@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/lib/sandbox-Kup4_ZIb.js

@@ -0,0 +1,747 @@
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-CEfmZzu0.js";
+import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
+import { brandMultiRootProvider } from "./providers.js";
+import { posix } from "node:path";
+import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
+import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
+import { fileURLToPath } from "node:url";
+//#region src/compat/sandbox-confine.ts
+/** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
+function isThenable(value) {
+	return typeof value?.then === "function";
+}
+/** Map an installed confine result without changing its synchronous shape. */
+function mapConfined(value, map) {
+	return isThenable(value) ? value.then(map) : map(value);
+}
+/**
+* Call the upstream `confine` and widen its result, preserving sync/async shape.
+*
+* @param base - the upstream `confine`, already bound to its provider.
+* @param widen - the pure transformation to apply to the upstream result. It
+*   runs exactly once per call, on whichever release; it may throw, and the
+*   throw surfaces synchronously or as a rejection to match the base shape.
+* @param argv - the caller's argv, forwarded verbatim.
+* @param policy - the per-call policy, forwarded verbatim.
+* @param signal - forwarded when the installed release accepts it.
+* @returns the widened result, in the shape the installed release uses.
+*/
+function widenConfined(base, widen, argv, policy, signal) {
+	const confined = base(argv, policy, signal);
+	return isThenable(confined) ? confined.then(widen) : widen(confined);
+}
+//#endregion
+//#region src/dialects.ts
+/**
+* Dialect adaptation: widening a confined argv with additional workspace roots.
+*
+* The upstream kernel-sandbox provider expresses `workspace-write` as a
+* per-dialect profile built from the SINGLE policy root (plus the platform temp
+* areas). Widening that profile is the one thing this plugin must do outside the
+* filesystem fence, and it is deliberately done by OBSERVATION: the upstream
+* dialect profile builders are unreachable in the published package (only
+* `lib/index.js` and `lib/types/**` ship — see ADR-0002), and
+* `@deepseek-ai/dsh-sandbox-local`'s `runnerArgv` / `landlockLauncher` /
+* `seatbeltExec` members are TS-private, so `confine()` and the `internals` test
+* hook are the ONLY public surface.
+*
+* Every dialect is therefore handled by
+* 1. splitting the wrapped argv at the separator `confine` itself inserted,
+* 2. recognizing the dialect from STRUCTURAL markers in the profile arguments,
+* 3. cloning the grant spelling — and the insertion point — from the arguments
+*    the upstream provider actually produced, and
+* 4. failing loudly (never silently confining to the primary root alone) when
+*    the shape is not one this module knows.
+*
+* The per-dialect profile shapes this recognizes (verified against dsh
+* `0.1.5-rc.2`, recorded in `docs/reference/multi-root-workspace-research.md`
+* §10) are:
+*
+* ```text
+* seatbelt     [sandbox-exec, -p, "<SBPL>" ]                 SBPL allow-forms
+* bwrap        [bwrap, --ro-bind / /, …, --bind <root> <root>]
+* landlock     [<launcher>, --ro /, --rw /dev/null, --rw <root>]
+* windows-acl  [node, <runner>, --workspace …, --mode <mode>]
+* runnerCommand is spelled exactly like bwrap (the upstream config contract
+* appends bwrap-compatible profile arguments to the operator's runner).
+* ```
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/dialects
+*/
+/** Profiles carry their target platform's spellings even in cross-OS tests. */
+function profileContains(candidate, root) {
+	if (!root.startsWith("/")) return isCanonicallyUnder(candidate, root);
+	return candidate === root || candidate.startsWith(root.endsWith("/") ? root : root + "/");
+}
+/** Both containment directions overlap: a deny ancestor covers a grant too. */
+function profileOverlaps(left, right) {
+	return profileContains(left, right) || profileContains(right, left);
+}
+/**
+* Every proper ancestor directory of each denied root, deduplicated and sorted
+* shallow → deep, minus the filesystem root and the roots themselves.
+*
+* A `(subpath R)` deny or a `--ro-bind R` pins a DIRECTORY, not a path: the
+* kernel denies writes beneath it but says nothing about the ancestors, so
+* `rename`ing an ancestor moves the whole tree out from under its deny while
+* every profile (and the fs fence's recorded `recordedPath`) still names the
+* old spelling. Denying/binding each ancestor itself is what keeps the
+* boundary attached to the directory the operator chose.
+*
+* Profiles carry target-platform spellings and Seatbelt/bwrap are always
+* POSIX, so the walk is posix `dirname`; a non-POSIX spelling contributes no
+* ancestors (`dirname('C:\\x')` is `.`).
+* @param roots - canonical denied roots.
+* @returns the ancestor directories, shallowest first.
