mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-10 17:57:54 -10:00
euxaristiaandClaude Sonnet 5
97ef90d27a
* chore: remove code unreachable on every supported platform The Security and code health job's advisory deadcode step reports 152 unreachable functions on main. Running the same check under GOOS=linux, windows, and darwin shows 13 of those are false positives whose callers live in windows build-tagged files, so only functions unreachable on all three platforms are touched. Functions with no references anywhere are deleted, including the internal/reasoning package, which nothing imports. Functions that only tests reference move into per-package export_test.go files so tests keep their seams while the production binary sheds the code. Test call sites of deleted convenience wrappers are ported to the live APIs (scoped tool constructors, tools.DeferredSource, FinishReason checks). Kept despite the report: cron.Store.Runs (only reader of runs.jsonl, which production writes), and agenteval.TraceEventKeys and MissingTraceEvents (used across packages by the trace contract test). * docs(config): correct ValidateFile's errors.As claim Message is a flattened string (.Error() already called on the parse error), not a wrapped error, so callers can't recover the concrete json error type via errors.As. Fix the comment to match. Co-Authored-By: Claude Sonnet 5 <[email protected]> * chore(trace,skills): drop obsolete Sink adapters and fix stale doc references The dead-code pass removed the Emit methods but left Sink, NDJSONSink, and TextSink exported with a contract nothing implements; remove the types with their contract. Also remove the stray blank line at EOF of trace.go flagged by gofmt, and update skills package docs and HOW_ZERO_WORKS.md to stop directing callers to DiscoveryRoots/Duplicates, which are now test seams. Co-Authored-By: Claude Fable 5 <[email protected]> * chore: clean up remaining review nits on dead code removal Replace a pointless fmt.Errorf(...%w...).Error() with fmt.Sprintf using %v, since the wrapped error was discarded immediately anyway. Remove a comment block that was duplicated verbatim. * docs(skills): drop remaining references to test-only List/Get Load and MergedSkills comments still named List/Get as production entry points after they moved to export_test.go. Point callers at Load and ListFromRoots instead. * chore: remove now-unreferenced export_test.go seams execSessionManager.len() and likelySandboxDenied/sandboxDenialKind had no remaining callers after the sandbox unify-command-execution rebase; the production code they wrapped for tests no longer exists. --------- Co-authored-by: Claude Sonnet 5 <[email protected]>
100 lines
3.2 KiB
Go
100 lines
3.2 KiB
Go
package tools
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/Gitlawb/zero/internal/sandbox"
|
|
)
|
|
|
|
// denyReadFixture builds a workspace with an ordinary file and a secret subtree,
|
|
// returning the resolved workspace root and a sandbox engine whose DenyRead
|
|
// covers the secret dir.
|
|
func denyReadFixture(t *testing.T) (string, *sandbox.Engine) {
|
|
t.Helper()
|
|
ws, err := filepath.EvalSymlinks(t.TempDir())
|
|
if err != nil {
|
|
t.Fatalf("EvalSymlinks: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(ws, "main.go"), []byte("package main\n"), 0o600); err != nil {
|
|
t.Fatalf("write main.go: %v", err)
|
|
}
|
|
secret := filepath.Join(ws, "secret")
|
|
if err := os.MkdirAll(secret, 0o755); err != nil {
|
|
t.Fatalf("mkdir secret: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(secret, "creds.go"), []byte("package main\n"), 0o600); err != nil {
|
|
t.Fatalf("write creds.go: %v", err)
|
|
}
|
|
|
|
scope, err := sandbox.NewScope(ws, nil)
|
|
if err != nil {
|
|
t.Fatalf("NewScope: %v", err)
|
|
}
|
|
engine := sandbox.NewEngine(sandbox.EngineOptions{
|
|
WorkspaceRoot: ws,
|
|
Policy: sandbox.Policy{
|
|
Mode: sandbox.ModeEnforce,
|
|
EnforceWorkspace: true,
|
|
DenyRead: []string{secret},
|
|
},
|
|
Scope: scope,
|
|
})
|
|
return ws, engine
|
|
}
|
|
|
|
func TestGrepSkipsDenyReadSubtree(t *testing.T) {
|
|
ws, engine := denyReadFixture(t)
|
|
tool, ok := NewScopedGrepTool(ws, nil).(sandboxAwareTool)
|
|
if !ok {
|
|
t.Fatal("grep tool must be sandbox-aware")
|
|
}
|
|
args := map[string]any{"pattern": "package main", "output_mode": "files_with_matches"}
|
|
|
|
// Sandboxed: the DenyRead subtree must be excluded from results.
|
|
sandboxed := tool.RunWithSandbox(context.Background(), args, engine)
|
|
if sandboxed.Status != StatusOK {
|
|
t.Fatalf("grep failed: %s", sandboxed.Output)
|
|
}
|
|
if !strings.Contains(sandboxed.Output, "main.go") {
|
|
t.Fatalf("grep must still match the non-denied file, got:\n%s", sandboxed.Output)
|
|
}
|
|
if strings.Contains(sandboxed.Output, "creds.go") {
|
|
t.Fatalf("grep must NOT surface a DenyRead file, got:\n%s", sandboxed.Output)
|
|
}
|
|
|
|
// Without a sandbox, the same search includes the secret file (default behavior).
|
|
plain := NewScopedGrepTool(ws, nil).Run(context.Background(), args)
|
|
if !strings.Contains(plain.Output, "creds.go") {
|
|
t.Fatalf("non-sandboxed grep should include the secret file, got:\n%s", plain.Output)
|
|
}
|
|
}
|
|
|
|
func TestGlobSkipsDenyReadSubtree(t *testing.T) {
|
|
ws, engine := denyReadFixture(t)
|
|
tool, ok := NewScopedGlobTool(ws, nil).(sandboxAwareTool)
|
|
if !ok {
|
|
t.Fatal("glob tool must be sandbox-aware")
|
|
}
|
|
args := map[string]any{"pattern": "**/*.go"}
|
|
|
|
sandboxed := tool.RunWithSandbox(context.Background(), args, engine)
|
|
if sandboxed.Status != StatusOK {
|
|
t.Fatalf("glob failed: %s", sandboxed.Output)
|
|
}
|
|
if !strings.Contains(sandboxed.Output, "main.go") {
|
|
t.Fatalf("glob must still match the non-denied file, got:\n%s", sandboxed.Output)
|
|
}
|
|
if strings.Contains(sandboxed.Output, "creds.go") {
|
|
t.Fatalf("glob must NOT surface a DenyRead file, got:\n%s", sandboxed.Output)
|
|
}
|
|
|
|
plain := NewScopedGlobTool(ws, nil).Run(context.Background(), args)
|
|
if !strings.Contains(plain.Output, "creds.go") {
|
|
t.Fatalf("non-sandboxed glob should include the secret file, got:\n%s", plain.Output)
|
|
}
|
|
}
|