@morlay/dsh-sandbox-local 0.0.13 → 0.0.14-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/dist/client.cjs +2 -4
  2. package/dist/client.d.cts +0 -4
  3. package/dist/client.d.mts +0 -4
  4. package/dist/client.mjs +2 -4
  5. package/dist/index.cjs +9 -18
  6. package/dist/index.d.mts +0 -4
  7. package/dist/index.mjs +8 -16
  8. package/dist/rows.cjs +1 -2
  9. package/dist/rows.d.mts +1 -3
  10. package/dist/rows.mjs +1 -2
  11. package/package.json +33 -33
package/dist/client.cjs CHANGED
@@ -4,7 +4,7 @@ window.__ModuleLoader__.load({
4
4
  var module = { exports: {} };
5
5
  var exports = module.exports;
6
6
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
7
- //#region src/client/locales.ts
7
+ // src/client/locales.ts
8
8
  const zh = {
9
9
  access: "额外可写根与拒绝项",
10
10
  accessHint: "一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；支持环境变量模板与 glob（`rw` 项必须是具体路径）。改完当场生效。"
@@ -13,8 +13,7 @@ window.__ModuleLoader__.load({
13
13
  access: "Extra writable roots and refusals",
14
14
  accessHint: "One entry per line: `rw <path>` grants a writable root, `r- <path>` makes it read-only, `-- <path>` denies it; env templates and globs work (`rw` entries must name a concrete path). Edits apply immediately."
15
15
  };
16
- //#endregion
17
- //#region src/client/index.ts
16
+ // src/client/index.ts
18
17
  const SANDBOX_NS = "sandbox-local";
19
18
  const FIELDS = ["access"];
20
19
  const NS = "settings.sandbox-local";
@@ -36,7 +35,6 @@ window.__ModuleLoader__.load({
36
35
  };
37
36
  }, "sandbox-local: field wording"));
38
37
  }
39
- //#endregion
40
38
  exports.NS = NS;
41
39
  exports.SANDBOX_NS = SANDBOX_NS;
42
40
  exports.apply = apply;
package/dist/client.d.cts CHANGED
@@ -1,12 +1,9 @@
1
1
  import { Context } from "@deepseek-ai/cordis";
2
- //#region src/client/locales.d.ts
3
2
  declare const zh: {
4
3
  readonly access: "额外可写根与拒绝项";
5
4
  readonly accessHint: "一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；支持环境变量模板与 glob（`rw` 项必须是具体路径）。改完当场生效。";
6
5
  };
7
6
  type SandboxFieldLocaleKey = keyof typeof zh;
8
- //#endregion
9
- //#region src/client/index.d.ts
10
7
  export declare const SANDBOX_NS = "sandbox-local";
11
8
  export declare const NS = "settings.sandbox-local";
12
9
  declare module "@deepseek-ai/dsh-client-ui-slots" {
@@ -16,5 +13,4 @@ declare module "@deepseek-ai/dsh-client-ui-slots" {
16
13
  }
17
14
  export declare const inject: string[];
18
15
  export declare function apply(ctx: Context): void;
19
- //#endregion
20
16
  export {};
package/dist/client.d.mts CHANGED
@@ -1,12 +1,9 @@
1
1
  import { Context } from "@deepseek-ai/cordis";
2
- //#region src/client/locales.d.ts
3
2
  declare const zh: {
4
3
  readonly access: "额外可写根与拒绝项";
5
4
  readonly accessHint: "一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；支持环境变量模板与 glob（`rw` 项必须是具体路径）。改完当场生效。";
6
5
  };
7
6
  type SandboxFieldLocaleKey = keyof typeof zh;
8
- //#endregion
9
- //#region src/client/index.d.ts
10
7
  export declare const SANDBOX_NS = "sandbox-local";
11
8
  export declare const NS = "settings.sandbox-local";
12
9
  declare module "@deepseek-ai/dsh-client-ui-slots" {
@@ -16,5 +13,4 @@ declare module "@deepseek-ai/dsh-client-ui-slots" {
16
13
  }
17
14
  export declare const inject: string[];
18
15
  export declare function apply(ctx: Context): void;
19
- //#endregion
20
16
  export {};
package/dist/client.mjs CHANGED
@@ -1,4 +1,4 @@
1
- //#region src/client/locales.ts
1
+ // src/client/locales.ts
2
2
  const zh = {
3
3
  access: "额外可写根与拒绝项",
4
4
  accessHint: "一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；支持环境变量模板与 glob（`rw` 项必须是具体路径）。改完当场生效。"
@@ -7,8 +7,7 @@ const en = {
7
7
  access: "Extra writable roots and refusals",
8
8
  accessHint: "One entry per line: `rw <path>` grants a writable root, `r- <path>` makes it read-only, `-- <path>` denies it; env templates and globs work (`rw` entries must name a concrete path). Edits apply immediately."
