mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 02:36:01 -10:00
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
174 lines
5.3 KiB
Go
174 lines
5.3 KiB
Go
package boot
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"reasonix/internal/contract/event"
|
|
"reasonix/internal/contract/provider"
|
|
"reasonix/internal/session/control"
|
|
"reasonix/internal/state/sessionstore"
|
|
)
|
|
|
|
// restartIsolationProvider delegates an isolated task in the DELEGATE turn and
|
|
// leaves its result pending; in the APPLY turn it applies the id the transcript
|
|
// carries and reports what the host answered.
|
|
type restartIsolationProvider struct {
|
|
mu sync.Mutex
|
|
applyResult string
|
|
}
|
|
|
|
func (p *restartIsolationProvider) Name() string { return "boot-restart-isolation" }
|
|
|
|
func (p *restartIsolationProvider) Stream(_ context.Context, req provider.Request) (<-chan provider.Chunk, error) {
|
|
ch := make(chan provider.Chunk, 2)
|
|
call := func(id, name string, args any) {
|
|
raw, _ := json.Marshal(args)
|
|
ch <- provider.Chunk{Type: provider.ChunkToolCall, ToolCall: &provider.ToolCall{ID: id, Name: name, Arguments: string(raw)}}
|
|
}
|
|
last := lastToolResult(req)
|
|
lastUser := ""
|
|
for _, m := range req.Messages {
|
|
if m.Role == provider.RoleUser {
|
|
lastUser = m.Content
|
|
}
|
|
}
|
|
switch {
|
|
case strings.Contains(firstUser(req), isolatedTask):
|
|
if hasToolResult(req) {
|
|
ch <- provider.Chunk{Type: provider.ChunkText, Text: "wrote out.txt"}
|
|
} else {
|
|
call("w1", "write_file", map[string]string{"path": "out.txt", "content": "made in isolation\n"})
|
|
}
|
|
case strings.Contains(lastUser, "APPLY") && !toolResultAfterLastUser(req):
|
|
id := ""
|
|
for _, m := range req.Messages {
|
|
if found := isoIDPattern.FindString(m.Content); found != "" {
|
|
id = found
|
|
}
|
|
}
|
|
call("a1", "apply_isolated", map[string]string{"id": id})
|
|
case strings.Contains(lastUser, "APPLY"):
|
|
p.mu.Lock()
|
|
p.applyResult = last
|
|
p.mu.Unlock()
|
|
ch <- provider.Chunk{Type: provider.ChunkText, Text: "done"}
|
|
case hasToolResult(req):
|
|
ch <- provider.Chunk{Type: provider.ChunkText, Text: "left pending"}
|
|
default:
|
|
call("t1", "task", map[string]string{"prompt": isolatedTask, "isolation": "worktree"})
|
|
}
|
|
ch <- provider.Chunk{Type: provider.ChunkDone}
|
|
close(ch)
|
|
return ch, nil
|
|
}
|
|
|
|
func toolResultAfterLastUser(req provider.Request) bool {
|
|
seen := false
|
|
for _, m := range req.Messages {
|
|
switch m.Role {
|
|
case provider.RoleUser:
|
|
seen = false
|
|
case provider.RoleTool:
|
|
seen = true
|
|
}
|
|
}
|
|
return seen
|
|
}
|
|
|
|
type isolationArm struct {
|
|
landed bool
|
|
applyResult string
|
|
}
|
|
|
|
// runIsolationArm delegates an isolated task in one turn and applies it in the
|
|
// next, restarting the process between the two when restart is set.
|
|
func runIsolationArm(t *testing.T, kind string, restart bool) isolationArm {
|
|
t.Helper()
|
|
if _, err := exec.LookPath("git"); err != nil {
|
|
t.Skip("git not installed")
|
|
}
|
|
isolateConfigHome(t)
|
|
dir := robustTempDir(t)
|
|
t.Chdir(dir)
|
|
rec := &restartIsolationProvider{}
|
|
provider.Register(kind, func(provider.Config) (provider.Provider, error) { return rec, nil })
|
|
writeFile(t, dir, "reasonix.toml", `
|
|
default_model = "test-model"
|
|
|
|
[agent]
|
|
system_prompt = "BASE"
|
|
worktree_isolation = true
|
|
|
|
[codegraph]
|
|
enabled = false
|
|
|
|
[[providers]]
|
|
name = "test-model"
|
|
kind = "`+kind+`"
|
|
model = "x"
|
|
`)
|
|
gitInDir(t, dir, "init", "-q")
|
|
// Attempts run in worktrees, each a folder of its own: the model is the
|
|
// user's, so an approval of this folder is not what makes them run.
|
|
mirrorToUserConfig(t, dir)
|
|
gitInDir(t, dir, "add", "-A")
|
|
gitInDir(t, dir, "commit", "-q", "-m", "init")
|
|
|
|
build := func() *control.Controller {
|
|
ctrl, err := Build(context.Background(), Options{Sink: event.Discard})
|
|
if err != nil {
|
|
t.Fatalf("Build: %v", err)
|
|
}
|
|
ctrl.SetToolApprovalMode(control.ToolApprovalYolo)
|
|
return ctrl
|
|
}
|
|
ctrl := build()
|
|
ctrl.SetSessionPath(filepath.Join(dir, ".reasonix", "sessions", "isolation.jsonl"))
|
|
if err := ctrl.Run(context.Background(), "DELEGATE make out.txt in isolation"); err != nil {
|
|
t.Fatalf("delegate: %v", err)
|
|
}
|
|
if restart {
|
|
path := ctrl.SessionPath()
|
|
ctrl.Close()
|
|
loaded, err := sessionstore.LoadSession(path)
|
|
if err != nil || loaded == nil {
|
|
t.Fatalf("load %s: %v", path, err)
|
|
}
|
|
ctrl = build()
|
|
if err := ctrl.Resume(loaded, path); err != nil {
|
|
t.Fatalf("Resume: %v", err)
|
|
}
|
|
}
|
|
defer ctrl.Close()
|
|
if err := ctrl.Run(context.Background(), "APPLY the pending isolated result"); err != nil {
|
|
t.Fatalf("apply: %v", err)
|
|
}
|
|
_, statErr := os.Stat(filepath.Join(dir, "out.txt"))
|
|
rec.mu.Lock()
|
|
defer rec.mu.Unlock()
|
|
return isolationArm{landed: statErr == nil, applyResult: rec.applyResult}
|
|
}
|
|
|
|
// A pending isolated result is work the model was told it holds. Uninterrupted,
|
|
// the next turn applies it; restarted between the turns, the same id should be
|
|
// just as applicable.
|
|
func TestEffectRestartKeepsAPendingIsolatedResult(t *testing.T) {
|
|
uninterrupted := runIsolationArm(t, uniqueKind("boot-restart-iso-a"), false)
|
|
restarted := runIsolationArm(t, uniqueKind("boot-restart-iso-b"), true)
|
|
t.Logf("uninterrupted: landed %v, apply said %.120q", uninterrupted.landed, uninterrupted.applyResult)
|
|
t.Logf("restarted: landed %v, apply said %.160q", restarted.landed, restarted.applyResult)
|
|
if !uninterrupted.landed {
|
|
t.Fatalf("the uninterrupted arm never applied its result, so it proves nothing: %+v", uninterrupted)
|
|
}
|
|
if restarted.landed != uninterrupted.landed {
|
|
t.Fatalf("a restart between delegating and applying lost the isolated result: %q", restarted.applyResult)
|
|
}
|
|
}
|