@lone-wolf-akela/dsh-sandboxie-redirect 0.3.0

package/lib/tool-schema.mjs

@@ -0,0 +1,109 @@
+/**
+ * `sandbox_clear`'s output schema, kept out of the tool definition so a test can
+ * check it WITHOUT booting DSH.
+ *
+ * Why this file exists: `defineTool` compiles `parameters` with the PARAMETER
+ * spec DSL and `output.schema` with the VALUE schema DSL, and the two do not
+ * agree about `required`. The value DSL allows it only on a PROPERTY node — the
+ * direct children of a `properties` map — while the root, an `items` object and
+ * a `oneOf` branch all reject it. Getting that wrong does not merely lose the
+ * tool: `defineTool` throws while the plugin row composes, and the throw happens
+ * inside a cordis callback, where the loader reports it as an unattributed
+ * failure. That is exactly how a schema typo turned into "the tool silently does
+ * not exist" and, one restart later, into a boot failure.
+ *
+ * The rules below mirror `runSchemaCompiler`/`allowRequired` in
+ * `@deepseek-ai/dsh-tools` (read from the shipped bundle, not guessed):
+ *   - every node: the annotation keys, plus `type` (or `oneOf`), plus `enum` and
+ *     `const` on scalars, plus `properties`/`additionalProperties` on objects and
+ *     `items` on arrays;
+ *   - `required`   only where the parent node is a property-map entry;
+ *   - every OBJECT node must state `additionalProperties` as a boolean.
+ * The authoritative compiler still runs at registration; this is a pre-flight so
+ * a bad schema is caught before it costs a restart.
+ */
+
+/** Author-facing keys the DSL accepts on any node. */
+const ANNOTATION_KEYS = ["description", "title", "default", "examples"];
+/** Keys accepted on scalar nodes. */
+const SCALAR_TYPES = ["string", "number", "integer", "boolean", "null"];
+
+/**
+ * Collect every way `schema` breaks the value schema DSL.
+ * @param schema - an object-rooted value schema.
+ * @param path - diagnostic path for this node.
+ * @param allowRequired - whether this node may carry `required` (only property-map entries may).
+ * @returns a list of human-readable violations; empty means it looks legal.
+ */
+export function valueSchemaViolations(schema, path = "output.schema", allowRequired = false) {
+  const problems = [];
+  if (typeof schema !== "object" || schema === null) return [`${path} must be an object`];
+  const keys = Object.keys(schema);
+  const base = [...ANNOTATION_KEYS, "type", ...(allowRequired ? ["required"] : [])];
+
+  if (Object.hasOwn(schema, "oneOf")) {
+    const extra = keys.filter((key) => ![...base, "oneOf"].includes(key));
+    for (const key of extra) problems.push(`${path}.${key} is not a valid key on a oneOf node`);
+    if (Object.hasOwn(schema, "type")) problems.push(`${path} cannot declare both type and oneOf`);
+    if (!Array.isArray(schema.oneOf) || schema.oneOf.length < 2) problems.push(`${path}.oneOf must hold at least two schemas`);
+    else schema.oneOf.forEach((branch, index) => problems.push(...valueSchemaViolations(branch, `${path}.oneOf[${index}]`, false)));
+    return problems;
+  }
+
+  const type = schema.type;
+  if (!SCALAR_TYPES.includes(type) && type !== "object" && type !== "array" && type !== "json") {
+    problems.push(`${path}.type must be string/number/integer/boolean/null/array/object/json, or use oneOf`);
+    return problems;
+  }
+
+  const allowed =
+    type === "object"
+      ? [...base, "properties", "additionalProperties"]
+      : type === "array"
+        ? [...base, "items"]
+        : type === "json"
+          ? [...base]
+          : [...base, "enum", "const"];
+  for (const key of keys) if (!allowed.includes(key)) problems.push(`${path}.${key} is not supported by the value schema DSL${key === "required" ? " on this node (only a property-map entry may carry it)" : ""}`);
+
+  if (type === "object") {
+    if (typeof schema.additionalProperties !== "boolean") problems.push(`${path}.additionalProperties must be explicitly true or false`);
+    for (const [name, child] of Object.entries(schema.properties ?? {})) {
+      // Property-map entries are the ONLY nodes that may carry `required`.