9
9
  };
10
- //#endregion
11
- //#region src/client/index.ts
10
+ // src/client/index.ts
12
11
  const SANDBOX_NS = "sandbox-local";
13
12
  const FIELDS = ["access"];
14
13
  const NS = "settings.sandbox-local";
@@ -30,5 +29,4 @@ function apply(ctx) {
30
29
  };
31
30
  }, "sandbox-local: field wording"));
32
31
  }
33
- //#endregion
34
32
  export { NS, SANDBOX_NS, apply, inject };
package/dist/index.cjs CHANGED
@@ -1,5 +1,5 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
- //#region \0rolldown/runtime.js
2
+ // \0rolldown/runtime.js
3
3
  var __create = Object.create;
4
4
  var __defProp = Object.defineProperty;
5
5
  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -20,7 +20,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
20
20
  value: mod,
21
21
  enumerable: true
22
22
  }) : target, mod));
23
- //#endregion
24
23
  let _deepseek_ai_dsh_fs = require("@deepseek-ai/dsh-fs");
25
24
  let _deepseek_ai_dsh_fs_local = require("@deepseek-ai/dsh-fs-local");
26
25
  let _deepseek_ai_schemastery = require("@deepseek-ai/schemastery");
@@ -29,7 +28,7 @@ let node_fs_promises = require("node:fs/promises");
29
28
  let node_path = require("node:path");
30
29
  let _deepseek_ai_dsh_sandbox = require("@deepseek-ai/dsh-sandbox");
31
30
  let _deepseek_ai_dsh_sandbox_local = require("@deepseek-ai/dsh-sandbox-local");
32
- //#region src/config.ts
31
+ // src/config.ts
33
32
  const localized = (text) => text;
34
33
  const Config = _deepseek_ai_schemastery.default.object({
35
34
  access: _deepseek_ai_schemastery.default.union([_deepseek_ai_schemastery.default.array(_deepseek_ai_schemastery.default.string()), _deepseek_ai_schemastery.default.string()]).default([]).description(localized({
@@ -66,8 +65,7 @@ function upstreamConfigOf(config) {
66
65
  diffBasisMaxBytes: config.diffBasisMaxBytes.get()
67
66
  };
68
67
  }
69
- //#endregion
70
- //#region src/containment.ts
68
+ // src/containment.ts
71
69
  const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
72
70
  async function statIfPresent(path) {
73
71
  try {
@@ -104,8 +102,7 @@ async function isPathUnder(path, root, caseSensitive = process.platform !== "win
104
102
  ancestor = parent;
105
103
  }
106
104
  }
107
- //#endregion
108
- //#region src/rules.ts
105
+ // src/rules.ts
109
106
  const ENV_TEMPLATE = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
110
107
  const ACCESS_LINE = /^(rw|r-|--)(?:\s+(.*))?$/u;
111
108
  const GLOB_META = /[*?[]/;
@@ -248,8 +245,7 @@ function isDenied(rules, canonicalTarget) {
248
245
  function isReadOnly(rules, canonicalTarget) {
249
246
  return matches(canonicalTarget, rules.readOnlySubtrees, rules.readOnlyPatterns);
250
247
  }
251
- //#endregion
252
- //#region src/fs.ts
248
+ // src/fs.ts
253
249
  var ConfigurableFileSystem = class extends _deepseek_ai_dsh_fs_local.LocalFileSystem {
