Enhance Beryl Agent detail and report views

2026-09-11 11:13:24 +08:00
parent 336bf88466
commit 15f067fff9
57 changed files with 1833 additions and 95 deletions
@@ -0,0 +1,23 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+const require = createRequire(new URL("../packages/harness/package.json", import.meta.url));
+const { parse } = require("yaml");
+const c = parse(readFileSync(new URL("../compose.sandbox.yaml", import.meta.url), "utf8"));
+test("agent sandbox is non-root, read-only, limited and internal-network-only", () => {
+  const a = c.services.agent;
+  assert.equal(a.user,"1000:1000"); assert.equal(a.read_only,true);
+  assert.deepEqual(a.cap_drop,["ALL"]); assert.ok(a.security_opt.includes("no-new-privileges:true"));
+  assert.equal(a.pids_limit,128); assert.ok(a.cpus>0); assert.ok(a.mem_limit);
+  assert.deepEqual(a.networks,["isolated"]); assert.equal(c.networks.isolated.internal,true);
+  assert.ok(a.ports.every(p=>p.startsWith("127.0.0.1:")));
+  assert.deepEqual(a.volumes,["sandbox-data:/app/workspace"]);
+  assert.equal(a.privileged,undefined);
+});
+test("credentials are not copied or loaded wholesale into the image", () => {
+  const dockerfile = readFileSync(new URL("../Dockerfile",import.meta.url),"utf8");
+  assert.ok(!/COPY\s+\.\s|COPY.*\.env|docker.sock/.test(dockerfile));
+  assert.equal(c.services.agent.env_file,undefined);
+  assert.equal(c.services.egress.environment.ANTHROPIC_API_KEY,undefined);
+});