@aalis/plugin-reach 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ace Nyan <ace@acenyan.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,21 @@
-# Temporary Holding Version
+# @aalis/plugin-reach
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+触及：按一次工具调用签发触及凭据（契约见 `@aalis/api-reach`）。主体取权限服务的 `principalOf`，场所与绑定取会话管理里的记录，档位与越界策略固定，三张受保护清单在激活时按家目录布局与真实路径算好，交给 `resolveReach` 定上限：主体是 owner 的调用有本地效果，不看会话的受众（主体的判法见权限服务的 `principalOf`：续做与子任务的类别随起它的那一轮，参与者按这次调用的）。另管本会话临时区（建、随会话删、定期清扫）与子进程环境（owner 的 login shell 环境，沙箱内同样完整，只去掉本实例的变量与 ssh-agent 的 socket）。
+
+## 角色
+
+运行时插件，提供 `reach` 服务。
+
+## 安装
+
+```bash
+pnpm add @aalis/plugin-reach
+```
+
+## 使用
+
+参考 [docs/plugins/plugin-reach.md](../../docs/plugins/plugin-reach.md) 与 [docs/api/api-reach.md](../../docs/api/api-reach.md)。
+
+## 许可
+
+MIT，见本目录 LICENSE。

package/dist/credential.d.ts

@@ -0,0 +1,11 @@
+import { type Reach, type ReachCredential } from '@aalis/api-reach';
+interface CredentialDeps {
+    /** 操作系统用户的家目录：沙箱里 npm 的用户配置从这里的 .npmrc 去掉 npm 的认证键 */
+    userHome: string;
+    /** 在场所的主目录下取的 login shell 环境 */
+    loginEnv(home: string): Promise<Record<string, string>>;
+}
+/** current 每次调用都算出这次调用当时的触及 */
+export declare function issueCredential(current: () => Reach, deps: CredentialDeps): ReachCredential;
+export {};
+//# sourceMappingURL=credential.d.ts.map

package/dist/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,KAAK,EAEV,KAAK,eAAe,EAIrB,MAAM,kBAAkB,CAAC;AAG1B,UAAU,cAAc;IACtB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,+BAA+B;AAC/B,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,eAAe,CAoB3F"}

package/dist/credential.js

@@ -0,0 +1,69 @@
+// ============================================================
+// 触及凭据：按一次工具调用签发，带品牌符号，冻结
+//
+// 签发时的触及定下命令在哪执行、场所的主目录与白纸、子进程环境；判定、存储兜底与沙箱策略每次按当时的触及。
+// ============================================================
+import { judgeReach, REACH_CREDENTIAL, sandboxPolicyOf, } from '@aalis/api-reach';
+import { sandboxEnv } from './process-env.js';
+/** current 每次调用都算出这次调用当时的触及 */
+export function issueCredential(current, deps) {
+    const issued = current();
+    const local = issued.exec === 'none' ? undefined : issued;
+    const credential = {
+        exec: issued.exec,
+        ...(local && { home: local.home, paper: local.paper }),
+        async require(request) {
+            const decision = judgeReach(current(), request);
+            return decision.verdict === 'allow' ? { allowed: true } : { allowed: false, message: explain(decision, request) };
+        },
+        allows: (effect, realPath) => judgeReach(current(), { effect, path: realPath }).verdict === 'allow',
+        sandboxPolicy: () => sandboxPolicyOf(current()),
+        async processEnv(mode) {
+            if (!local)
+                throw new Error('这次调用没有本地效果，没有子进程环境');
+            const env = await deps.loginEnv(local.home);
+            return mode === 'host' ? { ...env } : sandboxEnv(env, local.sessionTmp, deps.userHome);
+        },
+    };
+    // 品牌不可枚举：展开或 Object.assign 复制出来、改了方法再转交的对象不带它
+    return Object.freeze(Object.defineProperty(credential, REACH_CREDENTIAL, { value: true }));
+}
+/** 回给模型的话：要做什么、为什么不行、能不能申请 */
+function explain(decision, request) {
+    const subject = subjectOf(request);
+    if (decision.verdict === 'ask')
+        return `${subject}：${why(decision.reason)}，要 owner 批准，这里没有可用的审批`;
+    switch (decision.rule) {
+        case 'no-local-effect':
+            return `${subject}：这一轮不只有 owner 的话，没有本地效果`;
+        case 'control-plane':
+            return `${subject}：在宿主控制面里，任何档位都不能写；不可申请，不要尝试绕过`;
+        case 'deny-read':
+            return `${subject}：在拒读清单里；不可申请，不要尝试绕过`;
+        case 'boundary-policy':
+            return `${subject}：${why(decision.reason)}，越界策略是直接拒绝`;
+    }
+}
+function subjectOf(request) {
+    switch (request.effect) {
+        case 'read':
+            return `读 ${request.path}`;
+        case 'write':
+            return 'path' in request ? `写 ${request.path}` : `写编排定义 ${request.workflow}`;
+        case 'exec':
+            return request.host ? '在沙箱外执行命令' : '执行命令';
+        case 'network':
+            return { url: '访问模型给的网址', command: '执行要联网的命令', provider: '联网' }[request.via];
+    }
+}
+function why(reason) {
+    switch (reason.kind) {
+        case 'tier':
+            return '修改确认档里每一次写与执行都要问';
+        case 'boundary':
+            return { 'write-path': '超出了可写范围', 'host-exec': '要在沙箱外执行', network: '只读档里联网要问' }[reason.target];
+        case 'landing':
+            return '这里会被自动执行或用于持久化';
+    }
+}
+//# sourceMappingURL=credential.js.map

package/dist/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,0BAA0B;AAC1B,EAAE;AACF,uDAAuD;AACvD,+DAA+D;AAE/D,OAAO,EACL,UAAU,EACV,gBAAgB,EAMhB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,+BAA+B;AAC/B,MAAM,UAAU,eAAe,CAAC,OAAoB,EAAE,IAAoB;IACxE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,UAAU,GAAmD;QACjE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO;QACnG,aAAa,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC/C,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;IACF,8CAA8C;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAoB,CAAC;AAChH,CAAC;AAED,8BAA8B;AAC9B,SAAS,OAAO,CAAC,QAAsD,EAAE,OAAqB;IAC5F,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACjG,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,GAAG,OAAO,yBAAyB,CAAC;QAC7C,KAAK,eAAe;YAClB,OAAO,GAAG,OAAO,+BAA+B,CAAC;QACnD,KAAK,WAAW;YACd,OAAO,GAAG,OAAO,qBAAqB,CAAC;QACzC,KAAK,iBAAiB;YACpB,OAAO,GAAG,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB;IACtC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/E,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,MAAsB;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,kBAAkB,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAC7E,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/host-dirs.d.ts

