style: fix rustfmt issues from community PR merges
This commit is contained in:
@@ -3073,9 +3073,7 @@ fn auth_mode_uses_kimi_oauth(mode: &str) -> bool {
|
||||
}
|
||||
|
||||
fn normalize_auth_mode(mode: &str) -> String {
|
||||
mode.trim()
|
||||
.to_ascii_lowercase()
|
||||
.replace(['-', ' '], "_")
|
||||
mode.trim().to_ascii_lowercase().replace(['-', ' '], "_")
|
||||
}
|
||||
|
||||
fn base_url_uses_local_host(base_url: &str) -> bool {
|
||||
|
||||
@@ -2060,4 +2060,4 @@ mod tests {
|
||||
let _ = ColorDepth::detect();
|
||||
let _ = adapt_color(DEEPSEEK_INK, ColorDepth::detect());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -433,11 +433,7 @@ impl SandboxManager {
|
||||
fn prepare_landlock(&self, spec: &CommandSpec) -> ExecEnv {
|
||||
// Check if bwrap passthrough should be used (#2184).
|
||||
if self.prefer_bwrap && bwrap::is_available() {
|
||||
let command = bwrap::build_bwrap_command(
|
||||
&spec.cwd,
|
||||
&spec.program,
|
||||
&spec.args,
|
||||
);
|
||||
let command = bwrap::build_bwrap_command(&spec.cwd, &spec.program, &spec.args);
|
||||
|
||||
let mut env = spec.env.clone();
|
||||
env.insert("DEEPSEEK_SANDBOX".to_string(), "bwrap".to_string());
|
||||
@@ -767,11 +763,23 @@ mod tests {
|
||||
|
||||
#[test]
|
||||
fn test_parity_denial_zero_exit_never_denied() {
|
||||
assert!(!SandboxManager::was_denied(SandboxType::None, 0, "anything"));
|
||||
assert!(!SandboxManager::was_denied(
|
||||
SandboxType::None,
|
||||
0,
|
||||
"anything"
|
||||
));
|
||||
#[cfg(target_os = "macos")]
|
||||
assert!(!SandboxManager::was_denied(SandboxType::MacosSeatbelt, 0, ""));
|
||||
assert!(!SandboxManager::was_denied(
|
||||
SandboxType::MacosSeatbelt,
|
||||
0,
|
||||
""
|
||||
));
|
||||
#[cfg(target_os = "linux")]
|
||||
assert!(!SandboxManager::was_denied(SandboxType::LinuxLandlock, 0, ""));
|
||||
assert!(!SandboxManager::was_denied(
|
||||
SandboxType::LinuxLandlock,
|
||||
0,
|
||||
""
|
||||
));
|
||||
#[cfg(target_os = "windows")]
|
||||
assert!(!SandboxManager::was_denied(SandboxType::Windows, 0, ""));
|
||||
}
|
||||
@@ -779,9 +787,15 @@ mod tests {
|
||||
#[test]
|
||||
#[cfg(target_os = "linux")]
|
||||
fn test_parity_seccomp_sigsys_detected() {
|
||||
assert!(SandboxManager::was_denied(SandboxType::LinuxLandlock, 31, ""));
|
||||
assert!(SandboxManager::was_denied(
|
||||
SandboxType::LinuxLandlock, 1, "Bad system call"
|
||||
SandboxType::LinuxLandlock,
|
||||
31,
|
||||
""
|
||||
));
|
||||
assert!(SandboxManager::was_denied(
|
||||
SandboxType::LinuxLandlock,
|
||||
1,
|
||||
"Bad system call"
|
||||
));
|
||||
}
|
||||
|
||||
@@ -790,10 +804,14 @@ mod tests {
|
||||
fn test_parity_seatbelt_file_write_detected() {
|
||||
// Seatbelt patterns use "Sandbox: <cmd> denied <operation>" format.
|
||||
assert!(SandboxManager::was_denied(
|
||||
SandboxType::MacosSeatbelt, 1, "Sandbox: ls denied file-write*"
|
||||
SandboxType::MacosSeatbelt,
|
||||
1,
|
||||
"Sandbox: ls denied file-write*"
|
||||
));
|
||||
assert!(SandboxManager::was_denied(
|
||||
SandboxType::MacosSeatbelt, 1, "Operation not permitted"
|
||||
SandboxType::MacosSeatbelt,
|
||||
1,
|
||||
"Operation not permitted"
|
||||
));
|
||||
}
|
||||
|
||||
|
||||
@@ -10,8 +10,8 @@ use serde::{Deserialize, Serialize};
|
||||
use std::io;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use crate::command_safety::SafetyLevel;
|
||||
use super::{CommandSpec, ExecEnv};
|
||||
use crate::command_safety::SafetyLevel;
|
||||
|
||||
/// Determines execution restrictions for shell commands.
