@roj-ai/kompjutr-platform 0.2.11 → 0.2.12

package/README.md

@@ -1,10 +1,10 @@
 # @roj-ai/kompjutr-platform
 
 Run the Roj SDK against a [Kompjutr](https://www.npmjs.com/package/@kompjutr/do)
-workspace. This adapter uses `@kompjutr/do` **0.1.2** from npm.
+workspace. This adapter uses `@kompjutr/do` **0.1.3** from npm.
 
 ```bash
-bun add @roj-ai/sdk @roj-ai/kompjutr-platform @kompjutr/do@0.1.2
+bun add @roj-ai/sdk @roj-ai/kompjutr-platform @kompjutr/do@0.1.3
 ```
 
 ## Connect a workspace
@@ -47,17 +47,39 @@ resume after eviction; the default scheduler uses in-memory timers.
   a native process runner. Process spawning and native dev servers are unsupported;
   hosts can supply a service executor through SDK bootstrap overrides.
 - `shellConfinement` defaults to `none`. Set it to `host` only when the host
-  isolates the entire workspace. It does not create a per-directory sandbox.
-  Shell path grants are unsupported.
-- Known limitation: the host shell runner does not implement the virtual
-  `/home/user/session` and `/home/user/workspace` namespace exposed by
-  preset-level `sandboxed: true`. Support requires a native upstream namespace
-  shared by filesystem resolution, shell execution and Git; this work is deferred.
-  Existing Bun/bwrap virtual paths are unchanged.
+  isolates the entire workspace. Set it to `paths` when one workspace holds
+  several sessions' files; see [Path confinement](#path-confinement).
 - Session logs, LLM call logs and events are stored as SQL rows. Pass the
   `KompjutrEventStore` explicitly to bootstrap to use SQL event persistence.
 - The host owns authentication, workspace isolation and storage lifetime.
 
+## Path confinement
+
+With `shellConfinement: 'paths'`, every shell run sees only the grants the SDK
+sends for it. Presets keep the virtual `/home/user/session` and
+`/home/user/workspace` paths of `sandboxed: true`; each grant maps a virtual
+directory onto a real workspace directory.
+
+- The shell runs over a `createMountedFilesystem` view built per run. Paths
+  outside every grant do not exist (`ENOENT`), and `ro` grants reject writes.
+- The view fails closed on symlinks: an absolute target, a target above its
+  source, or a target in another mount reads as absent. A kernel bind mount
+  would follow it.
+- Grant sources resolve to their real directory first. Grant paths must not
+  nest, and every source must be an existing directory, or the run is rejected.
+- A run without grants is unconfined, as on the Bun platform.
+- Git keeps the real filesystem, so checkouts and dirty tracking stay real-path
+  based. The `git` command translates the cwd and absolute path operands to
+  real paths and prints real paths back as virtual ones (`rev-parse
+  --show-toplevel`, `init`, `clone` and error messages). It refuses absolute path operands
+  outside the grants, `init` and `clone` targets outside a writable grant, and a
+  repository whose root no writable grant shows.
+- Git needs no `.git` or `.gitconfig` grants: its data lives in SQL tables, not
+  in a `.git` directory. Do not place a checkout at `/` or above a session's
+  directories.
+- Confinement covers files, not Git data. Checkouts of one store still share
+  refs, objects and config across sessions.
+
 ## LLM call storage
 
 `KompjutrLLMCallLog` stores the exact request, response, metrics and error

package/dist/confined-git.d.ts

@@ -0,0 +1,13 @@
+import type { GitCliRunner } from '@kompjutr/do';
+import type { Filesystem } from '@kompjutr/do/fs';
+import type { GrantMounts } from './mounts.js';
+/**
+ * Runs Git for a shell confined to a mounted view.
+ *
+ * Git keeps the real filesystem, because checkout routing and dirty tracking work
+ * on real paths. This runner moves the shell's virtual cwd and absolute path
+ * operands into real space, refuses what no writable mount shows, and maps the
+ * real paths Git prints back to virtual ones.
+ */
+export declare function createConfinedGitRunner(git: GitCliRunner, view: Filesystem, mounts: GrantMounts): GitCliRunner;
+//# sourceMappingURL=confined-git.d.ts.map

package/dist/confined-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-git.d.ts","sourceRoot":"","sources":["../src/confined-git.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAgB,YAAY,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,aAAa,CAAA;AAa3D;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,CAwB9G"}

