docs: trim generated prose

packages/sandbox/sandbox-local/tests/bwrap.e2e.ts

@@ -9,22 +9,8 @@ import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
 import { bwrapProfileArgs, LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'
 
 /**
- * KEYLESS bwrap integration proof for the BACKEND: the REAL `bwrap` confining
- * REAL processes through `confine()` + a direct spawn of the returned argv.
- * Nothing is forced off: bwrap is the ladder's FIRST rung, so a passing probe
- * selects it naturally — the wrap shape assertion pins that. Verifies the
- * WORLD (files exist or don't) and that the kernel's denial text matches the
- * dialect the wrap advertises; the through-`ctx.bash` consumer proof lives
- * with `@deepseek-ai/dsh-bash-sandbox`.
- *
- * Self-skips wherever the functional probe fails — no `bwrap` on PATH, or a
- * host that denies unprivileged user namespaces (the probe is the same
- * profile the provider enforces, so skip conditions match runtime exactly).
- *
- * Workspaces for the workspace-write tests live under the HOME directory on
- * purpose: bwrap's `/tmp` is an EPHEMERAL mount (the documented
- * bwrap-profile difference — pinned by its own test below), so only a
- * workspace OUTSIDE `/tmp` proves the workspace-root rebind itself.
+ * Keyless bwrap integration proof for the backend: the real `bwrap` confining real processes
+ * through `confine()` + a direct spawn of the returned argv.
  */
 
 const probe = spawnSync('bwrap', [...bwrapProfileArgs({ mode: 'read-only', workspaceRoot: '/' }), '--', 'true'], { timeout: 5_000, stdio: 'ignore' })

packages/sandbox/sandbox-local/tests/landlock.e2e.ts

@@ -10,22 +10,10 @@ import { launcherPath } from 'node-addon-landlock-run'
 import { LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'
 
 /**
- * KEYLESS Landlock integration proof for the BACKEND: the REAL npm-distributed
- * `landlock-run` launcher (`node-addon-landlock-run`) confining REAL processes through `confine()` + a direct
- * spawn of the returned argv, with the bwrap rung forced off so the ladder
- * lands on the launcher. Verifies the WORLD (files exist or don't), not the
- * wrapper argv alone; the through-`ctx.bash` consumer proof lives with
- * `@deepseek-ai/dsh-bash-sandbox`.
- *
- * Self-skips when the running kernel does not enforce Landlock (or this
- * platform has no launcher package — the probe cannot pass then). The
- * binary itself arrives with `pnpm install`, so absence is not a checkout
- * state.
- *
- * Workspaces live under the HOME directory on purpose: `workspace-write`
- * grants the host `/tmp` wholesale (the documented Landlock-profile
- * difference), so only a workspace OUTSIDE `/tmp` proves the workspace-root
- * grant itself.
+ * Keyless Landlock integration proof for the backend: the real npm-distributed `landlock-run`
+ * launcher (`node-addon-landlock-run`) confining real processes through `confine()` + a direct
+ * spawn of the returned argv, with the bwrap rung forced off so the ladder lands on the
+ * launcher.
  */
 
 const probe = spawnSync(launcherPath(), ['--probe'], { timeout: 5_000, encoding: 'utf8' })

packages/sandbox/sandbox-local/tests/local.spec.ts

@@ -252,19 +252,14 @@ describe('the platform chains', () => {
   })
 
   it('a rogue chain entry throws via the probe walk\'s exhaustiveness guard (closed union)', async () => {
-    // Same convention as the wrap switch below: the union is closed, so a
-    // runner added later fails to compile at the probe switch instead of
-    // silently selecting without a probe. Only a cast can reach the guard.
+    // Same convention as the wrap switch below: the union is closed, so a runner added later
+    // fails to compile at the probe switch instead of silently selecting without a probe.
     const { sandbox } = await setup({}, { chain: ['chroot', 'bwrap'] as unknown as readonly ['bwrap'] })
     expect(() => sandbox.confine(['true'], RO)).toThrow('unreachable variant')
   })
 
   it('a rogue cached runner tag throws via the exhaustiveness guard (closed union)', async () => {
-    // The wrap switches on the chain verdict's runner tag and ends with
-    // assertNever: a rogue tag (only reachable by a cast — the union is
-    // closed and chainVerdict writes only its own literals) must throw, so a
-    // runner added later fails to compile at the switch instead of silently
-    // wrapping with another runner's dialect.
+    // A rogue runner tag must hit assertNever.
     const { sandbox } = await setup()
     ;(sandbox as unknown as { selectedRunner: unknown }).selectedRunner = { runner: 'chroot', enforcement: 'full' }
     expect(() => sandbox.confine(['true'], RO)).toThrow('unreachable variant')

