@ckanner/dsh-plugin-flywheel 0.28.0 → 0.28.2

package/dist/codex-pro-bridge.js

@@ -38,7 +38,7 @@ export function machineRequest(value, api, env) {
   const keys = new Set(['type', 'protocol', 'requestId', 'cwd', 'model', 'reasoningEffort', 'permissionMode', 'prompt', 'timeoutMs']);
   if (value === null || typeof value !== 'object' || Array.isArray(value) || value.type !== 'start' || value.protocol !== 1 ||
       Object.keys(value).some(key => !keys.has(key)) || typeof value.requestId !== 'string' || value.requestId.length > 256 ||
-      !['read-only', 'workspace-write'].includes(value.permissionMode)) {
+      !['read-only', 'workspace-write', 'danger-full-access'].includes(value.permissionMode)) {
     throw new WorkerError('INVALID_REQUEST', 'Expected one protocol=1 start request with an explicit supported permission mode');
   }
   if (value.timeoutMs !== undefined && (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1 || value.timeoutMs > 2147483647)) {
@@ -46,7 +46,9 @@ export function machineRequest(value, api, env) {
   }
   try {
     return api.parseMachineRequest({ protocol: 1, requestId: value.requestId, cwd: value.cwd, model: value.model,
-      effort: value.reasoningEffort, permissionMode: value.permissionMode, prompt: value.prompt,
+      effort: value.reasoningEffort,
+      permissionMode: value.permissionMode === 'danger-full-access' ? 'dangerously-bypass-approvals-and-sandbox' : value.permissionMode,
+      prompt: value.prompt,
       ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }),
       command: env.FLYWHEEL_CODEX_BIN || 'codex', threadMode: 'ephemeral', maxOutputBytes: LIMITS.machineOutputBytes });
   } catch (error) {

package/dist/control.js

@@ -4,6 +4,15 @@ import { directory, nonempty, record } from './protocol.js';
 const actions = ['start', 'status', 'stop', 'config', 'doctor'];
 const checkStatuses = ['pass', 'fail', 'warn', 'unknown', 'skipped'];
 
+// This marker is issued only where the host can prove that no control process
+// started. An engine/transport error after spawn must never acquire it.
+export class ControlNotDispatchedError extends Error {
+  constructor(cause) {
+    super(cause instanceof Error ? cause.message : String(cause), { cause });
+    this.name = 'ControlNotDispatchedError';
+  }
+}
+
 export async function validateControl(input, defaultCwd) {
   if (!record(input) || !actions.includes(input.action)) {
     throw new Error('action must be start, status, stop, config, or doctor');
@@ -46,13 +55,18 @@ function validDiagnostic(value, request) {
 
 /** Only the engine executable can mutate engine state. No shell interpolation. */
 export async function runControl(input, { binary = 'flywheel', defaultCwd, signal, timeoutMs = 60000 } = {}) {
-  nonempty(binary, 'flywheelBinary', 4096);
-  if (binary.startsWith('-')) throw new Error('flywheelBinary must name an executable');
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 120000) {
-    throw new Error('controlTimeoutMs must be between 100 and 120000');
+  let request;
+  try {
+    nonempty(binary, 'flywheelBinary', 4096);
+    if (binary.startsWith('-')) throw new Error('flywheelBinary must name an executable');
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 120000) {
+      throw new Error('controlTimeoutMs must be between 100 and 120000');
+    }
+    request = await validateControl(input, defaultCwd);
+    if (signal?.aborted) throw new Error('Flywheel control request cancelled');
+  } catch (error) {
+    throw new ControlNotDispatchedError(error);
   }
-  const request = await validateControl(input, defaultCwd);
-  if (signal?.aborted) throw new Error('Flywheel control request cancelled');
   // Diagnostic commands own watchdog child groups. Its TERM grace, pipe
   // WaitDelay, and quiescence confirmation may each take 5s; keep the Go owner
   // alive long enough to finish all three instead of orphaning its workers.
@@ -61,9 +75,17 @@ export async function runControl(input, { binary = 'flywheel', defaultCwd, signa
   if (request.taskDir) args.push('--task-dir', request.taskDir);
   if (request.probe) args.push('--probe');
   return new Promise((resolve, reject) => {
-    const child = spawn(binary, args, {
-      cwd: request.cwd, detached: false, stdio: ['ignore', 'pipe', 'pipe'],
-    });
+    let child;
+    try {
+      child = spawn(binary, args, {
+        cwd: request.cwd, detached: false, stdio: ['ignore', 'pipe', 'pipe'],
+      });
+    } catch (error) {
+      reject(new ControlNotDispatchedError(error));
+      return;
+    }
+    let spawned = false;
+    child.once('spawn', () => { spawned = true; });
     let stdout = '';
     let stderr = '';
     let failure;
@@ -88,7 +110,11 @@ export async function runControl(input, { binary = 'flywheel', defaultCwd, signa
       if (Buffer.byteLength(stdout) > 1024 * 1024) stop(new Error('Flywheel control response exceeds 1 MiB'));
     });
     child.stderr.on('data', chunk => { stderr = (stderr + chunk).slice(-8192); });
-    child.on('error', error => { failure = error; });
+    child.on('error', error => {
+      // Node emits spawn before other events after successful process creation.
+      // Require both the missing spawn event and missing PID for positive proof.
+      failure = !spawned && child.pid === undefined ? new ControlNotDispatchedError(error) : error;
+    });
     child.on('close', (code, childSignal) => {
       clearTimeout(timer);
       clearTimeout(killTimer);