254
250
  static inject = ["sandboxPolicy"];
255
251
  defaultMode;
@@ -308,8 +304,7 @@ var ConfigurableFileSystem = class extends _deepseek_ai_dsh_fs_local.LocalFileSy
308
304
  return compiled;
309
305
  }
310
306
  };
311
- //#endregion
312
- //#region src/policy.ts
307
+ // src/policy.ts
313
308
  const SANDBOX_POLICY_CONTEXT = "sandbox:policy";
314
309
  const APPROVAL_POLICY_CONTEXT = "approval:policy";
315
310
  function renderPolicyContext(policy, rules) {
@@ -373,8 +368,7 @@ function installRuntimeContexts(ctx, rules, resolve) {
373
368
  });
374
369
  for (const agent of ctx.get("agents")?.list() ?? []) install(agent);
375
370
  }
376
- //#endregion
377
- //#region src/dialects.ts
371
+ // src/dialects.ts
378
372
  const SEPARATOR = "--";
379
373
  function separatorIndex(argv) {
380
374
  const index = argv.indexOf(SEPARATOR);
@@ -444,8 +438,7 @@ function extendConfinedArgv(argv, rules) {
444
438
  case "windows-acl": return [...argv];
445
439
  }
446
440
  }
447
- //#endregion
448
- //#region src/sandbox.ts
441
+ // src/sandbox.ts
449
442
  var ConfigurableSandboxProvider = class extends _deepseek_ai_dsh_sandbox_local.LocalSandboxProvider {
450
443
  access;
451
444
  compiled = /* @__PURE__ */ new Map();
@@ -476,8 +469,7 @@ var ConfigurableSandboxProvider = class extends _deepseek_ai_dsh_sandbox_local.L
476
469
  return compiled;
477
470
  }
478
471
  };
479
- //#endregion
480
- //#region src/index.ts
472
+ // src/index.ts
481
473
  const name = "sandbox-local";
482
474
  const inject = ["sandboxPolicy"];
483
475
  function warnAboutDegradedRules(ctx, rules) {
@@ -496,7 +488,6 @@ function apply(ctx, config) {
496
488
  new ConfigurableFileSystem(ctx, config);
497
489
  installRuntimeContexts(ctx, rules, (session) => ctx.sandboxPolicy.resolve({ session }));
498
490
  }
499
- //#endregion
500
491
  exports.Config = Config;
501
492
  exports.apply = apply;
502
493
  exports.inject = inject;
package/dist/index.d.mts CHANGED
@@ -3,7 +3,6 @@ import { Volatile } from "@deepseek-ai/cosmokit";
3
3
  import z from "@deepseek-ai/schemastery";
4
4
  import { Config as Config$1 } from "@deepseek-ai/dsh-fs-local";
5
5
  import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
6
- //#region src/config.d.ts
7
6
  export interface Config extends Config$2, Config$1 {
8
7
  access?: string | string[];
9
8
  }
@@ -16,10 +15,7 @@ interface ResolvedConfig extends Omit<Config, "access" | "runnerCommand" | "runn
16
15
  readonly diffBasisMaxBytes: Volatile<number>;
17
16
  }
18
17
  export declare const Config: z<Config, ResolvedConfig>;
19
- //#endregion
20
- //#region src/index.d.ts
21
18
  export declare const name = "sandbox-local";
22
19
  export declare const inject: string[];
23
20
  export declare function apply(ctx: Context, config: ResolvedConfig): void;
24
- //#endregion
25
21
