@dsh-electron/dsh-plugin-multi-root-workspace 0.1.14 → 0.1.16

package/lib/process-fence.js

@@ -1,7 +1,9 @@
-import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
-import { s as withRegistryAdmission } from "./registry-operation-C2ZV3Jhw.js";
-import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
-import { n as detectDialect, s as confineInstalled } from "./dialects-Dr4rDR-H.js";
+import { t as wrapMethod } from "./method-wrapper-D4oUCsEF.js";
+import { c as withRegistryAdmission } from "./registry-operation-CIlmt6_c.js";
+import { t as aroundTool } from "./tool-context-CCeY3mrK.js";
+import { r as opsCompatibilityToken } from "./ops-settings-UN2oOKEp.js";
+import { n as detectDialect, s as confineInstalled } from "./dialects-CdlG3RF9.js";
+import { c as leaveOpsProtection, d as revokeOpsProtection, f as withOpsSpawnPermit, i as classifyOpsTool, n as assertOpsProtectionOwner, o as drainOpsProtection, r as claimOpsProtection, s as enterOpsProtection, t as assertOpsPosixCacheAdmission } from "./ops-tools-k4JYaOrM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/compat/process-profile.ts
 /** Structural runner recognition shared by the synchronous process seams. */
@@ -18,11 +20,11 @@ function originalProcessArgv(argv) {
 }
 //#endregion
 //#region src/compat/process-result.ts
-const object$1 = (value) => typeof value === "object" && value !== null;
+const object$2 = (value) => typeof value === "object" && value !== null;
 const thenable = (value) => typeof value?.then === "function";
-const textOf = (value) => typeof value === "string" ? value : object$1(value) && typeof value.text === "string" ? value.text : "";
-const stderrOf = (value) => textOf(value.stderr) + (object$1(value.error) ? textOf(value.error.message) : "") + (object$1(value.failure) ? textOf(value.failure.message) : "");
-const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$1(value.error) || object$1(value.failure) ? 1 : 0;
+const textOf = (value) => typeof value === "string" ? value : object$2(value) && typeof value.text === "string" ? value.text : "";
+const stderrOf = (value) => textOf(value.stderr) + (object$2(value.error) ? textOf(value.error.message) : "") + (object$2(value.failure) ? textOf(value.failure.message) : "");
+const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$2(value.error) || object$2(value.failure) ? 1 : 0;
 /** Denial and runner-failure verdicts for one settled process — the same
 * non-zero-exit + stderr-signature rules the sandbox executors apply: a fatal
 * runner line is an infrastructure failure, never a policy denial. */
@@ -40,7 +42,7 @@ const classifyOutcome = (exitCode, stderr, facts) => {
 const sandboxStamp = (value, facts, policy, stderr) => {
 	const { denied, runnerFailed } = classifyOutcome(exitCodeOf(value), stderr ?? stderrOf(value), facts);
 	return {
-		...object$1(value.sandbox) ? value.sandbox : {},
+		...object$2(value.sandbox) ? value.sandbox : {},
 		mode: policy.mode,
 		enforcement: facts.enforcement,
 		denied,
@@ -48,7 +50,7 @@ const sandboxStamp = (value, facts, policy, stderr) => {
 	};
 };
 function stampProcessResult(value, facts, policy) {
-	if (!object$1(value)) return value;
+	if (!object$2(value)) return value;
 	return {
 		...value,
 		sandbox: sandboxStamp(value, facts, policy)
@@ -63,8 +65,8 @@ function stampProcessResult(value, facts, policy) {
 */
 const liveHandle = (value) => thenable(value.done) || typeof value.done === "function" || Object.values(value).some((member) => typeof member === "function") || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null;
 function decorateProcessOutcome(value, facts, policy, diagnostics) {
-	if (object$1(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
-	if (object$1(value) && typeof value.result === "function") {
+	if (object$2(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
+	if (object$2(value) && typeof value.result === "function") {
 		let cached;
 		let settled = false;
 		wrapMethod(value, "result", (original) => function(...args) {
@@ -76,7 +78,7 @@ function decorateProcessOutcome(value, facts, policy, diagnostics) {
 		});
 		return value;
 	}
-	if (object$1(value) && liveHandle(value)) {
+	if (object$2(value) && liveHandle(value)) {
 		const settle = () => {
 			try {
 				value.sandbox = sandboxStamp(value, facts, policy, diagnostics?.stderr?.());
@@ -140,6 +142,58 @@ function isAsyncProcessEntry(entry) {
 	return typeof entry === "function" && entry.constructor.name === "AsyncFunction";
 }
 //#endregion
+//#region src/compat/forge-entrypoints.ts
+/**
+* The forge-bundle service entries an admission can wrap, in this order.
