@impz/client 2.1.0 → 2.2.1

package/dist/index.d.ts

@@ -81,6 +81,7 @@ declare const ExecStartMessageSchema: z.ZodObject<{
     broker: "broker";
   }>>>;
   log: z.ZodOptional<z.ZodBoolean>;
+  dropSysAdmin: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 declare const ExecAttachMessageSchema: z.ZodObject<{
   type: z.ZodLiteral<"attach">;
@@ -16594,6 +16595,7 @@ declare const impContract: {
         brokerRefusals: z.ZodOptional<z.ZodBoolean>;
         grantFilters: z.ZodOptional<z.ZodBoolean>;
         readOnlyFiles: z.ZodOptional<z.ZodBoolean>;
+        execDropSysAdmin: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>>;
     }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
       NOT_FOUND: {
@@ -20532,6 +20534,7 @@ declare const SystemInfoSchema: z.ZodObject<{
     brokerRefusals: z.ZodOptional<z.ZodBoolean>;
     grantFilters: z.ZodOptional<z.ZodBoolean>;
     readOnlyFiles: z.ZodOptional<z.ZodBoolean>;
+    execDropSysAdmin: z.ZodOptional<z.ZodBoolean>;
   }, z.core.$strip>>;
 }, z.core.$strip>;
 type SystemInfo = z.infer<typeof SystemInfoSchema>;
@@ -20685,6 +20688,7 @@ interface ExecOptions {
   readonly resumeFrom?: ResumeFrom;
   readonly require?: readonly ExecRequirement[];
   readonly log?: boolean;
+  readonly dropSysAdmin?: boolean;
   readonly signal?: Readonly<AbortSignal>;
   readonly maxUnreadBytes?: number;
 }

package/dist/index.js

@@ -3,7 +3,7 @@ import { RPCLink } from "@orpc/client/fetch";
 import * as z from "zod";
 //#endregion
 //#region src/check-server.ts
-const CLIENT_VERSION = "2.1.0";
+const CLIENT_VERSION = "2.2.1";
 async function checkServer(rpc) {
 	const info = await rpc.system.info();
 	return {
@@ -221,7 +221,8 @@ const ExecStartMessageSchema = z.object({
 	killGraceMs: z.int().min(1).max(6e4).optional(),
 	resumeFrom: ResumeFromSchema.optional(),
 	require: z.array(z.enum(EXEC_REQUIREMENTS)).optional(),
-	log: z.boolean().optional()
+	log: z.boolean().optional(),
+	dropSysAdmin: z.boolean().optional()
 }).refine((start) => start.session === void 0 || start.tty, {
 	message: "a session needs a tty",
 	path: ["tty"]
@@ -243,6 +244,9 @@ const ExecStartMessageSchema = z.object({
 }).refine((start) => start.require === void 0 || start.require.length === 0 || start.tool === void 0 && start.outer !== true, {
 	message: "a tool or an outer exec takes no require",
 	path: ["require"]
+}).refine((start) => start.dropSysAdmin !== true || start.tool === void 0 && start.outer !== true, {
+	message: "a tool or an outer exec cannot drop CAP_SYS_ADMIN",
+	path: ["dropSysAdmin"]
 });
 const ExecAttachMessageSchema = z.object({
 	type: z.literal("attach"),
@@ -906,11 +910,18 @@ var ExecError = class extends Error {
 	}
 };
 //#endregion
-//#region src/exec/check-exec-require.ts
+//#region src/exec/check-exec-feature.ts
 const CHECK_TIMEOUT_MS$1 = 5e3;
-const FeaturesSchema = z.object({ execRequire: z.boolean().optional() });
+const EXEC_FEATURE_GAPS = {
+	execRequire: "this impd is older than 0.30.0 and does not check exec requirements",
+	execDropSysAdmin: "this impd cannot start a command without CAP_SYS_ADMIN"
+};
+const FeaturesSchema = z.object({
+	execRequire: z.boolean().optional(),
+	execDropSysAdmin: z.boolean().optional()
+});
 const InfoAnswerSchema = z.object({ json: z.object({ features: FeaturesSchema.optional() }) });
-async function checkExecRequire(baseUrl, token, customFetch = fetch) {
+async function checkExecFeature(feature, baseUrl, token, customFetch = fetch) {
 	let response;
 	try {
 		response = await customFetch(new Request(resolveImpdUrl(baseUrl, "/rpc/system/info").href, {
@@ -935,8 +946,8 @@ async function checkExecRequire(baseUrl, token, customFetch = fetch) {
 		code: null,
 		message: `impd answered system.info with ${String(response.status)}; nothing was started`
 	};
-	if (parsed.data.json.features?.execRequire === true) return null;
-	const detail = "this impd is older than 0.30.0 and does not check exec requirements";
+	if (parsed.data.json.features?.[feature] === true) return null;
+	const detail = EXEC_FEATURE_GAPS[feature];
 	return {
 		kind: "failed",
 		code: "PRECONDITION_FAILED",
@@ -1063,8 +1074,11 @@ function openExecSession(options) {
 	};
 	const sendOpen = async () => {
 		const start = options.start;
-		if ("argv" in start && start.require !== void 0 && start.require.length > 0) {
-			const refusal = await checkExecRequire(options.baseUrl, options.token, options.fetch);
+		const features = [];
+		if ("argv" in start && start.require !== void 0 && start.require.length > 0) features.push("execRequire");
+		if ("argv" in start && start.dropSysAdmin === true) features.push("execDropSysAdmin");
+		for (const feature of features) {
+			const refusal = await checkExecFeature(feature, options.baseUrl, options.token, options.fetch);
 			if (refusal !== null) {
 				resolveOutcome(refusal);
 				return;
@@ -1254,7 +1268,8 @@ function openExec(deps, name, argv, options = {}) {
 		...options.killGraceMs !== void 0 && { killGraceMs: options.killGraceMs },
 		...options.resumeFrom !== void 0 && { resumeFrom: options.resumeFrom },
 		...options.require !== void 0 && { require: options.require },
-		...options.log === true && { log: true }
+		...options.log === true && { log: true },
+		...options.dropSysAdmin === true && { dropSysAdmin: true }
 	});
 }
 function openAttach(deps, name, session, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impz/client",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "Typed client for impd, the imp host daemon: imps, checkpoints, images and exec",
   "license": "MIT",
   "repository": {