@dsh-enhanced/assistant-isolation 0.1.30

package/lib/daemon-binding.js

@@ -0,0 +1,120 @@
+import { spawn } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { processWitness } from './runtime-witness.js';
+const systemctl = '/usr/bin/systemctl';
+const outputMaximum = 16_384;
+const invocationId = /^[0-9a-f]{32}$/;
+const pid = /^[1-9][0-9]*$/;
+const properties = ['MainPID', 'InvocationID', 'ActiveState', 'SubState', 'TriggeredBy', 'Triggers', 'Listen', 'ExecStart'];
+const required = {
+    'docker.service': ['MainPID', 'InvocationID', 'ActiveState', 'SubState', 'TriggeredBy', 'ExecStart'],
+    'docker.socket': ['InvocationID', 'ActiveState', 'SubState', 'Triggers', 'Listen'],
+};
+function equalUnit(left, right) { return properties.every(key => left[key] === right[key]); }
+function includesUnit(value, unit) { return value.split(/\s+/).includes(unit); }
+async function show(unit) {
+    return await new Promise(resolve => {
+        let stdout = Buffer.alloc(0);
+        let stderr = Buffer.alloc(0);
+        let complete = false;
+        let timeout;
+        const finish = (value) => { if (complete)
+            return; complete = true; if (timeout !== undefined)
+            clearTimeout(timeout); resolve(value); };
+        let child;
+        try {
+            child = spawn(systemctl, ['show', unit, ...properties.map(property => `--property=${property}`)], { shell: false, env: { LANG: 'C', LC_ALL: 'C' }, stdio: ['ignore', 'pipe', 'pipe'] });
+        }
+        catch {
+            finish(undefined);
+            return;
+        }
+        const collect = (target, chunk) => {
+            const bytes = stdout.length + stderr.length + chunk.length;
+            if (bytes > outputMaximum) {
+                child.kill('SIGKILL');
+                finish(undefined);
+                return;
+            }
+            if (target === 'stdout')
+                stdout = Buffer.concat([stdout, chunk]);
+            else
+                stderr = Buffer.concat([stderr, chunk]);
+        };
+        child.stdout?.on('data', chunk => collect('stdout', chunk));
+        child.stderr?.on('data', chunk => collect('stderr', chunk));
+        child.once('error', () => finish(undefined));
+        child.once('close', code => {
+            if (code !== 0 || stderr.length !== 0) {
+                finish(undefined);
+                return;
+            }
+            const values = new Map();
+            for (const line of stdout.toString('utf8').split('\n').filter(Boolean)) {
+                const separator = line.indexOf('=');
+                if (separator <= 0) {
+                    finish(undefined);
+                    return;
+                }
+                const key = line.slice(0, separator);
+                const value = line.slice(separator + 1);
+                if (!properties.includes(key) || values.has(key)) {
+                    finish(undefined);
+                    return;
+                }
+                values.set(key, value);
+            }
+            if (required[unit].some(property => !values.has(property))) {
+                finish(undefined);
+                return;
+            }
+            finish(Object.fromEntries(properties.map(property => [property, values.get(property) ?? ''])));
+        });
+        timeout = setTimeout(() => { child.kill('SIGKILL'); finish(undefined); }, 5_000);
+        timeout.unref();
+    });
+}
+function matches(daemon, service, socket) {
+    if (!pid.test(service.MainPID) || Number(service.MainPID) !== daemon.process.pid || !invocationId.test(service.InvocationID) || !invocationId.test(socket.InvocationID)
+        || service.ActiveState !== 'active' || service.SubState !== 'running' || socket.ActiveState !== 'active' || socket.SubState !== 'running'
+        || !includesUnit(service.TriggeredBy, 'docker.socket') || !includesUnit(socket.Triggers, 'docker.service') || socket.Listen !== `${daemon.socketPath} (Stream)`
+        || !/\bpath=\/usr\/bin\/dockerd\b/.test(service.ExecStart) || !/\bargv\[\]=.*\bdockerd -H fd:\/\//.test(service.ExecStart))
+        return undefined;
+    return { kind: 'systemd', serviceInvocationId: service.InvocationID, socketInvocationId: socket.InvocationID };
+}
+function sameProcess(left, daemon) {
+    return !!left && left.bootId === daemon.process.bootId && left.pid === daemon.process.pid && left.startTicks === daemon.process.startTicks;
+}
+async function dockerdFdCommand(pid) {
+    try {
+        const arguments_ = (await readFile(`/proc/${pid}/cmdline`)).toString('utf8').split('\0').filter(Boolean);
+        return basename(arguments_[0] ?? '') === 'dockerd' && arguments_.some((value, index) => value === '-H' && arguments_[index + 1] === 'fd://');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Attests the systemd configuration chain, not a kernel-level ownership proof
+ * for a particular inherited file descriptor. Every missing or changing datum
+ * is rejected so callers retain uncertainty rather than freeing work.
+ */
+export async function captureSystemdBinding(daemon) {
+    if (!daemon || typeof daemon !== 'object' || daemon.socketPath !== '/run/docker.sock')
+        return undefined;
+    if (!sameProcess(await processWitness(daemon.process.pid), daemon))
+        return undefined;
+    const [firstService, firstSocket] = await Promise.all([show('docker.service'), show('docker.socket')]);
+    if (!firstService || !firstSocket || !matches(daemon, firstService, firstSocket) || !await dockerdFdCommand(daemon.process.pid))
+        return undefined;
+    if (!sameProcess(await processWitness(daemon.process.pid), daemon))
+        return undefined;
+    const [secondService, secondSocket] = await Promise.all([show('docker.service'), show('docker.socket')]);
+    if (!secondService || !secondSocket || !equalUnit(firstService, secondService) || !equalUnit(firstSocket, secondSocket))
+        return undefined;
+    if (!sameProcess(await processWitness(daemon.process.pid), daemon) || !await dockerdFdCommand(daemon.process.pid))
+        return undefined;
+    return matches(daemon, secondService, secondSocket);
+}
+//# sourceMappingURL=daemon-binding.js.map

