feat: harden orchestrator execution runtime

2026-07-24 23:53:32 +08:00
parent 396bb78200
commit f6f2cd0933
55 changed files with 5122 additions and 194 deletions
@@ -12,11 +12,51 @@ import {
  resolveSandboxMcpNodeExecPath,
  resolveSandboxMcpServerPath,
  resolveSandboxMcpUserDataPgUrl,
+  resolveSandboxMcpControlDbEnv,
  sandboxDeveloperTools,
  sandboxMcpTools,
 } from './capabilities.mjs';
 import { applyPoliciesToCapabilities } from './policies.mjs';

+test('resolveSandboxMcpControlDbEnv rewrites loopback MySQL endpoints for container MCP', () => {
+  const resolved = resolveSandboxMcpControlDbEnv(
+    {
+      DATABASE_URL: 'mysql://portal:secret@127.0.0.1:3306/memind',
+      MYSQL_HOST: 'localhost',
+      MYSQL_PORT: '3306',
+      MYSQL_DATABASE: 'memind',
+    },
+    {
+      containerized: true,
+      hostGateway: 'host.docker.internal',
+    },
+  );
+
+  assert.equal(
+    resolved.DATABASE_URL,
+    'mysql://portal:secret@host.docker.internal:3306/memind',
+  );
+  assert.equal(resolved.MYSQL_HOST, 'host.docker.internal');
+  assert.equal(resolved.MYSQL_PORT, '3306');
+  assert.equal(resolved.MYSQL_DATABASE, 'memind');
+});
+
+test('resolveSandboxMcpControlDbEnv preserves native-process database endpoints', () => {
+  assert.deepEqual(
+    resolveSandboxMcpControlDbEnv(
+      {
+        DATABASE_URL: 'mysql://portal:secret@127.0.0.1:3306/memind',
+        MYSQL_HOST: '127.0.0.1',
+      },
+      { containerized: false },
+    ),
+    {
+      DATABASE_URL: 'mysql://portal:secret@127.0.0.1:3306/memind',
+      MYSQL_HOST: '127.0.0.1',
+    },
+  );
+});
+
 test('resolveSandboxMcpServerPath resolves to an existing MCP entry file', () => {
  const serverPath = resolveSandboxMcpServerPath();
  assert.match(serverPath, /mindspace-sandbox-mcp\.mjs$/);