kingwl
99650a201b
A ModeDefinition may declare access: the widest sandbox access shell commands run under while the mode holds, on the SANDBOX_MODES ladder. The bash seam gains the resolution point to hang it on: BashExecutor. resolveMode(session) folds override ?? default and dispatches the new bash/resolve-mode waterfall; dsh-tool-bash consults it at both the stamping site and the escalation baseline; dsh-mode's clamp listener takes the ladder minimum per call. Two independent log folds compose at read time — the mode never writes the sandbox knob, so the two switch in any order and the knob re-emerges intact on exit. The built-in plan definition ships access: read-only with the bash trio allowlisted CONDITIONALLY: both policy layers admit bash/bash_output/ bash_kill only while a confining executor is mounted (an unconfinable shell cannot honor the cap), and a bash call carrying sandbox_permissions under a cap is denied at the gate — no widening mid-mode; the widened step belongs in the plan. examples/plan-acp-agent swaps bash-local for sandbox-local + bash-sandbox (workspace-write default, clamped read-only inside plan) plus the approval seam; the re-recorded plan-mode arc runs a real cat inside plan under the clamped sandbox, and modes-advertise now pins the sandbox-mode and approval config options. RFC amended to the landed shape (access cap section, orthogonality FAQ, deferred item resolved into effects self-declaration).
75 lines
3.7 KiB
TypeScript
75 lines
3.7 KiB
TypeScript
import { dirname, join } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { defineAcpSnapshotSuite, type Scenario, type SnapshotSuiteOptions } from '@deepseek-ai/dsh-acp-snapshot'
|
|
|
|
/**
|
|
* Snapshot suite for the plan-mode composition (`../cordis.yml`, swapped to
|
|
* the sibling `cordis.snapshot.yml` replay overlay by the bin under
|
|
* `DSH_SNAPSHOT=replay`).
|
|
*
|
|
* The recorded scenarios re-execute the fs tools AND the sandboxed bash
|
|
* executor for real on replay (the replay overlay swaps only the model), so
|
|
* the plan-mode arc doubles as a live check of plan's read-only `access`
|
|
* cap: the recorded `cat` runs under the host's actual runner (Seatbelt on
|
|
* macOS, bwrap on Linux CI). The recorded commands stay `cat`-shaped —
|
|
* byte-identical across those backends and across GNU/BSD userlands — and
|
|
* the transcripts carry NO sandbox denial (a denied command's stderr is the
|
|
* backend's dialect; the denial→marker path is pinned at dsh-tool-bash's
|
|
* unit tier, and the cap's clamp at dsh-mode's). Prompts pin the model to
|
|
* RELATIVE paths, because a recorded absolute temp path would neither replay
|
|
* on another host nor normalize (the normalizers scrub the RUN's own cwd,
|
|
* not the recording's).
|
|
*/
|
|
|
|
function snapshotModeFromEnv(value: string | undefined): SnapshotSuiteOptions['mode'] {
|
|
switch (value) {
|
|
case undefined:
|
|
case '':
|
|
case 'replay':
|
|
return 'replay'
|
|
case 'record':
|
|
return 'record'
|
|
case 'refresh':
|
|
return 'refresh'
|
|
default:
|
|
throw new Error(`unknown DSH_SNAPSHOT mode: ${value}`)
|
|
}
|
|
}
|
|
|
|
const SCENARIOS: Scenario[] = [
|
|
// Protocol-only (keyless, authored): the session-mode surface this
|
|
// composition adds — availableModes/currentModeId advertised on
|
|
// session/new, the optimistic current_mode_update a session/set_mode
|
|
// answers with, and the loud rejection of an unknown mode id — as committed
|
|
// wire bytes. No model turn, so it replays keyless and needs no header pin.
|
|
{ name: 'modes-advertise', hasModelTurn: false, recorded: false },
|
|
// The full plan-mode arc, and NECESSARILY the pinned-header scenario for
|
|
// the 'plan' class: the first request ships the plan-shaped header (reason
|
|
// initial), the approved exit widens it back — a second, fallback snapshot
|
|
// (adding/removing exit_plan_mode resorts the canonical tool list, which
|
|
// the delta encoding cannot express) — so this composition's full header
|
|
// content, both shapes, is committed here verbatim. The arc: setMode(plan)
|
|
// → the model reads under the plan allowlist (it never attempts the
|
|
// filtered write — the deny path stays pinned at the unit tier) and
|
|
// presents the plan via exit_plan_mode → the scripted elicitation approves
|
|
// → the very next step already runs the widened toolset and writes for
|
|
// real, mid-turn.
|
|
{ name: 'plan-mode', hasModelTurn: true, recorded: true, pinsHeader: true, headerClass: 'plan', expectedHeaderSnapshots: 2 },
|
|
// The keep-planning branch: one presentation, the scripted review answers
|
|
// with free-text feedback (no approval), and the corrective isError carries
|
|
// it back verbatim — the session stays in plan mode, so the log holds one
|
|
// plan-shaped header, uniform with the pin's first.
|
|
{ name: 'plan-mode-reject', hasModelTurn: true, recorded: true, headerClass: 'plan' },
|
|
]
|
|
|
|
defineAcpSnapshotSuite({
|
|
agent: {
|
|
binScript: fileURLToPath(new URL('../../../packages/ui/acp-agent/src/bin.ts', import.meta.url)),
|
|
configPath: fileURLToPath(new URL('../cordis.yml', import.meta.url)),
|
|
tsconfigPath: fileURLToPath(new URL('../../../tsconfig.json', import.meta.url)),
|
|
},
|
|
snapshotsDir: join(dirname(fileURLToPath(import.meta.url)), 'snapshots'),
|
|
scenarios: SCENARIOS,
|
|
mode: snapshotModeFromEnv(process.env.DSH_SNAPSHOT),
|
|
})
|