From 738982ce10a6124fc59d4d11c7c57b168e741ccb Mon Sep 17 00:00:00 2001 From: host Date: Sun, 8 Nov 2026 10:22:51 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20rebase=20=E5=90=88=E5=85=A5=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=EF=BC=88#215=20=E5=B7=B2=E5=90=88=E5=B9=B6=20+=20?= =?UTF-8?q?=E6=89=A7=E8=A1=8C=E5=99=A8=E6=96=87=E6=A1=88=20+=20server=20?= =?UTF-8?q?=E9=87=8D=E5=AF=BC=E5=87=BA=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - cloud/server.py：重导出 handler_support._chv_vm_dead_from_row， 沿用 main 的 split 重导出约定（test_chv_arch_maint_fe 从 cloud.server 导入该名）。 - cloud/tests/test_coverage85_server2.py：执行器非法值文案期望 跟随分支行为（valid 列表已含 cloud-hypervisor，main 新增 的该用例原先按旧文案断言）。 - cloud/chv/compat215.py + test_chv_arch_maint_fe.py：#215 （facc2a2）已合入 main，四模块已存在，替换清单本身未动； 钉住项由“模块不存在”翻为“模块已存在”，tmpfs_isolated 扫描白名单加 canonical 定义 cloud/sandbox_policy.py。 R1/R2 替换本身未做（属合并后工作）：语义已核对， gates.resolve_inside 与本地版逐行一致， sandbox_policy.tmpfs_isolated 对 cloud-hypervisor 同样返回 False，未触发 R2 的停手条件。 --- cloud/chv/compat215.py | 8 ++++---- cloud/server.py | 1 + cloud/tests/test_chv_arch_maint_fe.py | 18 ++++++++++++++---- cloud/tests/test_coverage85_server2.py | 2 +- 4 files changed, 20 insertions(+), 9 deletions(-) diff --git a/cloud/chv/compat215.py b/cloud/chv/compat215.py index 5dd76f2..56afec1 100644 --- a/cloud/chv/compat215.py +++ b/cloud/chv/compat215.py @@ -25,9 +25,9 @@ cloud/gates.py、cloud/quota.py、cloud/sandbox_policy.py。 本模块只依赖标准库，是叶子模块，不 import cloud.sandbox。 合并后替换清单（REPLACEMENT_POINTS，本轨从“接口形状” -推进到可机械执行的清单；#215 未合并前一律不 import -cloud.gates / cloud.sandbox_policy / cloud.timeouts / -cloud.quota，测试钉住这些模块在本基线里不存在）： +推进到可机械执行的清单；#215 已合并，cloud.gates / +cloud.sandbox_policy / cloud.timeouts / cloud.quota +已存在，替换按清单执行，测试钉住清单本身不漂移）： - R1 gates.resolve_inside：唯一生产调用方是 hardening._is_within（快照 URL 白名单）。合并后两步： ① hardening 改为 `from cloud.gates import resolve_inside`； @@ -49,7 +49,7 @@ cloud.quota，测试钉住这些模块在本基线里不存在）： import os # 合并后替换清单：每项的 local/replacement/test 字段由测试 -# 逐项核对（local 函数真实存在、#215 模块当前不存在、 +# 逐项核对（local 函数真实存在、#215 模块已存在、 # test 命名的测试类真实存在），清单本身不得漂移。 REPLACEMENT_POINTS = ( { diff --git a/cloud/server.py b/cloud/server.py index 2bb406c..a6bd16a 100644 --- a/cloud/server.py +++ b/cloud/server.py @@ -217,6 +217,7 @@ from cloud.handler_support import ( _agent_tools_from_row as _agent_tools_from_row, _apply_default_quota as _apply_default_quota, _auth_store as _auth_store, + _chv_vm_dead_from_row as _chv_vm_dead_from_row, _default_quota_usd_micros as _default_quota_usd_micros, _ensure_followups_table as _ensure_followups_table, _ensure_quotas_table as _ensure_quotas_table, diff --git a/cloud/tests/test_chv_arch_maint_fe.py b/cloud/tests/test_chv_arch_maint_fe.py index 56a8a78..63b4f44 100644 --- a/cloud/tests/test_chv_arch_maint_fe.py +++ b/cloud/tests/test_chv_arch_maint_fe.py @@ -405,7 +405,10 @@ class PublicApiTypesTest(unittest.TestCase): class ReplacementChecklistTest(unittest.TestCase): - def test_points_resolve_and_215_modules_absent(self): + def test_points_resolve_and_215_modules_present(self): + # #215 已合并：四模块已存在，替换清单待按项执行； + # 本测试钉住清单本身（R1/R2/R3、R3 不替换、R2 + # 暂无调用方）与 shim 不越权（无 decide 等名字）。 by_id = {p["id"]: p for p in REPLACEMENT_POINTS} self.assertEqual(set(by_id), {"R1", "R2", "R3"}) self.assertIsNotNone(resolve_inside) @@ -414,21 +417,28 @@ class ReplacementChecklistTest(unittest.TestCase): self.assertIn("resolve_inside", hardening) for mod in ("cloud.gates", "cloud.sandbox_policy", "cloud.timeouts", "cloud.quota"): - self.assertIsNone(importlib.util.find_spec(mod), mod) + self.assertIsNotNone(importlib.util.find_spec(mod), mod) import cloud.chv.compat215 as m self.assertFalse(hasattr(m, "resolve_module_timeout")) self.assertFalse(hasattr(m, "decide")) self.assertIsNone(by_id["R3"]["replacement"]) self.assertIsNone(by_id["R2"]["caller"]) - def test_tmpfs_isolated_has_no_production_caller(self): + def test_tmpfs_isolated_only_shim_and_canonical(self): + # #215 已合并：cloud/sandbox_policy.py 是 canonical + # tmpfs_isolated 定义（非 shim 的调用方）；除 shim + # 与 canonical 外，生产代码不得再提及该名字（有新 + # 调用方时直接 import #215 版，见 R2 清单）。 hits = [] for f in (ROOT / "cloud").rglob("*.py"): if "tests" in f.parts: continue if "tmpfs_isolated" in f.read_text(): hits.append(str(f.relative_to(ROOT))) - self.assertEqual(hits, ["cloud/chv/compat215.py"]) + self.assertEqual(sorted(hits), sorted([ + "cloud/chv/compat215.py", + "cloud/sandbox_policy.py", + ])) def _row(**kw): diff --git a/cloud/tests/test_coverage85_server2.py b/cloud/tests/test_coverage85_server2.py index 4e41265..1ee95fd 100644 --- a/cloud/tests/test_coverage85_server2.py +++ b/cloud/tests/test_coverage85_server2.py @@ -238,7 +238,7 @@ class Server2TestCase(unittest.TestCase): ({"project_id": pid, "prompt": "x", "priority": "abc"}, "priority must be an integer"), ({"project_id": pid, "prompt": "x", "executor": "bogus"}, - "executor must be local, docker or cloud"), + "executor must be local, docker, cloud or cloud-hypervisor"), ({"project_id": pid, "prompt": "x", "model": " "}, "model must be a non-empty string"), ({"project_id": pid, "prompt": "x", "effort": "ultra"},