+*/
+function denyAncestors(roots) {
+	const denied = new Set(roots);
+	const ancestors = /* @__PURE__ */ new Set();
+	for (const root of roots) {
+		let ancestor = posix.dirname(root.replace(/\/+$/, "") || "/");
+		while (posix.dirname(ancestor) !== ancestor && !ancestors.has(ancestor)) {
+			ancestors.add(ancestor);
+			ancestor = posix.dirname(ancestor);
+		}
+	}
+	return [...ancestors].filter((ancestor) => !denied.has(ancestor)).sort((left, right) => left.split("/").length - right.split("/").length || (left < right ? -1 : 1));
+}
+/** The one SBPL form that carries the writable subpath grants. */
+const SBPL_SUBPATH_FORM = /\(allow file-write\*\s*(?:\(subpath\s+"(?:[^"\\]|\\.)*"\)\s*)+\)/;
+/** One SBPL `(subpath "…")` token inside that form. */
+const SBPL_SUBPATH_TOKEN = /\(subpath\s+("(?:[^"\\]|\\.)*")\)/g;
+/**
+* Split a `confine()` result at the separator by arithmetic, then VERIFY the
+* split: `confine` builds `[...profileArgs, '--', ...argv]`, so the separator
+* sits exactly one element before the caller's argv. A mismatch means the
+* provider no longer wraps argv the way this module assumes.
+* @param confinedArgv - the argv `confine` returned.
+* @param commandArgv - the argv the caller passed to `confine`.
+* @returns the recognized dialect and the split parts.
+*/
+function splitConfined(confinedArgv, commandArgv) {
+	const separator = confinedArgv.length - commandArgv.length - 1;
+	if (separator < 1 || confinedArgv[separator] !== "--") throw new DialectUnrecognizedError(`confined argv is not "[...profile, --, ...argv]" (separator expected at ${separator}, got ${JSON.stringify(confinedArgv[separator])})`);
+	const commandArgs = confinedArgv.slice(separator + 1);
+	if (commandArgs.length !== commandArgv.length || commandArgs.some((argument, index) => argument !== commandArgv[index])) throw new DialectUnrecognizedError("confined argv does not end with the caller's argv verbatim");
+	const profileArgs = confinedArgv.slice(0, separator);
+	return {
+		dialect: detectDialect(profileArgs),
+		profileArgs,
+		separator,
+		commandArgs
+	};
+}
+/**
+* Recognize the runner dialect from the profile arguments alone. Exactly one
+* marker must match; zero or several are both unrecognized.
+* @param profileArgs - everything before the separator.
+* @returns the dialect.
+*/
+function detectDialect(profileArgs) {
+	const matches = [];
+	if (profileArgs.length >= 2 && profileArgs[profileArgs.length - 2] === "-p") matches.push("seatbelt");
+	if (profileArgs.includes("--mode")) matches.push("windows-acl");
+	if (profileArgs.includes("--rw")) matches.push("landlock");
+	if (profileArgs.includes("--ro-bind")) matches.push("bwrap");
+	const [first, ...rest] = matches;
+	if (first === void 0) throw new DialectUnrecognizedError(`unrecognized sandbox profile arguments: ${JSON.stringify(profileArgs)}`);
+	if (rest.length > 0) throw new DialectUnrecognizedError(`ambiguous sandbox profile arguments (${matches.join(", ")}): ${JSON.stringify(profileArgs)}`);
+	return first;
+}
+/**
+* Widen one dialect's profile arguments with the additional roots.
+*
+* Only `workspace-write` grants roots, mirroring the upstream mode meaning and
+* the filesystem fence: `read-only` grants nothing, and `danger-full-access`
+* never confines at all (bash and the PTY backend skip `confine` in that mode).
+*
+* A root the dialect ALREADY grants is not granted twice — that keeps this
+* function aligned with the fence's own deduplication and, on bwrap, avoids
+* binding the real `/tmp` over the ephemeral `--tmpfs /tmp` mount.
+* @param dialect - the recognized dialect.
+* @param profileArgs - the profile arguments to widen.
+* @param policy - the per-call policy (its root is the policy root, never a new grant).
+* @param additionalRoots - canonical additional roots, in scope order.
+* @returns the widened profile arguments.
+*/
+function widenProfileArgs(dialect, profileArgs, policy, additionalRoots) {
+	if (policy.mode !== "workspace-write") throw new DialectUnrecognizedError(`dialect "${dialect}" grants write roots only under workspace-write, got mode "${policy.mode}"`);
+	if (additionalRoots.length === 0) return [...profileArgs];
+	switch (dialect) {
+		case "seatbelt": return widenSeatbelt(profileArgs, additionalRoots);
+		case "bwrap": return widenBwrap(profileArgs, policy.workspaceRoot, additionalRoots);
+		case "landlock": return widenLandlock(profileArgs, policy.workspaceRoot, additionalRoots);
+		case "windows-acl": throw new DialectUnrecognizedError("Windows ACL widening requires widenWindowsProfile");
+	}
+}
+/**
+* Graft writable grants onto a `read-only` profile — the B9 cell where a fixed
+* `read-write` additional root stays writable while the session mode denies
+* every other write. Each dialect appends its own grant spelling AFTER
+* upstream's deny-all baseline, so the appended form wins:
+*
+* - seatbelt: SBPL is last-match-wins — a trailing `(allow file-write*
+*   (subpath …))` overrides the blanket `(deny file-write*)` for those roots;
+* - bwrap: mounts apply in order — a `--bind W W` after `--ro-bind / /`
+*   re-mounts that subtree writable inside the read-only namespace;
+* - landlock: grants union — an extra `--rw W` widens exactly that subtree.
