@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/lib/process-fence.js

@@ -0,0 +1,280 @@
+import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/compat/process-result.ts
+const object$1 = (value) => typeof value === "object" && value !== null;
+const thenable = (value) => typeof value?.then === "function";
+const textOf = (value) => typeof value === "string" ? value : object$1(value) && typeof value.text === "string" ? value.text : "";
+const stderrOf = (value) => textOf(value.stderr) + (object$1(value.error) ? textOf(value.error.message) : "") + (object$1(value.failure) ? textOf(value.failure.message) : "");
+const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$1(value.error) || object$1(value.failure) ? 1 : 0;
+/** Denial and runner-failure verdicts for one settled process — the same
+* non-zero-exit + stderr-signature rules the sandbox executors apply: a fatal
+* runner line is an infrastructure failure, never a policy denial. */
+const classifyOutcome = (exitCode, stderr, facts) => {
+	const nonzero = exitCode !== null && exitCode !== 0;
+	const lines = stderr.toLowerCase().split(/\r?\n/);
+	const runnerFailed = nonzero && facts.runnerFailureRules.some((rule) => (rule.allowedExitCodes === void 0 || rule.allowedExitCodes.includes(exitCode)) && lines.some((line) => !rule.informationalLines?.some((info) => info.toLowerCase() === line) && rule.fatalSignatures.some((signature) => line.includes(signature.toLowerCase()))));
+	return {
+		denied: nonzero && !runnerFailed && facts.denialSignatures.some((signature) => stderr.toLowerCase().includes(signature.toLowerCase())),
+		runnerFailed
+	};
+};
+/** The `sandbox` stamp one settled outcome carries, merged over any stamp the
+* confining executor already installed. */
+const sandboxStamp = (value, facts, policy, stderr) => {
+	const { denied, runnerFailed } = classifyOutcome(exitCodeOf(value), stderr ?? stderrOf(value), facts);
+	return {
+		...object$1(value.sandbox) ? value.sandbox : {},
+		mode: policy.mode,
+		enforcement: facts.enforcement,
+		denied,
+		...runnerFailed ? { runnerFailed: true } : {}
+	};
+};
+function stampProcessResult(value, facts, policy) {
+	if (!object$1(value)) return value;
+	return {
+		...value,
+		sandbox: sandboxStamp(value, facts, policy)
+	};
+}
+/** Whether a non-thenable, non-`result()` value is a live process handle
+* rather than settled result data: it owns a `done` settle hook or callable
+* members, or carries a shaped prototype. Copying it would freeze
+* `status`/`exitCode` where consumers poll them and sever `readOutput`/`kill`
+* identity — the model-facing `proc.sandbox` read happens on this very
+* object, so the stamp must land in place.
+*/
+const liveHandle = (value) => thenable(value.done) || typeof value.done === "function" || Object.values(value).some((member) => typeof member === "function") || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null;
+function decorateProcessOutcome(value, facts, policy, diagnostics) {
+	if (object$1(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
+	if (object$1(value) && typeof value.result === "function") {
+		let cached;
+		let settled = false;
+		wrapMethod(value, "result", (original) => function(...args) {
+			if (!settled) {
+				cached = decorateProcessOutcome(original.apply(this, args), facts, policy, diagnostics);
+				settled = true;
+			}
+			return cached;
+		});
+		return value;
+	}
+	if (object$1(value) && liveHandle(value)) {
+		const settle = () => {
+			try {
+				value.sandbox = sandboxStamp(value, facts, policy, diagnostics?.stderr?.());
+			} catch {}
+		};
+		if (thenable(value.done)) {
+			value.done = value.done.then((outcome) => {
+				settle();
+				return decorateProcessOutcome(outcome, facts, policy, diagnostics);
+			}, (error) => {
+				settle();
+				throw error;
+			});
+			return value;
+		}
+		if (typeof value.done === "function") {
+			wrapMethod(value, "done", (original) => function(...args) {
+				const outcome = original.apply(this, args);
+				return thenable(outcome) ? outcome.then((resolved) => {
+					settle();
+					return decorateProcessOutcome(resolved, facts, policy, diagnostics);
+				}, (error) => {
+					settle();
+					throw error;
+				}) : (settle(), decorateProcessOutcome(outcome, facts, policy, diagnostics));
+			});
+			return value;
+		}
+		settle();
+		return value;
+	}
+	return stampProcessResult(value, facts, policy);
+}
+//#endregion
+//#region src/compat/process-entrypoints.ts
+/**
+* The public shell executor entries present on the mounted service, in this
+* order: `execute`, `run`, `start` (`start` existed through 0.1.6).
