@dsh-electron/dsh-plugin-multi-root-workspace 0.1.10 → 0.1.12

package/lib/native-win32-2waCRkPI.js

@@ -0,0 +1,312 @@
+import { EventEmitter } from "node:events";
+//#region src/authority/native-win32.ts
+/** Windows local pipes: tokens, never a caller-supplied PID or a bearer file. */
+var RestrictedRegistryPeerError = class extends Error {};
+let apiPromise;
+async function load() {
+	const koffi = (await import("koffi")).default;
+	const kernel = koffi.load("kernel32.dll"), advapi = koffi.load("advapi32.dll");
+	const k = (name, ret, args) => kernel.func("__stdcall", name, ret, args);
+	const a = (name, ret, args) => advapi.func("__stdcall", name, ret, args);
+	const close = k("CloseHandle", "int", ["intptr"]);
+	const createPipe = k("CreateNamedPipeW", "intptr", [
+		"str16",
+		"uint",
+		"uint",
+		"uint",
+		"uint",
+		"uint",
+		"uint",
+		"void *"
+	]);
+	const connect = k("ConnectNamedPipe", "int", ["intptr", "void *"]);
+	const open = k("CreateFileW", "intptr", [
+		"str16",
+		"uint",
+		"uint",
+		"void *",
+		"uint",
+		"uint",
+		"intptr"
+	]);
+	const state = k("SetNamedPipeHandleState", "int", [
+		"intptr",
+		"void *",
+		"void *",
+		"void *"
+	]);
+	const peek = k("PeekNamedPipe", "int", [
+		"intptr",
+		"void *",
+		"uint",
+		"void *",
+		"void *",
+		"void *"
+	]);
+	const read = k("ReadFile", "int", [
+		"intptr",
+		"void *",
+		"uint",
+		"void *",
+		"void *"
+	]);
+	const write = k("WriteFile", "int", [
+		"intptr",
+		"void *",
+		"uint",
+		"void *",
+		"void *"
+	]);
+	const error = k("GetLastError", "uint", []);
+	const serverPid = k("GetNamedPipeServerProcessId", "int", ["intptr", "void *"]);
+	const openProcess = k("OpenProcess", "intptr", [
+		"uint",
+		"int",
+		"uint"
+	]);
+	const openToken = a("OpenProcessToken", "int", [
+		"intptr",
+		"uint",
+		"void *"
+	]);
+	const openThreadToken = a("OpenThreadToken", "int", [
+		"intptr",
+		"uint",
+		"int",
+		"void *"
+	]);
+	const impersonate = a("ImpersonateNamedPipeClient", "int", ["intptr"]);
+	const revert = a("RevertToSelf", "int", []);
+	const restricted = a("IsTokenRestricted", "int", ["intptr"]);
+	const info = a("GetTokenInformation", "int", [
+		"intptr",
+		"int",
+		"void *",
+		"uint",
+		"void *"
+	]);
+	const sidString = a("ConvertSidToStringSidW", "int", ["void *", "void *"]);
+	const free = k("LocalFree", "intptr", ["intptr"]);
+	function tokenInfo(token, kind) {
+		const data = Buffer.alloc(65536), length = Buffer.alloc(4);
+		if (info(token, kind, data, data.length, length) === 0) throw new Error("cannot attest registry pipe token");
+		return data;
+	}
+	function sid(pointer) {
+		const output = Buffer.alloc(8);
+		if (sidString(pointer, output) === 0) throw new Error("cannot read registry peer SID");
+		const address = output.readBigUInt64LE();
+		try {
+			return String(koffi.decode(address, "char16_t", -1));
+		} finally {
+			free(Number(address));
+		}
+	}
+	function user(token) {
+		return sid(koffi.decode(tokenInfo(token, 1), "void *"));
+	}
+	const self = Buffer.alloc(8);
+	if (openToken(-1, 8, self) === 0) throw new Error("cannot identify registry Host user");
+	let ownUser;
+	try {
+		ownUser = user(Number(self.readBigUInt64LE()));
+	} finally {
+		close(Number(self.readBigUInt64LE()));
+	}
+	function attest(token) {
+		if (user(token) !== ownUser || restricted(token) !== 0 || tokenInfo(token, 29).readUInt32LE() !== 0) throw new RestrictedRegistryPeerError("registry pipe refuses restricted or foreign-user token");
+		const groups = tokenInfo(token, 2), count = groups.readUInt32LE();
+		if (count > 2048) throw new Error("registry token has too many groups");
+		for (let i = 0; i < count; i++) {
+			const group = sid(koffi.decode(groups.subarray(8 + i * 16), "void *"));
