@dsh-enhanced/assistant-isolation 0.1.67 → 0.1.70
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -68
- package/lib/cli.d.ts +2 -4
- package/lib/cli.d.ts.map +1 -1
- package/lib/cli.js +51 -77
- package/lib/cli.js.map +1 -1
- package/lib/config.d.ts +4 -7
- package/lib/config.d.ts.map +1 -1
- package/lib/config.js +26 -40
- package/lib/config.js.map +1 -1
- package/lib/index.d.ts +3 -3
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +2 -2
- package/lib/index.js.map +1 -1
- package/lib/ledger.d.ts +2 -13
- package/lib/ledger.d.ts.map +1 -1
- package/lib/ledger.js +7 -85
- package/lib/ledger.js.map +1 -1
- package/lib/probe.d.ts +0 -3
- package/lib/probe.d.ts.map +1 -1
- package/lib/probe.js +1 -41
- package/lib/probe.js.map +1 -1
- package/lib/service.d.ts +1 -1
- package/lib/service.d.ts.map +1 -1
- package/lib/service.js +10 -90
- package/lib/service.js.map +1 -1
- package/lib/types.d.ts +4 -31
- package/lib/types.d.ts.map +1 -1
- package/lib/verifier-runner.d.ts +8 -16
- package/lib/verifier-runner.d.ts.map +1 -1
- package/lib/verifier-runner.js +9 -207
- package/lib/verifier-runner.js.map +1 -1
- package/lib/version.d.ts +1 -1
- package/lib/version.js +1 -1
- package/package.json +8 -5
- package/lib/cleanup-receipt.d.ts +0 -28
- package/lib/cleanup-receipt.d.ts.map +0 -1
- package/lib/cleanup-receipt.js +0 -137
- package/lib/cleanup-receipt.js.map +0 -1
- package/lib/daemon-binding.d.ts +0 -13
- package/lib/daemon-binding.d.ts.map +0 -1
- package/lib/daemon-binding.js +0 -120
- package/lib/daemon-binding.js.map +0 -1
- package/lib/docker-socket.d.ts +0 -10
- package/lib/docker-socket.d.ts.map +0 -1
- package/lib/docker-socket.js +0 -43
- package/lib/docker-socket.js.map +0 -1
- package/lib/reconcile.d.ts +0 -5
- package/lib/reconcile.d.ts.map +0 -1
- package/lib/reconcile.js +0 -31
- package/lib/reconcile.js.map +0 -1
- package/lib/runner.d.ts +0 -12
- package/lib/runner.d.ts.map +0 -1
- package/lib/runner.js +0 -227
- package/lib/runner.js.map +0 -1
- package/lib/runtime-witness.d.ts +0 -32
- package/lib/runtime-witness.d.ts.map +0 -1
- package/lib/runtime-witness.js +0 -225
- package/lib/runtime-witness.js.map +0 -1
- package/lib/state-socket-binding.d.ts +0 -4
- package/lib/state-socket-binding.d.ts.map +0 -1
- package/lib/state-socket-binding.js +0 -64
- package/lib/state-socket-binding.js.map +0 -1
- package/runtime/supervisor.mjs +0 -300
package/lib/config.d.ts
CHANGED
|
@@ -3,15 +3,12 @@ import type { LinuxCgroupRoots } from './linux-cgroups.js';
|
|
|
3
3
|
import { type LinuxRuntime } from './linux-runtime.js';
|
|
4
4
|
import type { IsolationGrant, IsolationLimits, IsolationStoragePolicy } from './types.js';
|
|
5
5
|
export interface Config {
|
|
6
|
-
backend
|
|
7
|
-
linux
|
|
6
|
+
backend: 'linux-native';
|
|
7
|
+
linux: {
|
|
8
8
|
runtime: LinuxRuntime;
|
|
9
9
|
cgroupRoots: LinuxCgroupRoots;
|
|
10
10
|
};
|
|
11
11
|
stateRoot?: string;
|
|
12
|
-
image?: string;
|
|
13
|
-
dockerPath?: string;
|
|
14
|
-
socketPath?: string;
|
|
15
12
|
grants?: IsolationGrant[];
|
|
16
13
|
limits?: Partial<IsolationLimits>;
|
|
17
14
|
storage?: Partial<IsolationStoragePolicy>;
|
|
@@ -20,8 +17,8 @@ export interface Config {
|
|
|
20
17
|
maxReservedWorkspaceInodes?: number;
|
|
21
18
|
}
|
|
22
19
|
export declare const defaultLimits: IsolationLimits;
|
|
23
|
-
export type ValidatedConfig = Required<Omit<Config, '
|
|
24
|
-
linux
|
|
20
|
+
export type ValidatedConfig = Required<Omit<Config, 'limits' | 'storage'>> & {
|
|
21
|
+
linux: {
|
|
25
22
|
runtime: LinuxRuntime;
|
|
26
23
|
cgroupRoots: LinuxCgroupRoots;
|
|
27
24
|
};
|
package/lib/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAI7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAE1D,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAEzF,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,0BAA0B,CAAC,EAAE,MAAM,CAAA;CACpC;AACD,eAAO,MAAM,aAAa,EAAE,eACwH,CAAA;AAqBpJ,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,GAAG;IAC3E,KAAK,EAAE;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAA;CAC1H,CAAA;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAyC7D;AAED,6EAA6E;AAC7E,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAGd,CAAA"}
|
package/lib/config.js
CHANGED
|
@@ -1,19 +1,16 @@
|
|
|
1
1
|
import Schema from '@deepseek-ai/schemastery';
|
|
2
2
|
import { homedir } from 'node:os';
|
|
3
3
|
import { isAbsolute, join, resolve, sep } from 'node:path';
|
|
4
|
-
import { defaultStoragePolicy,
|
|
5
|
-
import { configuredDockerSocketPath } from './docker-socket.js';
|
|
4
|
+
import { defaultStoragePolicy, validateStoragePolicy } from './storage-policy.js';
|
|
6
5
|
import { linuxJobResourceReservation, validateLinuxExecutionContract } from './linux-execution-contract.js';
|
|
7
6
|
import { linuxRuntimeDigest, validateLinuxRuntime } from './linux-runtime.js';
|
|
8
7
|
export const defaultLimits = { maxDurationMs: 60_000, maxInputBytes: 1_048_576,
|
|
9
8
|
maxOutputBytes: 65_536, maxArtifactBytes: 262_144, maxFiles: 32, memoryMiB: 256, workspaceMiB: 64, workspaceInodes: 4096, pidsLimit: 64, cpus: 1 };
|
|
10
9
|
const integer = (max) => Schema.number().step(1).min(1).max(max);
|
|
11
10
|
const configShape = Schema.object({
|
|
12
|
-
backend: Schema.
