Blomios
17ca65ed0f
LP4-1 : adaptateurs SandboxEnforcer concrets (LandlockSandbox Linux via le LSM Landlock, NoopSandbox ailleurs) + default_enforcer() cfg-sélectionné, prêts à être injectés au composition root (LP4-3). Aucun changement de comportement runtime tant que rien n'est câblé : SpawnSpec.sandbox reste None. LP4-2 : PortablePtyAdapter consomme SpawnSpec.sandbox via spawn_command_sandboxed (thread jetable restreint par enforce() puis fork → le domaine Landlock est hérité par l'enfant à travers execve ; les autres threads d'IdeA ne sont jamais sandboxés). Builder additif with_sandbox_enforcer ; fail-closed si enforce() échoue. Tests : domain + infrastructure verts (dont les tests Landlock réels de fencing read-only/write-only et la confine-au-thread). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
75 lines
2.7 KiB
Rust
75 lines
2.7 KiB
Rust
//! # IdeA — Infrastructure layer
|
|
//!
|
|
//! Concrete **adapters** implementing the domain ports (ARCHITECTURE §5). All
|
|
//! real-world I/O (`tokio::fs`, broadcast channels, system clock, UUIDs) lives
|
|
//! here, never in `domain` or `application`.
|
|
//!
|
|
//! L1 shipped the DI/event-relay adapters: [`LocalFileSystem`],
|
|
//! [`TokioBroadcastEventBus`], [`SystemClock`], [`UuidGenerator`]. L2 adds the
|
|
//! project persistence adapter [`FsProjectStore`]. L3 adds the local PTY adapter
|
|
//! [`PortablePtyAdapter`]. Git/remote/template adapters arrive in later lots.
|
|
|
|
#![forbid(unsafe_code)]
|
|
#![warn(missing_docs)]
|
|
|
|
pub mod clock;
|
|
pub mod conversation;
|
|
pub mod conversation_log;
|
|
pub mod eventbus;
|
|
pub mod fileguard;
|
|
pub mod fs;
|
|
pub mod git;
|
|
pub mod id;
|
|
pub mod input;
|
|
pub mod inspector;
|
|
pub mod mailbox;
|
|
pub mod orchestrator;
|
|
pub mod permission;
|
|
pub mod process;
|
|
pub mod pty;
|
|
pub mod remote;
|
|
pub mod runtime;
|
|
pub mod sandbox;
|
|
pub mod session;
|
|
pub mod store;
|
|
|
|
pub use clock::SystemClock;
|
|
pub use conversation::InMemoryConversationRegistry;
|
|
pub use conversation_log::{
|
|
FsConversationLog, FsHandoffStore, FsProviderSessionStore, HeuristicHandoffSummarizer, WINDOW,
|
|
};
|
|
pub use eventbus::TokioBroadcastEventBus;
|
|
pub use fileguard::RwFileGuard;
|
|
pub use fs::LocalFileSystem;
|
|
pub use git::Git2Repository;
|
|
pub use id::UuidGenerator;
|
|
pub use input::{MediatedInbox, MillisClock, SystemMillisClock};
|
|
pub use inspector::ClaudeTranscriptInspector;
|
|
pub use mailbox::InMemoryMailbox;
|
|
pub use orchestrator::mcp::{McpServer, MemoryTransport, StdioTransport};
|
|
pub use orchestrator::{
|
|
process_request_file, FsOrchestratorWatcher, OrchestratorResponse, OrchestratorWatchHandle,
|
|
REQUESTS_SUBDIR,
|
|
};
|
|
pub use permission::{ClaudePermissionProjector, CodexPermissionProjector};
|
|
pub use process::LocalProcessSpawner;
|
|
pub use pty::PortablePtyAdapter;
|
|
pub use remote::{remote_host, LocalHost};
|
|
pub use runtime::CliAgentRuntime;
|
|
#[cfg(target_os = "linux")]
|
|
pub use sandbox::LandlockSandbox;
|
|
pub use sandbox::{default_enforcer, NoopSandbox};
|
|
pub use session::{ClaudeSdkSession, CodexExecSession, FakeCli, StructuredSessionFactory};
|
|
#[cfg(feature = "vector-onnx")]
|
|
pub use store::OnnxEmbedder;
|
|
#[cfg(feature = "vector-http")]
|
|
pub use store::{detect_ollama, HttpEmbedder, DEFAULT_LOCAL_EMBED_ENDPOINT};
|
|
pub use store::{
|
|
embedder_from_profile, index_token_size, onnx_model_is_cached, should_use_vector,
|
|
AdaptiveMemoryRecall, EmbedderEnvProbe, FsEmbedderProfileStore, FsEmbedderPromptStore,
|
|
FsMemoryStore, FsPermissionStore, FsProfileStore, FsProjectStore, FsSkillStore,
|
|
FsTemplateStore, HashEmbedder, IdeaiContextStore, NaiveMemoryRecall, OnnxModelInfo,
|
|
StubEmbedder, VectorMemoryRecall, DEFAULT_OLLAMA_BASE_URL, ONNX_CACHE_SUBDIR,
|
|
RECOMMENDED_ONNX_MODELS, VECTOR_HTTP_ENABLED, VECTOR_ONNX_ENABLED,
|
|
};
|