@dsh-enhanced/assistant-isolation 0.1.30

package/lib/workspace.js

@@ -0,0 +1,140 @@
+import { chmod, lstat, mkdir, open } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
+const maxText = 16_384;
+const control = /[\p{Cc}]/u;
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+function fail(message) { throw new Error(`invalid isolation workspace: ${message}`); }
+const positive = (value) => Number.isSafeInteger(value) && value > 0;
+const bytes = (value) => Buffer.byteLength(value, 'utf8');
+const pathOrder = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+function limitsInput(value) {
+    if (!value || typeof value !== 'object' || Object.keys(value).length !== 10
+        || !positive(value.maxDurationMs) || !positive(value.maxInputBytes) || !positive(value.maxOutputBytes) || !positive(value.maxArtifactBytes)
+        || !positive(value.workspaceMiB) || !positive(value.workspaceInodes) || !positive(value.maxFiles) || !positive(value.memoryMiB) || !positive(value.pidsLimit) || !Number.isFinite(value.cpus) || value.cpus <= 0)
+        fail('invalid limits');
+    return value;
+}
+function scalar(value, name, maximum = maxText) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > maximum || control.test(value))
+        fail(`invalid ${name}`);
+    return value;
+}
+/** Canonical relative path syntax shared by input staging and artifact collection. */
+function pathInput(value) {
+    const path = scalar(value, 'path', 4096);
+    if (isAbsolute(path) || path.includes('\\') || path.startsWith('./') || path.endsWith('/') || path.includes('//'))
+        fail('non-canonical path');
+    const parts = path.split('/');
+    if (parts.some(part => part.length === 0 || part === '.' || part === '..'))
+        fail('unsafe path');
+    return path;
+}
+function canonicalPaths(values, name, maximum) {
+    if (!Array.isArray(values) || values.length > maximum)
+        fail(`invalid ${name}`);
+    const paths = values.map(pathInput).sort(pathOrder);
+    if (paths.some((path, index) => index > 0 && path === paths[index - 1]))
+        fail(`duplicate ${name}`);
+    return paths;
+}
+function assertNoFileParentConflict(files) {
+    for (let index = 1; index < files.length; index += 1)
+        if (files[index].path.startsWith(`${files[index - 1].path}/`))
+            fail('file parent conflict');
+}
+/** Rejects model-controlled ambiguity before hashing, auditing, or staging a request. */
+export function normalizeRequest(request, limits) {
+    const configured = limitsInput(limits);
+    if (!request || typeof request !== 'object' || !Object.keys(request).every(key => ['grantId', 'idempotencyKey', 'command', 'files', 'artifacts', 'timeoutMs'].includes(key))
+        || !scalar(request.grantId, 'grant id', 256) || !scalar(request.idempotencyKey, 'idempotency key', 256)
+        || typeof request.command !== 'string' || request.command.length === 0 || request.command.includes('\0'))
+        fail('invalid request');
+    const timeoutMs = request.timeoutMs === undefined ? configured.maxDurationMs : request.timeoutMs;
+    if (!positive(timeoutMs) || timeoutMs > configured.maxDurationMs)
+        fail('invalid timeout');
+    const rawFiles = request.files === undefined ? [] : request.files;
+    if (!Array.isArray(rawFiles) || rawFiles.length > configured.maxFiles)
+        fail('invalid files');
+    const files = rawFiles.map(file => {
+        if (!file || typeof file !== 'object' || !Object.keys(file).every(key => key === 'path' || key === 'content') || Object.keys(file).length !== 2 || typeof file.content !== 'string')
+            fail('invalid file');
+        return { path: pathInput(file.path), content: file.content };
+    }).sort((left, right) => pathOrder(left.path, right.path));
+    if (files.some((file, index) => index > 0 && file.path === files[index - 1].path))
+        fail('duplicate files');
+    assertNoFileParentConflict(files);
+    const artifacts = request.artifacts === undefined ? [] : canonicalPaths(request.artifacts, 'artifacts', configured.maxFiles);
+    const inputBytes = bytes(request.command) + files.reduce((total, file) => total + bytes(file.path) + bytes(file.content), 0) + artifacts.reduce((total, path) => total + bytes(path), 0);
+    if (!Number.isSafeInteger(inputBytes) || inputBytes > configured.maxInputBytes)
+        fail('input exceeds limit');
+    const inputEntries = new Set();
+    for (const file of files) {
+        const parts = file.path.split('/');
+        for (let index = 1; index <= parts.length; index++)
+            inputEntries.add(parts.slice(0, index).join('/'));
+    }
+    if (inputEntries.size + 1 > configured.workspaceInodes)
+        fail('input exceeds workspace inode limit');
+    if (files.reduce((total, file) => total + bytes(file.content), 0) > configured.workspaceMiB * 1_048_576)
+        fail('input exceeds workspace byte limit');
+    return Object.freeze({ grantId: request.grantId, idempotencyKey: request.idempotencyKey, command: request.command, ...(files.length ? { files: files.map(file => Object.freeze(file)) } : {}), ...(artifacts.length ? { artifacts } : {}), timeoutMs });