|
|
11
|
+
backend: Schema.const('linux-native'),
|
|
13
12
|
linux: Schema.any(),
|
|
14
13
|
stateRoot: Schema.string().default(join(homedir(), '.dsh', 'assistant-isolation')),
|
|
15
|
-
image: Schema.string(), dockerPath: Schema.string().default(process.platform === 'darwin' ? '/usr/local/bin/docker' : '/usr/bin/docker'),
|
|
16
|
-
socketPath: Schema.string(),
|
|
17
14
|
grants: Schema.array(Schema.object({
|
|
18
15
|
id: Schema.string().required(), revision: integer(Number.MAX_SAFE_INTEGER).required(),
|
|
19
16
|
principalDigest: Schema.string().required(), principalRecordId: Schema.string().required(),
|
|
@@ -31,17 +28,14 @@ const configShape = Schema.object({
|
|
|
31
28
|
});
|
|
32
29
|
export function validateConfig(input) {
|
|
33
30
|
input = configShape(input);
|
|
34
|
-
const backend = input.backend
|
|
31
|
+
const backend = input.backend;
|
|
32
|
+
if (backend !== 'linux-native')
|
|
33
|
+
throw new Error('assistant-isolation: only the linux-native backend is supported');
|
|
35
34
|
const stateRoot = input.stateRoot ?? join(homedir(), '.dsh', 'assistant-isolation');
|
|
36
|
-
const dockerPath = input.dockerPath ?? (process.platform === 'darwin' ? '/usr/local/bin/docker' : '/usr/bin/docker');
|
|
37
|
-
const socketPath = backend === 'docker' ? configuredDockerSocketPath(input.socketPath) : input.socketPath ?? '';
|
|
38
35
|
const grants = structuredClone(input.grants ?? []);
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
throw new Error('assistant-isolation: canonical absolute paths required');
|
|
43
|
-
if (backend === 'docker' && ((image !== '' && !/^sha256:[0-9a-f]{64}$/.test(image)) || (grants.length > 0 && image === '')))
|
|
44
|
-
throw new Error('assistant-isolation: grants require an immutable local image ID');
|
|
36
|
+
if (!isAbsolute(stateRoot) || resolve(stateRoot) !== stateRoot || stateRoot === '/' || /[\p{Cc},]/u.test(stateRoot)) {
|
|
37
|
+
throw new Error('assistant-isolation: canonical absolute state root required');
|
|
38
|
+
}
|
|
45
39
|
const limits = { ...defaultLimits, ...input.limits };
|
|
46
40
|
const storage = validateStoragePolicy({ ...defaultStoragePolicy, ...input.storage });
|
|
47
41
|
const maxima = { maxDurationMs: 300_000, maxInputBytes: 1_048_576, maxOutputBytes: 262_144,
|
|
@@ -54,31 +48,23 @@ export function validateConfig(input) {
|
|
|
54
48
|
const maxConcurrentJobs = input.maxConcurrentJobs ?? 2;
|
|
55
49
|
if (!Number.isSafeInteger(maxConcurrentJobs) || maxConcurrentJobs < 1 || maxConcurrentJobs > 16)
|
|
56
50
|
throw new Error('assistant-isolation: invalid concurrency');
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
if (
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
linux = { runtime, cgroupRoots: contract.cgroupRoots };
|
|
75
|
-
const reservation = linuxJobResourceReservation(contract);
|
|
76
|
-
requiredMemory = reservation.memoryMiB;
|
|
77
|
-
requiredInodes = reservation.workspaceInodes;
|
|
78
|
-
requiredStorage = reservation.storageBytes;
|
|
79
|
-
}
|
|
80
|
-
else if (input.linux !== undefined)
|
|
81
|
-
throw new Error('assistant-isolation: Linux configuration requires linux-native backend');
|
|
51
|
+
if (process.platform !== 'linux' || !process.getuid?.() || stateRoot.includes('\\') || !input.linux
|
|
52
|
+
|| Object.keys(input.linux).sort().join() !== 'cgroupRoots,runtime')
|
|
53
|
+
throw new Error('assistant-isolation: Linux native runtime and cgroup roots required');
|
|
54
|
+
const runtime = validateLinuxRuntime(input.linux.runtime);
|
|
55
|
+
if (runtime.root.path === stateRoot || runtime.root.path.startsWith(stateRoot + sep)
|
|
56
|
+
|| stateRoot.startsWith(runtime.root.path + sep))
|
|
57
|
+
throw new Error('assistant-isolation: state overlaps Linux runtime');
|
|
58
|
+
const contract = validateLinuxExecutionContract({ schemaVersion: 1, backend, runtimeDigest: linuxRuntimeDigest(runtime),
|
|
59
|
+
profile: 'ordinary', limits, keeperLimits: { memoryMiB: 128, pidsLimit: 64, cpus: 0.5 }, cgroupRoots: input.linux.cgroupRoots });
|
|
60
|
+
if (contract.cgroupRoots.mode !== 'v1' || Object.entries(contract.cgroupRoots).some(([key, value]) => key !== 'mode'
|
|
61
|
+
&& !value.endsWith(`/uid-${process.getuid()}`)))
|
|
62
|
+
throw new Error('assistant-isolation: Linux native requires current-user cgroup v1 roots');
|
|
63
|
+
const linux = { runtime, cgroupRoots: contract.cgroupRoots };
|
|
64
|
+
const reservation = linuxJobResourceReservation(contract);
|
|
65
|
+
const requiredMemory = reservation.memoryMiB;
|
|
66
|
+
const requiredInodes = reservation.workspaceInodes;
|
|
67
|
+
const requiredStorage = reservation.storageBytes;
|
|
82
68
|
const maxReservedMemoryMiB = input.maxReservedMemoryMiB ?? 2048;
|
|
83
69
|
const maxReservedWorkspaceInodes = input.maxReservedWorkspaceInodes ?? 32_768;
|
|
84
70
|
if (!Number.isSafeInteger(maxReservedMemoryMiB) || maxReservedMemoryMiB < requiredMemory || maxReservedMemoryMiB > 65_536
|
|
@@ -90,7 +76,7 @@ export function validateConfig(input) {
|
|
|
90
76
|
throw new Error('assistant-isolation: invalid grant scope');
|
|
91
77
|
if (storage.maxStateBytes < requiredStorage)
|
|
92
78
|
throw new Error('assistant-isolation: storage budget below planned job allocation');
|
|
93
|
-
return { backend,
|
|
79
|
+
return { backend, linux, stateRoot, grants, limits, storage, maxConcurrentJobs, maxReservedMemoryMiB, maxReservedWorkspaceInodes };
|
|
94
80
|
}
|
|
95
81
|
/** Loader and direct callers share the same synchronous admission checks. */
|
|
96
82
|
export const Config = Schema.transform(Schema.any(), (value, options) => {
