mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
YHH
23f0a011c4
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
51 lines
1.6 KiB
Go
51 lines
1.6 KiB
Go
// hook_notice.go — a hook outcome as the notice a frontend renders.
|
|
package boot
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"reasonix/internal/contract/config"
|
|
"reasonix/internal/contract/event"
|
|
"reasonix/internal/ext/hook"
|
|
)
|
|
|
|
// hookNoticeEvent maps what a hook did onto the notice contract: a stable code
|
|
// frontends localize by, the English headline they fall back to, and the hook's
|
|
// own words as detail a surface can put behind a disclosure. Flattening all
|
|
// three into Text is what turned a broken hook into one unreadable line.
|
|
func hookNoticeEvent(n hook.Notice) event.Event {
|
|
return event.Event{
|
|
Kind: event.Notice,
|
|
Level: event.LevelWarn,
|
|
Code: hookNoticeCode(n),
|
|
Text: n.Text,
|
|
Detail: n.Detail,
|
|
}
|
|
}
|
|
|
|
func hookNoticeCode(n hook.Notice) string {
|
|
if errors.Is(n.Refusal, config.ErrProjectProgramChanged) {
|
|
return event.NoticeCodeProjectProgramChanged
|
|
}
|
|
switch n.Decision {
|
|
case hook.DecisionBlock:
|
|
return event.NoticeCodeHookBlocked
|
|
case hook.DecisionError:
|
|
return event.NoticeCodeHookFailed
|
|
default:
|
|
return event.NoticeCodeHookWarned
|
|
}
|
|
}
|
|
|
|
// projectHooksHeldEvent says which project hooks did not load and how to let them.
|
|
func projectHooksHeldEvent(p config.ProjectProgram) event.Event {
|
|
return event.Event{
|
|
Kind: event.Notice,
|
|
Level: event.LevelWarn,
|
|
Code: event.NoticeCodeProjectProgramsAwaitingApproval,
|
|
Text: "This project's hooks are off until you approve them.",
|
|
Detail: fmt.Sprintf("%s declares: %s\nRun `reasonix trust` in this workspace to review and approve them; any later change needs approval again.", p.Name, p.Detail),
|
|
}
|
|
}
|