@morlay/dsh-sandbox-local 0.0.8 → 0.0.9

package/dist/client.d.cts

@@ -16,4 +16,5 @@ declare module "@deepseek-ai/dsh-client-ui-slots" {
 }
 export declare const inject: string[];
 export declare function apply(ctx: Context): void;
-//#endregion
+//#endregion
+export {};

package/dist/client.d.mts

@@ -16,4 +16,5 @@ declare module "@deepseek-ai/dsh-client-ui-slots" {
 }
 export declare const inject: string[];
 export declare function apply(ctx: Context): void;
-//#endregion
+//#endregion
+export {};

package/dist/client.mjs

@@ -0,0 +1,34 @@
+//#region src/client/locales.ts
+const zh = {
+	access: "额外可写根与拒绝项",
+	accessHint: "一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；支持环境变量模板与 glob（`rw` 项必须是具体路径）。改完当场生效。"
+};
+const en = {
+	access: "Extra writable roots and refusals",
+	accessHint: "One entry per line: `rw <path>` grants a writable root, `r- <path>` makes it read-only, `-- <path>` denies it; env templates and globs work (`rw` entries must name a concrete path). Edits apply immediately."
+};
+//#endregion
+//#region src/client/index.ts
+const SANDBOX_NS = "sandbox-local";
+const FIELDS = ["access"];
+const NS = "settings.sandbox-local";
+const inject = ["locale"];
+function apply(ctx) {
+	const t = ctx.locale.bind(NS);
+	ctx.effect(() => ctx.locale.register(NS, {
+		zh,
+		en
+	}), "sandbox-local: field locale");
+	ctx.inject(["schemaFormHints"], (scope) => scope.effect(() => {
+		const hints = scope.schemaFormHints;
+		const offs = FIELDS.map((key) => hints.describe(SANDBOX_NS, [key], () => ({
+			label: t(key),
+			hint: t("accessHint")
+		})));
+		return () => {
+			for (const off of offs) off();
+		};
+	}, "sandbox-local: field wording"));
+}
+//#endregion
+export { NS, SANDBOX_NS, apply, inject };

package/dist/index.cjs

@@ -0,0 +1,503 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let _deepseek_ai_dsh_fs = require("@deepseek-ai/dsh-fs");
+let _deepseek_ai_dsh_fs_local = require("@deepseek-ai/dsh-fs-local");
+let _deepseek_ai_schemastery = require("@deepseek-ai/schemastery");
+_deepseek_ai_schemastery = __toESM(_deepseek_ai_schemastery, 1);
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let _deepseek_ai_dsh_sandbox = require("@deepseek-ai/dsh-sandbox");
+let _deepseek_ai_dsh_sandbox_local = require("@deepseek-ai/dsh-sandbox-local");
+//#region src/config.ts
+const localized = (text) => text;
+const Config = _deepseek_ai_schemastery.default.object({
+	access: _deepseek_ai_schemastery.default.union([_deepseek_ai_schemastery.default.array(_deepseek_ai_schemastery.default.string()), _deepseek_ai_schemastery.default.string()]).default([]).description(localized({
+		zh: "额外可写根与拒绝项，一行一条：`rw <路径>` 追加可写根，`r- <路径>` 只读，`-- <路径>` 拒绝；路径可用环境变量模板与 glob（`rw` 项必须是具体路径）。改它当场生效（沙箱规则每次按当前值重算），不用重挂这一行。",
+		en: "Extra writable roots and refusals, one entry per line: `rw <path>` grants a writable root, `r- <path>` makes it read-only, `-- <path>` denies it; env templates and globs work (`rw` entries must name a concrete path). Edits take effect on the next rule compile without remounting the row."
