@morlay/dsh-sandbox-local 0.0.3-alpha.4 → 0.0.3-alpha.6

package/README.md

@@ -97,7 +97,7 @@
 `sandbox-local` 行）与 `access` 规则一起维护在 preset 的 bundle patch 里，因此示例 app 的
 `dsh.profile.bundles` 不需要列出本包，只需要 profile 的依赖树能解析模块名
 （`@morlay/dsh-preset` 已在 `dependencies` 声明本包）。patch 层级的合并顺序与放置理由见
-[设计 预设生成与装配](../../preset/dsh-preset/.agents/designs/20260917-预设生成与装配.md)。
+[设计 host 层部署配置](../../preset/dsh-preset/.agents/designs/20260917-host层部署配置.md)。
 两种采用方式互斥：同时上线会重复插入同一行。
 
 ## 前提

package/dist/index.mjs

@@ -1,10 +1,48 @@
-import { dirname, isAbsolute, resolve, sep } from "node:path";
-import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
 import { stat } from "node:fs/promises";
+import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { canonicalPath, writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
 import z from "@deepseek-ai/schemastery";
+//#region src/containment.ts
+const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function statIfPresent(path) {
+	try {
+		return await stat(path, { bigint: true });
+	} catch (error) {
+		const code = error.code;
+		if (code !== void 0 && MISSING_CODES.has(code)) return void 0;
+		throw error;
+	}
+}
+function comparablePath(path, caseSensitive) {
+	return caseSensitive ? path : path.toLowerCase();
+}
+function isLexicallyUnder(path, root, caseSensitive) {
+	const comparableTarget = comparablePath(path, caseSensitive);
+	const comparableRoot = comparablePath(root, caseSensitive);
+	if (comparableTarget === comparableRoot) return true;
+	const prefix = comparableRoot.endsWith(sep) ? comparableRoot : comparableRoot + sep;
+	return comparableTarget.startsWith(prefix);
+}
+function sameIdentity(left, right) {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+async function isPathUnder(path, root, caseSensitive = process.platform !== "win32") {
+	if (isLexicallyUnder(path, root, caseSensitive)) return true;
+	const rootInfo = await statIfPresent(root);
+	if (rootInfo === void 0) return false;
+	let ancestor = path;
+	for (;;) {
+		const ancestorInfo = await statIfPresent(ancestor);
+		if (ancestorInfo !== void 0 && sameIdentity(ancestorInfo, rootInfo)) return true;
+		const parent = dirname(ancestor);
+		if (parent === ancestor) return false;
+		ancestor = parent;
+	}
+}
+//#endregion
 //#region src/rules.ts
 const ENV_TEMPLATE = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
 const ACCESS_LINE = /^(rw|r-|--)(?:\s+(.*))?$/u;
@@ -130,6 +168,10 @@ function compileRules(source, workspaceRoot) {
 		denyPatterns: deny.patterns
 	};
 }
+function writableRootsWith(rules, policy) {
+	const roots = writableRoots(policy);
+	return policy.mode === "workspace-write" ? [...roots, ...rules.allowRoots] : roots;
+}
 function isUnder(path, root) {
 	if (path === root) return true;
 	return path.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
@@ -145,34 +187,63 @@ function isReadOnly(rules, canonicalTarget) {
 	return matches(canonicalTarget, rules.readOnlySubtrees, rules.readOnlyPatterns);
 }
 //#endregion
-//#region src/dialects.ts
-const SEPARATOR = "--";
-const DIALECT_CAPABILITIES = {
-	seatbelt: {
-		allowWrite: true,
-		readOnly: true,
-		denyReadWrite: true,
-		denyWriteOnly: false
-	},
-	bwrap: {
-		allowWrite: true,
-		readOnly: true,
-		denyReadWrite: false,
-		denyWriteOnly: true
-	},
-	landlock: {
-		allowWrite: true,
-		readOnly: false,
-		denyReadWrite: false,
-		denyWriteOnly: false
-	},
-	"windows-acl": {
-		allowWrite: false,
-		readOnly: false,
-		denyReadWrite: false,
-		denyWriteOnly: false
+//#region src/fs.ts
+var ConfigurableFileSystem = class extends LocalFileSystem {
+	static inject = ["sandboxPolicy"];
+	defaultMode;
+	source;
+	compiled = /* @__PURE__ */ new Map();
+	constructor(ctx, config) {
+		super(ctx, config);
+		this.defaultMode = ctx.sandboxPolicy.defaultMode;
+		this.source = ruleSourceOf(config, process.env);
+	}
+	get sandboxMode() {
+		return this.defaultMode;
+	}
+	async resolve(path, opts) {
+		const target = await super.resolve(path, opts);
+		this.assertNotDenied(this.rulesFor(this.ctx.sandboxPolicy.resolve().workspaceRoot), target.targetKey, target.displayPath);
+		return target;
+	}
+	async writeText(target, content, expected, signal, sandboxPolicy) {
+		return super.writeText(await this.checkedTarget(target, sandboxPolicy), content, expected, signal);