package/lib/daemon-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-binding.js","sourceRoot":"","sources":["../src/daemon-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD,MAAM,SAAS,GAAG,oBAAoB,CAAA;AACtC,MAAM,aAAa,GAAG,MAAM,CAAA;AAC5B,MAAM,YAAY,GAAG,gBAAgB,CAAA;AACrC,MAAM,GAAG,GAAG,eAAe,CAAA;AAC3B,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AAEpI,MAAM,QAAQ,GAAG;IACf,gBAAgB,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC;IACpG,eAAe,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;CAC1E,CAAA;AAEV,SAAS,SAAS,CAAC,IAAU,EAAE,KAAW,IAAa,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC,CAAC;AACjH,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY,IAAa,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AAExG,KAAK,UAAU,IAAI,CAAC,IAAwC;IAC1D,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACjC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,OAAmC,CAAA;QACzH,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAQ,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAA;QAC7J,IAAI,KAA+B,CAAA;QACnC,IAAI,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAC/L,MAAM,CAAC;YAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;YAC1D,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;;gBAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;QAChH,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC3D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;YACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;gBAC7E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAkC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAC9G,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACzF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAS,CAAC,CAAA;QACxG,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/E,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAqB,EAAE,OAAa,EAAE,MAAY;IACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;WAClK,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;WACtI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,WAAW;WAC5J,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9I,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,YAAY,EAAE,kBAAkB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAA;AAChH,CAAC;AAED,SAAS,WAAW,CAAC,IAAqE,EAAE,MAAqB;IAC/G,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC,UAAU,CAAA;AAC5I,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxG,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAA;IAC9I,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAqB;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAA;IACvG,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACtG,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACjJ,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACxG,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC;QAAE,OAAO,SAAS,CAAA;IACzI,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACnI,OAAO,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;AACrD,CAAC"}

