@exagone313/dsh-podman 0.2.0-rc.2

package/dist/project-path.js

@@ -0,0 +1,73 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+// projectNameFromHostPath maps an absolute host directory to the project path a
+// project mount stores — the path relative to the projects root. Returns
+// undefined when the directory is not strictly inside the root (the root itself
+// is not a project, and neither is a sibling), so a directory browser can only
+// ever produce a valid mount.
+export function projectNameFromHostPath(projectsRoot, path) {
+    const root = stripTrailingSlash(projectsRoot);
+    const target = stripTrailingSlash(path);
+    if (root === "" || target === "" || target === root)
+        return undefined;
+    if (!target.startsWith(`${root}/`))
+        return undefined;
+    return target.slice(root.length + 1);
+}
+// hostPathForProjectName is the inverse: the absolute directory a project path
+// names under the projects root, used to open a directory browser where the
+// field's current value lives.
+export function hostPathForProjectName(projectsRoot, project) {
+    const root = stripTrailingSlash(projectsRoot);
+    const name = stripTrailingSlash(project).replace(/^\/+/, "");
+    return name === "" ? root : `${root}/${name}`;
+}
+function stripTrailingSlash(value) {
+    return String(value ?? "").replace(/\/+$/, "");
+}
+// confineToRoot clamps a directory to the projects root subtree, so a stale or
+// hand-edited project path can never open a browser outside it.
+export function confineToRoot(root, path) {
+    const normalizedRoot = stripTrailingSlash(root);
+    const normalizedPath = stripTrailingSlash(path);
+    if (normalizedRoot === "" || normalizedPath === normalizedRoot) {
+        return normalizedRoot;
+    }
+    return normalizedPath.startsWith(`${normalizedRoot}/`)
+        ? normalizedPath
+        : normalizedRoot;
+}
+// parentDirectory is the directory one level above `path`, never above the
+// projects root.
+export function parentDirectory(root, path) {
+    const normalizedRoot = stripTrailingSlash(root);
+    const index = path.lastIndexOf("/");
+    if (index <= 0)
+        return normalizedRoot;
+    const parent = stripTrailingSlash(path.slice(0, index));
+    return parent.length < normalizedRoot.length ? normalizedRoot : parent;
+}
+// rootCrumbs returns the cumulative paths from the projects root down to `path`
+// inclusive, so a breadcrumb trail never renders a segment above the root.
+export function rootCrumbs(root, path) {
+    const normalizedRoot = stripTrailingSlash(root);
+    const prefix = `${normalizedRoot}/`;
+    if (normalizedRoot === "" || !path.startsWith(prefix))
+        return [];
+    const crumbs = [];
+    let accumulated = normalizedRoot;
+    for (const segment of path.slice(prefix.length).split("/")) {
+        if (segment === "")
+            continue;
+        accumulated = `${accumulated}/${segment}`;
+        crumbs.push(accumulated);
+    }
+    return crumbs;
+}
+// crumbLabel is the display name of one crumb path.
+export function crumbLabel(path) {
+    const trimmed = stripTrailingSlash(path);
+    const name = trimmed.slice(trimmed.lastIndexOf("/") + 1);
+    return name === "" ? trimmed : name;
+}

package/dist/project-path.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/project-path.test.js

