@struktoai/mirage-dsh 0.0.1 → 0.0.6

package/cordis.patch.yml

@@ -19,6 +19,55 @@
 #           config: { token: !!js process.env.SLACK_BOT_TOKEN }
 #       runtimes:
 #         - { name: monty, captures: [python, python3] }
+#
+# A profile may also carry a permission document, which is what turns
+# mirage's allow/ask/deny into a policy for this bundle. Roles go under
+# `profiles`, and `profile` names the one a session gets by default:
+#
+#   - id: mirage
+#     config:
+#       profiles:
+#         agent:
+#           commands:
+#             allow: [cat, ls, grep, rm]
+#             ask:
+#               - { commands: [rm], reason: deletes are reviewed }
+#             deny:
+#               - { commands: [git push], reason: no publishing }
+#       profile: agent
+#
+# An `ask` rule is put to the human through dsh's own approval channel
+# (`ctx.approval`), so the prompt the agent triggers is the one dsh
+# already shows for its escalations. It quotes the line word by word as
+# a shell would read it back, so a name carrying a space or a newline
+# cannot pass itself off in the prompt as two operands or two lines.
+# `allowed-once` runs the line;
+# a rejection, a dismissal and an unanswerable ask all refuse it. With
+# no approval plugin composed the ask has nowhere to go, so it stays a
+# pending record the host answers through `ctx.mirage.decisions`
+# (`pending()`, then `answer(id, outcome, scope)`) — deliberately not a
+# refusal, since rewriting an `ask` rule as a `deny` would change what
+# the document says. A question never outlives the run that raised it:
+# the run's abort signal goes to the channel with the request and bounds
+# the ledger's wait, so a line still unanswered when its timeout expires
+# comes back as the kill, and a yes arriving after that is dropped
+# rather than banked for the next identical line.
+#
+# Two facts about how the mirage providers read the surrounding dsh
+# composition, neither of which needs a row here:
+#
+#   * The standing file policy is enforced, not merely reported. Both
+#     seams narrow every mount grant to read for a `read-only` call
+#     (leaving the null sink writable, as that mode's definition
+#     requires), so dsh-base's `DSH_PERMISSION_MODE=read-only` now
+#     actually confines a mirage world instead of being ignored. The
+#     policy's `workspaceRoot` is a directory on the host and is never
+#     consulted: the mounts and their modes are the boundary here.
+#
+#   * A workdir dsh resolved on its own machine (an unspecified one
+#     comes from the calling session's cwd) names nothing in this world,
+#     so it is ignored in favour of the workspace default rather than
+#     run in a directory the agent cannot reach.
 
 # The host filesystem and bash providers step aside; mirage provides the
 # same ctx.fs and ctx.shell seams over the workspace.

package/dist/{chunk-CATVBGGR.js → chunk-2F2PJ7D7.js}

@@ -48,16 +48,77 @@ function applyLiteralEdit(content, oldString, newString, replaceAll, displayPath
   }
   return replaceAll ? content.replaceAll(oldString, newString) : content.replace(oldString, newString);
 }
+function charBoundary(bytes, from) {
+  let start = from;
+  while (start < bytes.byteLength && ((bytes[start] ?? 0) & 192) === 128) start++;
+  return start;
+}
 function tailCap(text, maxBytes) {
   const bytes = new TextEncoder().encode(text);
   if (bytes.byteLength <= maxBytes) return { text, truncated: false };
-  let start = bytes.byteLength - maxBytes;
-  while (start < bytes.byteLength && ((bytes[start] ?? 0) & 192) === 128) start++;
+  const start = charBoundary(bytes, bytes.byteLength - maxBytes);
   return {
     text: new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(start)),
     truncated: true
   };
 }
+var TailBuffer = class {
+  budget;
+  parts = [];
+  bytes = 0;
+  constructor(budget) {
+    this.budget = budget;
+  }
+  /**
+   * Append a chunk, dropping the oldest bytes that no longer fit.
+   *
+   * @param data the bytes to append.
+   * @returns true when bytes were dropped to make room.
+   */
+  append(data) {
+    this.parts.push(data);
+    this.bytes += data.byteLength;
+    if (this.bytes <= this.budget) return false;
+    let excess = this.bytes - this.budget;
+    while (excess > 0) {
+      const head = this.parts[0];
+      if (head === void 0) break;
+      if (head.byteLength <= excess) {
+        this.parts.shift();
+        excess -= head.byteLength;
+        this.bytes -= head.byteLength;
+      } else {
+        this.parts[0] = head.subarray(excess);
+        this.bytes -= excess;
+        excess = 0;
+      }
+    }
+    return true;
+  }
+  /**
+   * Drain everything held, decoded as text.
+   *
+   * The head may sit mid-character, since dropping is byte-exact, so it
+   * is re-aligned before decoding rather than rendered as a replacement
+   * mark.
+   *
+   * @returns the buffered text; the buffer is left empty.
+   */
+  take() {
+    if (this.parts.length === 0) return "";
+    const joined = new Uint8Array(this.bytes);
+    let at = 0;
+    for (const part of this.parts) {
+      joined.set(part, at);
+      at += part.byteLength;
+    }
+    this.parts = [];
+    this.bytes = 0;
+    return new TextDecoder("utf-8", { fatal: false }).decode(
+      joined.subarray(charBoundary(joined, 0))
+    );
+  }
+};
 
 export {
   decodeStrictText,
@@ -65,6 +126,7 @@ export {
   detectsCrlf,
   restoreLineEndings,
   applyLiteralEdit,
-  tailCap
+  tailCap,
+  TailBuffer
 };
-//# sourceMappingURL=chunk-CATVBGGR.js.map
+//# sourceMappingURL=chunk-2F2PJ7D7.js.map

