@catheadowl/dsh-eval 0.2.0 → 0.2.1

package/src/sandbox.mjs

@@ -17,7 +17,7 @@
 
 import { spawn } from 'node:child_process'
 import {
-  chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync, unlinkSync,
+  chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, unlinkSync,
 } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
@@ -104,6 +104,67 @@ function copyProfileEntry(from, to, junctions) {
   copyFileSync(from, to)
 }
 
+/**
+ * Enumerate every loader row id the STAGED profile composes BEYOND the host
+ * templates (`@deepseek-ai/*` bundles) — the data source for the review
+ * adapter's default blank environment (blank = dsh-base/dsh-headless only,
+ * no out-of-tree plugin face regardless of what the host profile carries).
+ *
+ * Composition-aware, per the host's ordered-layer model: the profile root
+ * `cordis.yml` ships as an EMPTY entry list — plugins enter either through
+ * the profile's own `cordis.patch.yml` rows or through out-of-tree bundles
+ * listed in `package.json`'s `dsh.profile.bundles`, each bundle contributing
+ * rows from its own `cordis.patch.yml`/`cordis.yml` under the profile's
+ * (junctioned) `node_modules`. All three sources live inside the staged home.
+ *
+ * A minimal token scan (`- id: <token>` at any indentation, which also
+ * covers rows nested under `- insert:`), not a YAML parse (same precedent as
+ * the file-history minimal session-log decoder). Entries without an `id` are
+ * invisible to id-targeted disables by construction and thus not collected.
+ * Unreadable sources contribute nothing — callers keep their static
+ * fallback rows.
+ * @param {string} tmpHome - the staged temporary home.
+ * @param {string} profileName - the staged profile name.
+ * @returns {string[]} deduplicated loader row ids beyond the host templates.
+ */
+export function stagedPluginRows(tmpHome, profileName) {
+  const profileDir = join(tmpHome, 'profiles', profileName)
+  const rows = []
+  const collectIds = (text) => {
+    for (const match of text.matchAll(/^[ \t]*-[ \t]+id:[ \t]*"?'?([^\s"']+)/gm)) {
+      if (!rows.includes(match[1])) rows.push(match[1])
+    }
+  }
+  const readText = (file) => {
+    try {
+      return readFileSync(file, 'utf8')
+    } catch {
+      return undefined
+    }
+  }
+  // Source 1+2: the profile's own composition files (root list is normally
+  // the shipped empty `[]`, but a non-empty one is scanned all the same).
+  for (const name of ['cordis.patch.yml', 'cordis.yml']) {
+    const text = readText(join(profileDir, name))
+    if (text !== undefined) collectIds(text)
+  }
+  // Source 3: every NON-host bundle in dsh.profile.bundles — host template
+  // bundles (`@deepseek-ai/*`) define the sterile baseline and stay.
+  let bundles
+  try {
+    bundles = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8'))?.dsh?.profile?.bundles
+  } catch { /* no package.json → no bundle rows to collect */ }
+  for (const bundle of Array.isArray(bundles) ? bundles : []) {
+    if (typeof bundle !== 'string' || bundle.startsWith('@deepseek-ai/')) continue
+    const bundleDir = join(profileDir, 'node_modules', ...bundle.split('/'))
+    for (const name of ['cordis.patch.yml', 'cordis.yml']) {
+      const text = readText(join(bundleDir, name))
+      if (text !== undefined) collectIds(text)
+    }
+  }
+  return rows
+}
+
 /**
  * Copy the managed credential document into the temporary home (copy, not
  * junction: single file, best-effort owner-only 0o600 — a no-op beyond the

