@struktoai/mirage-dsh 0.0.1 → 0.0.6

package/dist/shell-B0N_jppN.d.ts

@@ -1,108 +0,0 @@
-import { Context } from '@deepseek-ai/cordis';
-import { ShellExecutor, ShellExecRequest, ShellExecSpec, ShellRunResult, ShellProcess } from '@deepseek-ai/dsh-shell';
-
-/** Configuration for the mirage shell executor. */
-interface MirageShellConfig {
-    /**
-     * Default working directory for commands. Defaults to `/`. With
-     * `sessionId` it instead seeds the bound session's initial cwd, and the
-     * session's own cwd is the default from then on.
-     */
-    workdir?: string;
-    /** Default foreground timeout in milliseconds. Defaults to 120000. */
-    defaultTimeoutMs?: number;
-    /** Upper cap on any requested timeout. Defaults to 600000. */
-    maxTimeoutMs?: number;
-    /** Default stdout capture budget in bytes. Defaults to 200000. */
-    stdoutMaxBytes?: number;
-    /** stderr capture budget in bytes. Defaults to 64000. */
-    stderrMaxBytes?: number;
-    /**
-     * Bind every command to this named workspace session. By default each
-     * command runs in an ephemeral fork of the workspace's default session,
-     * so nothing persists between calls, which is the one-shot contract of
-     * dsh's bash tool. With a session bound, `cd`, `export`, and function
-     * definitions persist across calls, the persistent-shell contract. The
-     * session is created on first use if the workspace does not have it; an
-     * existing session is adopted as is. A spec carrying an explicit
-     * `workdir` or `env` still runs as a one-call subshell of the bound
-     * session, per mirage's `ExecuteOptions` semantics.
-     */
-    sessionId?: string;
-    /**
-     * When set, a background command whose streamed output overruns its
-     * delta budget spills its full stdout and stderr to files under this
-     * workspace directory, and `readOutput()` points at them so a reader
-     * can recover what the delta dropped. The directory is a workspace
-     * path (e.g. `/tmp` on a ram mount), so the agent reads the spill
-     * through the same VFS as everything else; the writes go through the
-     * workspace, so they appear in history like any other write. Unset
-     * (the default) means no spill: output that overruns is simply
-     * flagged `lossy`, the honest "no safe path available" answer.
-     */
-    spillDir?: string;
-}
-/**
- * Mirage-backed implementation of `ctx.shell`: `run` executes the command
- * line with mirage's own shell (coreutils-faithful commands, installed
- * CLIs, the policy layer) against the shared `ctx.mirage` workspace, so a
- * path from `ctx.fs` means the same file here. There is no OS process
- * behind a command: `signal` in results is a compatibility value for kills,
- * and abort/timeout act cooperatively at the executor's own boundaries.
- *
- * Every command runs in an ephemeral fork of the workspace's default
- * session, so no shell state survives from one call to the next, matching
- * the one-shot contract of dsh's bash tool. Configuring a `sessionId`
- * binds all commands to one named session instead, whose cwd, exports,
- * and functions persist across calls.
- */
-declare class MirageShellExecutor extends ShellExecutor {
-    static readonly inject: string[];
-    private readonly workdir;
-    private readonly defaultTimeoutMs;
-    private readonly maxTimeoutMs;
-    private readonly stdoutMaxBytes;
-    private readonly stderrMaxBytes;
-    private readonly sessionId;
-    private readonly spillDir;
-    private sessionReady;
-    constructor(ctx: Context, config?: MirageShellConfig);
-    private workspace;
-    private newSpill;
-    /**
-     * With every runtime in the world reaching only the vfs
-     * (`ctx.mirage.vfsOnly`), the workspace dispatch is the single gate
-     * for anything a command can do, so this executor behaves like a
-     * workspace-write sandbox: reads and writes land only where mounts
-     * (and their modes) allow. Declaring it lets sandbox-aware plugins
-     * (dsh's permission presets) compose over this executor. A world
-     * holding a runtime with doors around the gate (the host `local`
-     * python, a remote sandbox) voids that claim, so this answers
-     * undefined then (the base contract's "does not sandbox") and those
-     * plugins refuse to compose instead of trusting a lie.
-     */
-    get sandboxMode(): ShellExecutor['sandboxMode'];
-    /**
-     * The sandbox facts to stamp on this run's result and process handle,
-     * or undefined when the world is not fully workspace-bound (no claim).
-     *
-     * `enforcement` is 'full': when every runtime reaches only the vfs, the
-     * workspace gate cannot be bypassed, so unlike an OS sandbox on an older
-     * kernel there is no promised effect it fails to govern. `denied` is
-     * false because mirage has no out-of-band denial channel: a refused write
-     * (a read-only mount) fails in-band as an ordinary command error with a
-     * nonzero exit, the way EROFS would, not as a separate sandbox verdict,
-     * so there is nothing here to distinguish from the command's own failure.
-     * `runnerFailed` is false because the workspace executor is the runner
-     * and a failure to run surfaces as a rejected/aborted execution, not a
-     * runner that never started.
-     */
-    private sandboxInfo;
-    resolve(request: ShellExecRequest): ShellExecSpec;
-    private ensureSession;
-    private provisionSession;
-    run(spec: ShellExecSpec): Promise<ShellRunResult>;
-    start(spec: ShellExecSpec): ShellProcess;
-}
-
-export { type MirageShellConfig as M, MirageShellExecutor as a };