+      problems.push(...valueSchemaViolations(child, `${path}.properties.${name}`, true));
+    }
+  }
+  if (type === "array" && Object.hasOwn(schema, "items")) {
+    problems.push(...valueSchemaViolations(schema.items, `${path}.items`, false));
+  }
+  return problems;
+}
+
+/** Wire payload of `sandbox_clear`: what it did, and what it found. */
+export const OUTPUT_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    action: { type: "string", required: true, enum: ["inspect", "clear", "status"] },
+    workspace: { type: "string", required: true },
+    copies: {
+      type: "array",
+      required: true,
+      items: {
+        // No `required` on this node: an `items` object is not a property-map
+        // entry, so the DSL rejects it there (see the header).
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          box: { type: "string", required: true },
+          root: { type: "string", required: true },
+          files: { type: "integer", required: true },
+          bytes: { type: "integer", required: true },
+          truncated: { type: "boolean", required: true }
+        }
+      }
+    },
+    cleared: { type: "array", required: true, items: { type: "string" } },
+    note: { type: "string", required: true }
+  }
+};

package/lib/tool.mjs

@@ -0,0 +1,323 @@
+/**
+ * The `sandbox_clear` tool — let the agent discard this workspace's Sandboxie
+ * copy without leaving the conversation.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Under the copy-on-write preset, reads and writes outside the workspace are
+ * served from a per-workspace copy. That is the point of the mode, but in a long
+ * task it creates two problems a shell command cannot fix:
+ *
+ *  - a STALE copy from an earlier run masks the real state (a file "exists" that
+ *    the real disk does not have, or an old virtualised edit is still in force);
+ *  - a copy that only grows (every `%TEMP%` write, every download) hides the
+ *    real filesystem behind it.
+ *
+ * Discarding the copy needs Sandboxie's own API, which a BOXED process cannot
+ * reach (Sandboxie hides the box list from one), so a shell command cannot do
+ * it. The harness process can, which is also why this tool works in every
+ * permission mode: the mode governs how commands are spawned, not what a
+ * host-side tool may do.
+ *
+ * WHY IT LOOKS LIKE THIS (a real failure, not a preference)
+ * --------------------------------------------------------
+ * The first version imported `boxes.mjs`, which loads koffi — a NATIVE module.
+ * The launcher is a plain-Node process where koffi loads fine (that is how
+ * `--manage` has always worked), but this half runs inside the Electron host,
+ * and the row never registered: no tool, and no error anyone could see, because
+ * a module-level import failure happens before any of this file's code can log.
+ * So now:
+ *
+ *  - the module level imports NOTHING but Node builtins, so every failure below
+ *    is reached and logged to `tool.log`;
+ *  - native work happens in a CHILD process running the launcher under the
+ *    managed Node runtime — the exact path `--manage clean` already uses;
+ *  - the ownership question is answered with pure fs (the same helpers the
+ *    header chip uses), so no native module is needed to decide what is ours.
+ *
+ * SAFETY
+ * ------
+ *  - It never takes a box name or a path from the model. The only boxes it can
+ *    touch are those whose Sandboxie configuration grants THIS session's
+ *    workspace access — the same test the chip uses, so what the tool reports
+ *    and what the user sees cannot disagree.
+ *  - `mode: "clear"` is explicit and is the only thing that deletes; `inspect`
+ *    is a pure read, including the size accounting. Both exist because anything
+ *    living only in the copy is destroyed by a clear.
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { logFile } from "./log.mjs";
+import { resolveNodePath } from "./redirect.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = path.resolve(HERE, "..");
+/** Diagnostics land in the plugin's state directory, never inside the package. */
+const LOG_PATH = logFile("tool.log");
+
+/** Stop accounting after this many files or this long, and say so. */
+const WALK_FILE_CAP = 20000;
+const WALK_MS_CAP = 3000;
+
+/** Append one diagnostic line; a diagnostic must never be the reason a call fails. */
+function log(message) {
+  try {
+    fs.appendFileSync(LOG_PATH, `${new Date().toISOString()} ${message}\n`);
+  } catch {
+    /* nothing sensible to do here */
+  }
+}
+
+/**
+ * The registrant context, kept for `mode: "status"`. Null outside a live plugin.