+*
+* `windows-acl` cannot be spelled this way and goes through
+* `widenWindowsProfile` (the standalone runner grants only the listed roots).
+* @param dialect - the recognized dialect.
+* @param profileArgs - the upstream read-only profile arguments.
+* @param additionalRoots - canonical roots the effective scope keeps writable.
+* @returns the grafted profile arguments.
+*/
+function graftProfileArgs(dialect, profileArgs, additionalRoots) {
+	if (additionalRoots.length === 0) return [...profileArgs];
+	switch (dialect) {
+		case "seatbelt": return graftSeatbelt(profileArgs, additionalRoots);
+		case "bwrap": return [...profileArgs, ...additionalRoots.flatMap((root) => [
+			"--bind",
+			root,
+			root
+		])];
+		case "landlock": {
+			const granted = /* @__PURE__ */ new Set();
+			for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === "--rw") granted.add(profileArgs[index + 1]);
+			const added = additionalRoots.filter((root) => !granted.has(root)).flatMap((root) => ["--rw", root]);
+			return [...profileArgs, ...added];
+		}
+		case "windows-acl": throw new DialectUnrecognizedError("Windows ACL read-only grafting requires widenWindowsProfile");
+	}
+}
+/** Append a trailing allow form to the SBPL — last-match-wins overrides the blanket deny. */
+function graftSeatbelt(profileArgs, additionalRoots) {
+	const profile = profileArgs[profileArgs.length - 1];
+	if (profile === void 0 || profileArgs[profileArgs.length - 2] !== "-p") throw new DialectUnrecognizedError(`seatbelt profile is not "[<sandbox-exec>, …, -p, <SBPL>]": ${JSON.stringify(profileArgs)}`);
+	const granted = new Set([...profile.matchAll(SBPL_SUBPATH_TOKEN)].map((token) => sbplValue(token[1])));
+	const added = additionalRoots.filter((root) => !granted.has(root));
+	if (added.length === 0) return [...profileArgs];
+	const widened = profile + ` (allow file-write* ${added.map((root) => `(subpath ${sbplString(root)})`).join(" ")})`;
+	return [...profileArgs.slice(0, -1), widened];
+}
+/** Quote one path exactly the way the upstream Seatbelt profile builder does. */
+function sbplString(path) {
+	return `"${path.replaceAll("\\", String.raw`\\`).replaceAll("\"", String.raw`\"`)}"`;
+}
+/** Unquote one SBPL string literal (including its surrounding quotes). */
+function sbplValue(literal) {
+	return literal.slice(1, -1).replaceAll(String.raw`\"`, "\"").replaceAll(String.raw`\\`, "\\");
+}
+/** Append the additional roots to the SBPL form that carries the subpath grants. */
+function widenSeatbelt(profileArgs, additionalRoots) {
+	const profile = profileArgs[profileArgs.length - 1];
+	if (profile === void 0 || profileArgs[profileArgs.length - 2] !== "-p") throw new DialectUnrecognizedError(`seatbelt profile is not "[<sandbox-exec>, …, -p, <SBPL>]": ${JSON.stringify(profileArgs)}`);
+	const form = SBPL_SUBPATH_FORM.exec(profile);
+	if (form === null) throw new DialectUnrecognizedError(`seatbelt profile has no "(allow file-write* (subpath …))" form to extend: ${JSON.stringify(profile)}`);
+	const matched = form[0];
+	const granted = new Set([...matched.matchAll(SBPL_SUBPATH_TOKEN)].map((token) => sbplValue(token[1])));
+	const added = additionalRoots.filter((root) => !granted.has(root)).map((root) => `(subpath ${sbplString(root)})`);
+	if (added.length === 0) return [...profileArgs];
+	const widened = profile.slice(0, form.index) + matched.slice(0, -1) + ` ${added.join(" ")})` + profile.slice(form.index + matched.length);
+	return [...profileArgs.slice(0, -1), widened];
+}
+/**
+* The observed bwrap bind flag: the flag of the `[flag, <root>, <root>]` triple
+* upstream built for the policy root.
+*/
+function bwrapBindFlag(profileArgs, workspaceRoot) {
+	for (let index = 2; index < profileArgs.length; index += 1) {
+		if (profileArgs[index] !== workspaceRoot || profileArgs[index - 1] !== workspaceRoot) continue;
+		const flag = profileArgs[index - 2];
+		if (flag === void 0 || !flag.startsWith("--") || flag.startsWith("--ro")) continue;
+		return flag;
+	}
+	throw new DialectUnrecognizedError(`bwrap profile has no writable bind of the policy root ${JSON.stringify(workspaceRoot)}: ${JSON.stringify(profileArgs)}`);
+}
+/** Append the additional roots as binds, after upstream's own root bind. */
+function widenBwrap(profileArgs, workspaceRoot, additionalRoots) {
+	const flag = bwrapBindFlag(profileArgs, workspaceRoot);
+	const granted = /* @__PURE__ */ new Set();
+	for (let index = 0; index + 2 < profileArgs.length; index += 1) if (profileArgs[index] === flag && profileArgs[index + 1] === profileArgs[index + 2]) granted.add(profileArgs[index + 2]);
+	for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === "--tmpfs") granted.add(profileArgs[index + 1]);
+	const added = additionalRoots.filter((root) => !granted.has(root)).flatMap((root) => [
+		flag,
+		root,
+		root
+	]);
+	return [...profileArgs, ...added];
+}
+/**
+* The observed Landlock read-write flag: the flag preceding the policy root in
+* the launcher's grant arguments.