package/lib/diagnostics.d.ts

@@ -0,0 +1,19 @@
+import type { IsolationGrant } from './types.js';
+export type IsolationGrantDiagnosticReason = 'database-missing' | 'database-unavailable' | 'database-corrupt' | 'schema-unsupported' | 'grant-missing' | 'grant-config-mismatch' | 'grant-revoked' | 'grant-expired' | 'max-runs-exhausted' | 'duration-budget-exhausted';
+export interface IsolationGrantDiagnostic {
+    readonly status: 'available' | 'ineligible' | 'unavailable';
+    readonly reasons: readonly IsolationGrantDiagnosticReason[];
+    readonly runsUsed: number | null;
+    readonly durationReservedMs: number | null;
+    readonly remainingRuns: number | null;
+    readonly remainingDurationMs: number | null;
+    readonly activeJobs: number | null;
+    readonly unknownJobs: number | null;
+}
+/** Read-only ledger inspection for an operator doctor. It never creates, migrates, leases, or consumes grants. */
+export declare function inspectIsolationGrant(input: {
+    stateRoot: string;
+    grant: IsolationGrant;
+    now?: number;
+}): IsolationGrantDiagnostic;
+//# sourceMappingURL=diagnostics.d.ts.map

package/lib/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,MAAM,MAAM,8BAA8B,GACtC,kBAAkB,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,GACvF,eAAe,GAAG,uBAAuB,GAAG,eAAe,GAAG,eAAe,GAC7E,oBAAoB,GAAG,2BAA2B,CAAA;AAEtD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,GAAG,aAAa,CAAA;IAC3D,QAAQ,CAAC,OAAO,EAAE,SAAS,8BAA8B,EAAE,CAAA;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAiCD,kHAAkH;AAClH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAqDjI"}