@@ -0,0 +1,27 @@
+import { type ProtectedLists } from '@aalis/api-reach';
+import type { Logger } from '@aalis/core';
+/** 文件或目录不存在 */
+export declare function isMissing(err: unknown): boolean;
+/** 安装集的形态：下有 packages/ 目录的是源码形态，其余是 npm 形态（create-aalis 生成的项目） */
+export declare function formOf(app: string): Promise<'source' | 'npm'>;
+/** 守护进程的入口文件：启动脚本（process.argv[1]）的真实路径；没有或取不到时为 undefined */
+export declare function entryOf(): Promise<string | undefined>;
+/**
+ * 清单里以具体路径为根的规则，各个根的真实路径（交给 api-reach 的 withRealRoots）：不存在的不记；取不了的（没有权限、
+ * 链接成环）记 warn，这一条只按写法拦
+ */
+export declare function realRootsOf(lists: ProtectedLists, logger: Pick<Logger, 'warn'>): Promise<Map<string, string>>;
+/**
+ * 安装集以外、守护进程加载了代码的目录，归宿主控制面（安装集里的已由清单按安装集的目录覆盖）：
+ * - 安装集 node_modules 顶层（含 `@scope/` 下）解析到安装集以外的包，整个目录；
+ * - 源码形态下 packages/ 里链接到安装集以外的包，与安装集里的包一样只算构建产物与依赖。
+ * 断掉的链接不是加载了的代码，跳过
+ */
+export declare function codeDirsOf(app: string): Promise<string[]>;
+/**
+ * 目录所在仓库的 git 目录（common dir，真实路径）：从目录往上找 `.git`。文件形式的 `.git`（worktree、子模块）按里面的
+ * gitdir 与 commondir 找到共用的那个。找到的不像 git 目录（没有 HEAD 与 objects）的不算，免得一个 `.git` 把任意目录
+ * 指成可写。不在仓库里时为 undefined
+ */
+export declare function gitDirOf(dir: string): Promise<string | undefined>;
+//# sourceMappingURL=host-dirs.d.ts.map

package/dist/host-dirs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-dirs.d.ts","sourceRoot":"","sources":["../src/host-dirs.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAe;AACf,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/C;AASD,kEAAkE;AAClE,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,CAMnE;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG3D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAcnH;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB/D;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoBvE"}

package/dist/host-dirs.js

@@ -0,0 +1,120 @@
+// ============================================================
+// 按磁盘取的几样：安装集的形态与守护进程的入口、安装集以外守护进程加载了代码的目录、清单里各个根的真实路径、
+// 绑定所在仓库的 git 目录
+// ============================================================
+// biome-ignore lint/style/noRestrictedImports: 安装集、入口、链接装进来的包与清单的根取真实路径、从绑定目录往上读 .git，这些路径不在存储根里
+import { lstat, readdir, readFile, realpath, stat } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { matchesRule } from '@aalis/api-reach';
+/** 文件或目录不存在 */
+export function isMissing(err) {
+    return err?.code === 'ENOENT';
+}
+/** 目录里的条目；目录不存在、不是目录（断掉的链接、同名的文件）时为空 */
+const entriesOf = (dir) => readdir(dir).catch(err => {
+    if (isMissing(err) || err.code === 'ENOTDIR')
+        return [];
+    throw err;
+});
+/** 安装集的形态：下有 packages/ 目录的是源码形态，其余是 npm 形态（create-aalis 生成的项目） */
+export async function formOf(app) {
+    const packages = await stat(join(app, 'packages')).catch(err => {
+        if (isMissing(err))
+            return undefined;
+        throw err;
+    });
+    return packages?.isDirectory() ? 'source' : 'npm';
+}
+/** 守护进程的入口文件：启动脚本（process.argv[1]）的真实路径；没有或取不到时为 undefined */
+export async function entryOf() {
+    const script = process.argv[1];
+    return script ? realpath(script).catch(() => undefined) : undefined;
+}
+/**
+ * 清单里以具体路径为根的规则，各个根的真实路径（交给 api-reach 的 withRealRoots）：不存在的不记；取不了的（没有权限、
+ * 链接成环）记 warn，这一条只按写法拦
+ */
+export async function realRootsOf(lists, logger) {
+    const roots = new Set([...lists.control, ...lists.landing, ...lists.denyRead].flatMap(rule => ('path' in rule ? [rule.path] : [])));
+    const real = new Map();
+    for (const root of roots) {
+        const resolved = await realpath(root).catch(err => {
+            if (!isMissing(err) && err.code !== 'ENOTDIR')
+                logger.warn(`取不到 ${root} 的真实路径，受保护清单里它只按写法拦:`, err);
+            return undefined;
+        });
+        if (resolved)
+            real.set(root, resolved);
+    }
+    return real;
+}
+/**
+ * 安装集以外、守护进程加载了代码的目录，归宿主控制面（安装集里的已由清单按安装集的目录覆盖）：
+ * - 安装集 node_modules 顶层（含 `@scope/` 下）解析到安装集以外的包，整个目录；
+ * - 源码形态下 packages/ 里链接到安装集以外的包，与安装集里的包一样只算构建产物与依赖。
+ * 断掉的链接不是加载了的代码，跳过
+ */
+export async function codeDirsOf(app) {
+    const outsideApp = async (entry) => {
+        const real = await realpath(entry).catch(() => undefined);
+        return real && !matchesRule({ path: app }, real, process.platform) ? real : undefined;
+    };
+    const top = join(app, 'node_modules');
+    const modules = [];
+    for (const name of await entriesOf(top)) {
+        if (name.startsWith('.'))
+            continue;
+        if (name.startsWith('@'))
+            modules.push(...(await entriesOf(join(top, name))).map(sub => join(top, name, sub)));
+        else
+            modules.push(join(top, name));
+    }
+    const outside = new Set();
+    for (const entry of modules) {
+        const real = await outsideApp(entry);
+        if (real)
+            outside.add(real);
+    }
+    for (const name of await entriesOf(join(app, 'packages'))) {
+        const real = await outsideApp(join(app, 'packages', name));
+        if (real)
+            for (const sub of ['dist', 'node_modules'])
+                outside.add(join(real, sub));
+    }
+    return [...outside];
+}
+/**
+ * 目录所在仓库的 git 目录（common dir，真实路径）：从目录往上找 `.git`。文件形式的 `.git`（worktree、子模块）按里面的
+ * gitdir 与 commondir 找到共用的那个。找到的不像 git 目录（没有 HEAD 与 objects）的不算，免得一个 `.git` 把任意目录
+ * 指成可写。不在仓库里时为 undefined
+ */
+export async function gitDirOf(dir) {
+    for (let at = dir;; at = dirname(at)) {
+        const dotGit = join(at, '.git');
+        // 读不到（不存在或没有权限）按没有处理：少一个可写目录，不多一个。链接到目录的 .git 按它指向的目录算，不再往上找
+        const entry = await lstat(dotGit).catch(() => undefined);
+        if (entry?.isDirectory() || entry?.isSymbolicLink())
+            return asGitDir(dotGit);
+        if (entry?.isFile()) {
+            const content = await readFile(dotGit, 'utf8').catch(() => undefined);
+            const gitdir = content && /^gitdir:\s*(.+?)\s*$/m.exec(content)?.[1];
+            if (!gitdir)
+                return undefined;
+            const own = resolve(at, gitdir);
+            return asGitDir(await readFile(join(own, 'commondir'), 'utf8').then(text => resolve(own, text.trim()), () => own));
+        }
+        if (dirname(at) === at)
+            return undefined;
+    }
+}
+async function asGitDir(dir) {
+    const real = await realpath(dir).catch(() => undefined);
+    if (!real)
+        return undefined;
+    const [head, objects] = await Promise.all([
+        stat(join(real, 'HEAD')).catch(() => undefined),
+        stat(join(real, 'objects')).catch(() => undefined),
+    ]);
+    return head?.isFile() && objects?.isDirectory() ? real : undefined;
+}
+//# sourceMappingURL=host-dirs.js.map

