[Feat] Add the Destructive Command Guard binary service - #1060
[Feat] Add the Destructive Command Guard binary service#1060navedmerchant wants to merge 1 commit into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
5c460bd to
baade5f
Compare
github-actions
Bot
added
the
awaiting-review
edelauna
left a comment
edelauna
left a comment
There was a problem hiding this comment.
Looks good - just had 2 comments for increased test coverage.
| const result = runDcg("/dcg", "echo test", "/workspace") | ||
| emitResult(child, payload, code) | ||
|
|
||
| await expect(result).resolves.toEqual(expected) |
There was a problem hiding this comment.
Every case here calls runDcg with "/workspace" as cwd, but none of the assertions check that it actually reaches spawn's options. Worth adding an expect(mockSpawn).toHaveBeenCalledWith(..., expect.objectContaining({ cwd: "/workspace" })) somewhere so a dropped/hardcoded cwd would fail?
| "tar", | ||
| expect.arrayContaining(["-xJf", "/tmp/dcg.tar.xz", "-C", tempDir, "--no-same-owner"]), | ||
| expect.objectContaining({ shell: false }), | ||
| ) |
There was a problem hiding this comment.
Since extractTarXzArchive appends --no-overwrite-dir on Linux, wouldn't arrayContaining/objectContaining here miss that flag being dropped or stdio being stripped? The ZIP test above uses an exact toHaveBeenCalledWith — could this match that for the same strictness?
github-actions
Bot
added
awaiting-author
| sha256: string | ||
| }> | ||
|
|
||
| export const DCG_ARCHIVES: Readonly<Record<string, DcgArchiveInfo>> = { |
There was a problem hiding this comment.
added #1067 similar to what we could use for semble for dependency management
2 participants
Related GitHub Issue
Closes #1056
Part of #1049. Split from #1050.
Description
Adds a self-contained service boundary for the pinned Destructive Command Guard binary. It selects platform-specific archives, installs and verifies the binary through the managed-binary infrastructure, deduplicates concurrent installation requests, and runs DCG with typed allow/deny results.
This PR does not add a setting or change command auto-approval behavior.
Stack
2 / 4 — base:
feat/managed-binary-infrastructureReview only the six files in this PR's own diff. Merge after the managed-binary PR; GitHub will retarget the surviving stack automatically or the base can be changed to
mainafter its dependency merges.Test Procedure
pnpm --dir src exec vitest run services/destructive-command-guard/__tests__/manager.spec.ts services/destructive-command-guard/__tests__/runner.spec.ts pnpm --dir src check-typesResult: 2 test files passed, 22 tests passed; type-check passed. Repository pre-push type-check also passed.
Checklist