@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { confineToRoot, crumbLabel, hostPathForProjectName, parentDirectory, projectNameFromHostPath, rootCrumbs, } from "./project-path.js";
+test("projectNameFromHostPath maps a host directory to a project path", () => {
+    assert.equal(projectNameFromHostPath("/projects", "/projects/web"), "web");
+    assert.equal(projectNameFromHostPath("/projects", "/projects/group/web"), "group/web");
+    assert.equal(projectNameFromHostPath("/projects/", "/projects/web/"), "web", "trailing slashes are ignored");
+});
+test("projectNameFromHostPath refuses anything outside the projects root", () => {
+    assert.equal(projectNameFromHostPath("/projects", "/projects"), undefined);
+    assert.equal(projectNameFromHostPath("/projects", "/projects/"), undefined);
+    assert.equal(projectNameFromHostPath("/projects", "/projects2/web"), undefined);
+    assert.equal(projectNameFromHostPath("/projects", "/etc/hosts"), undefined);
+    assert.equal(projectNameFromHostPath("/projects", "web"), undefined);
+    assert.equal(projectNameFromHostPath("/projects", ""), undefined);
+    assert.equal(projectNameFromHostPath("", "/projects/web"), undefined);
+});
+test("hostPathForProjectName is the inverse", () => {
+    assert.equal(hostPathForProjectName("/projects", "web"), "/projects/web");
+    assert.equal(hostPathForProjectName("/projects", "group/web"), "/projects/group/web");
+    assert.equal(hostPathForProjectName("/projects", ""), "/projects");
+    assert.equal(hostPathForProjectName("/projects", "/web"), "/projects/web");
+});
+test("confineToRoot clamps a directory to the projects root", () => {
+    assert.equal(confineToRoot("/projects", "/projects/web"), "/projects/web");
+    assert.equal(confineToRoot("/projects", "/projects"), "/projects");
+    assert.equal(confineToRoot("/projects", "/etc"), "/projects");
+    assert.equal(confineToRoot("/projects", ""), "/projects");
+    assert.equal(confineToRoot("/projects", "/projects/web/"), "/projects/web", "trailing slashes are ignored");
+});
+test("parentDirectory never climbs above the projects root", () => {
+    assert.equal(parentDirectory("/projects", "/projects/web/sub"), "/projects/web");
+    assert.equal(parentDirectory("/projects", "/projects/web"), "/projects");
+    assert.equal(parentDirectory("/projects", "/projects"), "/projects");
+    assert.equal(parentDirectory("/projects", "/elsewhere"), "/projects");
+});
+test("rootCrumbs lists the root-relative ancestry", () => {
+    assert.deepEqual(rootCrumbs("/projects", "/projects/group/web"), [
+        "/projects/group",
+        "/projects/group/web",
+    ]);
+    assert.deepEqual(rootCrumbs("/projects", "/projects"), []);
+    assert.deepEqual(rootCrumbs("/projects", "/etc"), [], "a path outside the root has no crumbs");
+});
+test("crumbLabel is the last segment", () => {
+    assert.equal(crumbLabel("/projects/group/web"), "web");
+    assert.equal(crumbLabel("/projects/group/web/"), "web");
+    assert.equal(crumbLabel("/projects"), "projects");
+});

