mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
YHH
23f0a011c4
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
82 lines
2.5 KiB
Go
82 lines
2.5 KiB
Go
package boot
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"reasonix/internal/contract/event"
|
|
"reasonix/internal/runtime/agent/testutil"
|
|
)
|
|
|
|
// TestGoalOnlyToolsLeaveTheSchemaWhenUnreachable is an effect test at the
|
|
// provider boundary: a turn that carries no goal recorder does not carry
|
|
// update_goal either, whether the assembly could ever arm one or not. Shipping
|
|
// it regardless bought a definition the model calls and the host rejects —
|
|
// measured across real sessions, 121 calls and 116 refusals.
|
|
func TestGoalOnlyToolsLeaveTheSchemaWhenUnreachable(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name string
|
|
unreachable bool
|
|
wantGoal bool
|
|
}{
|
|
{name: "reachable assembly, no goal armed", unreachable: false, wantGoal: false},
|
|
{name: "unreachable assembly", unreachable: true, wantGoal: false},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
isolateConfigHome(t)
|
|
dir := robustTempDir(t)
|
|
t.Chdir(dir)
|
|
|
|
registerBootTokenProfileTestProvider()
|
|
prov := testutil.NewMock("goal-surface", testutil.Turn{Text: "done"})
|
|
setBootTokenProfileTestProvider(t, prov)
|
|
writeFile(t, dir, "reasonix.toml", `
|
|
default_model = "test-model"
|
|
|
|
[[providers]]
|
|
name = "test-model"
|
|
kind = "boot-token-profile-test"
|
|
model = "x"
|
|
`)
|
|
approveWorkspace(t, dir)
|
|
|
|
ctrl, err := Build(context.Background(), Options{
|
|
Sink: event.Discard,
|
|
GoalTurnsUnreachable: tc.unreachable,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
defer ctrl.Close()
|
|
if err := ctrl.Run(context.Background(), "go"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
reqs := prov.Requests()
|
|
if len(reqs) != 1 {
|
|
t.Fatalf("requests = %d, want 1", len(reqs))
|
|
}
|
|
if got := requestHasTool(reqs[0], "update_goal"); got != tc.wantGoal {
|
|
t.Fatalf("update_goal present = %v, want %v; tools=%v",
|
|
got, tc.wantGoal, toolSchemaNames(reqs[0].Tools))
|
|
}
|
|
// The capability stays registered either way: what changed is the
|
|
// provider surface for this turn, not what the session can reach.
|
|
registered := false
|
|
for _, e := range ctrl.AllToolContractEntries() {
|
|
if e.Name == "update_goal" {
|
|
registered = true
|
|
}
|
|
}
|
|
if !registered {
|
|
t.Fatalf("update_goal left the registry; only the turn surface should narrow")
|
|
}
|
|
// The execution surface is untouched either way.
|
|
for _, want := range []string{"bash", "read_file", "edit_file", "write_file"} {
|
|
if !requestHasTool(reqs[0], want) {
|
|
t.Fatalf("missing execution tool %q; tools=%v", want, toolSchemaNames(reqs[0].Tools))
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|