+	})).volatile(),
+	runnerCommand: _deepseek_ai_schemastery.default.array(_deepseek_ai_schemastery.default.string()).default([]).disabled().description(localized({
+		zh: "沙箱 runner 的启动命令；空数组表示按平台自带的链去选。改它要重挂这一行。",
+		en: "Runner command for confined subprocesses; an empty array picks the platform chain. Edits apply on remount."
+	})).volatile(),
+	runnerFailureSignatures: _deepseek_ai_schemastery.default.array(_deepseek_ai_schemastery.default.string()).default([]).disabled().description(localized({
+		zh: "runner 命令「用不了」的判定片段，与 `runnerCommand` 成对出现。",
+		en: "Fragments that mark the runner command unusable; declared together with `runnerCommand`."
+	})).volatile(),
+	probeTimeoutMs: _deepseek_ai_schemastery.default.natural().default(5e3).disabled().description(localized({
+		zh: "探测 runner 可用性的超时（毫秒）。",
+		en: "Timeout in ms for probing whether the runner works."
+	})).volatile(),
+	cwd: _deepseek_ai_schemastery.default.string().default(process.cwd()).disabled().description(localized({
+		zh: "相对路径的基准目录；默认是启动这个进程时的工作目录。",
+		en: "Base directory for relative paths; defaults to the process working directory."
+	})).volatile(),
+	diffBasisMaxBytes: _deepseek_ai_schemastery.default.number().default(10485760).disabled().description(localized({
+		zh: "覆盖写差异的单侧字节上限（默认 10 MiB）。",
+		en: "Per-side byte cap for overwrite diffs (10 MiB by default)."
+	})).volatile()
+});
+function upstreamConfigOf(config) {
+	return {
+		runnerCommand: [...config.runnerCommand.get()],
+		runnerFailureSignatures: [...config.runnerFailureSignatures.get()],
+		probeTimeoutMs: config.probeTimeoutMs.get(),
+		cwd: config.cwd.get(),
+		diffBasisMaxBytes: config.diffBasisMaxBytes.get()
+	};
+}
+//#endregion
+//#region src/containment.ts
+const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function statIfPresent(path) {
+	try {
+		return await (0, node_fs_promises.stat)(path, { bigint: true });
+	} catch (error) {
+		const code = error.code;
+		if (code !== void 0 && MISSING_CODES.has(code)) return void 0;
+		throw error;
+	}
+}
+function comparablePath(path, caseSensitive) {
+	return caseSensitive ? path : path.toLowerCase();
+}
+function isLexicallyUnder(path, root, caseSensitive) {
+	const comparableTarget = comparablePath(path, caseSensitive);
+	const comparableRoot = comparablePath(root, caseSensitive);
+	if (comparableTarget === comparableRoot) return true;
+	const prefix = comparableRoot.endsWith(node_path.sep) ? comparableRoot : comparableRoot + node_path.sep;
+	return comparableTarget.startsWith(prefix);
+}
+function sameIdentity(left, right) {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+async function isPathUnder(path, root, caseSensitive = process.platform !== "win32") {
+	if (isLexicallyUnder(path, root, caseSensitive)) return true;
+	const rootInfo = await statIfPresent(root);
+	if (rootInfo === void 0) return false;
+	let ancestor = path;
+	for (;;) {
+		const ancestorInfo = await statIfPresent(ancestor);
+		if (ancestorInfo !== void 0 && sameIdentity(ancestorInfo, rootInfo)) return true;
+		const parent = (0, node_path.dirname)(ancestor);
+		if (parent === ancestor) return false;
+		ancestor = parent;
+	}
+}
+//#endregion
+//#region src/rules.ts
+const ENV_TEMPLATE = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+const ACCESS_LINE = /^(rw|r-|--)(?:\s+(.*))?$/u;
+const GLOB_META = /[*?[]/;