package/lib/diagnostics.js

@@ -0,0 +1,122 @@
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+const DIGEST = /^[a-f0-9]{64}$/u;
+const TEXT = /^[^\p{Cc}]{1,4096}$/u;
+const positive = (value) => Number.isSafeInteger(value) && value > 0;
+const timestamp = (value) => Number.isSafeInteger(value) && value >= 0;
+function freeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const item of Object.values(value))
+            freeze(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+function unavailable(reason) {
+    return freeze({ status: 'unavailable', reasons: freeze([reason]), runsUsed: null, durationReservedMs: null,
+        remainingRuns: null, remainingDurationMs: null, activeJobs: null, unknownJobs: null });
+}
+function validate(input) {
+    const grantKeys = ['id', 'revision', 'principalDigest', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset', 'expiresAt', 'maxRuns', 'maxTotalDurationMs'];
+    if (input === null || typeof input !== 'object' || Object.getPrototypeOf(input) !== Object.prototype || Object.keys(input).some(key => key !== 'stateRoot' && key !== 'grant' && key !== 'now')
+        || typeof input.stateRoot !== 'string' || !isAbsolute(input.stateRoot) || resolve(input.stateRoot) !== input.stateRoot || input.stateRoot === '/' || /[\p{Cc}]/u.test(input.stateRoot)
+        || !input.grant || typeof input.grant !== 'object' || Object.getPrototypeOf(input.grant) !== Object.prototype || Object.keys(input.grant).length !== grantKeys.length || grantKeys.some(key => !Object.hasOwn(input.grant, key)))
+        throw new Error('invalid isolation grant diagnostic input');
+    const grant = input.grant;
+    if (typeof grant.id !== 'string' || !TEXT.test(grant.id) || !positive(grant.revision) || typeof grant.principalDigest !== 'string' || !DIGEST.test(grant.principalDigest) || typeof grant.principalRecordId !== 'string' || !TEXT.test(grant.principalRecordId)
+        || !positive(grant.principalVersion) || typeof grant.workspace !== 'string' || !isAbsolute(grant.workspace) || resolve(grant.workspace) !== grant.workspace || /[\p{Cc}]/u.test(grant.workspace)
+        || typeof grant.agentPreset !== 'string' || !TEXT.test(grant.agentPreset) || !positive(grant.expiresAt) || !positive(grant.maxRuns) || !positive(grant.maxTotalDurationMs))
+        throw new Error('invalid isolation grant diagnostic input');
+    const now = input.now ?? Date.now();
+    if (!timestamp(now))
+        throw new Error('invalid isolation grant diagnostic clock');
+    return { stateRoot: input.stateRoot, grant: freeze({ ...grant }), now };
+}
+function safeCount(value) { return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined; }
+/** Read-only ledger inspection for an operator doctor. It never creates, migrates, leases, or consumes grants. */
+export function inspectIsolationGrant(input) {
+    const { stateRoot, grant, now } = validate(input);
+    const path = join(stateRoot, 'ledger.sqlite');
+    if (!existsSync(path) && !existsSync(stateRoot))
+        return unavailable('database-missing');
+    try {
+        const root = lstatSync(stateRoot);
+        if (!root.isDirectory() || root.isSymbolicLink() || realpathSync(stateRoot) !== stateRoot
+            || root.uid !== process.getuid?.() || (root.mode & 0o077) !== 0)
+            return unavailable('database-unavailable');
+        const file = lstatSync(path);
+        if (!file.isFile() || file.isSymbolicLink() || file.uid !== process.getuid?.())
+            return unavailable('database-unavailable');
+    }
+    catch {
+        return existsSync(stateRoot) ? unavailable('database-unavailable') : unavailable('database-missing');
+    }
+    let database;
+    let transaction = false;
+    try {
+        database = new DatabaseSync(path, { readOnly: true });
+        database.exec('PRAGMA query_only=ON; PRAGMA busy_timeout=250; BEGIN;');
+        transaction = true;
+        const version = database.prepare('PRAGMA user_version').get().user_version;
+        if (version !== 6)
+            return unavailable('schema-unsupported');
+        const schema = database.prepare("SELECT value FROM schema_meta WHERE key='schema-version'").get();
+        if (schema?.value !== '6')
+            return unavailable('schema-unsupported');
+        const row = database.prepare('SELECT revision, expires_at, max_runs, max_total_duration_ms, revoked, principal_digest, principal_record_id, principal_version, workspace, agent_preset FROM isolation_grants WHERE id=?').get(grant.id);
+        if (row !== undefined) {
+            const positiveFields = ['revision', 'expires_at', 'max_runs', 'max_total_duration_ms', 'principal_version'];
+            if (positiveFields.some(key => !positive(row[key])) || (row.revoked !== 0 && row.revoked !== 1) || typeof row.principal_digest !== 'string' || typeof row.principal_record_id !== 'string' || typeof row.workspace !== 'string' || typeof row.agent_preset !== 'string')
+                return unavailable('database-corrupt');
+        }
+        const usage = database.prepare('SELECT COUNT(*) AS runs, COALESCE(SUM(reserved_duration_ms), 0) AS duration FROM isolation_jobs WHERE grant_id=?').get(grant.id);
+        const active = database.prepare("SELECT COUNT(*) AS active FROM isolation_jobs WHERE grant_id=? AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent')=0))").get(grant.id);
+        const unknown = database.prepare("SELECT COUNT(*) AS unknown_jobs FROM isolation_jobs WHERE grant_id=? AND (status='unknown' OR (result_json IS NOT NULL AND json_extract(result_json, '$.status')='unknown'))").get(grant.id);
+        const runsUsed = safeCount(usage.runs);
+        const durationReservedMs = safeCount(usage.duration);
+        const activeJobs = safeCount(active.active);
+        const unknownJobs = safeCount(unknown.unknown_jobs);
+        if (runsUsed === undefined || durationReservedMs === undefined || activeJobs === undefined || unknownJobs === undefined)
+            return unavailable('database-corrupt');
+        const remainingRuns = Math.max(0, grant.maxRuns - runsUsed);
+        const remainingDurationMs = Math.max(0, grant.maxTotalDurationMs - durationReservedMs);
+        const reasons = [];
+        if (row === undefined)
+            reasons.push('grant-missing');
+        else {
+            const mismatch = row.revision !== grant.revision || row.expires_at !== grant.expiresAt || row.max_runs !== grant.maxRuns || row.max_total_duration_ms !== grant.maxTotalDurationMs
+                || row.principal_digest !== grant.principalDigest || row.principal_record_id !== grant.principalRecordId || row.principal_version !== grant.principalVersion || row.workspace !== grant.workspace || row.agent_preset !== grant.agentPreset;
+            if (mismatch)
+                reasons.push('grant-config-mismatch');
+            if (row.revoked === 1)
+                reasons.push('grant-revoked');
+        }
+        if (grant.expiresAt <= now)
+            reasons.push('grant-expired');
+        if (runsUsed >= grant.maxRuns)
+            reasons.push('max-runs-exhausted');
+        if (durationReservedMs >= grant.maxTotalDurationMs)
+            reasons.push('duration-budget-exhausted');
+        return freeze({ status: reasons.length === 0 ? 'available' : 'ineligible', reasons: freeze(reasons), runsUsed, durationReservedMs,
+            remainingRuns, remainingDurationMs, activeJobs, unknownJobs });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message.toLowerCase() : '';
+        return unavailable(message.includes('malformed') || message.includes('database disk image') || message.includes('not a database') ? 'database-corrupt' : 'database-unavailable');
+    }
+    finally {
+        if (transaction)
+            try {
+                database?.exec('COMMIT');
+            }
+            catch {
+                try {
+                    database?.exec('ROLLBACK');
+                }
+                catch { }
+            }
+        database?.close();
+    }
+}
+//# sourceMappingURL=diagnostics.js.map