+	}
+	async editText(target, edit, expected, signal, sandboxPolicy) {
+		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
+	}
+	assertNotDenied(rules, canonicalTarget, displayPath) {
+		if (!isDenied(rules, canonicalTarget)) return;
+		throw new FsError(`cannot access "${displayPath}": file access denied by the configured "--" rules`, "FS_SANDBOX_DENIED");
+	}
+	assertWritable(rules, canonicalTarget, displayPath) {
+		this.assertNotDenied(rules, canonicalTarget, displayPath);
+		if (!isReadOnly(rules, canonicalTarget)) return;
+		throw new FsError(`cannot write "${displayPath}": path is read-only by the configured "r-" rule`, "FS_SANDBOX_DENIED");
+	}
+	async checkedTarget(target, sandboxPolicy) {
+		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
+		const rules = this.rulesFor(policy.workspaceRoot);
+		this.assertWritable(rules, target.targetKey, target.displayPath);
+		const { mode } = policy;
+		if (mode === "danger-full-access") return target;
+		if (mode === "read-only") throw new FsError(`cannot write "${target.displayPath}": file access denied under read-only mode`, "FS_SANDBOX_DENIED");
+		const fresh = await super.resolve(target.displayPath);
+		this.assertWritable(rules, fresh.targetKey, fresh.displayPath);
+		for (const root of writableRootsWith(rules, policy)) if (await isPathUnder(fresh.targetKey, root)) return fresh;
+		throw new FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, "FS_SANDBOX_DENIED");
+	}
+	rulesFor(workspaceRoot) {
+		const cached = this.compiled.get(workspaceRoot);
+		if (cached !== void 0) return cached;
+		const compiled = compileRules(this.source, workspaceRoot);
+		this.compiled.set(workspaceRoot, compiled);
+		return compiled;
 	}
 };
+//#endregion
+//#region src/dialects.ts
+const SEPARATOR = "--";
 function separatorIndex(argv) {
 	const index = argv.indexOf(SEPARATOR);
 	if (index === -1) throw new Error("sandbox rules: the confined argv carries no `--` separator to extend");
@@ -242,99 +313,6 @@ function extendConfinedArgv(argv, rules) {
 	}
 }
 //#endregion
-//#region src/containment.ts
-const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
-async function statIfPresent(path) {
-	try {
-		return await stat(path, { bigint: true });
-	} catch (error) {
-		const code = error.code;
-		if (code !== void 0 && MISSING_CODES.has(code)) return void 0;
-		throw error;
-	}
-}
-function comparablePath(path, caseSensitive) {
-	return caseSensitive ? path : path.toLowerCase();
-}
-function isLexicallyUnder(path, root, caseSensitive) {
-	const comparableTarget = comparablePath(path, caseSensitive);
-	const comparableRoot = comparablePath(root, caseSensitive);
-	if (comparableTarget === comparableRoot) return true;
-	const prefix = comparableRoot.endsWith(sep) ? comparableRoot : comparableRoot + sep;
-	return comparableTarget.startsWith(prefix);
-}
-function sameIdentity(left, right) {
-	return left.dev === right.dev && left.ino === right.ino;
-}
-async function isPathUnder(path, root, caseSensitive = process.platform !== "win32") {
-	if (isLexicallyUnder(path, root, caseSensitive)) return true;
-	const rootInfo = await statIfPresent(root);
-	if (rootInfo === void 0) return false;
-	let ancestor = path;
-	for (;;) {
-		const ancestorInfo = await statIfPresent(ancestor);
-		if (ancestorInfo !== void 0 && sameIdentity(ancestorInfo, rootInfo)) return true;
-		const parent = dirname(ancestor);
-		if (parent === ancestor) return false;
-		ancestor = parent;
-	}
-}
-//#endregion
-//#region src/fs.ts
-var ConfigurableFileSystem = class extends LocalFileSystem {
-	static inject = ["sandboxPolicy"];
-	defaultMode;
-	source;
-	compiled = /* @__PURE__ */ new Map();
-	constructor(ctx, config) {
-		super(ctx, config);
-		this.defaultMode = ctx.sandboxPolicy.defaultMode;
-		this.source = ruleSourceOf(config, process.env);
-	}
-	get sandboxMode() {
-		return this.defaultMode;
-	}
-	async resolve(path, opts) {
-		const target = await super.resolve(path, opts);
-		this.assertNotDenied(this.rulesFor(opts?.cwd ?? this.ctx.sandboxPolicy.workspaceRoot), target.targetKey, target.displayPath);
-		return target;
-	}
-	async writeText(target, content, expected, signal, sandboxPolicy) {
-		return super.writeText(await this.checkedTarget(target, sandboxPolicy), content, expected, signal);
-	}
-	async editText(target, edit, expected, signal, sandboxPolicy) {
