@downcity/agent 1.1.283 → 1.1.285

package/scripts/linux-bubblewrap-sandbox.test.mjs

@@ -1,68 +0,0 @@
-/**
- * @file 验证 Linux Bubblewrap 参数对统一 Sandbox 策略的映射。
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-
-import { build_linux_bubblewrap_args } from "@downcity/shell/sandbox/backends/LinuxBubblewrap.js";
-
-function has_option_pair(args, option, source_path, target_path = source_path) {
-  for (let index = 0; index < args.length - 2; index += 1) {
-    if (
-      args[index] === option &&
-      args[index + 1] === source_path &&
-      args[index + 2] === target_path
-    ) return true;
-  }
-  return false;
-}
-
-test("Linux maps read paths to ro-bind and workspace to bind", async () => {
-  const fixture_root = await fs.mkdtemp(path.join(os.tmpdir(), "downcity-bwrap-"));
-  try {
-    const project_root = path.join(fixture_root, "project");
-    const tool_root = path.join(fixture_root, "tool");
-    await fs.mkdir(project_root, { recursive: true });
-    await fs.mkdir(tool_root, { recursive: true });
-    const request = {
-      execution_id: "sh_test",
-      execution_dir: path.join(project_root, ".downcity", "shell", "sh_test"),
-      cmd: "printf hello",
-      cwd: project_root,
-      shell_path: "/bin/sh",
-      login: true,
-      base_env: { PATH: "/usr/bin:/bin" },
-      policy: {
-        backend: "linux-bubblewrap",
-        root_path: project_root,
-        sandbox_dir: path.join(project_root, ".downcity", "sandbox"),
-        home_dir: path.join(project_root, ".downcity", "sandbox"),
-        tmp_dir: path.join(project_root, ".downcity", "sandbox", "tmp"),
-        cache_dir: path.join(project_root, ".downcity", "sandbox", ".cache"),
-        env_allowlist: ["PATH"],
-        read_only_paths: [tool_root],
-        read_write_paths: [project_root],
-        network_mode: "off",
-        fingerprint: "policy_test",
-      },
-    };
-    const args = build_linux_bubblewrap_args(request);
-    assert.equal(args.includes("--unshare-net"), true);
-    assert.equal(has_option_pair(args, "--ro-bind", tool_root), true);
-    assert.equal(has_option_pair(args, "--bind", tool_root), false);
-    assert.equal(has_option_pair(args, "--bind", project_root), true);
-    assert.deepEqual(args.slice(-5), [
-      "--chdir",
-      project_root,
-      "/bin/sh",
-      "-lc",
-      "printf hello",
-    ]);
-  } finally {
-    await fs.rm(fixture_root, { recursive: true, force: true });
-  }
-});

package/scripts/shell-sandbox-env.test.mjs

@@ -1,80 +0,0 @@
-/**
- * @file 验证 Safe Sandbox 环境变量收敛与临时目录映射。
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import path from "node:path";
-
-import { build_macos_sandbox_env } from "@downcity/shell/sandbox/backends/MacOsSeatbelt.js";
-import { build_linux_sandbox_env } from "@downcity/shell/sandbox/backends/LinuxBubblewrap.js";
-import { resolve_sandbox_policy } from "@downcity/shell/sandbox/SandboxPolicy.js";
-
-function create_request() {
-  const root_path = "/tmp/downcity-shell-env/project";
-  const sandbox_dir = path.join(root_path, ".downcity", "sandbox");
-  return {
-    execution_id: "sh_test",
-    execution_dir: path.join(root_path, ".downcity", "shell", "sh_test"),
-    cmd: "printf hello",
-    cwd: root_path,
-    shell_path: "/bin/zsh",
-    login: true,
-    base_env: {
-      PATH: "/usr/bin:/bin",
-      LANG: "C.UTF-8",
-      DC_SESSION_ID: "session_test",
-    },
-    policy: {
-      backend: "macos-seatbelt",
-      root_path,
-      sandbox_dir,
-      home_dir: sandbox_dir,
-      tmp_dir: path.join(sandbox_dir, "tmp"),
-      cache_dir: path.join(sandbox_dir, ".cache"),
-      env_allowlist: ["PATH", "LANG"],
-      read_only_paths: ["/usr", "/bin"],
-      read_write_paths: [root_path],
-      network_mode: "full",
-      fingerprint: "policy_test",
-    },
-  };
-}
-
-function assert_sandbox_tmp_env(env, tmp_dir) {
-  assert.equal(env.TMPDIR, tmp_dir);
-  assert.equal(env.TMP, tmp_dir);
-  assert.equal(env.TEMP, tmp_dir);
-  assert.equal(env.TEMPDIR, tmp_dir);
-  assert.equal(env.TMPPREFIX, path.join(tmp_dir, "zsh"));
-  assert.equal(env.DC_SANDBOX_TMP, tmp_dir);
-}
-
-test("macOS safe env points temporary variables at sandbox tmp", () => {
-  const request = create_request();
-  const env = build_macos_sandbox_env(request);
-  assert_sandbox_tmp_env(env, request.policy.tmp_dir);
-});
-
-test("Linux safe env points temporary variables at sandbox tmp", () => {
-  const request = create_request();
-  const env = build_linux_sandbox_env({
-    ...request,
-    policy: { ...request.policy, backend: "linux-bubblewrap" },
-  });
-  assert_sandbox_tmp_env(env, request.policy.tmp_dir);
-});
-
-test("safe policy exports explicit agent env keys only", async () => {
-  const policy = await resolve_sandbox_policy({
-    rootPath: "/tmp/downcity-shell-env/project",
-    env: {
-      DYNAMIC_ENV_REPRO: "dynamic_value",
-      DC_DYNAMIC_REPRO: "dc_value",
-    },
-  }, {});
-  assert.equal(policy.env_allowlist.includes("PATH"), true);
-  assert.equal(policy.env_allowlist.includes("DYNAMIC_ENV_REPRO"), true);
-  assert.equal(policy.env_allowlist.includes("DC_DYNAMIC_REPRO"), true);
-  assert.equal(policy.env_allowlist.includes("HOST_ONLY_ENV_REPRO"), false);
-});

