@deepseek-harness-tui/dsh-tui 0.8.0 → 0.8.2

package/lib/types/dsh-adapter/grants.js

@@ -0,0 +1,213 @@
+/** Live, scoped plugin grant evaluation. */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { normalizePermissionScope, permissionScopeCovers } from '../plugin-spec/permission-scope.js';
+import { loadSpecData } from '../plugin-spec/registry.js';
+import { DATA_DIR } from '../utils/paths.js';
+export const EXTENSION_GRANTS_FILE = 'extension-grants.json';
+function parseRule(value) {
+    if (typeof value === 'string')
+        return { permission: value, legacy: true };
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (Object.keys(record).some(key => !['name', 'scope', 'activationId'].includes(key)))
+        return undefined;
+    if (typeof record.name !== 'string' || typeof record.scope !== 'string')
+        return undefined;
+    if (record.activationId !== undefined && typeof record.activationId !== 'string')
+        return undefined;
+    return {
+        permission: record.name,
+        scope: record.scope,
+        ...(record.activationId === undefined ? {} : { activationId: record.activationId }),
+        legacy: false,
+    };
+}
+function parseTable(text) {
+    const grants = new Map();
+    const denies = new Map();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { grants, denies, corrupt: true };
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { grants, denies, corrupt: true };
+    }
+    const root = parsed;
+    if (Object.keys(root).some(key => key !== 'grants' && key !== 'denies')) {
+        return { grants, denies, corrupt: true };
+    }
+    const readSection = (key, target) => {
+        const section = root[key];
+        if (section === undefined)
+            return true;
+        if (section === null || typeof section !== 'object' || Array.isArray(section))
+            return false;
+        for (const [componentId, values] of Object.entries(section)) {
+            if (componentId === '' || !Array.isArray(values))
+                return false;
+            const rules = values.map(parseRule);
+            if (rules.some(rule => rule === undefined))
+                return false;
+            target.set(componentId, rules);
+        }
+        return true;
+    };
+    if (!readSection('grants', grants) || !readSection('denies', denies)) {
+        return { grants: new Map(), denies: new Map(), corrupt: true };
+    }
+    return { grants, denies, corrupt: false };
+}
+function resolveRegistry(registry) {
+    return registry ?? loadSpecData()?.permissions;
+}
+function principalParts(principal) {
+    return typeof principal === 'string' ? { componentId: principal } : principal;
+}
+function ruleMatches(rule, principal, permission, scope, mode = 'grant') {
+    if (rule.permission !== permission)
+        return false;
+    if (rule.activationId !== undefined && rule.activationId !== principal.activationId)
+        return false;
+    const actual = normalizePermissionScope(permission, scope, principal.componentId);
+    if (actual === undefined)
+        return false;
+    // A legacy string row carries no resource/session/command scope. Treating a
+    // legacy GRANT as a wildcard would silently enlarge a grant during the v0.15
+    // migration, so it never authorizes. A legacy DENY is safe to apply
+    // conservatively to every enforceable scope: it can reduce availability but
+    // cannot widen access or make revocation ineffective.
+    if (rule.legacy)
+        return mode === 'deny';
+    const declared = normalizePermissionScope(permission, rule.scope ?? '', principal.componentId);
+    return declared !== undefined && permissionScopeCovers(permission, declared, actual);
+}
+/** An unbound/diagnostic principal cannot safely inherit a default or an
+ * unscoped rule when an activation-specific rule could apply. Returning deny
+ * here is conservative: callers must admit a real activation before using a
+ * grant whose lifetime is activation-scoped. */
+function hasUnknownActivationRule(rules, principal, permission, scope) {
+    if (principal.activationId !== undefined)
+        return false;
+    const actual = normalizePermissionScope(permission, scope, principal.componentId);
+    if (actual === undefined)
+        return false;
+    return rules.some(rule => {
+        if (rule.legacy || rule.permission !== permission || rule.activationId === undefined)
+            return false;
+        const declared = normalizePermissionScope(permission, rule.scope ?? '', principal.componentId);
+        return declared !== undefined && permissionScopeCovers(permission, declared, actual);
+    });
+}
+function storeFrom(table, registry, onChange) {
+    const known = new Map((registry?.permissions ?? []).map(entry => [entry.name, entry.default]));
+    // The store is a capability, not a mutable configuration object.  Keep the
+    // live table in the closure and freeze the facade so a traceable Cordis
+    // proxy (or an accidentally retained reference) cannot replace `allows`
+    // and turn an authorization check into an unconditional allow.
+    return Object.freeze({
+        get corrupt() {
+            return table().corrupt;
+        },
+        allows(principalValue, permission, scope) {
+            const current = table();
+            if (current.corrupt || known.get(permission) === undefined)
+                return false;
+            const principal = principalParts(principalValue);
+            if (normalizePermissionScope(permission, scope, principal.componentId) === undefined)
+                return false;
+            const denies = current.denies.get(principal.componentId) ?? [];
+            const grants = current.grants.get(principal.componentId) ?? [];
+            if (hasUnknownActivationRule(denies, principal, permission, scope)
+                || hasUnknownActivationRule(grants, principal, permission, scope))
+                return false;
+            if (denies.some(rule => ruleMatches(rule, principal, permission, scope, 'deny')))
+                return false;
+            if (grants.some(rule => ruleMatches(rule, principal, permission, scope, 'grant')))
+                return true;
+            return known.get(permission) === 'allow';
+        },
+        defaultOf: permission => known.get(permission) ?? 'deny',
+        knownPermissions: () => [...known.keys()],
+        onChange,
+    });
+}
+/** Parse a fixed snapshot, primarily for deterministic tests. */
+export function parseGrantStore(text, registry) {
+    const parsed = text === ''
+        ? { grants: new Map(), denies: new Map(), corrupt: false }
+        : parseTable(text);
+    return storeFrom(() => parsed, resolveRegistry(registry), () => () => undefined);
+}
+/**
+ * Read grants on every decision. File changes therefore affect the next
+ * operation without a restart. onChange uses a non-persistent watcher so
+ * grant-owned subscriptions can be released even when no event is flowing.
+ */
+export function readGrantStore(dir = DATA_DIR, registry) {
+    const file = join(dir, EXTENSION_GRANTS_FILE);
+    const readCurrent = () => {
+        let text;
+        let missing = false;
+        try {
+            text = readFileSync(file, 'utf8');
+        }
+        catch (error) {
+            missing = error.code === 'ENOENT';
+            text = missing ? '' : '{unreadable';
+        }
+        return {
+            // An existing zero-byte file is corruption, not the same state as an
+            // absent grants file. Only ENOENT receives the registry defaults.
+            table: missing
+                ? { grants: new Map(), denies: new Map(), corrupt: false }
+                : parseTable(text),
+            signature: text,
+        };
+    };
+    const listeners = new Set();
+    let watching = false;
+    let watchTimer;
+    let signature = readCurrent().signature;
+    const changed = () => {
+        const next = readCurrent().signature;
+        if (next === signature)
+            return;
+        signature = next;
+        for (const listener of [...listeners]) {
+            try {
+                listener();
+            }
+            catch {
+                // A lifecycle observer is advisory; one faulty cleanup callback must
+                // not prevent the remaining subscriptions from seeing revocation.
+            }
+        }
+    };
+    const onChange = (listener) => {
+        listeners.add(listener);
+        if (!watching) {
+            watching = true;
+            // A small unref'ed poll is deterministic across filesystems and
+            // timestamp granularities. The synchronous read on every operation
+            // remains the authorization source of truth; this loop only releases
+            // grant-owned subscriptions promptly after a revocation.
+            watchTimer = setInterval(changed, 50);
+            watchTimer.unref?.();
+        }
+        return () => {
+            listeners.delete(listener);
+            if (watching && listeners.size === 0) {
+                watching = false;
+                if (watchTimer !== undefined)
+                    clearInterval(watchTimer);
+                watchTimer = undefined;
+            }
+        };
+    };
+    return storeFrom(() => readCurrent().table, resolveRegistry(registry), onChange);
+}