+			if (/^S-1-4-(?:\d+-){4}3$/.test(group)) throw new RestrictedRegistryPeerError("registry pipe refuses an ambient deny token");
+		}
+		const integrity = sid(koffi.decode(tokenInfo(token, 25), "void *"));
+		if (!/^S-1-16-\d+$/.test(integrity) || Number(integrity.split("-").at(-1)) < 8192) throw new RestrictedRegistryPeerError("registry pipe refuses low-integrity peer");
+	}
+	function clientToken(handle) {
+		if (impersonate(handle) === 0) throw new Error("cannot attest registry client");
+		const token = Buffer.alloc(8);
+		let opened = false, reverted = false;
+		try {
+			opened = openThreadToken(-2, 8, 1, token) !== 0;
+		} finally {
+			reverted = revert() !== 0;
+		}
+		if (!reverted) process.abort();
+		if (!opened) throw new Error("cannot read registry client token");
+		const value = Number(token.readBigUInt64LE());
+		try {
+			attest(value);
+		} finally {
+			close(value);
+		}
+	}
+	function attestServer(handle) {
+		const pid = Buffer.alloc(4);
+		if (serverPid(handle, pid) === 0) throw new Error("cannot identify registry server");
+		const process = openProcess(4096, 0, pid.readUInt32LE());
+		if (!process) throw new Error("registry server has exited");
+		const token = Buffer.alloc(8);
+		try {
+			if (openToken(process, 8, token) === 0) throw new Error("cannot attest registry server");
+			const value = Number(token.readBigUInt64LE());
+			try {
+				attest(value);
+			} finally {
+				close(value);
+			}
+		} finally {
+			close(process);
+		}
+	}
+	class Pipe extends EventEmitter {
+		handle;
+		closed = false;
+		attested;
+		timer;
+		constructor(handle, server) {
+			super();
+			this.handle = handle;
+			this.attested = !server;
+			this.on("error", () => {});
+			this.timer = setInterval(() => this.receive(), 20);
+			this.timer.unref();
+		}
+		receive() {
+			if (this.closed) return;
+			const available = Buffer.alloc(4);
+			if (peek(this.handle, null, 0, null, available, null) === 0) {
+				this.destroy();
+				return;
+			}
+			if (available.readUInt32LE() === 0) return;
+			const data = Buffer.alloc(Math.min(available.readUInt32LE(), 65536)), got = Buffer.alloc(4);
+			if (read(this.handle, data, data.length, got, null) === 0) {
+				this.destroy();
+				return;
+			}
+			try {
+				if (!this.attested) {
+					clientToken(this.handle);
+					this.attested = true;
+				}
+				this.emit("data", data.subarray(0, got.readUInt32LE()));
+			} catch {
+				this.destroy();
+			}
+		}
+		write(text) {
+			if (this.closed) return false;
+			const data = Buffer.from(text), wrote = Buffer.alloc(4);
+			if (data.length > 1048576 || write(this.handle, data, data.length, wrote, null) === 0 || wrote.readUInt32LE() !== data.length) {
+				this.destroy();
+				return false;
+			}
+			return true;
+		}
+		destroy() {
+			if (this.closed) return;
+			this.closed = true;
+			clearInterval(this.timer);
+			close(this.handle);
+			this.emit("close");
+		}
+	}
+	function create(endpoint, first) {
+		const value = createPipe(endpoint, 3 | (first ? 524288 : 0), 9, 255, 1048576, 1048576, 0, null);
+		if (value === -1 || value === 0) throw new Error("cannot create registry pipe");
+		return value;
+	}
+	const attestSelf = () => {
+		const token = Buffer.alloc(8);
+		if (openToken(-1, 8, token) === 0) throw new Error("cannot attest registry Host");
+		const value = Number(token.readBigUInt64LE());
+		try {
+			attest(value);
+		} finally {
+			close(value);
+		}
+	};
+	return {
+		close,
+		connect,
+		open,
+		state,
+		error,
+		attestServer,
+		attestSelf,
+		Pipe,
+		create
+	};
+}
+function api() {
+	return apiPromise ??= load();
+}
+async function connectWindows(endpoint) {
+	const native = await api();
+	const handle = native.open(endpoint, 3221225472, 0, null, 3, 0, 0);