+ * @type {any}
+ */
+let pluginScope = null;
+
+/** Size up one copy tree. Host-side on purpose: walking `C:\Sandbox\…` from inside the box hangs. */
+function measure(root) {
+  let files = 0;
+  let bytes = 0;
+  let truncated = false;
+  if (!fs.existsSync(root)) return { files, bytes, truncated };
+  const started = Date.now();
+  const stack = [root];
+  while (stack.length > 0) {
+    if (files >= WALK_FILE_CAP || Date.now() - started > WALK_MS_CAP) {
+      truncated = true;
+      break;
+    }
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      files += 1;
+      try {
+        bytes += fs.statSync(full).size;
+      } catch {
+        /* a file that vanished mid-walk simply does not count */
+      }
+    }
+  }
+  return { files, bytes, truncated };
+}
+
+/**
+ * Every box whose Sandboxie configuration grants this workspace access, with its
+ * size. Pure fs — no Sandboxie API, no native module. Exported so a test (and
+ * the `inspect-copies` CLI) can run it against the real configuration.
+ * @param host - the loaded host half (its config helpers).
+ * @param naming - the loaded naming helpers (`boxRoot`).
+ * @param workspace - the session workspace.
+ * @param options.sizes - pass false to skip the walk; the caller is then running
+ *   INSIDE a box, where measuring `C:\Sandbox\…` recurses into the redirection
+ *   layer and hangs.
+ */
+export function copiesFor(host, naming, workspace, options = {}) {
+  const sections = host.readIniSections();
+  if (sections === null) return null;
+  const copies = [];
+  for (const [box, body] of sections) {
+    if (!host.sectionOwnsWorkspace(body, workspace)) continue;
+    const root = host.rootForBox(box, sections);
+    copies.push(options.sizes === false ? { box, root } : { box, root, ...measure(root) });
+  }
+  return copies;
+}
+
+function humanBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+
+const DESCRIPTION = [
+  "Discard this workspace's Sandboxie copy — the redirected writes the copy-on-write permission preset collects for paths OUTSIDE the workspace.",
+  "Use it when a command's view of the filesystem disagrees with the real disk (a file that exists only in the copy, or a stale copy from an earlier run masking the real state), or to reclaim the space a long task accumulated.",
+  '`mode: "inspect"` only reports; `mode: "clear"` stops the box\'s processes, deletes its copy and drops its Sandboxie configuration, so the next copy-on-write command starts from a fresh empty box. Anything that exists ONLY in the copy is destroyed, so inspect first when the copy may hold the only copy of something.',
+  "Only boxes whose Sandboxie configuration grants THIS session's workspace access can be touched, and the tool works in every permission mode because it runs in the harness process rather than in the sandbox."
+].join(" ");
+
+/**
+ * Register `sandbox_clear`.
+ * @param ctx - registrant context carrying the tool registry.
+ */
+export async function apply(ctx) {
+  try {
+    // Everything risky is imported HERE, not at module level: a throw above this
+    // point aborts the row before any log line can be written, which is exactly
+    // how the first version failed invisibly.
+    const { importCore } = await import("./core.mjs");
+    const { defineTool } = await importCore("@deepseek-ai/dsh-tools");
+    const { OUTPUT_SCHEMA, valueSchemaViolations } = await import("./tool-schema.mjs");
+    const host = await import("./host.mjs");
+    const naming = await import("./naming.mjs");
+
+    ctx.inject(["tools"], (scope) => {
+      // cordis CALLS this callback, so it is outside the try/catch below: a
+      // throw here is reported by the loader as an unattributed failure, which
+      // is how the previous schema error stayed invisible in the logs. Hence its
+      // own guard.
+      try {
+      // Kept so `mode: "status"` can ask the projection registry directly what
+      // it holds for the calling session. The header chip goes through that
+      // registry, and when the chip is wrong there is otherwise no way to tell a
+      // stale client from a fold that never ran.