package/dist/confined-git.js

@@ -0,0 +1,129 @@
+import { posix } from 'node:path';
+/** Commands whose every absolute operand is a pathspec. */
+const PATHSPEC_OPERANDS = new Set(['status', 'ls-files', 'add', 'restore']);
+/** Commands that read pathspecs only after `--`. */
+const PATHSPEC_AFTER_SEPARATOR = new Set(['diff', 'log', 'reset', 'checkout']);
+/** `git clone` options that take their value as the next argument. */
+const CLONE_VALUED_OPTIONS = new Set(['--depth', '--branch', '-b', '--origin', '-o']);
+/** Unquoted paths in Git's messages: after whitespace or a quote, up to the next one. */
+const MESSAGE_PATH = /(?<=^|[\s'"])\/[^\s'"]*/g;
+/**
+ * Runs Git for a shell confined to a mounted view.
+ *
+ * Git keeps the real filesystem, because checkout routing and dirty tracking work
+ * on real paths. This runner moves the shell's virtual cwd and absolute path
+ * operands into real space, refuses what no writable mount shows, and maps the
+ * real paths Git prints back to virtual ones.
+ */
+export function createConfinedGitRunner(git, view, mounts) {
+    return {
+        async runCli(input, options) {
+            const virtualCwd = view.realpath(input.cwd ?? '/');
+            const cwd = mounts.toReal(virtualCwd);
+            if (cwd === undefined)
+                return refused(`'${virtualCwd}' is outside the mounted paths`);
+            const translated = await translate(git, view, mounts, input.argv, virtualCwd, cwd);
+            if (!translated.ok)
+                return refused(translated.message);
+            const result = await git.runCli({ ...input, argv: translated.argv, cwd: cwd.real }, options);
+            const toVirtual = (text) => text.replace(MESSAGE_PATH, (match) => {
+                // `path: message` puts a colon after the path.
+                const path = match.endsWith(':') ? match.slice(0, -1) : match;
+                return `${mounts.toVirtual(path, cwd.mount) ?? path}${match.slice(path.length)}`;
+            });
+            return {
+                ...result,
+                stdout: printsRealPaths(input.argv) ? toVirtual(result.stdout) : result.stdout,
+                stderr: toVirtual(result.stderr),
+            };
+        },
+    };
+}
+async function translate(git, view, mounts, argv, virtualCwd, cwd) {
+    const command = argv[0];
+    if (command === 'init' || command === 'clone') {
+        const index = command === 'init' ? initDirectoryIndex(argv) : cloneDirectoryIndex(argv);
+        const directory = index === undefined ? undefined : argv[index];
+        if (index === undefined || directory === undefined) {
+            // Both create in or directly under the cwd.
+            return cwd.mount.mode === 'rw' ? { ok: true, argv } : { ok: false, message: `'${virtualCwd}' is read-only` };
+        }
+        const target = writableTarget(view, mounts, posix.resolve(virtualCwd, directory));
+        if (target === undefined)
+            return { ok: false, message: `'${directory}' is outside the writable mounted paths` };
+        const translatedArgv = [...argv];
+        translatedArgv[index] = target;
+        return { ok: true, argv: translatedArgv };
+    }
+    const translatedArgv = [...argv];
+    for (const index of pathspecIndexes(argv)) {
+        const pathspec = argv[index];
+        if (pathspec === undefined || !pathspec.startsWith('/'))
+            continue;
+        const real = mounts.toReal(posix.resolve(pathspec));
+        if (real === undefined)
+            return { ok: false, message: `'${pathspec}' is outside the mounted paths` };
+        translatedArgv[index] = real.real;
+    }
+    const repository = await git.runCli({ argv: ['rev-parse', '--show-toplevel'], cwd: cwd.real });
+    // A cwd outside any repository fails the command itself with Git's own message.
+    if (repository.exitCode === 0 && !mounts.isWritable(repository.stdout.trimEnd())) {
+        return { ok: false, message: `the repository at '${virtualCwd}' is not inside a writable mounted path` };
+    }
+    return { ok: true, argv: translatedArgv };
+}
+/**
+ * The real path a new repository would take, when a writable mount shows it.
+ * The existing part resolves through the view, so a symlink leaving its mount fails here
+ * instead of being followed by Git in real space.
+ */
+function writableTarget(view, mounts, virtualTarget) {
+    let existing = virtualTarget;
+    const missing = [];
+    while (view.statTarget(existing) === null) {
+        if (existing === '/' || view.stat(existing) !== null)
+            return undefined;
+        missing.unshift(posix.basename(existing));
+        existing = posix.dirname(existing);
+    }
+    const target = mounts.toReal(posix.join(view.realpath(existing), ...missing));
+    return target?.mount.mode === 'rw' ? target.real : undefined;
+}
+function initDirectoryIndex(argv) {
+    const index = argv.findIndex((argument, position) => position > 0 && !argument.startsWith('-'));
+    return index === -1 ? undefined : index;
+}
+function cloneDirectoryIndex(argv) {
+    const operands = [];
+    for (let index = 1; index < argv.length; index++) {
+        const argument = argv[index];
+        if (argument === undefined)
+            break;
+        if (CLONE_VALUED_OPTIONS.has(argument))
+            index++;
+        else if (!argument.startsWith('-'))
+            operands.push(index);
+    }
+    return operands[1];
+}
+function pathspecIndexes(argv) {
+    const command = argv[0] ?? '';
+    const separator = argv.indexOf('--', 1);
+    const indexes = [];
+    for (let index = 1; index < argv.length; index++) {
+        if (index === separator)
+            continue;
+        if (PATHSPEC_OPERANDS.has(command) || (PATHSPEC_AFTER_SEPARATOR.has(command) && separator !== -1 && index > separator)) {
+            indexes.push(index);
+        }
+    }
+    return indexes;
+}
+/** Commands whose stdout names a real path rather than repository content. */
+function printsRealPaths(argv) {
+    return argv[0] === 'init' || argv[0] === 'clone' || (argv[0] === 'rev-parse' && argv[1] === '--show-toplevel');
+}
+function refused(message) {
+    return { stdout: '', stderr: `fatal: ${message}\n`, exitCode: 128, truncated: false };
+}
+//# sourceMappingURL=confined-git.js.map

package/dist/confined-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-git.js","sourceRoot":"","sources":["../src/confined-git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAKjC,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAC3E,oDAAoD;AACpD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;AAC9E,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAA;AACrF,yFAAyF;AACzF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAI/C;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAiB,EAAE,IAAgB,EAAE,MAAmB;IAC/F,OAAO;QACN,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACrC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,UAAU,gCAAgC,CAAC,CAAA;YAErF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;YAClF,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAEtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAC5F,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;gBACpC,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC7D,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;YACjF,CAAC,CAAC,CAAA;YACH,OAAO;gBACN,GAAG,MAAM;gBACT,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;gBAC9E,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aAChC,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CACvB,GAAiB,EACjB,IAAgB,EAChB,MAAmB,EACnB,IAAuB,EACvB,UAAkB,EAClB,GAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACvF,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,4CAA4C;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,UAAU,gBAAgB,EAAE,CAAA;QAC7G,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;QACjF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,SAAS,yCAAyC,EAAE,CAAA;QAC/G,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAChC,cAAc,CAAC,KAAK,CAAC,GAAG,MAAM,CAAA;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,QAAQ,gCAAgC,EAAE,CAAA;QACnG,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAA;IAClC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,gFAAgF;IAChF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,UAAU,yCAAyC,EAAE,CAAA;IACzG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAgB,EAAE,MAAmB,EAAE,aAAqB;IACnF,IAAI,QAAQ,GAAG,aAAa,CAAA;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACtE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QACzC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;IAC7E,OAAO,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAuB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/F,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAuB;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAK;QACjC,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,KAAK,EAAE,CAAA;aAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACvC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,IAAuB;IAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAA;AAC/G,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC/B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,OAAO,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACtF,CAAC"}