+	if (handle === -1 || handle === 0) throw new Error("registry authority pipe is not ready");
+	try {
+		const mode = Buffer.alloc(4);
+		mode.writeUInt32LE(1);
+		if (native.state(handle, mode, null, null) === 0) throw new Error("cannot set nonblocking registry pipe");
+		native.attestServer(handle);
+		return new native.Pipe(handle, false);
+	} catch (error) {
+		native.close(handle);
+		throw error;
+	}
+}
+async function listenWindows(endpoint, accepted) {
+	const native = await api();
+	let handle = native.create(endpoint, true), closed = false;
+	const timer = setInterval(() => {
+		if (closed) return;
+		const result = native.connect(handle, null), error = result ? 0 : native.error();
+		if (!result && error !== 535) {
+			if (error === 232) {
+				native.close(handle);
+				try {
+					handle = native.create(endpoint, false);
+				} catch {
+					closed = true;
+					clearInterval(timer);
+				}
+			}
+			return;
+		}
+		const ready = handle;
+		try {
+			handle = native.create(endpoint, false);
+		} catch {
+			native.close(ready);
+			closed = true;
+			clearInterval(timer);
+			return;
+		}
+		accepted(new native.Pipe(ready, true));
+	}, 20);
+	timer.unref();
+	return { close() {
+		if (closed) return;
+		closed = true;
+		clearInterval(timer);
+		native.close(handle);
+	} };
+}
+async function windowsHostAvailability() {
+	const native = await api();
+	try {
+		native.attestSelf();
+		return { available: true };
+	} catch (error) {
+		if (error instanceof RestrictedRegistryPeerError) return {
+			available: false,
+			reason: error.message
+		};
+		throw error;
+	}
+}
+//#endregion
+export { connectWindows, listenWindows, windowsHostAvailability };

package/lib/process-fence.js

@@ -1,5 +1,22 @@
 import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
+import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { n as detectDialect, s as confineInstalled } from "./dialects-Dr4rDR-H.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/compat/process-profile.ts
+/** Structural runner recognition shared by the synchronous process seams. */
+function hasConfinedProfile(argv) {
+	return argv.includes("--ro-bind") || argv.includes("--ro") && argv.includes("--rw") || argv.includes("--workspace") && argv.includes("--mode") || argv.includes("-p") && argv.some((arg) => arg.includes("(version 1)"));
+}
+/** Agent PTYs are re-confined after their own fresh admission, never replayed. */
+function originalProcessArgv(argv) {
+	if (!hasConfinedProfile(argv)) return argv;
+	const separator = argv.indexOf("--");
+	if (separator < 1 || separator === argv.length - 1) throw new Error("unrecognized confined terminal argv");
+	detectDialect(argv.slice(0, separator));
+	return argv.slice(separator + 1);
+}
+//#endregion
 //#region src/compat/process-result.ts
 const object$1 = (value) => typeof value === "object" && value !== null;
 const thenable = (value) => typeof value?.then === "function";
@@ -118,6 +135,10 @@ function shellEntrypoints(shell) {
 function ptcEntrypoints(runtime) {
 	return typeof runtime.run === "function" ? ["run"] : [];
 }
+/** Async public entries can acquire admission before calling their implementation. */
+function isAsyncProcessEntry(entry) {
+	return typeof entry === "function" && entry.constructor.name === "AsyncFunction";
+}
 //#endregion
 //#region src/process-fence.ts
 /**
@@ -185,6 +206,10 @@ function isThenable(value) {
 }
 const object = (value) => typeof value === "object" && value !== null;
 function apply(ctx) {
+	aroundTool(ctx, async (exec, next) => {
+		if (!ctx.get("multiRootRegistry")?.shared || exec.agent === void 0) return next();
+		return withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session: exec.agent.session }), "process", next);
+	});