-		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
-	}
-	assertNotDenied(rules, canonicalTarget, displayPath) {
-		if (!isDenied(rules, canonicalTarget)) return;
-		throw new FsError(`cannot access "${displayPath}": file access denied by the configured "--" rules`, "FS_SANDBOX_DENIED");
-	}
-	assertWritable(rules, canonicalTarget, displayPath) {
-		this.assertNotDenied(rules, canonicalTarget, displayPath);
-		if (!isReadOnly(rules, canonicalTarget)) return;
-		throw new FsError(`cannot write "${displayPath}": path is read-only by the configured "r-" rule`, "FS_SANDBOX_DENIED");
-	}
-	async checkedTarget(target, sandboxPolicy) {
-		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
-		const rules = this.rulesFor(policy.workspaceRoot);
-		this.assertWritable(rules, target.targetKey, target.displayPath);
-		const { mode } = policy;
-		if (mode === "danger-full-access") return target;
-		if (mode === "read-only") throw new FsError(`cannot write "${target.displayPath}": file access denied under read-only mode`, "FS_SANDBOX_DENIED");
-		const fresh = await super.resolve(target.displayPath);
-		this.assertWritable(rules, fresh.targetKey, fresh.displayPath);
-		for (const root of [...writableRoots(policy), ...rules.allowRoots]) if (await isPathUnder(fresh.targetKey, root)) return fresh;
-		throw new FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, "FS_SANDBOX_DENIED");
-	}
-	rulesFor(workspaceRoot) {
-		const cached = this.compiled.get(workspaceRoot);
-		if (cached !== void 0) return cached;
-		const compiled = compileRules(this.source, workspaceRoot);
-		this.compiled.set(workspaceRoot, compiled);
-		return compiled;
-	}
-};
-//#endregion
 //#region src/sandbox.ts
 var ConfigurableSandboxProvider = class extends LocalSandboxProvider {
 	source;
@@ -382,11 +360,7 @@ function warnAboutDegradedRules(ctx, config) {
 	const denials = rules.deny.length > 0;
 	if (!grants && !readOnly && !denials) return;
 	if (process.platform === "darwin") return;
-	if (readOnly || denials) {
-		const seatbelt = DIALECT_CAPABILITIES.seatbelt.denyReadWrite;
-		const bwrap = DIALECT_CAPABILITIES.bwrap.denyWriteOnly;
-		ctx.logger.warn(`sandbox-local: "r-" / "--" entries cannot be fully enforced for confined subprocesses on ${process.platform} (Seatbelt enforces both; bwrap binds the path read-only, so "--" degrades to write-only: ${bwrap}; Landlock and the Windows ACL runner cannot express a subpath rule at all: ${seatbelt} applies to Seatbelt only) — tools that read through ctx.fs stay covered`);
-	}
+	if (readOnly || denials) ctx.logger.warn(`sandbox-local: "r-" / "--" entries cannot be fully enforced for confined subprocesses on ${process.platform} (Seatbelt enforces both; bwrap binds the path read-only, so "--" degrades to write-only; Landlock and the Windows ACL runner cannot express a subpath rule at all) — tools that read through ctx.fs stay covered`);
 	if (grants && process.platform === "win32") ctx.logger.warn("sandbox-local: \"rw\" entries cannot be granted to confined subprocesses on win32; ctx.fs covers the extra roots, the Windows ACL runner does not");
 }
 function apply(ctx, config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morlay/dsh-sandbox-local",
-  "version": "0.0.3-alpha.4",
+  "version": "0.0.3-alpha.6",
   "description": "Configurable sandbox bundle: replaces the shipped process-sandbox provider and filesystem fence with implementations that add extra writable roots and access denials on top of the upstream semantics.",
   "keywords": [
     "dsh",
@@ -27,23 +27,23 @@
     "./cordis.patch.yml": "./cordis.patch.yml"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-fs": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.6-alpha.2"
+    "@deepseek-ai/cordis": "4.0.3",
+    "@deepseek-ai/dsh-fs": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-fs-sandbox": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-alpha.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-fs": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "3.18.2"
+    "@deepseek-ai/cordis": "4.0.3",
+    "@deepseek-ai/dsh-fs": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-fs-sandbox": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-alpha.1",
+    "@deepseek-ai/schemastery": "3.18.3"
   },
   "dsh": {
     "bundle": {

