Files
DeepSeek-Reasonix/cmd/reasonix-studio-host/packagegrants.go
T
yhh 394da0a313 refactor: the kernel's packages live in the layer they belong to
internal/ was 141 packages side by side, so nothing but a reader's memory
said which were foundations and which assembled the rest. Each now sits in a
layer directory, and the directory is the declaration:

  base      L0  foundation with no domain in it
  contract  L1  types and interfaces the layers above agree on
  model, tools, safety, ext, state, platform
            L2  subsystems, peers of one another
  runtime   L3  the turn engine
  session   L4  the controller
  assembly  L5  the composition root
  frontend  L6  cli, serve, acp and the host adapters

Only paths change: package names, code and behaviour do not. Imports,
repolint and coverage baselines, sensitive paths, CI package lists and docs
follow the new paths; release notes keep the paths they were written with,
and sample paths inside tests and fixtures keep theirs.

repolint gains layer-order: a package may import its own layer and those
below it, read from where it lives. The 47 imports that point upward today
are recorded as that rule's opening debt (-allow-widen, a new rule's first
baseline) and can only go down. Most of it is config, which still reaches
into eight subsystems and is the next thing to take apart; the rest is
event, history and a few tools reaching into runtime for types that belong
in contract.
2026-09-23 18:28:21 -07:00

48 lines
1.4 KiB
Go

package main
import (
"encoding/json"
"fmt"
"io"
"os"
"path/filepath"
"strings"
"reasonix/internal/platform/packagegrant"
)
// stripPackageGrants works on the directory the application runs from and is
// never handed a directory directly: the grants it removes are the ones that
// stop that application's own sandboxed children from loading, and no other
// tree is this flag's to change. The report goes to out as one JSON line.
func stripPackageGrants(out, logs io.Writer, app string) int {
if strings.TrimSpace(app) == "" {
fmt.Fprintln(logs, "strip-package-grants: -studio-app names no application")
return 2
}
exe, err := filepath.EvalSymlinks(app)
if err != nil {
fmt.Fprintf(logs, "strip-package-grants: %v\n", err)
return 2
}
if info, err := os.Stat(exe); err != nil || !info.Mode().IsRegular() {
fmt.Fprintf(logs, "strip-package-grants: %s is not an application executable\n", exe)
return 2
}
report, err := packagegrant.Strip(filepath.Dir(exe))
if err != nil {
fmt.Fprintf(logs, "strip-package-grants: %v\n", err)
return 1
}
for _, refused := range report.Refused {
fmt.Fprintf(logs, "strip-package-grants: kept a grant at %s: %v\n", refused.Path, refused.Err)
}
for _, unread := range report.Unread {
fmt.Fprintf(logs, "strip-package-grants: could not read %s: %v\n", unread.Path, unread.Err)
}
if err := json.NewEncoder(out).Encode(report); err != nil {
return 1
}
return 0
}