+}
+async function directory(path, create) {
+    if (create)
+        await mkdir(path, { recursive: true, mode: 0o700 });
+    const entry = await lstat(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink())
+        fail('directory is not private');
+    await chmod(path, 0o700);
+}
+async function privateParents(root, relativePath) {
+    let current = root;
+    const parts = relativePath.split('/');
+    parts.pop();
+    for (const part of parts) {
+        current = resolve(current, part);
+        await mkdir(current, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+            throw error; });
+        await directory(current, false);
+    }
+    return current;
+}
+/** Creates a fresh, job-only workspace. It deliberately never copies a project checkout. */
+export async function stageWorkspace(stateRoot, jobId, request) {
+    if (!isAbsolute(stateRoot) || !uuid.test(jobId))
+        fail('invalid staging root or job id');
+    await directory(stateRoot, true);
+    const workspaces = resolve(stateRoot, 'workspaces');
+    await directory(workspaces, true);
+    const jobRoot = resolve(workspaces, jobId);
+    try {
+        await mkdir(jobRoot, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            fail('workspace collision');
+        throw error;
+    }
+    await directory(jobRoot, false);
+    const workspace = resolve(jobRoot, 'workspace');
+    await mkdir(workspace, { mode: 0o700 });
+    await directory(workspace, false);
+    const files = request.files ?? [];
+    for (const file of files) {
+        const path = pathInput(file.path);
+        if (typeof file.content !== 'string')
+            fail('invalid staged file');
+        const parent = await privateParents(workspace, path);
+        const target = resolve(parent, path.slice(path.lastIndexOf('/') + 1));
+        const handle = await open(target, 'wx', 0o600);
+        try {
+            await handle.writeFile(file.content, 'utf8');
+            await handle.chmod(0o600);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return workspace;
+}
+//# sourceMappingURL=workspace.js.map

package/lib/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAG/C,MAAM,OAAO,GAAG,MAAM,CAAA;AACtB,MAAM,OAAO,GAAG,WAAW,CAAA;AAC3B,MAAM,IAAI,GAAG,6EAA6E,CAAA;AAC1F,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AACpG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAA;AAC1G,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AACzE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEnG,SAAS,WAAW,CAAC,KAAsB;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,EAAE;WACtE,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;WACxI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC1O,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY,EAAE,OAAO,GAAG,OAAO;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC7H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACxC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC7I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/F,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,cAAc,CAAC,MAAe,EAAE,IAAY,EAAE,OAAe;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO;QAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IAClG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAsB;IACxD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,KAAK,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;AACrJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,OAAyB,EAAE,MAAuB;IACjF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACvK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,iBAAiB,EAAE,GAAG,CAAC;WACpG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACnI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IAChG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,UAAU,CAAC,aAAa;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAChC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QACzM,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC9D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC3G,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC5H,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IACxL,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,UAAU,CAAC,aAAa;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC3G,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvG,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,eAAe;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACnG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,GAAG,SAAS;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;AACzP,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,MAAe;IACpD,IAAI,MAAM;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IACpF,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,YAAoB;IAC9D,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,KAAK,CAAC,GAAG,EAAE,CAAA;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAAC,CAAC;IAC9N,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa,EAAE,OAAyB;IAC9F,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACvF,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAChC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAAC,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;IAChK,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3H,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACpG,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC3H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAClH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "@dsh-enhanced/assistant-isolation",