|
||||
///
|
||||
|
||||
+128
-125
@@ -149,130 +149,130 @@ pub fn apply_seccomp_filter() -> std::io::Result<()> {
|
||||
// These are the syscalls most commonly used by shell commands, compilers,
|
||||
// and developer tools. Any syscall NOT on this list causes immediate SIGSYS.
|
||||
let allowed_syscalls: &[u32] = &[
|
||||
0, // read
|
||||
1, // write
|
||||
2, // open
|
||||
3, // close
|
||||
4, // stat
|
||||
5, // fstat
|
||||
6, // lstat
|
||||
7, // poll
|
||||
8, // lseek
|
||||
9, // mmap
|
||||
10, // mprotect
|
||||
11, // munmap
|
||||
12, // brk
|
||||
13, // rt_sigaction
|
||||
14, // rt_sigprocmask
|
||||
15, // rt_sigreturn
|
||||
16, // ioctl
|
||||
17, // pread64
|
||||
18, // pwrite64
|
||||
19, // readv
|
||||
20, // writev
|
||||
21, // access
|
||||
22, // pipe
|
||||
23, // select
|
||||
24, // sched_yield
|
||||
25, // mremap
|
||||
27, // mincore
|
||||
28, // madvise
|
||||
29, // shmget
|
||||
30, // shmat
|
||||
32, // dup
|
||||
33, // dup2
|
||||
35, // nanosleep
|
||||
39, // getpid
|
||||
41, // socket
|
||||
42, // connect
|
||||
43, // accept
|
||||
44, // sendto
|
||||
45, // recvfrom
|
||||
46, // sendmsg
|
||||
47, // recvmsg
|
||||
48, // shutdown
|
||||
49, // bind
|
||||
50, // listen
|
||||
51, // getsockname
|
||||
52, // getpeername
|
||||
53, // socketpair
|
||||
54, // setsockopt
|
||||
55, // getsockopt
|
||||
56, // clone
|
||||
57, // fork
|
||||
58, // vfork
|
||||
59, // execve
|
||||
60, // exit
|
||||
61, // wait4
|
||||
62, // kill
|
||||
63, // uname
|
||||
72, // fcntl
|
||||
73, // flock
|
||||
74, // fsync
|
||||
75, // fdatasync
|
||||
76, // truncate
|
||||
77, // ftruncate
|
||||
78, // getdents
|
||||
79, // getcwd
|
||||
80, // chdir
|
||||
81, // fchdir
|
||||
82, // rename
|
||||
83, // mkdir
|
||||
84, // rmdir
|
||||
85, // creat
|
||||
86, // link
|
||||
87, // unlink
|
||||
88, // symlink
|
||||
89, // readlink
|
||||
90, // chmod
|
||||
91, // fchmod
|
||||
92, // chown
|
||||
93, // fchown
|
||||
94, // lchown
|
||||
95, // umask
|
||||
96, // gettimeofday
|
||||
97, // getrlimit
|
||||
98, // getrusage
|
||||
99, // sysinfo
|
||||
100, // times
|
||||
102, // getuid
|
||||
104, // getgid
|
||||
107, // geteuid
|
||||
108, // getegid
|
||||
110, // getppid
|
||||
111, // getpgrp
|
||||
112, // setsid
|
||||
116, // syslog
|
||||
131, // sigaltstack
|
||||
137, // statfs
|
||||
138, // fstatfs
|
||||
157, // prctl
|
||||
158, // arch_prctl
|
||||
186, // gettid
|
||||
201, // time
|
||||
202, // futex
|
||||
204, // sched_getaffinity
|
||||
217, // getdents64
|
||||
218, // set_tid_address
|
||||
228, // clock_gettime
|
||||
230, // clock_nanosleep
|
||||
231, // exit_group
|
||||
232, // epoll_wait
|
||||
233, // epoll_ctl
|
||||
234, // tgkill
|
||||
235, // utimes
|
||||
257, // openat
|
||||
262, // newfstatat
|
||||
273, // set_robust_list
|
||||
281, // epoll_pwait
|
||||
291, // epoll_create1
|
||||
292, // dup3
