mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
153 lines
4.2 KiB
Go
153 lines
4.2 KiB
Go
package boot
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"slices"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"reasonix/internal/contract/event"
|
|
"reasonix/internal/contract/provider"
|
|
"reasonix/internal/ext/plugin"
|
|
)
|
|
|
|
func requestToolNames(req provider.Request) []string {
|
|
names := make([]string, 0, len(req.Tools))
|
|
for _, t := range req.Tools {
|
|
names = append(names, t.Name)
|
|
}
|
|
return names
|
|
}
|
|
|
|
func alwaysLoadConfig(url string, alwaysLoad bool) string {
|
|
load := ""
|
|
if alwaysLoad {
|
|
load = "load = \"always\"\n"
|
|
}
|
|
return fmt.Sprintf(`
|
|
default_model = "test-model"
|
|
|
|
[agent]
|
|
system_prompt = "BASE"
|
|
|
|
[codegraph]
|
|
enabled = false
|
|
|
|
[[providers]]
|
|
name = "test-model"
|
|
kind = "boot-mcp-always-load"
|
|
model = "x"
|
|
|
|
[[plugins]]
|
|
name = "ops"
|
|
type = "http"
|
|
url = %q
|
|
%s`, url, load)
|
|
}
|
|
|
|
// An always-loaded server's tools reach the provider from the first request of
|
|
// the first session that knows its schema, stay byte-identical across turns,
|
|
// and are callable by their own name, and the server is connected before the
|
|
// first call. A deferred server's tools never reach it, and it stays idle.
|
|
func TestEffectAlwaysLoadedMCPToolsReachTheProviderSchema(t *testing.T) {
|
|
var rec *capabilityCallProvider
|
|
provider.Register("boot-mcp-always-load", func(provider.Config) (provider.Provider, error) { return rec, nil })
|
|
for _, alwaysLoad := range []bool{true, false} {
|
|
isolateConfigHome(t)
|
|
dir := robustTempDir(t)
|
|
t.Chdir(dir)
|
|
server := deployMCPServer(t, "")
|
|
writeFile(t, dir, "reasonix.toml", alwaysLoadConfig(server.URL, alwaysLoad))
|
|
approveWorkspace(t, dir)
|
|
approveProjectServer(t, dir, "ops")
|
|
|
|
// The first session has no cached schema: nothing to show yet, so the
|
|
// server stays deferred while boot discovers and caches its tools.
|
|
rec = &capabilityCallProvider{}
|
|
ctrl, err := Build(context.Background(), Options{Sink: event.Discard})
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
waitForMCPServer(t, ctrl.Host(), "ops")
|
|
if err := ctrl.Run(context.Background(), "hello"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
if names := requestToolNames(rec.last()); slices.Contains(names, "mcp__ops__deploy") {
|
|
t.Fatalf("alwaysLoad=%v: a server with no cached schema reached the first session's schema: %v", alwaysLoad, names)
|
|
}
|
|
ctrl.Close()
|
|
|
|
rec = &capabilityCallProvider{direct: "mcp__ops__deploy"}
|
|
if !alwaysLoad {
|
|
rec.direct = ""
|
|
}
|
|
ctrl, err = Build(context.Background(), Options{Sink: event.Discard})
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
// An always-loaded server is connected before anything calls it; a
|
|
// deferred one stays idle until its first call.
|
|
if alwaysLoad {
|
|
waitForMCPServer(t, ctrl.Host(), "ops")
|
|
} else {
|
|
time.Sleep(300 * time.Millisecond)
|
|
for _, srv := range ctrl.Host().Servers() {
|
|
if srv.Name == "ops" {
|
|
t.Fatal("a deferred server connected before anything called it")
|
|
}
|
|
}
|
|
}
|
|
if err := ctrl.Run(context.Background(), "deploy"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
if err := ctrl.Run(context.Background(), "again"); err != nil {
|
|
t.Fatalf("Run: %v", err)
|
|
}
|
|
reqs := rec.requests()
|
|
ctrl.Close()
|
|
server.Close()
|
|
|
|
names := requestToolNames(reqs[0])
|
|
if got := slices.Contains(names, "mcp__ops__deploy"); got != alwaysLoad {
|
|
t.Fatalf("alwaysLoad=%v: mcp__ops__deploy in schema = %v; tools: %v", alwaysLoad, got, names)
|
|
}
|
|
first, _ := json.Marshal(reqs[0].Tools)
|
|
for i, req := range reqs[1:] {
|
|
if again, _ := json.Marshal(req.Tools); string(again) != string(first) {
|
|
t.Fatalf("alwaysLoad=%v: request %d changed the tool schema", alwaysLoad, i+1)
|
|
}
|
|
}
|
|
if alwaysLoad {
|
|
results := effectToolResults(reqs[1])
|
|
if len(results) != 1 || !strings.Contains(results[0], "deployed") {
|
|
t.Fatalf("direct call to the always-loaded tool: results = %q", results)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func (p *capabilityCallProvider) requests() []provider.Request {
|
|
p.mu.Lock()
|
|
defer p.mu.Unlock()
|
|
return slices.Clone(p.reqs)
|
|
}
|
|
|
|
func waitForMCPServer(t *testing.T, host *plugin.Host, name string) {
|
|
t.Helper()
|
|
deadline := time.Now().Add(10 * time.Second)
|
|
for {
|
|
for _, srv := range host.Servers() {
|
|
if srv.Name == name {
|
|
return
|
|
}
|
|
}
|
|
if time.Now().After(deadline) {
|
|
t.Fatalf("MCP server %q never connected", name)
|
|
}
|
|
time.Sleep(20 * time.Millisecond)
|
|
}
|
|
}
|