kingwl
7b8c3a9b40
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn instead — wrapped so the process and its children run confined — plus the enforcement completeness and the backend denial/runner-failure dialects; no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides per call. dsh-sandbox-local selects by platform and caches the verdict: multi-candidate chains probe FUNCTIONALLY in preference order (Linux: bwrap → the registry-installed node-addon-landlock-run launcher), a sole candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails closed at execution via runnerFailureSignatures; win32 is a reserved empty chain. Profile parity is honest per backend (documented temp-area and ABI differences; enforcement full|partial is a structured result fact). CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap, Landlock per architecture through the registry-installed launcher, Seatbelt), failing on a silent all-skip; the packed-install rehearsal installs the launcher family from the registry and asserts the binary executable apart from kernel enforcement.
67 lines
2.4 KiB
JSON
67 lines
2.4 KiB
JSON
{
|
|
"compilerOptions": {
|
|
"target": "es2024",
|
|
"module": "esnext",
|
|
"moduleResolution": "bundler",
|
|
"declaration": true,
|
|
"sourceMap": true,
|
|
"declarationMap": true,
|
|
"composite": true,
|
|
"incremental": true,
|
|
"skipLibCheck": true,
|
|
"esModuleInterop": true,
|
|
"allowImportingTsExtensions": true,
|
|
"rewriteRelativeImportExtensions": true,
|
|
"verbatimModuleSyntax": false,
|
|
"strict": true,
|
|
"noUncheckedIndexedAccess": true,
|
|
"exactOptionalPropertyTypes": true,
|
|
"noImplicitOverride": true,
|
|
"noFallthroughCasesInSwitch": true,
|
|
"noUnusedLocals": true,
|
|
"noUnusedParameters": true,
|
|
"types": ["node"],
|
|
// Source-level resolution for every repo-local graph. Project references,
|
|
// not declaration path aliases, keep each package/vendor source compiled
|
|
// under its own tsconfig boundary.
|
|
"paths": {
|
|
"cordis": ["./vendor/cordis/src"],
|
|
"cosmokit": ["./vendor/cosmokit/src"],
|
|
"schemastery": ["./vendor/schemastery/src"],
|
|
"@cordisjs/plugin-loader": ["./vendor/loader/src"],
|
|
"@cordisjs/plugin-include": ["./vendor/include/src"],
|
|
"@cordisjs/plugin-group": ["./vendor/group/src"],
|
|
"@cordisjs/plugin-timer": ["./vendor/timer/src"],
|
|
"@cordisjs/plugin-hmr": ["./vendor/hmr/src"],
|
|
"@cordisjs/plugin-logger-console": ["./vendor/logger-console/src"],
|
|
// One wildcard maps every @deepseek-ai/dsh-<name> to its source. Package
|
|
// dir names are unique across groups, so first-on-disk-wins resolution is
|
|
// unambiguous; adding a package under an existing group needs no edit
|
|
// here. The build graph's project references (tsconfig.build.json) stay
|
|
// explicit — TS project references have no wildcard form.
|
|
"@deepseek-ai/dsh-*": [
|
|
"./packages/approval/*/src",
|
|
"./packages/core/*/src",
|
|
"./packages/sandbox/*/src",
|
|
"./packages/llm/*/src",
|
|
"./packages/bash/*/src",
|
|
"./packages/code-runtime/*/src",
|
|
"./packages/fs/*/src",
|
|
"./packages/compact/*/src",
|
|
"./packages/guard/*/src",
|
|
"./packages/subagent/*/src",
|
|
"./packages/workflow/*/src",
|
|
"./packages/web/*/src",
|
|
"./packages/timeout/*/src",
|
|
"./packages/todo/*/src",
|
|
"./packages/cordis/*/src",
|
|
"./packages/hooks/*/src",
|
|
"./packages/session-persistence/*/src",
|
|
"./packages/ui/*/src",
|
|
"./packages/util/*/src",
|
|
"./packages/support/*/src"
|
|
]
|
|
}
|
|
}
|
|
}
|