kingwl
7b8c3a9b40
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn instead — wrapped so the process and its children run confined — plus the enforcement completeness and the backend denial/runner-failure dialects; no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides per call. dsh-sandbox-local selects by platform and caches the verdict: multi-candidate chains probe FUNCTIONALLY in preference order (Linux: bwrap → the registry-installed node-addon-landlock-run launcher), a sole candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails closed at execution via runnerFailureSignatures; win32 is a reserved empty chain. Profile parity is honest per backend (documented temp-area and ABI differences; enforcement full|partial is a structured result fact). CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap, Landlock per architecture through the registry-installed launcher, Seatbelt), failing on a silent all-skip; the packed-install rehearsal installs the launcher family from the registry and asserts the binary executable apart from kernel enforcement.
86 lines
3.5 KiB
JSON
86 lines
3.5 KiB
JSON
{
|
|
"extends": "./tsconfig.base.json",
|
|
"compilerOptions": {
|
|
"noEmit": true,
|
|
"rewriteRelativeImportExtensions": false
|
|
},
|
|
"include": [
|
|
"examples/*/src/**/*.ts",
|
|
"examples/*/start.ts",
|
|
"examples/*/tests/**/*.ts",
|
|
"packages/*/*/tests/**/*.ts",
|
|
"scripts/**/*.ts"
|
|
],
|
|
"references": [
|
|
{ "path": "./vendor/cosmokit" },
|
|
{ "path": "./vendor/schemastery" },
|
|
{ "path": "./vendor/cordis" },
|
|
{ "path": "./vendor/loader" },
|
|
{ "path": "./vendor/include" },
|
|
{ "path": "./vendor/group" },
|
|
{ "path": "./vendor/timer" },
|
|
{ "path": "./vendor/hmr" },
|
|
{ "path": "./vendor/logger-console" },
|
|
{ "path": "./packages/util/brand" },
|
|
{ "path": "./packages/util/timeout" },
|
|
{ "path": "./packages/llm/llm" },
|
|
{ "path": "./packages/core/session" },
|
|
{ "path": "./packages/session-persistence/session-persistence" },
|
|
{ "path": "./packages/session-persistence/session-persistence-jsonl" },
|
|
{ "path": "./packages/session-persistence/session-persistence-sqlite" },
|
|
{ "path": "./packages/core/system-prompt" },
|
|
{ "path": "./packages/approval/approval" },
|
|
{ "path": "./packages/sandbox/sandbox" },
|
|
{ "path": "./packages/sandbox/sandbox-local" },
|
|
{ "path": "./packages/core/agent" },
|
|
{ "path": "./packages/ui/user-interaction" },
|
|
{ "path": "./packages/core/tools" },
|
|
{ "path": "./packages/ui/tool-ask-user" },
|
|
{ "path": "./packages/core/agent-loop" },
|
|
{ "path": "./packages/core/agent-core" },
|
|
{ "path": "./packages/bash/bash" },
|
|
{ "path": "./packages/code-runtime/code-runtime" },
|
|
{ "path": "./packages/code-runtime/code-runtime-worker" },
|
|
{ "path": "./packages/llm/llm-deepseek" },
|
|
{ "path": "./packages/llm/llm-pi-ai" },
|
|
{ "path": "./packages/bash/bash-local" },
|
|
{ "path": "./packages/bash/tool-bash" },
|
|
{ "path": "./packages/fs/fs" },
|
|
{ "path": "./packages/fs/fs-local" },
|
|
{ "path": "./packages/fs/fs-policy" },
|
|
{ "path": "./packages/fs/tool-fs" },
|
|
{ "path": "./packages/compact/compact" },
|
|
{ "path": "./packages/compact/compact-basic" },
|
|
{ "path": "./packages/web/web" },
|
|
{ "path": "./packages/web/web-search-exa" },
|
|
{ "path": "./packages/web/web-search-perplexity" },
|
|
{ "path": "./packages/web/web-search-deepseek" },
|
|
{ "path": "./packages/web/web-fetch-local" },
|
|
{ "path": "./packages/web/tool-web" },
|
|
{ "path": "./packages/timeout/timeout-policy" },
|
|
{ "path": "./packages/support/invariants" },
|
|
{ "path": "./packages/ui/acp" },
|
|
{ "path": "./packages/ui/acp-agent" },
|
|
{ "path": "./packages/ui/app-boot" },
|
|
{ "path": "./packages/ui/stdio-agent" },
|
|
{ "path": "./packages/support/llm-replay" },
|
|
{ "path": "./packages/support/acp-snapshot" },
|
|
{ "path": "./packages/subagent/subagent" },
|
|
{ "path": "./packages/support/subagent-mock" },
|
|
{ "path": "./packages/subagent/tool-subagent" },
|
|
{ "path": "./packages/subagent/subagent-inprocess" },
|
|
{ "path": "./packages/subagent/subagent-spawn" },
|
|
{ "path": "./packages/subagent/subagent-fork" },
|
|
{ "path": "./packages/subagent/subagent-acp" },
|
|
{ "path": "./packages/workflow/workflow" },
|
|
{ "path": "./packages/workflow/workflow-workerthread" },
|
|
{ "path": "./packages/workflow/tool-workflow" },
|
|
{ "path": "./packages/todo/tool-todo" },
|
|
{ "path": "./packages/guard/repeat-tool-guard" },
|
|
{ "path": "./packages/cordis/tool-cordis" },
|
|
{ "path": "./packages/hooks/hook-protocol" },
|
|
{ "path": "./packages/hooks/hooks-claude" },
|
|
{ "path": "./packages/hooks/hooks-codex" }
|
|
]
|
|
}
|