package/dist/prompts.d.ts

@@ -0,0 +1,13 @@
+export declare const HARNESS_SOURCE_SECTION = "harness:source";
+export declare function withoutHarnessSourceSection(assembly: any): any;
+export declare function podmanRuntimeSection(ctx: any): {
+    name: string;
+    order: number;
+    text: (context?: {
+        scope?: unknown;
+    }) => string;
+};
+export declare const PODMAN_OPS_PRESET_YML = "name: Podman operator mode\ndescription: Podman-focused container operations \u2014 manage images, containers, volumes, mounts, secrets, and daemons. Inspections and lifecycle run directly; commands, container file edits, daemon starts, and secret changes ask for approval; supports web research.\norder: 2\n";
+export declare const PODMAN_OPS_AGENT_CORDIS_YML = "- id: persona\n  name: '@deepseek-ai/dsh-persona'\n  config:\n    suffix: Your working directory is {{cwd}}.\n    prefix: >-\n      You are a Podman container-operations agent powered by the {{model}} model.\n\n      You manage container infrastructure through the dsh-podman tools: images\n      (image_list, image_get, image_build, image_rebuild, image_rebuild_all,\n      image_remove), containers (container_list, container_start,\n      container_recreate, container_remove), mounts (container_mount_list,\n      container_mount_add, container_mount_remove, container_mount_update),\n      PATH additions (container_path_set, container_path_add,\n      container_path_remove), volumes (volume_list,\n      volume_create, volume_remove), secrets (secret_list, secret_create,\n      secret_remove, container_secret_add, container_secret_remove), daemons\n      (daemon_list, daemon_start, daemon_stop, daemon_restart, daemon_logs),\n      and container inspection (container_read, container_glob,\n      container_grep).\n\n      Inspection and lifecycle operations run directly. Running commands inside\n      a container (container_bash, container_exec), editing container files\n      (container_write, container_edit), starting daemons (daemon_start),\n      exposing or removing secret environment variables (container_secret_add,\n      container_secret_remove), removing secrets (secret_remove), and\n      rebuilding all images (image_rebuild_all) require the user's approval.\n      Use web_search to research images and documentation. Use\n      ask_user_question for user decisions and todo_write to track work.\n- id: tool-ask-user\n  name: '@deepseek-ai/dsh-tool-ask-user'\n- id: tool-todo\n  name: '@deepseek-ai/dsh-tool-todo'\n  config:\n    allowParallelInProgress: true\n- id: tool-web\n  name: '@deepseek-ai/dsh-tool-web'\n  config:\n    fetch: false\n    searchTimeoutMs: 60000\n";
+export declare function ensurePodmanOpsPreset(ctx: any, dir?: string): void;
+export declare function homePresetsRoot(): string;

