M0: compilable skeleton — Kigi 0.1.0 fork surgery
Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.
Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
ptyctl, ptyctl-cli, third_party/ unchanged; proto package
xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
(templates re-encrypted)
Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
module & dc_log, heap-profile uploader, auth-diagnostics uploader,
session-analytics halves of feedback; local zero-egress observability
preserved in new kigi-log crate (unified log, --debug firehose,
subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
shell util
Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted
Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean
Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
(new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
fast-worktree); RSS measurement tests serialized via serial_test
Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
notices sustained; kigi-tools ported-code notices extended; README,
CONTRIBUTING, SECURITY, AGENTS.md rewritten
Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).
This commit is contained in:
@@ -0,0 +1,169 @@
|
||||
//! Smoke test for sandbox enforcement.
|
||||
//!
|
||||
//! This binary applies a sandbox profile and then attempts various operations
|
||||
//! to verify kernel enforcement. Run it directly to test:
|
||||
//!
|
||||
//! ```bash
|
||||
//! # Test workspace profile (should allow writes to CWD, block ~/Desktop)
|
||||
//! cargo run -p kigi-sandbox --example sandbox_smoke_test
|
||||
//!
|
||||
//! # Test strict profile
|
||||
//! cargo run -p kigi-sandbox --example sandbox_smoke_test -- strict
|
||||
//!
|
||||
//! # Test read-only profile
|
||||
//! cargo run -p kigi-sandbox --example sandbox_smoke_test -- read-only
|
||||
//! ```
|
||||
|
||||
use kigi_sandbox::{ProfileName, SandboxManager};
|
||||
use std::path::Path;
|
||||
|
||||
fn main() {
|
||||
// Parse profile from args (default: workspace).
|
||||
let profile_name = std::env::args()
|
||||
.nth(1)
|
||||
.unwrap_or_else(|| "workspace".to_string());
|
||||
|
||||
let profile: ProfileName = profile_name.parse().unwrap_or_else(|e| {
|
||||
eprintln!("Error: {e}");
|
||||
std::process::exit(1);
|
||||
});
|
||||
|
||||
// Check platform support before applying
|
||||
let support = SandboxManager::support_info();
|
||||
println!(
|
||||
"Platform support: {}",
|
||||
if support.is_supported { "YES" } else { "NO" }
|
||||
);
|
||||
println!("Details: {}", support.details);
|
||||
|
||||
if !support.is_supported {
|
||||
println!("\n⚠️ Sandbox not supported on this platform.");
|
||||
println!(" On macOS: Seatbelt should be available (10.5+)");
|
||||
println!(" On Linux: Landlock requires kernel ≥ 5.13");
|
||||
println!("\n Tests will show what WOULD happen, but won't enforce.");
|
||||
}
|
||||
|
||||
let workspace = std::env::current_dir().expect("failed to get cwd");
|
||||
println!("\nProfile: {profile}");
|
||||
println!("Workspace: {}", workspace.display());
|
||||
|
||||
// Apply the sandbox
|
||||
println!("\n--- Applying sandbox ---");
|
||||
let mut sandbox = SandboxManager::new(profile, &workspace);
|
||||
match sandbox.apply(&workspace) {
|
||||
Ok(()) => {
|
||||
if sandbox.is_applied() {
|
||||
println!("✅ Sandbox applied (kernel-enforced, irreversible)");
|
||||
} else {
|
||||
println!("⚠️ Sandbox was not applied (unsupported platform or Off profile)");
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
