@dsh-electron/dsh-plugin-multi-root-workspace 0.1.5 → 0.1.7

package/lib/sandbox-D8Fw95FM.js

@@ -1,290 +0,0 @@
-import { SandboxUnavailableError } from "@deepseek-ai/dsh-sandbox";
-import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
-//#region src/compat/sandbox-confine.ts
-/** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
-function isThenable(value) {
-	return typeof value?.then === "function";
-}
-/**
-* Call the upstream `confine` and widen its result, preserving sync/async shape.
-*
-* @param base - the upstream `confine`, already bound to its provider.
-* @param widen - the pure transformation to apply to the upstream result. It
-*   runs exactly once per call, on whichever release; it may throw, and the
-*   throw surfaces synchronously or as a rejection to match the base shape.
-* @param argv - the caller's argv, forwarded verbatim.
-* @param policy - the per-call policy, forwarded verbatim.
-* @param signal - forwarded when the installed release accepts it.
-* @returns the widened result, in the shape the installed release uses.
-*/
-function widenConfined(base, widen, argv, policy, signal) {
-	const confined = base(argv, policy, signal);
-	return isThenable(confined) ? confined.then(widen) : widen(confined);
-}
-//#endregion
-//#region src/dialects.ts
-/**
-* Raised when a confined argv cannot be recognized or widened. The provider
-* converts this into the fail-closed `SandboxUnavailableError`: an unrecognized
-* dialect must never degrade into "the primary root was granted after all".
-*/
-var DialectUnrecognizedError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "DialectUnrecognizedError";
-	}
-};
-/** The one SBPL form that carries the writable subpath grants. */
-const SBPL_SUBPATH_FORM = /\(allow file-write\*\s*(?:\(subpath\s+"(?:[^"\\]|\\.)*"\)\s*)+\)/;
-/** One SBPL `(subpath "…")` token inside that form. */
-const SBPL_SUBPATH_TOKEN = /\(subpath\s+("(?:[^"\\]|\\.)*")\)/g;
-/**
-* Split a `confine()` result at the separator by arithmetic, then VERIFY the
-* split: `confine` builds `[...profileArgs, '--', ...argv]`, so the separator
-* sits exactly one element before the caller's argv. A mismatch means the
-* provider no longer wraps argv the way this module assumes.
-* @param confinedArgv - the argv `confine` returned.
-* @param commandArgv - the argv the caller passed to `confine`.
-* @returns the recognized dialect and the split parts.
-*/
-function splitConfined(confinedArgv, commandArgv) {
-	const separator = confinedArgv.length - commandArgv.length - 1;
-	if (separator < 1 || confinedArgv[separator] !== "--") throw new DialectUnrecognizedError(`confined argv is not "[...profile, --, ...argv]" (separator expected at ${separator}, got ${JSON.stringify(confinedArgv[separator])})`);
-	const commandArgs = confinedArgv.slice(separator + 1);
-	if (commandArgs.length !== commandArgv.length || commandArgs.some((argument, index) => argument !== commandArgv[index])) throw new DialectUnrecognizedError("confined argv does not end with the caller's argv verbatim");
-	const profileArgs = confinedArgv.slice(0, separator);
-	return {
-		dialect: detectDialect(profileArgs),
-		profileArgs,
-		separator,
-		commandArgs
-	};
-}
-/**
-* Recognize the runner dialect from the profile arguments alone. Exactly one
-* marker must match; zero or several are both unrecognized.
-* @param profileArgs - everything before the separator.
-* @returns the dialect.
-*/
-function detectDialect(profileArgs) {
-	const matches = [];
-	if (profileArgs.length >= 2 && profileArgs[profileArgs.length - 2] === "-p") matches.push("seatbelt");
-	if (profileArgs.includes("--mode")) matches.push("windows-acl");
-	if (profileArgs.includes("--rw")) matches.push("landlock");
-	if (profileArgs.includes("--ro-bind")) matches.push("bwrap");
-	const [first, ...rest] = matches;
-	if (first === void 0) throw new DialectUnrecognizedError(`unrecognized sandbox profile arguments: ${JSON.stringify(profileArgs)}`);
-	if (rest.length > 0) throw new DialectUnrecognizedError(`ambiguous sandbox profile arguments (${matches.join(", ")}): ${JSON.stringify(profileArgs)}`);
-	return first;
-}
-/**
-* Widen one dialect's profile arguments with the additional roots.
