DeepSeek/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: reserve seam for complete capabilities

Browse Source
This commit is contained in:
Turtle
2026-08-09 15:34:32 +08:00
parent 27ac49e687
commit dda02250f5
966 changed files with 2166 additions and 2159 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
native/landlock-run/AGENTS.md
View File

@@ -18,10 +18,10 @@ The project is pre-1.0. Prefer the correct public shape over compatibility shims
## Repository layout
```text
packages/entry/ Published entry package: JS seam (resolve/probe/grants) + the C source.
packages/entry/ Published entry package: JavaScript API (resolve/probe/grants) + the C source.
packages/linux-*/ Published per-platform packages: one prebuilt static binary, no JavaScript.
scripts/ Build, matrix derivation, prepack gates, and release orchestration.
test/ Plain-node behavioral tests (entry seam + real-kernel launcher proofs).
test/ Plain-node behavioral tests (entry API + real-kernel launcher proofs).
docs/ Architecture, packaging, CLI contract, release, support matrix, naming.
```

2
native/landlock-run/docs/architecture.md
View File

@@ -1,6 +1,6 @@
# Architecture
This repository owns confinement *mechanism*, not policy: consumers (agent harnesses, sandbox seams) decide which paths a run may read or write; this package family provides the launcher that enforces those grants and the JS seam that resolves and speaks to it. The packaging follows the per-platform-package model of [`node-addon-require-builtin`](https://www.npmjs.com/package/@esplus/node-addon-require-builtin) (and esbuild), adapted from Node addons to standalone static executables.
This repository owns confinement *mechanism*, not policy: consumers (agent harnesses and sandbox capabilities) decide which paths a run may read or write; this package family provides the launcher that enforces those grants and the JavaScript API that resolves and speaks to it. The packaging follows the per-platform-package model of [`node-addon-require-builtin`](https://www.npmjs.com/package/@esplus/node-addon-require-builtin) (and esbuild), adapted from Node addons to standalone static executables.
## Two-layer package family

4
native/landlock-run/packages/entry/src/index.ts
View File

@@ -1,5 +1,5 @@
/**
* The JS seam over the prebuilt `landlock-run` launcher: resolve the
* The JavaScript API over the prebuilt `landlock-run` launcher: resolve the
* binary for this host, build its grant argv, and run its functional probe.
*
* This module owns the launcher's CLI contract (`docs/cli-contract.md`) so
@@ -61,7 +61,7 @@ export interface LauncherGrants {
* deliberately not checked either way: {@link probe} is the single
* availability signal (a missing binary probes `unusable` the same way an
* unenforcing kernel does).
* @param resolvePackageJson - test seam over `require.resolve` (the default
* @param resolvePackageJson - test hook over `require.resolve` (the default
* covers real installs); receives the platform package's `package.json`
* specifier and returns its absolute path, throwing when unresolvable.
* @returns the absolute launcher path to probe and exec.

2
native/landlock-run/test/entry.test.js
View File

@@ -1,6 +1,6 @@
/**
* Keyless entry-package tests — run on every host, no kernel or binary
* required. Cover the JS seam's pure surface: grant-argv construction, the
* required. Cover the JavaScript API's pure surface: grant-argv construction, the
* resolution contract (platform package → fallback), and probe verdicts over
* fake launchers. Requires built `lib/` (`pnpm build:ts`).
*/