+* `worktrees.create`/`restore` take an `Agent` (the session rides on
+* `agent.session`); every listed `forgePanel` entry takes the `Session` as
+* its first argument. Entries not listed — background inspections, the
+* isolated `forge-worktree` instance inside the panel's mount group — stay
+* ledger-covered.
+*/
+const FORGE_PROCESS_SERVICES = [{
+	service: "worktrees",
+	keys: ["create", "restore"]
+}, {
+	service: "forgePanel",
+	keys: [
+		"branches",
+		"track",
+		"dismiss",
+		"refresh",
+		"localDiff",
+		"localText",
+		"changeRequestChecks",
+		"changeRequestDiff",
+		"changeRequestText",
+		"submitReview",
+		"markReady",
+		"merge",
+		"requestWorktree",
+		"cancelWorktree",
+		"stopCreation",
+		"retryWorktree",
+		"restoreWorktree",
+		"continueInProject"
+	]
+}];
+const object$1 = (value) => typeof value === "object" && value !== null;
+/**
+* Read the session a foreign-service entry resolves its policy from — the
+* first argument alone: a `Session`, or an `Agent`-shaped value carrying one.
+* The probe is deliberately structural and narrow (`id` + `header`): it is a
+* trust boundary over the upstream type, not a full validation — anything
+* else runs unadmitted rather than let `sandboxPolicy.resolve` read fields a
+* foreign argument lacks.
+* @param first - the wrapped call's first argument.
+* @returns the session, or `undefined` for a call that does not carry one.
+*/
+function sessionOf(first) {
+	const candidate = object$1(first) && object$1(first.session) ? first.session : first;
+	const isSession = (value) => object$1(value) && typeof value.id === "string" && object$1(value.header);
+	return isSession(candidate) ? candidate : void 0;
+}
+//#endregion
 //#region src/process-fence.ts
 /**
 * `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
@@ -206,9 +260,59 @@ function isThenable(value) {
 }
 const object = (value) => typeof value === "object" && value !== null;
 function apply(ctx) {
+	const opsScope = ctx.get("multiRootScope");
+	const opsSandbox = ctx.sandbox;
+	const runOpsDispatch = async (exec, policy, next) => {
+		const modeToken = opsCompatibilityToken(ctx);
+		const scope = opsScope;
+		const opsState = scope.opsProtection;
+		const token = enterOpsProtection(opsState);
+		try {
+			const dispatch = async () => {
+				const resolved = scope.resolve(policy);
+				if (resolved.authority === "unavailable") throw new Error("multi-root workspace: the registry authority is unavailable; refusing the OPS execution");
+				if (resolved.deniedRoots.length > 0) {
+					if (policy.mode !== "danger-full-access") throw new Error(`multi-root workspace: the OPS execution is refused in ${policy.mode}: private preparation and worker write boundaries cannot be proven without OPS integration`);
+					if (classifyOpsTool(exec.name) === "unknown") throw new Error(`multi-root workspace: the unrecognized OPS capability ${JSON.stringify(exec.name)} is refused while write boundaries apply`);
+					if (exec.name === "ops_bash" && typeof exec.arguments === "object" && exec.arguments !== null && exec.arguments.run_in_background === true) throw new Error("multi-root workspace: run_in_background is refused while danger-full-access write boundaries apply");
+				}
+				let facts;
+				if (resolved.deniedRoots.length > 0) {
+					if (process.platform === "win32") throw new Error("multi-root workspace: OPS worker preparation is not verified on this platform; refusing the call while write boundaries apply");
+					assertOpsPosixCacheAdmission(resolved.deniedRoots);
+					facts = await opsSandbox.restrictedExecution(policy, resolved.deniedRoots, exec.signal, resolved.protectedHome);
+					if (facts === void 0 || facts.argv.length === 0) throw new Error("multi-root workspace: the restricted runner could not be prepared; refusing the OPS execution");
+				}
+				assertOpsProtectionOwner(opsState, token);
+				if (opsCompatibilityToken(ctx) !== modeToken) throw new Error("multi-root workspace: the OPS compatibility mode changed during dispatch; refusing the execution");
+				const store = {
+					argvPrefix: facts?.argv ?? [],
+					ops: true,
+					opsState,
+					active: true
+				};
+				try {
+					return await processDenyStore.run(store, () => facts === void 0 ? next() : decorateProcessOutcome(next(), facts, policy, { stderr: () => store.stderr?.() }));
+				} finally {
+					store.active = false;
+				}
+			};