package/lib/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAmB1C,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,IAAI,GAAG,sBAAsB,CAAA;AACnC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAA;AAC1G,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAA;AAE5G,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,WAAW,CAAC,MAAwI;IAC3J,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;QACxG,aAAa,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1F,CAAC;AACD,SAAS,QAAQ,CAAC,KAAiE;IACjF,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;IAC1K,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,CAAC;WAC1L,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WACnL,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC/R,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAC1P,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WAC7L,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACzO,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAChF,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAA;AACzE,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,IAAwB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA,CAAC,CAAC;AAE5J,kHAAkH;AAClH,MAAM,UAAU,qBAAqB,CAAC,KAAiE;IACrG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC,kBAAkB,CAAC,CAAA;IACvF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS;eACpF,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAC7G,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,OAAO,WAAW,CAAC,sBAAsB,CAAC,CAAA;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,QAAkC,CAAA;IACtC,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAAC,WAAW,GAAG,IAAI,CAAA;QAC1F,MAAM,OAAO,GAAI,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAiC,CAAC,YAAY,CAAA;QAC1G,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAqC,CAAA;QACpI,IAAI,MAAM,EAAE,KAAK,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAA;QACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,2LAA2L,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAwC,CAAA;QAC9Q,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,mBAAmB,CAAU,CAAA;YACpH,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC,kBAAkB,CAAC,CAAA;QACjT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,kHAAkH,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAA2C,CAAA;QAC1M,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,mLAAmL,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAyB,CAAA;QAC1P,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,8KAA8K,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAA+B,CAAA;QAC5P,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9L,IAAI,QAAQ,KAAK,SAAS,IAAI,kBAAkB,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,kBAAkB,CAAC,CAAA;QAC/J,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;QAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,kBAAkB,GAAG,kBAAkB,CAAC,CAAA;QACnJ,MAAM,OAAO,GAAqC,EAAE,CAAA;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;aAC/C,CAAC;YACJ,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,qBAAqB,KAAK,KAAK,CAAC,kBAAkB;mBAC7K,GAAG,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe,IAAI,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,iBAAiB,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC,gBAAgB,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAA;YAC7O,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;YACnD,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACzD,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACjE,IAAI,kBAAkB,IAAI,KAAK,CAAC,kBAAkB;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC7F,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,kBAAkB;YAC/H,aAAa,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,OAAO,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAA;IAClL,CAAC;YAAS,CAAC;QACT,IAAI,WAAW;YAAE,IAAI,CAAC;gBAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC;oBAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAAC,CAAC;QACvG,QAAQ,EAAE,KAAK,EAAE,CAAA;IACnB,CAAC;AACH,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,19 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { version } from './version.js';
+import { AssistantIsolationService, Config } from './service.js';
+export declare const name = "dsh-enhanced-assistant-isolation";
+export { version, AssistantIsolationService, Config };
+export { IsolatedVerifierRunner, type IsolatedVerifierRunnerConfig } from './verifier-runner.js';
+export { inspectIsolationGrant, type IsolationGrantDiagnostic, type IsolationGrantDiagnosticReason } from './diagnostics.js';
+export { probeIsolationRuntime } from './probe.js';
+export * from './audit-archive.js';
+export { isolationPrincipalDigest } from './service.js';
+export type * from './types.js';
+export declare function apply(ctx: Context, config?: Config): void;
+declare const _default: {
+    name: string;
+    Config: import("@deepseek-ai/schemastery").default<Config>;
+    apply: typeof apply;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,eAAO,MAAM,IAAI,qCAAqC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,qBAAqB,EAAE,KAAK,wBAAwB,EAAE,KAAK,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AAC5H,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AACvD,mBAAmB,YAAY,CAAA;AAE/B,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAA+C;;;;;;AAE7G,wBAAsC"}