package/dist/{chunk-CATVBGGR.js.map → chunk-2F2PJ7D7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/text.ts"],"sourcesContent":["// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n//     http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n\nimport { FsError } from '@deepseek-ai/dsh-fs'\n\nconst BINARY_SAMPLE_BYTES = 8192\n\n// dsh text semantics: a NUL in the leading sample or invalid UTF-8 is a\n// binary file, refused as FS_NOT_TEXT rather than decoded lossily (the\n// mirage facade's readFileText decodes with fatal: false, which the dsh\n// seam contract forbids).\nexport function decodeStrictText(bytes: Uint8Array, displayPath: string): string {\n  if (bytes.subarray(0, BINARY_SAMPLE_BYTES).includes(0)) {\n    throw new FsError(`cannot read \"${displayPath}\": binary file`, 'FS_NOT_TEXT')\n  }\n  try {\n    return new TextDecoder('utf-8', { fatal: true }).decode(bytes)\n  } catch (error: unknown) {\n    throw new FsError(`cannot read \"${displayPath}\": invalid UTF-8 text`, 'FS_NOT_TEXT', {\n      cause: error,\n    })\n  }\n}\n\nexport function normalizeLineEndings(value: string): string {\n  return value.replaceAll('\\r\\n', '\\n')\n}\n\n// CRLF-majority sniff over a bounded sample, the same heuristic dsh's own\n// backends use to keep a rewritten file in its original line-ending style.\nexport function detectsCrlf(value: string): boolean {\n  const sample = value.slice(0, 4096)\n  const crlf = sample.split('\\r\\n').length - 1\n  const lf = sample.split('\\n').length - 1 - crlf\n  return crlf > lf\n}\n\nexport function restoreLineEndings(value: string, crlf: boolean): string {\n  return crlf ? normalizeLineEndings(value).replaceAll('\\n', '\\r\\n') : value\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n  if (needle.length === 0) return 0\n  let count = 0\n  let index = haystack.indexOf(needle)\n  while (index !== -1) {\n    count++\n    index = haystack.indexOf(needle, index + needle.length)\n  }\n  return count\n}\n\n// Literal replacement with dsh's edit taxonomy: zero matches and an empty\n// oldString are FS_EDIT_NOT_FOUND, several matches without replaceAll is\n// FS_AMBIGUOUS_EDIT.\nexport function applyLiteralEdit(\n  content: string,\n  oldString: string,\n  newString: string,\n  replaceAll: boolean,\n  displayPath: string,\n): string {\n  const matches = countOccurrences(content, oldString)\n  if (matches === 0) {\n    throw new FsError(`cannot edit \"${displayPath}\": oldString not found`, 'FS_EDIT_NOT_FOUND')\n  }\n  if (matches > 1 && !replaceAll) {\n    throw new FsError(\n      `cannot edit \"${displayPath}\": oldString matches ${String(matches)} locations; pass replaceAll or a longer unique string`,\n      'FS_AMBIGUOUS_EDIT',\n    )\n  }\n  return replaceAll\n    ? content.replaceAll(oldString, newString)\n    : content.replace(oldString, newString)\n}\n\n// Byte-accurate tail cap: keep the LAST maxBytes bytes of the encoded text,\n// re-aligned to a UTF-8 sequence boundary so the kept tail still decodes.\nexport function tailCap(text: string, maxBytes: number): { text: string; truncated: boolean } {\n  const bytes = new TextEncoder().encode(text)\n  if (bytes.byteLength <= maxBytes) return { text, truncated: false }\n  let start = bytes.byteLength - maxBytes\n  while (start < bytes.byteLength && ((bytes[start] ?? 0) & 0xc0) === 0x80) start++\n  return {\n    text: new TextDecoder('utf-8', { fatal: false }).decode(bytes.subarray(start)),\n    truncated: true,\n  }\n}\n"],"mappings":";AAcA,SAAS,eAAe;AAExB,IAAM,sBAAsB;AAMrB,SAAS,iBAAiB,OAAmB,aAA6B;AAC/E,MAAI,MAAM,SAAS,GAAG,mBAAmB,EAAE,SAAS,CAAC,GAAG;AACtD,UAAM,IAAI,QAAQ,gBAAgB,WAAW,kBAAkB,aAAa;AAAA,EAC9E;AACA,MAAI;AACF,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,SAAS,OAAgB;AACvB,UAAM,IAAI,QAAQ,gBAAgB,WAAW,yBAAyB,eAAe;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,MAAM,WAAW,QAAQ,IAAI;AACtC;AAIO,SAAS,YAAY,OAAwB;AAClD,QAAM,SAAS,MAAM,MAAM,GAAG,IAAI;AAClC,QAAM,OAAO,OAAO,MAAM,MAAM,EAAE,SAAS;AAC3C,QAAM,KAAK,OAAO,MAAM,IAAI,EAAE,SAAS,IAAI;AAC3C,SAAO,OAAO;AAChB;AAEO,SAAS,mBAAmB,OAAe,MAAuB;AACvE,SAAO,OAAO,qBAAqB,KAAK,EAAE,WAAW,MAAM,MAAM,IAAI;AACvE;AAEA,SAAS,iBAAiB,UAAkB,QAAwB;AAClE,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,QAAQ;AACZ,MAAI,QAAQ,SAAS,QAAQ,MAAM;AACnC,SAAO,UAAU,IAAI;AACnB;AACA,YAAQ,SAAS,QAAQ,QAAQ,QAAQ,OAAO,MAAM;AAAA,EACxD;AACA,SAAO;AACT;AAKO,SAAS,iBACd,SACA,WACA,WACA,YACA,aACQ;AACR,QAAM,UAAU,iBAAiB,SAAS,SAAS;AACnD,MAAI,YAAY,GAAG;AACjB,UAAM,IAAI,QAAQ,gBAAgB,WAAW,0BAA0B,mBAAmB;AAAA,EAC5F;AACA,MAAI,UAAU,KAAK,CAAC,YAAY;AAC9B,UAAM,IAAI;AAAA,MACR,gBAAgB,WAAW,wBAAwB,OAAO,OAAO,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,SAAO,aACH,QAAQ,WAAW,WAAW,SAAS,IACvC,QAAQ,QAAQ,WAAW,SAAS;AAC1C;AAIO,SAAS,QAAQ,MAAc,UAAwD;AAC5F,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAC3C,MAAI,MAAM,cAAc,SAAU,QAAO,EAAE,MAAM,WAAW,MAAM;AAClE,MAAI,QAAQ,MAAM,aAAa;AAC/B,SAAO,QAAQ,MAAM,gBAAgB,MAAM,KAAK,KAAK,KAAK,SAAU,IAAM;AAC1E,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,OAAO,MAAM,SAAS,KAAK,CAAC;AAAA,IAC7E,WAAW;AAAA,EACb;AACF;","names":[]}
+{"version":3,"sources":["../src/text.ts"],"sourcesContent":["// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n//     http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n\nimport { FsError } from '@deepseek-ai/dsh-fs'\n\nconst BINARY_SAMPLE_BYTES = 8192\n\n// dsh text semantics: a NUL in the leading sample or invalid UTF-8 is a\n// binary file, refused as FS_NOT_TEXT rather than decoded lossily (the\n// mirage facade's readFileText decodes with fatal: false, which the dsh\n// seam contract forbids).\nexport function decodeStrictText(bytes: Uint8Array, displayPath: string): string {\n  if (bytes.subarray(0, BINARY_SAMPLE_BYTES).includes(0)) {\n    throw new FsError(`cannot read \"${displayPath}\": binary file`, 'FS_NOT_TEXT')\n  }\n  try {\n    return new TextDecoder('utf-8', { fatal: true }).decode(bytes)\n  } catch (error: unknown) {\n    throw new FsError(`cannot read \"${displayPath}\": invalid UTF-8 text`, 'FS_NOT_TEXT', {\n      cause: error,\n    })\n  }\n}\n\nexport function normalizeLineEndings(value: string): string {\n  return value.replaceAll('\\r\\n', '\\n')\n}\n\n// CRLF-majority sniff over a bounded sample, the same heuristic dsh's own\n// backends use to keep a rewritten file in its original line-ending style.\nexport function detectsCrlf(value: string): boolean {\n  const sample = value.slice(0, 4096)\n  const crlf = sample.split('\\r\\n').length - 1\n  const lf = sample.split('\\n').length - 1 - crlf\n  return crlf > lf\n}\n\nexport function restoreLineEndings(value: string, crlf: boolean): string {\n  return crlf ? normalizeLineEndings(value).replaceAll('\\n', '\\r\\n') : value\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n  if (needle.length === 0) return 0\n  let count = 0\n  let index = haystack.indexOf(needle)\n  while (index !