mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
YHH
23f0a011c4
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
85 lines
2.4 KiB
Go
85 lines
2.4 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"reasonix/internal/base/hostwrite"
|
|
)
|
|
|
|
// newSingleProgram digests a single program path with the binary's content, so
|
|
// a program swapped at the same path needs approval again at the next load.
|
|
func newSingleProgram(kind ProjectProgramKind, key, path, ws string) ProjectProgram {
|
|
p := NewProjectProgram(kind, key, path, ws, ws, path, nil)
|
|
if info, err := os.Stat(path); err == nil && info.Mode().IsRegular() && filepath.IsAbs(path) {
|
|
p.Files = []string{filepath.Clean(path)}
|
|
p.Digest = p.currentDigest()
|
|
}
|
|
return p
|
|
}
|
|
|
|
// namesWritablePath reports a program path that is relative, climbs with "..",
|
|
// or lies — existing or not — in the workspace, an allow_write root, or a
|
|
// temporary or toolchain cache directory the bash jail leaves writable. A bare
|
|
// command name is looked up on PATH, which never searches the workspace.
|
|
func (c *Config) namesWritablePath(ws, path string) bool {
|
|
path = strings.TrimSpace(path)
|
|
if path == "" || !strings.ContainsAny(path, `/\`) {
|
|
return false
|
|
}
|
|
if !filepath.IsAbs(path) || strings.Contains(path, "..") || ws == "" {
|
|
return true
|
|
}
|
|
return inRoots(path, c.writableRoots(ws))
|
|
}
|
|
|
|
// inRoots reports path at or under any of roots, by spelling or by identity.
|
|
func inRoots(path string, roots []string) bool {
|
|
resolved, err := evalSymlinksAllowMissing(path)
|
|
if err != nil {
|
|
return true
|
|
}
|
|
for _, root := range roots {
|
|
if real, err := evalSymlinksAllowMissing(root); err == nil {
|
|
root = real
|
|
}
|
|
if pathWithinRoot(root, resolved) || sameFileAncestor(root, resolved) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func hostWritableDirs() []string { return hostwrite.Dirs() }
|
|
|
|
func (c *Config) writableRoots(ws string) []string {
|
|
roots := append([]string{ws, os.TempDir()}, hostWritableDirs()...)
|
|
for _, dir := range c.Sandbox.AllowWrite {
|
|
if dir = ExpandVars(dir); dir != "" {
|
|
roots = append(roots, dir)
|
|
}
|
|
}
|
|
return roots
|
|
}
|
|
|
|
// sameFileAncestor asks the filesystem, not the spelling, whether root is path
|
|
// or one of its ancestors: a case-insensitive volume or a junction spells the
|
|
// same directory differently.
|
|
func sameFileAncestor(root, path string) bool {
|
|
rootInfo, err := os.Stat(root)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
for dir := path; ; {
|
|
if info, err := os.Stat(dir); err == nil && os.SameFile(rootInfo, info) {
|
|
return true
|
|
}
|
|
parent := filepath.Dir(dir)
|
|
if parent == dir {
|
|
return false
|
|
}
|
|
dir = parent
|
|
}
|
|
}
|