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  * rows rather than files on a disk — inside a Durable Object, or anywhere else
  * that can hand kompjutr a SQL storage.
  */
-import type { Platform, Scheduler } from '@roj-ai/sdk/platform';
+import type { Platform, Scheduler, ShellConfinement } from '@roj-ai/sdk/platform';
 import type { Workspace } from '@kompjutr/do';
 import type { KompjutrLLMCallLogOptions } from './llm-call-log.js';
 export interface KompjutrPlatformOptions {
@@ -19,8 +19,12 @@ export interface KompjutrPlatformOptions {
     scheduler?: Scheduler;
     /** Retention and column ceiling for the LLM call log. */
     llmCallLog?: KompjutrLLMCallLogOptions;
-    /** How the workspace itself is isolated. Defaults to `none`. */
-    shellConfinement?: 'host' | 'none';
+    /**
+     * How shell commands are confined. `paths` mounts each run's grants as its
+     * only filesystem; `host` means the workspace holds one session's files.
+     * Defaults to `none`.
+     */
+    shellConfinement?: ShellConfinement;
 }
 export declare function createKompjutrPlatform(workspace: Workspace, options?: KompjutrPlatformOptions): Platform;
 export { KompjutrEventStore } from './event-store.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAE/D,OAAO,KAAK,EAAO,SAAS,EAAE,MAAM,cAAc,CAAA;AAKlD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAKlE,MAAM,WAAW,uBAAuB;IACvC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,yBAAyB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAClC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,GAAE,uBAA4B,GAAG,QAAQ,CA2B5G;AAWD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAClD,YAAY,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AACtD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEjF,OAAO,KAAK,EAAO,SAAS,EAAE,MAAM,cAAc,CAAA;AAKlD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAKlE,MAAM,WAAW,uBAAuB;IACvC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,yBAAyB,CAAA;IACtC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACnC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,GAAE,uBAA4B,GAAG,QAAQ,CA2B5G;AAWD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAClD,YAAY,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AACtD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAG3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAiBtD,MAAM,UAAU,sBAAsB,CAAC,SAAoB,EAAE,UAAmC,EAAE;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAA;IACvC,2EAA2E;IAC3E,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IAEnC,OAAO;QACN,EAAE,EAAE,wBAAwB,CAAC;YAC5B,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,UAAU,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;QACF,OAAO,EAAE,8BAA8B,EAAE;QACzC,KAAK,EAAE,yBAAyB,CAAC;YAChC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,GAAG;YACH,WAAW,EAAE,OAAO,CAAC,gBAAgB;SACrC,CAAC;QACF,GAAG,EAAE,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,UAAU,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,UAAU,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;QACpE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE;QACtD,MAAM;KACN,CAAA;AACF,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,SAAoB;IACzC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,GAAG,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAG3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAqBtD,MAAM,UAAU,sBAAsB,CAAC,SAAoB,EAAE,UAAmC,EAAE;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAA;IACvC,2EAA2E;IAC3E,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IAEnC,OAAO;QACN,EAAE,EAAE,wBAAwB,CAAC;YAC5B,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,UAAU,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;QACF,OAAO,EAAE,8BAA8B,EAAE;QACzC,KAAK,EAAE,yBAAyB,CAAC;YAChC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,GAAG;YACH,WAAW,EAAE,OAAO,CAAC,gBAAgB;SACrC,CAAC;QACF,GAAG,EAAE,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,UAAU,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,UAAU,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;QACpE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE;QACtD,MAAM;KACN,CAAA;AACF,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,SAAoB;IACzC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,GAAG,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA"}

package/dist/mounts.d.ts

@@ -0,0 +1,22 @@
+import type { Filesystem, MountSpec } from '@kompjutr/do/fs';
+import type { ShellGrant } from '@roj-ai/sdk/platform';
+/** A real workspace path, and the mount that shows it. */
+export interface MountedPath {
+    mount: MountSpec;
+    real: string;
+}
+/**
+ * One run's grants as mounts, plus the prefix translation between the paths a
+ * command sees and the workspace's real ones, for consumers that bypass the view.
+ */
+export declare class GrantMounts {
+    readonly specs: readonly MountSpec[];
+    constructor(filesystem: Filesystem, grants: readonly ShellGrant[]);
+    /** The real path behind a canonical virtual path, or undefined outside every mount. */
+    toReal(virtualPath: string): MountedPath | undefined;
+    /** A virtual path showing `realPath`, from `preferred` when it shows it, otherwise from the narrowest source. */
+    toVirtual(realPath: string, preferred?: MountSpec): string | undefined;
+    /** Whether a writable mount shows `realPath`. */
+    isWritable(realPath: string): boolean;
+}
+//# sourceMappingURL=mounts.d.ts.map

package/dist/mounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounts.d.ts","sourceRoot":"","sources":["../src/mounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,SAAS,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,qBAAa,WAAW;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;gBAExB,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE;IASjE,uFAAuF;IACvF,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAQpD,iHAAiH;IACjH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS;IAUtE,iDAAiD;IACjD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAGrC"}