|
||||
293, // pipe2
|
||||
302, // prlimit64
|
||||
318, // getrandom
|
||||
332, // statx
|
||||
334, // rseq
|
||||
435, // clone3
|
||||
0, // read
|
||||
1, // write
|
||||
2, // open
|
||||
3, // close
|
||||
4, // stat
|
||||
5, // fstat
|
||||
6, // lstat
|
||||
7, // poll
|
||||
8, // lseek
|
||||
9, // mmap
|
||||
10, // mprotect
|
||||
11, // munmap
|
||||
12, // brk
|
||||
13, // rt_sigaction
|
||||
14, // rt_sigprocmask
|
||||
15, // rt_sigreturn
|
||||
16, // ioctl
|
||||
17, // pread64
|
||||
18, // pwrite64
|
||||
19, // readv
|
||||
20, // writev
|
||||
21, // access
|
||||
22, // pipe
|
||||
23, // select
|
||||
24, // sched_yield
|
||||
25, // mremap
|
||||
27, // mincore
|
||||
28, // madvise
|
||||
29, // shmget
|
||||
30, // shmat
|
||||
32, // dup
|
||||
33, // dup2
|
||||
35, // nanosleep
|
||||
39, // getpid
|
||||
41, // socket
|
||||
42, // connect
|
||||
43, // accept
|
||||
44, // sendto
|
||||
45, // recvfrom
|
||||
46, // sendmsg
|
||||
47, // recvmsg
|
||||
48, // shutdown
|
||||
49, // bind
|
||||
50, // listen
|
||||
51, // getsockname
|
||||
52, // getpeername
|
||||
53, // socketpair
|
||||
54, // setsockopt
|
||||
55, // getsockopt
|
||||
56, // clone
|
||||
57, // fork
|
||||
58, // vfork
|
||||
59, // execve
|
||||
60, // exit
|
||||
61, // wait4
|
||||
62, // kill
|
||||
63, // uname
|
||||
72, // fcntl
|
||||
73, // flock
|
||||
74, // fsync
|
||||
75, // fdatasync
|
||||
76, // truncate
|
||||
77, // ftruncate
|
||||
78, // getdents
|
||||
79, // getcwd
|
||||
80, // chdir
|
||||
81, // fchdir
|
||||
82, // rename
|
||||
83, // mkdir
|
||||
84, // rmdir
|
||||
85, // creat
|
||||
86, // link
|
||||
87, // unlink
|
||||
88, // symlink
|
||||
89, // readlink
|
||||
90, // chmod
|
||||
91, // fchmod
|
||||
92, // chown
|
||||
93, // fchown
|
||||
94, // lchown
|
||||
95, // umask
|
||||
96, // gettimeofday
|
||||
97, // getrlimit
|
||||
98, // getrusage
|
||||
99, // sysinfo
|
||||
100, // times
|
||||
102, // getuid
|
||||
104, // getgid
|
||||
107, // geteuid
|
||||
108, // getegid
|
||||
110, // getppid
|
||||
111, // getpgrp
|
||||
112, // setsid
|
||||
116, // syslog
|
||||
131, // sigaltstack
|
||||
137, // statfs
|
||||
138, // fstatfs
|
||||
157, // prctl
|
||||
158, // arch_prctl
|
||||
186, // gettid
|
||||
201, // time
|
||||
202, // futex
|
||||
204, // sched_getaffinity
|
||||
217, // getdents64
|
||||
218, // set_tid_address
|
||||
228, // clock_gettime
|
||||
230, // clock_nanosleep
|
||||
231, // exit_group
|
||||
232, // epoll_wait
|
||||
233, // epoll_ctl
|
||||
234, // tgkill
|
||||
235, // utimes
|
||||
257, // openat
|
||||
262, // newfstatat
|
||||
273, // set_robust_list
|
||||
281, // epoll_pwait
|
||||
291, // epoll_create1
|
||||
292, // dup3
|
||||
293, // pipe2
|
||||
302, // prlimit64
|
||||
318, // getrandom
|
||||
332, // statx
|
||||
334, // rseq
|
||||
435, // clone3
|
||||
];
|
||||
|
||||
// Build the BPF program.