+* @param shell - the mounted `ctx.shell` service.
+* @returns the present entries — a structural probe only.
+*/
+function shellEntrypoints(shell) {
+	const record = shell;
+	return [
+		"execute",
+		"run",
+		"start"
+	].filter((key) => typeof record[key] === "function");
+}
+/**
+* The PTC runtime's public entry: `['run']` when it is a function; never the
+* concrete runtime's private `execute` helper.
+* @param runtime - the mounted `ctx.ptcRuntime` service.
+* @returns the present entries — a structural probe only.
+*/
+function ptcEntrypoints(runtime) {
+	return typeof runtime.run === "function" ? ["run"] : [];
+}
+//#endregion
+//#region src/process-fence.ts
+/**
+* `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
+* never sees — `danger-full-access` with explicit `read-only` additional roots.
+*
+* Upstream, every confined consumer routes through `ctx.sandbox.confine`, which
+* this bundle's provider already widens (grants, the read-only fixed-write
+* graft, and the workspace-write deny edge). But the shell executor, the PTC
+* runtime and the PTY backend all short-circuit that mode: `policy.mode ===
+* 'danger-full-access'` returns the bare argv, so an explicit `read-only` root
+* would silently stay writable. This row closes the gap without touching any
+* upstream executor:
+*
+* - `ctx.subprocess.spawn` is wrapped to prepend a precomputed restricted
+*   profile whenever the AsyncLocalStorage below carries one. `spawn` is
+*   synchronous, so the profile — which never depends on the callee's argv —
+*   is built by the wrapping consumer, not here.
+* - `ctx.shell.execute` (bash and pwsh alike, and `start` where an older
+*   release still exposes it — `compat/process-entrypoints.ts` owns which
+*   entries a mounted executor actually carries) resolves the per-call policy
+*   exactly the way the executor itself does, and — under Full-access with
+*   deny roots — asks the sandbox provider for the restricted prefix and runs
+*   the call inside the store, so every subprocess the executor launches is
+*   confined.
+* - `ctx.ptcRuntime.run` does the same for `run_code`.
+* - `ctx.subprocess.spawnTerminal` keys on the `DSH_PTY_SESSION_ID` marker:
+*   every supported `dsh-terminal-bash` backend stamps it (alongside
+*   `DSH_SESSION_ID`) when it launches an agent's PTY, and no other caller —
+*   above all the panel's terminal controller — ever sets it. A spec without
+*   the marker is a USER terminal, passed through untouched in every mode:
+*   the sandbox protects agent behavior, and upstream never confines the
+*   user's own terminal. Because that marker is the ONLY discriminator, the
+*   `multi-root-compat` gate asserts it at boot (`compat/pty-marker.ts`):
+*   an installed backend whose emitted code no longer stamps it fails the
+*   plugin load rather than silently reclassifying agent PTYs as the user's.
+*   `ctx.terminals` itself is deliberately NOT wrapped:
+*   upstream mounts it inside `optional-persistent-terminals` with
+*   `isolate: { terminals: true }`, so the registry entry is unreachable from
+*   this row — the shared `spawnTerminal` seam plus the env discriminator
+*   covers both the un-isolated SDK mount and the isolated web mount.
+*
+* The same seam carries the unknown-authority downgrade: while the scope
+* reports `authority: 'unavailable'` — a contended, storage-failed or
+* config-invalid registry publishes an empty deny set that is NOT evidence —
+* `danger-full-access` executions run inside a primary-root-only
+* profile (with the deny set applied) instead of ambient.
+*
+* Windows uses the standalone ambient deny-token runner. Landlock cannot subtract a subtree, so that combination selects bubblewrap.