|
package/lib/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAC3G,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAqB,MAAM,oBAAoB,CAAA;AAchG,MAAM,CAAC,MAAM,aAAa,GAAoB,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS;IAC7F,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACpJ,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACxE,MAAM,WAAW,GAAmB,MAAM,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClF,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;QACrF,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1F,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7I,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;QAC9F,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;KAChE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC;QACxF,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;QAC9F,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5J,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAChM,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnD,0BAA0B,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC/D,CAAC,CAAA;AAIF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAC7B,IAAI,OAAO,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAClH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;IACpD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,GAAG,oBAAoB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACpF,MAAM,MAAM,GAAoB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO;QACzG,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IACrI,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAiC,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;eACjG,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC9J,CAAC;IACD,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC5J,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;WAC9F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IAC7J,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC;WAC/E,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACxH,MAAM,QAAQ,GAAG,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACrH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAClI,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM;WAC/G,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,MAAO,EAAE,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IAC9I,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAA;IAC5C,MAAM,cAAc,GAAG,WAAW,CAAC,eAAe,CAAA;IAClD,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAA;IAChD,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAA;IAC/D,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,IAAI,MAAM,CAAA;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,GAAG,cAAc,IAAI,oBAAoB,GAAG,MAAM;WACpH,CAAC,MAAM,CAAC,aAAa,CAAC,0BAA0B,CAAC,IAAI,0BAA0B,GAAG,cAAc,IAAI,0BAA0B,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC9M,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS;eACvG,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC/G,IAAI,OAAO,CAAC,aAAa,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IAChI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,CAAA;AACpI,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,MAAM,GAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACtF,IAAI,CAAC;QAAC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;IACpC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAAC,CAAC;AAC5F,CAAC,CAAmB,CAAA"}
|
package/lib/index.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import { version } from './version.js';
|
|
|
3
3
|
import { AssistantIsolationService, Config } from './service.js';
|
|
4
4
|
export declare const name = "dsh-enhanced-assistant-isolation";
|
|
5
5
|
export { version, AssistantIsolationService, Config };
|
|
6
|
-
export { IsolatedVerifierRunner, type IsolatedVerifierRunnerConfig } from './verifier-runner.js';
|
|
6
|
+
export { IsolatedVerifierRunner, type LinuxVerifierRunnerConfig as IsolatedVerifierRunnerConfig } from './verifier-runner.js';
|
|
7
7
|
export { runNativeMacProcess, type NativeMacProcessInput, type NativeMacProcessResult, type NativeMacReadRoot } from './native-macos.js';
|
|
8
8
|
export { validateNativeMacRuntime, verifyNativeMacRuntime, hashNativeMacRuntimeTree, nativeMacRuntimeDigest, type NativeMacRuntime } from './native-runtime.js';
|
|
9
9
|
export { NativeMacVerifierRunner, type NativeMacVerifierRunnerConfig } from './native-verifier-runner.js';
|
|
@@ -23,11 +23,11 @@ export { prepareLinuxExecutionIntent, runLinuxExecution, readLinuxExecutionRecei
|
|
|
23
23
|
export { prepareLinuxRepositoryIntent, runLinuxRepositoryExecution, readLinuxRepositoryReceipt, reconcileLinuxRepositoryExecution, type LinuxRepositoryExecutionContext, type LinuxRepositoryExecutionRequest, type LinuxRepositoryExecutionReceipt, type LinuxRepositoryExecutionOutcome, type LinuxRepositoryArtifact, type LinuxRepositoryArtifactSummary } from './linux-execution.js';
|
|
24
24
|
export { linuxExecutionContractDigest, linuxExecutionIntentDigest, linuxExecutionResourcesDigest, linuxJobResourceReservation, LINUX_REPOSITORY_STORAGE_BYTES, type LinuxExecutionContract, type LinuxExecutionContractV1, type LinuxRepositoryExecutionContract, type LinuxExecutionIntent, type LinuxExecutionIntentV1, type LinuxRepositoryExecutionIntent, type LinuxExecutionResources, type LinuxReceiptBinding, type LinuxExecutionPartialCleanupProof } from './linux-execution-contract.js';
|
|
25
25
|
export { inspectIsolationGrant, type IsolationGrantDiagnostic, type IsolationGrantDiagnosticReason } from './diagnostics.js';
|
|
26
|
-