+*/
+function landlockReadWriteFlag(profileArgs, workspaceRoot) {
+	for (let index = 1; index < profileArgs.length; index += 1) {
+		if (profileArgs[index] !== workspaceRoot) continue;
+		const flag = profileArgs[index - 1];
+		if (flag === void 0 || !flag.startsWith("--") || flag.startsWith("--ro")) continue;
+		return flag;
+	}
+	throw new DialectUnrecognizedError(`landlock profile has no read-write grant of the policy root ${JSON.stringify(workspaceRoot)}: ${JSON.stringify(profileArgs)}`);
+}
+/** Append the additional roots as read-write grants, after upstream's own root grant. */
+function widenLandlock(profileArgs, workspaceRoot, additionalRoots) {
+	const flag = landlockReadWriteFlag(profileArgs, workspaceRoot);
+	const granted = /* @__PURE__ */ new Set();
+	for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === flag) granted.add(profileArgs[index + 1]);
+	const added = additionalRoots.filter((root) => !granted.has(root)).flatMap((root) => [flag, root]);
+	return [...profileArgs, ...added];
+}
+/**
+* The bwrap mount points a workspace-write profile makes writable, split by
+* mechanism: `binds` are the `[flag, X, X]` triples whose flag is not `--ro*`
+* (a host directory stays reachable and writable), `tmpfs` are the `--tmpfs`
+* targets (a fresh private filesystem that hides whatever the host has there).
+* The distinction matters for the ancestor pinning in {@link denyProfileArgs}:
+* a directory inside a tmpfs is renamable only within the namespace and never
+* touches the host tree — while self-binding it would expose and make writable
+* the host content the tmpfs exists to hide.
+* @returns the writable bind targets and the tmpfs targets, in profile order.
+*/
+function bwrapWritableMounts(profileArgs) {
+	const binds = [];
+	const tmpfs = [];
+	for (let index = 0; index + 2 < profileArgs.length; index += 1) {
+		const flag = profileArgs[index];
+		if (!flag.startsWith("--") || flag.startsWith("--ro")) continue;
+		if (flag === "--tmpfs") {
+			tmpfs.push(profileArgs[index + 1]);
+			index += 1;
+			continue;
+		}
+		if (profileArgs[index + 1] === profileArgs[index + 2]) binds.push(profileArgs[index + 2]);
+	}
+	return {
+		binds,
+		tmpfs
+	};
+}
+/** The paths a Landlock profile grants read-write (`--rw` flag values). */
+function landlockWritablePaths(profileArgs) {
+	const granted = [];
+	for (let index = 0; index + 1 < profileArgs.length; index += 1) if (profileArgs[index] === "--rw") granted.push(profileArgs[index + 1]);
+	return granted;
+}
+/**
+* Deny `deniedRoots` inside an upstream `workspace-write` profile — the B9 edge
+* where an explicit `read-only` (or tool-capped) additional root sits under a
+* directory the profile grants writable (the platform temp area, which an
+* additional root may legitimately be registered beneath).
+*
+* A denied root outside every grant needs no profile work at all: the mode
+* already denies it. Per dialect:
+*
+* - seatbelt appends a trailing `(deny file-write* (subpath …) (literal …))`
+*   form — last match wins over every earlier allow, and a redundant deny on
+*   an ungranted root is harmless. The literals pin every ancestor of a denied
+*   root: Seatbelt checks the operated path only, so `rename`ing an ancestor
+*   would otherwise move the whole tree out from under its `subpath` deny;
+* - bwrap re-mounts the root `--ro-bind` AFTER the writable mounts (a later
+*   mount wins inside the namespace). The source is mandatory: if a denied
+*   root disappears, namespace setup fails before the command can recreate it.
+*   This also restores read access to denied roots under a `--tmpfs` target.
+*   Ancestors of a denied root that lie strictly inside a writable BIND target
+*   are self-bound (`--bind A A`) BEFORE the ro-binds: the kernel refuses to
+*   rename a mountpoint, so the deny can no longer be walked off by renaming
+*   the tree's parent. Ancestors inside a `--tmpfs` target are never bound —
+*   a rename there only moves namespace-private mounts, while the self-bind
+*   would expose and make writable the host content the tmpfs hides — and
+*   ancestors outside every writable target are not renamable anyway;
+* - landlock cannot subtract: a denied root under an `--rw` grant throws —
+*   union semantics have no deny primitive;
+* - windows-acl goes through `widenWindowsProfile`, whose runner-side ACL
+*   grant cannot subtract either — its caller checks the same overlap. The
+*   deny ACE does follow its directory object through a parent rename, but
+*   the moved tree's NEW path no longer matches the recorded deny set — so
+*   the ambient deny runner pins every ancestor of each deny root with a
+*   non-delete-sharing handle for the child lifetime (`windows-path-guard.ts`,
+*   `windows-deny.ts`).