package/dist/host-dirs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-dirs.js","sourceRoot":"","sources":["../src/host-dirs.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,wDAAwD;AACxD,iBAAiB;AACjB,+DAA+D;AAE/D,iGAAiG;AACjG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAuB,MAAM,kBAAkB,CAAC;AAGpE,eAAe;AACf,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAQ,GAAoC,EAAE,IAAI,KAAK,QAAQ,CAAC;AAClE,CAAC;AAED,wCAAwC;AACxC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;IACvB,IAAI,SAAS,CAAC,GAAG,CAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,GAAG,CAAC;AACZ,CAAC,CAAC,CAAC;AAEL,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW;IACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7D,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAqB,EAAE,MAA4B;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7G,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAChD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS;gBACtE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,EAAE,GAAG,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;;YAC1G,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACxC,KAAK,IAAI,EAAE,GAAG,GAAG,GAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAChC,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,cAAc,EAAE;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAChC,OAAO,QAAQ,CACb,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CACjD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EACjC,GAAG,EAAE,CAAC,GAAG,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+import { type HostPaths } from '@aalis/api-host-paths';
+declare const _default: import("@aalis/core").PluginDefinition<{
+    provide: import("@aalis/core").ServiceDescriptor<(identity: symbol) => import("@aalis/core").Provide, import("@aalis/core").Provide>;
+    events: import("@aalis/core").ServiceDescriptor<(identity: symbol) => import("@aalis/core").Events, import("@aalis/core").Events>;
+    lifecycle: import("@aalis/core").ServiceDescriptor<(identity: symbol) => import("@aalis/core").LifecycleCap, import("@aalis/core").LifecycleCap>;
+    logger: import("@aalis/core").ServiceDescriptor<(identity: symbol) => import("@aalis/core").Logger, import("@aalis/core").Logger>;
+    /** 家目录布局：三张清单、白纸与本会话临时区都按它 */
+    paths: import("@aalis/core").ServiceDescriptor<HostPaths, HostPaths>;
+    /** 会话记录与绑定 */
+    sessionManager: import("@aalis/core").ServiceDescriptor<import("@aalis/api-session-manager").SessionManagerService, import("@aalis/api-session-manager").SessionManagerService>;
+    /** 这一轮的主体；缺席时谁都不是 owner，一律没有本地效果 */
+    authority: import("@aalis/core").OptionalUse<import("@aalis/api-authority").AuthorityService, import("@aalis/api-authority").AuthorityService>;
+    /** 取 owner 的 login shell 环境；缺席时子进程用守护进程的环境 */
+    process: import("@aalis/core").OptionalUse<import("@aalis/api-process").ProcessService, import("@aalis/api-process").ProcessService>;
+}>;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,uBAAuB,CAAC;;;;;;IAuChE,8BAA8B;;IAE9B,cAAc;;IAEd,oCAAoC;;IAEpC,8CAA8C;;;AAKhD,wBAOG"}