export {
|
|
26
|
+
export { probeLinuxIsolationRuntime, type LinuxIsolationProbeConfig } from './probe.js';
|
|
27
27
|
export * from './audit-archive.js';
|
|
28
28
|
export { isolationPrincipalDigest } from './service.js';
|
|
29
29
|
export type * from './types.js';
|
|
30
|
-
export declare function apply(ctx: Context, config
|
|
30
|
+
export declare function apply(ctx: Context, config: Config): Promise<void>;
|
|
31
31
|
declare const _default: {
|
|
32
32
|
name: string;
|
|
33
33
|
Config: import("@deepseek-ai/schemastery").default<Config>;
|
package/lib/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,eAAO,MAAM,IAAI,qCAAqC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,eAAO,MAAM,IAAI,qCAAqC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,KAAK,yBAAyB,IAAI,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAC7H,OAAO,EAAE,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACxI,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/J,OAAO,EAAE,uBAAuB,EAAE,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AACzG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACnK,OAAO,EAAE,2BAA2B,EAAE,KAAK,6BAA6B,EAAE,KAAK,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAC3I,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxJ,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,4BAA4B,EACrF,sBAAsB,EAAE,4BAA4B,EACpD,KAAK,oBAAoB,EAAE,KAAK,IAAI,EAAE,KAAK,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AACzG,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,mCAAmC,EAC9G,gCAAgC,EAChC,KAAK,0BAA0B,EAAE,KAAK,2BAA2B,EAAE,KAAK,4BAA4B,EACpG,KAAK,gCAAgC,EAAE,KAAK,qCAAqC,EACjF,KAAK,+BAA+B,EAAE,MAAM,mCAAmC,CAAA;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,KAAK,4BAA4B,EAAE,KAAK,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC3K,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,4CAA4C,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAC1K,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,iCAAiC,EACxG,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,qCAAqC,EACvH,uBAAuB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACjH,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,iCAAiC,EAC/H,KAAK,+BAA+B,EAAE,KAAK,+BAA+B,EAAE,KAAK,+BAA+B,EAAE,KAAK,+BAA+B,EACtJ,KAAK,uBAAuB,EAAE,KAAK,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,6BAA6B,EAC9F,2BAA2B,EAAE,8BAA8B,EAC3D,KAAK,sBAAsB,EAAE,KAAK,wBAAwB,EAAE,KAAK,gCAAgC,EACjG,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,8BAA8B,EAC3F,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EACtD,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,KAAK,wBAAwB,EAAE,KAAK,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AAC5H,OAAO,EAAE,0BAA0B,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAA;AACvF,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AACvD,mBAAmB,YAAY,CAAA;AAE/B,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAA2D;;;;;;AAEnI,wBAAsC;AAEtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA"}
|
package/lib/index.js
CHANGED
|
@@ -22,10 +22,10 @@ export { prepareLinuxExecutionIntent, runLinuxExecution, readLinuxExecutionRecei
|
|
|
22
22
|
export { prepareLinuxRepositoryIntent, runLinuxRepositoryExecution, readLinuxRepositoryReceipt, reconcileLinuxRepositoryExecution } from './linux-execution.js';
|
|
23
23
|
export { linuxExecutionContractDigest, linuxExecutionIntentDigest, linuxExecutionResourcesDigest, linuxJobResourceReservation, LINUX_REPOSITORY_STORAGE_BYTES } from './linux-execution-contract.js';
|
|
24
24
|
export { inspectIsolationGrant } from './diagnostics.js';
|
|
25
|
-
export {
|
|
25
|
+
export { probeLinuxIsolationRuntime } from './probe.js';
|
|
26
26
|
export * from './audit-archive.js';
|
|
27
27
|
export { isolationPrincipalDigest } from './service.js';
|
|
28
|
-
export async function apply(ctx, config
|
|
28
|
+
export async function apply(ctx, config) { await new AssistantIsolationService(ctx, config).ready; }
|
|
29
29
|
// Loader unwraps the default export; preserve the trusted plugin identity there.
|
|
30
30
|
export default { name, Config, apply };
|
|
31
31
|
export { validateLinuxCgroupRoots } from './linux-execution-contract.js';
|
package/lib/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,MAAM,CAAC,MAAM,IAAI,GAAG,kCAAkC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAEhE,MAAM,CAAC,MAAM,IAAI,GAAG,kCAAkC,CAAA;AACtD,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAkE,MAAM,sBAAsB,CAAA;AAC7H,OAAO,EAAE,mBAAmB,EAAmF,MAAM,mBAAmB,CAAA;AACxI,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAA;AAC/J,OAAO,EAAE,uBAAuB,EAAsC,MAAM,6BAA6B,CAAA;AACzG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AAC1I,OAAO,EAAE,iBAAiB,EAA6G,MAAM,sBAAsB,CAAA;AACnK,OAAO,EAAE,2BAA2B,EAA2E,MAAM,sBAAsB,CAAA;AAC3I,OAAO,EAAE,gBAAgB,EAAqG,MAAM,oBAAoB,CAAA;AACxJ,OAAO,EAAE,mBAAmB,EAAkC,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,4BAA4B,EACrF,sBAAsB,EAAE,4BAA4B,EACoB,MAAM,yBAAyB,CAAA;AACzG,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,mCAAmC,EAC9G,gCAAgC,EAGM,MAAM,mCAAmC,CAAA;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,OAAO,EAAE,qBAAqB,EAAyG,MAAM,8BAA8B,CAAA;AAC3K,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,4CAA4C,EAA4B,MAAM,4BAA4B,CAAA;AAC1K,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,iCAAiC,EACxC,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,qCAAqC,EACvH,uBAAuB,EAAE,4BAA4B,EAA8B,MAAM,sBAAsB,CAAA;AACjH,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,iCAAiC,EAE5D,MAAM,sBAAsB,CAAA;AACjG,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,6BAA6B,EAC9F,2BAA2B,EAAE,8BAA8B,EAInB,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAsE,MAAM,kBAAkB,CAAA;AAC5H,OAAO,EAAE,0BAA0B,EAAkC,MAAM,YAAY,CAAA;AACvF,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAGvD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc,IAAmB,MAAM,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAA,CAAC,CAAC;AACnI,iFAAiF;AACjF,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAEtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA"}
