deepseek-harness/packages/experimental/webworker-runtime/tests/node/sandbox-stack.spec.ts

/** The unchanged sandbox-local → bash-sandbox → subprocess stack over the Worker Node layer. */
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
import { Context } from '@deepseek-ai/cordis'
import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'
import LocalSandboxProvider from '@deepseek-ai/dsh-sandbox-local'
import { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
import LocalSubprocessRuntime from '@deepseek-ai/dsh-subprocess-local'
import { MemoryVfs } from '../../src/storage/memory.ts'
import { setActiveVfs } from '../../src/storage/active.ts'
import { processAlive, signalProcess } from '../../src/node/process-table.ts'

vi.mock('node:child_process', async () => await import('../../src/node/builtin_modules/implemented/child_process.ts'))

const WORKSPACE = '/dsh/workspace'
const OUTSIDE = '/dsh/home'
let vfs: MemoryVfs
const contexts: Context[] = []

beforeEach(() => {
  vfs = new MemoryVfs()
  setActiveVfs(vfs)
  vfs.mkdirSync(WORKSPACE, { recursive: true })
  vfs.mkdirSync(OUTSIDE, { recursive: true })
  vfs.mkdirSync('/dsh/tmp', { recursive: true })
  vi.spyOn(process, 'kill').mockImplementation((pid: number, signal?: string | number): true => {
    if (signal === 0) {
      if (processAlive(pid)) return true
      const error = new Error('kill ESRCH') as NodeJS.ErrnoException
      error.code = 'ESRCH'
      throw error
    }
    signalProcess(pid, (signal ?? 'SIGTERM') as NodeJS.Signals)
    return true
  })
})

afterEach(async () => {
  await Promise.all(contexts.splice(0).map(async (ctx) => { await ctx.fiber.dispose() }))
  vi.restoreAllMocks()
})

/** Boot the production providers while only their platform primitives are replaced. */
async function setup(mode: 'read-only' | 'workspace-write' | 'danger-full-access'): Promise<SandboxBashExecutor> {
  const ctx = new Context()
  contexts.push(ctx)
  await ctx.plugin(LocalSandboxProvider)
  await ctx.plugin(SandboxPolicyService, { mode, workspaceRoot: WORKSPACE })
  await ctx.plugin(LocalSubprocessRuntime)
  await ctx.plugin(SandboxBashExecutor, { cwd: WORKSPACE })
  return ctx.shell as SandboxBashExecutor
}

describe('Worker Landlock through the production sandbox stack', () => {
  it('allows workspace and temp writes while classifying an outside write as denied', async () => {
    const bash = await setup('workspace-write')
    const allowed = await bash.run(bash.resolve({
      command: `echo workspace > ${WORKSPACE}/allowed.txt; echo temp > /tmp/allowed.txt`,
    }))
    expect(allowed.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement: 'full' })
    expect(vfs.readFileSync(`${WORKSPACE}/allowed.txt`, 'utf8')).toBe('workspace\n')
    expect(vfs.readFileSync('/dsh/tmp/allowed.txt', 'utf8')).toBe('temp\n')

    const denied = await bash.run(bash.resolve({ command: `echo denied > ${OUTSIDE}/denied.txt` }))
    expect(denied.exitCode).toBe(1)
    expect(denied.sandbox).toEqual({ mode: 'workspace-write', denied: true, enforcement: 'full' })
    expect(vfs.existsSync(`${OUTSIDE}/denied.txt`)).toBe(false)
  })

  it('keeps read-only confined and danger-full-access unwrapped', async () => {
    const readOnly = await setup('read-only')
    const strict = await readOnly.run(readOnly.resolve({
      command: `echo discarded > /dev/null; echo denied > ${WORKSPACE}/strict.txt`,
    }))
    expect(strict.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement: 'full' })
    expect(vfs.existsSync(`${WORKSPACE}/strict.txt`)).toBe(false)

    const unrestricted = await setup('danger-full-access')
    const result = await unrestricted.run(unrestricted.resolve({ command: `echo allowed > ${OUTSIDE}/full.txt` }))
    expect(result.sandbox).toEqual({ mode: 'danger-full-access', denied: false })
    expect(vfs.readFileSync(`${OUTSIDE}/full.txt`, 'utf8')).toBe('allowed\n')
  })

  it('does not leak a concurrent command policy into another process', async () => {
    const bash = await setup('read-only')
    const strict = bash.run(bash.resolve({
      command: `sleep 0.02; echo denied > ${WORKSPACE}/strict.txt`,
    }))
    const writable = bash.run(bash.resolve({
      command: `echo allowed > ${WORKSPACE}/writable.txt`,
      sandboxPolicy: { mode: 'workspace-write', workspaceRoot: WORKSPACE },
    }))
    const [strictResult, writableResult] = await Promise.all([strict, writable])
    expect(strictResult.sandbox).toEqual({ mode: 'read-only', denied: true, enforcement: 'full' })
    expect(writableResult.sandbox).toEqual({ mode: 'workspace-write', denied: false, enforcement: 'full' })
    expect(vfs.existsSync(`${WORKSPACE}/strict.txt`)).toBe(false)
    expect(vfs.readFileSync(`${WORKSPACE}/writable.txt`, 'utf8')).toBe('allowed\n')
  })
})