package/dist/index.js

@@ -0,0 +1,148 @@
+// biome-ignore lint/style/noRestrictedImports: 安装集与用户家目录取真实路径；本会话临时区按 0700 建、随会话删
+import { mkdir, realpath, rm } from 'node:fs/promises';
+// biome-ignore lint/style/noRestrictedImports: 拒读清单与落点按操作系统用户的家目录生成
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { authority } from '@aalis/api-authority';
+import { hostPaths } from '@aalis/api-host-paths';
+import { processService } from '@aalis/api-process';
+import { protectedLists, reach, resolveReach, withRealRoots, } from '@aalis/api-reach';
+import { paperDirName, placePaperId, rootSessionOf, sessionManager } from '@aalis/api-session-manager';
+import { definePlugin, events, lifecycle, logger, optional, provide } from '@aalis/core';
+import { issueCredential } from './credential.js';
+import { codeDirsOf, entryOf, formOf, gitDirOf, realRootsOf } from './host-dirs.js';
+import { loginEnvs } from './process-env.js';
+import { SWEEP_EVERY_MS, sessionTmpOf, sweepSessionTmp } from './session-tmp.js';
+import { t } from './texts.js';
+// ════════════════════════════════════════════════════════════
+// plugin-reach —— 触及服务（契约见 @aalis/api-reach）
+//
+// 按一次工具调用签发凭据：主体取权限服务的 principalOf（类别为人亲手、这次调用的参与者都是 owner 的为 owner；续做与子任务的
+// 类别随起它的那一轮，批过的调用参与者是批的人），不看会话的受众；场所与绑定取会话管理里的记录，档位与越界策略固定（工作区档、
+// 越界要问），仓库的 git 目录按磁盘找，三张清单在激活时按家目录布局与真实路径算好；交给 api-reach 的 resolveReach 定上限。
+// 绑定与 git 目录在签发时取好，场所每次判定时取当时的。另管本会话临时区与子进程环境。
+// ════════════════════════════════════════════════════════════
+/** 档位与越界策略：还不能按会话设，固定为工作区档、越界要问 */
+const DEFAULT_TIER = 'workspace';
+const DEFAULT_BOUNDARY = 'ask';
+const uses = {
+    provide,
+    events,
+    lifecycle,
+    logger,
+    /** 家目录布局：三张清单、白纸与本会话临时区都按它 */
+    paths: hostPaths,
+    /** 会话记录与绑定 */
+    sessionManager,
+    /** 这一轮的主体；缺席时谁都不是 owner，一律没有本地效果 */
+    authority: optional(authority),
+    /** 取 owner 的 login shell 环境；缺席时子进程用守护进程的环境 */
+    process: optional(processService),
+};
+export default definePlugin({
+    name: '@aalis/plugin-reach',
+    displayName: t('displayName'),
+    subsystem: 'authority',
+    provides: [reach],
+    uses,
+    apply: run,
+});
+async function run(caps) {
+    const { events, lifecycle, logger } = caps;
+    const sm = caps.sessionManager.use;
+    const lookup = (id) => sm.getSession(id);
+    // 清单与路径比较一律用真实路径：安装集可能经符号链接给出，用户家目录同理；清单里链接出去的根按真实路径补一份
+    const given = caps.paths.use;
+    const app = await realpath(given.app);
+    const userHome = await realpath(homedir());
+    // 业务句柄是转发句柄，展开得不到成员：在它之上只换掉 app，其余沿原型链读
+    const paths = Object.assign(Object.create(given), { app });
+    const declared = protectedLists({
+        paths,
+        userHome,
+        platform: process.platform,
+        form: await formOf(app),
+        codeDirs: await codeDirsOf(app),
+        entry: await entryOf(),
+    });
+    const realRoots = await realRootsOf(declared, logger.use);
+    const lists = withRealRoots(declared, root => realRoots.get(root));
+    const loginEnv = loginEnvs({ process: caps.process, userHome, logger: logger.use });
+    /**
+     * 会话所在场所的白纸目录：白纸 id 由场所键算出，目录名与白纸插件同取 paperDirName。房间写的具名白纸只决定白纸任务用哪一块，
+     * 不换这里
+     */
+    const paperOf = (sessionId) => join(paths.stage.paper, paperDirName(placePaperId(sm.placeOf(sessionId).key)));
+    /** 删会话时在后台删着的临时区 */
+    const deleting = new Map();
+    /**
+     * 一个会话的触及，返回每次调用都重算的函数：绑定与仓库的 git 目录（按磁盘找，异步）在这里取好；场所在每次调用时取当时的
+     */
+    async function reachOf(sessionId, principal) {
+        const work = rootSessionOf(sm.getSession(sessionId), lookup)?.work;
+        const gitDir = work && (await gitDirOf(work.root));
+        return () => {
+            const paper = paperOf(sessionId);
+            return resolveReach({
+                principal,
+                tier: DEFAULT_TIER,
+                onBoundary: DEFAULT_BOUNDARY,
+                // 主目录：项目工作区是绑定目录，其余是场所的白纸
+                place: { home: work?.root ?? paper, paper },
+                binding: work,
+                gitDirs: gitDir ? [gitDir] : [],
+                sessionTmp: sessionTmpOf(paths.tmp, sessionId),
+                localPorts: [],
+                lists,
+                paths,
+            });
+        };
+    }
+    const service = {
+        async forCall(call) {
+            // 这一轮的主体：权限服务不在时是 other
+            const principal = caps.authority.present ? caps.authority.use.principalOf(call) : 'other';
+            const credential = issueCredential(await reachOf(call.sessionId, principal), {
+                userHome,
+                loginEnv,
+            });
+            if (credential.exec !== 'none') {
+                // 同一个 id 的会话删了又建：前一份还在删，先等它删完，免得删掉新建的
+                await deleting.get(call.sessionId);
+                await mkdir(sessionTmpOf(paths.tmp, call.sessionId), { recursive: true, mode: 0o700 });
+            }
+            return credential;
+        },
+    };
+    // 删会话时在后台删它的临时区，不拖住删会话；删不掉记 warn
+    events.use.on('session:deleted', sessionId => {
+        const dir = sessionTmpOf(paths.tmp, sessionId);
+        const done = rm(dir, { recursive: true, force: true })
+            .catch(err => logger.use.warn(`删不掉会话 ${sessionId} 的临时区 ${dir}:`, err))
+            .finally(() => {
+            if (deleting.get(sessionId) === done)
+                deleting.delete(sessionId);
+        });
+        deleting.set(sessionId, done);
+    });
+    // 清扫在后台排队跑，启动时的那一轮不拖住激活
+    let sweeping = Promise.resolve();
+    const sweep = () => {
+        sweeping = sweeping
+            .then(() => sweepSessionTmp(paths.tmp, lookup, Date.now(), logger.use))
+            .then(removed => {
+            if (removed.length > 0)
+                logger.use.debug(`清掉 ${removed.length} 个会话的临时区`);
+        })
+            .catch(err => logger.use.warn('清扫本会话临时区失败:', err));
+    };
+    sweep();
+    const sweepTimer = setInterval(sweep, SWEEP_EVERY_MS);
+    sweepTimer.unref();
+    lifecycle.use.onDispose(async () => {
+        clearInterval(sweepTimer);
+        await Promise.all([sweeping, ...deleting.values()]);
+    });
+    caps.provide.use(reach, service);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvD,oEAAoE;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAkB,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAGL,cAAc,EAId,KAAK,EACL,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAgB,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAE/B,+DAA+D;AAC/D,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,iEAAiE;AACjE,8EAA8E;AAC9E,+CAA+C;AAC/C,+DAA+D;AAE/D,mCAAmC;AACnC,MAAM,YAAY,GAAe,WAAW,CAAC;AAC7C,MAAM,gBAAgB,GAAmB,KAAK,CAAC;AAE/C,MAAM,IAAI,GAAG;IACX,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,8BAA8B;IAC9B,KAAK,EAAE,SAAS;IAChB,cAAc;IACd,cAAc;IACd,oCAAoC;IACpC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC9B,8CAA8C;IAC9C,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC;CAClC,CAAC;AAGF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC;IAC7B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,IAAI;IACJ,KAAK,EAAE,GAAG;CACX,CAAC,CAAC;AAEH,KAAK,UAAU,GAAG,CAAC,IAAU;IAC3B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAEjD,wDAAwD;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,wCAAwC;IACxC,MAAM,KAAK,GAAc,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC9B,KAAK;QACL,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC;QACvB,QAAQ,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC;QAC/B,KAAK,EAAE,MAAM,OAAO,EAAE;KACvB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACpF;;;OAGG;IACH,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAElD;;OAEG;IACH,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,SAAyB;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,SAAS;gBACT,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,gBAAgB;gBAC5B,0BAA0B;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,KAAK,EAAE;gBAC3C,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC/B,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC;gBAC9C,UAAU,EAAE,EAAE;gBACd,KAAK;gBACL,KAAK;aACN,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAiB;QAC5B,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,wBAAwB;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE;gBAC3E,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC/B,sCAAsC;gBACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnC,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;IAEF,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACnD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,SAAS,SAAS,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;aACrE,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI;gBAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACL,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,wBAAwB;IACxB,IAAI,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,QAAQ,GAAG,QAAQ;aAChB,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;aACtE,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,KAAK,EAAE,CAAC;IACR,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE,CAAC;IAEnB,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;QACjC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/locales/en.d.ts