println!("❌ Sandbox apply failed: {e}");
|
||||
}
|
||||
}
|
||||
|
||||
println!(
|
||||
"Child network restricted: {}",
|
||||
sandbox.restrict_child_network()
|
||||
);
|
||||
|
||||
// Test operations
|
||||
println!("\n--- Testing filesystem operations ---\n");
|
||||
|
||||
// Test 1: Read CWD (should always work)
|
||||
test_read("Read CWD", &workspace);
|
||||
|
||||
// Test 2: Read /tmp (should work for workspace/read-only)
|
||||
test_read("Read /tmp", Path::new("/tmp"));
|
||||
|
||||
// Test 3: Read home directory (should work for workspace/read-only, blocked for strict)
|
||||
if let Some(home) = dirs::home_dir() {
|
||||
test_read("Read ~/", &home);
|
||||
}
|
||||
|
||||
// Test 4: Write to CWD (should work for workspace/strict, blocked for read-only)
|
||||
let test_file = workspace.join(".sandbox-test-write");
|
||||
test_write("Write to CWD", &test_file);
|
||||
// Clean up
|
||||
let _ = std::fs::remove_file(&test_file);
|
||||
|
||||
// Test 5: Write to /tmp (should work for workspace/strict, blocked for read-only)
|
||||
let tmp_test = Path::new("/tmp/.kigi-sandbox-test");
|
||||
test_write("Write to /tmp", tmp_test);
|
||||
let _ = std::fs::remove_file(tmp_test);
|
||||
|
||||
// Test 6: Write outside workspace (should be blocked for all active profiles)
|
||||
if let Some(home) = dirs::home_dir() {
|
||||
let outside = home.join(".sandbox-test-blocked");
|
||||
test_write("Write to ~/", &outside);
|
||||
let _ = std::fs::remove_file(&outside);
|
||||
}
|
||||
|
||||
// Test 7: Read ~/.ssh (a custom profile's `deny` list could block this)
|
||||
if let Some(home) = dirs::home_dir() {
|
||||
let ssh = home.join(".ssh");
|
||||
if ssh.exists() {
|
||||
test_read("Read ~/.ssh/", &ssh);
|
||||
}
|
||||
}
|
||||
|
||||
// Summary
|
||||
println!("\n--- Sandbox event log ---");
|
||||
let events = sandbox.logger().take_events();
|
||||
for event in &events {
|
||||
println!(
|
||||
" {:?}: {} {:?}",
|
||||
event.event_type, event.profile, event.target
|
||||
);
|
||||
}
|
||||
if events.is_empty() {
|
||||
println!(" (no events recorded)");
|
||||
}
|
||||
|
||||
println!("\n✅ Smoke test complete");
|
||||
}
|
||||
|
||||
fn test_read(label: &str, path: &Path) {
|
||||
if path.is_file() {
|
||||
match std::fs::read(path) {
|
||||
Ok(_) => println!(" ✅ {label}: OK (read)"),
|
||||
Err(e)
|
||||
if e.raw_os_error() == Some(libc::EACCES)
|
||||
|| e.raw_os_error() == Some(libc::EPERM) =>
|
||||
{
|
||||
println!(" 🔒 {label}: BLOCKED ({e})");
|
||||
}
|
||||
Err(e) => println!(" ❌ {label}: ERROR ({e})"),
|
||||
}
|
||||
return;
|
||||
}
|
||||
match std::fs::read_dir(path) {
|
||||
Ok(mut entries) => {
|
||||
let count = entries.by_ref().take(5).count();
|
||||
println!(" ✅ {label}: OK ({count} entries)");
|
||||
}
|
||||
Err(e) => {
|
||||
if e.raw_os_error() == Some(libc::EACCES) || e.raw_os_error() == Some(libc::EPERM) {
|
||||
println!(" 🔒 {label}: BLOCKED ({e})");
|
||||
} else {
|
||||
println!(" ❌ {label}: ERROR ({e})");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn test_write(label: &str, path: &Path) {
|
||||
match std::fs::write(path, b"sandbox-test") {
|
||||
Ok(()) => {
|
||||
println!(" ✅ {label}: OK (written)");
|
||||
}
|
||||
Err(e) => {
|
||||
if e.raw_os_error() == Some(libc::EACCES) || e.raw_os_error() == Some(libc::EPERM) {
|
||||
println!(" 🔒 {label}: BLOCKED ({e})");
|
||||
} else {
|
||||
println!(" ❌ {label}: ERROR ({e})");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user