package/dist/index.js

@@ -1,4 +1,4 @@
-import { runControl } from './control.js';
+import { ControlNotDispatchedError, runControl } from './control.js';
 import { resolveFlywheelBinary } from './installation.js';
 
 export const inject = ['commands', 'tools'];
@@ -33,11 +33,25 @@ export function apply(ctx, config = {}) {
     description: '通过 Go 引擎控制 Flywheel 任务、查看实际模型配置或执行无推理环境检查。',
     input: { hint: '{"action":"doctor"} 或 {"action":"status","taskDir":"/absolute/docs/task"}' },
     async handler({ rawInput, agent, signal }) {
+      let input;
       try {
-        const value = await control(JSON.parse(rawInput), agent, signal);
+        try {
+          input = JSON.parse(rawInput);
+        } catch (error) {
+          throw new ControlNotDispatchedError(error);
+        }
+        const value = await control(input, agent, signal);
         return { kind: 'success', text: JSON.stringify(value, null, 2) };
       } catch (error) {
-        return { kind: 'error', text: error.message };
+        // CommandResult preserves only kind/text. Wrap every failure, including
+        // unknown outcomes, so a child error's text cannot impersonate host proof.
+        return { kind: 'error', text: JSON.stringify({
+          protocol: 1,
+          type: 'flywheel-control-error',
+          action: typeof input?.action === 'string' ? input.action : null,
+          dispatch: error instanceof ControlNotDispatchedError ? 'not-dispatched' : 'unknown',
+          message: error instanceof Error ? error.message : String(error),
+        }, null, 2) };
       }
     },
   });

package/dist/policy.js

@@ -4,20 +4,22 @@ export const inject = ['sandboxPolicy', 'approval', 'shell'];
 