+  "version": "0.1.30",
+  "description": "Finite owner-authorized offline Linux Docker jobs with durable audit and external revocation.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "runtime",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/22-ai-00/dsh-enhanced.git",
+    "directory": "plugins/assistant-isolation"
+  },
+  "keywords": [
+    "deepseek",
+    "deepseek-harness",
+    "dsh-plugin"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0",
+    "@dsh-enhanced/assistant-delivery": ">0.1.7 <0.2.0",
+    "@dsh-enhanced/assistant-policy": ">0.1.7 <0.2.0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.2-rc.1 <0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-agent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
+    },
+    "@dsh-enhanced/assistant-delivery": {
+      "optional": true
+    },
+    "@dsh-enhanced/assistant-policy": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@types/node": "22.20.0",
+    "typescript": "6.0.3",
+    "vitest": "4.1.8",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.2-rc.1",
+    "@dsh-enhanced/assistant-policy": "0.1.30",
+    "@dsh-enhanced/assistant-delivery": "0.1.30"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.2",
+    "@dsh-enhanced/task-acceptance-contract": "0.1.30"
+  },
+  "bin": {
+    "dsh-isolation": "./lib/cli.js"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}

package/runtime/supervisor.mjs

@@ -0,0 +1,290 @@
+import { spawn } from 'node:child_process'
+import { chmod, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const SOCKET = 'unix:///var/run/docker.sock'
+const OPERATION_TIMEOUT_MS = 10_000
+const NAME = /^dsh-isolation-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/
+const IMAGE = /^sha256:[0-9a-f]{64}$/
+let config
+let workerOwned = false
+let keeperOwned = false
+let volumeOwned = false
+let started = false
+let finalizing = false
+let complete = false
+let deadlineTimer
+let stdout = ''
+let stderr = ''
+let dockerDirectory
+let provisioning = Promise.resolve()
+let cancelReason
+let creationAmbiguous = false
+let mutationAmbiguous = false
+let requestsSettled = true
+const activeCommands = new Set()
+const workerName = () => config.containerName
+const keeperName = () => `${workerName()}-keeper`
+const volumeName = () => `${workerName()}-workspace`
+
+function environment() {
+  return { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }
+}
+function send(message) {
+  if (process.connected) { try { process.send(message) } catch {} }
+}
+function decode(buffer) {
+  try { return new TextDecoder('utf-8', { fatal: true }).decode(buffer) }
+  catch { return undefined }
+}
+function succeeded(result) {
+  return result.code === 0 && !result.timeout && !result.overflow
+}
+function docker(args, { outputLimit = 65_536, timeoutMs = OPERATION_TIMEOUT_MS } = {}) {
+  return new Promise(resolve => {
+    let child
+    let out = Buffer.alloc(0)
+    let err = Buffer.alloc(0)
+    let overflow = false
+    let timeout = false
+    let settled = false
+    let timer
+    const finish = result => {
+      if (settled) return
+      settled = true
+      if (timer !== undefined) clearTimeout(timer)
+      const mutating = ['create', 'start', 'cp', 'exec'].includes(args[0]) || (args[0] === 'volume' && args[1] === 'create')
+      if (mutating && (timeout || overflow || result.code === null)) mutationAmbiguous = true
+      if (mutating && (timeout || overflow || result.code !== 0 || result.signal || result.error)) requestsSettled = false
+      const decoded = decode(out)
+      resolve({ ...result, stdout: decoded ?? '', stderr: decode(err) ?? '', stdoutBytes: out.length,
+        stdoutUtf8: decoded !== undefined, overflow, timeout })
+    }
+    try {
+      child = spawn(config.dockerPath, ['--config', dockerDirectory, '-H', SOCKET, ...args], {
+        shell: false, env: environment(), stdio: ['ignore', 'pipe', 'pipe'],
+      })
+    } catch (error) { finish({ code: null, error: String(error) }); return }
+    activeCommands.add(child)
+    child.once('close', () => activeCommands.delete(child))
+    const collect = (target, chunk) => {
+      const kept = chunk.subarray(0, Math.max(0, outputLimit - out.length - err.length))
+      if (target === 'out') out = Buffer.concat([out, kept])
+      else err = Buffer.concat([err, kept])
+      if (kept.length !== chunk.length && !overflow) { overflow = true; child.kill('SIGTERM') }
+    }
+    child.stdout.on('data', chunk => collect('out', chunk))
+    child.stderr.on('data', chunk => collect('err', chunk))
+    child.once('error', error => finish({ code: null, error: error.message }))
+    // close, not exit: collect the final pipe bytes before accepting an artifact.
