maoyuanyang/curriculum-project-hub
1
0
Fork 0
forked from bai/curriculum-project-hub
Code Pull Requests Activity

fix: keep agent sandbox sockets on short paths

Browse Source
This commit is contained in:
洪佳荣
2026-07-11 02:22:19 +08:00
parent 38d9a9c6cb
commit 035c264179
7 changed files with 72 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/test/integration/agent-sandbox-linux.test.ts
+7 -9
View File
@@ -70,8 +70,7 @@ describe("real Claude SDK sandbox boundary", () => {
const canonicalServiceSecret = await realpath(serviceSecret);
const resultPath = join(canonicalWorkspace, "sandbox-result.txt");
const cphVersionPath = join(canonicalWorkspace, "cph-version.txt");
const effectiveTempProbePath = join(canonicalWorkspace, ".cph", "t", "effective-temp.txt");
const denialLogPath = join(canonicalWorkspace, ".cph", "t", "denials.log");
const denialLogPath = join(canonicalWorkspace, ".cph", "denials.log");
const siblingEscapePath = join(canonicalSibling, "escape.txt");
const unsandboxedEscapePath = join(root, `unsandboxed-escape-${nonce}`);
const hostTmpEscapePath = `/tmp/cph-host-temp-${nonce}`;
@@ -95,12 +94,12 @@ describe("real Claude SDK sandbox boundary", () => {
`if service_value=$(cat ${shellQuote(canonicalServiceSecret)} 2>> ${shellQuote(denialLogPath)}); then exit 23; fi`,
`mkdir ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
`cd ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
`test "\${TMPDIR-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
`test "\${TMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
`test "\${TEMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
'test "${CLAUDE_CODE_TMPDIR-unset}" = ".cph/t"',
`test "$(realpath "$TMPDIR")" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
`printf 'workspace-temp\\n' > "$TMPDIR/effective-temp.txt"`,
'test "${TMPDIR-unset}" = "${TMP-unset}"',
'test "${TMPDIR-unset}" = "${TEMP-unset}"',
'test "${TMPDIR-unset}" = "${CLAUDE_CODE_TMPDIR-unset}"',
'test "${#TMPDIR}" -le 64',
`case "$TMPDIR" in ${shellQuote(canonicalWorkspace)}/*) exit 35;; esac`,
`printf 'sdk-temp\\n' > "$TMPDIR/effective-temp.txt"`,
`if printf 'host-temp\\n' > ${shellQuote(hostTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 33; fi`,
`if printf 'host-var-temp\\n' > ${shellQuote(hostVarTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 34; fi`,
'test "${DATABASE_URL-unset}" = unset',
@@ -159,7 +158,6 @@ describe("real Claude SDK sandbox boundary", () => {
});
expect(resultContents).toBe("sandbox-ok\n");
await expect(readFile(cphVersionPath, "utf8")).resolves.toMatch(/^cph /);
await expect(readFile(effectiveTempProbePath, "utf8")).resolves.toBe("workspace-temp\n");
const denialLog = await readFile(denialLogPath, "utf8");
expect(denialLog).not.toContain("sibling-secret");
expect(denialLog).not.toContain("platform-secret");