 export async function apply(ctx, config) {
   const { permissionMode, cwd } = config;
-  if (!['read-only', 'workspace-write'].includes(permissionMode) || typeof cwd !== 'string' ||
+  const fullAccess = permissionMode === 'danger-full-access';
+  if (!['read-only', 'workspace-write', 'danger-full-access'].includes(permissionMode) || typeof cwd !== 'string' ||
       ctx.shell.sandboxMode === undefined) {
-    throw new Error('Flywheel requires a confined DSH shell and explicit workspace policy');
+    throw new Error('Flywheel requires a sandbox-capable DSH shell and explicit permission policy');
   }
-  // This local no-op proves that the actual runner starts and reports full
-  // enforcement. Merely selecting a policy value is not readiness evidence.
+  // Probe the official runner. Restricted modes must prove full enforcement;
+  // full access must truthfully report that no confinement was applied.
   const probe = await ctx.shell.execute(ctx.shell.resolve({
     command: ':', workdir: cwd, timeoutMs: 5000,
     sandboxPolicy: { mode: permissionMode, workspaceRoot: cwd },
   }));
   const result = await probe.result();
   if (result.exitCode !== 0 || result.timedOut || result.aborted ||
-      result.sandbox?.mode !== permissionMode || result.sandbox?.enforcement !== 'full') {
-    throw new Error('Flywheel sandbox readiness probe did not prove full enforcement');
+      result.sandbox?.mode !== permissionMode ||
+      (fullAccess ? result.sandbox.denied !== false || result.sandbox.enforcement !== undefined : result.sandbox.enforcement !== 'full')) {
+    throw new Error(fullAccess ? 'Flywheel readiness probe did not confirm explicit full access' : 'Flywheel sandbox readiness probe did not prove full enforcement');
   }
   ctx.on('session/created', session => {
     // A fresh SDK session has no inherited permission facts. Pin both canonical
@@ -30,8 +32,8 @@ export async function apply(ctx, config) {
       cwd: policy.workspaceRoot,
       permissionMode: policy.mode,
       approvalPolicy: ctx.approval.effectivePolicy(session),
-      confinedShell: ctx.shell.sandboxMode !== undefined,
-      enforcement: result.sandbox.enforcement,
+      confinedShell: !fullAccess,
+      ...(fullAccess ? {} : { enforcement: result.sandbox.enforcement }),
     });
   });
 }

package/dist/protocol.js

@@ -49,8 +49,8 @@ export async function validateStart(value) {
   const provider = nonempty(value.provider, 'provider');
   const model = nonempty(value.model, 'model');
   const prompt = nonempty(value.prompt, 'prompt', MAX_FRAME_BYTES);
-  if (!['read-only', 'workspace-write'].includes(value.permissionMode)) {
-    throw new BridgeError('INVALID_REQUEST', 'permissionMode must be read-only or workspace-write');
+  if (!['read-only', 'workspace-write', 'danger-full-access'].includes(value.permissionMode)) {
+    throw new BridgeError('INVALID_REQUEST', 'permissionMode must be read-only, workspace-write or danger-full-access');
   }
   if (value.reasoningEffort !== undefined) nonempty(value.reasoningEffort, 'reasoningEffort', 64);
   if (value.maxTokens !== undefined && (!Number.isSafeInteger(value.maxTokens) || value.maxTokens < 1)) {
@@ -151,10 +151,12 @@ export class SessionFold {
 
   verifiedPolicy(request) {
     const policy = this.policy;
+    const fullAccess = request.permissionMode === 'danger-full-access';
     if (!policy || policy.protocol !== PROTOCOL || policy.permissionMode !== request.permissionMode ||
         policy.cwd !== request.cwd || policy.approvalPolicy !== 'never' ||
-        policy.confinedShell !== true || policy.enforcement !== 'full') {
-      throw new BridgeError('INVALID_REQUEST', 'DSH did not attest the requested cwd and confined permission policy; prompt withheld');
+        policy.confinedShell !== !fullAccess ||
+        (fullAccess ? policy.enforcement !== undefined : policy.enforcement !== 'full')) {
+      throw new BridgeError('INVALID_REQUEST', 'DSH did not attest the requested cwd and permission policy; prompt withheld');
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckanner/dsh-plugin-flywheel",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Flywheel engine controls with owned DSH SDK and Codex Pro machine workers",
   "type": "module",
   "license": "UNLICENSED",
@@ -25,7 +25,8 @@
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
-    "PROTOCOL.md"
+    "PROTOCOL.md",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "dsh": {
     "bundle": {
@@ -33,9 +34,10 @@
     },
     "client": {
       "inject": [
-        "@deepseek-ai/dsh-client-ui-chat",
+        "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-commands",
-        "@deepseek-ai/dsh-api-remotes"
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-locale"
       ],
       "platform": "web"
     }
@@ -66,7 +68,11 @@
     "dsh-subagent-codex-pro": "0.8.0"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.5",
     "jsdom": "26.1.0",
+    "lightningcss": "1.33.0",
     "react": "18.3.1",
     "react-dom": "18.3.1"
   },