From 1a6ccc9aaac79071651fcdce8580fd48bf52b869 Mon Sep 17 00:00:00 2001 From: 1445043649 <> Date: Thu, 14 May 2026 13:50:12 +0800 Subject: [PATCH] =?UTF-8?q?feat(tests):=20PR7=20T7.1=20=E2=80=94=20boundar?= =?UTF-8?q?y=20scan=20allowlist=20toml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds backend/tests/boundary_allowlist.toml that names the four current legitimate runtime importers of langgraph.checkpoint.*: - app/gateway/routers/threads.py (empty_checkpoint for thread init) - packages/harness/deerflow/runtime/checkpointer/async_provider.py - packages/harness/deerflow/runtime/checkpointer/provider.py - packages/harness/deerflow/runtime/runs/worker.py (empty_checkpoint) The allowlist replaces plan's draft (thread_runs.py / gateway/app.py) with the ground-truth grep: both of those reach the checkpointer through `app.gateway.deps.get_checkpointer` DI, so they need not be listed. factory.py imports BaseCheckpointSaver only under `if TYPE_CHECKING:` — the scanner (next commit) exempts type-only imports automatically. Co-Authored-By: Claude Opus 4.7 (1M context) --- backend/tests/boundary_allowlist.toml | 28 +++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 backend/tests/boundary_allowlist.toml diff --git a/backend/tests/boundary_allowlist.toml b/backend/tests/boundary_allowlist.toml new file mode 100644 index 00000000..cf7dd1ab --- /dev/null +++ b/backend/tests/boundary_allowlist.toml @@ -0,0 +1,28 @@ +# PR7 — boundary scan allowlist for direct LangGraph checkpoint/saver imports. +# +# Paths are relative to backend/. A path here means: "this file is permitted to +# import langgraph.checkpoint.* at runtime". Adding to this list requires a +# matching justification in the PR that introduces the new importer. +# +# Consumed by tests/test_workspace_boundary.py. +# +# Imports inside `if TYPE_CHECKING:` blocks are exempt automatically — they do +# not pull the symbol into runtime — so type-only references (e.g. annotations +# on `BaseCheckpointSaver` parameters) do NOT need to be listed here. + +langgraph_checkpoint_importers = [ + # Gateway thread plumbing: constructs an empty checkpoint when initialising + # a new thread's state via the LangGraph runtime. + "app/gateway/routers/threads.py", + + # Harness checkpointer factories: the single authorised place to construct + # InMemorySaver / SqliteSaver / PostgresSaver implementations. Everywhere + # else must obtain a checkpointer via `app.gateway.deps.get_checkpointer` + # or `deerflow.runtime.checkpointer` helpers. + "packages/harness/deerflow/runtime/checkpointer/async_provider.py", + "packages/harness/deerflow/runtime/checkpointer/provider.py", + + # Background run worker: uses `empty_checkpoint` to seed state for runs + # resumed from a missing/expired checkpoint id. + "packages/harness/deerflow/runtime/runs/worker.py", +]