package/dist/mounts.js

@@ -0,0 +1,55 @@
+import { posix } from 'node:path';
+/**
+ * One run's grants as mounts, plus the prefix translation between the paths a
+ * command sees and the workspace's real ones, for consumers that bypass the view.
+ */
+export class GrantMounts {
+    specs;
+    constructor(filesystem, grants) {
+        this.specs = grants.map((grant) => ({
+            path: posix.resolve(grant.path),
+            // A bind mount follows symlinks in its source; the view accepts only the resolved directory.
+            source: filesystem.realpath(posix.resolve(grant.source ?? grant.path)),
+            mode: grant.mode,
+        }));
+    }
+    /** The real path behind a canonical virtual path, or undefined outside every mount. */
+    toReal(virtualPath) {
+        for (const mount of this.specs) {
+            const rest = suffixUnder(mount.path, virtualPath);
+            if (rest !== undefined)
+                return { mount, real: joinSuffix(mount.source, rest) };
+        }
+        return undefined;
+    }
+    /** A virtual path showing `realPath`, from `preferred` when it shows it, otherwise from the narrowest source. */
+    toVirtual(realPath, preferred) {
+        const candidates = [...this.specs].sort((left, right) => right.source.length - left.source.length);
+        if (preferred !== undefined)
+            candidates.unshift(preferred);
+        for (const mount of candidates) {
+            const rest = suffixUnder(mount.source, realPath);
+            if (rest !== undefined)
+                return joinSuffix(mount.path, rest);
+        }
+        return undefined;
+    }
+    /** Whether a writable mount shows `realPath`. */
+    isWritable(realPath) {
+        return this.specs.some((mount) => mount.mode === 'rw' && suffixUnder(mount.source, realPath) !== undefined);
+    }
+}
+/** `''` when `path` is `root`, `/rest` when below it, undefined otherwise. */
+function suffixUnder(root, path) {
+    if (path === root)
+        return '';
+    if (root === '/')
+        return path.startsWith('/') ? path : undefined;
+    return path.startsWith(`${root}/`) ? path.slice(root.length) : undefined;
+}
+function joinSuffix(root, suffix) {
+    if (suffix === '')
+        return root;
+    return root === '/' ? suffix : `${root}${suffix}`;
+}
+//# sourceMappingURL=mounts.js.map

package/dist/mounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mounts.js","sourceRoot":"","sources":["../src/mounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAUjC;;;GAGG;AACH,MAAM,OAAO,WAAW;IACd,KAAK,CAAsB;IAEpC,YAAY,UAAsB,EAAE,MAA6B;QAChE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC/B,6FAA6F;YAC7F,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;YACtE,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,uFAAuF;IACvF,MAAM,CAAC,WAAmB;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YACjD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;QAC/E,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,iHAAiH;IACjH,SAAS,CAAC,QAAgB,EAAE,SAAqB;QAChD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClG,IAAI,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC1D,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAChD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,iDAAiD;IACjD,UAAU,CAAC,QAAgB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAA;IAC5G,CAAC;CACD;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAA;AAClD,CAAC"}

package/dist/shell.d.ts

@@ -1,11 +1,14 @@
-import type { ShellRunner } from '@roj-ai/sdk/platform';
+import type { ShellConfinement, ShellRunner } from '@roj-ai/sdk/platform';
 import type { Filesystem, Git } from '@kompjutr/do';
 export interface KompjutrShellRunnerOptions {
     filesystem: Filesystem;
     /** Adds the `git` command when the workspace was configured with Git. */
     git?: Git;
-    /** `host` is valid only when this workspace contains one session's files. */
-    confinement?: 'host' | 'none';
+    /**
+     * `paths` shows each run only its grants; `host` is valid only when this
+     * workspace contains one session's files. Defaults to `none`.
+     */
+    confinement?: ShellConfinement;
 }
 export declare function createKompjutrShellRunner(options: KompjutrShellRunnerOptions): ShellRunner;
 //# sourceMappingURL=shell.d.ts.map

package/dist/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAInD,MAAM,WAAW,0BAA0B;IAC1C,UAAU,EAAE,UAAU,CAAA;IACtB,yEAAyE;IACzE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC7B;AAMD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CA+B1F"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAc,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAOnD,MAAM,WAAW,0BAA0B;IAC1C,UAAU,EAAE,UAAU,CAAA;IACtB,yEAAyE;IACzE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT;;;OAGG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC9B;AAaD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CAqC1F"}

package/dist/shell.js

@@ -1,21 +1,30 @@
+import { createMountedFilesystem } from '@kompjutr/do/fs';
 import { createGitCommand } from '@kompjutr/do/git-shell';
 import { createShell } from '@kompjutr/do/shell';
+import { createConfinedGitRunner } from './confined-git.js';
+import { GrantMounts } from './mounts.js';
 function quoteShellWord(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
 export function createKompjutrShellRunner(options) {
-    const commands = options.git === undefined ? undefined : new Map([['git', createGitCommand(options.git)]]);
+    const confinement = options.confinement ?? 'none';
+    const unconfined = {
+        filesystem: options.filesystem,
+        commands: options.git === undefined ? undefined : new Map([['git', createGitCommand(options.git)]]),
+    };
     return {
-        confinement: options.confinement ?? 'none',
+        confinement,
         supportsTimeout: false,
         async run(runOptions) {
             if (!runOptions.cwd.startsWith('/'))
                 throw new Error('kompjutr shell requires an absolute cwd');
-            if ((runOptions.grants?.length ?? 0) > 0) {
-                throw new Error('kompjutr shell does not support path grants');
+            if (confinement !== 'paths' && (runOptions.grants?.length ?? 0) > 0) {
+                throw new Error('kompjutr shell does not support path grants without paths confinement');
             }
+            // Without grants the caller asks for no confinement, as with the Bun sandbox.
+            const scope = confinement === 'paths' && runOptions.grants !== undefined ? confinedScope(options, runOptions.grants) : unconfined;
             // ShellSession caches cwd per instance, even though instances share the default SQL row.
-            const shell = createShell({ fs: options.filesystem, commands });
+            const shell = createShell({ fs: scope.filesystem, commands: scope.commands });
             const cwdResult = await shell.run(`cd ${quoteShellWord(runOptions.cwd)}`);
             const result = cwdResult.exitCode === 0
                 ? await shell.run(runOptions.command, {
@@ -33,4 +42,15 @@ export function createKompjutrShellRunner(options) {
         },
     };
 }
+/** A fail-closed view of the run's grants, with Git translated between that view and real space. */
+function confinedScope(options, grants) {
+    const mounts = new GrantMounts(options.filesystem, grants);
+    const view = createMountedFilesystem(options.filesystem, mounts.specs);
+    if (options.git === undefined)
+        return { filesystem: view };
+    return {
+        filesystem: view,
+        commands: new Map([['git', createGitCommand(createConfinedGitRunner(options.git, view, mounts))]]),
+    };
+}
 //# sourceMappingURL=shell.js.map