-*
-* Only `workspace-write` grants roots, mirroring the upstream mode meaning and
-* the filesystem fence: `read-only` grants nothing, and `danger-full-access`
-* never confines at all (bash and the PTY backend skip `confine` in that mode).
-*
-* A root the dialect ALREADY grants is not granted twice — that keeps this
-* function aligned with the fence's own deduplication and, on bwrap, avoids
-* binding the real `/tmp` over the ephemeral `--tmpfs /tmp` mount.
-* @param dialect - the recognized dialect.
-* @param profileArgs - the profile arguments to widen.
-* @param policy - the per-call policy (its root is the policy root, never a new grant).
-* @param additionalRoots - canonical additional roots, in scope order.
-* @returns the widened profile arguments.
-*/
-function widenProfileArgs(dialect, profileArgs, policy, additionalRoots) {
-	if (policy.mode !== "workspace-write") throw new DialectUnrecognizedError(`dialect "${dialect}" grants write roots only under workspace-write, got mode "${policy.mode}"`);
-	if (additionalRoots.length === 0) return [...profileArgs];
-	switch (dialect) {
-		case "seatbelt": return widenSeatbelt(profileArgs, additionalRoots);
-		case "bwrap": return widenBwrap(profileArgs, policy.workspaceRoot, additionalRoots);
-		case "landlock": return widenLandlock(profileArgs, policy.workspaceRoot, additionalRoots);
-		case "windows-acl": return [...profileArgs];
-	}
-}
-/** Quote one path exactly the way the upstream Seatbelt profile builder does. */
-function sbplString(path) {
-	return `"${path.replaceAll("\\", String.raw`\\`).replaceAll("\"", String.raw`\"`)}"`;
-}
-/** Unquote one SBPL string literal (including its surrounding quotes). */
-function sbplValue(literal) {
-	return literal.slice(1, -1).replaceAll(String.raw`\"`, "\"").replaceAll(String.raw`\\`, "\\");
-}
-/** Append the additional roots to the SBPL form that carries the subpath grants. */
-function widenSeatbelt(profileArgs, additionalRoots) {
-	const profile = profileArgs[profileArgs.length - 1];
-	if (profile === void 0 || profileArgs[profileArgs.length - 2] !== "-p") throw new DialectUnrecognizedError(`seatbelt profile is not "[<sandbox-exec>, …, -p, <SBPL>]": ${JSON.stringify(profileArgs)}`);
-	const form = SBPL_SUBPATH_FORM.exec(profile);
-	if (form === null) throw new DialectUnrecognizedError(`seatbelt profile has no "(allow file-write* (subpath …))" form to extend: ${JSON.stringify(profile)}`);
-	const matched = form[0];
-	const granted = new Set([...matched.matchAll(SBPL_SUBPATH_TOKEN)].map((token) => sbplValue(token[1])));
-	const added = additionalRoots.filter((root) => !granted.has(root)).map((root) => `(subpath ${sbplString(root)})`);
-	if (added.length === 0) return [...profileArgs];
-	const widened = profile.slice(0, form.index) + matched.slice(0, -1) + ` ${added.join(" ")})` + profile.slice(form.index + matched.length);
-	return [...profileArgs.slice(0, -1), widened];
-}
-/**
-* The observed bwrap bind flag: the flag of the `[flag, <root>, <root>]` triple
-* upstream built for the policy root.