+      pluginScope = scope;
+      // Pre-flight the schema, because `defineTool` throwing here is invisible
+      // and cost two restarts. The authoritative compiler still has the last
+      // word; this converts an unattributed throw into a logged skip.
+      const problems = valueSchemaViolations(OUTPUT_SCHEMA);
+      if (problems.length > 0) {
+        for (const problem of problems) log(`schema pre-flight: ${problem}`);
+        log("refusing to register sandbox_clear with an invalid output schema");
+        return;
+      }
+      scope.tools.register(
+      defineTool({
+        name: "sandbox_clear",
+        description: DESCRIPTION,
+        parameters: {
+          mode: {
+            type: "string",
+            required: true,
+            enum: ["inspect", "clear", "status"],
+            description: "inspect reports the copies and their size; clear deletes them (destroying anything that exists only in the copy)."
+          }
+        },
+        output: {
+          // Checked by valueSchemaViolations() before registration, and by
+          // test/validate-patch.mjs offline: see lib/tool-schema.mjs for why the
+          // parameter DSL and the value schema DSL disagree about required.
+          schema: OUTPUT_SCHEMA,
+          render: (_args, value) => {
+            const lines = value.copies.map(
+              (copy) =>
+                `- ${copy.box}: ${copy.files} file(s), ${humanBytes(copy.bytes)}${copy.truncated ? " (counting stopped early)" : ""} at ${copy.root}`
+            );
+            const head =
+              value.action === "clear"
+                ? `Cleared ${value.cleared.length} sandbox copy/copies for ${value.workspace}.`
+                : `Sandbox copies for ${value.workspace}: ${value.copies.length} found.`;
+            return [{ type: "text", text: [head, ...lines, value.note].join("\n") }];
+          }
+        },
+        execute(args, exec) {
+          const cwd = exec.agent?.session?.header?.cwd;
+          if (typeof cwd !== "string" || cwd.length === 0) {
+            throw new Error("sandbox_clear needs the calling session's workspace, and this caller has none");
+          }
+          if (args.mode === "status") {
+            // Ask the projection registry what it holds for THIS session. The
+            // header chip reads that value, so this separates "the fold never
+            // ran" from "the client never got it" — the ambiguity that made the
+            // chip cost several restarts to even locate.
+            let detail;
+            try {
+              const projections = pluginScope?.get?.("sessionProjections");
+              const session = exec.agent?.session;
+              const state = projections?.stateOf?.(session, "sandboxBox");
+              detail = `projections=${projections === undefined ? "absent" : "present"} session=${session?.id ?? "?"} seq=${session?.seq ?? "?"} stateOf=${JSON.stringify(state ?? null)}`;
+            } catch (error) {
+              detail = `status query threw: ${error?.message ?? error}`;
+            }
+            log(`status: ${detail}`);
+            return Promise.resolve({ action: "status", workspace, copies: [], cleared: [], note: detail });
+          }          const workspace = naming.canonicalWorkspace(cwd);
+          const before = copiesFor(host, naming, workspace);
+          if (before === null) {
+            throw new Error(`cannot read ${host.sandboxIniPath()}, so the sandbox state is unknown; refusing to act`);
+          }
+          const listed = before.map((copy) => ({
+            box: copy.box,
+            root: copy.root,
+            files: copy.files,
+            bytes: copy.bytes,
+            truncated: copy.truncated
+          }));
+          log(`execute mode=${args.mode} workspace=${workspace} copies=${listed.map((copy) => copy.box).join(",") || "(none)"}`);
+
+          if (args.mode === "inspect") {
+            return Promise.resolve({
+              action: "inspect",
+              workspace,
+              copies: listed,
+              cleared: [],
+              note:
+                before.length === 0
+                  ? "No copy exists for this workspace, so reads and writes outside it already reflect the real disk."
+                  : 'Call again with mode: "clear" to delete these copies. Files that exist only in a copy are lost.'
+            });
+          }
+
+          // The deletion runs in a CHILD process under the managed Node runtime:
+          // the launcher owns the Sandboxie/native work, and this is the same
+          // `--manage clean` path a human would use from a console.
