CIAgent
2d9f3201b3
Task 1-1-01: SandboxBackend protocol + UnshareBackend (unshare user/mount/pid/net)
+ workdir layout (workspace/ + snapshots/). Isolation probe real on this box:
in-ns uid=0, network isolated (fresh net ns, lo only), writes contained to per-sandbox
bind dir; proc-remount not permitted (documented, not required). Deviations (documented):
util-linux 2.38.1 lacks --bind flag -> bind moved into namespace via sh -c mount shim;
rlimits moved into shim (preexec would kill the pytest interpreter); userns != DAC barrier
(host-uid-owned targets), documented for hardening under D-025.
Task 1-1-02: add sqlmodel, sqlalchemy, websockets, aiofiles (PyPI-verified); config keys
SANDBOX_DIR/MAX_CONCURRENT=5/TIMEOUT_S=900/MAX_WORKDIR_MB=512/DB_PATH (D-024/027/032/G-2).
Task 1-1-03: README sandbox isolation section with real probe transcript + locked
resource-limit mechanism (G-1/G-2); ruff config already correct (no change).
139/139 tests pass; ruff clean. .gitignore: ignore all ai-service sandboxes dirs (runtime+tests).
---ci---
phase: 1
milestone: v0.3
status: execute
requirements: {covered: [REQ-3-001, REQ-3-002], partial: []}
---/ci---
58 lines
661 B
Plaintext
58 lines
661 B
Plaintext
# Environment files — never commit credentials
|
|
.env
|
|
.env.secrets
|
|
.env.*
|
|
!.env.example
|
|
|
|
# CIAgent secrets
|
|
.ciagent/.env.secrets
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
venv/
|
|
|
|
# Build artifacts
|
|
dist/
|
|
/build/
|
|
.next/
|
|
.turbo/
|
|
*.tsbuildinfo
|
|
|
|
# Storybook
|
|
storybook-static/
|
|
|
|
# OS files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# IDE
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
*.swo
|
|
|
|
# Logs
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
|
|
# Test coverage
|
|
coverage/
|
|
.nyc_output/
|
|
|
|
# Python tooling caches
|
|
.pytest_cache/
|
|
.ruff_cache/
|
|
*.egg-info/
|
|
.ciagent/bin/
|
|
|
|
# v0.3 engine runtime data (SQLite + sandboxes)
|
|
apps/ai-service/ai_service/data/
|
|
apps/ai-service/**/sandboxes/
|
|
*.db
|
|
*.db-journal
|