+			if (ctx.get("multiRootRegistry")?.shared) return await withRegistryAdmission(ctx, policy, "process", dispatch);
+			return await dispatch();
+		} finally {
+			leaveOpsProtection(opsState);
+		}
+	};
 	aroundTool(ctx, async (exec, next) => {
-		if (!ctx.get("multiRootRegistry")?.shared || exec.agent === void 0) return next();
-		return withRegistryAdmission(ctx, ctx.sandboxPolicy.resolve({ session: exec.agent.session }), "process", next);
+		const kind = classifyOpsTool(exec.name);
+		if (kind === "other" || kind === "publish" || opsCompatibilityToken(ctx) === void 0) {
+			if (!ctx.get("multiRootRegistry")?.shared || exec.agent === void 0) return next();
+			const policy = ctx.sandboxPolicy.resolve({ session: exec.agent.session });
+			return opsScope.withToolCap(exec.name, () => withRegistryAdmission(ctx, policy, "process", next));
+		}
+		if (exec.agent === void 0) throw new Error(`multi-root workspace: the OPS call ${JSON.stringify(exec.name)} cannot be confirmed against a trusted session`);
+		const policy = ctx.sandboxPolicy.resolve({ session: exec.agent.session });
+		return opsScope.withToolCap(exec.name, () => runOpsDispatch(exec, policy, next));
 	});
 	const policyOf = (spec) => spec?.sandboxPolicy ?? ctx.sandboxPolicy.resolve();
 	/**
@@ -240,27 +344,46 @@ function apply(ctx) {
 		return isThenable(prepared) ? prepared.then(run) : run(prepared);
 	};
 	ctx.inject(["subprocess"], (scope) => {
-		scope.effect(() => wrapMethod(scope.subprocess, "spawn", (original) => function(spec) {
-			const store = processDenyStore.getStore();
-			if (scope.multiRootScope.admissionRequired && scope.multiRootScope.hasAdmission() && !scope.multiRootScope.admissionPathsValid()) throw new Error("multi-root workspace: an admitted root was redirected before process launch");
-			const argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
-			if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
-			const handle = original.call(this, store === void 0 ? spec : {
-				...spec,
-				argv
-			});
-			if (store === void 0) return handle;
-			const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
-			if (stderr !== void 0) store.stderr = () => {
-				try {
-					return stderr.readFrom(0).text;
-				} catch {
-					return;
+		const opsState = opsScope.opsProtection;
+		scope.effect(() => {
+			const restore = wrapMethod(scope.get("subprocess"), "spawn", (original) => function(spec) {
+				const store = processDenyStore.getStore();
+				if (store?.ops === true && (store.active === false || store.opsState !== opsState)) throw new Error("multi-root workspace: the OPS execution domain has expired");
+				const admissionScope = store?.ops === true ? opsScope : scope.multiRootScope;
+				if (admissionScope.admissionRequired && admissionScope.hasAdmission() && !admissionScope.admissionPathsValid()) throw new Error("multi-root workspace: an admitted root was redirected before process launch");
+				let argv = spec.argv;
+				if (store?.ops === true) {
+					const prefix = store.argvPrefix;
+					if (hasConfinedProfile(spec.argv)) {
+						if (!(spec.argv.length > prefix.length && prefix.every((segment, index) => spec.argv[index] === segment))) throw new Error("multi-root workspace: a confined spawn inside an OPS execution domain must carry this domain's own profile");
+					} else argv = [...prefix, ...spec.argv];
+					if (opsScope.admissionRequired && (hasConfinedProfile(spec.argv) || prefix.length > 0) && !opsScope.permitsOperationProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
+				} else {
+					argv = store === void 0 ? spec.argv : [...store.argvPrefix, ...spec.argv];
+					if (scope.multiRootScope.admissionRequired && (store !== void 0 || hasConfinedProfile(argv)) && !scope.multiRootScope.permitsProfile(argv)) throw new Error("multi-root workspace: a confined spawn requires a profile from this live admission");
 				}
+				const launch = () => original.call(this, argv === spec.argv ? spec : {
+					...spec,
+					argv
+				});
+				const handle = store !== void 0 || admissionScope.admissionRequired && admissionScope.permitsOperationProfile(argv) ? withOpsSpawnPermit(opsState, launch) : launch();
+				if (store === void 0) return handle;
+				const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
+				if (stderr !== void 0) store.stderr = () => {
+					try {
+						return stderr.readFrom(0).text;
+					} catch {
+						return;
+					}
+				};
+				return handle;
+			});