packages/sandbox/sandbox-local/tests/packed-install.e2e.ts

@@ -6,32 +6,7 @@ import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
-/**
- * KEYLESS publish-path rehearsal for this package's own distribution: the
- * provider must work from its PACKED tarball plus its REGISTRY launcher
- * dependency, not the git checkout. `pnpm pack` produces the EXACT bytes
- * `pnpm publish` would upload; this suite packs the workspace closure
- * (`dsh-sandbox-local` + its `@deepseek-ai` peers), installs the tarballs
- * into a throwaway consumer OUTSIDE the repo — npm resolving the
- * `node-addon-landlock-run` dependency (and its os/cpu-selected platform
- * package) from the public registry, the real consumer path — and drives
- * the INSTALLED packages under plain `node`: no tsx, no tsconfig paths, no
- * workspace resolution, so a `files`-list omission, a broken launcher
- * dependency, or a mode-stripped binary fails here instead of at the first
- * real install.
- *
- * World-proofs: the registry-installed launcher carries this host's ELF
- * architecture and IS executable (a tarball that loses the mode bit would
- * otherwise masquerade as a non-enforcing kernel — the fail-closed branch
- * below must never absorb that), and the installed provider confines a real
- * process THROUGH it (bwrap forced off) — or fails closed when the running
- * kernel does not enforce Landlock, which is itself the installed
- * fail-closed contract. Byte provenance of the launcher is the
- * `node-addon-landlock-run` repository's own release-pipeline concern.
- *
- * Self-skips off Linux or when the built `lib/` is absent (run
- * `pnpm run build` first — CI's landlock legs do).
- */
+/** Keyless packed-tarball smoke in an external plain-Node consumer. */
 
 const packageDir = fileURLToPath(new URL('..', import.meta.url))
 const repoRoot = fileURLToPath(new URL('../../../..', import.meta.url))
@@ -84,11 +59,7 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
       tarballs.push(lines[lines.length - 1] as string)
     }
 
-    // A real consumer: plain ESM project, tarballs installed by npm — the
-    // peer ranges (^0.0.1) resolve to the tarball versions, cordis pins to
-    // the peer range's rc, and `node-addon-landlock-run` (with its
-    // os/cpu-selected platform package, an OPTIONAL dependency of the entry
-    // — so no `--omit=optional` here) comes from the public registry.
+    // Install packed tarballs in a plain ESM consumer, including optional platform dependencies.
     writeFileSync(join(consumerDir, 'package.json'), JSON.stringify({ name: 'dsh-packed-consumer', private: true, type: 'module' }))
     const install = spawnSync('npm', ['install', '--no-audit', '--no-fund', ...tarballs, 'cordis@4.0.0-rc.6'], {
       cwd: consumerDir,

packages/sandbox/sandbox-local/tests/seatbelt.e2e.ts

@@ -9,20 +9,9 @@ import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
 import { LocalSandboxProvider, seatbeltProfileArgs } from '@deepseek-ai/dsh-sandbox-local'
 
 /**
- * KEYLESS Seatbelt integration proof for the BACKEND: the REAL macOS
- * `sandbox-exec` confining REAL processes through `confine()` + a direct
- * spawn of the returned argv, with the Linux rungs forced off so the ladder
- * lands on Seatbelt. Verifies the WORLD (files exist or don't) and that the
- * kernel's denial text matches the dialect the wrap advertises; the
- * through-`ctx.bash` consumer proof lives with `@deepseek-ai/dsh-bash-sandbox`.
- *
- * Self-skips wherever the functional probe fails — every non-macOS host, or
- * a macOS whose `sandbox-exec` refuses the profile.
- *
- * Workspaces for the workspace-write tests live under the HOME directory on
- * purpose: `workspace-write` grants `/tmp` and the per-user temp dir
- * wholesale (the documented Seatbelt-profile temp areas), so only a
- * workspace OUTSIDE both proves the workspace-root grant itself.
+ * Keyless Seatbelt integration proof for the backend: the real macOS `sandbox-exec` confining
+ * real processes through `confine()` + a direct spawn of the returned argv, with the Linux
+ * rungs forced off so the ladder lands on Seatbelt.
  */
 
 const probe = spawnSync('sandbox-exec', [...seatbeltProfileArgs({ mode: 'read-only', workspaceRoot: '/' }), '--', 'true'], { timeout: 5_000, stdio: 'ignore' })