+* @param dialect - the recognized dialect.
+* @param profileArgs - the upstream workspace-write profile arguments.
+* @param deniedRoots - canonical roots this call must not write.
+* @returns the profile arguments with the in-profile denies applied.
+*/
+function denyProfileArgs(dialect, profileArgs, deniedRoots) {
+	if (deniedRoots.length === 0) return [...profileArgs];
+	switch (dialect) {
+		case "seatbelt": {
+			const profile = profileArgs[profileArgs.length - 1];
+			if (profile === void 0 || profileArgs[profileArgs.length - 2] !== "-p") throw new DialectUnrecognizedError(`seatbelt profile is not "[<sandbox-exec>, …, -p, <SBPL>]": ${JSON.stringify(profileArgs)}`);
+			const granted = [...profile.matchAll(SBPL_SUBPATH_TOKEN)].map((token) => sbplValue(token[1]));
+			const covered = deniedRoots.filter((root) => granted.some((target) => profileOverlaps(root, target)));
+			if (covered.length === 0) return [...profileArgs];
+			const denied = [...covered.map((root) => `(subpath ${sbplString(root)})`), ...denyAncestors(covered).map((ancestor) => `(literal ${sbplString(ancestor)})`)].join(" ");
+			return [...profileArgs.slice(0, -1), `${profile} (deny file-write* ${denied})`];
+		}
+		case "bwrap": {
+			const writable = bwrapWritableMounts(profileArgs);
+			const covered = deniedRoots.filter((root) => [...writable.binds, ...writable.tmpfs].some((target) => profileOverlaps(root, target)));
+			const pins = denyAncestors(covered).filter((ancestor) => writable.binds.some((target) => ancestor !== target && profileContains(ancestor, target)) && !writable.tmpfs.some((target) => profileContains(ancestor, target))).flatMap((ancestor) => [
+				"--bind",
+				ancestor,
+				ancestor
+			]);
+			const binds = covered.flatMap((root) => [
+				"--ro-bind",
+				root,
+				root
+			]);
+			return [
+				...profileArgs,
+				...pins,
+				...binds
+			];
+		}
+		case "landlock": {
+			const granted = landlockWritablePaths(profileArgs);
+			const covered = deniedRoots.filter((root) => granted.some((target) => profileOverlaps(root, target)));
+			if (covered.length > 0) throw new DialectUnrecognizedError(`landlock cannot deny [${covered.join(", ")}] inside a writable grant — its launcher only supports allowlist union`);
+			return [...profileArgs];
+		}
+		case "windows-acl": throw new DialectUnrecognizedError("Windows ACL deny overlap is checked by widenWindowsProfile");
+	}
+}
+/**
+* Restrict an ambient-writable execution to everything EXCEPT `deniedRoots` —
+* the B9 cell `danger-full-access` + explicit `read-only`. The consumers of
+* this profile (shell, PTY, PTC) bypass `confine()` entirely under that mode,
+* so the process fence builds this profile from an upstream skeleton instead:
+* the caller probes `confine` once under `read-only` to obtain the runner's
+* argument prefix, and this function rewrites the file-effect part.
+*
+* - seatbelt: `(version 1) (allow default)` kept from the profile head, plus a
+*   trailing `(deny file-write* (subpath …) (literal …))` — allow-default with
+*   subpath carve-outs, the inverse of the confined profiles. The literals
+*   pin every ancestor of a denied root, so `rename`ing the tree's parent
+*   cannot walk it out from under the deny (Seatbelt checks the operated
+*   path only — verified natively on macOS);
+* - bwrap: `--ro-bind / /` becomes `--bind / /` (ambient writable namespace),
+*   each denied root is re-mounted `--ro-bind` after it, and every ancestor
+*   of a denied root is self-bound `--bind A A` between the root mount and the
+*   ro-binds — a mountpoint cannot be renamed (EBUSY), so the deny follows no
+*   rename of the tree's ancestors. A missing source fails the launch,
+*   retaining the registered negative authorization;
+* - landlock cannot express "everything except" — its launcher only unions
+*   allowlists, so it throws. windows-acl expresses the cell through the
+*   standalone ambient-deny runner instead of this profile rewrite: standing
+*   deny ACEs on every denied object, plus ancestor pin handles held through
+*   the child and its drained Job descendants so no rename can vacate the
+*   registered spelling (`windows-deny.ts`, `windows-path-guard.ts`).
+* @param dialect - the recognized dialect.
+* @param profileArgs - the upstream read-only skeleton's profile arguments.
+* @param deniedRoots - canonical roots the execution must not write.
+* @returns the restricted profile arguments.