  export type { ResolvedConfig };
package/dist/index.mjs CHANGED
@@ -5,7 +5,7 @@ import { stat } from "node:fs/promises";
5
5
  import { dirname, isAbsolute, resolve, sep } from "node:path";
6
6
  import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
7
7
  import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
8
- //#region src/config.ts
8
+ // src/config.ts
9
9
  const localized = (text) => text;
10
10
  const Config = z.object({
11
11
  access: z.union([z.array(z.string()), z.string()]).default([]).description(localized({
@@ -42,8 +42,7 @@ function upstreamConfigOf(config) {
42
42
  diffBasisMaxBytes: config.diffBasisMaxBytes.get()
43
43
  };
44
44
  }
45
- //#endregion
46
- //#region src/containment.ts
45
+ // src/containment.ts
47
46
  const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
48
47
  async function statIfPresent(path) {
49
48
  try {
@@ -80,8 +79,7 @@ async function isPathUnder(path, root, caseSensitive = process.platform !== "win
80
79
  ancestor = parent;
81
80
  }
82
81
  }
83
- //#endregion
84
- //#region src/rules.ts
82
+ // src/rules.ts
85
83
  const ENV_TEMPLATE = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
86
84
  const ACCESS_LINE = /^(rw|r-|--)(?:\s+(.*))?$/u;
87
85
  const GLOB_META = /[*?[]/;
@@ -224,8 +222,7 @@ function isDenied(rules, canonicalTarget) {
224
222
  function isReadOnly(rules, canonicalTarget) {
225
223
  return matches(canonicalTarget, rules.readOnlySubtrees, rules.readOnlyPatterns);
226
224
  }
227
- //#endregion
228
- //#region src/fs.ts
225
+ // src/fs.ts
229
226
  var ConfigurableFileSystem = class extends LocalFileSystem {
230
227
  static inject = ["sandboxPolicy"];
231
228
  defaultMode;
@@ -284,8 +281,7 @@ var ConfigurableFileSystem = class extends LocalFileSystem {
284
281
  return compiled;
285
282
  }
286
283
  };
287
- //#endregion
288
- //#region src/policy.ts
284
+ // src/policy.ts
289
285
  const SANDBOX_POLICY_CONTEXT = "sandbox:policy";
290
286
  const APPROVAL_POLICY_CONTEXT = "approval:policy";
291
287
  function renderPolicyContext(policy, rules) {
@@ -349,8 +345,7 @@ function installRuntimeContexts(ctx, rules, resolve) {
349
345
  });
350
346
  for (const agent of ctx.get("agents")?.list() ?? []) install(agent);
351
347
  }
352
- //#endregion
353
- //#region src/dialects.ts
348
+ // src/dialects.ts
354
349
  const SEPARATOR = "--";
355
350
  function separatorIndex(argv) {
356
351
  const index = argv.indexOf(SEPARATOR);
@@ -420,8 +415,7 @@ function extendConfinedArgv(argv, rules) {
420
415
  case "windows-acl": return [...argv];
421
416
  }
422
417
  }
423
- //#endregion
424
- //#region src/sandbox.ts
418
+ // src/sandbox.ts
425
419
  var ConfigurableSandboxProvider = class extends LocalSandboxProvider {
426
420
  access;
427
421
  compiled = /* @__PURE__ */ new Map();