package/dist/prompts.js

@@ -0,0 +1,149 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { PODMAN_OPS_PRESET } from "./approval.js";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// Prompt section the harness registers to name its own on-disk checkout.
+// Mirrors @deepseek-ai/dsh-app-boot's HARNESS_SOURCE_SECTION.
+export const HARNESS_SOURCE_SECTION = "harness:source";
+// The checkout the section points at lives on the host and is never reachable
+// from the workspace container, so the line is false under this plugin. Drop it
+// from the assembled prompt without touching any other section.
+export function withoutHarnessSourceSection(assembly) {
+    return {
+        ...assembly,
+        sections: assembly.sections.filter((section) => section.name !== HARNESS_SOURCE_SECTION),
+    };
+}
+// The built-in shell and filesystem tools whose presence decides which runtime
+// wording applies.
+const BUILTIN_TOOLS = ["bash", "read", "write", "edit", "glob", "grep"];
+// Wording for an agent that has the built-in shell and filesystem tools.
+const RUNTIME_WITH_BUILTINS = "This dsh session's `bash`, `read`, `write`, `edit`, `glob`, and `grep` " +
+    "are container-backed: they run in a Podman container, the default " +
+    "container of the current dsh workspace — the same one `container_bash` " +
+    "and the other container-scoped tools (`container_*` and `daemon_*`) " +
+    'target with `container: "default"`. Containers are scoped to a dsh ' +
+    "workspace: each workspace has its own default container and any named " +
+    "ones, and the container-scoped tools address them by logical name within " +
+    "the current workspace. There is no host shell — never describe their " +
+    "output as the host's — and host paths do not exist. Because `bash` and " +
+    "`container_bash` run in that one container with the same command-visible " +
+    "environment, a command sees the same environment and filesystem either " +
+    "way, and matching output is never evidence of a host " +
+    "shell. Containers share the host kernel, so `uname -a`, `uname -r`, and " +
+    "`/proc/version` do report the host kernel; the " +
+    "container's own identity shows in `hostname`, `/etc/os-release`, and " +
+    "`/proc/1/cmdline`.";
+// Wording for an agent that has only the container tools (the Podman operator
+// preset mounts none of the built-in shell or filesystem rows), so it never
+// names a tool the agent does not have.
+const RUNTIME_CONTAINER_ONLY = "This dsh session's container tools run in a Podman container: the default " +
+    "container of the current dsh workspace — the same one the container-scoped " +
+    'tools (`container_*` and `daemon_*`) target with `container: "default"`. ' +
+    "Containers are scoped to a dsh workspace: each workspace has its own " +
+    "default container and any named ones, and the container-scoped tools " +
+    "address them by logical name within the current workspace. There is no " +
+    "host shell — never describe their output as the host's — and host paths do " +
+    "not exist. Containers share the host kernel, so `uname -a`, `uname -r`, " +
+    "and `/proc/version` do report the host kernel; the container's own identity " +
+    "shows in `hostname`, `/etc/os-release`, and `/proc/1/cmdline`.";
+// Correct the model's host/container mental model: the built-in shell and
+// filesystem tools are container-backed too, so there is no host shell. It sits
+// just before the tool sections so the correction lands next to the tool
+// descriptions it explains, and it states the two facts that otherwise invite a
+// "bash runs on the host" hallucination: `bash` and `container_bash` use the
+// same container, and a container shares the host kernel (so `uname` matches
+// the host even though the container's identity does not). It names the
+// execution environment a Podman container, not a "Podman workspace", and says
+// that containers are scoped to a dsh workspace, so the two vocabularies stay
+// apart. An agent without the built-in tools gets the container-only wording.