+const REGEX_META = /[\\^$+.(){}|]/;
+function expandEnvTemplates(value, env) {
+	return value.replace(ENV_TEMPLATE, (_match, name) => {
+		const resolved = env[name];
+		if (resolved === void 0 || resolved.length === 0) throw new Error(`sandbox rules: "${value}" references the unset environment variable "${name}"`);
+		return resolved;
+	});
+}
+function globToRegexSource(pattern) {
+	let source = "";
+	for (let index = 0; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				index += 1;
+				if (pattern[index + 1] === "/") {
+					index += 1;
+					source += "(.*/)?";
+				} else source += ".*";
+			} else source += "[^/]*";
+			continue;
+		}
+		if (char === "?") {
+			source += "[^/]";
+			continue;
+		}
+		if (char === "[") {
+			const close = pattern.indexOf("]", index + 1);
+			if (close === -1) {
+				source += "\\[";
+				continue;
+			}
+			const body = pattern.slice(index + 1, close);
+			if (body.length === 0) {
+				source += "\\[\\]";
+				index = close;
+				continue;
+			}
+			source += body.startsWith("!") ? `[^${body.slice(1)}]` : `[${body}]`;
+			index = close;
+			continue;
+		}
+		source += REGEX_META.test(char) ? `\\${char}` : char;
+	}
+	return source;
+}
+function isEmptyRules(rules) {
+	return rules.allowRoots.length === 0 && rules.readOnlySubtrees.length === 0 && rules.readOnlyPatterns.length === 0 && rules.denySubtrees.length === 0 && rules.denyPatterns.length === 0;
+}
+function withoutAllowRoots(rules) {
+	return rules.allowRoots.length === 0 ? rules : {
+		...rules,
+		allowRoots: []
+	};
+}
+function parseAccess(input) {
+	const lines = (input === void 0 ? [] : typeof input === "string" ? [input] : [...input]).flatMap((value) => value.split(/\r?\n/u)).map((line) => line.trim()).filter((line) => line.length > 0);
+	const allowWrite = [];
+	const readOnly = [];
+	const deny = [];
+	for (const line of lines) {
+		const match = ACCESS_LINE.exec(line);
+		if (match === null) throw new Error(`sandbox rules: access entry ${JSON.stringify(line)} must start with "rw " (write), "r- " (read-only) or "-- " (deny)`);
+		const rule = (match[2] ?? "").trim();
+		if (rule.length === 0) throw new Error(`sandbox rules: access entry ${JSON.stringify(line)} carries no path`);
+		if (match[1] === "rw") allowWrite.push(rule);
+		else if (match[1] === "r-") readOnly.push(rule);
+		else deny.push(rule);
+	}
+	return {
+		allowWrite,
+		readOnly,
+		deny
+	};
+}
+function ruleSourceOf(access, env) {
+	const parsed = parseAccess(access);
+	const expand = (values) => values.map((value) => expandEnvTemplates(value, env));
+	return {
+		allowWrite: expand(parsed.allowWrite),
+		readOnly: expand(parsed.readOnly),
+		deny: expand(parsed.deny)
+	};
+}
+function absolutize(value, workspaceRoot) {
+	return (0, node_path.isAbsolute)(value) ? value : (0, node_path.resolve)(workspaceRoot, value);
+}
+function compilePaths(values, workspaceRoot) {
+	const subtrees = [];
+	const patterns = [];
+	for (const value of values) {
+		const absolute = absolutize(value, workspaceRoot);
+		if (GLOB_META.test(value)) {
+			const pattern = `^${globToRegexSource(absolute)}$`;
+			patterns.push({
+				source: pattern,
+				regex: new RegExp(pattern)
+			});
+		} else subtrees.push((0, _deepseek_ai_dsh_sandbox.canonicalPath)(absolute));
+	}
+	return {
+		subtrees,
+		patterns
+	};
+}
+function compileRules(source, workspaceRoot) {