+* An unusable mount runner fails without starting an unconfined process.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/process-fence
+*/
+const inject = [
+	"multiRootCompat",
+	"multiRootProviders",
+	"multiRootScope",
+	"sandbox",
+	"sandboxPolicy"
+];
+const processDenyStore = new AsyncLocalStorage();
+/** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
+function isThenable(value) {
+	return typeof value?.then === "function";
+}
+const object = (value) => typeof value === "object" && value !== null;
+function apply(ctx) {
+	const policyOf = (spec) => spec?.sandboxPolicy ?? ctx.sandboxPolicy.resolve();
+	/**
+	* The confined facts for one Full-access call, or `undefined` when the call
+	* needs no confinement (not full-access, and nothing to deny while the
+	* registry is the store's authority). An `unavailable` scope authority
+	* clamps the call to a primary-root-only profile: the empty deny
+	* set a contended or failed registry publishes is not evidence that nothing
+	* is restricted. May throw synchronously — `SandboxUnavailableError` from a
+	* dialect that cannot express the confinement, which must propagate to the
+	* caller, never be swallowed.
+	*/
+	const prepare = (policy, signal) => {
+		if (policy.mode !== "danger-full-access") return void 0;
+		const scope = ctx.multiRootScope.resolve(policy);
+		if (scope.authority === "unavailable") return ctx.sandbox.clampedExecution(policy, scope.deniedRoots, signal);
+		if (scope.deniedRoots.length === 0) return void 0;
+		return ctx.sandbox.restrictedExecution(policy, scope.deniedRoots, signal, scope.protectedHome);
+	};
+	/**
+	* Run `body` under the restricted deny context when `prepared` is a prefix —
+	* preserving the sync/async shape of the prepared value itself.
+	*/
+	const runDenied = (prepared, policy, body) => {
+		const run = (facts) => {
+			const store = { argvPrefix: facts.argv };
+			return processDenyStore.run(store, () => decorateProcessOutcome(body(), facts, policy, { stderr: () => store.stderr?.() }));
+		};
+		return isThenable(prepared) ? prepared.then(run) : run(prepared);
+	};
+	ctx.inject(["subprocess"], (scope) => {
+		scope.effect(() => wrapMethod(scope.subprocess, "spawn", (original) => function(spec) {
+			const store = processDenyStore.getStore();
+			if (store === void 0) return original.call(this, spec);
+			const handle = original.call(this, {
+				...spec,
+				argv: [...store.argvPrefix, ...spec.argv]
+			});
+			const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
+			if (stderr !== void 0) store.stderr = () => {
+				try {
+					return stderr.readFrom(0).text;
+				} catch {
+					return;
+				}
+			};
+			return handle;
+		}));
+		scope.effect(() => wrapMethod(scope.subprocess, "spawnTerminal", (original) => async function(spec) {
+			const ptySessionId = spec.env?.DSH_PTY_SESSION_ID;
+			if (ptySessionId === void 0 || ptySessionId === "") return await original.call(this, spec);
+			const sessionId = spec.env?.DSH_SESSION_ID;
+			const session = sessionId === void 0 || sessionId === "" ? void 0 : ctx.get("sessions")?.get(sessionId);
+			if (session === void 0) {
+				if (!ctx.multiRootScope.hasActiveDenyRoots()) return await original.call(this, spec);
+				throw new Error(`multi-root workspace: agent terminal spawn carries a session marker that does not resolve to a live session (${JSON.stringify(sessionId ?? ptySessionId)}), and explicit read-only roots are or may be registered — refusing to spawn an unconfined terminal`);
+			}
+			const policy = ctx.sandboxPolicy.resolve({ session });
+			const prepared = prepare(policy, spec.signal);
+			if (prepared === void 0) return await original.call(this, spec);
+			const argvPrefix = (await prepared).argv;
+			return await original.call(this, {
+				...spec,
+				argv: [...argvPrefix, ...spec.argv]
+			});
+		}));
+	});
+	/**
+	* The wrapper every execute-style consumer entry shares: resolve the policy
+	* the way the upstream consumer does, and when the call runs ambient under
+	* Full-access with roots to deny, execute it inside the restricted store so
+	* every subprocess it launches is confined.
+	*/
+	const deniedEntry = (scope, target, key) => {
+		scope.effect(() => wrapMethod(target, key, (original) => function(spec, ...rest) {
+			const policy = policyOf(spec);
+			const prepared = prepare(policy, spec?.signal);
+			if (prepared === void 0) return original.call(this, spec, ...rest);
+			return runDenied(prepared, policy, () => original.call(this, spec, ...rest));
+		}));
+	};
+	ctx.inject(["shell"], (scope) => {
+		const shell = scope.get("shell");
+		if (shell === void 0) return;
+		for (const key of shellEntrypoints(shell)) deniedEntry(scope, shell, key);
+	});
+	ctx.inject(["ptcRuntime"], (scope) => {
+		const runtime = scope.get("ptcRuntime");
+		if (runtime === void 0) return;
+		for (const key of ptcEntrypoints(runtime)) deniedEntry(scope, runtime, key);
+	});
+}
+//#endregion
+export { apply, inject };

package/lib/providers.js

@@ -0,0 +1,87 @@
+import { Service } from "@deepseek-ai/cordis";
+//#region src/providers.ts
+/**
+* `MultiRootProviders`: the fail-loud guard that proves the services mounted as
+* `ctx.fs` and `ctx.sandbox` are THIS bundle's providers — the only ones whose
+* widening the registry, the instruction row, LSP routing and workspace-files
+* are allowed to attach to.