@@ -0,0 +1,5 @@
+declare const _default: {
+    readonly displayName: "Reach";
+};
+export default _default;
+//# sourceMappingURL=en.d.ts.map

package/dist/locales/en.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/locales/en.ts"],"names":[],"mappings":";;;AAGA,wBAEG"}

package/dist/locales/en.js

@@ -0,0 +1,5 @@
+import { defineLocale } from '@aalis/schema-i18n';
+export default defineLocale()({
+    displayName: 'Reach',
+});
+//# sourceMappingURL=en.js.map

package/dist/locales/en.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/locales/en.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,eAAe,YAAY,EAAU,CAAC;IACpC,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC"}

package/dist/process-env.d.ts

@@ -0,0 +1,17 @@
+import type { ProcessService } from '@aalis/api-process';
+import type { Logger, ServiceSelection } from '@aalis/core';
+type Env = Record<string, string>;
+/** 按 owner 的 login shell 取环境的入口：同一个主目录取到一次就一直用，同时来的调用共用一次取 */
+export declare function loginEnvs(deps: {
+    process: ServiceSelection<ProcessService>;
+    userHome: string;
+    logger: Logger;
+}): (home: string) => Promise<Env>;
+/**
+ * 沙箱里的命令拿到的环境：完整的登录环境去掉本实例的变量与 ssh-agent 的 socket，注入 npm 的用户配置（去掉认证键的副本，写在
+ * 本会话临时区）、本机 Node 的头文件、浏览器的缓存目录，关掉 pnpm 的构建产物缓存（沙箱里构建出的产物不能被沙箱外的安装直接
+ * 复用），SSH 地址的拉取走 HTTPS
+ */
+export declare function sandboxEnv(login: Env, sessionTmp: string, userHome: string): Promise<Env>;
+export {};
+//# sourceMappingURL=process-env.d.ts.map

package/dist/process-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-env.d.ts","sourceRoot":"","sources":["../src/process-env.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5D,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAmBlC,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,IAuCrG,MAAM,MAAM,KAAG,OAAO,CAAC,GAAG,CAAC,CAcpC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CA8C/F"}