+*/
+function restrictProfileArgs(dialect, profileArgs, deniedRoots) {
+	if (deniedRoots.length === 0) return [...profileArgs];
+	switch (dialect) {
+		case "seatbelt": {
+			const profile = profileArgs[profileArgs.length - 1];
+			if (profile === void 0 || profileArgs[profileArgs.length - 2] !== "-p") throw new DialectUnrecognizedError(`seatbelt profile is not "[<sandbox-exec>, …, -p, <SBPL>]": ${JSON.stringify(profileArgs)}`);
+			const anchor = profile.indexOf("(allow default)");
+			if (anchor < 0) throw new DialectUnrecognizedError(`seatbelt profile has no "(allow default)" to restrict from: ${JSON.stringify(profile)}`);
+			const denied = [...deniedRoots.map((root) => `(subpath ${sbplString(root)})`), ...denyAncestors(deniedRoots).map((ancestor) => `(literal ${sbplString(ancestor)})`)].join(" ");
+			const restricted = `${profile.slice(0, anchor + 15)} (deny file-write* ${denied})`;
+			return [...profileArgs.slice(0, -1), restricted];
+		}
+		case "bwrap": {
+			const base = profileArgs.indexOf("--ro-bind");
+			if (base < 1 || profileArgs[base + 1] !== "/" || profileArgs[base + 2] !== "/") throw new DialectUnrecognizedError("bwrap ambient profile requires an observed root mount");
+			const args = [
+				...profileArgs.slice(0, base),
+				"--bind",
+				"/",
+				"/",
+				"--die-with-parent"
+			];
+			for (const ancestor of denyAncestors(deniedRoots)) args.push("--bind", ancestor, ancestor);
+			for (const root of deniedRoots) args.push("--ro-bind", root, root);
+			return args;
+		}
+		case "landlock": return [
+			"bwrap",
+			"--bind",
+			"/",
+			"/",
+			"--die-with-parent",
+			...denyAncestors(deniedRoots).flatMap((ancestor) => [
+				"--bind",
+				ancestor,
+				ancestor
+			]),
+			...deniedRoots.flatMap((root) => [
+				"--ro-bind",
+				root,
+				root
+			])
+		];
+		case "windows-acl": throw new DialectUnrecognizedError("Windows ACL cannot express an ambient grant minus subtree denies — the restricted-token model only grants");
+	}
+}
+//#endregion
+//#region src/windows-profile.ts
+/** Windows runner argv and capability identity. No Win32 calls at module load. */
+/** Recognize the upstream runner, then select our ambient deny-token path.
+*
+* `protectedHome` is a diagnostics label only: when it names one of the deny
+* roots it is forwarded as `--protected-home` so the runner can word its
+* hardlink/scan remediation for the protected `$DSH_HOME`. It never changes
+* which roots are denied or how.
+*/
+function restrictWindowsProfile(profile, deniedRoots, protectedHome) {
+	assertWindowsDenyCapacity(deniedRoots.length);
+	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
+	const parsed = parseWindowsProfile(profile.slice(2));
+	if (deniedRoots.length === 0) throw new DialectUnrecognizedError("Windows ambient restriction requires at least one deny root");
+	for (const root of [parsed.workspace, ...deniedRoots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
+	const label = protectedHome !== void 0 && deniedRoots.some((root) => root.toLowerCase() === protectedHome.toLowerCase()) ? ["--protected-home", protectedHome] : [];
+	return [
+		profile[0],
+		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
+		"--upstream-runner",
+		profile[1],
+		"--workspace",
+		parsed.workspace,
+		"--temp",
+		parsed.temp,
+		"--mode",
+		"danger-full-access",
+		...deniedRoots.flatMap((root) => ["--deny-root", root]),
+		...label
+	];
+}
+function widenWindowsProfile(profile, roots, deniedRoots, primaryRoot) {
+	if (profile.length < 2 || profile[0] === void 0 || profile[1]?.startsWith("--")) throw new DialectUnrecognizedError("Windows ACL runner invocation is not [node, runner, ...flags]");
+	const parsed = parseWindowsProfile(profile.slice(2));
+	for (const root of [parsed.workspace, ...roots]) if (isWindowsNetworkOrDevicePath(root)) throw new DialectUnrecognizedError(`Windows ACL confinement cannot cover network or device paths: ${root}`);
+	if (primaryRoot !== void 0 && canonicalPath(parsed.workspace) !== primaryRoot) throw new DialectUnrecognizedError("Windows ACL profile workspace does not match the policy root");
+	{
+		const granted = parsed.mode === "workspace-write" ? [
+			parsed.workspace,
+			parsed.temp,
+			...roots
+		] : roots;
+		const covered = deniedRoots.filter((root) => granted.some((target) => windowsContained(root, target) || windowsContained(target, root)));
+		if (covered.length > 0) throw new DialectUnrecognizedError(`Windows ACL cannot deny [${covered.join(", ")}] inside a writable grant — the restricted-token model only grants`);
+	}
+	if (roots.length === 0) return [...profile];
+	return [
+		profile[0],
+		fileURLToPath(new URL("./windows-runner.js", import.meta.url)),
+		"--upstream-runner",
+		profile[1],
+		...profile.slice(2),
+		...roots.flatMap((root) => ["--additional-root", root])
+	];
+}
+/**
+* Containment over Windows SPELLINGS, not the host OS: the profile this
+* function rewrites may be produced for a Windows host while the check runs
+* in tests on POSIX, so the comparison cannot borrow the host's separator or
+* case rules.
