Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(sandbox): defer native protocol exports (round 3)

Browse Source
This commit is contained in:
Hypatia May
2026-08-04 13:37:33 +08:00
parent 319376ef1c
commit f91aedd074
14 changed files with 44 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
native/landlock-run/test/entry.test.js
View File

@@ -12,8 +12,6 @@ import path from 'node:path';
import {
LAUNCHER_BIN,
LAUNCHER_FAILURE_EXIT,
LAUNCHER_FATAL_PREFIX,
PARTIAL_ENFORCEMENT_NOTICE,
grantArgs,
launcherPath,
probe,
@@ -22,8 +20,6 @@ import {
// --- constants are part of the CLI contract ---
assert.equal(LAUNCHER_BIN, 'landlock-run');
assert.equal(LAUNCHER_FAILURE_EXIT, 125);
assert.equal(LAUNCHER_FATAL_PREFIX, 'landlock-run: ');
assert.equal(PARTIAL_ENFORCEMENT_NOTICE, 'landlock-run: partial enforcement (older Landlock ABI)');
// --- grantArgs: flag spelling, ordering, and empty grants ---
assert.deepEqual(grantArgs({}), []);

10
native/landlock-run/test/launcher.test.js
View File

@@ -19,13 +19,13 @@ import path from 'node:path';
import { spawnSync } from 'node:child_process';
import {
LAUNCHER_FAILURE_EXIT,
LAUNCHER_FATAL_PREFIX,
PARTIAL_ENFORCEMENT_NOTICE,
grantArgs,
launcherPath,
probe,
} from 'node-addon-landlock-run';
const FATAL_PREFIX = 'landlock-run: ';
const PARTIAL_NOTICE = 'landlock-run: partial enforcement (older Landlock ABI)';
const requireLandlock = process.env.NALR_REQUIRE_LANDLOCK === '1';
if (process.platform !== 'linux') {
@@ -45,7 +45,7 @@ const run = (args, options = {}) => spawnSync(launcher, args, { encoding: 'utf8'
{
const noCommand = run([]);
assert.equal(noCommand.status, LAUNCHER_FAILURE_EXIT);
assert.ok(noCommand.stderr.startsWith(LAUNCHER_FATAL_PREFIX));
assert.ok(noCommand.stderr.startsWith(FATAL_PREFIX));
assert.match(noCommand.stderr, /usage error: missing `-- <argv>\.\.\.` command/);
const unknownFlag = run(['--bogus', '--', 'true']);
@@ -78,7 +78,7 @@ if (enforcement === 'unusable') {
console.log('launcher.test: SKIP enforcement half — kernel does not enforce Landlock');
process.exit(0);
}
const expectedNotice = enforcement === 'partial' ? `${PARTIAL_ENFORCEMENT_NOTICE}\n` : '';
const expectedNotice = enforcement === 'partial' ? `${PARTIAL_NOTICE}\n` : '';
{
const probeRun = run(['--probe']);
assert.equal(probeRun.status, 0);
@@ -129,7 +129,7 @@ const expectedNotice = enforcement === 'partial' ? `${PARTIAL_ENFORCEMENT_NOTICE
const marker = path.join(os.tmpdir(), `nalr-should-not-exist-${process.pid}`);
const badGrant = run(['--ro', '/no/such/grant/root', '--', '/bin/sh', '-c', `echo x > ${marker}`]);
assert.equal(badGrant.status, LAUNCHER_FAILURE_EXIT);
assert.ok(badGrant.stderr.startsWith(LAUNCHER_FATAL_PREFIX));
assert.ok(badGrant.stderr.startsWith(FATAL_PREFIX));
assert.match(badGrant.stderr, /cannot open rule path/);
assert.ok(!fs.existsSync(marker), 'the command must never run when the launcher fails');
}