+	const allowRoots = [];
+	for (const value of source.allowWrite) {
+		if (GLOB_META.test(value)) throw new Error(`sandbox rules: rw entry "${value}" must name a concrete path, not a glob`);
+		allowRoots.push((0, _deepseek_ai_dsh_sandbox.canonicalPath)(absolutize(value, workspaceRoot)));
+	}
+	const readOnly = compilePaths(source.readOnly, workspaceRoot);
+	const deny = compilePaths(source.deny, workspaceRoot);
+	return {
+		allowRoots,
+		readOnlySubtrees: readOnly.subtrees,
+		readOnlyPatterns: readOnly.patterns,
+		denySubtrees: deny.subtrees,
+		denyPatterns: deny.patterns
+	};
+}
+function writableRootsWith(rules, policy) {
+	const roots = (0, _deepseek_ai_dsh_sandbox.writableRoots)(policy);
+	return policy.mode === "workspace-write" ? [...roots, ...rules.allowRoots] : roots;
+}
+function isUnder(path, root) {
+	if (path === root) return true;
+	return path.startsWith(root.endsWith(node_path.sep) ? root : `${root}${node_path.sep}`);
+}
+function matches(canonicalTarget, subtrees, patterns) {
+	for (const subtree of subtrees) if (isUnder(canonicalTarget, subtree)) return true;
+	return patterns.some((pattern) => pattern.regex.test(canonicalTarget));
+}
+function isDenied(rules, canonicalTarget) {
+	return matches(canonicalTarget, rules.denySubtrees, rules.denyPatterns);
+}
+function isReadOnly(rules, canonicalTarget) {
+	return matches(canonicalTarget, rules.readOnlySubtrees, rules.readOnlyPatterns);
+}
+//#endregion
+//#region src/fs.ts
+var ConfigurableFileSystem = class extends _deepseek_ai_dsh_fs_local.LocalFileSystem {
+	static inject = ["sandboxPolicy"];
+	defaultMode;
+	access;
+	compiled = /* @__PURE__ */ new Map();
+	constructor(ctx, config) {
+		super(ctx, upstreamConfigOf(config));
+		this.defaultMode = ctx.sandboxPolicy.defaultMode;
+		this.access = config.access;
+	}
+	get source() {
+		return ruleSourceOf(this.access.get(), process.env);
+	}
+	get sandboxMode() {
+		return this.defaultMode;
+	}
+	async resolve(path, opts) {
+		const target = await super.resolve(path, opts);
+		this.assertNotDenied(this.rulesFor(this.ctx.sandboxPolicy.resolve().workspaceRoot), target.targetKey, target.displayPath);
+		return target;
+	}
+	async writeText(target, content, expected, signal, sandboxPolicy) {
+		return super.writeText(await this.checkedTarget(target, sandboxPolicy), content, expected, signal);
+	}
+	async editText(target, edit, expected, signal, sandboxPolicy) {
+		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
+	}
+	assertNotDenied(rules, canonicalTarget, displayPath) {
+		if (!isDenied(rules, canonicalTarget)) return;
+		throw new _deepseek_ai_dsh_fs.FsError(`cannot access "${displayPath}": file access denied by the configured "--" rules`, "FS_SANDBOX_DENIED");
+	}
+	assertWritable(rules, canonicalTarget, displayPath) {
+		this.assertNotDenied(rules, canonicalTarget, displayPath);
+		if (!isReadOnly(rules, canonicalTarget)) return;
+		throw new _deepseek_ai_dsh_fs.FsError(`cannot write "${displayPath}": path is read-only by the configured "r-" rule`, "FS_SANDBOX_DENIED");
+	}
+	async checkedTarget(target, sandboxPolicy) {
+		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
+		const rules = this.rulesFor(policy.workspaceRoot);
+		this.assertWritable(rules, target.targetKey, target.displayPath);
+		const { mode } = policy;
+		if (mode === "danger-full-access") return target;