== -1) {\n    count++\n    index = haystack.indexOf(needle, index + needle.length)\n  }\n  return count\n}\n\n// Literal replacement with dsh's edit taxonomy: zero matches and an empty\n// oldString are FS_EDIT_NOT_FOUND, several matches without replaceAll is\n// FS_AMBIGUOUS_EDIT.\nexport function applyLiteralEdit(\n  content: string,\n  oldString: string,\n  newString: string,\n  replaceAll: boolean,\n  displayPath: string,\n): string {\n  const matches = countOccurrences(content, oldString)\n  if (matches === 0) {\n    throw new FsError(`cannot edit \"${displayPath}\": oldString not found`, 'FS_EDIT_NOT_FOUND')\n  }\n  if (matches > 1 && !replaceAll) {\n    throw new FsError(\n      `cannot edit \"${displayPath}\": oldString matches ${String(matches)} locations; pass replaceAll or a longer unique string`,\n      'FS_AMBIGUOUS_EDIT',\n    )\n  }\n  return replaceAll\n    ? content.replaceAll(oldString, newString)\n    : content.replace(oldString, newString)\n}\n\n// The first index at or after `from` that starts a UTF-8 sequence, so a tail\n// taken from there decodes as characters rather than as replacement marks.\nfunction charBoundary(bytes: Uint8Array, from: number): number {\n  let start = from\n  while (start < bytes.byteLength && ((bytes[start] ?? 0) & 0xc0) === 0x80) start++\n  return start\n}\n\n// Byte-accurate tail cap: keep the LAST maxBytes bytes of the encoded text,\n// re-aligned to a UTF-8 sequence boundary so the kept tail still decodes.\nexport function tailCap(text: string, maxBytes: number): { text: string; truncated: boolean } {\n  const bytes = new TextEncoder().encode(text)\n  if (bytes.byteLength <= maxBytes) return { text, truncated: false }\n  const start = charBoundary(bytes, bytes.byteLength - maxBytes)\n  return {\n    text: new TextDecoder('utf-8', { fatal: false }).decode(bytes.subarray(start)),\n    truncated: true,\n  }\n}\n\n/**\n * A bounded backlog of output bytes: the newest `budget` bytes, with the\n * oldest dropped as they overflow.\n *\n * Held as bytes rather than as a string because the string form had to\n * re-encode everything already buffered on every append to measure it,\n * which is quadratic in a command's output and lands on the same event\n * loop that serves the workspace. Appending here costs the chunk, not\n * the backlog.\n */\nexport class TailBuffer {\n  private readonly budget: number\n  private parts: Uint8Array[] = []\n  private bytes = 0\n\n  constructor(budget: number) {\n    this.budget = budget\n  }\n\n  /**\n   * Append a chunk, dropping the oldest bytes that no longer fit.\n   *\n   * @param data the bytes to append.\n   * @returns true when bytes were dropped to make room.\n   */\n  append(data: Uint8Array): boolean {\n    this.parts.push(data)\n    this.bytes += data.byteLength\n    if (this.bytes <= this.budget) return false\n    let excess = this.bytes - this.budget\n    while (excess > 0) {\n      const head = this.parts[0]\n      if (head === undefined) break\n      if (head.byteLength <= excess) {\n        this.parts.shift()\n        excess -= head.byteLength\n        this.bytes -= head.byteLength\n      } else {\n        this.parts[0] = head.subarray(excess)\n        this.bytes -= excess\n        excess = 0\n      }\n    }\n    return true\n  }\n\n  /**\n   * Drain everything held, decoded as text.\n   *\n   * The head may sit mid-character, since dropping is byte-exact, so it\n   * is re-aligned before decoding rather than rendered as a replacement\n   * mark.\n   *\n   * @returns the buffered text; the buffer is left empty.\n   */\n  take(): string {\n    if (this.parts.length === 0) return ''\n    const joined = new Uint8Array(this.bytes)\n    let at = 0\n    for (const part of this.parts) {\n      joined.set(part, at)\n      at += part.byteLength\n    }\n    this.parts = []\n    this.bytes = 0\n    return new TextDecoder('utf-8', { fatal: false }).decode(\n      joined.subarray(charBoundary(joined, 0)),\n    )\n  }\n}\n"],"mappings":";AAcA,SAAS,eAAe;AAExB,IAAM,sBAAsB;AAMrB,SAAS,iBAAiB,OAAmB,aAA6B;AAC/E,MAAI,MAAM,SAAS,GAAG,mBAAmB,EAAE,SAAS,CAAC,GAAG;AACtD,UAAM,IAAI,QAAQ,gBAAgB,WAAW,kBAAkB,aAAa;AAAA,EAC9E;AACA,MAAI;AACF,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,SAAS,OAAgB;AACvB,UAAM,IAAI,QAAQ,gBAAgB,WAAW,yBAAyB,eAAe;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,MAAM,WAAW,QAAQ,IAAI;AACtC;AAIO,SAAS,YAAY,OAAwB;AAClD,QAAM,SAAS,MAAM,MAAM,GAAG,IAAI;AAClC,QAAM,OAAO,OAAO,MAAM,MAAM,EAAE,SAAS;AAC3C,QAAM,KAAK,OAAO,MAAM,IAAI,EAAE,SAAS,IAAI;AAC3C,SAAO,OAAO;AAChB;AAEO,SAAS,mBAAmB,OAAe,MAAuB;AACvE,SAAO,OAAO,qBAAqB,KAAK,EAAE,WAAW,MAAM,MAAM,IAAI;AACvE;AAEA,SAAS,iBAAiB,UAAkB,QAAwB;AAClE,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI,QAAQ;AACZ,MAAI,QAAQ,SAAS,QAAQ,MAAM;AACnC,SAAO,UAAU,IAAI;AACnB;AACA,YAAQ,SAAS,QAAQ,QAAQ,QAAQ,OAAO,MAAM;AAAA,EACxD;AACA,SAAO;AACT;AAKO,SAAS,iBACd,SACA,WACA,WACA,YACA,aACQ;AACR,QAAM,UAAU,iBAAiB,SAAS,SAAS;AACnD,MAAI,YAAY,GAAG;AACjB,UAAM,IAAI,QAAQ,gBAAgB,WAAW,0BAA0B,mBAAmB;AAAA,EAC5F;AACA,MAAI,UAAU,KAAK,CAAC,YAAY;AAC9B,UAAM,IAAI;AAAA,MACR,gBAAgB,WAAW,wBAAwB,OAAO,OAAO,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,SAAO,aACH,QAAQ,WAAW,WAAW,SAAS,IACvC,QAAQ,QAAQ,WAAW,SAAS;AAC1C;AAIA,SAAS,aAAa,OAAmB,MAAsB;AAC7D,MAAI,QAAQ;AACZ,SAAO,QAAQ,MAAM,gBAAgB,MAAM,KAAK,KAAK,KAAK,SAAU,IAAM;AAC1E,SAAO;AACT;AAIO,SAAS,QAAQ,MAAc,UAAwD;AAC5F,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI;AAC3C,MAAI,MAAM,cAAc,SAAU,QAAO,EAAE,MAAM,WAAW,MAAM;AAClE,QAAM,QAAQ,aAAa,OAAO,MAAM,aAAa,QAAQ;AAC7D,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,OAAO,MAAM,SAAS,KAAK,CAAC;AAAA,IAC7E,WAAW;AAAA,EACb;AACF;AAYO,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACT,QAAsB,CAAC;AAAA,EACvB,QAAQ;AAAA,EAEhB,YAAY,QAAgB;AAC1B,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,MAA2B;AAChC,SAAK,MAAM,KAAK,IAAI;AACpB,SAAK,SAAS,KAAK;AACnB,QAAI,KAAK,SAAS,KAAK,OAAQ,QAAO;AACtC,QAAI,SAAS,KAAK,QAAQ,KAAK;AAC/B,WAAO,SAAS,GAAG;AACjB,YAAM,OAAO,KAAK,MAAM,CAAC;AACzB,UAAI,SAAS,OAAW;AACxB,UAAI,KAAK,cAAc,QAAQ;AAC7B,aAAK,MAAM,MAAM;AACjB,kBAAU,KAAK;AACf,aAAK,SAAS,KAAK;AAAA,MACrB,OAAO;AACL,aAAK,MAAM,CAAC,IAAI,KAAK,SAAS,MAAM;AACpC,aAAK,SAAS;AACd,iBAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAe;AACb,QAAI,KAAK,MAAM,WAAW,EAAG,QAAO;AACpC,UAAM,SAAS,IAAI,WAAW,KAAK,KAAK;AACxC,QAAI,KAAK;AACT,eAAW,QAAQ,KAAK,OAAO;AAC7B,aAAO,IAAI,MAAM,EAAE;AACnB,YAAM,KAAK;AAAA,IACb;AACA,SAAK,QAAQ,CAAC;AACd,SAAK,QAAQ;AACb,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE;AAAA,MAChD,OAAO,SAAS,aAAa,QAAQ,CAAC,CAAC;AAAA,IACzC;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-4CZV24HW.js