package/dist/process-env.js

@@ -0,0 +1,145 @@
+// ============================================================
+// 子进程环境：owner 的 login shell 环境，沙箱内另去掉两样并注入沙箱要的几项
+//
+// 环境在场所的主目录下用 owner 的 login shell 取一次（项目的 .nvmrc、venv 这类按目录选的工具链与 owner 自己的终端一致），
+// 缓存在内存，不落盘；取不到时用守护进程的环境，1 分钟后再取（一次超时不能让这个主目录一直用守护进程的环境）。
+// 宿主执行与沙箱里的命令都拿到完整的登录环境，不按名字或值猜凭据：能进沙箱的只有主体是 owner 的一轮，密钥不靠出口过滤，
+// 靠权限隔离。沙箱里只去掉本实例自己的变量与 ssh-agent 的 socket，git 的命令行配置接上沙箱要的几项，npm 的用户配置换成
+// 去掉认证键的副本。
+// ============================================================
+// biome-ignore lint/style/noRestrictedImports: 读用户家目录的 .npmrc、在本会话临时区写去掉认证键的副本（不跟随链接）、按 PATH 找本机 Node 的头文件，这些路径不在存储根里
+import { access, lstat, readFile, realpath, rename, stat, writeFile } from 'node:fs/promises';
+// biome-ignore lint/style/noRestrictedImports: 没有 SHELL 时取操作系统账户登记的 login shell
+import { userInfo } from 'node:os';
+import { delimiter, dirname, join } from 'node:path';
+import { isMissing } from './host-dirs.js';
+/** 取环境的时限：rc 文件卡住（等输入、连网）时按取不到处理 */
+const CAPTURE_TIMEOUT_MS = 10_000;
+/** 取不到时这么久之后再取 */
+const RETRY_AFTER_MS = 60_000;
+/** AALIS_ 开头的是实例自己的命名空间（家目录这类本实例的配置），不交给沙箱里的命令 */
+const INSTANCE_VARS = /^AALIS_/;
+/** ssh-agent 的 socket：ssh-agent 不对沙箱开放，经 SSH 的推送要宿主执行 */
+const SSH_AGENT_SOCK = 'SSH_AUTH_SOCK';
+/**
+ * npm 定义的认证键：令牌、用户名与密码、客户端证书与私钥（文件或内联）。~/.npmrc 在拒读清单里，沙箱里的 npm 读的是去掉这些键
+ * 的副本
+ */
+const NPMRC_SECRET = /(^|:)(_authToken|_auth|_password|username|password|(cert|key)(file)?)\s*=/i;
+/** SSH 地址的拉取改走 HTTPS（沙箱里没有 SSH 凭据），推送仍是 SSH（沙箱里推不了，要宿主执行） */
+const HTTPS_HOSTS = ['github.com', 'gitlab.com'];
+/** 按 owner 的 login shell 取环境的入口：同一个主目录取到一次就一直用，同时来的调用共用一次取 */
+export function loginEnvs(deps) {
+    const cache = new Map();
+    /** 取不到时为 undefined */
+    async function capture(home) {
+        try {
+            if (!deps.process.present)
+                throw new Error('没有进程服务');
+            const proc = deps.process.use;
+            const shell = process.env.SHELL || userInfo().shell;
+            if (!shell)
+                throw new Error('不知道 owner 的 login shell（没有 SHELL，账户也没登记）');
+            // 白纸首次写入时才建：主目录还不在时在用户家目录下取，与新开一个终端相同
+            const cwd = await stat(home).then(s => (s.isDirectory() ? home : deps.userHome), () => deps.userHome);
+            const mark = `__AALIS_ENV_${crypto.randomUUID()}__`;
+            const { stdout } = await proc.execFile(shell, ['-i', '-l', '-c', `printf '%s' '${mark}'; /usr/bin/env -0`], {
+                cwd,
+                timeout: CAPTURE_TIMEOUT_MS,
+                input: '',
+            });
+            const at = stdout.indexOf(mark);
+            if (at < 0)
+                throw new Error(`${shell} 的输出里没有环境`);
+            return Object.fromEntries(stdout
+                .slice(at + mark.length)
+                .split('\0')
+                .filter(line => line.includes('='))
+                .map(line => [line.slice(0, line.indexOf('=')), line.slice(line.indexOf('=') + 1)]));
+        }
+        catch (err) {
+            deps.logger.warn(`没取到 owner 的 login shell 环境（主目录 ${home}），子进程用守护进程的环境，1 分钟后再取:`, err);
+            return undefined;
+        }
+    }
+    return (home) => {
+        const cached = cache.get(home);
+        if (cached && Date.now() < cached.retryAt)
+            return cached.env;
+        const entry = {
+            retryAt: Number.POSITIVE_INFINITY,
+            env: capture(home).then(env => {
+                if (env)
+                    return env;
+                entry.retryAt = Date.now() + RETRY_AFTER_MS;
+                return { ...process.env };
+            }),
+        };
+        cache.set(home, entry);
+        return entry.env;
+    };
+}
+/**
+ * 沙箱里的命令拿到的环境：完整的登录环境去掉本实例的变量与 ssh-agent 的 socket，注入 npm 的用户配置（去掉认证键的副本，写在
+ * 本会话临时区）、本机 Node 的头文件、浏览器的缓存目录，关掉 pnpm 的构建产物缓存（沙箱里构建出的产物不能被沙箱外的安装直接
+ * 复用），SSH 地址的拉取走 HTTPS
+ */
+export async function sandboxEnv(login, sessionTmp, userHome) {
+    const env = Object.fromEntries(Object.entries(login).filter(([name]) => !INSTANCE_VARS.test(name) && name !== SSH_AGENT_SOCK));
+    const npmrc = join(sessionTmp, 'npmrc');
+    const owned = await readFile(join(userHome, '.npmrc'), 'utf8').catch(err => {
+        if (isMissing(err))
+            return '';
+        throw err;
+    });
+    // 临时区在沙箱里可写，沙箱里的命令能把 npmrc、甚至临时区本身换成符号链接，骗守护进程去改写别处：临时区本身要是目录，
+    // 副本先以随机名独占创建（不跟随链接），再改名盖过去（换掉的是链接本身）
+    if (!(await lstat(sessionTmp)).isDirectory()) {
+        throw new Error(`本会话临时区 ${sessionTmp} 不是目录（可能被换成了符号链接），不往里写 npm 的用户配置`);
+    }
+    const staging = join(sessionTmp, `.npmrc-${crypto.randomUUID()}`);
+    const kept = owned.split('\n').filter(line => !NPMRC_SECRET.test(line.trim()));
+    await writeFile(staging, kept.join('\n'), { mode: 0o600, flag: 'wx' });
+    await rename(staging, npmrc);
+    const nodeDir = await nodeDirOf(env.PATH);
+    const injected = {
+        npm_config_userconfig: npmrc,
+        npm_config_side_effects_cache: 'false',
+        PUPPETEER_CACHE_DIR: join(sessionTmp, 'puppeteer'),
+        ...(nodeDir ? { npm_config_nodedir: nodeDir } : {}),
+    };
+    // npm 的环境变量不分大小写：同名的旧值去掉，免得两份打架
+    for (const name of Object.keys(env)) {
+        if (Object.keys(injected).some(key => key.toLowerCase() === name.toLowerCase()))
+            delete env[name];
+    }
+    const git = HTTPS_HOSTS.flatMap((host) => [
+        [`url.https://${host}/.insteadOf`, `git@${host}:`],
+        [`url.https://${host}/.insteadOf`, `ssh://git@${host}/`],
+        [`url.git@${host}:.pushInsteadOf`, `git@${host}:`],
+        [`url.ssh://git@${host}/.pushInsteadOf`, `ssh://git@${host}/`],
+    ]);
+    // git 的命令行配置只有一组连续编号：沙箱要的几项接在登录环境原有的那组后面重新编号，原有的照留（计数不是数字时 git 本就
+    // 读不了那组，从 0 编号）
+    const base = /^\d+$/.test(env.GIT_CONFIG_COUNT ?? '') ? Number(env.GIT_CONFIG_COUNT) : 0;
+    git.forEach(([key, value], i) => {
+        env[`GIT_CONFIG_KEY_${base + i}`] = key;
+        env[`GIT_CONFIG_VALUE_${base + i}`] = value;
+    });
+    env.GIT_CONFIG_COUNT = String(base + git.length);
+    return { ...env, ...injected };
+}
+/** 这份 PATH 上的 node 所在的安装（带头文件的才算）：源码编译原生模块时 node-gyp 用它，不必去下载头文件 */
+async function nodeDirOf(path) {
+    for (const dir of (path ?? '').split(delimiter)) {
+        if (!dir)
+            continue;
+        const bin = await realpath(join(dir, 'node')).catch(() => undefined);
+        if (!bin)
+            continue;
+        const prefix = dirname(dirname(bin));
+        return access(join(prefix, 'include', 'node', 'node.h')).then(() => prefix, () => undefined);
+    }
+    return undefined;
+}
+//# sourceMappingURL=process-env.js.map

