quixos-toolchain/quixos-nix-helpers
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Validate complete engine addresses and retain shared socket inputs (#503)

Browse Source
This commit is contained in:
Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065
2026-10-29 12:30:55 +00:00
parent 97ce77d3de
commit 4a87fc2c7d
4 changed files with 48 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
restricted-execution/service.mjs
+10 -2
View File
@@ -6,6 +6,8 @@ import { constants } from "node:fs";
import { tmpdir } from "node:os";
import { join, dirname } from "node:path";
import { checkedSocketPath } from "../socket-address.mjs";
const abi = "quixos-transaction-ports-v1";
/** Reserved supervisor faults are not authored domain rejections. A graph
* transaction must roll back without recording a permanent rejected outcome
@@ -359,10 +361,16 @@ export async function serveRestrictedRegistry(config, io = process) {
() => destroyEngine(engine),
);
if (!call.open) return;
if (config.sandboxIdentity) {
// The privileged helper owns a fixed explicit /run root and requires
// this exact basename. Keep its cross-UID ancestry and identity rules.
for (const filename of ["broker.sock", "engine.sock"])
checkedSocketPath(tmpdir() + "/qx-engine-XXXXXX/" + filename);
}
engine.directory = await mkdtemp(join(tmpdir(), "qx-engine-"));
if (!call.open) return;
const broker = join(engine.directory, "broker.sock");
engine.socket = join(engine.directory, "engine.sock");
const broker = checkedSocketPath(join(engine.directory, "broker.sock"));
engine.socket = checkedSocketPath(join(engine.directory, "engine.sock"));
engine.server = createServer(async (request, response) => {
const call = engine.current;
const message = call?.message;