@@ -0,0 +1,196 @@
+// src/approval.ts
+import { Outcome, Scope } from "@struktoai/mirage-core/policy/types";
+import { shellQuote } from "@struktoai/mirage-core/utils/quote";
+var APPROVAL_TOOL_NAME = "bash";
+function approverOf(ctx) {
+  const held = ctx.get("approval");
+  if (held === null || typeof held !== "object") return null;
+  const { request } = held;
+  return typeof request === "function" ? held : null;
+}
+function approvalReason(record) {
+  const line = [record.command, ...record.argv].map(shellQuote).join(" ");
+  return `${record.reason}: ${line}`;
+}
+function askThroughApproval(ctx) {
+  return async (record, signal) => {
+    const approver = approverOf(ctx);
+    if (approver === null) return null;
+    const outcome = await approver.request({
+      agent: void 0,
+      toolName: APPROVAL_TOOL_NAME,
+      callId: record.id,
+      reason: approvalReason(record),
+      ...signal !== void 0 ? { signal } : {}
+    });
+    const verb = outcome === "allowed-once" ? Outcome.ALLOW : Outcome.DENY;
+    return { ...record, outcome: verb, scope: Scope.ONCE };
+  };
+}
+
+// src/service.ts
+import { Service } from "@deepseek-ai/cordis";
+import { buildRuntime } from "@struktoai/mirage-core/runtime/table";
+import { parseMountMode } from "@struktoai/mirage-core/types";
+import { Workspace, buildResource, parseSessionProfile } from "@struktoai/mirage-node";
+function isMountBlock(entry) {
+  if (Array.isArray(entry)) return false;
+  return typeof entry.resource === "string";
+}
+async function resolveMount(entry) {
+  const resource = await buildResource(entry.resource, entry.config ?? {});
+  if (entry.mode === void 0) return resource;
+  return [resource, parseMountMode(entry.mode)];
+}
+function parseProfiles(raw) {
+  const out = {};
+  for (const [name, block] of Object.entries(raw)) {
+    out[name] = parseSessionProfile(block, `profile \`${name}\``);
+  }
+  return out;
+}
+function toRuntimeEntry(entry) {
+  if (typeof entry === "string") return entry;
+  return buildRuntime(entry.name, entry.captures === void 0 ? {} : { captures: entry.captures });
+}
+function builtEntry(entry) {
+  return typeof entry === "string" ? buildRuntime(entry) : entry;
+}
+var MirageService = class extends Service {
+  static provide = "mirage";
+  /** Resolves to the shared workspace once every mount is built. */
+  ready;
+  built = null;
+  plannedRuntimes;
+  constructor(ctx, config = {}) {
+    super(ctx, "mirage");
+    if (config.workspace !== void 0 && config.mounts !== void 0) {
+      throw new Error("mirage: pass either workspace or mounts, not both");
+    }
+    if (config.workspace !== void 0) {
+      if (config.runtimes !== void 0 || config.workspaceOptions !== void 0 || config.profiles !== void 0 || config.profile !== void 0) {
+        throw new Error(
+          "mirage: runtimes, profiles, profile and workspaceOptions configure a service-owned workspace, not an adopted workspace"
+        );
+      }
+      this.built = config.workspace;
+      this.ready = Promise.resolve(config.workspace);
+      return;
+    }
+    if (config.mounts === void 0) {
+      throw new Error("mirage: one of workspace or mounts is required");
+    }
+    const options = { ...config.workspaceOptions ?? {} };
+    if (config.runtimes !== void 0) {
+      if (options.runtimes !== void 0) {
+        throw new Error("mirage: pass runtimes or workspaceOptions.runtimes, not both");
+      }
+      options.runtimes = config.runtimes.map(toRuntimeEntry);
+    }
+    if (config.profiles !== void 0) {
+      if (options.profiles !== void 0) {
+        throw new Error("mirage: pass profiles or workspaceOptions.profiles, not both");
+      }
+      options.profiles = parseProfiles(config.profiles);
+    }
+    if (config.profile !== void 0) {
+      if (options.profile !== void 0) {
+        throw new Error("mirage: pass profile or workspaceOptions.profile, not both");
+      }
+      options.profile = config.profile;
+    }
+    options.onAsk ??= askThroughApproval(ctx);
+    this.plannedRuntimes = options.runtimes?.map(builtEntry);
+    if (this.plannedRuntimes !== void 0) options.runtimes = [...this.plannedRuntimes];
+    const blocks = Object.values(config.mounts).some(isMountBlock);
+    if (blocks) {
+      this.ready = this.open(config.mounts, options);
+      void this.ready.catch(() => void 0);
+    } else {
+      const owned = new Workspace(config.mounts, options);
+      this.built = owned;
+      this.ready = Promise.resolve(owned);
+    }
+    ctx.effect(
+      () => async () => {
+        const ws = await this.ready.catch(() => null);
+        if (ws !== null) await ws.close();
+      },
+      "mirage workspace"
+    );
+  }
+  /** The live workspace; throws until `ready` resolves. */
+  get workspace() {
+    if (this.built === null) {
+      throw new Error("mirage: workspace is not ready yet; await ctx.mirage.ready");
+    }
+    return this.built;
+  }
+  /**
+   * The decision ledger: every ask this world has raised and every
+   * answer given, questions still waiting included.
+   *
+   * The host's handle on the ask layer. A composition with an approval
+   * channel answers inline and rarely reads this; one without it finds
+   * its pending questions here (`pending()`) and answers them out of
+   * band (`answer(id, outcome, scope)`), which is what makes an `ask`
+   * rule usable with no human at the keyboard.