|
||||
@@ -316,7 +316,10 @@ pub fn apply_seccomp_filter() -> std::io::Result<()> {
|
||||
// forward over the remaining checks + KILL to reach ALLOW.
|
||||
for &syscall in allowed_syscalls {
|
||||
let remaining = (allowed_syscalls.len() as u8).saturating_sub(
|
||||
allowed_syscalls.iter().position(|&s| s == syscall).unwrap_or(0) as u8
|
||||
allowed_syscalls
|
||||
.iter()
|
||||
.position(|&s| s == syscall)
|
||||
.unwrap_or(0) as u8,
|
||||
);
|
||||
// If syscall == this one, jump to allow_target; otherwise fall through
|
||||
filter.push(sock_filter {
|
||||
|
||||
@@ -326,7 +326,10 @@ impl ToolSpec for RlmEvalTool {
|
||||
// Store full body as a handle for out-of-band retrieval
|
||||
let name = format!("{tag}_{}", 0); // single counter is fine
|
||||
let handle = store.insert_text(session_id, name, text);
|
||||
(Some(format!("{} chars; retrieve via handle_read", text.len())), Some(handle))
|
||||
(
|
||||
Some(format!("{} chars; retrieve via handle_read", text.len())),
|
||||
Some(handle),
|
||||
)
|
||||
}
|
||||
_ => (None, None),
|
||||
}
|
||||
|
||||
@@ -43,19 +43,21 @@ pub(crate) fn render_footer(f: &mut Frame, area: Rect, app: &mut App) {
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let toast = quit_prompt.or_else(|| {
|
||||
// Version-update hint takes precedence over ephemeral status toasts
|
||||
// so the user sees it even when status traffic would hide it.
|
||||
app.version_hint.as_ref().map(|hint| FooterToast {
|
||||
text: hint.clone(),
|
||||
color: palette::STATUS_INFO,
|
||||
let toast = quit_prompt
|
||||
.or_else(|| {
|
||||
// Version-update hint takes precedence over ephemeral status toasts
|
||||
// so the user sees it even when status traffic would hide it.
|
||||
app.version_hint.as_ref().map(|hint| FooterToast {
|
||||
text: hint.clone(),
|
||||
color: palette::STATUS_INFO,
|
||||
})
|
||||
})
|
||||
}).or_else(|| {
|
||||
app.active_status_toast().map(|toast| FooterToast {
|
||||
text: toast.text,
|
||||
color: status_color(toast.level),
|
||||
})
|
||||
});
|
||||
.or_else(|| {
|
||||
app.active_status_toast().map(|toast| FooterToast {
|
||||
text: toast.text,
|
||||
color: status_color(toast.level),
|
||||
})
|
||||
});
|
||||
|
||||
// Drive every cluster from the user's configured `status_items`. Mode
|
||||
// and Model are always rendered by `FooterProps` itself (their position
|
||||
@@ -645,8 +647,7 @@ pub(crate) fn footer_auxiliary_spans(app: &App, max_width: usize) -> Vec<Span<'s
|
||||
})
|
||||
.unwrap_or_default();
|
||||
|
||||
let shell_spans =
|
||||
crate::tui::widgets::footer_shell_chip(active_foreground_shell_running(app));
|
||||
let shell_spans = crate::tui::widgets::footer_shell_chip(active_foreground_shell_running(app));
|
||||
|
||||
let parts: Vec<&Vec<Span<'static>>> = [
|
||||
&coherence_spans,
|
||||
|
||||
@@ -940,9 +940,7 @@ async fn run_event_loop(
|
||||
if let Some(ref handle) = version_check {
|
||||
done = handle.is_finished();
|
||||
}
|
||||
if done
|
||||
&& let Ok(Some(hint)) = version_check.take().unwrap().await
|
||||
{
|
||||
if done && let Ok(Some(hint)) = version_check.take().unwrap().await {
|
||||
app.version_hint = Some(hint);
|
||||
}
|
||||
|
||||
|
||||
@@ -2079,7 +2079,10 @@ pub(crate) fn slash_completion_hints(
|
||||
continue;
|
||||
}
|
||||
let cmd_lower = cmd.name.to_ascii_lowercase();
|
||||
let alias_match = cmd.aliases.iter().any(|a| a.to_ascii_lowercase().contains(&prefix_lower));
|
||||
let alias_match = cmd
|
||||
.aliases
|
||||
.iter()
|
||||