+    child.once('close', (code, signal) => finish({ code, signal }))
+    timer = setTimeout(() => { timeout = true; child.kill('SIGKILL') }, timeoutMs)
+    timer.unref()
+  })
+}
+async function absent(type, name) {
+  const result = await docker(['inspect', '--type', type, name])
+  return !result.timeout && !result.overflow && result.code !== 0
+    && /no such (object|container|volume)/i.test(result.stderr)
+}
+async function erase(type, name) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const result = await docker(type === 'volume' ? ['volume', 'rm', name] : ['rm', '-f', name])
+    if (succeeded(result) || await absent(type, name)) return true
+    if (attempt < 2) await new Promise(resolve => setTimeout(resolve, 100))
+  }
+  return false
+}
+async function removeWorker() {
+  if (!workerOwned) return true
+  await docker(['kill', workerName()])
+  return erase('container', workerName())
+}
+async function removeStorage() {
+  const keeperRemoved = !keeperOwned || await erase('container', keeperName())
+  const volumeRemoved = !volumeOwned || await erase('volume', volumeName())
+  return keeperRemoved && volumeRemoved
+}
+function artifactPath(path) {
+  return typeof path === 'string' && path.length > 0 && path.length <= 4096 && !path.startsWith('/')
+    && !/[\p{Cc}\\]/u.test(path) && path.split('/').every(part => part && part !== '.' && part !== '..')
+}
+function exportInterruption() {
+  if (cancelReason !== undefined) return cancelReason
+  return Date.now() >= config.deadline ? 'deadline-expired' : undefined
+}
+function exportTimeout() {
+  return Math.max(1, Math.min(OPERATION_TIMEOUT_MS, config.deadline - Date.now()))
+}
+async function stat(path, regular) {
+  if (exportInterruption()) return undefined
+  const result = await docker(['exec', keeperName(), '/bin/busybox', 'stat', '-c', '%f:%h:%s', '--', path], { timeoutMs: exportTimeout() })
+  if (!succeeded(result) || exportInterruption() || !/^[0-9a-fA-F]+:\d+:\d+\n?$/.test(result.stdout)) return undefined
+  const fields = result.stdout.trim().split(':')
+  const mode = Number.parseInt(fields[0], 16)
+  const links = Number(fields[1])
+  const size = Number(fields[2])
+  if (![mode, links, size].every(Number.isSafeInteger)) return undefined
+  // BusyBox stat without -L examines the link itself. Each parent is examined
+  // separately after worker removal, so no worker can race path resolution.
+  if (regular ? (mode & 0o170000) !== 0o100000 || links !== 1 : (mode & 0o170000) !== 0o40000) return undefined
+  return { size }
+}
+async function exportArtifacts() {
+  const files = []
+  let total = 0
+  for (const path of config.artifacts) {
+    if (exportInterruption() || !artifactPath(path)) return undefined
+    let parent = '/workspace'
+    if (!await stat(parent, false)) return undefined
+    const parts = path.split('/')
+    for (const part of parts.slice(0, -1)) {
+      parent += `/${part}`
+      if (!await stat(parent, false)) return undefined
+    }
+    const target = `/workspace/${path}`
+    const entry = await stat(target, true)
+    if (!entry || entry.size > config.limits.maxArtifactBytes - total || exportInterruption()) return undefined
+    const result = await docker(['exec', keeperName(), '/bin/busybox', 'cat', '--', target], {
+      outputLimit: entry.size, timeoutMs: exportTimeout(),
+    })
+    if (!succeeded(result) || !result.stdoutUtf8 || result.stdoutBytes !== entry.size || exportInterruption()) return undefined
+    total += entry.size
+    files.push({ path, content: result.stdout })
+  }
+  return files
+}
+async function finish(status, reason, exitCode) {
+  if (finalizing) return
+  finalizing = true
+  if (deadlineTimer !== undefined) clearTimeout(deadlineTimer)
+  // Cleanup cannot overtake a create/copy request still owned by this process.