|
package/lib/ledger.d.ts
CHANGED
|
@@ -1,6 +1,3 @@
|
|
|
1
|
-
import { type CreationWitness, type DaemonWitness } from './runtime-witness.js';
|
|
2
|
-
import type { SystemdBinding } from './daemon-binding.js';
|
|
3
|
-
import { type IsolationCleanupReceipt } from './cleanup-receipt.js';
|
|
4
1
|
import { type LinuxExecutionContract, type LinuxExecutionIntent, type LinuxExecutionResources, type LinuxReceiptBinding, type LinuxExecutionPartialCleanupProof } from './linux-execution-contract.js';
|
|
5
2
|
import type { IsolationArtifactBinding, IsolationGrant, IsolationIdentity, IsolationJob, IsolationResult, IsolationStorageBudget } from './types.js';
|
|
6
3
|
export type IsolationLedgerErrorCode = 'conflict' | 'invalid-input' | 'invalid-path' | 'invalid-state' | 'not-found' | 'schema' | 'schema-too-new' | 'unauthorized';
|
|
@@ -42,7 +39,7 @@ export declare class IsolationLedger {
|
|
|
42
39
|
resourceReservation?: ResourceReservation;
|
|
43
40
|
storageBudget?: IsolationStorageBudget;
|
|
44
41
|
artifactBinding?: IsolationArtifactBinding;
|
|
45
|
-
backend
|
|
42
|
+
backend: IsolationJob['backend'];
|
|
46
43
|
linuxContract?: LinuxExecutionContract;
|
|
47
44
|
}): {
|
|
48
45
|
job: IsolationJob;
|
|
@@ -53,7 +50,7 @@ export declare class IsolationLedger {
|
|
|
53
50
|
/** Commit the crash boundary before a supervisor can receive create authority. */
|
|
54
51
|
markDispatched(jobId: string, expectedVersion: number, authority: IsolationControllerAuthority): IsolationJob;
|
|
55
52
|
start(jobId: string, expectedVersion: number, authority?: IsolationControllerAuthority): IsolationJob;
|
|
56
|
-
settle(jobId: string, expectedVersion: number, input: IsolationResult, authority?: IsolationControllerAuthority
|
|
53
|
+
settle(jobId: string, expectedVersion: number, input: IsolationResult, authority?: IsolationControllerAuthority): IsolationJob;
|
|
57
54
|
/** A Host-verified durable supervisor receipt is the only native dispatch settlement proof. */
|
|
58
55
|
settleNativeReceipt(jobId: string, expectedVersion: number, binding: {
|
|
59
56
|
requestDigest: string;
|
|
@@ -69,14 +66,6 @@ export declare class IsolationLedger {
|
|
|
69
66
|
settleLinuxPrestartCleanup(jobId: string, expectedVersion: number, proof: LinuxExecutionPartialCleanupProof, authority: IsolationControllerAuthority): IsolationJob;
|
|
70
67
|
findJobByKey(value: IsolationIdentity, sessionId: string, grantId: string, key: string): IsolationJob | undefined;
|
|
71
68
|
findNativeVerifierJob(principalDigest: string, stateRoot: string, key: string): IsolationJob | undefined;
|
|
72
|
-
/** Host-only release after exact cleanup; outcome and origin evidence remain immutable. */
|
|
73
|
-
settleReconciledUnknown(jobId: string, expectedVersion: number, proof: {
|
|
74
|
-
original: CreationWitness;
|
|
75
|
-
current: DaemonWitness;
|
|
76
|
-
currentBinding?: SystemdBinding;
|
|
77
|
-
checkedAt: number;
|
|
78
|
-
cleanup: IsolationCleanupReceipt;
|
|
79
|
-
}, authority: IsolationControllerAuthority): IsolationJob;
|
|
80
69
|
revoke(grantId: string, revision: number, reason: string): void;
|
|
81
70
|
claimController(ownerId: string, ttlMs: number): IsolationControllerAuthority;
|
|
82
71
|
renewController(authority: IsolationControllerAuthority, ttlMs: number): boolean;
|
package/lib/ledger.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAMA,OAAO,
|
|
1
|
+
{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAMA,OAAO,EAA+R,KAAK,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAA;AAEne,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAmB,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAErK,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAEnK,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,wBAAwB;gBAA9B,IAAI,EAAE,wBAAwB,EAAE,OAAO,GAAE,MAAa;CAC5E;AACD,MAAM,WAAW,4BAA4B;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAmChF;;;mEAGmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAiC;AAgB3F,KAAK,mBAAmB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAA;AAqE3H,iGAAiG;AACjG,qBAAa,eAAe;;gBAGd,IAAI,EAAE,MAAM,EAAE,EAAE,GAAc,EAAE,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IA4EzE,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,EAAE,4BAA4B,GAAG,IAAI;IAcpF,OAAO,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,4BAA4B,CAAC;QAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;QAAC,eAAe,CAAC,EAAE,wBAAwB,CAAC;QAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,sBAAsB,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IA4E1c,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAiBlJ,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAevJ,kFAAkF;IAClF,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAiB7G,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,4BAA4B,GAAG,YAAY;IAWrG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,4BAA4B,GAAG,YAAY;IAmB9H,+FAA+F;IAC/F,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IA+BvN,8EAA8E;IAC9E,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAcvK,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAYzJ,+EAA+E;IAC/E,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAgBhK,6FAA6F;IAC7F,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,iCAAiC,EAAE,SAAS,EAAE,4BAA4B,GAAG,YAAY;IAqBnK,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAMjH,qBAAqB,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAKxG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAM/D,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,4BAA4B;IAY7E,eAAe,CAAC,SAAS,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhF,iBAAiB,CAAC,SAAS,EAAE,4BAA4B,GAAG,IAAI;IAIhE,aAAa,CAAC,SAAS,EAAE,4BAA4B,GAAG,OAAO;IAC/D,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAC5C,WAAW,CAAC,OAAO,SAAK,GAAG,YAAY,EAAE;IACzC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK,EAAE,KAAK,SAAK,EAAE,sBAAsB,UAAQ,GAAG,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAMrI,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,4BAA4B,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAqBvJ,YAAY,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE;IAOpH,eAAe,CAAC,SAAS,EAAE,4BAA4B,GAAG;QAAE,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;QAAC,WAAW,EAAE,aAAa,GAAG,YAAY,CAAA;KAAE;IAmBxI,4FAA4F;IAC5F,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IASvG,gFAAgF;IAChF,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAQhE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9B,KAAK,IAAI,IAAI;CACd"}
|
package/lib/ledger.js
CHANGED
|
@@ -4,8 +4,6 @@ import { chmodSync, mkdirSync } from 'node:fs';
|
|
|
4
4
|
import { randomBytes, randomUUID } from 'node:crypto';
|
|
5
5
|
import { dirname, isAbsolute, normalize } from 'node:path';
|
|
6
6
|
import { DatabaseSync } from 'node:sqlite';
|
|
7
|
-
import { processExited, sameDaemonWitness, validateCreationWitness } from './runtime-witness.js';
|
|
8
|
-
import { receiptData } from './cleanup-receipt.js';
|
|
9
7
|
import { linuxExecutionContractDigest, linuxExecutionIntentDigest, linuxExecutionResourcesDigest, linuxJobResourceReservation, validateLinuxExecutionContract, validateLinuxExecutionIntent, validateLinuxExecutionResources, validateLinuxReceiptBinding, validateLinuxExecutionPartialCleanupProof } from './linux-execution-contract.js';
|
|
10
8
|
import { pruneResult, validateRetention } from './storage-policy.js';
|
|
11
9
|
export class IsolationLedgerError extends Error {
|
|
@@ -215,17 +213,6 @@ export class IsolationLedger {
|
|
|
215
213
|
fail('schema');
|
|
216
214
|
if (![0, 1].includes(row.dispatch_attempted) || ![0, 1].includes(row.migrated))
|
|
217
215
|
fail('schema');
|
|
218
|
-
let witness;
|
|
219
|
-
if (row.creation_witness_json !== null) {
|
|
220
|
-
try {
|
|
221
|
-
witness = validateCreationWitness(JSON.parse(row.creation_witness_json));
|
|
222
|
-
}
|
|
223
|
-
catch {
|
|
224
|
-
fail('schema');
|
|
225
|
-
}
|
|
226
|
-
if (!row.dispatch_attempted)
|
|
227
|
-
fail('schema');
|
|
228
|
-
}
|
|
229
216
|
let binding;
|
|
230
217
|
if (row.artifact_binding_json !== null) {
|
|
231
218
|
try {
|
|
@@ -284,7 +271,7 @@ export class IsolationLedger {
|
|
|
284
271
|
}
|
|
285
272
|
else if (row.status !== 'prepared' && row.status !== 'running')
|
|
286
273
|
fail('schema');
|
|
287
|
-
return frozen({ ...(linuxContract ? { linuxContract } : {}), ...(linuxIntent ? { linuxIntent } : {}), ...(linuxResources ? { linuxResources } : {}), ...(binding ? { artifactBinding: binding } : {}), id: row.id, grantId: row.grant_id, grantRevision: row.grant_revision, identity: jobIdentity, sessionId: row.session_id, idempotencyKey: row.idempotency_key, requestDigest: row.request_digest,
|
|
274
|
+
return frozen({ ...(linuxContract ? { linuxContract } : {}), ...(linuxIntent ? { linuxIntent } : {}), ...(linuxResources ? { linuxResources } : {}), ...(binding ? { artifactBinding: binding } : {}), id: row.id, grantId: row.grant_id, grantRevision: row.grant_revision, identity: jobIdentity, sessionId: row.session_id, idempotencyKey: row.idempotency_key, requestDigest: row.request_digest, backend: row.backend_kind, ...(row.native_resource_id ? { nativeResourceId: row.native_resource_id } : {}), ...(row.native_nonce ? { nativeNonce: row.native_nonce } : {}), deadline: row.deadline, reservedDurationMs: row.reserved_duration_ms, reservedMemoryMiB: row.reserved_memory_mib, reservedWorkspaceInodes: row.reserved_workspace_inodes, reservedStorageBytes: row.reserved_storage_bytes, dispatchAttempted: row.dispatch_attempted === 1, status: row.status, version: row.version, createdAt: row.created_at, updatedAt: row.updated_at, ...(parsed ? { result: parsed } : {}) });
|
|
288
275
|
}
|
|
289
276
|
#bindLinuxIntent(row, intent, contract) {
|
|
290
277
|
if (intent.jobId !== row.id || intent.requestDigest !== row.request_digest || intent.nativeResourceId !== row.native_resource_id
|
|
@@ -335,7 +322,7 @@ export class IsolationLedger {
|
|
|
335
322
|
});
|
|
336
323
|
}
|
|
337
324
|
prepare(input) {
|
|
338
|
-
if (!input || typeof input !== 'object' || ![6, 7, 8, 9, 10, 11, 12, 13].includes(Object.keys(input).length) || !onlyKeys(input, ['identity', 'sessionId', 'grantId', 'idempotencyKey', 'requestDigest', 'durationMs', 'maxActiveJobs', 'authority', 'resourceReservation', 'storageBudget', 'artifactBinding', 'backend', 'linuxContract']) || !text(input.sessionId) || !text(input.grantId) || !text(input.idempotencyKey) || !text(input.requestDigest) || !safePositive(input.durationMs) || (input.maxActiveJobs !== undefined && !safePositive(input.maxActiveJobs)) || (input.backend !==
|
|
325
|
+