+          const node = resolveNodePath();
+          if (node === null) {
+            throw new Error(
+              "cannot find a genuine Node runtime to run the launcher; set DSH_SBIE_NODE to a node.exe path"
+            );
+          }
+          const launcher = path.join(PACKAGE_ROOT, "bin", "dsh-sbie-run.mjs");
+          const result = spawnSync(node, [launcher, "--manage", "clean", workspace], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 180000
+          });
+          const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+          log(`clear exit=${result.status} output=${output.replace(/\s+/g, " ").slice(0, 400)}`);
+          // The box's existence is what the header chip and the session
+          // projection read, so drop the memo now instead of waiting it out.
+          host.invalidateBoxCache();
+          const stillThere = copiesFor(host, naming, workspace) ?? [];
+          const cleared = listed.filter((copy) => !stillThere.some((after) => after.box === copy.box)).map((copy) => copy.box);
+
+          if (result.status !== 0 && cleared.length === 0) {
+            throw new Error(`the launcher could not clear the copies (exit ${result.status}): ${output || "no output"}`);
+          }
+          return Promise.resolve({
+            action: "clear",
+            workspace,
+            copies: listed,
+            cleared,
+            note:
+              listed.length === 0
+                ? "Nothing to clear: no managed box belongs to this workspace."
+                : "The copies are gone, so paths outside the workspace read from the real disk again. The next copy-on-write command creates a fresh, empty box."
+          });
+        },
+        presentCall: (args) => ({
+          card: "generic",
+          title: args.mode === "clear" ? "Clear the sandbox copy" : "Inspect the sandbox copy",
+          kind: "other",
+          rawInput: args
+        })
+      })
+      );
+      log("apply: registered sandbox_clear");
+      } catch (error) {
+        log(`registering sandbox_clear FAILED: ${error?.stack ?? error}`);
+      }
+    });
+  } catch (error) {
+    // `apply` is async, so an escaping throw would surface as an unhandled
+    // rejection instead of a readable diagnostic.
+    log(`apply FAILED: ${error?.stack ?? error}`);
+  }
+}
+
+export const inject = ["tools"];

package/lib/words.mjs

@@ -0,0 +1,46 @@
+/**
+ * Word lists for Docker-style box names (`dsh_brisk_otter`).
+ *
+ * Constraints that shaped these lists:
+ * - Sandboxie accepts only alphanumerics and `_` in a box name (Start.exe's own
+ *   parser: `iswalnum(c) || c === '_'`), so every word is plain lowercase ASCII.
+ * - The whole name must stay well inside Sandboxie's 34-wide-character box-name
+ *   buffer, so words are short.
+ * - 90 x 90 = 8100 first-choice combinations; `boxNameCandidates` walks further
+ *   on the rare collision instead of lengthening the name.
+ */
+
+export const ADJECTIVES = [
+  "able", "amber", "ancient", "arctic", "autumn", "azure", "bald", "beige", "bitter", "bold",
+  "bouncy", "brave", "breezy", "bright", "brisk", "bronze", "burly", "busy", "calm", "candid",
+  "canny", "cheery", "chilly", "civic", "clever", "cloudy", "cosmic", "cozy", "crimson", "crisp",
+  "curious", "dapper", "daring", "dawn", "deft", "dense", "dizzy", "dusty", "eager", "early",
+  "earthy", "elated", "electric", "elegant", "ember", "fancy", "fearless", "fleet", "fluffy", "foggy",
+  "fond", "frank", "frosty", "gilded", "glad", "glossy", "golden", "graceful", "grand", "grateful",
+  "green", "hardy", "hazel", "hearty", "hidden", "honest", "humble", "ivory", "jolly", "jovial",
+  "keen", "kindly", "lively", "lucid", "lucky", "lush", "mellow", "merry", "mighty", "misty",
+  "modest", "mossy", "nimble", "noble", "olive", "placid", "playful", "plucky", "polar", "polished",
