kingwl
7b8c3a9b40
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn instead — wrapped so the process and its children run confined — plus the enforcement completeness and the backend denial/runner-failure dialects; no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides per call. dsh-sandbox-local selects by platform and caches the verdict: multi-candidate chains probe FUNCTIONALLY in preference order (Linux: bwrap → the registry-installed node-addon-landlock-run launcher), a sole candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails closed at execution via runnerFailureSignatures; win32 is a reserved empty chain. Profile parity is honest per backend (documented temp-area and ABI differences; enforcement full|partial is a structured result fact). CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap, Landlock per architecture through the registry-installed launcher, Seatbelt), failing on a silent all-skip; the packed-install rehearsal installs the launcher family from the registry and asserts the binary executable apart from kernel enforcement.
94 lines
3.3 KiB
JSON
94 lines
3.3 KiB
JSON
{
|
|
"$schema": "https://unpkg.com/knip@5/schema.json",
|
|
"exclude": ["duplicates"],
|
|
"ignoreWorkspaces": ["vendor/*"],
|
|
"ignoreBinaries": ["bwrap", "sandbox-exec"],
|
|
"workspaces": {
|
|
".": {
|
|
"entry": [
|
|
"examples/echo-agent/src/*.ts",
|
|
"examples/echo-agent/tests/**/*.e2e.ts",
|
|
"examples/coding-agent/tests/**/*.e2e.ts",
|
|
"examples/cordis-agent/tests/**/*.e2e.ts",
|
|
"examples/acp-agent/tests/**/*.e2e.ts",
|
|
"examples/*/tests/**/*.snapshot.ts"
|
|
],
|
|
"project": ["scripts/**/*.ts", "examples/**/*.ts"]
|
|
},
|
|
"packages/sandbox/sandbox-local": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/*/*": {
|
|
"entry": ["tests/**/*.spec.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/util/brand": {
|
|
"project": ["src/**/*.ts"],
|
|
"ignoreDependencies": ["cordis"]
|
|
},
|
|
"packages/util/timeout": {
|
|
"entry": ["tests/**/*.spec.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"],
|
|
"ignoreDependencies": ["cordis"]
|
|
},
|
|
"packages/support/acp-snapshot": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/fixtures/fake-acp-agent.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"],
|
|
"ignoreDependencies": ["cordis"]
|
|
},
|
|
"packages/core/agent-loop": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/code-runtime/code-runtime-worker": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/llm/llm-deepseek": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/llm/llm-pi-ai": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/web/web-search-exa": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/web/web-search-perplexity": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/workflow/workflow-workerthread": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/web/web-search-deepseek": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/ui/acp-agent": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/ui/stdio-agent": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/subagent/subagent-spawn": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/subagent/subagent-acp": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts", "tests/mock-acp-server.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
},
|
|
"packages/fs/tool-fs": {
|
|
"entry": ["tests/**/*.spec.ts", "tests/**/*.e2e.ts"],
|
|
"project": ["src/**/*.ts", "tests/**/*.ts"]
|
|
}
|
|
}
|
|
}
|