+*/
+function windowsContained(candidate, root) {
+	const normalize = (path) => path.replaceAll("/", "\\").replace(/\\+$/, "").toLowerCase();
+	const target = normalize(candidate);
+	const base = normalize(root);
+	return target === base || target.startsWith(`${base}\\`);
+}
+//#endregion
+//#region src/sandbox.ts
+/**
+* Local process-sandbox provider over the multi-root scope. Registers as
+* `ctx.sandbox`; the runner chain, probing, denial dialects, and Windows ACL
+* grant mechanics stay the upstream implementation's.
+*/
+var MultiRootSandboxProvider = class extends LocalSandboxProvider {
+	static inject = [
+		"multiRootCompat",
+		"sandboxPolicy",
+		"multiRootScope"
+	];
+	constructor(ctx, config) {
+		super(ctx, config);
+		brandMultiRootProvider(this, "sandbox");
+	}
+	/**
+	* Wrap `argv` so it executes confined under `policy` on this host, granting
+	* the scope's additional roots inside the SAME dialect profile.
+	*
+	* Under `read-only` nothing is added (the mode denies every write, additional
+	* roots included), and `danger-full-access` never reaches here at all: the
+	* bash executor and the PTY backend both hand their argv straight to the local
+	* runtime in that mode. Widening therefore only ever ADDS the scope's
+	* additional roots to an upstream `workspace-write` profile.
+	*
+	* The return shape is the INSTALLED upstream provider's: synchronous on a
+	* release with a synchronous `confine`, a promise on a release with an
+	* asynchronous one. `widenConfined` preserves whichever it is — see
+	* `./compat/sandbox-confine.ts`.
+	* @param argv - the exact argv the caller is about to spawn.
+	* @param policy - the file-effect policy this execution runs under.
+	* @param signal - cancellation, forwarded to releases that accept it.
+	* @returns the argv to spawn instead, plus the selected backend's facts.
+	*/
+	confine(argv, policy, signal) {
+		const scope = this.ctx.multiRootScope.resolve(policy);
+		if (policy.mode === "workspace-write" && scope.authority === "unavailable") {
+			const prefix = this.clampedExecution(policy, scope.deniedRoots, signal);
+			return widenConfined(() => prefix, (facts) => ({
+				...facts,
+				argv: [...facts.argv, ...argv]
+			}), argv, policy, signal);
+		}
+		const base = super.confine;
+		return widenConfined(base.bind(this), (confined) => this.widenForScope(confined, argv, policy, scope), argv, policy, signal);
+	}
+	/**
+	* Graft the scope's effective grants and denies onto one upstream `confine`
+	* result.
+	*
+	* Pure with respect to the upstream call: it only ever reads the scope and
+	* rewrites `argv`. `enforcement`, `denialSignatures` and `runnerFailureRules`
+	* are passed through untouched, because the bash executor derives its denial
+	* and enforcement reporting from them.
+	*
+	* Mode behavior (B9, R2): `workspace-write` widens the grant with the
+	* effective writable roots AND denies any restricted root the upstream
+	* grants could reach (a `read-only` root registered under the platform
+	* temp). `read-only` grafts the fixed `read-write` roots back onto the
+	* deny-all baseline — the three-state matrix's standout cell — and then
+	* applies the SAME deny pass: a grafted writable parent must not silently
+	* swallow a denied child (Seatbelt appends the deny after the allow, bwrap
+	* adds a mandatory `--ro-bind`, Landlock / windows-acl refuse the
+	* unrepresentable subtraction). `danger-full-access` never reaches
+	* here (consumers bypass `confine`); its deny semantics live in
+	* {@link restrictedArgvPrefix}.
+	* @param confined - the upstream result for this call.
+	* @param argv - the caller's argv, needed to re-split the wrapped form.
+	* @param policy - the per-call policy.
+	* @param scope - the authorization snapshot taken at dispatch.
+	* @returns the upstream result element for element, or one with a rewritten argv.
+	*/
+	widenForScope(confined, argv, policy, scope) {
+		if (scope.authority === "unavailable" || policy.mode !== "workspace-write" && policy.mode !== "read-only") return confined;
+		const writable = scope.writableRoots;
+		const denied = scope.deniedRoots;
+		if (writable.length === 0 && (denied.length === 0 || policy.mode === "read-only")) return confined;
+		try {
+			const shape = splitConfined(confined.argv, argv);
+			if (shape.dialect === "windows-acl") return {
+				...confined,
+				argv: [
+					...widenWindowsProfile(shape.profileArgs, writable, denied, scope.primaryRoot),
+					"--",
+					...argv
+				]
+			};
+			const widened = policy.mode === "workspace-write" ? widenProfileArgs(shape.dialect, shape.profileArgs, policy, writable) : graftProfileArgs(shape.dialect, shape.profileArgs, writable);
+			const profileArgs = denyProfileArgs(shape.dialect, widened, denied);
+			return {
+				...confined,
+				argv: [
+					...profileArgs,
+					"--",
+					...argv
+				]
+			};
+		} catch (error) {
+			if (!(error instanceof DialectUnrecognizedError)) throw error;
+			throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot apply the additional workspace roots (writable: [${writable.join(", ")}], denied: [${denied.join(", ")}]) under the primary root ${scope.primaryRoot} — ${error.message}`);
+		}
+	}
+	/**
+	* Build the runner-prefix that confines an ambient-writable execution to
+	* everything EXCEPT `deniedRoots` — the `danger-full-access` + explicit
+	* `read-only` cell, which the shell, PTY and PTC consumers never route
+	* through `confine()` at all.