+   */
+  get decisions() {
+    return this.workspace.decisions;
+  }
+  /**
+   * What a line would do here, without doing it: one `Explanation` per
+   * command, carrying the outcome, the rule that spoke and the exact
+   * exit code and stderr the agent would get.
+   *
+   * A dry run through the same gate the dispatcher uses, so a host
+   * reading this and an agent typing the line cannot be told different
+   * things. It spends no ONCE answer, records no question and never
+   * reaches the approval channel, which is what makes it safe to call
+   * about a line nobody typed — a pre-execute check, or an operator
+   * asking why a command was refused.
+   *
+   * @param line the command line to judge.
+   * @param sessionId the session to judge it in; the default when empty.
+   * @returns one explanation per command of the line.
+   */
+  async explain(line, sessionId = "") {
+    const ws = await this.ready;
+    return ws.explain(line, sessionId);
+  }
+  /**
+   * True while every runtime in the world reaches only the vfs
+   * (`Runtime.reach`), meaning the workspace dispatch is the single
+   * gate for anything the agent can execute: every effect passes
+   * mount modes, session grants, and policy before touching the real
+   * backend behind a mount. The default world qualifies, and so do
+   * the bridged engines, while the host `local` python or a remote
+   * sandbox can act around the gate. Answers before `ready` from the
+   * constructor-resolved entries (mounts resolve asynchronously,
+   * runtimes never do) and from the live workspace afterwards, so a
+   * later `addRuntime` is seen.
+   */
+  get vfsOnly() {
+    const entries = this.built === null ? this.plannedRuntimes ?? [] : this.built.runtimeEntries;
+    return entries.every((entry) => entry.reach === "vfs");
+  }
+  async open(mounts, options) {
+    const resolved = {};
+    for (const [prefix, entry] of Object.entries(mounts)) {
+      resolved[prefix] = isMountBlock(entry) ? await resolveMount(entry) : entry;
+    }
+    const ws = new Workspace(resolved, options);
+    this.built = ws;
+    return ws;
+  }
+};
+
+export {
+  APPROVAL_TOOL_NAME,
+  approverOf,
+  approvalReason,
+  askThroughApproval,
+  MirageService
+};
+//# sourceMappingURL=chunk-4CZV24HW.js.map

package/dist/chunk-4CZV24HW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/approval.ts","../src/service.ts"],"sourcesContent":["// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n//     http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n\nimport type { Context } from '@deepseek-ai/cordis'\nimport type { AskHandler } from '@struktoai/mirage-core/policy/decisions'\nimport type { Decision } from '@struktoai/mirage-core/policy/types'\nimport { Outcome, Scope } from '@struktoai/mirage-core/policy/types'\nimport { shellQuote } from '@struktoai/mirage-core/utils/quote'\n\n/**\n * The tool an approval request is attributed to. A mirage ask is raised\n * by the command plane, which is what dsh's bash tool called, so the\n * audit trail names that tool rather than the head word of the line\n * (which the request's own reason already carries).\n */\nexport const APPROVAL_TOOL_NAME = 'bash'\n\n/**\n * The outcomes dsh's approval channel answers with.\n *\n * Declared here rather than imported: the type lives in\n * `@deepseek-ai/dsh-sandbox`, which this package does not depend on, and\n * dsh itself treats the channel structurally for the same reason (its\n * `EscalationApprover` is \"a minimal STRUCTURAL function shape, not the\n * approval service type\"). Staying structural is what lets any approver\n * be wired, dsh's own included.\n */\nexport type ApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable'\n\n/**\n * The one question this bridge asks of dsh: `ctx.approval` narrowed to\n * the call it makes. An `ApprovalService` satisfies it structurally,\n * without this package importing the approval or agent packages.\n */\nexport interface Approver {\n  request(req: {\n    agent: object | undefined\n    toolName: string\n    callId: string\n    reason: string\n    signal?: AbortSignal\n  }): Promise<ApprovalOutcome>\n}\n\n/**\n * dsh's approval channel, or null when the composition has none.\n *\n * Read through `ctx.get`, not as `ctx.approval`. A plain property read\n * of a service this plugin does not `inject` does not answer undefined,\n * it throws (`cannot get property \"approval\" without inject`), so\n * probing that way would turn every ask in a composition without an\n * approver into a thrown error instead of a pending one. `ctx.get` is\n * cordis's documented read \"without the inject requirement\", and its\n * default strictness answers only a provider whose fiber is live, so an\n * unloaded approval plugin reads as absent rather than as a stale\n * channel nobody is listening on.\n *\n * Declaring `inject` instead would be wrong in the other direction: it\n * would make an approval channel a load requirement, and a headless\n * composition that legitimately has none would fail to compose at all.\n *\n * Read at ask time rather than captured when the plugin loads, because\n * cordis composes plugins in whatever order the profile lists them and a\n * snapshot taken at load would miss an approver registered after this.\n *\n * @param ctx the cordis context to read.\n * @returns the approver, or null when nothing provides one.\n */\nexport function approverOf(ctx: Context): Approver | null {\n  const held: unknown = ctx.get('approval')\n  if (held === null || typeof held !== 'object') return null\n  const { request } = held as { request?: unknown }\n  return typeof request === 'function' ? (held as Approver) : null\n}\n\n/**\n * What the human is shown: the rule's reason, and the line it is about.\n *\n * The reason alone is the operator's sentence (\"deletes are reviewed\")\n * and names nothing being deleted, so the line is quoted beside it. The\n * words come off the record rather than being re-rendered, so what was\n * approved is what was asked.\n *\n * Each word is rendered as a shell would read it back, because this\n * string is the whole of what the human authorizes and the words are\n * already-expanded values, not source. Joined raw, `rm -- 'quarterly\n * report'` reads as two operands and a newline inside a name forges a\n * line break in the prompt, so the human would be nodding at something\n * other than the run. `shellQuote` is GNU's diagnostic rendering: an\n * ordinary name stays bare, and only a word a shell would read as\n * something else is dressed.\n *\n * @param record the ledger record being asked about.\n * @returns the prompt text.\n */\nexport function approvalReason(record: Decision): string {\n  const line = [record.command, ...record.argv].map(shellQuote).join(' ')\n  return `${record.reason}: ${line}`\n}\n\n/**\n * Bridge mirage's ask to dsh's approval channel: the handler that fills\n * `WorkspaceOptions.onAsk`.