+  "proud", "quaint", "quiet", "rapid", "rustic", "sandy", "scarlet", "serene", "sharp", "shiny",
+  "silent", "silky", "silver", "sleek", "smooth", "snowy", "sober", "solar", "spry", "steady",
+  "sturdy", "sunny", "swift", "tame", "tender", "teal", "tidy", "tiny", "topaz", "tranquil",
+  "valiant", "velvet", "vivid", "warm", "wise", "witty", "zesty"
+];
+
+export const NOUNS = [
+  "acorn", "alder", "anchor", "antler", "arrow", "aspen", "atlas", "badger", "bamboo", "basin",
+  "beacon", "beaver", "berry", "birch", "bison", "blossom", "bramble", "brook", "bubble", "cactus",
+  "canyon", "cedar", "cello", "cinder", "clover", "cobalt", "comet", "compass", "coral", "cosmos",
+  "cotton", "crab", "crane", "crater", "cricket", "crystal", "cypress", "dahlia", "daisy", "dolphin",
+  "dragon", "dune", "eagle", "ember", "falcon", "fawn", "fern", "finch", "fjord", "flint",
+  "forest", "fossil", "fox", "galaxy", "garden", "gecko", "ginger", "glacier", "gopher", "granite",
+  "grove", "gull", "harbor", "hazel", "heron", "hickory", "hollow", "ibis", "indigo", "island",
+  "ivy", "jasmine", "jasper", "juniper", "kestrel", "koala", "lantern", "larch", "lark", "laurel",
+  "lava", "lemon", "lilac", "lily", "linen", "lotus", "lynx", "magnet", "magnolia", "mango",
+  "maple", "marble", "meadow", "mesa", "meteor", "mint", "moth", "mulberry", "nebula", "nectar",
+  "nettle", "oasis", "ocean", "olive", "onyx", "orbit", "orchid", "osprey", "otter", "panda",
+  "pebble", "pelican", "penguin", "pepper", "petal", "pine", "pixel", "plum", "pollen", "poppy",
+  "prairie", "prism", "puffin", "quartz", "quill", "raven", "reef", "ridge", "robin", "rowan",
+  "saffron", "sage", "salmon", "sequoia", "shale", "sparrow", "spruce", "summit", "sycamore", "talon",
+  "thistle", "thunder", "tiger", "timber", "topaz", "tulip", "tundra", "turtle", "valley", "violet",
+  "walnut", "walrus", "willow", "winter", "wren", "yarrow", "zephyr"
+];

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@lone-wolf-akela/dsh-sandboxie-redirect",
+  "version": "0.3.0",
+  "description": "DSH bundle adding a copy-on-write permission preset: shell commands run inside a per-workspace Sandboxie box, so writes outside the workspace land in the box's copy while the real disk is untouched.",
+  "type": "module",
+  "license": "MIT",
+  "author": "lone-wolf-akela",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lone-wolf-akela/dsh-sandboxie-redirect.git"
+  },
+  "bugs": {
+    "url": "https://github.com/lone-wolf-akela/dsh-sandboxie-redirect/issues"
+  },
+  "homepage": "https://github.com/lone-wolf-akela/dsh-sandboxie-redirect#readme",
+  "os": [
+    "win32"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "lib/provider.mjs",
+  "exports": {
+    ".": {
+      "default": "./lib/provider.mjs"
+    },
+    "./provider": {
+      "default": "./lib/provider.mjs"
+    },
+    "./host": {
+      "default": "./lib/host.mjs"
+    },
+    "./note": {
+      "default": "./lib/note.mjs"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "dsh-sbie-run": "./bin/dsh-sbie-run.mjs"
+  },
+  "files": [
+    "lib",
+    "bin",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "dsh-bundle",
+    "deepseek-harness",
+    "sandboxie",
+    "sandbox",
+    "copy-on-write",
+    "permission-preset",
+    "windows"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "test": "node test/unit.mjs && node test/host-projection.mjs && node test/validate-patch.mjs",
+    "test:acceptance": "node test/run-tests.mjs",
+    "test:soak": "node test/soak.mjs 30",
+    "validate:patch": "node test/validate-patch.mjs",
+    "pack:check": "npm pack --dry-run"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.2.0-rc.2"
+  },
+  "devDependencies": {
+    "js-yaml": "^4.1.0"
+  }
+}