Cameron Mcloughlin
e5c9663b4f
There is a bug on main and preview causes all terminal tool calls to fail when: - on windows - sandboxing is not available (i.e. no WSL) - sandboxing is enabled in settings (the default) - the "warn windows-drive grants" setting is enabled (the default) Example error: <img width="352" height="79" alt="image" src="https://github.com/user-attachments/assets/24affbec-f086-40eb-8827-ad74aabc6167" /> This PR fixes it by making sure we only show the check at the right time --- Release Notes: - N/A or Added/Fixed/Improved ...
80 lines
2.9 KiB
TOML
80 lines
2.9 KiB
TOML
[package]
|
|
name = "sandbox"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
publish.workspace = true
|
|
license = "GPL-3.0-or-later"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[lib]
|
|
path = "src/sandbox.rs"
|
|
|
|
[features]
|
|
# Builds `bwrap_test_helper`, the behavior helper driven by the NixOS sandbox
|
|
# VM tests in `nix/tests/sandboxing`. Off by default so normal builds don't
|
|
# produce the test binary. Pulls in serde only when enabled (the helper parses
|
|
# its check list as JSON), and enables the matching `http_proxy` escape hatch so
|
|
# the in-process proxy can reach the VM's private-network echo servers.
|
|
nixos-test = [
|
|
"dep:serde",
|
|
"dep:serde_json",
|
|
"http_proxy/nixos-integration-tests",
|
|
]
|
|
|
|
# Builds `wsl_sandbox_test_helper`, the Windows analog of `bwrap_test_helper`.
|
|
# It drives the real WSL/Bubblewrap sandbox end-to-end (see
|
|
# `script/test-wsl-sandbox.ps1` / `cargo xtask wsl-sandbox-tests`). Off by
|
|
# default so normal builds and the workspace test run don't produce it.
|
|
wsl-test = []
|
|
|
|
# Behavior test helper for the Linux Bubblewrap sandbox. Only built when the
|
|
# `nixos-test` feature is enabled (and only meaningful on Linux).
|
|
[[bin]]
|
|
name = "bwrap_test_helper"
|
|
path = "src/bwrap_test_helper.rs"
|
|
required-features = ["nixos-test"]
|
|
|
|
# Behavior test helper for the Windows WSL/Bubblewrap sandbox. Only built when
|
|
# the `wsl-test` feature is enabled (and only meaningful on Windows).
|
|
[[bin]]
|
|
name = "wsl_sandbox_test_helper"
|
|
path = "src/wsl_sandbox_test_helper.rs"
|
|
required-features = ["wsl-test"]
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
futures.workspace = true
|
|
http_proxy.workspace = true
|
|
log.workspace = true
|
|
# Used only by the `nixos-test` helper binary to parse its check list; gated
|
|
# behind the `nixos-test` feature so normal builds don't pull it in.
|
|
serde = { workspace = true, optional = true }
|
|
serde_json = { workspace = true, optional = true }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
libc.workspace = true
|
|
# Safe wrappers for the SCM_RIGHTS fd-passing and `fstat` the bind validator
|
|
# needs, so that code doesn't hand-roll `msghdr`/`CMSG_*`/`mem::zeroed` unsafe.
|
|
nix = { workspace = true, features = ["fs", "socket", "uio"] }
|
|
# Builds the in-sandbox seccomp-BPF filter that blocks the untrusted command from
|
|
# creating `AF_UNIX` (and other non-IP) sockets, `io_uring`, `ptrace`, etc. — the
|
|
# syscall-level half of preventing session-IPC-socket sandbox escapes.
|
|
seccompiler.workspace = true
|
|
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
tempfile.workspace = true
|
|
# For the `#[gpui::property_test]` in the writable-grant normalization tests.
|
|
# `proptest` comes transitively via `gpui::proptest`.
|
|
gpui = { workspace = true, features = ["test-support"] }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
tempfile.workspace = true
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
smol.workspace = true
|
|
# Structural WSL-installed check (registered distros under HKCU\...\Lxss)
|
|
# without spawning `wsl.exe`.
|
|
windows-registry.workspace = true
|