+		if (mode === "read-only") throw new _deepseek_ai_dsh_fs.FsError(`cannot write "${target.displayPath}": file access denied under read-only mode`, "FS_SANDBOX_DENIED");
+		const fresh = await super.resolve(target.displayPath);
+		this.assertWritable(rules, fresh.targetKey, fresh.displayPath);
+		for (const root of writableRootsWith(rules, policy)) if (await isPathUnder(fresh.targetKey, root)) return fresh;
+		throw new _deepseek_ai_dsh_fs.FsError(`cannot write "${target.displayPath}": file access denied under workspace-write mode`, "FS_SANDBOX_DENIED");
+	}
+	rulesFor(workspaceRoot) {
+		const access = this.access.get();
+		const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+		const cached = this.compiled.get(key);
+		if (cached !== void 0) return cached;
+		const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+		this.compiled.set(key, compiled);
+		return compiled;
+	}
+};
+//#endregion
+//#region src/policy.ts
+const SANDBOX_POLICY_CONTEXT = "sandbox:policy";
+const APPROVAL_POLICY_CONTEXT = "approval:policy";
+function renderPolicyContext(policy, rules) {
+	const base = (() => {
+		switch (policy.mode) {
+			case "read-only": return "文件策略：只读——不能修改任何文件。别因此拒绝必需的修改：照常尝试工具，按它的拒绝与升级指引行动。";
+			case "workspace-write": return `文件策略：workspace-write——可改会话工作区 ${JSON.stringify(policy.workspaceRoot)} 下的文件，部分平台临时目录同样可写。`;
+			case "danger-full-access": return "文件策略：全权——文件改动不再受限。";
+		}
+	})();
+	const extras = [];
+	if (rules.allowWrite.length > 0) extras.push(`额外可写：${rules.allowWrite.join("、")}。`);
+	if (rules.readOnly.length > 0) extras.push(`只读（不可写）：${rules.readOnly.join("、")}。`);
+	if (rules.deny.length > 0) extras.push(`拒绝（读写都拒）：${rules.deny.join("、")}。`);
+	return extras.length === 0 ? base : `${base} ${extras.join("")}`;
+}
+const APPROVAL_ASK_TEXT = "审批策略：ask——需要审批的操作会询问用户；没有可用的应答者时直接失败。";
+const APPROVAL_NEVER_TEXT = "审批提示已禁用：需要审批的操作一律自动拒绝——不要请求沙箱升级（不要设 sandbox_permissions）。";
+function renderApprovalContext(policy) {
+	return policy === "never" ? APPROVAL_NEVER_TEXT : APPROVAL_ASK_TEXT;
+}
+function effectiveApprovalPolicy(approval, session) {
+	return approval.overrideOf(session) ?? approval.config.policy ?? "ask";
+}
+function registerPolicyContext(scope, rules, resolve) {
+	const prompt = scope.get("systemPrompt");
+	if (prompt === void 0) return;
+	prompt.context({
+		name: SANDBOX_POLICY_CONTEXT,
+		order: prompt.getContextOrder("SANDBOX_POLICY"),
+		text: (context) => {
+			const session = context.agent?.session;
+			return session === void 0 ? "" : renderPolicyContext(resolve(session), rules);
+		}
+	});
+}
+function registerApprovalContext(scope) {
+	const prompt = scope.get("systemPrompt");
+	if (prompt === void 0) return;
+	prompt.context({
+		name: APPROVAL_POLICY_CONTEXT,
+		order: prompt.getContextOrder("APPROVAL_POLICY"),
+		text: (context) => {
+			const agent = context.agent;
+			if (agent === void 0) return "";
+			const approval = agent.ctx.get("approval");
+			return approval === void 0 ? "" : renderApprovalContext(effectiveApprovalPolicy(approval, agent.session));
+		}
+	});
+}
+function installRuntimeContexts(ctx, rules, resolve) {
+	const installed = /* @__PURE__ */ new WeakSet();
+	const install = (agent) => {
+		if (installed.has(agent)) return;
+		installed.add(agent);
+		registerPolicyContext(agent.ctx, rules, resolve);
+		registerApprovalContext(agent.ctx);