 	const policyOf = (spec) => spec?.sandboxPolicy ?? ctx.sandboxPolicy.resolve();
 	/**
 	* The confined facts for one Full-access call, or `undefined` when the call
@@ -217,11 +242,14 @@ function apply(ctx) {
 	ctx.inject(["subprocess"], (scope) => {
 		scope.effect(() => wrapMethod(scope.subprocess, "spawn", (original) => function(spec) {
 			const store = processDenyStore.getStore();
-			if (store === void 0) return original.call(this, spec);
-			const handle = original.call(this, {
+			if (scope.multiRootScope.admissionRequired && scope.multiRootScope.hasAdmission() && !scope.multiRootScope.admissionPathsValid()) throw new Error("multi-root workspace: an admitted root was redirected before process launch");
+			const argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
+			if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
+			const handle = original.call(this, store === void 0 ? spec : {
 				...spec,
-				argv: [...store.argvPrefix, ...spec.argv]
+				argv
 			});
+			if (store === void 0) return handle;
 			const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
 			if (stderr !== void 0) store.stderr = () => {
 				try {
@@ -242,12 +270,27 @@ function apply(ctx) {
 				throw new Error(`multi-root workspace: agent terminal spawn carries a session marker that does not resolve to a live session (${JSON.stringify(sessionId ?? ptySessionId)}), and explicit read-only roots are or may be registered — refusing to spawn an unconfined terminal`);
 			}
 			const policy = ctx.sandboxPolicy.resolve({ session });
-			const prepared = prepare(policy, spec.signal);
-			if (prepared === void 0) return await original.call(this, spec);
-			const argvPrefix = (await prepared).argv;
-			return await original.call(this, {
-				...spec,
-				argv: [...argvPrefix, ...spec.argv]
+			return withRegistryAdmission(ctx, policy, "pty", async () => {
+				if (ctx.get("multiRootRegistry")?.shared) {
+					const command = originalProcessArgv(spec.argv);
+					const prefix = prepare(policy, spec.signal);
+					const argv = policy.mode === "danger-full-access" ? prefix === void 0 ? command : [...(await prefix).argv, ...command] : (await confineInstalled(ctx.sandbox, command, {
+						...policy,
+						mode: policy.mode
+					}, spec.signal)).argv;
+					if (!ctx.multiRootScope.admissionPathsValid()) throw new Error("an admitted terminal root was redirected");
+					return await original.call(this, {
+						...spec,
+						argv
+					});
+				}
+				const prepared = prepare(policy, spec.signal);
+				if (prepared === void 0) return await original.call(this, spec);
+				const argvPrefix = (await prepared).argv;
+				return await original.call(this, {
+					...spec,
+					argv: [...argvPrefix, ...spec.argv]
+				});
 			});
 		}));
 	});
@@ -260,9 +303,16 @@ function apply(ctx) {
 	const deniedEntry = (scope, target, key) => {
 		scope.effect(() => wrapMethod(target, key, (original) => function(spec, ...rest) {
 			const policy = policyOf(spec);
-			const prepared = prepare(policy, spec?.signal);
-			if (prepared === void 0) return original.call(this, spec, ...rest);
-			return runDenied(prepared, policy, () => original.call(this, spec, ...rest));
+			const run = () => {
+				const prepared = prepare(policy, spec?.signal);
+				if (prepared === void 0) return original.call(this, spec, ...rest);
+				return runDenied(prepared, policy, () => original.call(this, spec, ...rest));
+			};
+			if (ctx.get("multiRootRegistry")?.shared) {
+				if (isAsyncProcessEntry(original)) return withRegistryAdmission(ctx, policy, "process", run);
+				if (!ctx.multiRootScope.hasAdmission()) return ctx.get("multiRootRegistry").withPrimaryOperation(policy, run);
+			}
+			return run();
 		}));
 	};
 	ctx.inject(["shell"], (scope) => {