package/dist/process-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-env.js","sourceRoot":"","sources":["../src/process-env.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,kFAAkF;AAClF,0DAA0D;AAC1D,iEAAiE;AACjE,0EAA0E;AAC1E,YAAY;AACZ,+DAA+D;AAE/D,sHAAsH;AACtH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9F,gFAAgF;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,oCAAoC;AACpC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,kBAAkB;AAClB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,kDAAkD;AAClD,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,yDAAyD;AACzD,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC;;;GAGG;AACH,MAAM,YAAY,GAAG,4EAA4E,CAAC;AAClG,6DAA6D;AAC7D,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAEjD,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,IAAqF;IAC7G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IAExE,sBAAsB;IACtB,KAAK,UAAU,OAAO,CAAC,IAAY;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,KAAK,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACxE,sCAAsC;YACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC7C,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CACpB,CAAC;YACF,MAAM,IAAI,GAAG,eAAe,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;YACpD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,IAAI,oBAAoB,CAAC,EAAE;gBAC1G,GAAG;gBACH,OAAO,EAAE,kBAAkB;gBAC3B,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM;iBACH,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;iBACvB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAClC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kCAAkC,IAAI,wBAAwB,EAC9D,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAY,EAAgB,EAAE;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QAC7D,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,iBAAiB;YACjC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC5B,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;gBACpB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;gBAC5C,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAS,CAAC;YACnC,CAAC,CAAC;SACH,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAU,EAAE,UAAkB,EAAE,QAAgB;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,cAAc,CAAC,CAC/F,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACzE,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,+DAA+D;IAC/D,sCAAsC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAQ;QACpB,qBAAqB,EAAE,KAAK;QAC5B,6BAA6B,EAAE,OAAO;QACtC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IACF,gCAAgC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAC7B,CAAC,IAAI,EAA2B,EAAE,CAAC;QACjC,CAAC,eAAe,IAAI,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAClD,CAAC,eAAe,IAAI,aAAa,EAAE,aAAa,IAAI,GAAG,CAAC;QACxD,CAAC,WAAW,IAAI,iBAAiB,EAAE,OAAO,IAAI,GAAG,CAAC;QAClD,CAAC,iBAAiB,IAAI,iBAAiB,EAAE,aAAa,IAAI,GAAG,CAAC;KAC/D,CACF,CAAC;IACF,kEAAkE;IAClE,gBAAgB;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;QACxC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,SAAS,CAAC,IAAwB;IAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAC3D,GAAG,EAAE,CAAC,MAAM,EACZ,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/session-tmp.d.ts

@@ -0,0 +1,7 @@
+import type { SessionInfo } from '@aalis/api-session-manager';
+import type { Logger } from '@aalis/core';
+export declare const SWEEP_EVERY_MS: number;
+export declare const sessionTmpOf: (tmp: string, sessionId: string) => string;
+/** 清扫一遍，返回删掉的会话 id。逐个临时区处理：一个看不了或删不掉的记 warn（写明目录与原因），不挡别的 */
+export declare function sweepSessionTmp(tmp: string, sessionOf: (sessionId: string) => SessionInfo | undefined, now: number, logger: Pick<Logger, 'warn'>): Promise<string[]>;
+//# sourceMappingURL=session-tmp.d.ts.map

package/dist/session-tmp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tmp.d.ts","sourceRoot":"","sources":["../src/session-tmp.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1C,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,EAAE,WAAW,MAAM,WACI,CAAC;AAEhE,6DAA6D;AAC7D,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,EACzD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAuBnB"}

