mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-08-30 04:40:37 +00:00
99 lines
4.6 KiB
TypeScript
99 lines
4.6 KiB
TypeScript
/** The unchanged sandbox-local → bash-sandbox → subprocess stack over the Worker Node layer. */
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
|
|
import { Context } from '@deepseek-ai/cordis'
|
|
import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'
|
|
import LocalSandboxProvider from '@deepseek-ai/dsh-sandbox-local'
|
|
import { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
|
|
import LocalSubprocessRuntime from '@deepseek-ai/dsh-subprocess-local'
|
|
import { MemoryVfs } from '../../src/storage/memory.ts'
|
|
import { setActiveVfs } from '../../src/storage/active.ts'
|
|
import { processAlive, signalProcess } from '../../src/node/process-table.ts'
|
|
|
|
vi.mock('node:child_process', async () => await import('../../src/node/builtin_modules/implemented/child_process.ts'))
|
|
|
|
const WORKSPACE = '/dsh/workspace'
|
|
const OUTSIDE = '/dsh/home'
|
|
let vfs: MemoryVfs
|
|
const contexts: Context[] = []
|
|
|
|
beforeEach(() => {
|
|
vfs = new MemoryVfs()
|
|
setActiveVfs(vfs)
|
|
vfs.mkdirSync(WORKSPACE, { recursive: true })
|
|
vfs.mkdirSync(OUTSIDE, { recursive: true })
|
|
vfs.mkdirSync('/dsh/tmp', { recursive: true })
|
|
vi.spyOn(process, 'kill').mockImplementation((pid: number, signal?: string | number): true => {
|
|
if (signal === 0) {
|
|
if (processAlive(pid)) return true
|
|
const error = new Error('kill ESRCH') as NodeJS.ErrnoException
|
|
error.code = 'ESRCH'
|
|
throw error
|
|
}
|
|
signalProcess(pid, (signal ?? 'SIGTERM') as NodeJS.Signals)
|
|
return true
|
|
})
|
|
})
|
|
|
|
afterEach(async () => {
|
|
await Promise.all(contexts.splice(0).map(async (ctx) => { await ctx.fiber.dispose() }))
|
|
vi.restoreAllMocks()
|
|
})
|
|
|
|
/** Boot the production providers while only their platform primitives are replaced. */
|
|
async function setup(mode: 'read-only' | 'workspace-write' | 'danger-full-access'): Promise<SandboxBashExecutor> {
|
|
const ctx = new Context()
|
|
contexts.push(ctx)
|
|
await ctx.plugin(LocalSandboxProvider)
|
|
await ctx.plugin(SandboxPolicyService, { mode, workspaceRoot: WORKSPACE })
|
|
await ctx.plugin(LocalSubprocessRuntime)
|
|
await ctx.plugin(SandboxBashExecutor, { cwd: WORKSPACE })
|
|
return ctx.shell as SandboxBashExecutor
|
|
}
|
|
|
|
describe('Worker Landlock through the production sandbox stack', () => {
|
|
it('allows workspace and temp writes while classifying an outside write as denied', async () => {
|
|
const bash = await setup('workspace-write')
|
|
const allowed = await bash.run(bash.resolve({
|
|
command: `echo workspace > ${WORKSPACE}/allowed.txt; echo temp > /tmp/allowed.txt`,
|
|
}))
|
|
expect(allowed.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement: 'full' })
|
|
expect(vfs.readFileSync(`${WORKSPACE}/allowed.txt`, 'utf8')).toBe('workspace\n')
|
|
expect(vfs.readFileSync('/dsh/tmp/allowed.txt', 'utf8')).toBe('temp\n')
|
|
|
|
const denied = await bash.run(bash.resolve({ command: `echo denied > ${OUTSIDE}/denied.txt` }))
|
|
expect(denied.exitCode).toBe(1)
|
|
expect(denied.sandbox).toEqual({ mode: 'workspace-write', denied: true, enforcement: 'full' })
|
|
expect(vfs.existsSync(`${OUTSIDE}/denied.txt`)).toBe(false)
|
|
})
|
|
|
|
it('keeps read-only confined and danger-full-access unwrapped', async () => {
|
|
const readOnly = await setup('read-only')
|
|
const strict = await readOnly.run(readOnly.resolve({
|
|
command: `echo discarded > /dev/null; echo denied > ${WORKSPACE}/strict.txt`,
|
|
}))
|
|
expect(strict.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement: 'full' })
|
|
expect(vfs.existsSync(`${WORKSPACE}/strict.txt`)).toBe(false)
|
|
|
|
const unrestricted = await setup('danger-full-access')
|
|
const result = await unrestricted.run(unrestricted.resolve({ command: `echo allowed > ${OUTSIDE}/full.txt` }))
|
|
expect(result.sandbox).toEqual({ mode: 'danger-full-access', denied: false })
|
|
expect(vfs.readFileSync(`${OUTSIDE}/full.txt`, 'utf8')).toBe('allowed\n')
|
|
})
|
|
|
|
it('does not leak a concurrent command policy into another process', async () => {
|
|
const bash = await setup('read-only')
|
|
const strict = bash.run(bash.resolve({
|
|
command: `sleep 0.02; echo denied > ${WORKSPACE}/strict.txt`,
|
|
}))
|
|
const writable = bash.run(bash.resolve({
|
|
command: `echo allowed > ${WORKSPACE}/writable.txt`,
|
|
sandboxPolicy: { mode: 'workspace-write', workspaceRoot: WORKSPACE },
|
|
}))
|
|
const [strictResult, writableResult] = await Promise.all([strict, writable])
|
|
expect(strictResult.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement: 'full' })
|
|
expect(writableResult.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement: 'full' })
|
|
expect(vfs.existsSync(`${WORKSPACE}/strict.txt`)).toBe(false)
|
|
expect(vfs.readFileSync(`${WORKSPACE}/writable.txt`, 'utf8')).toBe('allowed\n')
|
|
})
|
|
})
|