mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
YHH
23f0a011c4
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
110 lines
3.3 KiB
Go
110 lines
3.3 KiB
Go
package boot
|
|
|
|
import (
|
|
"context"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"reasonix/internal/contract/event"
|
|
"reasonix/internal/contract/provider"
|
|
)
|
|
|
|
// A runtime outlives the request that built it: Studio opens a pane with one
|
|
// HTTP request, whose context ends when the handler returns. An MCP server that
|
|
// starts on its first call must still start after that.
|
|
func TestEffectAnMCPServerStartsAfterTheBuildingRequestEnded(t *testing.T) {
|
|
home := isolateConfigHome(t)
|
|
dir := robustTempDir(t)
|
|
t.Chdir(dir)
|
|
rec := &capabilityCallProvider{call: `{"action":"call","capability_id":"mcp-tool:screen/shot","arguments":{}}`}
|
|
provider.Register("boot-runtime-ctx", func(provider.Config) (provider.Provider, error) { return rec, nil })
|
|
writeFile(t, dir, "reasonix.toml", `
|
|
default_model = "test-model"
|
|
|
|
[agent]
|
|
system_prompt = "BASE"
|
|
|
|
[codegraph]
|
|
enabled = false
|
|
|
|
[[providers]]
|
|
name = "test-model"
|
|
kind = "boot-runtime-ctx"
|
|
model = "x"
|
|
`)
|
|
server := screenshotMCPServer(t)
|
|
defer server.Close()
|
|
// The user's own config: a server nobody has to vouch for, started lazily.
|
|
rxHome := filepath.Join(home, "rx")
|
|
t.Setenv("REASONIX_HOME", rxHome)
|
|
writeFile(t, rxHome, "config.toml", `
|
|
[[plugins]]
|
|
name = "screen"
|
|
type = "http"
|
|
url = "`+server.URL+`"
|
|
`)
|
|
approveWorkspace(t, dir)
|
|
// The first runtime finds no cached schema and starts the server while it
|
|
// builds; the one after it, like a second pane, starts it on first call.
|
|
first, err := Build(context.Background(), Options{Sink: event.Discard})
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
if err := first.Run(context.Background(), "look at the screen"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
first.Close()
|
|
request, requestDone := context.WithCancel(context.Background())
|
|
ctrl, err := Build(request, Options{Sink: event.Discard})
|
|
requestDone()
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
defer ctrl.Close()
|
|
if err := ctrl.Run(context.Background(), "look at the screen"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
results := effectToolResults(rec.last())
|
|
if len(results) != 1 || !strings.Contains(results[0], "captured") {
|
|
t.Fatalf("tool results = %q, want the server's answer", results)
|
|
}
|
|
}
|
|
|
|
// capabilityCallProvider makes one call per turn, then answers: a
|
|
// use_capability call with arguments call, or the tool named direct.
|
|
type capabilityCallProvider struct {
|
|
mu sync.Mutex
|
|
call string
|
|
direct string
|
|
reqs []provider.Request
|
|
}
|
|
|
|
func (p *capabilityCallProvider) Name() string { return "boot-runtime-ctx" }
|
|
|
|
func (p *capabilityCallProvider) Stream(_ context.Context, req provider.Request) (<-chan provider.Chunk, error) {
|
|
p.mu.Lock()
|
|
p.reqs = append(p.reqs, req)
|
|
p.mu.Unlock()
|
|
first := len(req.Messages) > 0 && req.Messages[len(req.Messages)-1].Role == provider.RoleUser
|
|
ch := make(chan provider.Chunk, 2)
|
|
switch {
|
|
case first && p.direct != "":
|
|
ch <- provider.Chunk{Type: provider.ChunkToolCall, ToolCall: &provider.ToolCall{ID: "call-1", Name: p.direct, Arguments: `{}`}}
|
|
case first:
|
|
ch <- provider.Chunk{Type: provider.ChunkToolCall, ToolCall: &provider.ToolCall{ID: "cap-1", Name: "use_capability", Arguments: p.call}}
|
|
default:
|
|
ch <- provider.Chunk{Type: provider.ChunkText, Text: "done"}
|
|
}
|
|
ch <- provider.Chunk{Type: provider.ChunkDone}
|
|
close(ch)
|
|
return ch, nil
|
|
}
|
|
|
|
func (p *capabilityCallProvider) last() provider.Request {
|
|
p.mu.Lock()
|
|
defer p.mu.Unlock()
|
|
return p.reqs[len(p.reqs)-1]
|
|
}
|