@almadar/workspace 0.11.3 → 0.11.5

package/dist/index.d.ts

@@ -10,6 +10,6 @@ export { openWorkspace } from './open-workspace.js';
 export { listWorkspaces } from './list-workspaces.js';
 export { deleteWorkspace } from './delete-workspace.js';
 export { openAccount } from './account.js';
-export type { WorkspaceService, InstantiateWorkspaceSeed, WorkspaceObserver, WorkspaceWriteEvent, WorkspaceWatchEvent, OpenWorkspaceOptions, ListWorkspacesOptions, WorkspaceSummary, RestoreBackend, GitHubConfig, GitStatusInfo, SnapshotMeta, WorkspaceArchiveBackend, FileTreeNode, AccountService, AccountConfig, ProviderCredential, AuthToken, AccountIdentity, OpenAccountOptions, } from './types.js';
+export type { WorkspaceService, InstantiateWorkspaceSeed, WorkspaceObserver, WorkspaceWriteEvent, WorkspaceWatchEvent, OpenWorkspaceOptions, MountEntry, ListWorkspacesOptions, WorkspaceSummary, RestoreBackend, GitHubConfig, GitStatusInfo, SnapshotMeta, WorkspaceArchiveBackend, FileTreeNode, AccountService, AccountConfig, ProviderCredential, AuthToken, AccountIdentity, OpenAccountOptions, } from './types.js';
 export type { WorkspaceIndex, EmbedderPort, ResolveResult, ResolveOptions, TraitRefEmit, WorkspaceIndexStats, OrbitalIndexEntry, ExtraTraitIdentity, RetrievalResult, RetrievalOptions, RecentlyEditedOptions, EventEdge, EntityBinding, RuleBinding, RecencyEntry, IntentMaps, ComposedMaps, BM25Document, BM25Table, BM25Options, WorkspaceIndexManifest, } from './workspace-index/types.js';
 export { DEFAULT_COERCION_THRESHOLD, DEFAULT_RETRIEVAL_TOP_K, RRF_K, WORKSPACE_INDEX_SCHEMA_VERSION, } from './workspace-index/types.js';

