Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(sandbox): defer native protocol exports (round 3)

Browse Source
This commit is contained in:
Hypatia May
2026-08-04 13:37:33 +08:00
parent 319376ef1c
commit f91aedd074
14 changed files with 44 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
packages/sandbox/sandbox-local/src/index.ts
View File

@@ -8,9 +8,8 @@
import { spawnSync } from 'node:child_process'
import {
LAUNCHER_FATAL_PREFIX,
LAUNCHER_BIN,
LAUNCHER_FAILURE_EXIT,
PARTIAL_ENFORCEMENT_NOTICE,
launcherPath as landlockLauncherPath,
probe as defaultProbeLandlock,
} from 'node-addon-landlock-run'
@@ -157,8 +156,8 @@ const RUNNER_FAILURE_RULES = {
bwrap: [{ fatalSignatures: ['bwrap: '] }],
landlock: [{
allowedExitCodes: [LAUNCHER_FAILURE_EXIT],
fatalSignatures: [LAUNCHER_FATAL_PREFIX],
informationalLines: [PARTIAL_ENFORCEMENT_NOTICE],
fatalSignatures: [`${LAUNCHER_BIN}: `],
informationalLines: [`${LAUNCHER_BIN}: partial enforcement (older Landlock ABI)`],
}],
seatbelt: [{ fatalSignatures: ['sandbox-exec: '] }],
} as const satisfies Record<SelectedRunner['runner'], readonly RunnerFailureRule[]>

10
packages/sandbox/sandbox-local/tests/local.spec.ts
View File

@@ -12,11 +12,7 @@ import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { describe, expect, it, vi } from 'vitest'
import { Context } from 'cordis'
import {
LAUNCHER_FAILURE_EXIT,
LAUNCHER_FATAL_PREFIX,
PARTIAL_ENFORCEMENT_NOTICE,
} from 'node-addon-landlock-run'
import { LAUNCHER_FAILURE_EXIT } from 'node-addon-landlock-run'
import { SANDBOX_UNAVAILABLE, SandboxUnavailableError } from '@deepseek-ai/dsh-sandbox'
import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
import {
@@ -179,8 +175,8 @@ describe('the platform chains', () => {
denialSignatures: ['permission denied'],
runnerFailureRules: [{
allowedExitCodes: [LAUNCHER_FAILURE_EXIT],
fatalSignatures: [LAUNCHER_FATAL_PREFIX],
informationalLines: [PARTIAL_ENFORCEMENT_NOTICE],
fatalSignatures: ['landlock-run: '],
informationalLines: ['landlock-run: partial enforcement (older Landlock ABI)'],
}],
})
expect(probeLandlock).toHaveBeenCalledWith(launcher)