@deepseek-ai/dsh-sandbox-windows-acl 0.1.6-alpha.1 → 0.1.6-alpha.2

package/lib/index.js

@@ -1,2 +1,2 @@
-import { a as assertTempRootOutsideWorkspace, i as AclWriteGrant, n as tempWriteSid, r as workspaceWriteSid, t as AclSandbox } from "./types-BYdUtsBr.js";
+import { a as assertTempRootOutsideWorkspace, i as AclWriteGrant, n as tempWriteSid, r as workspaceWriteSid, t as AclSandbox } from "./types-CutH1Lgc.js";
 export { AclSandbox, AclWriteGrant, assertTempRootOutsideWorkspace, tempWriteSid, workspaceWriteSid };

package/lib/runner.js

@@ -1,4 +1,4 @@
-import { a as assertTempRootOutsideWorkspace, n as tempWriteSid, o as win32, r as workspaceWriteSid, t as AclSandbox } from "./types-BYdUtsBr.js";
+import { a as assertTempRootOutsideWorkspace, n as tempWriteSid, o as win32, r as workspaceWriteSid, t as AclSandbox } from "./types-CutH1Lgc.js";
 import { closeSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { SUBPROCESS_CONTROL_ENV, SUBPROCESS_CONTROL_FD } from "@deepseek-ai/dsh-subprocess/control";

package/lib/{types-BYdUtsBr.js → types-CutH1Lgc.js}

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, realpathSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ERROR_INSUFFICIENT_BUFFER, Win32Error, allocPtrSlot, allocUint32, decodePtr, decodeUint32, drainPipe, extendWin32ProcessBindings, isNullPtr, isNullPtr as isNullPtr$1, spawnInheritedJobProcess, spawnPipedProcess, throwLastError, throwLastError as throwLastError$1, throwWin32, waitForProcessExit } from "@deepseek-ai/dsh-win32-process";
 import { createHash } from "node:crypto";
-import koffi from "koffi";
+import { createLazyRequire } from "@deepseek-ai/dsh-lazy-require";
 //#region lib/types/win32-abi.js
 /** ACL/token-specific Win32 constants. */
 /** OpenProcess access required to query the current process token. */
@@ -20,8 +20,17 @@ const FILE_ALL_ACCESS = 2032127;
 //#endregion
 //#region lib/types/ffi.js
 /** ACL/token bindings layered on the shared Win32 process owner. */
-const PVOID = koffi.pointer("void");
-const PPVOID = koffi.pointer(PVOID);
+const requireKoffi = createLazyRequire("koffi", import.meta.url);
+let cachedTypes;
+function ffiTypes() {
+	if (cachedTypes !== void 0) return cachedTypes;
+	const koffi = requireKoffi();
+	const PVOID = koffi.pointer("void");
+	return cachedTypes = {
+		PVOID,
+		PPVOID: koffi.pointer(PVOID)
+	};
+}
 /**
 * Return whether CreateFileW produced INVALID_HANDLE_VALUE.
 * @param handle - handle returned by CreateFileW.
@@ -37,7 +46,7 @@ function isInvalidHandle(handle) {
 * @param value - unsigned value to store.
 */
 function encodeUint32(slot, value) {
-	koffi.encode(slot, "uint32", value);
+	requireKoffi().encode(slot, "uint32", value);
 }
 /**
 * Return a Koffi pointer's numeric address for struct packing.
@@ -45,7 +54,7 @@ function encodeUint32(slot, value) {
 * @returns pointer address.
 */
 function ptrAddress(ptr) {
-	return koffi.address(ptr);
+	return requireKoffi().address(ptr);
 }
 /**
 * Allocate a raw byte block.
@@ -53,7 +62,7 @@ function ptrAddress(ptr) {
 * @returns allocated pointer.
 */
 function allocBytes(length) {
-	return koffi.alloc("uint8", length);
+	return requireKoffi().alloc("uint8", length);
 }
 /**
 * Allocate one zeroed x64 OVERLAPPED record.
@@ -71,7 +80,7 @@ function allocOverlapped() {
 * @returns decoded pointer, or null for address zero.
 */
 function decodePtrAt(buffer, offset) {
-	const value = koffi.decode(buffer, offset, PVOID);
+	const value = requireKoffi().decode(buffer, offset, ffiTypes().PVOID);
 	return isNullPtr(value) ? null : value;
 }
 /**
@@ -81,7 +90,7 @@ function decodePtrAt(buffer, offset) {
 * @returns decoded value.
 */
 function decodeUint8At(ptr, offset) {
-	return koffi.decode(ptr, offset, "uint8");
+	return requireKoffi().decode(ptr, offset, "uint8");
 }
 /**
 * Decode a uint16 field at a native pointer offset.
@@ -90,7 +99,7 @@ function decodeUint8At(ptr, offset) {
 * @returns decoded value.
 */
 function decodeUint16At(ptr, offset) {
-	return koffi.decode(ptr, offset, "uint16");
+	return requireKoffi().decode(ptr, offset, "uint16");
 }
 /**
 * Decode a uint32 field at a native pointer offset.
@@ -99,7 +108,7 @@ function decodeUint16At(ptr, offset) {
 * @returns decoded value.
 */
 function decodeUint32At(ptr, offset) {
-	return koffi.decode(ptr, offset, "uint32");
+	return requireKoffi().decode(ptr, offset, "uint32");
 }
 /**
 * Compare two in-memory SID records without allocating strings.
@@ -120,6 +129,8 @@ function sameSidAt(left, leftOffset, right, rightOffset) {
 let cached;
 function bindings() {
 	if (cached !== void 0) return cached;
+	const koffi = requireKoffi();
+	const { PVOID, PPVOID } = ffiTypes();
 	cached = extendWin32ProcessBindings(({ kernel32, advapi32, bind }) => ({
 		openProcess: bind(kernel32, "OpenProcess", PVOID, [
 			"uint32",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-sandbox-windows-acl",
   "description": "Windows ACL write-restriction sandbox backend (restricted-token spawn with capability-SID write allowlist) for the DeepSeek Harness sandbox seam",
-  "version": "0.1.6-alpha.1",
+  "version": "0.1.6-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -34,17 +34,18 @@
   "license": "MIT",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.1"
+    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.2"
   },
   "dependencies": {
     "koffi": "^3.1.0",
-    "@deepseek-ai/dsh-win32-process": "^0.1.6-alpha.1"
+    "@deepseek-ai/dsh-lazy-require": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-win32-process": "^0.1.6-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-pwsh-local": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-pwsh-local": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-sandbox-local": "^0.1.6-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.6-alpha.1"
+    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.6-alpha.2"
   }
 }