if (!input || typeof input !== 'object' || ![6, 7, 8, 9, 10, 11, 12, 13].includes(Object.keys(input).length) || !onlyKeys(input, ['identity', 'sessionId', 'grantId', 'idempotencyKey', 'requestDigest', 'durationMs', 'maxActiveJobs', 'authority', 'resourceReservation', 'storageBudget', 'artifactBinding', 'backend', 'linuxContract']) || !text(input.sessionId) || !text(input.grantId) || !text(input.idempotencyKey) || !text(input.requestDigest) || !safePositive(input.durationMs) || (input.maxActiveJobs !== undefined && !safePositive(input.maxActiveJobs)) || (input.backend !== 'macos-seatbelt' && input.backend !== 'linux-native') || (input.backend === 'macos-seatbelt' && input.resourceReservation !== undefined))
|
|
339
326
|
fail('invalid-input');
|
|
340
327
|
let linuxContract;
|
|
341
328
|
if (input.backend === 'linux-native') {
|
|
@@ -378,7 +365,7 @@ export class IsolationLedger {
|
|
|
378
365
|
const existing = this.#database.prepare('SELECT * FROM isolation_jobs WHERE principal_digest=? AND principal_record_id=? AND principal_version=? AND workspace=? AND agent_preset=? AND session_id=? AND grant_id=? AND idempotency_key=?').get(who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, input.sessionId, input.grantId, input.idempotencyKey);
|
|
379
366
|
if (existing) {
|
|
380
367
|
const job = this.#decodeJob(existing);
|
|
381
|
-
if (job.requestDigest !== input.requestDigest || job.backend !==
|
|
368
|
+
if (job.requestDigest !== input.requestDigest || (job.backend !== 'docker' && job.backend !== input.backend) || (linuxContract && (job.linuxContract === undefined || linuxExecutionContractDigest(job.linuxContract) !== linuxExecutionContractDigest(linuxContract))))
|
|
382
369
|
fail('conflict', 'idempotency key has a different request or backend');
|
|
383
370
|
return { job, created: false };
|
|
384
371
|
}
|
|
@@ -440,9 +427,8 @@ export class IsolationLedger {
|
|
|
440
427
|
}
|
|
441
428
|
const id = randomUUID();
|
|
442
429
|
const deadline = Math.min(now + input.durationMs, current.expires_at);
|
|
443
|
-
const native = input.backend === 'macos-seatbelt' || input.backend === 'linux-native';
|
|
444
430
|
insertAttempted = true;
|
|
445
|
-
this.#database.prepare("INSERT INTO isolation_jobs(id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,linux_contract_json,dispatch_attempted,status,version,created_at,updated_at) VALUES (
|
|
431
|
+
this.#database.prepare("INSERT INTO isolation_jobs(id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,linux_contract_json,dispatch_attempted,status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,NULL,?,?,?,?,?,?,?,?,?,0, 'prepared',1,?,?)").run(id, input.grantId, current.revision, who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, input.sessionId, input.idempotencyKey, input.requestDigest, input.backend, `${input.backend === 'linux-native' ? 'linux' : 'native'}-${id}`, input.backend === 'linux-native' ? randomBytes(16).toString('hex') : randomUUID(), deadline, input.durationMs, reservation?.memoryMiB ?? 0, reservation?.workspaceInodes ?? 0, storage?.reservedBytes ?? 0, linuxContract ? JSON.stringify(linuxContract) : null, now, now);
|
|
446
432
|
if (binding)
|
|
447
433
|
this.#database.prepare('UPDATE isolation_jobs SET artifact_binding_json=? WHERE id=?').run(JSON.stringify(binding), id);
|
|
448
434
|
this.#audit(now, 'job-prepared', id, input.grantId, `revision:${current.revision}${reservation ? `;reservation:memoryMiB:${reservation.memoryMiB},workspaceInodes:${reservation.workspaceInodes}` : ''}${storage ? `;storageBytes:${storage.reservedBytes}` : ''}`);
|
|
@@ -565,25 +551,12 @@ export class IsolationLedger {
|
|
|
565
551
|
return this.#job(jobId);
|
|
566
552
|
});
|
|
567
553
|
}
|
|
568
|
-
settle(jobId, expectedVersion, input, authority
|
|
554
|
+
settle(jobId, expectedVersion, input, authority) {
|
|
569
555
|
if (!text(jobId) || !safePositive(expectedVersion))
|
|
570
556
|
fail('invalid-input');
|
|
571
557
|
const value = result(input);
|
|
572
558
|
if (value.jobId !== jobId || (value.status !== 'unknown' && !value.quiescent))
|
|
573
559
|
fail('invalid-input', 'result job id differs or non-unknown result is not quiescent');
|
|
574
|
-
let witness;
|
|
575
|
-
if (creationWitness !== undefined) {
|
|
576
|
-
try {
|
|
577
|
-
witness = validateCreationWitness(creationWitness);
|
|
578
|
-
}
|
|
579
|
-
catch {
|
|
580
|
-
fail('invalid-input');
|
|
581
|
-
}
|
|
582
|
-
if (value.status !== 'unknown' || value.quiescent)
|
|
583
|
-
fail('invalid-input');
|
|
584
|
-
}
|
|
585
|
-
if (value.reason === 'docker-creation-unconfirmed' && value.quiescent)
|
|
586
|
-
fail('invalid-input');
|
|
587
560
|
const controller = this.#authority(authority);
|
|
588
561
|
return this.#transaction(() => {
|
|
589
562
|
const now = this.#nowValue();
|
|
@@ -595,8 +568,6 @@ export class IsolationLedger {
|
|
|
595
568
|
fail('conflict', 'job version differs');
|
|
596
569
|
if (job.backend === 'linux-native' && !controller)
|
|
597
570
|
fail('invalid-input', 'Linux writes require controller authority');
|
|
598
|
-
if (witness && !job.dispatchAttempted)
|
|
599
|
-
fail('invalid-state');
|
|
600
571
|
if (job.backend !== 'docker' && job.dispatchAttempted && value.status !== 'unknown')
|
|
601
572
|
fail('invalid-state', 'native dispatch requires a durable receipt');
|
|
602
573
|
if (job.dispatchAttempted && value.status === 'unknown' && value.quiescent)
|
|
@@ -604,7 +575,7 @@ export class IsolationLedger {
|
|
|
604
575
|
if (job.status !== 'prepared' && job.status !== 'running') {
|
|
605
576
|
if (job.result && equal(job.result, value))
|
|
606
577
|
return job;
|
|
607
|
-
const cleanup = !job.dispatchAttempted && job.