package/dist/index.js

@@ -293,7 +293,7 @@ function appMarkerFile(workDir) {
 function workspaceIndexManifestFile(workDir) {
   return path2.join(workDir, WORKSPACE_LAYOUT.ALMADAR_DIR, "index.json");
 }
-function sandboxedPath(workDir, relPath) {
+function sandboxedPath(workDir, relPath, mounts) {
   if (typeof relPath !== "string" || relPath.length === 0) {
     throw new Error("sandbox: empty relative path");
   }
@@ -303,6 +303,20 @@ function sandboxedPath(workDir, relPath) {
   if (/^[a-zA-Z]:[\\/]/.test(relPath)) {
     throw new Error(`sandbox: drive-letter paths are not allowed (${relPath})`);
   }
+  if (mounts) {
+    for (const [prefix, mountRoot] of mounts) {
+      const prefixSep = prefix + "/";
+      if (relPath === prefix || relPath.startsWith(prefixSep)) {
+        const mountAbs = path2.resolve(mountRoot);
+        const rest = relPath === prefix ? "." : relPath.slice(prefixSep.length);
+        const target2 = path2.resolve(mountAbs, rest);
+        if (target2 !== mountAbs && !target2.startsWith(mountAbs + path2.sep)) {
+          throw new Error(`sandbox: mount path escapes mount root (${relPath})`);
+        }
+        return target2;
+      }
+    }
+  }
   const rootAbs = path2.resolve(workDir);
   const target = path2.resolve(rootAbs, relPath);
   if (target !== rootAbs && !target.startsWith(rootAbs + path2.sep)) {
@@ -1770,6 +1784,8 @@ var WorkspaceServiceImpl = class {
   constructor(args) {
     /** Per-absolute-path serial queue. */
     this.writeQueue = /* @__PURE__ */ new Map();
+    /** Mount prefix → resolved absolute directory. Built from constructor `mounts` + runtime `mountReadonly`. */
+    this.mountMap = /* @__PURE__ */ new Map();
     this.workDir = args.workDir;
     this.backend = args.backend;
     this.sinks = args.sinks;
@@ -1787,6 +1803,9 @@ var WorkspaceServiceImpl = class {
       readSchema: () => this.readSchema(),
       readHistory: (orbital) => this.readHistory(orbital)
     });
+    if (args.mounts) {
+      for (const m of args.mounts) this.mountMap.set(m.prefix, path2.resolve(m.absPath));
+    }
   }
   // === Identity ===
   get appId() {
@@ -2109,7 +2128,7 @@ var WorkspaceServiceImpl = class {
   }
   // === Sandboxed generic file I/O ===
   async readFile(relPath) {
-    const abs = sandboxedPath(this.workDir, relPath);
+    const abs = this.sandbox(relPath);
     if (!this.backend.exists(abs)) return null;
     try {
       return await this.backend.readFile(abs);
@@ -2118,7 +2137,8 @@ var WorkspaceServiceImpl = class {
     }
   }
   async writeFile(relPath, content) {
-    const abs = sandboxedPath(this.workDir, relPath);
+    this.assertNotMounted(relPath);
+    const abs = this.sandbox(relPath);
     await this.withLock(abs, async () => {
       await this.ensureParent(abs);
       await this.backend.writeFile(abs, content);
@@ -2126,7 +2146,8 @@ var WorkspaceServiceImpl = class {
     await this.emit({ kind: "file", relPath, content });
   }
   async removeFile(relPath) {
-    const abs = sandboxedPath(this.workDir, relPath);
+    this.assertNotMounted(relPath);
+    const abs = this.sandbox(relPath);
     let removed = false;
     await this.withLock(abs, async () => {
       if (!this.backend.exists(abs)) return;
@@ -2136,7 +2157,7 @@ var WorkspaceServiceImpl = class {
     if (removed) await this.emit({ kind: "file-removed", relPath });
   }
   async listTree(relPath) {
-    const base = relPath === void 0 ? this.workDir : sandboxedPath(this.workDir, relPath);
+    const base = relPath === void 0 ? this.workDir : this.sandbox(relPath);
     if (!this.backend.exists(base)) return [];
     const out = [];
     await walk(this.backend, base, this.workDir, out);
@@ -2145,12 +2166,39 @@ var WorkspaceServiceImpl = class {
   async exists(relPath) {
     let abs;
     try {
-      abs = sandboxedPath(this.workDir, relPath);
+      abs = this.sandbox(relPath);
     } catch {
       return false;
     }
     return this.backend.exists(abs);
   }
+  // === Read-only mounts ===
+  mountReadonly(prefix, absPath) {
+    if (this.mountMap.has(prefix)) {
+      throw new Error(`mount: prefix "${prefix}" already registered`);
+    }
+    this.mountMap.set(prefix, path2.resolve(absPath));
+  }
+  isMounted(relPath) {
+    try {
+      for (const [prefix] of this.mountMap) {
+        if (relPath === prefix || relPath.startsWith(prefix + "/")) return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+  /** Resolve a sandboxed path through mounts. */
+  sandbox(relPath) {
+    return sandboxedPath(this.workDir, relPath, this.mountMap.size > 0 ? this.mountMap : void 0);
+  }
+  /** Throw if relPath resolves to a mount (write/remove are blocked). */
+  assertNotMounted(relPath) {
+    if (this.isMounted(relPath)) {
+      throw new Error(`sandbox: cannot write to read-only mount (${relPath})`);
+    }
+  }
   // === Git ===
   async commitAndPush(opts) {
     if (!this.git) return null;
@@ -2405,7 +2453,8 @@ async function openWorkspaceInternal(opts) {
     appId: resolved.appId,
     git,
     github: opts.github,
-    archiveBackend: opts.archiveBackend
+    archiveBackend: opts.archiveBackend,
+    mounts: opts.mounts
   });
   if (!bare) {
     await service.index.warm();