package/scripts/shell-sandbox-preflight.test.mjs

@@ -1,157 +0,0 @@
-/**
- * @file 验证 shell sandbox 启动前依赖诊断。
- *
- * 关键点（中文）
- * - 测试编译后的 bin 输出，避免测试文件进入 package 源码导出面。
- * - 通过注入探针模拟 Linux 依赖状态，不要求当前测试机安装 bwrap。
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  checkShellSandboxPreflightWithProbe,
-} from "@downcity/shell/sandbox/SandboxPreflight.js";
-
-async function withPlatform(platform, callback) {
-  const previous = Object.getOwnPropertyDescriptor(process, "platform");
-  Object.defineProperty(process, "platform", {
-    configurable: true,
-    value: platform,
-  });
-  try {
-    return await callback();
-  } finally {
-    if (previous) {
-      Object.defineProperty(process, "platform", previous);
-    }
-  }
-}
-
-function createProbe(params) {
-  return {
-    commandExists: async (command) => params.commands?.has(command) === true,
-    readProcInt: async (filePath) => params.proc?.get(filePath) ?? null,
-    inspectWindowsMxcSupport: async () => params.windows_support || {
-      supported: true,
-      windows_build: 26100,
-      isolation_tier: "appcontainer-dacl",
-      warnings: [],
-    },
-  };
-}
-
-test("Linux shell sandbox preflight reports missing bwrap and disabled userns", async () => {
-  await withPlatform("linux", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(),
-      proc: new Map([
-        ["/proc/sys/kernel/unprivileged_userns_clone", 0],
-        ["/proc/sys/user/max_user_namespaces", 0],
-      ]),
-    }));
-
-    assert.equal(result.ok, false);
-    assert.equal(result.backend, "linux-bubblewrap");
-    assert.deepEqual(
-      result.issues.map((issue) => issue.code),
-      ["missing-command", "userns-disabled"],
-    );
-    assert.match(result.issues[0].message, /bubblewrap/);
-    assert.match(result.issues[1].message, /user namespaces/);
-  });
-});
-
-test("Linux shell sandbox preflight accepts bwrap with enabled userns", async () => {
-  await withPlatform("linux", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(["bwrap"]),
-      proc: new Map([
-        ["/proc/sys/kernel/unprivileged_userns_clone", 1],
-        ["/proc/sys/user/max_user_namespaces", 1024],
-      ]),
-    }));
-
-    assert.equal(result.ok, true);
-    assert.equal(result.backend, "linux-bubblewrap");
-    assert.deepEqual(result.issues, []);
-  });
-});
-
-test("Windows MXC development sandbox accepts a supported runtime", async () => {
-  await withPlatform("win32", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(["cmd.exe"]),
-      proc: new Map(),
-    }));
-
-    assert.equal(result.ok, true);
-    assert.equal(result.backend, "windows-mxc-dev");
-    assert.deepEqual(result.issues, []);
-  });
-});
-
-test("Windows MXC development sandbox reports a missing cmd.exe", async () => {
-  await withPlatform("win32", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(),
-      proc: new Map(),
-    }));
-
-    assert.equal(result.ok, false);
-    assert.equal(result.backend, "windows-mxc-dev");
-    assert.deepEqual(result.issues.map((issue) => issue.code), ["missing-command"]);
-  });
-});
-
-test("Windows MXC development sandbox rejects hosts older than 24H2", async () => {
-  await withPlatform("win32", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(["cmd.exe"]),
-      proc: new Map(),
-      windows_support: {
-        supported: false,
-        windows_build: 22631,
-        warnings: [],
-        reason: "Windows 11 24H2 is required.",
-      },
-    }));
-
-    assert.equal(result.ok, false);
-    assert.deepEqual(result.issues.map((issue) => issue.code), [
-      "unsupported-windows-version",
-    ]);
-  });
-});
-
-test("Windows MXC development sandbox rejects an unavailable runtime", async () => {
-  await withPlatform("win32", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(["cmd.exe"]),
-      proc: new Map(),
-      windows_support: {
-        supported: false,
-        windows_build: 26100,
-        warnings: [],
-        reason: "MXC probe failed.",
-      },
-    }));
-
-    assert.equal(result.ok, false);
-    assert.deepEqual(result.issues.map((issue) => issue.code), [
-      "sandbox-runtime-unavailable",
-    ]);
-  });
-});
-
-test("Other unsupported platforms still fail shell sandbox preflight", async () => {
-  await withPlatform("freebsd", async () => {
-    const result = await checkShellSandboxPreflightWithProbe(createProbe({
-      commands: new Set(),
-      proc: new Map(),
-    }));
-
-    assert.equal(result.ok, false);
-    assert.deepEqual(result.issues.map((issue) => issue.code), ["unsupported-platform"]);
-  });
-});