kyleandClaude Opus 5.5
b426ca1958
A draft spec for the owner's review and 13 offline tasks with their given tests: shared tool arguments and host rules in proto, the sealed fetch target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each task's tests were run against a reference at that task's end state (560 to 638 tests, clippy clean); the reference is not in the repository. Adds the runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
Rust
46 lines
1.4 KiB
Rust
//! A grant path is mounted into the tool container as `--volume=<path>:<path>:ro`, so a path with
|
|
//! `:` or `,` in it cannot be granted: the set is invalid, as for any other bad grant (M3b spec,
|
|
//! section 3). Do not edit.
|
|
|
|
#[path = "support/tmp.rs"]
|
|
mod tmp;
|
|
|
|
use brokerd::grants::load;
|
|
use tmp::TempDir;
|
|
|
|
fn grant_with_path(path: &str) -> String {
|
|
format!(
|
|
"tool = \"read_file\"\nmode = \"auto\"\nmax_taint = \"secret\"\n[constraints]\npaths = [{path:?}]\n"
|
|
)
|
|
}
|
|
|
|
#[test]
|
|
fn a_path_with_a_colon_or_a_comma_makes_the_set_invalid() {
|
|
for path in ["/home/kyle/a:b", "/home/kyle/a,b", "/x:/y", "/n,ro"] {
|
|
let dir = TempDir::new("mount-bad");
|
|
dir.write("notes.toml", &grant_with_path(path));
|
|
let problems = load(dir.path()).expect_err(path);
|
|
assert_eq!(problems.len(), 1, "{path}: {problems:?}");
|
|
assert_eq!(problems[0].file, "notes.toml");
|
|
assert!(
|
|
problems[0].problem.contains("cannot be mounted"),
|
|
"{path}: {}",
|
|
problems[0].problem
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn other_punctuation_is_still_fine() {
|
|
for path in [
|
|
"/home/kyle/a b",
|
|
"/home/kyle/a;b",
|
|
"/home/kyle/a=b",
|
|
"/home/kyle/a.b-c_d",
|
|
] {
|
|
let dir = TempDir::new("mount-ok");
|
|
dir.write("notes.toml", &grant_with_path(path));
|
|
assert!(load(dir.path()).is_ok(), "{path}");
|
|
}
|
|
}
|