+	*
+	* The restricted profile does not depend on the callee's argv, so the prefix
+	* is computed once per call here and the synchronous `ctx.subprocess.spawn`
+	* seam only has to prepend it. The upstream profile builders stay private:
+	* this probes `confine` under `read-only` for the runner's argument skeleton
+	* and rewrites the file-effect part per dialect. Windows selects the
+	* standalone ambient deny-token runner. Landlock cannot express
+	* "everything except", so this combination selects bubblewrap; unusable
+	* runners fail without spawning an unconfined command.
+	*
+	* The return preserves the installed `confine` shape: a synchronous result
+	* on a synchronous release, a promise on an asynchronous one.
+	* @param policy - the caller's policy (mode must be `danger-full-access`).
+	* @param deniedRoots - canonical roots this execution must not write.
+	* @param signal - cancellation, forwarded to releases that accept it.
+	* @param protectedHome - diagnostics label: which deny root is the
+	*   protected `$DSH_HOME`. Forwarded to the Windows runner only when it is
+	*   a member of `deniedRoots`; it never changes authorization.
+	* @returns the argv prefix, ending at the `--` separator.
+	*/
+	restrictedArgvPrefix(policy, deniedRoots, signal, protectedHome) {
+		return mapConfined(this.restrictedExecution(policy, deniedRoots, signal, protectedHome), (confined) => confined.argv);
+	}
+	/** Full-access restriction and the actual selected backend's diagnostics. */
+	restrictedExecution(policy, deniedRoots, signal, protectedHome) {
+		const probePolicy = {
+			mode: "read-only",
+			workspaceRoot: policy.workspaceRoot,
+			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
+		};
+		const probe = super.confine.call(this, ["true"], probePolicy, signal);
+		const restrict = (confined) => {
+			try {
+				const shape = splitConfined(confined.argv, ["true"]);
+				const argv = [...shape.dialect === "windows-acl" ? restrictWindowsProfile(shape.profileArgs, deniedRoots, protectedHome) : restrictProfileArgs(shape.dialect, shape.profileArgs, deniedRoots), "--"];
+				return shape.dialect === "landlock" ? {
+					argv,
+					enforcement: "full",
+					denialSignatures: ["read-only file system"],
+					runnerFailureRules: [{ fatalSignatures: ["bwrap: "] }]
+				} : {
+					...confined,
+					argv
+				};
+			} catch (error) {
+				if (!(error instanceof DialectUnrecognizedError)) throw error;
+				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot confine an ambient execution away from the denied roots [${deniedRoots.join(", ")}] — ${error.message}`);
+			}
+		};
+		return widenConfined(() => probe, restrict, ["true"], probePolicy, signal);
+	}
+	/**
+	* Limit an execution with unknown registry authority to the primary root.
+	* Shared temp grants are unsafe: another process may have registered a
+	* read-only root beneath them. Harvest the upstream read-only skeleton and
+	* graft only the primary root, retaining diagnostics and the sync/async shape.
+	* Explicit denies still win; an unrepresentable overlap refuses launch.
+	* @param policy - the caller's execution policy.
+	* @param deniedRoots - known negative boundaries, including protected home.
+	* @param signal - cancellation forwarded to upstream.
+	* @returns the confined prefix ending at `--`, without the caller's command.
+	*/
+	clampedExecution(policy, deniedRoots, signal) {
+		const probePolicy = {
+			mode: "read-only",
+			workspaceRoot: policy.workspaceRoot,
+			...policy.sessionId === void 0 ? {} : { sessionId: policy.sessionId }
+		};
+		const probe = super.confine.call(this, ["true"], probePolicy, signal);
+		const clamp = (confined) => {
+			try {
+				const shape = splitConfined(confined.argv, ["true"]);
+				const profileArgs = shape.dialect === "windows-acl" ? widenWindowsProfile(shape.profileArgs, [canonicalPath(policy.workspaceRoot)], deniedRoots, canonicalPath(policy.workspaceRoot)) : denyProfileArgs(shape.dialect, graftProfileArgs(shape.dialect, shape.profileArgs, [canonicalPath(policy.workspaceRoot)]), deniedRoots);
+				return {
+					...confined,
+					argv: [...profileArgs, "--"]
+				};
+			} catch (error) {
+				if (!(error instanceof DialectUnrecognizedError)) throw error;
+				throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot limit an execution to the primary root while the registry authority is unavailable — ${error.message}`);
+			}
+		};
+		return widenConfined(() => probe, clamp, ["true"], probePolicy, signal);
+	}
+};
+//#endregion
+export { widenConfined as n, MultiRootSandboxProvider as t };