@@ -452,8 +446,7 @@ var ConfigurableSandboxProvider = class extends LocalSandboxProvider {
452
446
  return compiled;
453
447
  }
454
448
  };
455
- //#endregion
456
- //#region src/index.ts
449
+ // src/index.ts
457
450
  const name = "sandbox-local";
458
451
  const inject = ["sandboxPolicy"];
459
452
  function warnAboutDegradedRules(ctx, rules) {
@@ -472,5 +465,4 @@ function apply(ctx, config) {
472
465
  new ConfigurableFileSystem(ctx, config);
473
466
  installRuntimeContexts(ctx, rules, (session) => ctx.sandboxPolicy.resolve({ session }));
474
467
  }
475
- //#endregion
476
468
  export { Config, apply, inject, name };
package/dist/rows.cjs CHANGED
@@ -1,5 +1,5 @@
1
1
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
- //#region src/rows.ts
2
+ // src/rows.ts
3
3
  function sandboxRows() {
4
4
  return [
5
5
  {
@@ -16,5 +16,4 @@ function sandboxRows() {
16
16
  }] }
17
17
  ];
18
18
  }
19
- //#endregion
20
19
  exports.sandboxRows = sandboxRows;
package/dist/rows.d.mts CHANGED
@@ -1,4 +1,3 @@
1
- //#region src/rows.d.ts
2
1
  export interface PatchRow {
3
2
  readonly id?: string;
4
3
  readonly disabled?: boolean;
@@ -9,5 +8,4 @@ export interface RowEntry {
9
8
  readonly name: string;
10
9
  readonly config?: Readonly<Record<string, unknown>>;
11
10
  }
12
- export declare function sandboxRows(): readonly PatchRow[];
13
- //#endregion
11
+ export declare function sandboxRows(): readonly PatchRow[];
package/dist/rows.mjs CHANGED
@@ -1,4 +1,4 @@
1
- //#region src/rows.ts
1
+ // src/rows.ts
2
2
  function sandboxRows() {
3
3
  return [
4
4
  {
@@ -15,5 +15,4 @@ function sandboxRows() {
15
15
  }] }
16
16
  ];
17
17
  }
18
- //#endregion
19
18
  export { sandboxRows };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@morlay/dsh-sandbox-local",
3
- "version": "0.0.13",
3
+ "version": "0.0.14-alpha.0",
4
4
  "description": "Configurable sandbox for dsh: replaces the shipped process-sandbox provider and filesystem fence with implementations that add extra writable roots, read-only roots and access denials on top of the upstream semantics, and owns the runtime-context snapshot (`sandbox:policy` / `approval:policy`) with the deployment's own wording.",
5
5
  "keywords": [
6
6
  "dsh",
@@ -38,42 +38,42 @@
38
38
  "./locale/*.json": "./locale/*.json"
39
39
  },
40
40
  "devDependencies": {
41
- "@deepseek-ai/cordis": "^4.0.5",
42
- "@deepseek-ai/cosmokit": "^1.8.6",
43
- "@deepseek-ai/dsh-agent": "^0.2.1-rc.1",
44
- "@deepseek-ai/dsh-agent-loop-testkit": "^0.2.1-rc.1",
45
- "@deepseek-ai/dsh-client-locale": "^0.2.1-rc.1",
46
- "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-rc.1",
47
- "@deepseek-ai/dsh-fs": "^0.2.1-rc.1",
48
- "@deepseek-ai/dsh-fs-local": "^0.2.1-rc.1",
49
- "@deepseek-ai/dsh-fs-sandbox": "^0.2.1-rc.1",
50
- "@deepseek-ai/dsh-sandbox": "^0.2.1-rc.1",
51
- "@deepseek-ai/dsh-sandbox-local": "^0.2.1-rc.1",