+	};
+	ctx.on("agent/created", ({ agent }) => {
+		install(agent);
+	});
+	for (const agent of ctx.get("agents")?.list() ?? []) install(agent);
+}
+//#endregion
+//#region src/dialects.ts
+const SEPARATOR = "--";
+function separatorIndex(argv) {
+	const index = argv.indexOf(SEPARATOR);
+	if (index === -1) throw new Error("sandbox rules: the confined argv carries no `--` separator to extend");
+	return index;
+}
+function dialectOf(argv) {
+	const separator = argv.indexOf(SEPARATOR);
+	const runner = separator === -1 ? argv : argv.slice(0, separator);
+	if (runner.includes("-p")) return "seatbelt";
+	if (runner[0] === "bwrap") return "bwrap";
+	if (runner.includes("--workspace")) return "windows-acl";
+	if (runner.includes("--ro") || runner.includes("--rw")) return "landlock";
+}
+function sbplString(value) {
+	return `"${value.replaceAll("\\", String.raw`\\`).replaceAll("\"", String.raw`\"`)}"`;
+}
+function sbplRegexBody(source) {
+	if (source.includes("\"")) throw new Error(`sandbox rules: deny pattern ${JSON.stringify(source)} cannot be expressed in a Seatbelt profile`);
+	return source;
+}
+function extendSeatbelt(argv, rules) {
+	const index = argv.indexOf("-p");
+	const profile = index === -1 ? void 0 : argv[index + 1];
+	if (profile === void 0) throw new Error("sandbox rules: the Seatbelt runner argv carries no `-p` profile to extend");
+	const extended = `${profile} ${[
+		...rules.allowRoots.map((root) => `(allow file-write* (subpath ${sbplString(root)}))`),
+		...rules.readOnlySubtrees.map((path) => `(deny file-write* (subpath ${sbplString(path)}))`),
+		...rules.readOnlyPatterns.map((pattern) => `(deny file-write* (regex #"${sbplRegexBody(pattern.source)}"))`),
+		...rules.denySubtrees.map((path) => `(deny file-read* file-write* (subpath ${sbplString(path)}))`),
+		...rules.denyPatterns.map((pattern) => `(deny file-read* file-write* (regex #"${sbplRegexBody(pattern.source)}"))`)
+	].join(" ")}`;
+	return [
+		...argv.slice(0, index + 1),
+		extended,
+		...argv.slice(index + 2)
+	];
+}
+function extendBwrap(argv, rules) {
+	const separator = separatorIndex(argv);
+	const additions = [];
+	for (const root of rules.allowRoots) additions.push("--bind-try", root, root);
+	for (const path of [...rules.readOnlySubtrees, ...rules.denySubtrees]) additions.push("--ro-bind-try", path, path);
+	return [
+		...argv.slice(0, separator),
+		...additions,
+		...argv.slice(separator)
+	];
+}
+function extendLandlock(argv, rules) {
+	const separator = separatorIndex(argv);
+	const additions = rules.allowRoots.flatMap((root) => ["--rw", root]);
+	return [
+		...argv.slice(0, separator),
+		...additions,
+		...argv.slice(separator)
+	];
+}
+function extendConfinedArgv(argv, rules) {
+	if (isEmptyRules(rules)) return [...argv];
+	const dialect = dialectOf(argv);
+	if (dialect === void 0) throw new Error("sandbox rules: cannot extend an unrecognized sandbox runner argv; drop allowWrite/deny or configure a bwrap-compatible runnerCommand");
+	switch (dialect) {
+		case "seatbelt": return extendSeatbelt(argv, rules);
+		case "bwrap": return extendBwrap(argv, rules);
+		case "landlock": return extendLandlock(argv, rules);
+		case "windows-acl": return [...argv];
+	}
+}
+//#endregion
+//#region src/sandbox.ts
+var ConfigurableSandboxProvider = class extends _deepseek_ai_dsh_sandbox_local.LocalSandboxProvider {
+	access;