\n *\n * Mirage owns every outcome (`policy/decisions.ts`); this only decides\n * which of its branches an approval answer lands on. Every answer from a\n * live channel is one of mirage's two settled verbs, because\n * `request` blocks until the channel answers and so never reports \"no\n * answer yet\":\n *\n *   * `allowed-once` is dsh's only yes and grants exactly the line that\n *     asked, so it maps to ALLOW at ONCE and never SESSION. Widening one\n *     nod into a standing grant is the one thing the human did not\n *     consent to; a host that wants SESSION answers writes them to the\n *     ledger itself (`ws.decisions.answer`), the surface built for it.\n *   * `rejected` is an explicit refusal.\n *   * `cancelled` is a refusal too: the human was shown the prompt and\n *     dismissed it, which is an answer rather than the absence of one.\n *     Leaving it pending would re-prompt them, since a retry reuses the\n *     waiting record and would call `request` again.\n *   * `unavailable` is a permission check that could not run, so it\n *     fails closed. Pending here would be fail-open-into-retry.\n *\n * The three refusals match what dsh does with the same vocabulary for\n * its own escalations, where `approveEscalation` throws on a rejection,\n * a cancellation and an unanswerable ask alike.\n *\n * The run's own signal rides along, so a prompt raised for a line whose\n * run is then killed or times out is dismissed with it rather than left\n * on somebody's screen for a command that no longer exists. The ledger\n * stops waiting either way — it bounds the wait by the same signal — but\n * only the channel can take its prompt down.\n *\n * With no approver on the context the handler answers null, which is\n * mirage's \"nobody has answered yet\": the ask stays pending in the\n * ledger. That is deliberate, and it is why the service installs this\n * unconditionally rather than only under a composed approver — the two\n * are the same answer to mirage (`onAsk` unset and a null return both\n * render pending), and installing always is what lets an approver\n * composed after this plugin still be found.\n *\n * Refusing instead would rewrite an operator's `ask` rule as a `deny`,\n * and the embedder may well be answering `ws.decisions.pending()` out\n * of band.\n *\n * @param ctx the cordis context carrying `ctx.approval`.\n * @returns the handler to pass as `onAsk`.\n */\nexport function askThroughApproval(ctx: Context): AskHandler {\n  return async (record: Decision, signal?: AbortSignal): Promise<Decision | null> => {\n    const approver = approverOf(ctx)\n    if (approver === null) return null\n    const outcome = await approver.request({\n      agent: undefined,\n      toolName: APPROVAL_TOOL_NAME,\n      callId: record.id,\n      reason: approvalReason(record),\n      ...(signal !== undefined ? { signal } : {}),\n    })\n    const verb = outcome === 'allowed-once' ? Outcome.ALLOW : Outcome.DENY\n    return { ...record, outcome: verb, scope: Scope.ONCE }\n  }\n}\n","// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n// Licensed under the Apache License, Version 2.0 (the \"License\");\n// you may not use this file except in compliance with the License.\n// You may obtain a copy of the License at\n//\n//     http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========\n\nimport { Service } from '@deepseek-ai/cordis'\nimport type { Context } from '@deepseek-ai/cordis'\nimport type { Explanation } from '@struktoai/mirage-core/policy/types'\nimport type { Runtime, RuntimeEntry } from '@struktoai/mirage-core/runtime/base'\nimport { buildRuntime } from '@struktoai/mirage-core/runtime/table'\nimport { parseMountMode } from '@struktoai/mirage-core/types'\nimport type { MountSpec } from '@struktoai/mirage-core/workspace/workspace/workspace'\nimport { Workspace, buildResource, parseSessionProfile } from '@struktoai/mirage-node'\nimport type { Mount, NodeWorkspaceOptions, SessionProfile } from '@struktoai/mirage-node'\nimport { askThroughApproval } from './approval.ts'\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    mirage: MirageService\n  }\n}\n\n/**\n * A declarative mount, YAML-friendly: the resource is named by its\n * registry type and built through `buildResource`, so a dsh bundle\n * patch can mount anything without holding a live instance. Told apart\n * from a live `Mount` by the type of `resource`: a string names a\n * registry entry, an object is the instance itself.\n */\nexport interface MirageMountBlock {\n  /** Resource registry name (`ram`, `s3`, `slack`, `redis`, ...). */\n  resource: string\n  /** Mount mode: `read`, `write`, or `exec`. Omitted = the workspace default. */\n  mode?: string\n  /** Resource constructor config, passed to the registry factory. */\n  config?: Record<string, unknown>\n}\n\n/** One mount entry: a live spec or instance, or a declarative block. */\nexport type MirageMount = MountSpec | Mount | MirageMountBlock\n\n/** A runtime entry, YAML-friendly: a name, or a name with captures. */\nexport interface MirageRuntimeBlock {\n  /** Runtime registry name (`monty`, `pyodide`, `quickjs`, ...). */\n  name: string\n  /** Command words this runtime captures (e.g. `['python', 'python3']`). */\n  captures?: string[]\n}\n\n/**\n * Configuration for the shared mirage execution world. Exactly one of\n * `workspace` (adopt a live workspace the embedder owns and closes) or\n * `mounts` (construct a workspace here; the service closes it when its\n * plugin unloads) must be given.\n */\nexport interface MirageConfig {\n  /** A live workspace to adopt; its lifecycle stays with the embedder. */\n  workspace?: Workspace\n  /** Mounts for a service-owned workspace, keyed by mount prefix. */\n  mounts?: Record<string, MirageMount>\n  /**\n   * Runtimes for a service-owned workspace, built via `buildRuntime`.\n   * The YAML-friendly twin of `workspaceOptions.runtimes`; pass one or\n   * the other, not both.\n   */\n  runtimes?: (string | MirageRuntimeBlock)[]\n  /**\n   * The roles (`profiles:` in mirage config), each a whole permission\n   * document: its `commands.allow` list, its `commands.ask` and\n   * `commands.deny` rules, the mount sections carrying rules of their\n   * own, and the paths and vars it hides. The YAML-friendly twin of\n   * `workspaceOptions.profiles`; pass one or the other, not both.\n   *\n   * Written as the document, not as an already-parsed profile: every\n   * entry goes through `parseSessionProfile`, so a misspelled field is a\n   * load error rather than a first-session one. That parse is what lets\n   * a dsh bundle patch carry a policy at all, since\n   * `workspaceOptions.profiles` wants profiles already parsed and a\n   * patch file holds plain YAML.