package/lib/types/dsh-adapter/host-access.d.ts

@@ -0,0 +1,37 @@
+import { Context } from '@deepseek-ai/cordis';
+/** Host-only escape hatch for process teardown paths that intentionally act on
+ * the composition root while running from a host plugin callback. This module
+ * is internal and is not part of the public plugin package surface. */
+export declare function withHostRootCapability<T>(callback: () => T): T;
+export declare function concreteService<T extends object>(service: T): T;
+/** Bind a host-side disposer to the caller's authenticated Cordis activation.
+ * A failed registration immediately rolls back the owned contribution. */
+export declare function bindCallerEffect(ctx: Context, disposer: () => unknown, onRegistered?: (cleanup: () => unknown) => void): boolean;
+/** Return the stable, authenticated Fiber identity for an activation. */
+export declare function activationFiber(ctx: Context): object | undefined;
+/** Return Cordis's canonical activation context, never a writable context
+ * shadow. Explicit owner arguments use this before resolving host services. */
+export declare function activationContext(ctx: Context): Context | undefined;
+/** Resolve a service's composition root once.  Service methods are invoked
+ * through caller-bound Cordis proxies; keeping this root in host state avoids
+ * resolving sibling services through an attacker-provided caller shadow. */
+export declare function compositionRoot(ctx: Context): Context;
+/** Recover the composition root that owns a traceable service. Cordis stores
+ * the provider context on the concrete Service instance; callers may reach
+ * that instance through a proxy from another composition, so this must be
+ * resolved from the unwrapped service rather than from the call context. */
+export declare function serviceCompositionRoot(service: object): Context | undefined;
+/** Explicit context arguments on mediated APIs may be supplied by host code
+ * running from the composition root, or may be the activation making the
+ * service call.  A non-root plugin cannot nominate a different activation's
+ * context and thereby borrow its verified identity/lifecycle. */
+export declare function assertCallerContext(caller: Context, target: Context, capability: string, service?: object): void;
+/**
+ * Resolve the caller for a plugin-owned effect. A plugin can read
+ * `ctx.root`, but using its root-bound service proxy would attach cleanup to
+ * the host fiber and leave the effect alive after the plugin unloads. Host
+ * code must use the module-local host accessor for controls it owns; the
+ * public service surface only accepts a live non-root activation.
+ */
+export declare function requirePluginCaller(caller: Context, capability: string, service?: object): Context;
+//# sourceMappingURL=host-access.d.ts.map

package/lib/types/dsh-adapter/host-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-access.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/host-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAS,MAAM,qBAAqB,CAAA;AAoSpD;;uEAEuE;AACvE,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAE9D;AA8FD,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAe/D;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,OAAO,EACvB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,GAC9C,OAAO,CA2BT;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMhE;AAED;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAInE;AAED;;4EAE4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAwDrD;AAuDD;;;4EAG4E;AAC5E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAO3E;AAED;;;iEAGiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAehH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAmBlG"}