@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/lib/{protocol-CJOvAvOS.js → protocol-CwDnFEyK.js}

@@ -1,8 +1,50 @@
+import { createRequire } from "node:module";
 import { closeSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, unlinkSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { z } from "zod";
 import { Socket } from "node:net";
+//#region src/compat/koffi.ts
+/**
+* Koffi must be the host's own copy, not this package's `dependencies` entry:
+* `dsh plugin add` installs a private koffi beside the one the host already
+* loaded, and two `koffi.node` images in one process SIGBUS on darwin-arm64
+* pointer authentication (packed-install smoke, 2026-11-01). `dsh-fs-local`
+* carries koffi on every supported release, so anchoring at it yields the
+* single binary the host itself loaded.
+*
+* Two ways to reach that same binary, in order:
+* 1. `require('koffi')` from the host anchor — the live CJS `module.exports`.
+*    The host occasionally exposes a partial `{}` exports object for koffi's
+*    CJS entry (mid-evaluation or an intercepted require in the addon loader),
+*    so the result is validated instead of trusted.
+* 2. The host koffi's own ESM entry (`index.js` beside the resolved CJS
+*    entry) — a separate module instance over the same `koffi.node`, immune
+*    to a broken CJS cache entry and never a second native image.
+* Only when no host tree resolves at all does the package-local copy load.
+*/
+const pick = (candidate) => {
+	let cur = candidate;
+	for (let i = 0; i < 3; i++) {
+		if (typeof cur?.load === "function") return cur;
+		cur = cur?.default;
+	}
+};
+async function loadHostKoffi() {
+	try {
+		const anchor = createRequire(import.meta.url).resolve("@deepseek-ai/dsh-fs-local/package.json");
+		const hostRequire = createRequire(anchor);
+		const cjs = pick(hostRequire("koffi"));
+		if (cjs !== void 0) return cjs;
+		const esm = pick(await import(pathToFileURL(join(dirname(hostRequire.resolve("koffi")), "index.js")).href));
+		if (esm !== void 0) return esm;
+	} catch {}
+	const own = pick(await import("koffi"));
+	if (own !== void 0) return own;
+	return (await import("koffi")).default;
+}
+//#endregion
 //#region src/authority/native.ts
 /** Kernel-authenticated local IPC. No credential file and no inherited capability. */
 function storeIdentity(root) {
@@ -34,7 +76,7 @@ function storeIdentity(root) {
 }
 let posixPromise;
 async function loadPosix() {
-	const koffi = (await import("koffi")).default;
+	const koffi = await loadHostKoffi();
 	const libc = koffi.load(process.platform === "darwin" ? "/usr/lib/libSystem.B.dylib" : "libc.so.6");
 	const bind = (name, ret, args) => libc.func(name, ret, args);
 	const socketpair = bind("socketpair", "int", [
@@ -170,7 +212,7 @@ function posix$1() {
 	return posixPromise ??= loadPosix();
 }
 async function connectNative(endpoint) {
-	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).connectWindows(endpoint);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).connectWindows(endpoint);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	if (api.connect(fd, address, address.length) !== 0) {
 		closeSync(fd);
@@ -180,7 +222,7 @@ async function connectNative(endpoint) {
 }
 /** Called only by the kernel lease holder. Never removes another epoch's socket. */
 async function listenNative(endpoint, accepted) {
-	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).listenWindows(endpoint, accepted);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).listenWindows(endpoint, accepted);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	try {
 		unlinkSync(endpoint);
@@ -222,14 +264,14 @@ async function listenNative(endpoint, accepted) {
 }
 /** Capability probe for native tests and diagnostics; not an authorization bypass. */
 async function nativeHostAvailability() {
-	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).windowsHostAvailability();
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).windowsHostAvailability();
 	if (process.platform === "linux") {
 		if (!/^NoNewPrivs:\s+0$/m.test(readFileSync("/proc/self/status", "utf8"))) return {
 			available: false,
 			reason: "the Host itself has NoNewPrivs; shared IPC refuses restricted peers"
 		};
 	} else if (process.platform === "darwin") {
-		if ((await import("koffi")).default.load("/usr/lib/libsandbox.dylib").func("int sandbox_check(int pid, const char *operation, int filter)")(process.pid, null, 0) !== 0) return {
+		if ((await loadHostKoffi()).load("/usr/lib/libsandbox.dylib").func("int sandbox_check(int pid, const char *operation, int filter)")(process.pid, null, 0) !== 0) return {
 			available: false,
 			reason: "the Host itself is sandboxed; shared IPC refuses sandboxed peers"
 		};
@@ -303,7 +345,11 @@ const rootSchema = z.object({
 		"invalid"
 	]),
 	detail: z.string().optional(),
-	invalidReason: z.literal("membership-conflict").optional()
+	invalidReason: z.enum([
+		"membership-conflict",
+		"protected-path",
+		"primary-overlap"
+	]).optional()
 }).strict();
 const snapshotSchema = z.object({
 	protocol: z.literal(1),
@@ -649,4 +695,4 @@ function parseArguments(method, args) {
 	return argumentSchemas[method].parse(args);
 }
 //#endregion
-export { snapshotSchema as a, parseArguments as i, AuthorityRpcError as n, nativeHostAvailability as o, AuthorityServer as r, storeIdentity as s, AuthorityClient as t };
+export { snapshotSchema as a, loadHostKoffi as c, parseArguments as i, AuthorityRpcError as n, nativeHostAvailability as o, AuthorityServer as r, storeIdentity as s, AuthorityClient as t };