\n   */\n  profiles?: Record<string, unknown>\n  /**\n   * Which role shapes a session created without one, the workspace's own\n   * session included. A name `profiles` does not define is an error. The\n   * YAML-friendly twin of `workspaceOptions.profile`.\n   */\n  profile?: string\n  /** Options forwarded to the service-owned workspace's constructor. */\n  workspaceOptions?: NodeWorkspaceOptions\n}\n\nfunction isMountBlock(entry: MirageMount): entry is MirageMountBlock {\n  if (Array.isArray(entry)) return false\n  return typeof (entry as MirageMountBlock).resource === 'string'\n}\n\nasync function resolveMount(entry: MirageMountBlock): Promise<MountSpec> {\n  const resource = await buildResource(entry.resource, entry.config ?? {})\n  if (entry.mode === undefined) return resource\n  return [resource, parseMountMode(entry.mode)]\n}\n\n/**\n * Validate a `profiles` block: every role through the core document\n * validator, naming the role in the error so a typo in a patch file\n * points at the block that holds it.\n *\n * @param raw the roles as written, keyed by role name.\n * @returns the parsed roles, ready for `WorkspaceOptions.profiles`.\n */\nfunction parseProfiles(raw: Record<string, unknown>): Record<string, SessionProfile> {\n  const out: Record<string, SessionProfile> = {}\n  for (const [name, block] of Object.entries(raw)) {\n    out[name] = parseSessionProfile(block, `profile \\`${name}\\``)\n  }\n  return out\n}\n\nfunction toRuntimeEntry(entry: string | MirageRuntimeBlock): RuntimeEntry {\n  if (typeof entry === 'string') return entry\n  return buildRuntime(entry.name, entry.captures === undefined ? {} : { captures: entry.captures })\n}\n\n// A name shorthand builds exactly as the workspace would build it; holding\n// the instance early is what lets `vfsOnly` classify the world before the\n// (asynchronous) mounts finish resolving.\nfunction builtEntry(entry: RuntimeEntry): Runtime {\n  return typeof entry === 'string' ? buildRuntime(entry) : entry\n}\n\n/**\n * The one mirage `Workspace` behind every mirage-backed dsh provider\n * (`ctx.mirage`, mirroring how `ctx.e2b` owns one sandbox for the E2B\n * adapters). `MirageFileSystem` and `MirageShellExecutor` both inject it,\n * which is what keeps `ctx.fs` targets and `ctx.shell` commands in one\n * execution world: a `processPath` handed to the shell resolves there.\n *\n * Construction with live resources is synchronous; a declarative mount\n * block defers to `buildResource`, so consumers await `ready` (the\n * adapters do) and `workspace` throws until it resolves, mirroring how\n * the E2B service owner exposes its sandbox.\n */\nexport class MirageService extends Service {\n  static readonly provide = 'mirage'\n\n  /** Resolves to the shared workspace once every mount is built. */\n  readonly ready: Promise<Workspace>\n\n  private built: Workspace | null = null\n  private readonly plannedRuntimes: readonly Runtime[] | undefined\n\n  constructor(ctx: Context, config: MirageConfig = {}) {\n    super(ctx, 'mirage')\n    if (config.workspace !== undefined && config.mounts !== undefined) {\n      throw new Error('mirage: pass either workspace or mounts, not both')\n    }\n    if (config.workspace !== undefined) {\n      // An adopted workspace is already built, so runtimes and constructor\n      // options can no longer reach it. Saying so beats accepting a config\n      // whose runtimes silently never load, which is what the workspace and\n      // mounts pair above already refuses to do.\n      // `profiles` and `profile` join them for the same reason, and one\n      // more: an adopted workspace's roles and its `onAsk` are the\n      // embedder's own, so silently re-answering its asks through\n      // `ctx.approval` would take over a seam it may already have filled.\n      if (\n        config.runtimes !== undefined ||\n        config.workspaceOptions !== undefined ||\n        config.profiles !== undefined ||\n        config.profile !== undefined\n      ) {\n        throw new Error(\n          'mirage: runtimes, profiles, profile and workspaceOptions configure a service-owned workspace, not an adopted workspace',\n        )\n      }\n      this.built = config.workspace\n      this.ready = Promise.resolve(config.workspace)\n      return\n    }\n    if (config.mounts === undefined) {\n      throw new Error('mirage: one of workspace or mounts is required')\n    }\n    const options = { ...(config.workspaceOptions ?? {}) }\n    if (config.runtimes !== undefined) {\n      if (options.runtimes !== undefined) {\n        throw new Error('mirage: pass runtimes or workspaceOptions.runtimes, not both')\n      }\n      options.runtimes = config.runtimes.map(toRuntimeEntry)\n    }\n    if (config.profiles !== undefined) {\n      if (options.profiles !== undefined) {\n        throw new Error('mirage: pass profiles or workspaceOptions.profiles, not both')\n      }\n      options.profiles = parseProfiles(config.profiles)\n    }\n    if (config.profile !== undefined) {\n      if (options.profile !== undefined) {\n        throw new Error('mirage: pass profile or workspaceOptions.profile, not both')\n      }\n      options.profile = config.profile\n    }\n    // How an asked line gets answered. Installed for every service-owned\n    // workspace rather than only under a composed `ctx.approval`, because\n    // the two are one answer to mirage (an unset `onAsk` and a handler\n    // returning null both leave the ask pending) and installing always is\n    // what finds an approver composed after this plugin. An explicit\n    // `workspaceOptions.onAsk` is the embedder's decision and stands.\n    options.onAsk ??= askThroughApproval(ctx)\n    this.plannedRuntimes = options.runtimes?.map(builtEntry)\n    if (this.plannedRuntimes !== undefined) options.runtimes = [...this.plannedRuntimes]\n    const blocks = Object.values(config.mounts).some(isMountBlock)\n    if (blocks) {\n      this.ready = this.open(config.mounts, options)\n      // A declarative mount resolves asynchronously and nothing awaits\n      // `ready` until a provider's first call, so a failure here would\n      // reach the process as an unhandled rejection and take the whole\n      // harness down over a typo in a patch file. This only marks the\n      // rejection observed; `ready` still rejects for every real caller,\n      // and the disposer below still sees it.\n      void this.ready.catch(() => undefined)\n    } else {\n      const owned = new Workspace(config.mounts as Record<string, MountSpec | Mount>, options)\n      this.built = owned\n      this.ready = Promise.resolve(owned)\n    }\n    ctx.effect(\n      () => async () => {\n        const ws = await this.ready.catch(() => null)\n        if (ws !