mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 02:36:01 -10:00
YHH
23f0a011c4
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
35 lines
1.1 KiB
Go
35 lines
1.1 KiB
Go
package config
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
)
|
|
|
|
// ErrProjectProgramChanged is an approved program whose files changed after
|
|
// the approval was checked, so the host refuses to run it.
|
|
var ErrProjectProgramChanged = errors.New("workspace program changed since it was approved")
|
|
|
|
// Verify reports ErrProjectProgramChanged when a file the approval covered no
|
|
// longer holds the approved content.
|
|
func (p ProjectProgram) Verify() error {
|
|
if len(p.Files) == 0 || p.currentDigest() == p.Digest {
|
|
return nil
|
|
}
|
|
return fmt.Errorf("%w: %s %q; approve it again with `reasonix trust`", ErrProjectProgramChanged, p.Kind, p.Name)
|
|
}
|
|
|
|
// ProjectProgramVerifier returns the check an executor runs before starting the
|
|
// project-declared program of kind and name, or nil when the program in force
|
|
// is not one a workspace declared.
|
|
func (c *Config) ProjectProgramVerifier(kind ProjectProgramKind, name string) func() error {
|
|
if c == nil {
|
|
return nil
|
|
}
|
|
for _, p := range c.projectScope.admitted {
|
|
if p.Kind == kind && p.Name == name && len(p.Files) > 0 {
|
|
return p.Verify
|
|
}
|
|
}
|
|
return nil
|
|
}
|