-*/
-function bwrapBindFlag(profileArgs, workspaceRoot) {
-	for (let index = 2; index < profileArgs.length; index += 1) {
-		if (profileArgs[index] !== workspaceRoot || profileArgs[index - 1] !== workspaceRoot) continue;
-		const flag = profileArgs[index - 2];
-		if (flag === void 0 || !flag.startsWith("--") || flag.startsWith("--ro")) continue;
-		return flag;
-	}
-	throw new DialectUnrecognizedError(`bwrap profile has no writable bind of the policy root ${JSON.stringify(workspaceRoot)}: ${JSON.stringify(profileArgs)}`);
-}
-/** Append the additional roots as binds, after upstream's own root bind. */
-function widenBwrap(profileArgs, workspaceRoot, additionalRoots) {
-	const flag = bwrapBindFlag(profileArgs, workspaceRoot);
-	const granted = /* @__PURE__ */ new Set();
-	for (let index = 0; index + 2 < profileArgs.length; index += 1) if (profileArgs[index] === flag && profileArgs[index + 1] === profileArgs[index + 2]) granted.add(profileArgs[index + 2]);
-	for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === "--tmpfs") granted.add(profileArgs[index + 1]);
-	const added = additionalRoots.filter((root) => !granted.has(root)).flatMap((root) => [
-		flag,
-		root,
-		root
-	]);
-	return [...profileArgs, ...added];
-}
-/**
-* The observed Landlock read-write flag: the flag preceding the policy root in
-* the launcher's grant arguments.
-*/
-function landlockReadWriteFlag(profileArgs, workspaceRoot) {
-	for (let index = 1; index < profileArgs.length; index += 1) {
-		if (profileArgs[index] !== workspaceRoot) continue;
-		const flag = profileArgs[index - 1];
-		if (flag === void 0 || !flag.startsWith("--") || flag.startsWith("--ro")) continue;
-		return flag;
-	}
-	throw new DialectUnrecognizedError(`landlock profile has no read-write grant of the policy root ${JSON.stringify(workspaceRoot)}: ${JSON.stringify(profileArgs)}`);
-}
-/** Append the additional roots as read-write grants, after upstream's own root grant. */
-function widenLandlock(profileArgs, workspaceRoot, additionalRoots) {
-	const flag = landlockReadWriteFlag(profileArgs, workspaceRoot);
-	const granted = /* @__PURE__ */ new Set();
-	for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === flag) granted.add(profileArgs[index + 1]);
-	const added = additionalRoots.filter((root) => !granted.has(root)).flatMap((root) => [flag, root]);
-	return [...profileArgs, ...added];
-}
-//#endregion
-//#region src/sandbox.ts
-/**
-* `MultiRootSandboxProvider`: the kernel-sandbox dialect provider mounted as
-* `ctx.sandbox`.
-*
-* Every confined execution in this composition funnels through `confine()` —
-* the bash executor wraps `['bash','-c',command]`, and the terminal backend
-* wraps its PTY spawn argv — so widening the grant here is what gives bash, PTY,
-* and the fs fence one and the same root set (requirement §13). The bash
-* executor itself is therefore left upstream: it never computes roots.
-*
-* The widening itself lives in `./dialects.ts`: the upstream profile builders
-* are unreachable in the published package, so the additional roots are grafted
-* onto the profile `super.confine` actually produced (recognize the dialect
-* structurally, clone its grant spelling, fail loudly when the shape is not
-* known). This class owns only the policy that decides WHEN to graft:
-*
-* 1. with no additional roots, or under any mode other than `workspace-write`,
-*    the upstream result is returned ELEMENT FOR ELEMENT — same argv, same
-*    `enforcement`, same `denialSignatures`, same `runnerFailureRules`;
-* 2. `enforcement`, `denialSignatures`, and `runnerFailureRules` are NEVER
-*    recomputed here, even when the argv is widened — the bash executor derives
-*    its denial and enforcement reporting from them;
-* 3. only `argv` may differ, and a dialect whose shape cannot be extended fails
-*    loudly (`SandboxUnavailableError`) instead of silently confining to the
-*    primary root alone.
-*
-* @module @dsh-electron/dsh-plugin-multi-root-workspace/sandbox
-*/
-/**
-* Local process-sandbox provider over the multi-root scope. Registers as
-* `ctx.sandbox`; the runner chain, probing, denial dialects, and Windows ACL
-* grant mechanics stay the upstream implementation's.
-*/
-var MultiRootSandboxProvider = class extends LocalSandboxProvider {
-	static inject = [
-		"multiRootCompat",
-		"sandboxPolicy",
-		"multiRootScope"
-	];
-	/** Whether the Windows ACL limitation has already been reported (once per provider). */
-	warnedAboutWindowsAcl = false;
-	/**
-	* Wrap `argv` so it executes confined under `policy` on this host, granting
-	* the scope's additional roots inside the SAME dialect profile.
