opensource/kilocode
3
0
Fork 0
mirror of https://github.com/Kilo-Org/kilocode.git synced 2026-08-28 19:11:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): reconcile Linux sandbox network tests

Browse Source
This commit is contained in:
Marius Wichtner
2026-06-24 11:14:48 +02:00
parent 72b386731a
commit ebb744ce2d
3 changed files with 18 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/kilo-sandbox/src/bubblewrap.ts
-3
View File
@@ -114,9 +114,6 @@ export function generate(
executable: string,
mounts = process.platform === "linux" ? mountpoints() : [],
): Launch {
if (profile.network.mode !== "allow" || profile.network.allowedHosts.length > 0) {
throw new Error("Linux process sandbox network restrictions are not supported")
}
const allow = writable(profile)
validate(allow, executable, mounts)
const args = [
packages/kilo-sandbox/test/backend.test.ts
+3 -9
View File
@@ -75,12 +75,6 @@ describe("sandbox launch preparation", () => {
expect(args.args.slice(-4)).toEqual(["--", "/bin/sh", "-c", "printf '%s' 'hello world'"])
})
test("fails Linux network restrictions closed without changing the network namespace", () => {
expect(() => generateBubblewrap(makeProfile("deny"), launch, "/opt/kilo/bwrap", [])).toThrow(
"Linux process sandbox network restrictions are not supported",
)
})
test("layers Linux writable roots before protected git metadata without changing the network namespace", () => {
const root = mkdtempSync(path.join(os.tmpdir(), "kilo-bubblewrap-policy-"))
const git = path.join(root, ".git")
@@ -173,12 +167,12 @@ describe("sandbox launch preparation", () => {
})
test("merges profile environment values and applies exact deny names", async () => {
const result = await Effect.runPromise(Effect.scoped(run(makeProfile(), prepare(launch))))
const result = await Effect.runPromise(Effect.scoped(run(makeProfile("allow"), prepare(launch))))
expect(result.environment?.KEEP).toBe("profile")
expect(result.environment?.DROP).toBeUndefined()
expect(result.environment?.RESET).toBeUndefined()
expect(result.environment?.HTTPS_PROXY).toBeUndefined()
expect(result.environment?.no_proxy).toBeUndefined()
expect(result.environment?.HTTPS_PROXY).toBe("http://127.0.0.1:9000")
expect(result.environment?.no_proxy).toBe("*")
expect(result.environment?.PATH).toBeUndefined()
})
packages/kilo-sandbox/test/filesystem.test.ts
+15 -12
View File
@@ -321,18 +321,21 @@ describe("sandbox FileSystem", () => {
},
)
test.skipIf(process.platform === "darwin")("fails closed when the OS backend is unavailable", async () => {
await execute(
run(
makeProfile(allowed),
Effect.gen(function* () {
const fs = yield* FileSystem.FileSystem
const denied = yield* fs.writeFileString(path.join(allowed, "blocked.txt"), "blocked").pipe(Effect.flip)
expect(denied.reason._tag).toBe("PermissionDenied")
}),
),
)
})
test.skipIf(process.platform === "darwin" || process.platform === "linux")(
"fails closed when the OS backend is unavailable",
async () => {
await execute(
run(
makeProfile(allowed),
Effect.gen(function* () {
const fs = yield* FileSystem.FileSystem
const denied = yield* fs.writeFileString(path.join(allowed, "blocked.txt"), "blocked").pipe(Effect.flip)
expect(denied.reason._tag).toBe("PermissionDenied")
}),
),
)
},
)
test("passes through mutations when no profile is active", async () => {
await execute(