package/dist/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAUhD,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAE1G,OAAO;QACN,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QAC1C,eAAe,EAAE,KAAK;QACtB,KAAK,CAAC,GAAG,CAAC,UAAU;YACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC/F,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC/D,CAAC;YAED,yFAAyF;YACzF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,MAAM,MAAM,GACX,SAAS,CAAC,QAAQ,KAAK,CAAC;gBACvB,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE;oBACpC,GAAG,EAAE,UAAU,CAAC,GAAG;oBACnB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACvB,CAAC;gBACH,CAAC,CAAC,SAAS,CAAA;YACb,OAAO;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAoBzC,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAA;IACjD,MAAM,UAAU,GAAe;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACnG,CAAA;IAED,OAAO;QACN,WAAW;QACX,eAAe,EAAE,KAAK;QACtB,KAAK,CAAC,GAAG,CAAC,UAAU;YACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC/F,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;YACzF,CAAC;YAED,8EAA8E;YAC9E,MAAM,KAAK,GAAG,WAAW,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;YACjI,yFAAyF;YACzF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC7E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,MAAM,MAAM,GACX,SAAS,CAAC,QAAQ,KAAK,CAAC;gBACvB,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE;oBACpC,GAAG,EAAE,UAAU,CAAC,GAAG;oBACnB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACvB,CAAC;gBACH,CAAC,CAAC,SAAS,CAAA;YACb,OAAO;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,OAAmC,EAAE,MAA6B;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAC1D,OAAO;QACN,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAClG,CAAA;AACF,CAAC"}

package/dist/testing/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/testing/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAyB,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAiB,cAAc,EAAE,MAAM,cAAc,CAAA;AAE3F,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAuEtC,qBAAa,gBAAiB,YAAW,wBAAwB;;IAChE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAE5B,8EAA8E;IAC9E,cAAc,SAAI;IAClB,6FAA6F;IAC7F,QAAQ,SAAI;gBAIA,IAAI,SAAa;IAkB7B,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;IAgBvC,aAAa,IAAI,IAAI;IAKrB,KAAK,IAAI,IAAI;CAGb"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/testing/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAyB,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAiB,cAAc,EAAE,MAAM,cAAc,CAAA;AAE3F,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAuEtC,qBAAa,gBAAiB,YAAW,wBAAwB;;IAChE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAE5B,8EAA8E;IAC9E,cAAc,SAAI;IAClB,6FAA6F;IAC7F,QAAQ,SAAI;gBAIA,IAAI,SAAa;IAmB7B,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;IAgBvC,aAAa,IAAI,IAAI;IAKrB,KAAK,IAAI,IAAI;CAGb"}

package/dist/testing/storage.js

@@ -95,7 +95,8 @@ export class BunSqliteStorage {
                     throw new Error(`too many SQL variables: ${bindings.length} exceeds the ${MAX_BIND_PARAMETERS} a Durable Object binds`);
                 }
                 this.statementCount++;
-                const statement = this.db.query(query);
+                // Not `query()`: it caches by SQL text, and a nested cursor over the same SQL would share one statement.
+                const statement = this.db.prepare(query);
                 const rows = statement.iterate(...bindings.map(toBinding));
                 return new Cursor(rows, () => {
                     this.rowCount++;