== null) await ws.close()\n      },\n      'mirage workspace',\n    )\n  }\n\n  /** The live workspace; throws until `ready` resolves. */\n  get workspace(): Workspace {\n    if (this.built === null) {\n      throw new Error('mirage: workspace is not ready yet; await ctx.mirage.ready')\n    }\n    return this.built\n  }\n\n  /**\n   * The decision ledger: every ask this world has raised and every\n   * answer given, questions still waiting included.\n   *\n   * The host's handle on the ask layer. A composition with an approval\n   * channel answers inline and rarely reads this; one without it finds\n   * its pending questions here (`pending()`) and answers them out of\n   * band (`answer(id, outcome, scope)`), which is what makes an `ask`\n   * rule usable with no human at the keyboard.\n   */\n  get decisions(): Workspace['decisions'] {\n    return this.workspace.decisions\n  }\n\n  /**\n   * What a line would do here, without doing it: one `Explanation` per\n   * command, carrying the outcome, the rule that spoke and the exact\n   * exit code and stderr the agent would get.\n   *\n   * A dry run through the same gate the dispatcher uses, so a host\n   * reading this and an agent typing the line cannot be told different\n   * things. It spends no ONCE answer, records no question and never\n   * reaches the approval channel, which is what makes it safe to call\n   * about a line nobody typed — a pre-execute check, or an operator\n   * asking why a command was refused.\n   *\n   * @param line the command line to judge.\n   * @param sessionId the session to judge it in; the default when empty.\n   * @returns one explanation per command of the line.\n   */\n  async explain(line: string, sessionId = ''): Promise<Explanation[]> {\n    const ws = await this.ready\n    return ws.explain(line, sessionId)\n  }\n\n  /**\n   * True while every runtime in the world reaches only the vfs\n   * (`Runtime.reach`), meaning the workspace dispatch is the single\n   * gate for anything the agent can execute: every effect passes\n   * mount modes, session grants, and policy before touching the real\n   * backend behind a mount. The default world qualifies, and so do\n   * the bridged engines, while the host `local` python or a remote\n   * sandbox can act around the gate. Answers before `ready` from the\n   * constructor-resolved entries (mounts resolve asynchronously,\n   * runtimes never do) and from the live workspace afterwards, so a\n   * later `addRuntime` is seen.\n   */\n  get vfsOnly(): boolean {\n    const entries = this.built === null ? (this.plannedRuntimes ?? []) : this.built.runtimeEntries\n    return entries.every((entry) => entry.reach === 'vfs')\n  }\n\n  private async open(\n    mounts: Record<string, MirageMount>,\n    options: NodeWorkspaceOptions,\n  ): Promise<Workspace> {\n    const resolved: Record<string, MountSpec | Mount> = {}\n    for (const [prefix, entry] of Object.entries(mounts)) {\n      resolved[prefix] = isMountBlock(entry) ? await resolveMount(entry) : entry\n    }\n    const ws = new Workspace(resolved, options)\n    this.built = ws\n    return ws\n  }\n}\n"],"mappings":";AAiBA,SAAS,SAAS,aAAa;AAC/B,SAAS,kBAAkB;AAQpB,IAAM,qBAAqB;AAqD3B,SAAS,WAAW,KAA+B;AACxD,QAAM,OAAgB,IAAI,IAAI,UAAU;AACxC,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,QAAM,EAAE,QAAQ,IAAI;AACpB,SAAO,OAAO,YAAY,aAAc,OAAoB;AAC9D;AAsBO,SAAS,eAAe,QAA0B;AACvD,QAAM,OAAO,CAAC,OAAO,SAAS,GAAG,OAAO,IAAI,EAAE,IAAI,UAAU,EAAE,KAAK,GAAG;AACtE,SAAO,GAAG,OAAO,MAAM,KAAK,IAAI;AAClC;AAkDO,SAAS,mBAAmB,KAA0B;AAC3D,SAAO,OAAO,QAAkB,WAAmD;AACjF,UAAM,WAAW,WAAW,GAAG;AAC/B,QAAI,aAAa,KAAM,QAAO;AAC9B,UAAM,UAAU,MAAM,SAAS,QAAQ;AAAA,MACrC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ,OAAO;AAAA,MACf,QAAQ,eAAe,MAAM;AAAA,MAC7B,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3C,CAAC;AACD,UAAM,OAAO,YAAY,iBAAiB,QAAQ,QAAQ,QAAQ;AAClE,WAAO,EAAE,GAAG,QAAQ,SAAS,MAAM,OAAO,MAAM,KAAK;AAAA,EACvD;AACF;;;AC/JA,SAAS,eAAe;AAIxB,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,WAAW,eAAe,2BAA2B;AA+E9D,SAAS,aAAa,OAA+C;AACnE,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AACjC,SAAO,OAAQ,MAA2B,aAAa;AACzD;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,WAAW,MAAM,cAAc,MAAM,UAAU,MAAM,UAAU,CAAC,CAAC;AACvE,MAAI,MAAM,SAAS,OAAW,QAAO;AACrC,SAAO,CAAC,UAAU,eAAe,MAAM,IAAI,CAAC;AAC9C;AAUA,SAAS,cAAc,KAA8D;AACnF,QAAM,MAAsC,CAAC;AAC7C,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,QAAI,IAAI,IAAI,oBAAoB,OAAO,aAAa,IAAI,IAAI;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAkD;AACxE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,aAAa,MAAM,MAAM,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS,CAAC;AAClG;AAKA,SAAS,WAAW,OAA8B;AAChD,SAAO,OAAO,UAAU,WAAW,aAAa,KAAK,IAAI;AAC3D;AAcO,IAAM,gBAAN,cAA4B,QAAQ;AAAA,EACzC,OAAgB,UAAU;AAAA;AAAA,EAGjB;AAAA,EAED,QAA0B;AAAA,EACjB;AAAA,EAEjB,YAAY,KAAc,SAAuB,CAAC,GAAG;AACnD,UAAM,KAAK,QAAQ;AACnB,QAAI,OAAO,cAAc,UAAa,OAAO,WAAW,QAAW;AACjE,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,QAAI,OAAO,cAAc,QAAW;AASlC,UACE,OAAO,aAAa,UACpB,OAAO,qBAAqB,UAC5B,OAAO,aAAa,UACpB,OAAO,YAAY,QACnB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,WAAK,QAAQ,OAAO;AACpB,WAAK,QAAQ,QAAQ,QAAQ,OAAO,SAAS;AAC7C;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAW;AAC/B,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,UAAM,UAAU,EAAE,GAAI,OAAO,oBAAoB,CAAC,EAAG;AACrD,QAAI,OAAO,aAAa,QAAW;AACjC,UAAI,QAAQ,aAAa,QAAW;AAClC,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,cAAQ,WAAW,OAAO,SAAS,IAAI,cAAc;AAAA,IACvD;AACA,QAAI,OAAO,aAAa,QAAW;AACjC,UAAI,QAAQ,aAAa,QAAW;AAClC,cAAM,IAAI,MAAM,8DAA8D;AAAA,MAChF;AACA,cAAQ,WAAW,cAAc,OAAO,QAAQ;AAAA,IAClD;AACA,QAAI,OAAO,YAAY,QAAW;AAChC,UAAI,QAAQ,YAAY,QAAW;AACjC,cAAM,IAAI,MAAM,4DAA4D;AAAA,MAC9E;AACA,cAAQ,UAAU,OAAO;AAAA,IAC3B;AAOA,YAAQ,UAAU,mBAAmB,GAAG;AACxC,SAAK,kBAAkB,QAAQ,UAAU,IAAI,UAAU;AACvD,QAAI,KAAK,oBAAoB,OAAW,SAAQ,WAAW,CAAC,GAAG,KAAK,eAAe;AACnF,UAAM,SAAS,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,YAAY;AAC7D,QAAI,QAAQ;AACV,WAAK,QAAQ,KAAK,KAAK,OAAO,QAAQ,OAAO;AAO7C,WAAK,KAAK,MAAM,MAAM,MAAM,MAAS;AAAA,IACvC,OAAO;AACL,YAAM,QAAQ,IAAI,UAAU,OAAO,QAA6C,OAAO;AACvF,WAAK,QAAQ;AACb,WAAK,QAAQ,QAAQ,QAAQ,KAAK;AAAA,IACpC;AACA,QAAI;AAAA,MACF,MAAM,YAAY;AAChB,cAAM,KAAK,MAAM,KAAK,MAAM,MAAM,MAAM,IAAI;AAC5C,YAAI,OAAO,KAAM,OAAM,GAAG,MAAM;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,YAAuB;AACzB,QAAI,KAAK,UAAU,MAAM;AACvB,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,YAAoC;AACtC,WAAO,KAAK,UAAU;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QAAQ,MAAc,YAAY,IAA4B;AAClE,UAAM,KAAK,MAAM,KAAK;AACtB,WAAO,GAAG,QAAQ,MAAM,SAAS;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,IAAI,UAAmB;AACrB,UAAM,UAAU,KAAK,UAAU,OAAQ,KAAK,mBAAmB,CAAC,IAAK,KAAK,MAAM;AAChF,WAAO,QAAQ,MAAM,CAAC,UAAU,MAAM,UAAU,KAAK;AAAA,EACvD;AAAA,EAEA,MAAc,KACZ,QACA,SACoB;AACpB,UAAM,WAA8C,CAAC;AACrD,eAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,eAAS,MAAM,IAAI,aAAa,KAAK,IAAI,MAAM,aAAa,KAAK,IAAI;AAAA,IACvE;AACA,UAAM,KAAK,IAAI,UAAU,UAAU,OAAO;AAC1C,SAAK,QAAQ;AACb,WAAO;AAAA,EACT;AACF;","names":[]}