+export function podmanRuntimeSection(ctx) {
+    return {
+        name: "podman:runtime",
+        order: 950,
+        text: ({ scope } = {}) => BUILTIN_TOOLS.some((name) => ctx.tools.get(name, scope) !== undefined)
+            ? RUNTIME_WITH_BUILTINS
+            : RUNTIME_CONTAINER_ONLY,
+    };
+}
+// The "Podman operator mode" preset metadata, shipped verbatim into the
+// harness's user-presets root.
+export const PODMAN_OPS_PRESET_YML = `name: Podman operator mode
+description: Podman-focused container operations — manage images, containers, volumes, mounts, secrets, and daemons. Inspections and lifecycle run directly; commands, container file edits, daemon starts, and secret changes ask for approval; supports web research.
+order: 2
+`;
+// The "Podman operator mode" agent composition: a Podman-focused persona plus
+// the built-in task and web tools. The plugin's own container tools are global
+// and need no rows; the command/file/daemon/secret tools stay available but
+// gated by the pre-execute policy (PODMAN_OPS_APPROVAL_TOOLS + global flags).
+export const PODMAN_OPS_AGENT_CORDIS_YML = `- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    suffix: Your working directory is {{cwd}}.
+    prefix: >-
+      You are a Podman container-operations agent powered by the {{model}} model.
+
+      You manage container infrastructure through the dsh-podman tools: images
+      (image_list, image_get, image_build, image_rebuild, image_rebuild_all,
+      image_remove), containers (container_list, container_start,
+      container_recreate, container_remove), mounts (container_mount_list,
+      container_mount_add, container_mount_remove, container_mount_update),
+      PATH additions (container_path_set, container_path_add,
+      container_path_remove), volumes (volume_list,
+      volume_create, volume_remove), secrets (secret_list, secret_create,
+      secret_remove, container_secret_add, container_secret_remove), daemons
+      (daemon_list, daemon_start, daemon_stop, daemon_restart, daemon_logs),
+      and container inspection (container_read, container_glob,
+      container_grep).
+
+      Inspection and lifecycle operations run directly. Running commands inside
+      a container (container_bash, container_exec), editing container files
+      (container_write, container_edit), starting daemons (daemon_start),
+      exposing or removing secret environment variables (container_secret_add,
+      container_secret_remove), removing secrets (secret_remove), and
+      rebuilding all images (image_rebuild_all) require the user's approval.
+      Use web_search to research images and documentation. Use
+      ask_user_question for user decisions and todo_write to track work.
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000
+`;
+// Install the "Podman operator mode" agent preset into the harness's
+// user-presets root (~/.dsh/.agent-presets/<id>). The plugin owns the preset
+// content and (re)writes it on every load, so a local copy is always brought
+// back to the shipped composition. Best-effort — a failure only logs.
+export function ensurePodmanOpsPreset(ctx, dir) {
+    const log = (message, ...args) => {
+        try {
+            ctx?.logger?.warn?.(message, ...args);
+        }
+        catch {
+            // Logger failure must not abort preset installation.
+        }
+    };
+    try {
+        const target = dir ?? join(homePresetsRoot(), PODMAN_OPS_PRESET);
+        mkdirSync(target, { recursive: true });
+        writeFileSync(join(target, "preset.yml"), PODMAN_OPS_PRESET_YML);
+        writeFileSync(join(target, "agent.cordis.yml"), PODMAN_OPS_AGENT_CORDIS_YML);
+        log(`[dsh-podman] wrote the "${PODMAN_OPS_PRESET}" agent preset to %s`, target);
+    }
+    catch (error) {
+        log(`[dsh-podman] could not install the "${PODMAN_OPS_PRESET}" agent preset: %o`, error);
+    }
+}
+// The harness user-presets root ($DSH_HOME or ~/.dsh, plus .agent-presets).
+export function homePresetsRoot() {
+    return join(process.env.DSH_HOME ?? join(homedir(), ".dsh"), ".agent-presets");
+}

