kingwl
2dc62497ce
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox RFC's deferred cross-family phase. - dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the deployment default mode + workspaceRoot and the per-session override event, renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter. Decouples the bash seam from dsh-session. - dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences write/edit by the per-call mode (read-only denies, workspace-write contains to the workspace + temp roots via the shared writableRoots, danger passes through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent re-canonicalization. A policy fence in trusted code, not a kernel boundary. - dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider ladder, denial/hint markers, approveEscalation) both tool families use; approveEscalation takes a structural approver so dsh-sandbox gains no approval/agent dependency, and both tools stay duplication-free. - tool-fs: write/edit advertise sandbox_permissions/justification under a confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker, and resolve the same one-approved-wider retry. - examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating that disabled the fs stack under confined modes. RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
103 lines
5.0 KiB
TypeScript
103 lines
5.0 KiB
TypeScript
import { spawnSync } from 'node:child_process'
|
|
import { existsSync, readFileSync } from 'node:fs'
|
|
import { mkdtemp, rm } from 'node:fs/promises'
|
|
import { homedir, tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { afterEach, describe, expect, it } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import { launcherPath } from 'node-addon-landlock-run'
|
|
import { LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'
|
|
import { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
|
|
import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'
|
|
|
|
/**
|
|
* KEYLESS consumer-integration proof: the REAL `LocalSandboxProvider` (bwrap
|
|
* rung forced off, so the npm-distributed `landlock-run` confines) underneath the
|
|
* REAL `SandboxBashExecutor`, driven through the executor's public run/start
|
|
* paths. Verifies the WORLD (files exist or don't) plus the stamped result
|
|
* facts; the backend-only confinement proofs live with
|
|
* `@deepseek-ai/dsh-sandbox-local`.
|
|
*
|
|
* Self-skips when the running kernel does not enforce Landlock; the
|
|
* launcher binary itself arrives with `pnpm install` (`node-addon-landlock-run`).
|
|
*/
|
|
|
|
const probe = spawnSync(launcherPath(), ['--probe'], { timeout: 5_000, encoding: 'utf8' })
|
|
const landlockUsable = probe.status === 0
|
|
/** The kernel's enforcement level from the probe report — stamped facts below must match it. */
|
|
const enforcement = /partially enforced/.test(probe.stdout ?? '') ? 'partial' : 'full'
|
|
|
|
let ctx: Context | undefined
|
|
const tempDirs: string[] = []
|
|
|
|
afterEach(async () => {
|
|
await ctx?.fiber.dispose()
|
|
ctx = undefined
|
|
await Promise.all(tempDirs.splice(0).map(dir => rm(dir, { recursive: true, force: true })))
|
|
})
|
|
|
|
async function tempDir(base: string): Promise<string> {
|
|
const dir = await mkdtemp(join(base, 'dsh-landlock-e2e-'))
|
|
tempDirs.push(dir)
|
|
return dir
|
|
}
|
|
|
|
async function sandboxedBash(workspace: string, mode: 'read-only' | 'workspace-write'): Promise<SandboxBashExecutor> {
|
|
ctx = new Context()
|
|
await ctx.plugin(LocalSandboxProvider, {})
|
|
;(ctx.sandbox as LocalSandboxProvider).internals = { probeBwrap: () => false }
|
|
await ctx.plugin(SandboxPolicyService, { mode, workspaceRoot: workspace })
|
|
await ctx.plugin(SandboxBashExecutor, { cwd: workspace, timeoutMs: 30_000 })
|
|
return ctx.bash as SandboxBashExecutor
|
|
}
|
|
|
|
describe.skipIf(!landlockUsable)('bash-sandbox: real Landlock confinement through ctx.bash', () => {
|
|
it('read-only denies a write — the file must NOT exist, the result carries denial + enforcement facts', async () => {
|
|
const workdir = await tempDir(tmpdir())
|
|
const bash = await sandboxedBash(workdir, 'read-only')
|
|
const result = await bash.run(bash.resolve({ command: `echo hi > ${workdir}/denied.txt` }))
|
|
expect(result.exitCode).not.toBe(0)
|
|
expect(result.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement })
|
|
expect(existsSync(join(workdir, 'denied.txt'))).toBe(false)
|
|
})
|
|
|
|
it('workspace-write lands a write inside the workspace root and still denies one beside it', async () => {
|
|
const workdir = await tempDir(homedir())
|
|
const outside = await tempDir(homedir())
|
|
const bash = await sandboxedBash(workdir, 'workspace-write')
|
|
|
|
const inside = await bash.run(bash.resolve({ command: `printf landlock-ok > ${workdir}/allowed.txt` }))
|
|
expect(inside.exitCode).toBe(0)
|
|
expect(inside.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement })
|
|
expect(readFileSync(join(workdir, 'allowed.txt'), 'utf8')).toBe('landlock-ok')
|
|
|
|
const denied = await bash.run(bash.resolve({ command: `echo hi > ${outside}/denied.txt` }))
|
|
expect(denied.exitCode).not.toBe(0)
|
|
expect(denied.sandbox).toEqual({ mode: 'workspace-write', denied: true, enforcement })
|
|
expect(existsSync(join(outside, 'denied.txt'))).toBe(false)
|
|
})
|
|
|
|
it('classifies a background denial once the task settles', async () => {
|
|
const workdir = await tempDir(homedir())
|
|
const bash = await sandboxedBash(workdir, 'read-only')
|
|
const task = bash.start(bash.resolve({ command: `echo hi > ${workdir}/bg-denied.txt` }))
|
|
await task.done
|
|
expect(task.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement })
|
|
expect(existsSync(join(workdir, 'bg-denied.txt'))).toBe(false)
|
|
})
|
|
|
|
it('an approved escalated retry — the spec-level workspace-write override — lands the exact write read-only denied', async () => {
|
|
const workdir = await tempDir(homedir())
|
|
const bash = await sandboxedBash(workdir, 'read-only')
|
|
const command = `printf escalated > ${workdir}/escalated.txt`
|
|
const strict = await bash.run(bash.resolve({ command }))
|
|
expect(strict.exitCode).not.toBe(0)
|
|
expect(strict.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement: enforcement })
|
|
expect(existsSync(join(workdir, 'escalated.txt'))).toBe(false)
|
|
const retried = await bash.run(bash.resolve({ command, sandboxMode: 'workspace-write' }))
|
|
expect(retried.exitCode).toBe(0)
|
|
expect(retried.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement: enforcement })
|
|
expect(readFileSync(join(workdir, 'escalated.txt'), 'utf8')).toBe('escalated')
|
|
})
|
|
})
|