@shapeshift-labs/frontier-swarm-codex 0.5.122 → 0.5.124

package/dist/codex-workspace-write-fence.js

@@ -1,155 +0,0 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { normalizeWorkspacePath, shouldPruneWorkspaceWriteFenceTraversal } from './common.js';
-const WRITE_FENCE_LIMITATIONS = [
-    'chmod-readonly is a best-effort pre-exec fence, not a security sandbox',
-    'a worker running as the same OS user can chmod owned paths back to writable',
-    'workspace root and allowed-write ancestors may remain writable so allowed new files can be created',
-    'symlinks and heavyweight dependency/run artifact trees are not traversed; strict post-exec restore is the durable enforcement'
-];
-export async function applyWorkspacePreExecWriteFence(input) {
-    const writableRoots = uniqueWriteFenceRoots(input.writableRoots ?? input.allowedWrites);
-    const skipped = skippedWriteFenceReason(input.enabled !== false, input.workspacePlan);
-    if (skipped)
-        return { records: [], summary: createWriteFenceSummary({ mode: 'none', skippedReason: skipped, writableRoots }) };
-    const records = [];
-    await walkWorkspaceWriteFence(input.workspace, input.workspace, writableRoots, records);
-    return {
-        records,
-        summary: createWriteFenceSummary({
-            mode: 'chmod-readonly',
-            applied: records.length > 0,
-            lockedPathCount: records.length,
-            sampleLockedPaths: records.slice(0, 20).map((entry) => entry.path),
-            writableRoots
-        })
-    };
-}
-export async function restoreWorkspacePreExecWriteFence(state) {
-    let restoredPathCount = 0;
-    let failedRestoreCount = 0;
-    for (const record of [...state.records].reverse()) {
-        try {
-            await fs.chmod(record.absolutePath, record.originalMode);
-            restoredPathCount += 1;
-        }
-        catch {
-            failedRestoreCount += 1;
-        }
-    }
-    return { ...state.summary, restoredPathCount, failedRestoreCount };
-}
-async function walkWorkspaceWriteFence(root, current, allowedWrites, records) {
-    const entries = await fs.readdir(current, { withFileTypes: true }).catch(() => []);
-    for (const entry of entries) {
-        const absolute = path.join(current, entry.name);
-        const relative = path.relative(root, absolute).replace(/\\/g, '/');
-        if (!relative || entry.isSymbolicLink())
-            continue;
-        if (entry.isDirectory()) {
-            if (shouldPruneWorkspaceWriteFenceTraversal(relative)) {
-                await fenceWorkspacePath(absolute, relative, 'directory', allowedWrites, records);
-                continue;
-            }
-            await walkWorkspaceWriteFence(root, absolute, allowedWrites, records);
-            await fenceWorkspacePath(absolute, relative, 'directory', allowedWrites, records);
-        }
-        else if (entry.isFile()) {
-            await fenceWorkspacePath(absolute, relative, 'file', allowedWrites, records);
-        }
-    }
-}
-async function fenceWorkspacePath(absolutePath, relativePath, kind, allowedWrites, records) {
-    const keepWritable = kind === 'directory'
-        ? allowedWrites.some((entry) => writeEntryCoversDirectory(relativePath, entry))
-        : allowedWrites.some((entry) => writeEntryCoversFile(relativePath, entry));
-    if (keepWritable)
-        return;
-    const stat = await fs.lstat(absolutePath).catch(() => undefined);
-    if (!stat)
-        return;
-    const originalMode = stat.mode & 0o7777;
-    const fencedMode = originalMode & ~0o222;
-    if (fencedMode === originalMode)
-        return;
-    await fs.chmod(absolutePath, fencedMode).catch(() => { });
-    const after = await fs.lstat(absolutePath).catch(() => undefined);
-    if (!after || (after.mode & 0o222) !== 0)
-        return;
-    records.push({ path: relativePath, absolutePath, kind, originalMode, fencedMode });
-}
-function writeEntryCoversFile(file, entry) {
-    const parsed = parseWriteFenceEntry(entry);
-    if (!parsed)
-        return false;
-    if (parsed.all)
-        return true;
-    return file === parsed.prefix || file.startsWith(parsed.prefix + '/');
-}
-function writeEntryCoversDirectory(directory, entry) {
-    const parsed = parseWriteFenceEntry(entry);
-    if (!parsed)
-        return false;
-    if (parsed.all)
-        return true;
-    return directory === parsed.prefix
-        || directory.startsWith(parsed.prefix + '/')
-        || parsed.prefix.startsWith(directory + '/');
-}
-function parseWriteFenceEntry(entry) {
-    const raw = String(entry ?? '').trim().replace(/\\/g, '/').replace(/\/+$/, '');
-    if (!raw || raw.includes('\0') || path.isAbsolute(raw) || path.win32.isAbsolute(raw))
-        return undefined;
-    if (raw === '*' || raw === '**' || raw === '**/*')
-        return { all: true };
-    const starIndex = raw.indexOf('*');
-    const staticPart = writeFenceStaticRoot(raw, starIndex);
-    const prefix = normalizeWorkspacePath(staticPart);
-    return prefix ? { all: false, prefix } : undefined;
-}
-function writeFenceStaticRoot(raw, starIndex) {
-    if (starIndex < 0)
-        return raw.replace(/\/+$/, '');
-    const staticPart = raw.slice(0, starIndex);
-    if (staticPart.endsWith('/'))
-        return staticPart.replace(/\/+$/, '');
-    const segmentEnd = staticPart.lastIndexOf('/');
-    if (segmentEnd < 0)
-        return '';
-    return staticPart.slice(0, segmentEnd).replace(/\/+$/, '');
-}
-function skippedWriteFenceReason(enabled, plan) {
-    if (!enabled)
-        return 'worker execution skipped';
-    if (plan.allowedWritePolicy.mode !== 'strict')
-        return 'allowed write policy is audit';
-    if (plan.mode !== 'copy' && plan.mode !== 'snapshot')
-        return `workspace mode ${plan.mode} is not isolated`;
-    return undefined;
-}
-function createWriteFenceSummary(input) {
-    return {
-        mode: input.mode,
-        applied: input.applied ?? false,
-        ...(input.skippedReason ? { skippedReason: input.skippedReason } : {}),
-        lockedPathCount: input.lockedPathCount ?? 0,
-        restoredPathCount: 0,
-        failedRestoreCount: 0,
-        sampleLockedPaths: input.sampleLockedPaths ?? [],
-        writableRoots: uniqueWriteFenceRoots(input.writableRoots),
-        limitations: WRITE_FENCE_LIMITATIONS
-    };
-}
-function uniqueWriteFenceRoots(values) {
-    const out = [];
-    const seen = new Set();
-    for (const value of values) {
-        const root = String(value ?? '').trim();
-        if (!root || seen.has(root))
-            continue;
-        seen.add(root);
-        out.push(root);
-    }
-    return out;
-}
-//# sourceMappingURL=codex-workspace-write-fence.js.map