package/dist/testing/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/testing/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAyB,MAAM,YAAY,CAAA;AAG3E,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,8FAA8F;AAC9F,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9D,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACxH,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,+BAA+B,OAAO,KAAK,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,MAAM;IAOO;IANlB,KAAK,CAAe;IACpB,WAAW,CAA4B;IACvC,KAAK,GAAG,KAAK,CAAA;IAEb,YACC,IAAmB,EACF,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QAElC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,KAAK;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;;YACpC,IAAI,CAAC,KAAK,EAAE,CAAA;QACjB,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI;QACH,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAA;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACvB,OAAO,KAAK,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACvD,OAAO,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,MAAM;QACL,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;YACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACxC,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChB,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,OAAO;QACN,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;CACD;AAED,MAAM,OAAO,gBAAgB;IACnB,EAAE,CAAa;IACf,GAAG,CAAgB;IAE5B,8EAA8E;IAC9E,cAAc,GAAG,CAAC,CAAA;IAClB,6FAA6F;IAC7F,QAAQ,GAAG,CAAC,CAAA;IAEZ,MAAM,GAAG,CAAC,CAAA;IAEV,YAAY,IAAI,GAAG,UAAU;QAC5B,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,GAAG;YACV,IAAI,EAAE,CAAqB,KAAa,EAAE,GAAG,QAAmB,EAAsB,EAAE;gBACvF,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,gBAAgB,mBAAmB,yBAAyB,CAAC,CAAA;gBACxH,CAAC;gBACD,IAAI,CAAC,cAAc,EAAE,CAAA;gBACrB,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAA0B,KAAK,CAAC,CAAA;gBAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC1D,OAAO,IAAI,MAAM,CAAM,IAAI,EAAE,GAAG,EAAE;oBACjC,IAAI,CAAC,QAAQ,EAAE,CAAA;gBAChB,CAAC,CAAC,CAAA;YACH,CAAC;SACD,CAAA;IACF,CAAC;IAED,eAAe,CAAI,OAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,EAAE,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;YACxB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACrB,OAAO,MAAM,CAAA;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACvB,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,MAAM,EAAE,CAAA;QACd,CAAC;IACF,CAAC;IAED,aAAa;QACZ,IAAI,CAAC,cAAc,GAAG,CAAC,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;IAClB,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;CACD"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/testing/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAyB,MAAM,YAAY,CAAA;AAG3E,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,8FAA8F;AAC9F,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9D,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACxH,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,+BAA+B,OAAO,KAAK,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,MAAM;IAOO;IANlB,KAAK,CAAe;IACpB,WAAW,CAA4B;IACvC,KAAK,GAAG,KAAK,CAAA;IAEb,YACC,IAAmB,EACF,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QAElC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,KAAK;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;;YACpC,IAAI,CAAC,KAAK,EAAE,CAAA;QACjB,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI;QACH,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAA;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACvB,OAAO,KAAK,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACvD,OAAO,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,MAAM;QACL,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;YACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACxC,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChB,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,OAAO;QACN,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;CACD;AAED,MAAM,OAAO,gBAAgB;IACnB,EAAE,CAAa;IACf,GAAG,CAAgB;IAE5B,8EAA8E;IAC9E,cAAc,GAAG,CAAC,CAAA;IAClB,6FAA6F;IAC7F,QAAQ,GAAG,CAAC,CAAA;IAEZ,MAAM,GAAG,CAAC,CAAA;IAEV,YAAY,IAAI,GAAG,UAAU;QAC5B,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,GAAG;YACV,IAAI,EAAE,CAAqB,KAAa,EAAE,GAAG,QAAmB,EAAsB,EAAE;gBACvF,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,gBAAgB,mBAAmB,yBAAyB,CAAC,CAAA;gBACxH,CAAC;gBACD,IAAI,CAAC,cAAc,EAAE,CAAA;gBACrB,yGAAyG;gBACzG,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA0B,KAAK,CAAC,CAAA;gBACjE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC1D,OAAO,IAAI,MAAM,CAAM,IAAI,EAAE,GAAG,EAAE;oBACjC,IAAI,CAAC,QAAQ,EAAE,CAAA;gBAChB,CAAC,CAAC,CAAA;YACH,CAAC;SACD,CAAA;IACF,CAAC;IAED,eAAe,CAAI,OAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,EAAE,CAAA;QACrC,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;YACxB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACrB,OAAO,MAAM,CAAA;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACvB,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,MAAM,EAAE,CAAA;QACd,CAAC;IACF,CAAC;IAED,aAAa;QACZ,IAAI,CAAC,cAAc,GAAG,CAAC,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;IAClB,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@roj-ai/kompjutr-platform",
-	"version": "0.2.11",
+	"version": "0.2.12",
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -43,8 +43,8 @@
 		"type-check": "tsc --noEmit"
 	},
 	"dependencies": {
-		"@kompjutr/do": "0.1.2",
-		"@roj-ai/sdk": "^0.2.11"
+		"@kompjutr/do": "0.1.3",
+		"@roj-ai/sdk": "^0.2.12"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.3",