.any(|a| a.to_ascii_lowercase().contains(&prefix_lower));
|
||||
if cmd_lower.contains(&prefix_lower) || alias_match {
|
||||
seen.insert(name.clone());
|
||||
push_command_entry(&mut entries, &name, cmd.name, &prefix_lower, locale);
|
||||
@@ -2096,7 +2099,10 @@ pub(crate) fn slash_completion_hints(
|
||||
continue;
|
||||
}
|
||||
let cmd_lower = cmd.name.to_ascii_lowercase();
|
||||
let alias_match = cmd.aliases.iter().any(|a| fuzzy_chars_in_order(&prefix_lower, &a.to_ascii_lowercase()));
|
||||
let alias_match = cmd
|
||||
.aliases
|
||||
.iter()
|
||||
.any(|a| fuzzy_chars_in_order(&prefix_lower, &a.to_ascii_lowercase()));
|
||||
if fuzzy_chars_in_order(&prefix_lower, &cmd_lower) || alias_match {
|
||||
seen.insert(name.clone());
|
||||
push_command_entry(&mut entries, &name, cmd.name, &prefix_lower, locale);
|
||||
@@ -2122,9 +2128,9 @@ pub(crate) fn slash_completion_hints(
|
||||
for (skill_name, skill_desc) in cached_skills {
|
||||
let skill_name_lower = skill_name.to_ascii_lowercase();
|
||||
if skill_name_lower.contains(&skill_prefix)
|
||||
&& !entries.iter().any(|e| {
|
||||
e.name == format!("/skill {skill_name}")
|
||||
})
|
||||
&& !entries
|
||||
.iter()
|
||||
.any(|e| e.name == format!("/skill {skill_name}"))
|
||||
{
|
||||
entries.push(SlashMenuEntry {
|
||||
name: format!("/skill {skill_name}"),
|
||||
@@ -2201,37 +2207,36 @@ fn push_command_entry(
|
||||
prefix_lower: &str,
|
||||
locale: crate::localization::Locale,
|
||||
) {
|
||||
let (description, alias_hint) =
|
||||
if let Some(info) = commands::get_command_info(command_key) {
|
||||
let hint = if !command_key.to_ascii_lowercase().starts_with(prefix_lower) {
|
||||
let (description, alias_hint) = if let Some(info) = commands::get_command_info(command_key) {
|
||||
let hint = if !command_key.to_ascii_lowercase().starts_with(prefix_lower) {
|
||||
info.aliases
|
||||
.iter()
|
||||
.find(|a| {
|
||||
a.to_ascii_lowercase().starts_with(prefix_lower)
|
||||
|| a.to_ascii_lowercase().contains(prefix_lower)
|
||||
|| fuzzy_chars_in_order(prefix_lower, &a.to_ascii_lowercase())
|
||||
})
|
||||
.map(|a| a.to_string())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let desc = if info.aliases.is_empty() {
|
||||
info.description_for(locale).to_string()
|
||||
} else {
|
||||
format!(
|
||||
"{} (aliases: {})",
|
||||
info.description_for(locale),
|
||||
info.aliases
|
||||
.iter()
|
||||
.find(|a| {
|
||||
a.to_ascii_lowercase().starts_with(prefix_lower)
|
||||
|| a.to_ascii_lowercase().contains(prefix_lower)
|
||||
|| fuzzy_chars_in_order(prefix_lower, &a.to_ascii_lowercase())
|
||||
})
|
||||
.map(|a| a.to_string())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let desc = if info.aliases.is_empty() {
|
||||
info.description_for(locale).to_string()
|
||||
} else {
|
||||
format!(
|
||||
"{} (aliases: {})",
|
||||
info.description_for(locale),
|
||||
info.aliases
|
||||
.iter()
|
||||
.map(|a| format!("/{a}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
};
|
||||
(desc, hint)
|
||||
} else {
|
||||
(String::from("User-defined command"), None)
|
||||
.map(|a| format!("/{a}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
};
|
||||
(desc, hint)
|
||||
} else {
|
||||
(String::from("User-defined command"), None)
|
||||
};
|
||||
entries.push(SlashMenuEntry {
|
||||
name: name.to_string(),
|
||||
description,
|
||||
|
||||
Generated
+1610
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"devDependencies": {
|
||||
"wrangler": "^4.94.0"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user