+  await provisioning
+  const workerRemoved = await removeWorker()
+  let artifacts = []
+  if (status === 'succeeded' && workerRemoved && keeperOwned) {
+    const exported = await exportArtifacts()
+    const interrupted = exportInterruption()
+    if (interrupted !== undefined) {
+      status = interrupted === 'deadline-expired' ? 'timed-out' : 'cancelled'
+      reason = interrupted
+    } else if (exported === undefined) {
+      status = 'failed'
+      reason = 'artifact-export-rejected'
+    } else artifacts = exported
+  }
+  const storageRemoved = await removeStorage()
+  // A final receipt must not outrun an attached start or other CLI still alive.
+  // No new create can follow provisioning; begin() stops when finalizing is set.
+  const outstanding = [...activeCommands]
+  await Promise.all(outstanding.map(child => new Promise(resolve => child.once('close', resolve))))
+  // A timed-out CLI can leave an in-flight daemon create request. A momentary
+  // absence is not a release receipt for such a request; retain its reservation.
+  const quiescent = workerRemoved && storageRemoved && !mutationAmbiguous
+  if (creationAmbiguous) reason = 'docker-creation-unconfirmed'
+  else if (mutationAmbiguous) reason = 'docker-mutation-unconfirmed'
+  if (!quiescent || status !== 'succeeded') artifacts = []
+  if (dockerDirectory !== undefined) await rm(dockerDirectory, { recursive: true, force: true }).catch(() => undefined)
+  complete = true
+  send({ type: 'result', settlementProtocol: 'all-cli-closed/v1', requestsSettled: requestsSettled && !mutationAmbiguous, result: { status: quiescent ? status : 'unknown', quiescent,
+    ...(exitCode === undefined ? {} : { exitCode }), stdout, stderr, artifacts,
+    ...(reason === undefined ? {} : { reason }) } })
+  if (process.connected) process.disconnect()
+}
+async function begin() {
+  const attached = await docker(['start', '--attach', workerName()], {
+    outputLimit: config.limits.maxOutputBytes, timeoutMs: Math.max(1, config.deadline - Date.now()),
+  })
+  stdout = attached.stdout
+  stderr = attached.stderr
+  if (finalizing) return
+  if (attached.overflow) { await finish('failed', 'output-limit-exceeded'); return }
+  if (attached.timeout) { await finish('unknown', 'docker-start-timeout'); return }
+  const inspected = await docker(['inspect', '--type', 'container', '--format', '{{json .State}}', workerName()])
+  let state
+  try { state = JSON.parse(inspected.stdout) } catch {}
+  if (!succeeded(inspected) || typeof state?.Running !== 'boolean' || state.Running || !Number.isSafeInteger(state.ExitCode)) {
+    await finish('unknown', 'container-state-unconfirmed')
+    return
+  }
+  await finish(state.ExitCode === 0 ? 'succeeded' : 'failed', state.ExitCode === 0 ? undefined : 'container-exited-nonzero', state.ExitCode)
+}
+function valid(input) {
+  return input && NAME.test(input.containerName) && IMAGE.test(input.image)
+    && typeof input.dockerPath === 'string' && input.dockerPath.startsWith('/')
+    && typeof input.workspacePath === 'string' && input.workspacePath.startsWith('/') && !/[\p{Cc},]/u.test(input.workspacePath)
+    && typeof input.command === 'string' && Number.isSafeInteger(input.deadline)
+    && input.limits && Object.values(input.limits).every(value => typeof value === 'number' && Number.isFinite(value) && value > 0)
+    && Array.isArray(input.artifacts) && input.artifacts.length <= input.limits.maxFiles && input.artifacts.every(artifactPath)
+}
+function sandbox(keeper = false) {
+  const memory = keeper ? '32m' : `${Math.floor(config.limits.memoryMiB)}m`
+  const flags = ['--network', 'none', '--read-only', '--log-driver', 'none', '--cap-drop', 'ALL',
+    '--security-opt', 'no-new-privileges', '--user', `${process.getuid()}:${process.getgid()}`,
+    '--pids-limit', keeper ? '16' : String(Math.floor(config.limits.pidsLimit)), '--memory', memory, '--memory-swap', memory,
+    '--shm-size', '1m', '--cpus', String(config.limits.cpus)]
+  if (!keeper) {
+    const tmpMiB = Math.max(1, Math.min(64, Math.floor(config.limits.memoryMiB / 4)))
+    flags.push('--tmpfs', `/tmp:rw,nosuid,nodev,size=${tmpMiB}m,nr_inodes=${Math.floor(config.limits.workspaceInodes)}`)
+  }
+  return flags
+}
+function creationResult(result) {
+  if (result.timeout || result.overflow || result.code === null) creationAmbiguous = true
+  return !finalizing && succeeded(result)
+}
+async function provision() {
+  const inspected = await docker(['image', 'inspect', '--format', '{{json .Config.Volumes}}', config.image])
+  if (finalizing || !succeeded(inspected) || !['null', '{}'].includes(inspected.stdout.trim())) return false
+  // Mark each unique resource owned before sending its create request, including
+  // the timeout / lost-ack window. No resource name comes from the model.