package/lib/index.js

@@ -0,0 +1,13 @@
+import { version } from './version.js';
+import { AssistantIsolationService, Config } from './service.js';
+export const name = 'dsh-enhanced-assistant-isolation';
+export { version, AssistantIsolationService, Config };
+export { IsolatedVerifierRunner } from './verifier-runner.js';
+export { inspectIsolationGrant } from './diagnostics.js';
+export { probeIsolationRuntime } from './probe.js';
+export * from './audit-archive.js';
+export { isolationPrincipalDigest } from './service.js';
+export function apply(ctx, config = {}) { new AssistantIsolationService(ctx, config); }
+// Loader unwraps the default export; preserve the trusted plugin identity there.
+export default { name, Config, apply };
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,MAAM,CAAC,MAAM,IAAI,GAAG,kCAAkC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAqC,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,qBAAqB,EAAsE,MAAM,kBAAkB,CAAA;AAC5H,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAGvD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAiB,EAAE,IAAU,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC;AAC7G,iFAAiF;AACjF,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA"}

package/lib/ledger.d.ts

@@ -0,0 +1,88 @@
+import { type CreationWitness, type DaemonWitness } from './runtime-witness.js';
+import type { SystemdBinding } from './daemon-binding.js';
+import { type IsolationCleanupReceipt } from './cleanup-receipt.js';
+import type { IsolationArtifactBinding, IsolationGrant, IsolationIdentity, IsolationJob, IsolationResult, IsolationStorageBudget } from './types.js';
+export type IsolationLedgerErrorCode = 'conflict' | 'invalid-input' | 'invalid-path' | 'invalid-state' | 'not-found' | 'schema' | 'schema-too-new' | 'unauthorized';
+export declare class IsolationLedgerError extends Error {
+    readonly code: IsolationLedgerErrorCode;
+    constructor(code: IsolationLedgerErrorCode, message?: string);
+}
+export interface IsolationControllerAuthority {
+    ownerId: string;
+    fence: number;
+}
+type ResourceReservation = {
+    memoryMiB: number;
+    workspaceInodes: number;
+    maxMemoryMiB: number;
+    maxWorkspaceInodes: number;
+};
+/** Durable Host-owned authorization and job state. This database is never mounted in workers. */
+export declare class IsolationLedger {
+    #private;
+    constructor(path: string, { now }?: {
+        now?: () => number;
+    });
+    syncGrants(grants: IsolationGrant[], authority?: IsolationControllerAuthority): void;
+    prepare(input: {
+        identity: IsolationIdentity;
+        sessionId: string;
+        grantId: string;
+        idempotencyKey: string;
+        requestDigest: string;
+        durationMs: number;
+        maxActiveJobs?: number;
+        authority?: IsolationControllerAuthority;
+        resourceReservation?: ResourceReservation;
+        storageBudget?: IsolationStorageBudget;
+        artifactBinding?: IsolationArtifactBinding;
+    }): {
+        job: IsolationJob;
+        created: boolean;
+    };
+    /** Commit the crash boundary before a supervisor can receive create authority. */
+    markDispatched(jobId: string, expectedVersion: number, authority: IsolationControllerAuthority): IsolationJob;
+    start(jobId: string, expectedVersion: number, authority?: IsolationControllerAuthority): IsolationJob;
+    settle(jobId: string, expectedVersion: number, input: IsolationResult, authority?: IsolationControllerAuthority, creationWitness?: CreationWitness): IsolationJob;
+    /** Host-only release after exact cleanup; outcome and origin evidence remain immutable. */
+    settleReconciledUnknown(jobId: string, expectedVersion: number, proof: {
+        original: CreationWitness;
+        current: DaemonWitness;
+        currentBinding?: SystemdBinding;
+        checkedAt: number;
+        cleanup: IsolationCleanupReceipt;
+    }, authority: IsolationControllerAuthority): IsolationJob;
+    revoke(grantId: string, revision: number, reason: string): void;
+    claimController(ownerId: string, ttlMs: number): IsolationControllerAuthority;
+    renewController(authority: IsolationControllerAuthority, ttlMs: number): boolean;
+    releaseController(authority: IsolationControllerAuthority): void;
+    hasController(authority: IsolationControllerAuthority): boolean;
+    get(jobId: string): IsolationJob | undefined;
+    recoverable(afterId?: string): IsolationJob[];
+    retentionCandidates(cutoff: number, afterId?: string, limit?: number): Array<{
+        id: string;
+        version: number;
+    }>;
+    compactResult(id: string, expectedVersion: number, cutoff: number, authority: IsolationControllerAuthority): {
+        changed: boolean;
+        removedBytes: number;
+    };
+    storageStats(): {
+        jobRecords: number;
+        reusableBytes: number;
+        activeReservedBytes: number;
+        legacyActiveJobs: number;
+    };
+    maintainStorage(authority: IsolationControllerAuthority): {
+        checkpoint: 'complete' | 'busy';
+        reclaimMode: 'incremental' | 'page-reuse';
+    };
+    /** Newer declared output attempts mask older success, including failed/unknown attempts. */
+    acceptedArtifactJob(contractId: string, contractDigest: string, path: string): IsolationJob | undefined;
+    /** Read-only current grant check for the exact native tool preauthorization. */
+    permitsGrant(value: IsolationIdentity, grantId: string): boolean;
+    usable(jobId: string): boolean;
+    close(): void;
+}
+export {};
+//# sourceMappingURL=ledger.d.ts.map