+	compiled = /* @__PURE__ */ new Map();
+	constructor(ctx, config) {
+		super(ctx, upstreamConfigOf(config));
+		this.access = config.access;
+	}
+	get source() {
+		return ruleSourceOf(this.access.get(), process.env);
+	}
+	async confine(argv, policy, signal) {
+		const confined = await super.confine(argv, policy, signal);
+		const rules = this.rulesFor(policy.workspaceRoot);
+		const effective = policy.mode === "workspace-write" ? rules : withoutAllowRoots(rules);
+		if (isEmptyRules(effective)) return confined;
+		return {
+			...confined,
+			argv: extendConfinedArgv(confined.argv, effective)
+		};
+	}
+	rulesFor(workspaceRoot) {
+		const access = this.access.get();
+		const key = `${workspaceRoot}\u0000${JSON.stringify(access ?? null)}`;
+		const cached = this.compiled.get(key);
+		if (cached !== void 0) return cached;
+		const compiled = compileRules(ruleSourceOf(access, process.env), workspaceRoot);
+		this.compiled.set(key, compiled);
+		return compiled;
+	}
+};
+//#endregion
+//#region src/index.ts
+const name = "sandbox-local";
+const inject = ["sandboxPolicy"];
+function warnAboutDegradedRules(ctx, rules) {
+	const grants = rules.allowWrite.length > 0;
+	const readOnly = rules.readOnly.length > 0;
+	const denials = rules.deny.length > 0;
+	if (!grants && !readOnly && !denials) return;
+	if (process.platform === "darwin") return;
+	if (readOnly || denials) ctx.logger.warn(`sandbox-local: "r-" / "--" entries cannot be fully enforced for confined subprocesses on ${process.platform} (Seatbelt enforces both; bwrap binds the path read-only, so "--" degrades to write-only; Landlock and the Windows ACL runner cannot express a subpath rule at all) — tools that read through ctx.fs stay covered`);
+	if (grants && process.platform === "win32") ctx.logger.warn("sandbox-local: \"rw\" entries cannot be granted to confined subprocesses on win32; ctx.fs covers the extra roots, the Windows ACL runner does not");
+}
+function apply(ctx, config) {
+	const rules = ruleSourceOf(config.access.get(), process.env);
+	warnAboutDegradedRules(ctx, rules);
+	new ConfigurableSandboxProvider(ctx, config);
+	new ConfigurableFileSystem(ctx, config);
+	installRuntimeContexts(ctx, rules, (session) => ctx.sandboxPolicy.resolve({ session }));
+}
+//#endregion
+exports.Config = Config;
+exports.apply = apply;
+exports.inject = inject;
+exports.name = name;

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { Config as Config$1 } from "@deepseek-ai/dsh-fs-local";
-import z from "@deepseek-ai/schemastery";
-import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
 import { Context } from "@deepseek-ai/cordis";
 import { Volatile } from "@deepseek-ai/cosmokit";
+import z from "@deepseek-ai/schemastery";
+import { Config as Config$1 } from "@deepseek-ai/dsh-fs-local";
+import { Config as Config$2 } from "@deepseek-ai/dsh-sandbox-local";
 //#region src/config.d.ts
 export interface Config extends Config$2, Config$1 {
   access?: string | string[];

package/dist/rows.cjs

@@ -0,0 +1,20 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/rows.ts
+function sandboxRows() {
+	return [
+		{
+			id: "sandbox",
+			disabled: true
+		},
+		{
+			id: "fs-sandbox",
+			disabled: true
+		},
+		{ insert: [{
+			id: "sandbox-local",
+			name: "@morlay/dsh-sandbox-local"
+		}] }
+	];
+}
+//#endregion
+exports.sandboxRows = sandboxRows;