package/dist/session-tmp.js

@@ -0,0 +1,68 @@
+// ============================================================
+// 本会话临时区：tmp/sessions/<会话 id 的 UTF-8 十六进制>/，0700。十六进制只有小写，大小写不敏感的文件系统上两个会话也不会撞名
+//
+// 有本地效果的调用签发凭据时建好；删会话时删；启动时与每天清扫一次：7 天没有改动、会话也不在运行的删掉。会话表里查不到
+// 的同样按 7 天算，不立即删：会话表读不出（记忆后端暂时连不上）时表是空的，不能当作会话都删了。删除与清扫都在后台跑，
+// 不拖住激活与删会话。
+// 插件自己的临时目录（浏览器截图、代码执行的脚本目录）不在这里，清扫不碰。
+// ============================================================
+// biome-ignore lint/style/noRestrictedImports: 清扫本会话临时区要按 lstat 不跟随链接地看修改时间，存储服务没有这个能力
+import { lstat, readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isMissing } from './host-dirs.js';
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** 这么久没有改动的临时区，会话不在运行时清掉 */
+const STALE_MS = 7 * DAY_MS;
+export const SWEEP_EVERY_MS = DAY_MS;
+export const sessionTmpOf = (tmp, sessionId) => join(tmp, 'sessions', Buffer.from(sessionId).toString('hex'));
+/** 清扫一遍，返回删掉的会话 id。逐个临时区处理：一个看不了或删不掉的记 warn（写明目录与原因），不挡别的 */
+export async function sweepSessionTmp(tmp, sessionOf, now, logger) {
+    const root = join(tmp, 'sessions');
+    const names = await readdir(root).catch(err => {
+        if (isMissing(err))
+            return [];
+        throw err;
+    });
+    const removed = [];
+    for (const name of names) {
+        const sessionId = Buffer.from(name, 'hex').toString();
+        // 名字不是某个会话 id 的编码：不是本会话临时区，不动
+        if (Buffer.from(sessionId).toString('hex') !== name)
+            continue;
+        const dir = join(root, name);
+        try {
+            if (sessionOf(sessionId)?.status === 'active' || (await changedSince(dir, now - STALE_MS)))
+                continue;
+            // 遍历期间会话可能开了新回合
+            if (sessionOf(sessionId)?.status === 'active')
+                continue;
+            await rm(dir, { recursive: true, force: true });
+            removed.push(sessionId);
+        }
+        catch (err) {
+            logger.warn(`清不掉会话 ${sessionId} 的临时区 ${dir}:`, err);
+        }
+    }
+    return removed;
+}
+/** 目录或它下面任何一项在 since 之后改过（不跟随符号链接）；遍历中途被删掉的按刚改过算，这一轮不动它 */
+async function changedSince(path, since) {
+    try {
+        const entry = await lstat(path);
+        if (entry.mtimeMs > since)
+            return true;
+        if (!entry.isDirectory())
+            return false;
+        for (const name of await readdir(path)) {
+            if (await changedSince(join(path, name), since))
+                return true;
+        }
+        return false;
+    }
+    catch (err) {
+        if (isMissing(err))
+            return true;
+        throw err;
+    }
+}
+//# sourceMappingURL=session-tmp.js.map

package/dist/session-tmp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tmp.js","sourceRoot":"","sources":["../src/session-tmp.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,gFAAgF;AAChF,EAAE;AACF,8DAA8D;AAC9D,8DAA8D;AAC9D,aAAa;AACb,uCAAuC;AACvC,+DAA+D;AAE/D,uFAAuF;AACvF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,4BAA4B;AAC5B,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAE,CAC7D,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAEhE,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,SAAyD,EACzD,GAAW,EACX,MAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,8BAA8B;QAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,SAAS;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;gBAAE,SAAS;YACrG,gBAAgB;YAChB,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,QAAQ;gBAAE,SAAS;YACxD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,SAAS,SAAS,SAAS,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/texts.d.ts

@@ -0,0 +1,9 @@
+declare const SOURCE: {
+    readonly displayName: "触及";
+};
+export type Source = typeof SOURCE;
+export declare const t: import("@aalis/schema-i18n").TextFactory<{
+    readonly displayName: "触及";
+}>;
+export {};
+//# sourceMappingURL=texts.d.ts.map

package/dist/texts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"texts.d.ts","sourceRoot":"","sources":["../src/texts.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,MAAM;;CAEF,CAAC;AACX,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC;AAEnC,eAAO,MAAM,CAAC;;EAAiG,CAAC"}

package/dist/texts.js

@@ -0,0 +1,8 @@
+// 本插件自己的原文字典：显示名
+import { defineTexts } from '@aalis/schema-i18n';
+import en from './locales/en.js';
+const SOURCE = {
+    displayName: '触及',
+};
+export const t = defineTexts({ ns: '@aalis/plugin-reach', language: 'zh-CN', source: SOURCE, locales: { en } });
+//# sourceMappingURL=texts.js.map

package/dist/texts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"texts.js","sourceRoot":"","sources":["../src/texts.ts"],"names":[],"mappings":"AAAA,iBAAiB;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEjC,MAAM,MAAM,GAAG;IACb,WAAW,EAAE,IAAI;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "@aalis/plugin-reach",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AalisLabs/Aalis.git",
+    "directory": "packages/plugin-reach"
+  },
+  "author": "Ace Nyan <ace@acenyan.com>",
+  "bugs": {
+    "url": "https://github.com/AalisLabs/Aalis/issues"
+  },
+  "homepage": "https://github.com/AalisLabs/Aalis#readme",
+  "description": "触及：按一次工具调用签发触及凭据（这一轮的主体、档位与场所定下本机能读写执行什么），管本会话临时区与子进程环境",
+  "type": "module",
+  "keywords": [
+    "aalis",
+    "aalis-plugin"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@aalis/api-authority": ">=0.12.0 <1.0.0",
+    "@aalis/api-host-paths": ">=0.1.0 <1.0.0",
+    "@aalis/api-process": ">=0.10.0 <1.0.0",
+    "@aalis/api-reach": ">=0.2.0 <1.0.0",
+    "@aalis/api-session-manager": ">=0.12.0 <1.0.0",
+    "@aalis/schema-i18n": ">=0.1.0 <1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0",
+    "@aalis/core": "0.21.0"
+  },
+  "peerDependencies": {
+    "@aalis/core": ">=0.21.0 <1.0.0"
+  },
+  "aalis": {
+    "service": {
+      "optional": [
+        "authority",
+        "process"
+      ],
+      "provides": [
+        "reach"
+      ],
+      "required": [
+        "events",
+        "host-paths",
+        "lifecycle",
+        "logger",
+        "provide",
+        "session-manager"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch"
+  }
 }