77 lines
2.3 KiB
TypeScript
77 lines
2.3 KiB
TypeScript
#!/usr/bin/env bun
|
|
/**
|
|
* Local smoke test for qimingcode 1.2.0 native sandbox (no Electron).
|
|
* Usage: bun run script/verify-sandbox.ts
|
|
*/
|
|
import path from "path"
|
|
import fs from "fs"
|
|
import { Config, ConfigParse } from "../src/config"
|
|
import { resolveWritableRoots, isPathWritable } from "../src/sandbox/path"
|
|
|
|
const fail = (msg: string) => {
|
|
console.error(`FAIL: ${msg}`)
|
|
process.exit(1)
|
|
}
|
|
|
|
const ok = (msg: string) => console.log(`OK: ${msg}`)
|
|
|
|
// 1) Strict config schema
|
|
const parsed = ConfigParse.schema(
|
|
Config.Info.zod,
|
|
{
|
|
sandbox: {
|
|
sandbox_mode: "strict",
|
|
helper_path: "C:\\helper\\qiming-sandbox-helper.exe",
|
|
mode: "workspace-write",
|
|
network_enabled: true,
|
|
},
|
|
},
|
|
"verify.json",
|
|
)
|
|
if (parsed.sandbox?.sandbox_mode !== "strict") fail("sandbox_mode not strict")
|
|
ok("Config.Info accepts OPENCODE sandbox object")
|
|
|
|
try {
|
|
ConfigParse.schema(
|
|
Config.Info.zod,
|
|
{ sandbox: { sandbox_mode: "strict" }, extra_key: true } as Record<string, unknown>,
|
|
"bad.json",
|
|
)
|
|
fail("expected unknown top-level key to throw")
|
|
} catch {
|
|
ok("unknown top-level keys rejected")
|
|
}
|
|
|
|
// 2) Writable roots (strict = session only)
|
|
const session = path.resolve(process.cwd(), "_verify_session")
|
|
const sibling = path.resolve(process.cwd(), "_verify_sibling", "out.txt")
|
|
fs.mkdirSync(session, { recursive: true })
|
|
fs.mkdirSync(path.dirname(sibling), { recursive: true })
|
|
|
|
const roots = resolveWritableRoots({ sandbox_mode: "strict" }, session)
|
|
if (!isPathWritable(path.join(session, "inside.txt"), roots)) {
|
|
fail("write inside session should be allowed")
|
|
}
|
|
if (isPathWritable(sibling, roots)) {
|
|
fail("write outside session should be blocked")
|
|
}
|
|
ok("strict writable_roots: session allowed, sibling denied")
|
|
|
|
// 3) Built binary version (if dist exists)
|
|
const distExe = path.resolve(
|
|
import.meta.dir,
|
|
"../dist/qimingcode-windows-x64/bin/opencode.exe",
|
|
)
|
|
if (fs.existsSync(distExe)) {
|
|
const proc = Bun.spawn([distExe, "--version"], { stdout: "pipe", stderr: "pipe" })
|
|
const version = (await new Response(proc.stdout).text()).trim()
|
|
if (!version.startsWith("1.2.")) {
|
|
fail(`dist binary version expected 1.2.x, got ${version}`)
|
|
}
|
|
ok(`dist binary --version = ${version}`)
|
|
} else {
|
|
console.log("SKIP: dist binary not found (run: bun run build --single --skip-embed-web-ui)")
|
|
}
|
|
|
|
console.log("\nAll local qimingcode sandbox checks passed.")
|