@commonlyai/cli 0.1.194 → 0.1.196
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -17
- package/src/lib/sandbox/seatbelt.js +13 -2
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@commonlyai/cli",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.196",
|
|
4
4
|
"license": "Apache-2.0",
|
|
5
5
|
"description": "The Commonly CLI — connect agents, manage pods, iterate fast",
|
|
6
6
|
"type": "module",
|
|
@@ -47,22 +47,6 @@
|
|
|
47
47
|
"eslint": "^8.56.0",
|
|
48
48
|
"jest": "^29.7.0"
|
|
49
49
|
},
|
|
50
|
-
"jest": {
|
|
51
|
-
"testEnvironment": "node",
|
|
52
|
-
"setupFiles": [
|
|
53
|
-
"<rootDir>/jest.setup.cjs"
|
|
54
|
-
],
|
|
55
|
-
"setupFilesAfterEnv": [
|
|
56
|
-
"<rootDir>/jest.teardown.cjs"
|
|
57
|
-
],
|
|
58
|
-
"transform": {},
|
|
59
|
-
"testMatch": [
|
|
60
|
-
"**/__tests__/**/*.[jt]s?(x)",
|
|
61
|
-
"**/__tests__/**/*.mjs",
|
|
62
|
-
"**/?(*.)+(spec|test).[jt]s?(x)",
|
|
63
|
-
"**/?(*.)+(spec|test).mjs"
|
|
64
|
-
]
|
|
65
|
-
},
|
|
66
50
|
"engines": {
|
|
67
51
|
"node": ">=20.0.0"
|
|
68
52
|
},
|
|
@@ -289,7 +289,6 @@ const OPEN_NETWORK = String.raw`
|
|
|
289
289
|
(socket-protocol 2)))
|
|
290
290
|
(allow mach-lookup
|
|
291
291
|
(global-name "com.apple.SecurityServer")
|
|
292
|
-
(global-name "com.apple.SystemConfiguration.DNSConfiguration")
|
|
293
292
|
(global-name "com.apple.SystemConfiguration.configd")
|
|
294
293
|
(global-name "com.apple.networkd")
|
|
295
294
|
(global-name "com.apple.ocspd")
|
|
@@ -297,6 +296,18 @@ const OPEN_NETWORK = String.raw`
|
|
|
297
296
|
(global-name "com.apple.securityd.xpc"))
|
|
298
297
|
`;
|
|
299
298
|
|
|
299
|
+
// Both network modes. On macOS, c-ares (node's dns.Resolver and dns.resolve*)
|
|
300
|
+
// reads the resolver list from configd's DNSConfiguration service while the
|
|
301
|
+
// Resolver is constructed. Denied, that lookup does not always fail: at
|
|
302
|
+
// times it blocks the main thread forever. dsh builds a Resolver as it loads,
|
|
303
|
+
// so confined turns ran to their 900 s timeout without sending a request
|
|
304
|
+
// (D106). Admitted, resolution fails fast, because mDNSResponder and port 53
|
|
305
|
+
// stay unreachable in a loopback profile. The service returns configuration
|
|
306
|
+
// and opens no channel out.
|
|
307
|
+
const RESOLVER_CONFIG = String.raw`
|
|
308
|
+
(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration"))
|
|
309
|
+
`;
|
|
310
|
+
|
|
300
311
|
const escapeSbplString = (value) => String(value)
|
|
301
312
|
.replaceAll('\\', '\\\\')
|
|
302
313
|
.replaceAll('"', '\\"')
|
|
@@ -466,7 +477,7 @@ export const buildSeatbeltProfile = ({
|
|
|
466
477
|
})() : [];
|
|
467
478
|
|
|
468
479
|
return [
|
|
469
|
-
|
|
480
|
+
`${PLATFORM_BASELINE}${RESOLVER_CONFIG}${network === 'open' ? OPEN_NETWORK : ''}`.trim(),
|
|
470
481
|
executableRules,
|
|
471
482
|
executableSymlinkRules,
|
|
472
483
|
`(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedWorkspace)}"))`,
|