98c3b2438a
Changes: - Classify clipboard delivery confidence - Add durable session update append - Scope the xAI session bearer to first-party memory embedding endpoints - Persist subagent outputs to disk and bound long-lived agent state - Add MiniSweAgent:bash for mini-swe-agent parity - Revert taking local sessions off the persistent shell - Contextual tip recommending grok wrap on SSH sessions - Voice STT bearer from model BYOK env_key/api_key - Define exact website policies for sandbox - Gate unsafe shell environments - Shared pin hoist; single require_sha gate for marketplace plugins - Server-signed is-managed claim (closes sidecar-removal downgrade) - Optional require_sha pin for remote plugin installs - Show session title and last exchange in the exit resume hint - Gate shell output redirects - Warn when fail_closed is present but not a boolean - Add canonical text editing core (ratatui-textarea) - Keep execution state out of goal scratch - Add acknowledged persistence primitives - Inherit child network restrictions in sandbox - Fail closed when hook matchers fail to recompile - Add MCP setup preferences for plugin MCPs - Gate sourced shell scripts - Gate file-typed project hooks - grok wrap: restore terminal modes on child death - Harden owner-only permissions on auth and MCP credentials - Create crash dump files with owner-only permissions - Write the agent_id cache owner-only (0600) - SessionMetrics mode skips Mixpanel profile sync - Dashboard: slim live-tail peek - Yank full queued prompt text, not (+N lines) - Defeat clock-rollback on the signed managed-config cache - Stop early session/cancel from overtaking the prompt and wedging the turn slot - Self-heal a diverged agent entrypoint on startup - Add matched inference expectations in test-support - Add AuthSingleFlight cancel/successor gap tests - Remove consumer from external OTEL allowlist and pin scrub coverage - Enable /copy in minimal mode - Surface capacity and API-key detail on 429 errors - Single-flight interactive auth - Fix PageUp/PageDown skipping lines behind sticky prompt header
67 lines
2.9 KiB
TOML
67 lines
2.9 KiB
TOML
[package]
|
|
license = "Apache-2.0"
|
|
name = "xai-grok-sandbox"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
description = "OS-level sandboxing for Grok Build using kernel primitives (Landlock/Seatbelt) via nono"
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
dirs = "5.0"
|
|
dunce = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
toml = { workspace = true }
|
|
tracing = { workspace = true }
|
|
url = { workspace = true }
|
|
xai-grok-config = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = { workspace = true }
|
|
# Pinned exact: the macOS Seatbelt deny precedence (see deny.rs `emit_seatbelt_deny`)
|
|
# depends on nono's observed rule-emission order. A bump can silently change it and
|
|
# re-open the `mv x y && cat y` bypass with `is_applied()` still true, so re-verify
|
|
# `deny_paths_e2e` on real macOS (it self-skips in CI) before bumping.
|
|
#
|
|
# Non-optional (not gated on `enforce`): Cargo has no target-conditional features
|
|
# table, so a `dep:nono` reference from the cross-platform `enforce` feature would
|
|
# break feature resolution on non-unix targets (e.g. Windows builds). nono/globset
|
|
# are unix-only here, so they only compile on unix anyway; the enforce *code*
|
|
# stays gated on `cfg(all(feature = "enforce", unix))`.
|
|
nono = { version = "=0.53.0", default-features = false }
|
|
# globset validates every deny glob on BOTH platforms (so a glob is interpreted
|
|
# identically or rejected identically) and matches them on Linux. Non-optional for
|
|
# the same reason as nono above.
|
|
globset = { workspace = true }
|
|
|
|
# Linux additionally walks the tree to expand globs to existing paths (enforce+
|
|
# linux only). cfg(linux)-gated rather than enforce-gated: the cross-platform
|
|
# enforce feature can't reference a linux-only optional dep without breaking macOS
|
|
# feature resolution, so a `--no-default-features` Linux build pulls it unused.
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
ignore = { workspace = true }
|
|
|
|
[features]
|
|
default = ["enforce"]
|
|
## Enable kernel-enforced sandboxing via nono (Landlock/Seatbelt). Marker feature
|
|
## only: the backing deps (nono/globset) are non-optional unix-only deps (see
|
|
## above), and the enforce code is gated on `cfg(all(feature = "enforce", unix))`.
|
|
## On non-unix targets enabling this feature is a no-op (no kernel sandbox exists).
|
|
enforce = []
|
|
|
|
[dev-dependencies]
|
|
serial_test = { workspace = true }
|
|
# Compiles the hand-rolled macOS deny-glob regex in tests to assert it matches
|
|
# EXACTLY the set globset (the Linux backend) matches — the cross-platform parity
|
|
# guard for the glob dialect.
|
|
regex = { workspace = true }
|
|
|
|
# The smoke-test example exercises kernel enforcement (uses enforce-only APIs
|
|
# like `support_info`), so it only builds with the `enforce` feature. This keeps
|
|
# `--no-default-features --all-targets` clean.
|
|
[[example]]
|
|
name = "sandbox_smoke_test"
|
|
required-features = ["enforce"]
|