mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Channing CongerandGitHub
36460387ec
## Summary
This is the first PR in the V8 in-process sandboxing rollout.
It adds the build-system and Rust feature plumbing needed to support
sandboxed V8 builds, then enables sandboxing by default for the
source-built Bazel V8 path that we control directly. It deliberately
keeps the published `rusty_v8` artifact workflows on their current
non-sandboxed contract so this PR can land and ship independently before
we change any released artifacts.
## Rollout plan
- [x] **PR 1: land sandbox plumbing and default source-built Bazel V8 to
sandboxed mode**
- [ ] **PR 2: publish sandbox-enabled release artifacts and add
compatibility validation**
- Produce sandboxed artifact pairs for every released Cargo target that
does not already use the source-built Bazel path.
- Add CI coverage that consumes those sandboxed artifacts and verifies:
- `codex-v8-poc` reports sandbox enabled
- `codex-code-mode` builds/tests against the sandboxed path
- [ ] **PR 3: switch release consumers to sandboxed artifacts by
default**
- Update released artifact selectors/checksums.
- Enable the Rust `v8_enable_sandbox` feature in the default release
path.
- Make the sandboxed artifact family the normal path for published
builds.
- [ ] **PR 4: remove rollout-only compatibility paths**
- Remove the temporary non-sandbox release compatibility config once the
new default has shipped and baked.
- Keep the invariant tests permanently.
82 lines
2.3 KiB
Rust
82 lines
2.3 KiB
Rust
//! Bazel-wired proof-of-concept crate reserved for future V8 experiments.
|
|
|
|
/// Returns the Bazel label for this proof-of-concept crate.
|
|
#[must_use]
|
|
pub fn bazel_target() -> &'static str {
|
|
"//codex-rs/v8-poc:v8-poc"
|
|
}
|
|
|
|
/// Returns the embedded V8 version.
|
|
#[must_use]
|
|
pub fn embedded_v8_version() -> &'static str {
|
|
v8::V8::get_version()
|
|
}
|
|
|
|
/// Returns whether the linked V8 library was built with the in-process sandbox.
|
|
#[must_use]
|
|
pub fn linked_v8_has_sandbox() -> bool {
|
|
unsafe extern "C" {
|
|
fn v8__V8__IsSandboxEnabled() -> bool;
|
|
}
|
|
|
|
// `rusty_v8` exposes this symbol for its own sandbox verification tests.
|
|
unsafe { v8__V8__IsSandboxEnabled() }
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use pretty_assertions::assert_eq;
|
|
use std::sync::Once;
|
|
|
|
use super::bazel_target;
|
|
|
|
fn initialize_v8() {
|
|
static INIT: Once = Once::new();
|
|
|
|
INIT.call_once(|| {
|
|
v8::V8::initialize_platform(v8::new_default_platform(0, false).make_shared());
|
|
v8::V8::initialize();
|
|
});
|
|
}
|
|
|
|
fn evaluate_expression(expression: &str) -> String {
|
|
initialize_v8();
|
|
|
|
let isolate = &mut v8::Isolate::new(Default::default());
|
|
v8::scope!(let scope, isolate);
|
|
|
|
let context = v8::Context::new(scope, Default::default());
|
|
let scope = &mut v8::ContextScope::new(scope, context);
|
|
let source = v8::String::new(scope, expression).expect("expression should be valid UTF-8");
|
|
let script = v8::Script::compile(scope, source, None).expect("expression should compile");
|
|
let result = script.run(scope).expect("expression should evaluate");
|
|
|
|
result.to_rust_string_lossy(scope)
|
|
}
|
|
|
|
#[test]
|
|
fn exposes_expected_bazel_target() {
|
|
assert_eq!(bazel_target(), "//codex-rs/v8-poc:v8-poc");
|
|
}
|
|
|
|
#[test]
|
|
fn exposes_embedded_v8_version() {
|
|
assert!(!super::embedded_v8_version().is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn sandbox_feature_matches_linked_v8() {
|
|
assert_eq!(super::linked_v8_has_sandbox(), cfg!(feature = "sandbox"));
|
|
}
|
|
|
|
#[test]
|
|
fn evaluates_integer_addition() {
|
|
assert_eq!(evaluate_expression("1 + 2"), "3");
|
|
}
|
|
|
|
#[test]
|
|
fn evaluates_string_concatenation() {
|
|
assert_eq!(evaluate_expression("'hello ' + 'world'"), "hello world");
|
|
}
|
|
}
|