-	*
-	* Under `read-only` nothing is added (the mode denies every write, additional
-	* roots included), and `danger-full-access` never reaches here at all: the
-	* bash executor and the PTY backend both hand their argv straight to the local
-	* runtime in that mode. Widening therefore only ever ADDS the scope's
-	* additional roots to an upstream `workspace-write` profile.
-	*
-	* The return shape is the INSTALLED upstream provider's: synchronous on a
-	* release with a synchronous `confine`, a promise on a release with an
-	* asynchronous one. `widenConfined` preserves whichever it is — see
-	* `./compat/sandbox-confine.ts`.
-	* @param argv - the exact argv the caller is about to spawn.
-	* @param policy - the file-effect policy this execution runs under.
-	* @param signal - cancellation, forwarded to releases that accept it.
-	* @returns the argv to spawn instead, plus the selected backend's facts.
-	*/
-	confine(argv, policy, signal) {
-		const base = super.confine;
-		return widenConfined(base.bind(this), (confined) => this.widenForScope(confined, argv, policy), argv, policy, signal);
-	}
-	/**
-	* Graft the scope's additional roots onto one upstream `confine` result.
-	*
-	* Pure with respect to the upstream call: it only ever reads the scope and
-	* rewrites `argv`. `enforcement`, `denialSignatures` and `runnerFailureRules`
-	* are passed through untouched, because the bash executor derives its denial
-	* and enforcement reporting from them.
-	* @param confined - the upstream result for this call.
-	* @param argv - the caller's argv, needed to re-split the wrapped form.
-	* @param policy - the per-call policy.
-	* @returns the upstream result element for element, or one with a widened argv.
-	*/
-	widenForScope(confined, argv, policy) {
-		if (policy.mode !== "workspace-write") return confined;
-		const scope = this.ctx.multiRootScope.resolve(policy);
-		if (scope.additionalRoots.length === 0) return confined;
-		try {
-			const shape = splitConfined(confined.argv, argv);
-			if (shape.dialect === "windows-acl") {
-				this.warnAboutWindowsAcl(scope.additionalRoots.length);
-				return confined;
-			}
-			const profileArgs = widenProfileArgs(shape.dialect, shape.profileArgs, policy, scope.additionalRoots);
-			return {
-				...confined,
-				argv: [
-					...profileArgs,
-					"--",
-					...argv
-				]
-			};
-		} catch (error) {
-			if (!(error instanceof DialectUnrecognizedError)) throw error;
-			throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot grant the additional workspace roots [${scope.additionalRoots.join(", ")}] under the primary root ${scope.primaryRoot} — ${error.message}`);
-		}
-	}
-	/**
-	* Report the documented first-release limitation exactly once: the Windows ACL
-	* rung grants through per-workspace write SIDs rather than argv paths, so
-	* additional roots stay unenforced for confined commands there while the
-	* in-process filesystem fence still allows them.
-	* @param rootCount - how many additional roots the scope carries.
-	*/
-	warnAboutWindowsAcl(rootCount) {
-		if (this.warnedAboutWindowsAcl) return;
-		this.warnedAboutWindowsAcl = true;
-		this.ctx.logger.warn(`multi-root workspace: this scope carries ${rootCount} additional workspace root(s), but the Windows ACL runner grants write access per workspace SID and cannot express them; confined bash/PTY runs will not be able to write them, while ctx.fs still can. Kernel-level multi-root on Windows is out of scope for the first release.`);
-	}
-};
-//#endregion
-export { widenConfined as n, MultiRootSandboxProvider as t };

package/lib/{registry-lease-win32-dy8TQMD9.js → registry-lease-win32-DTO6QpT9.js}

@@ -1,6 +1,6 @@
-import { createHash } from "node:crypto";
-import { basename, dirname, join, resolve } from "node:path";
 import { realpathSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
 //#region src/registry-lease-win32.ts
 /**
 * Windows named-kernel-semaphore adapter for the registry authority lease.