|
|
578
|
+
const cleanup = !job.dispatchAttempted && job.status === 'unknown' && job.result?.status === 'unknown' && job.result.quiescent === false && value.status === 'unknown' && value.quiescent === true
|
|
608
579
|
&& equal({ ...job.result, quiescent: true }, value);
|
|
609
580
|
if (!cleanup)
|
|
610
581
|
fail('invalid-state');
|
|
@@ -614,7 +585,7 @@ export class IsolationLedger {
|
|
|
614
585
|
this.#audit(now, 'job-quiesced', jobId, job.grantId, 'unknown');
|
|
615
586
|
return this.#job(jobId);
|
|
616
587
|
}
|
|
617
|
-
const changed = this.#database.prepare(
|
|
588
|
+
const changed = this.#database.prepare("UPDATE isolation_jobs SET status=?, result_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status IN ('prepared','running')").run(value.status, JSON.stringify(value), now, jobId, expectedVersion);
|
|
618
589
|
if (changed.changes !== 1)
|
|
619
590
|
fail('conflict');
|
|
620
591
|
this.#audit(now, 'job-settled', jobId, job.grantId, value.status);
|
|
@@ -793,55 +764,6 @@ export class IsolationLedger {
|
|
|
793
764
|
const row = this.#database.prepare("SELECT * FROM isolation_jobs WHERE backend_kind='macos-seatbelt' AND principal_digest=? AND workspace=? AND idempotency_key=? AND grant_id='verification' AND agent_preset='verification'").get(principalDigest, stateRoot, key);
|
|
794
765
|
return row ? this.#decodeJob(row) : undefined;
|
|
795
766
|
}
|
|
796
|
-
/** Host-only release after exact cleanup; outcome and origin evidence remain immutable. */
|
|
797
|
-
settleReconciledUnknown(jobId, expectedVersion, proof, authority) {
|
|
798
|
-
if (!text(jobId) || !safePositive(expectedVersion) || !proof || !safeTime(proof.checkedAt))
|
|
799
|
-
fail('invalid-input');
|
|
800
|
-
let original;
|
|
801
|
-
let current;
|
|
802
|
-
try {
|
|
803
|
-
original = validateCreationWitness(proof.original);
|
|
804
|
-
current = validateCreationWitness({ daemon: proof.current, supervisor: proof.current.process,
|
|
805
|
-
...(proof.currentBinding ? { binding: proof.currentBinding } : {}) }).daemon;
|
|
806
|
-
}
|
|
807
|
-
catch {
|
|
808
|
-
fail('invalid-input');
|
|
809
|
-
}
|
|
810
|
-
const controller = this.#authority(authority);
|
|
811
|
-
if (!controller)
|
|
812
|
-
fail('invalid-input');
|
|
813
|
-
return this.#transaction(() => {
|
|
814
|
-
const now = this.#nowValue();
|
|
815
|
-
this.#requireController(controller, now);
|
|
816
|
-
if (proof.checkedAt > now || now - proof.checkedAt > 5_000)
|
|
817
|
-
fail('invalid-input', 'cleanup proof expired');
|
|
818
|
-
const job = this.#job(jobId);
|
|
819
|
-
if (!job)
|
|
820
|
-
fail('not-found');
|
|
821
|
-
if (job.version !== expectedVersion || !equal(job.creationWitness, original))
|
|
822
|
-
fail('conflict');
|
|
823
|
-
if (job.backend !== 'docker' || !job.dispatchAttempted || job.status !== 'unknown' || !job.result || job.result.quiescent
|
|
824
|
-
|| original.requestsSettled !== true || !processExited(original.supervisor))
|
|
825
|
-
fail('invalid-state');
|
|
826
|
-
if (original.daemon.engineId !== current.engineId || original.daemon.dockerPath !== current.dockerPath
|
|
827
|
-
|| original.daemon.socketPath !== current.socketPath || original.daemon.pidFile !== current.pidFile)
|
|
828
|
-
fail('invalid-state');
|
|
829
|
-
if (!sameDaemonWitness(original.daemon, current))
|
|
830
|
-
fail('invalid-state', 'daemon generation changed');
|
|
831
|
-
const cleanup = receiptData(proof.cleanup);
|
|
832
|
-
if (!cleanup || cleanup.containerName !== job.containerName || cleanup.dockerPath !== current.dockerPath
|
|
833
|
-
|| cleanup.socketPath !== current.socketPath || cleanup.checkedAt > now || now - cleanup.checkedAt > 5_000)
|
|
834
|
-
fail('invalid-input', 'exact resource cleanup receipt required');
|
|
835
|
-
const mode = 'requests-settled';
|
|
836
|
-
const changed = this.#database.prepare("UPDATE isolation_jobs SET result_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status='unknown'")
|
|
837
|
-
.run(JSON.stringify({ ...job.result, quiescent: true }), now, jobId, expectedVersion);
|
|
838
|
-
if (changed.changes !== 1)
|
|
839
|
-
fail('conflict');
|
|
840
|
-
this.#audit(now, 'job-quiesced', jobId, job.grantId, JSON.stringify({ mode, checkedAt: proof.checkedAt, original, current, cleanup,
|
|
841
|
-
...(proof.currentBinding ? { currentBinding: proof.currentBinding } : {}) }));
|
|
842
|
-
return this.#job(jobId);
|
|
843
|
-
});
|
|
844
|
-
}
|
|
845
767
|
revoke(grantId, revision, reason) {
|
|
846
768
|
if (!text(grantId) || !safePositive(revision) || !text(reason))
|
|
847
769
|
fail('invalid-input');
|