jiang
7383ed6d13
Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore session-scoped learning, credential renewal, typed project queries and controlled frontend actions from the legacy Agent. Replace host Shell execution with an approved Landlock/seccomp executor and persistent per-session workspaces. Add typed Bocha search and Tianditu geocoding bridges using the owning session credential. Require a working kernel sandbox before startup and persist workspace files in deployments. Validation completed before this commit: TypeScript checks, 150 Bun tests, Docker build and UID 10001 sandbox execution, native Shell approval and session recovery. Tianditu succeeded; Bocha currently reports exhausted account quota. Unrelated investigation-report contract work is excluded.
24 lines
1.3 KiB
TypeScript
24 lines
1.3 KiB
TypeScript
import { describe, expect, it } from "bun:test";
|
|
import { readFile } from "node:fs/promises";
|
|
|
|
describe("OpenCode 2 permissions", () => {
|
|
it("keeps protected paths denied, shell/edit gated and subagents disabled", async () => {
|
|
const config = JSON.parse(await readFile("opencode.json", "utf8"));
|
|
const rules = config.permissions as { action: string; resource: string; effect: string }[];
|
|
const effect = (action: string, resource: string) => rules.find((rule) => rule.action === action && rule.resource === resource)?.effect;
|
|
expect(effect("*", "*")).toBe("ask");
|
|
expect(effect("external_directory", "*")).toBe("deny");
|
|
expect(effect("subagent", "*")).toBe("deny");
|
|
expect(effect("question", "*")).toBe("allow");
|
|
expect(effect("todowrite", "*")).toBe("allow");
|
|
for (const action of ["read", "edit"]) {
|
|
for (const path of [".env", "*.env", "data/**", "**/logs/**"]) expect(effect(action, path)).toBe("deny");
|
|
}
|
|
expect(effect("edit", "*")).toBe("ask");
|
|
expect(effect("shell", "*")).toBe("ask");
|
|
for (const pattern of ["*.env*", "*data/*", "*logs/*"]) expect(effect("shell", pattern)).toBe("deny");
|
|
expect(config.permission).toBeUndefined();
|
|
expect(config.experimental?.continue_loop_on_deny).toBeUndefined();
|
|
});
|
|
});
|