ZacharyZhang-NY
6f31415ed6
The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok' crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party license archives, README provenance, and the required 'Based on Grok Build Open Source' attribution, now sourced from version_attribution.txt). Wire-visible renames (both sides in this repo, changed in lockstep): - Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode). - Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* / _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps a read-side alias for the legacy '_x.ai/session/update' method so existing updates.jsonl histories load; writes emit only the new name (both directions test-pinned). - Agent types grok-build* → kigi* with a documented legacy-prefix alias at resolution time so persisted sessions keep resolving. - ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build implementation dirs renamed to kigi*. - x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes grokday/groknight → kigiday/kiginight (old persisted values fall back to the default theme), web_fetch allowlist xAI hosts → kimi.com + moonshot platforms, changelog CDN → this repo, grok-build changelog archives deleted. - BYOK default endpoint removed: [endpoints] api_base_url is now truly optional with NO default — consumers fail fast with the flag name when unset (no silent x.ai egress). Mock harnesses inject it explicitly. - System-prompt identity fixed: 'released by xAI' → 'an unofficial community CLI for Kimi' (template + regenerated encrypted form). Also repaired pre-existing grok-era test debt found by the sweep: the stale trace_classify default-model pin, the grok-pager UA label test, pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY test could previously reach the real api.moonshot.cn), and the outdated oauth fixture scope key. Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings); FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed; deny advisories ok.
65 lines
2.8 KiB
TOML
65 lines
2.8 KiB
TOML
[package]
|
|
license = "Apache-2.0"
|
|
name = "kigi-sandbox"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
description = "OS-level sandboxing for Kigi using kernel primitives (Landlock/Seatbelt) via nono"
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
dirs = "5.0"
|
|
dunce = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
toml = { workspace = true }
|
|
tracing = { workspace = true }
|
|
kigi-config = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = { workspace = true }
|
|
# Pinned exact: the macOS Seatbelt deny precedence (see deny.rs `emit_seatbelt_deny`)
|
|
# depends on nono's observed rule-emission order. A bump can silently change it and
|
|
# re-open the `mv x y && cat y` bypass with `is_applied()` still true, so re-verify
|
|
# `deny_paths_e2e` on real macOS (it self-skips in CI) before bumping.
|
|
#
|
|
# Non-optional (not gated on `enforce`): Cargo has no target-conditional features
|
|
# table, so a `dep:nono` reference from the cross-platform `enforce` feature would
|
|
# break feature resolution on non-unix targets (e.g. Windows builds). nono/globset
|
|
# are unix-only here, so they only compile on unix anyway; the enforce *code*
|
|
# stays gated on `cfg(all(feature = "enforce", unix))`.
|
|
nono = { version = "=0.53.0", default-features = false }
|
|
# globset validates every deny glob on BOTH platforms (so a glob is interpreted
|
|
# identically or rejected identically) and matches them on Linux. Non-optional for
|
|
# the same reason as nono above.
|
|
globset = { workspace = true }
|
|
|
|
# Linux additionally walks the tree to expand globs to existing paths (enforce+
|
|
# linux only). cfg(linux)-gated rather than enforce-gated: the cross-platform
|
|
# enforce feature can't reference a linux-only optional dep without breaking macOS
|
|
# feature resolution, so a `--no-default-features` Linux build pulls it unused.
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
ignore = { workspace = true }
|
|
|
|
[features]
|
|
default = ["enforce"]
|
|
## Enable kernel-enforced sandboxing via nono (Landlock/Seatbelt). Marker feature
|
|
## only: the backing deps (nono/globset) are non-optional unix-only deps (see
|
|
## above), and the enforce code is gated on `cfg(all(feature = "enforce", unix))`.
|
|
## On non-unix targets enabling this feature is a no-op (no kernel sandbox exists).
|
|
enforce = []
|
|
|
|
[dev-dependencies]
|
|
serial_test = { workspace = true }
|
|
# Compiles the hand-rolled macOS deny-glob regex in tests to assert it matches
|
|
# EXACTLY the set globset (the Linux backend) matches — the cross-platform parity
|
|
# guard for the glob dialect.
|
|
regex = { workspace = true }
|
|
|
|
# The smoke-test example exercises kernel enforcement (uses enforce-only APIs
|
|
# like `support_info`), so it only builds with the `enforce` feature. This keeps
|
|
# `--no-default-features --all-targets` clean.
|
|
[[example]]
|
|
name = "sandbox_smoke_test"
|
|
required-features = ["enforce"]
|