package/dist/public.d.ts

@@ -0,0 +1,4 @@
+export declare function publicMount(mount: any): Record<string, unknown>;
+export declare function publicContainer(row: any): Record<string, unknown>;
+export declare function publicImage(image: any): Record<string, unknown>;
+export declare function publicDaemon(info: any): Record<string, unknown>;

package/dist/public.js

@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { mountKindFromProto, mountModeFromProto } from "./mount-enums.js";
+// Rebuild API objects so tool results never expose internal fields (see
+// AGENTS.md "Security"): only allow-listed attributes reach the model.
+export function publicMount(mount) {
+    const kind = mountKindFromProto(mount?.kind);
+    const mode = mountModeFromProto(mount?.mode);
+    return {
+        ...(mount?.projectName ? { projectName: mount.projectName } : {}),
+        ...(mount?.destination ? { destination: mount.destination } : {}),
+        ...(mount?.volume ? { volume: mount.volume } : {}),
+        ...(mount?.secret ? { secret: mount.secret } : {}),
+        ...(kind !== undefined ? { kind } : {}),
+        ...(mode !== undefined ? { mode } : {}),
+    };
+}
+export function publicContainer(row) {
+    return {
+        containerName: row?.containerName ?? "",
+        status: row?.status ?? "",
+        ...(row?.imageId ? { imageId: row.imageId } : {}),
+        mounts: (row?.mounts ?? []).map(publicMount),
+        paths: row?.paths ?? [],
+        env: row?.env ?? {},
+        secretEnv: row?.secretEnv ?? {},
+    };
+}
+export function publicImage(image) {
+    return {
+        imageId: image?.imageId ?? "",
+        ...(image?.parent ? { parent: image.parent } : {}),
+        packages: image?.packages ?? [],
+        isBase: image?.isBase ?? false,
+        status: image?.status ?? "",
+        ...(image?.primitive ? { primitive: image.primitive } : {}),
+        ...(image?.packageManager ? { packageManager: image.packageManager } : {}),
+        ...(image?.builtAt ? { builtAt: image.builtAt } : {}),
+        basePublic: image?.basePublic ?? false,
+        ...(image?.imageTag ? { imageTag: image.imageTag } : {}),
+    };
+}
+export function publicDaemon(info) {
+    const running = info?.running ?? false;
+    return {
+        name: info?.name ?? "",
+        argv: info?.argv ?? [],
+        running,
+        // An exit code only means something once the daemon has exited; the proto
+        // field defaults to 0 while it runs.
+        ...(!running && info?.exitCode !== undefined && info?.exitCode !== null
+            ? { exitCode: info.exitCode }
+            : {}),
+        ...(info?.startedAt ? { startedAt: info.startedAt } : {}),
+        ...(info?.stoppedAt ? { stoppedAt: info.stoppedAt } : {}),
+        ...(info?.uid !== undefined && info?.uid !== null ? { uid: info.uid } : {}),
+        ...(info?.gid !== undefined && info?.gid !== null ? { gid: info.gid } : {}),
+        ...(Array.isArray(info?.groups) && info.groups.length > 0
+            ? { groups: info.groups }
+            : {}),
+    };
+}