package/src/confined-git.ts

@@ -0,0 +1,144 @@
+import { posix } from 'node:path'
+import type { GitCliResult, GitCliRunner } from '@kompjutr/do'
+import type { Filesystem } from '@kompjutr/do/fs'
+import type { GrantMounts, MountedPath } from './mounts.js'
+
+/** Commands whose every absolute operand is a pathspec. */
+const PATHSPEC_OPERANDS = new Set(['status', 'ls-files', 'add', 'restore'])
+/** Commands that read pathspecs only after `--`. */
+const PATHSPEC_AFTER_SEPARATOR = new Set(['diff', 'log', 'reset', 'checkout'])
+/** `git clone` options that take their value as the next argument. */
+const CLONE_VALUED_OPTIONS = new Set(['--depth', '--branch', '-b', '--origin', '-o'])
+/** Unquoted paths in Git's messages: after whitespace or a quote, up to the next one. */
+const MESSAGE_PATH = /(?<=^|[\s'"])\/[^\s'"]*/g
+
+type Translated = { ok: true; argv: readonly string[] } | { ok: false; message: string }
+
+/**
+ * Runs Git for a shell confined to a mounted view.
+ *
+ * Git keeps the real filesystem, because checkout routing and dirty tracking work
+ * on real paths. This runner moves the shell's virtual cwd and absolute path
+ * operands into real space, refuses what no writable mount shows, and maps the
+ * real paths Git prints back to virtual ones.
+ */
+export function createConfinedGitRunner(git: GitCliRunner, view: Filesystem, mounts: GrantMounts): GitCliRunner {
+	return {
+		async runCli(input, options) {
+			const virtualCwd = view.realpath(input.cwd ?? '/')
+			const cwd = mounts.toReal(virtualCwd)
+			if (cwd === undefined) return refused(`'${virtualCwd}' is outside the mounted paths`)
+
+			const translated = await translate(git, view, mounts, input.argv, virtualCwd, cwd)
+			if (!translated.ok) return refused(translated.message)
+
+			const result = await git.runCli({ ...input, argv: translated.argv, cwd: cwd.real }, options)
+			const toVirtual = (text: string): string =>
+				text.replace(MESSAGE_PATH, (match) => {
+					// `path: message` puts a colon after the path.
+					const path = match.endsWith(':') ? match.slice(0, -1) : match
+					return `${mounts.toVirtual(path, cwd.mount) ?? path}${match.slice(path.length)}`
+				})
+			return {
+				...result,
+				stdout: printsRealPaths(input.argv) ? toVirtual(result.stdout) : result.stdout,
+				stderr: toVirtual(result.stderr),
+			}
+		},
+	}
+}
+
+async function translate(
+	git: GitCliRunner,
+	view: Filesystem,
+	mounts: GrantMounts,
+	argv: readonly string[],
+	virtualCwd: string,
+	cwd: MountedPath,
+): Promise<Translated> {
+	const command = argv[0]
+	if (command === 'init' || command === 'clone') {
+		const index = command === 'init' ? initDirectoryIndex(argv) : cloneDirectoryIndex(argv)
+		const directory = index === undefined ? undefined : argv[index]
+		if (index === undefined || directory === undefined) {
+			// Both create in or directly under the cwd.
+			return cwd.mount.mode === 'rw' ? { ok: true, argv } : { ok: false, message: `'${virtualCwd}' is read-only` }
+		}
+		const target = writableTarget(view, mounts, posix.resolve(virtualCwd, directory))
+		if (target === undefined) return { ok: false, message: `'${directory}' is outside the writable mounted paths` }
+		const translatedArgv = [...argv]
+		translatedArgv[index] = target
+		return { ok: true, argv: translatedArgv }
+	}
+
+	const translatedArgv = [...argv]
+	for (const index of pathspecIndexes(argv)) {
+		const pathspec = argv[index]
+		if (pathspec === undefined || !pathspec.startsWith('/')) continue
+		const real = mounts.toReal(posix.resolve(pathspec))
+		if (real === undefined) return { ok: false, message: `'${pathspec}' is outside the mounted paths` }
+		translatedArgv[index] = real.real
+	}
+
+	const repository = await git.runCli({ argv: ['rev-parse', '--show-toplevel'], cwd: cwd.real })
+	// A cwd outside any repository fails the command itself with Git's own message.
+	if (repository.exitCode === 0 && !mounts.isWritable(repository.stdout.trimEnd())) {
+		return { ok: false, message: `the repository at '${virtualCwd}' is not inside a writable mounted path` }
+	}
+	return { ok: true, argv: translatedArgv }
+}
+
+/**
+ * The real path a new repository would take, when a writable mount shows it.
+ * The existing part resolves through the view, so a symlink leaving its mount fails here
+ * instead of being followed by Git in real space.
+ */
+function writableTarget(view: Filesystem, mounts: GrantMounts, virtualTarget: string): string | undefined {
+	let existing = virtualTarget
+	const missing: string[] = []
+	while (view.statTarget(existing) === null) {
+		if (existing === '/' || view.stat(existing) !== null) return undefined
+		missing.unshift(posix.basename(existing))
+		existing = posix.dirname(existing)
+	}
+	const target = mounts.toReal(posix.join(view.realpath(existing), ...missing))
+	return target?.mount.mode === 'rw' ? target.real : undefined
+}
+
+function initDirectoryIndex(argv: readonly string[]): number | undefined {
+	const index = argv.findIndex((argument, position) => position > 0 && !argument.startsWith('-'))
+	return index === -1 ? undefined : index
+}
+
+function cloneDirectoryIndex(argv: readonly string[]): number | undefined {
+	const operands: number[] = []
+	for (let index = 1; index < argv.length; index++) {
+		const argument = argv[index]
+		if (argument === undefined) break
+		if (CLONE_VALUED_OPTIONS.has(argument)) index++
+		else if (!argument.startsWith('-')) operands.push(index)
+	}
+	return operands[1]
+}
+
+function pathspecIndexes(argv: readonly string[]): number[] {
+	const command = argv[0] ?? ''
+	const separator = argv.indexOf('--', 1)
+	const indexes: number[] = []
+	for (let index = 1; index < argv.length; index++) {
+		if (index === separator) continue
+		if (PATHSPEC_OPERANDS.has(command) || (PATHSPEC_AFTER_SEPARATOR.has(command) && separator !== -1 && index > separator)) {
+			indexes.push(index)
+		}
+	}
+	return indexes
+}
+
+/** Commands whose stdout names a real path rather than repository content. */
+function printsRealPaths(argv: readonly string[]): boolean {
+	return argv[0] === 'init' || argv[0] === 'clone' || (argv[0] === 'rev-parse' && argv[1] === '--show-toplevel')
+}
+
+function refused(message: string): GitCliResult {
+	return { stdout: '', stderr: `fatal: ${message}\n`, exitCode: 128, truncated: false }
+}

package/src/index.ts

@@ -6,7 +6,7 @@
  * that can hand kompjutr a SQL storage.
  */
 
-import type { Platform, Scheduler } from '@roj-ai/sdk/platform'
+import type { Platform, Scheduler, ShellConfinement } from '@roj-ai/sdk/platform'
 import { createTimerScheduler } from '@roj-ai/sdk/platform'
 import type { Git, Workspace } from '@kompjutr/do'
 import { KompjutrEventStore } from './event-store.js'
@@ -29,8 +29,12 @@ export interface KompjutrPlatformOptions {
 	scheduler?: Scheduler
 	/** Retention and column ceiling for the LLM call log. */
 	llmCallLog?: KompjutrLLMCallLogOptions
-	/** How the workspace itself is isolated. Defaults to `none`. */
-	shellConfinement?: 'host' | 'none'
+	/**
+	 * How shell commands are confined. `paths` mounts each run's grants as its
+	 * only filesystem; `host` means the workspace holds one session's files.
+	 * Defaults to `none`.
+	 */
+	shellConfinement?: ShellConfinement
 }
 
 export function createKompjutrPlatform(workspace: Workspace, options: KompjutrPlatformOptions = {}): Platform {