package/src/tool-validation.mjs

@@ -1,77 +1,77 @@
-/**
- * Post-run tool boundary validation for blind review.
- *
- * After a review run completes, this module inspects the session trace's
- * `request/header` events to verify that no unexpected tools were mounted
- * in the reviewer's session.  This is the detection half of the
- * sterile-profile strategy: the profile prevents plugin tools from being
- * installed, the overlay disables every host tool row, and this check
- * makes any residual drift (a bundle leaking tools through a patch, a host
- * regression, a misconfigured profile) an explicit adapter failure.
- *
- * The module is intentionally pure: it takes an already-parsed trace and
- * returns a plain result object.  File I/O (reading the session log,
- * writing evidence) stays in the calling adapter.
- */
-
-/**
- * Collect every distinct tool name mounted across all `request/header`
- * events in a trace.
- * @param {import('./trace.mjs').EvalTrace} trace
- * @returns {string[]} sorted tool names.
- */
-function collectMountedToolNames(trace) {
-  const names = new Set()
-  for (const header of trace.requestHeaders ?? []) {
-    for (const name of header.toolNames ?? []) {
-      names.add(name)
-    }
-  }
-  return [...names].sort()
-}
-
-/**
- * Check a review trace for tool leakage.
- *
- * Every tool name appearing in any `request/header` event is compared
- * against the allowed set.  An empty allowed set (the review default)
- * means the reviewer must see no tools at all.
- *
- * @param {import('./trace.mjs').EvalTrace | undefined} trace - the parsed trace; `undefined` skips validation.
- * @param {{ allowedTools?: Set<string> }} [options]
- * @returns {{ ok: boolean, unexpected: string[], actual: string[], allowed: string[] }}
- */
-export function validateToolBoundary(trace, options = {}) {
-  const allowed = options.allowedTools ?? new Set()
-  const allowedNames = [...allowed].sort()
-  if (trace === undefined || trace === null) {
-    return { ok: true, unexpected: [], actual: [], allowed: allowedNames }
-  }
-  const actual = collectMountedToolNames(trace)
-  const unexpected = actual.filter(name => !allowed.has(name))
-  return {
-    ok: unexpected.length === 0,
-    unexpected,
-    actual,
-    allowed: allowedNames,
-  }
-}
-
-/**
- * Render a diagnostic evidence document for a tool boundary failure.
- * Suitable for writing to `.runs/<id>/tool-boundary-evidence.json`.
- *
- * @param {{ ok: boolean, unexpected: string[], actual: string[], allowed: string[] }} validation
- * @param {{ runDir: string, profile: string }} context
- * @returns {string}
- */
-export function renderToolBoundaryEvidence(validation, context) {
-  return JSON.stringify({
-    status: 'tool-boundary-violation',
-    runDir: context.runDir,
-    profile: context.profile,
-    unexpectedTools: validation.unexpected,
-    actualMounted: validation.actual,
-    allowedTools: validation.allowed,
-  }, null, 2) + '\n'
-}
+/**
+ * Post-run tool boundary validation for blind review.
+ *
+ * After a review run completes, this module inspects the session trace's
+ * `request/header` events to verify that no unexpected tools were mounted
+ * in the reviewer's session.  This is the detection half of the
+ * blank-environment strategy: the overlay disables every staged out-of-tree
+ * plugin row plus every host tool row, and this check makes any residual
+ * drift (a bundle leaking tools through a patch, a host regression, a
+ * misconfigured profile) an explicit adapter failure.
+ *
+ * The module is intentionally pure: it takes an already-parsed trace and
+ * returns a plain result object.  File I/O (reading the session log,
+ * writing evidence) stays in the calling adapter.
+ */
+
+/**
+ * Collect every distinct tool name mounted across all `request/header`
+ * events in a trace.
+ * @param {import('./trace.mjs').EvalTrace} trace
+ * @returns {string[]} sorted tool names.
+ */
+function collectMountedToolNames(trace) {
+  const names = new Set()
+  for (const header of trace.requestHeaders ?? []) {
+    for (const name of header.toolNames ?? []) {
+      names.add(name)
+    }
+  }
+  return [...names].sort()
+}
+
+/**
+ * Check a review trace for tool leakage.
+ *
+ * Every tool name appearing in any `request/header` event is compared
+ * against the allowed set.  An empty allowed set (the review default)
+ * means the reviewer must see no tools at all.
+ *
+ * @param {import('./trace.mjs').EvalTrace | undefined} trace - the parsed trace; `undefined` skips validation.
+ * @param {{ allowedTools?: Set<string> }} [options]
+ * @returns {{ ok: boolean, unexpected: string[], actual: string[], allowed: string[] }}
+ */
+export function validateToolBoundary(trace, options = {}) {
+  const allowed = options.allowedTools ?? new Set()
+  const allowedNames = [...allowed].sort()
+  if (trace === undefined || trace === null) {
+    return { ok: true, unexpected: [], actual: [], allowed: allowedNames }
+  }
+  const actual = collectMountedToolNames(trace)
+  const unexpected = actual.filter(name => !allowed.has(name))
+  return {
+    ok: unexpected.length === 0,
+    unexpected,
+    actual,
+    allowed: allowedNames,
+  }
+}
+
+/**
+ * Render a diagnostic evidence document for a tool boundary failure.
+ * Suitable for writing to `.runs/<id>/tool-boundary-evidence.json`.
+ *
+ * @param {{ ok: boolean, unexpected: string[], actual: string[], allowed: string[] }} validation
+ * @param {{ runDir: string, profile: string }} context
+ * @returns {string}
+ */
+export function renderToolBoundaryEvidence(validation, context) {
+  return JSON.stringify({
+    status: 'tool-boundary-violation',
+    runDir: context.runDir,
+    profile: context.profile,
+    unexpectedTools: validation.unexpected,
+    actualMounted: validation.actual,
+    allowedTools: validation.allowed,
+  }, null, 2) + '\n'
+}