package/lib/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6D,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC1I,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAe,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAEhF,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAmB,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAErK,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAEnK,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,wBAAwB;gBAA9B,IAAI,EAAE,wBAAwB,EAAE,OAAO,GAAE,MAAa;CAC5E;AACD,MAAM,WAAW,4BAA4B;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAmDhF,KAAK,mBAAmB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAA;AA6C3H,iGAAiG;AACjG,qBAAa,eAAe;;gBAGd,IAAI,EAAE,MAAM,EAAE,EAAE,GAAc,EAAE,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAgCzE,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,EAAE,4BAA4B,GAAG,IAAI;IAcpF,OAAO,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,4BAA4B,CAAC;QAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;QAAC,eAAe,CAAC,EAAE,wBAAwB,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAgDhY,kFAAkF;IAClF,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAiB7G,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,4BAA4B,GAAG,YAAY;IAUrG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,4BAA4B,EAAE,eAAe,CAAC,EAAE,eAAe,GAAG,YAAY;IAwBjK,2FAA2F;IAC3F,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE;QACrE,QAAQ,EAAE,eAAe,CAAC;QAAC,OAAO,EAAE,aAAa,CAAC;QAAC,cAAc,CAAC,EAAE,cAAc,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KACxI,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAmCzD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAM/D,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,4BAA4B;IAY7E,eAAe,CAAC,SAAS,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhF,iBAAiB,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI;IAIhE,aAAa,CAAC,SAAS,EAAE,4BAA4B,GAAG,OAAO;IAC/D,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAC5C,WAAW,CAAC,OAAO,SAAK,GAAG,YAAY,EAAE;IACzC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK,EAAE,KAAK,SAAK,GAAG,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAMrG,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,4BAA4B,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAqBvJ,YAAY,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE;IAOpH,eAAe,CAAC,SAAS,EAAE,4BAA4B,GAAG;QAAE,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;QAAC,WAAW,EAAE,aAAa,GAAG,YAAY,CAAA;KAAE;IAmBxI,4FAA4F;IAC5F,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IASvG,gFAAgF;IAChF,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAQhE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9B,KAAK,IAAI,IAAI;CACd"}