package/src/mounts.ts

@@ -0,0 +1,63 @@
+import { posix } from 'node:path'
+import type { Filesystem, MountSpec } from '@kompjutr/do/fs'
+import type { ShellGrant } from '@roj-ai/sdk/platform'
+
+/** A real workspace path, and the mount that shows it. */
+export interface MountedPath {
+	mount: MountSpec
+	real: string
+}
+
+/**
+ * One run's grants as mounts, plus the prefix translation between the paths a
+ * command sees and the workspace's real ones, for consumers that bypass the view.
+ */
+export class GrantMounts {
+	readonly specs: readonly MountSpec[]
+
+	constructor(filesystem: Filesystem, grants: readonly ShellGrant[]) {
+		this.specs = grants.map((grant) => ({
+			path: posix.resolve(grant.path),
+			// A bind mount follows symlinks in its source; the view accepts only the resolved directory.
+			source: filesystem.realpath(posix.resolve(grant.source ?? grant.path)),
+			mode: grant.mode,
+		}))
+	}
+
+	/** The real path behind a canonical virtual path, or undefined outside every mount. */
+	toReal(virtualPath: string): MountedPath | undefined {
+		for (const mount of this.specs) {
+			const rest = suffixUnder(mount.path, virtualPath)
+			if (rest !== undefined) return { mount, real: joinSuffix(mount.source, rest) }
+		}
+		return undefined
+	}
+
+	/** A virtual path showing `realPath`, from `preferred` when it shows it, otherwise from the narrowest source. */
+	toVirtual(realPath: string, preferred?: MountSpec): string | undefined {
+		const candidates = [...this.specs].sort((left, right) => right.source.length - left.source.length)
+		if (preferred !== undefined) candidates.unshift(preferred)
+		for (const mount of candidates) {
+			const rest = suffixUnder(mount.source, realPath)
+			if (rest !== undefined) return joinSuffix(mount.path, rest)
+		}
+		return undefined
+	}
+
+	/** Whether a writable mount shows `realPath`. */
+	isWritable(realPath: string): boolean {
+		return this.specs.some((mount) => mount.mode === 'rw' && suffixUnder(mount.source, realPath) !== undefined)
+	}
+}
+
+/** `''` when `path` is `root`, `/rest` when below it, undefined otherwise. */
+function suffixUnder(root: string, path: string): string | undefined {
+	if (path === root) return ''
+	if (root === '/') return path.startsWith('/') ? path : undefined
+	return path.startsWith(`${root}/`) ? path.slice(root.length) : undefined
+}
+
+function joinSuffix(root: string, suffix: string): string {
+	if (suffix === '') return root
+	return root === '/' ? suffix : `${root}${suffix}`
+}

package/src/shell.ts

@@ -1,14 +1,27 @@
-import type { ShellRunner } from '@roj-ai/sdk/platform'
+import type { ShellConfinement, ShellGrant, ShellRunner } from '@roj-ai/sdk/platform'
 import type { Filesystem, Git } from '@kompjutr/do'
+import { createMountedFilesystem } from '@kompjutr/do/fs'
 import { createGitCommand } from '@kompjutr/do/git-shell'
 import { createShell } from '@kompjutr/do/shell'
+import { createConfinedGitRunner } from './confined-git.js'
+import { GrantMounts } from './mounts.js'
 
 export interface KompjutrShellRunnerOptions {
 	filesystem: Filesystem
 	/** Adds the `git` command when the workspace was configured with Git. */
 	git?: Git
-	/** `host` is valid only when this workspace contains one session's files. */
-	confinement?: 'host' | 'none'
+	/**
+	 * `paths` shows each run only its grants; `host` is valid only when this
+	 * workspace contains one session's files. Defaults to `none`.
+	 */
+	confinement?: ShellConfinement
+}
+
+type ShellCommands = NonNullable<Parameters<typeof createShell>[0]['commands']>
+
+interface ShellScope {
+	filesystem: Filesystem
+	commands?: ShellCommands
 }
 
 function quoteShellWord(value: string): string {
@@ -16,19 +29,25 @@ function quoteShellWord(value: string): string {
 }
 
 export function createKompjutrShellRunner(options: KompjutrShellRunnerOptions): ShellRunner {
-	const commands = options.git === undefined ? undefined : new Map([['git', createGitCommand(options.git)]])
+	const confinement = options.confinement ?? 'none'
+	const unconfined: ShellScope = {
+		filesystem: options.filesystem,
+		commands: options.git === undefined ? undefined : new Map([['git', createGitCommand(options.git)]]),
+	}
 
 	return {
-		confinement: options.confinement ?? 'none',
+		confinement,
 		supportsTimeout: false,
 		async run(runOptions) {
 			if (!runOptions.cwd.startsWith('/')) throw new Error('kompjutr shell requires an absolute cwd')
-			if ((runOptions.grants?.length ?? 0) > 0) {
-				throw new Error('kompjutr shell does not support path grants')
+			if (confinement !== 'paths' && (runOptions.grants?.length ?? 0) > 0) {
+				throw new Error('kompjutr shell does not support path grants without paths confinement')
 			}
 
+			// Without grants the caller asks for no confinement, as with the Bun sandbox.
+			const scope = confinement === 'paths' && runOptions.grants !== undefined ? confinedScope(options, runOptions.grants) : unconfined
 			// ShellSession caches cwd per instance, even though instances share the default SQL row.
-			const shell = createShell({ fs: options.filesystem, commands })
+			const shell = createShell({ fs: scope.filesystem, commands: scope.commands })
 			const cwdResult = await shell.run(`cd ${quoteShellWord(runOptions.cwd)}`)
 			const result =
 				cwdResult.exitCode === 0
@@ -47,3 +66,14 @@ export function createKompjutrShellRunner(options: KompjutrShellRunnerOptions):
 		},
 	}
 }
+
+/** A fail-closed view of the run's grants, with Git translated between that view and real space. */
+function confinedScope(options: KompjutrShellRunnerOptions, grants: readonly ShellGrant[]): ShellScope {
+	const mounts = new GrantMounts(options.filesystem, grants)
+	const view = createMountedFilesystem(options.filesystem, mounts.specs)
+	if (options.git === undefined) return { filesystem: view }
+	return {
+		filesystem: view,
+		commands: new Map([['git', createGitCommand(createConfinedGitRunner(options.git, view, mounts))]]),
+	}
+}

package/src/testing/storage.ts

@@ -105,7 +105,8 @@ export class BunSqliteStorage implements DurableObjectStorageLike {
 					throw new Error(`too many SQL variables: ${bindings.length} exceeds the ${MAX_BIND_PARAMETERS} a Durable Object binds`)
 				}
 				this.statementCount++
-				const statement = this.db.query<Row, SQLQueryBindings[]>(query)
+				// Not `query()`: it caches by SQL text, and a nested cursor over the same SQL would share one statement.
+				const statement = this.db.prepare<Row, SQLQueryBindings[]>(query)
 				const rows = statement.iterate(...bindings.map(toBinding))
 				return new Cursor<Row>(rows, () => {
 					this.rowCount++