52
- "@deepseek-ai/dsh-sandbox-policy": "^0.2.1-rc.1",
53
- "@deepseek-ai/dsh-scope": "^0.2.1-rc.1",
54
- "@deepseek-ai/dsh-session": "^0.2.1-rc.1",
55
- "@deepseek-ai/dsh-system-prompt": "^0.2.1-rc.1",
56
- "@morlay/dsh-client-ui-primitives": "0.0.13"
41
+ "@deepseek-ai/cordis": "^4.0.6-alpha.1",
42
+ "@deepseek-ai/cosmokit": "^1.8.7-alpha.1",
43
+ "@deepseek-ai/dsh-agent": "^0.2.2-alpha.2",
44
+ "@deepseek-ai/dsh-agent-loop-testkit": "^0.2.2-alpha.2",
45
+ "@deepseek-ai/dsh-client-locale": "^0.2.2-alpha.2",
46
+ "@deepseek-ai/dsh-client-ui-slots": "^0.2.2-alpha.2",
47
+ "@deepseek-ai/dsh-fs": "^0.2.2-alpha.2",
48
+ "@deepseek-ai/dsh-fs-local": "^0.2.2-alpha.2",
49
+ "@deepseek-ai/dsh-fs-sandbox": "^0.2.2-alpha.2",
50
+ "@deepseek-ai/dsh-sandbox": "^0.2.2-alpha.2",
51
+ "@deepseek-ai/dsh-sandbox-local": "^0.2.2-alpha.2",
52
+ "@deepseek-ai/dsh-sandbox-policy": "^0.2.2-alpha.2",
53
+ "@deepseek-ai/dsh-scope": "^0.2.2-alpha.2",
54
+ "@deepseek-ai/dsh-session": "^0.2.2-alpha.2",
55
+ "@deepseek-ai/dsh-system-prompt": "^0.2.2-alpha.2",
56
+ "@morlay/dsh-client-ui-primitives": "0.0.14-alpha.0"
57
57
  },
58
58
  "peerDependencies": {
59
- "@deepseek-ai/cordis": "^4.0.5",
60
- "@deepseek-ai/cosmokit": "^1.8.6",
61
- "@deepseek-ai/dsh-agent": "^0.2.1-rc.1",
62
- "@deepseek-ai/dsh-client-locale": "^0.2.1-rc.1",
63
- "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-rc.1",
64
- "@deepseek-ai/dsh-fs": "^0.2.1-rc.1",
65
- "@deepseek-ai/dsh-fs-local": "^0.2.1-rc.1",
66
- "@deepseek-ai/dsh-fs-sandbox": "^0.2.1-rc.1",
67
- "@deepseek-ai/dsh-sandbox": "^0.2.1-rc.1",
68
- "@deepseek-ai/dsh-sandbox-local": "^0.2.1-rc.1",
69
- "@deepseek-ai/dsh-sandbox-policy": "^0.2.1-rc.1",
70
- "@deepseek-ai/dsh-session": "^0.2.1-rc.1",
71
- "@deepseek-ai/dsh-system-prompt": "^0.2.1-rc.1",
72
- "@deepseek-ai/dsh-user-approval": "^0.2.1-rc.1",
73
- "@deepseek-ai/schemastery": "^3.18.5"
59
+ "@deepseek-ai/cordis": "^4.0.6-alpha.1",
60
+ "@deepseek-ai/cosmokit": "^1.8.7-alpha.1",
61
+ "@deepseek-ai/dsh-agent": "^0.2.2-alpha.2",
62
+ "@deepseek-ai/dsh-client-locale": "^0.2.2-alpha.2",
63
+ "@deepseek-ai/dsh-client-ui-slots": "^0.2.2-alpha.2",
64
+ "@deepseek-ai/dsh-fs": "^0.2.2-alpha.2",
65
+ "@deepseek-ai/dsh-fs-local": "^0.2.2-alpha.2",
66
+ "@deepseek-ai/dsh-fs-sandbox": "^0.2.2-alpha.2",
67
+ "@deepseek-ai/dsh-sandbox": "^0.2.2-alpha.2",
68
+ "@deepseek-ai/dsh-sandbox-local": "^0.2.2-alpha.2",
69
+ "@deepseek-ai/dsh-sandbox-policy": "^0.2.2-alpha.2",
70
+ "@deepseek-ai/dsh-session": "^0.2.2-alpha.2",
71
+ "@deepseek-ai/dsh-system-prompt": "^0.2.2-alpha.2",
72
+ "@deepseek-ai/dsh-user-approval": "^0.2.2-alpha.2",
73
+ "@deepseek-ai/schemastery": "^3.18.6-alpha.1"
74
74
  },
75
75
  "engines": {
76
- "dsh": ">= 0.2.1-rc.1 < 0.2.2"
76
+ "dsh": ">= 0.2.2-alpha.2 < 0.2.3"
77
77
  },
78
78
  "dsh": {
79
79
  "client": {