package/src/fs.ts

@@ -10,7 +10,6 @@ import type {
 } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
 import type { Config } from "./config.ts";
-import { writableRoots } from "@deepseek-ai/dsh-sandbox";
 import type { SandboxExecutionPolicy, SandboxMode } from "@deepseek-ai/dsh-sandbox";
 import type {} from "@deepseek-ai/dsh-sandbox-policy";
 import { isPathUnder } from "./containment.ts";
@@ -19,6 +18,7 @@ import {
   isDenied,
   isReadOnly,
   ruleSourceOf,
+  writableRootsWith,
   type CompiledRules,
   type RuleSource,
 } from "./rules.ts";
@@ -46,8 +46,10 @@ export class ConfigurableFileSystem extends LocalFileSystem {
     opts?: { cwd?: string; signal?: AbortSignal },
   ): Promise<FsTarget> {
     const target = await super.resolve(path, opts);
+    // 规则里的相对路径相对**会话工作区**解析（`opts.cwd` 只是目标路径的解析基准，见包 README 的条目语法）：
+    // 读写两侧同一个基准，读被拒的文件才不会在写路径上被放行。
     this.assertNotDenied(
-      this.rulesFor(opts?.cwd ?? this.ctx.sandboxPolicy.workspaceRoot),
+      this.rulesFor(this.ctx.sandboxPolicy.resolve().workspaceRoot),
       target.targetKey,
       target.displayPath,
     );
@@ -118,7 +120,7 @@ export class ConfigurableFileSystem extends LocalFileSystem {
 
     const fresh = await super.resolve(target.displayPath);
     this.assertWritable(rules, fresh.targetKey, fresh.displayPath);
-    for (const root of [...writableRoots(policy), ...rules.allowRoots]) {
+    for (const root of writableRootsWith(rules, policy)) {
       if (await isPathUnder(fresh.targetKey, root)) return fresh;
     }
     throw new FsError(

package/src/index.ts

@@ -1,6 +1,5 @@
 import type { Context } from "@deepseek-ai/cordis";
 import type { Config } from "./config.ts";
-import { DIALECT_CAPABILITIES } from "./dialects.ts";
 import { ConfigurableFileSystem } from "./fs.ts";
 import { ruleSourceOf } from "./rules.ts";
 import { ConfigurableSandboxProvider } from "./sandbox.ts";
@@ -19,12 +18,10 @@ function warnAboutDegradedRules(ctx: Context, config: Config): void {
   if (!grants && !readOnly && !denials) return;
   if (process.platform === "darwin") return;
   if (readOnly || denials) {
-    const seatbelt = DIALECT_CAPABILITIES.seatbelt.denyReadWrite;
-    const bwrap = DIALECT_CAPABILITIES.bwrap.denyWriteOnly;
     ctx.logger.warn(
       `sandbox-local: "r-" / "--" entries cannot be fully enforced for confined subprocesses on ${process.platform} ` +
-        `(Seatbelt enforces both; bwrap binds the path read-only, so "--" degrades to write-only: ${bwrap}; ` +
-        `Landlock and the Windows ACL runner cannot express a subpath rule at all: ${seatbelt} applies to Seatbelt only) ` +
+        '(Seatbelt enforces both; bwrap binds the path read-only, so "--" degrades to write-only; ' +
+        "Landlock and the Windows ACL runner cannot express a subpath rule at all) " +
         "— tools that read through ctx.fs stay covered",
     );
   }