+			return async () => {
+				await drainOpsProtection(opsState);
+				restore();
 			};
-			return handle;
-		}));
-		scope.effect(() => wrapMethod(scope.subprocess, "spawnTerminal", (original) => async function(spec) {
+		});
+		scope.effect(() => wrapMethod(scope.get("subprocess"), "spawnTerminal", (original) => async function(spec) {
 			const ptySessionId = spec.env?.DSH_PTY_SESSION_ID;
 			if (ptySessionId === void 0 || ptySessionId === "") return await original.call(this, spec);
 			const sessionId = spec.env?.DSH_SESSION_ID;
@@ -293,6 +416,11 @@ function apply(ctx) {
 				});
 			});
 		}));
+		const token = claimOpsProtection(opsState);
+		scope.effect(() => async () => {
+			revokeOpsProtection(opsState, token);
+			await drainOpsProtection(opsState);
+		});
 	});
 	/**
 	* The wrapper every execute-style consumer entry shares: resolve the policy
@@ -325,6 +453,37 @@ function apply(ctx) {
 		if (runtime === void 0) return;
 		for (const key of ptcEntrypoints(runtime)) deniedEntry(scope, runtime, key);
 	});
+	const admitCalls = (service, keys) => {
+		ctx.inject([service], (scope) => {
+			const target = scope.get(service);
+			if (target === void 0) return;
+			for (const key of keys) try {
+				if (!isAsyncProcessEntry(target[key])) {
+					if (key in target) ctx.logger.warn(`multi-root workspace: foreign process entry ${service}.${key} exists but is not wrappable and stays outside the admission; any confined spawn it performs relies on the ledger`);
+					continue;
+				}
+				scope.effect(() => wrapMethod(target, key, (original) => async function(first, ...rest) {
+					const session = sessionOf(first);
+					if (session === void 0) return original.call(this, first, ...rest);
+					const policy = ctx.sandboxPolicy.resolve({ session });
+					let ran = false;
+					try {
+						return await withRegistryAdmission(ctx, policy, "process", () => {
+							ran = true;
+							return original.call(this, first, ...rest);
+						});
+					} catch (error) {
+						if (ran) throw error;
+						ctx.logger.warn(`multi-root workspace: admission for ${service}.${key} is unavailable; running unadmitted: ${error instanceof Error ? error.message : String(error)}`);
+						return original.call(this, first, ...rest);
+					}
+				}));
+			} catch (error) {
+				ctx.logger.warn(`multi-root workspace: foreign process entry ${service}.${key} is not wrappable: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+	};
+	for (const { service, keys } of FORGE_PROCESS_SERVICES) admitCalls(service, keys);
 }
 //#endregion
 export { apply, inject };

package/lib/{protocol-CnR1KTXy.js → protocol-CwDnFEyK.js}

@@ -212,7 +212,7 @@ function posix$1() {
 	return posixPromise ??= loadPosix();
 }
 async function connectNative(endpoint) {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).connectWindows(endpoint);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).connectWindows(endpoint);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	if (api.connect(fd, address, address.length) !== 0) {
 		closeSync(fd);
@@ -222,7 +222,7 @@ async function connectNative(endpoint) {
 }
 /** Called only by the kernel lease holder. Never removes another epoch's socket. */
 async function listenNative(endpoint, accepted) {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).listenWindows(endpoint, accepted);
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).listenWindows(endpoint, accepted);
 	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
 	try {
 		unlinkSync(endpoint);
@@ -264,7 +264,7 @@ async function listenNative(endpoint, accepted) {
 }
 /** Capability probe for native tests and diagnostics; not an authorization bypass. */
 async function nativeHostAvailability() {
-	if (process.platform === "win32") return (await import("./native-win32-CRNXr11U.js")).windowsHostAvailability();
+	if (process.platform === "win32") return (await import("./native-win32-C5oMtt7f.js")).windowsHostAvailability();
 	if (process.platform === "linux") {
 		if (!/^NoNewPrivs:\s+0$/m.test(readFileSync("/proc/self/status", "utf8"))) return {
 			available: false,
@@ -345,7 +345,11 @@ const rootSchema = z.object({
 		"invalid"
 	]),
 	detail: z.string().optional(),
-	invalidReason: z.literal("membership-conflict").optional()
+	invalidReason: z.enum([
+		"membership-conflict",
+		"protected-path",
+		"primary-overlap"
+	]).optional()
 }).strict();
 const snapshotSchema = z.object({
 	protocol: z.literal(1),