package/dist/read-only-shell.d.ts

@@ -0,0 +1,14 @@
+import { type ReasonLocale } from "./approval-reasons.js";
+import { type WorkspaceResolver } from "./workspace-binding.js";
+export declare const REMOUNT_TOOL_NAME = "dsh_podman_builtin_remount_read_only";
+export declare const READ_ONLY_GATED_TOOLS: ReadonlySet<string>;
+export type ReadOnlyShellDecision = {
+    kind: "allow";
+} | {
+    kind: "deny";
+    reason: string;
+} | undefined;
+export declare function createReadOnlyShellGate(deps: {
+    resolver: WorkspaceResolver;
+    approve: (exec: any, reason: string) => Promise<boolean>;
+}): (exec: any, locale: ReasonLocale) => Promise<ReadOnlyShellDecision>;

package/dist/read-only-shell.js

@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { currentCwd, sessionWorkspaceSlug } from "./guest-rpc.js";
+import { mountKindFromProto, mountKindToProto } from "./mount-enums.js";
+import { renderDenial, renderReason, } from "./approval-reasons.js";
+// The synthetic tool name the read-only remount prompt is raised under. The
+// `dsh_podman_builtin_` prefix is reserved for plugin-raised prompts about
+// built-in operations, so the browser panel can recognise them without
+// mistaking a real tool for one.
+export const REMOUNT_TOOL_NAME = "dsh_podman_builtin_remount_read_only";
+// The tools the read-only gate covers: the built-in shell and file tools, and
+// the plugin's counterparts plus daemons (everything that would otherwise be
+// denied by read-only and can run or write through the container's mounts).
+export const READ_ONLY_GATED_TOOLS = new Set([
+    "bash",
+    "pwsh",
+    "write",
+    "edit",
+    "container_bash",
+    "container_exec",
+    "container_write",
+    "container_edit",
+    "daemon_start",
+]);
+// The read-only shell gate: under read-only permission, the covered tools run
+// once every mount that carries a mode is read-only. Otherwise the user is
+// asked (through `approve`) to remount the read-write mounts read-only; on
+// approval the container is recreated with the read-only list and the tool runs.
+export function createReadOnlyShellGate(deps) {
+    return async (exec, locale) => {
+        const name = String(exec?.name ?? "");
+        if (!READ_ONLY_GATED_TOOLS.has(name))
+            return undefined;
+        const container = containerOf(exec);
+        const state = await readContainerMounts(deps.resolver, exec, container);
+        // An unreadable container falls through to the caller's plain denial: the
+        // gate never widens access it could not verify.
+        if (state === undefined)
+            return undefined;
+        const remount = state.mounts.filter((mount) => carriesMode(mount.kind) && mount.mode !== "MOUNT_MODE_READ_ONLY");
+        if (remount.length === 0)
+            return { kind: "allow" };
+        const keep = state.mounts.filter((mount) => !remount.includes(mount));
+        const reason = renderReason(locale, {
+            kind: "read_only_remount",
+            tool: name,
+            remount: remount.map(mountFactOf),
+            keep: keep.map(mountFactOf),
+        });
+        if (!(await deps.approve(exec, reason))) {
+            return {
+                kind: "deny",
+                reason: renderDenial(locale, {
+                    kind: "read_only_remount_declined",
+                    tool: name,
+                }),
+            };
+        }
+        await remountReadOnly(deps.resolver, exec, container, state.mounts);
+        return { kind: "allow" };
+    };
+}
+// The logical container a tool call targets: its `container` argument for the
+// plugin's tools, the default container for the built-in ones.
+function containerOf(exec) {
+    const container = exec?.arguments?.container;
+    return typeof container === "string" && container !== "" ? container : "default";
+}
+// Whether a mount kind carries a mode: project and volume mounts do; tmpfs is
+// always read-write and secret mounts take none.
+function carriesMode(kind) {
+    return (kind === undefined ||
+        kind === "" ||
+        kind === "MOUNT_KIND_PROJECT" ||
+        kind === "MOUNT_KIND_VOLUME");
+}
+// readContainerMounts resolves the workspace and returns the target container's
+// mounts, or undefined when the container cannot be read.
+async function readContainerMounts(resolver, exec, container) {
+    try {
+        const slug = await sessionWorkspaceSlug(resolver, currentCwd(exec));
+        const result = await resolver.control("listContainers", {});
+        const row = (result.containers ?? []).find((candidate) => candidate.workspaceSlug === slug &&
+            candidate.containerName === container);
+        if (row === undefined)
+            return undefined;
+        return { slug, mounts: (row.mounts ?? []) };
+    }
+    catch {
+        return undefined;
+    }
+}
+// remountReadOnly recreates the container with every project and volume mount
+// read-only; tmpfs stays read-write and secrets carry no mode. One recreate
+// replaces the whole list, so the mounts never pass through an inconsistent
+// state.
+async function remountReadOnly(resolver, exec, container, mounts) {
+    await resolver.control("recreateContainer", {
+        workspaceSlug: await sessionWorkspaceSlug(resolver, currentCwd(exec)),
+        container,
+        mounts: mounts.map(readOnlyMountRequest),
+    });
+}
+// readOnlyMountRequest maps a stored mount onto the control plane's mount
+// message with the mode forced read-only.
+function readOnlyMountRequest(mount) {
+    const kind = mountKindFromProto(typeof mount.kind === "string" ? mount.kind : undefined);
+    const request = {
+        projectName: typeof mount.projectName === "string" ? mount.projectName : "",
+        kind: mountKindToProto(kind),
+    };
+    if (carriesMode(mount.kind))
+        request.mode = "MOUNT_MODE_READ_ONLY";
+    else if (kind === "tmpfs")
+        request.mode = "MOUNT_MODE_READ_WRITE";
+    if (typeof mount.destination === "string" && mount.destination !== "") {
+        request.destination = mount.destination;
+    }
+    if (typeof mount.volume === "string" && mount.volume !== "") {
+        request.volume = mount.volume;
+    }
+    if (typeof mount.secret === "string" && mount.secret !== "") {
+        request.secret = mount.secret;
+    }
+    return request;
+}
+// mountFactOf renders one stored mount as an approval reason fact.
+function mountFactOf(mount) {
+    const resolved = mountKindFromProto(typeof mount.kind === "string" ? mount.kind : undefined);
+    const kind = resolved === "volume" || resolved === "secret" || resolved === "tmpfs"
+        ? resolved
+        : "project";
+    const destination = typeof mount.destination === "string" && mount.destination !== ""
+        ? mount.destination
+        : undefined;
+    const source = kind === "volume"
+        ? String(mount.volume ?? "")
+        : kind === "secret"
+            ? String(mount.secret ?? "")
+            : kind === "tmpfs"
+                ? ""
+                : String(mount.projectName ?? "");
+    return {
+        kind,
+        source,
+        ...(destination === undefined ? {} : { destination }),
+        readOnly: mount.mode === "MOUNT_MODE_READ_ONLY",
+    };
+}

package/dist/read-only-shell.test.d.ts

@@ -0,0 +1 @@
+export {};