+  volumeOwned = true
+  const options = `o=size=${Math.floor(config.limits.workspaceMiB)}m,nr_inodes=${Math.floor(config.limits.workspaceInodes)},uid=${process.getuid()},gid=${process.getgid()},mode=0700,nosuid,nodev`
+  if (!creationResult(await docker(['volume', 'create', '--driver', 'local', '--opt', 'type=tmpfs', '--opt', 'device=tmpfs', '--opt', options, volumeName()]))) return false
+  keeperOwned = true
+  if (!creationResult(await docker(['create', '--pull', 'never', '--name', keeperName(), ...sandbox(true),
+    '--mount', `type=volume,src=${volumeName()},dst=/workspace,volume-nocopy`, '--entrypoint', '/bin/busybox', config.image, 'sleep', '3600']))) return false
+  if (!succeeded(await docker(['start', keeperName()])) || finalizing) return false
+  if (!succeeded(await docker(['cp', '-a', `${config.workspacePath}/.`, `${keeperName()}:/workspace`])) || finalizing) return false
+  workerOwned = true
+  return creationResult(await docker(['create', '--pull', 'never', '--name', workerName(), ...sandbox(),
+    '--mount', `type=volume,src=${volumeName()},dst=/workspace,volume-nocopy`, '--workdir', '/workspace',
+    '--entrypoint', '/bin/sh', config.image, '-c', config.command]))
+}
+async function configure(input) {
+  if (config !== undefined || !valid(input)) { send({ type: 'error', reason: 'invalid-supervisor-config' }); return }
+  if (process.platform !== 'linux' || typeof process.getuid !== 'function' || typeof process.getgid !== 'function' || process.getuid() === 0) {
+    send({ type: 'error', reason: 'non-root-linux-host-required' })
+    return
+  }
+  config = input
+  try {
+    dockerDirectory = await mkdtemp(join(tmpdir(), 'dsh-isolation-docker-'))
+    await chmod(dockerDirectory, 0o700)
+  } catch { await finish('failed', 'docker-config-directory-unavailable'); return }
+  if (finalizing) { await rm(dockerDirectory, { recursive: true, force: true }).catch(() => undefined); return }
+  if (config.deadline <= Date.now()) { await finish('timed-out', 'deadline-expired-before-create'); return }
+  deadlineTimer = setTimeout(() => { void finish('timed-out', 'deadline-expired') }, config.deadline - Date.now())
+  deadlineTimer.unref()
+  let markSettled
+  provisioning = new Promise(resolve => { markSettled = resolve })
+  let prepared = false
+  try { prepared = await provision() } finally { markSettled() }
+  if (finalizing) return
+  if (!prepared) { await finish('failed', 'docker-create-failed'); return }
+  if (!process.connected) { await finish('unknown', 'parent-disconnected-before-authorization'); return }
+  send({ type: 'ready' })
+}
+process.on('message', message => {
+  if (!message || typeof message !== 'object') return
+  if (message.type === 'configure') void configure(message.config)
+  else if (message.type === 'start' && config !== undefined && !finalizing && !started) { started = true; void begin() }
+  else if (message.type === 'cancel' && config !== undefined) {
+    cancelReason = typeof message.reason === 'string' ? message.reason : 'cancelled'
+    void finish(cancelReason === 'deadline-expired' ? 'timed-out' : 'cancelled', cancelReason)
+  }
+})
+process.on('disconnect', () => {
+  if (config !== undefined && !complete) { cancelReason = 'parent-ipc-disconnected'; void finish('unknown', cancelReason) }
+})