package/dist/codex-workspace-write-fence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-workspace-write-fence.js","sourceRoot":"","sources":["../src/codex-workspace-write-fence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,uCAAuC,EAAE,MAAM,aAAa,CAAC;AAgB9F,MAAM,uBAAuB,GAAG;IAC9B,wEAAwE;IACxE,6EAA6E;IAC7E,oGAAoG;IACpG,+HAA+H;CAChI,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACtF,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC/H,MAAM,OAAO,GAA6C,EAAE,CAAC;IAC7D,MAAM,uBAAuB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACxF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,uBAAuB,CAAC;YAC/B,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;YAC3B,eAAe,EAAE,OAAO,CAAC,MAAM;YAC/B,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAClE,aAAa;SACd,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAA4C;IAE5C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACzD,iBAAiB,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAY,EACZ,OAAe,EACf,aAAgC,EAChC,OAAiD;IAEjD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,uCAAuC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,MAAM,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,YAAoB,EACpB,YAAoB,EACpB,IAA0B,EAC1B,aAAgC,EAChC,OAAiD;IAEjD,MAAM,YAAY,GAAG,IAAI,KAAK,WAAW;QACvC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,YAAY;QAAE,OAAO;IACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,YAAY,GAAG,CAAC,KAAK,CAAC;IACzC,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO;IACxC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB,EAAE,KAAa;IACjE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,SAAS,KAAK,MAAM,CAAC,MAAM;WAC7B,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;WACzC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAE,SAAiB;IAC1D,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAAgC;IACjF,IAAI,CAAC,OAAO;QAAE,OAAO,0BAA0B,CAAC;IAChD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,+BAA+B,CAAC;IACtF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,kBAAkB,IAAI,CAAC,IAAI,kBAAkB,CAAC;IAC3G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAOhC;IACC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;QAC/B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,CAAC;QAC3C,iBAAiB,EAAE,CAAC;QACpB,kBAAkB,EAAE,CAAC;QACrB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,EAAE;QAChD,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/collect-run-graph.d.ts

@@ -1,7 +0,0 @@
-import type { FrontierCodexCollectResult } from './types-collection.js';
-import type { FrontierCodexRunGraph } from './types-run-graph.js';
-export declare function createCodexCollectRunGraph(input: {
-    result: FrontierCodexCollectResult;
-    generatedAt?: number;
-}): FrontierCodexRunGraph;
-//# sourceMappingURL=collect-run-graph.d.ts.map

package/dist/collect-run-graph.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"collect-run-graph.d.ts","sourceRoot":"","sources":["../src/collect-run-graph.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,qBAAqB,EAItB,MAAM,sBAAsB,CAAC;AA6E9B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,0BAA0B,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,qBAAqB,CAgFxB"}