mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
acac2149a5
The Windows platform layer previously kept fs path-rule confinement (sandbox-policy + fs-sandbox) next to the unconfined pwsh shell. Windows has no OS sandbox runner (landlock/bwrap/seatbelt are POSIX-only), so the shell can bypass fs-only path rules with one command — the policy was theater. The layer now removes the whole sandbox stack (sandbox, sandbox-policy, fs-sandbox disabled), mounts the unconfined dsh-fs-local, and degrades to danger-full-access: permission/ui-permission leave the roster and the approval policy is 'never'. dsh-base declares dsh-fs-local so the profile module fallback links it for cold starts; base.spec.ts pins the shipped Windows roster (disables, inserts, approval policy); the Agent Note records the rejected fs-only confinement alternative.
73 lines
2.6 KiB
TypeScript
73 lines
2.6 KiB
TypeScript
/**
|
|
* The bundle's substance is its patch file: the `dsh.bundle.patch` manifest
|
|
* field must name a real, parseable patch list.
|
|
*/
|
|
|
|
import { readFileSync } from 'node:fs'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { resolve } from 'node:path'
|
|
import { describe, expect, it } from 'vitest'
|
|
import * as yaml from 'js-yaml'
|
|
import { entryListSchema } from '@cordisjs/plugin-include'
|
|
|
|
describe('dsh-base bundle', () => {
|
|
it('declares a parseable patch list through the dsh.bundle.patch manifest field', () => {
|
|
const root = fileURLToPath(new URL('..', import.meta.url))
|
|
const manifest = JSON.parse(
|
|
readFileSync(resolve(root, 'package.json'), 'utf8'),
|
|
) as { dsh?: { bundle?: { patch?: string } } }
|
|
expect(manifest.dsh?.bundle?.patch).toBe('./cordis.patch.yml')
|
|
const parsed = yaml.load(
|
|
readFileSync(resolve(root, manifest.dsh!.bundle!.patch!), 'utf8'),
|
|
{ schema: entryListSchema },
|
|
)
|
|
expect(Array.isArray(parsed)).toBe(true)
|
|
// The base layer is one insert list over the empty profile root.
|
|
const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(
|
|
patch => patch.insert ?? [],
|
|
)
|
|
expect(rows.length).toBeGreaterThan(50)
|
|
expect(rows.some(row => row.id === 'agent-loop')).toBe(true)
|
|
})
|
|
|
|
it('ships the Windows platform layer as the documented danger-full-access roster', () => {
|
|
const root = fileURLToPath(new URL('..', import.meta.url))
|
|
const parsed = yaml.load(
|
|
readFileSync(resolve(root, 'windows.cordis.patch.yml'), 'utf8'),
|
|
{ schema: entryListSchema },
|
|
) as {
|
|
id?: string
|
|
disabled?: boolean
|
|
insert?: { id?: string; name?: string }[]
|
|
config?: { policy?: string }
|
|
}[]
|
|
const disables = parsed
|
|
.filter(patch => patch.disabled === true)
|
|
.map(patch => patch.id)
|
|
// The POSIX-only sandboxed stacks leave the Windows roster as one unit:
|
|
// shell (bash-sandbox/tool-bash), the permission switcher it requires,
|
|
// and the fs/sandbox policy stack whose OS runners do not exist on win32.
|
|
expect(disables).toEqual(
|
|
expect.arrayContaining([
|
|
'bash-sandbox',
|
|
'tool-bash',
|
|
'permission',
|
|
'ui-permission',
|
|
'sandbox',
|
|
'sandbox-policy',
|
|
'fs-sandbox',
|
|
]),
|
|
)
|
|
const inserted = parsed
|
|
.flatMap(patch => patch.insert ?? [])
|
|
.map(row => row.id)
|
|
expect(inserted).toEqual(
|
|
expect.arrayContaining(['pwsh-local', 'tool-pwsh', 'fs-local']),
|
|
)
|
|
// Full danger-full-access degradation: no approval prompts on Windows.
|
|
expect(parsed.find(patch => patch.id === 'approval')?.config).toEqual({
|
|
policy: 'never',
|
|
})
|
|
})
|
|
})
|