+*
+* Why a brand and not `instanceof`: the plugin may be installed twice (a
+* duplicated install forks the class identity), and cordis private fields are
+* not a public contract. A well-known symbol survives both. The brand is
+* non-enumerable so it never leaks into spreads, JSON, or surface payloads.
+*
+* Deterministic outcome under a provider conflict: cordis refuses a second
+* `ctx.provide` of an already-registered key, so whoever mounts the colliding
+* provider second loses loudly — but a conflicting plugin can also DISABLE this
+* bundle's rows (the same mechanism this bundle uses on upstream), leaving a
+* foreign `ctx.fs`/`ctx.sandbox` in place. In that case this service's
+* `[Service.init]` logs which service is foreign and throws: the row never
+* activates, so every row injecting `multiRootProviders` — the registry above
+* all — never starts, the scope stays empty, and nothing is ever granted,
+* regardless of patch order. Cordis re-evaluates an injecting fiber when an
+* injected service is unprovided and re-provided, so a LATE replacement re-runs
+* the same check.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/providers
+*/
+/**
+* The well-known brand key both providers carry. `Symbol.for` makes it
+* identical across duplicated installs of this package.
+*/
+const MULTI_ROOT_PROVIDER_BRAND = Symbol.for("@dsh-electron/dsh-plugin-multi-root-workspace/provider");
+/**
+* Stamp the multi-root provider brand on a service value. Non-enumerable:
+* the mark must not travel into structural copies.
+* @param value - the service instance being mounted.
+* @param kind - which provider key it claims.
+* @returns the same value, branded.
+*/
+function brandMultiRootProvider(value, kind) {
+	Object.defineProperty(value, MULTI_ROOT_PROVIDER_BRAND, {
+		value: kind,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return value;
+}
+/**
+* Whether `value` is this bundle's provider of `kind`. Structural on purpose:
+* no `instanceof`, so a duplicated install still recognizes the brand.
+* @param value - the service mounted under the key.
+* @param kind - the provider key being checked.
+*/
+function isMultiRootProvider(value, kind) {
+	return value !== null && (typeof value === "object" || typeof value === "function") && value[MULTI_ROOT_PROVIDER_BRAND] === kind;
+}
+/**
+* The conflict gate: `ctx.multiRootProviders` exists only while `ctx.fs` and
+* `ctx.sandbox` are this bundle's branded providers. Every row that widens an
+* authority surface injects it, so a foreign provider composition loses the
+* whole gated set instead of silently widening an unverified one.
+*/
+var MultiRootProviders = class extends Service {
+	static provide = "multiRootProviders";
+	static inject = [
+		"multiRootCompat",
+		"fs",
+		"sandbox"
+	];
+	/**
+	* Verify the provider identities once per activation. A foreign service is
+	* named in the log and the throw leaves this row — and every dependent —
+	* unstarted: fail loud, never a widened grant.
+	*/
+	[Service.init]() {
+		const foreign = [];
+		if (!isMultiRootProvider(this.ctx.fs, "fs")) foreign.push("fs");
+		if (!isMultiRootProvider(this.ctx.sandbox, "sandbox")) foreign.push("sandbox");
+		if (foreign.length === 0) return;
+		const names = foreign.map((name) => `ctx.${name}`).join(" and ");
+		this.ctx.logger.error(`multi-root-workspace: ${names} is provided by another plugin, not this bundle's multi-root provider; refusing to start the multi-root rows so no widened grant can attach to an unverified provider. Resolve the conflict by disabling the other plugin's provider rows.`);
+		throw new Error(`multi-root-workspace: ${names} is a foreign provider; multi-root rows are disabled`);
+	}
+};
+//#endregion
+export { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, MultiRootProviders as default, brandMultiRootProvider, isMultiRootProvider };