@tiphareth/dsh-hardssh 0.1.2-alpha → 0.2.2

package/src/switch/switch-fs.ts

@@ -59,6 +59,63 @@ export interface SwitchFsDeps {
   /** The world owning one namespaced target key (never undefined: every
    *  key this facade issued maps back). */
   worldForNamespace(namespace: string): WorkspaceWorld | undefined
+  /** Client-side roots that must stay LOCAL even in a bound workspace (dsh's
+   *  own `~/.dsh` with skills & harness state, plugin configs, …). Default
+   *  routing in a remote world is REMOTE for everything else. */
+  localRoots?: ReadonlyArray<string>
+  /** Windows inside `localRoots` that must NEVER be treated as local
+   *  infrastructure — the managed workspace ANCHOR ROOT. Anchors physically
+   *  live under `~/.dsh`, so without this carve-out a path inside the anchors
+   *  window (including a stale anchor dir with no ledger record) would fall
+   *  into the local exception and a remote session would silently write to
+   *  the client machine. Semantics: local exception = localRoots MINUS
+   *  exclusions. */
+  localRootExclusions?: ReadonlyArray<string>
+  /** Roots whose contents are NEVER accessible through this seam — the
+   *  encrypted credential store. Enforced on every dispatch path (see
+   *  `assertNotDenied`), so a bound session's agent cannot read the vault
+   *  ciphertext through the routed filesystem and attack it offline. It does
+   *  NOT constrain a command that runs natively on this machine as the same
+   *  user (e.g. the client-side `pwsh` tool). */
+  deniedRoots?: ReadonlyArray<string>
+  /** The world owning an ABSOLUTE workspace anchor path (the caller's own
+   *  workspace or a SIBLING workspace's anchor), or undefined when no
+   *  workspace claims that path. Consulted BEFORE the `localRoots`
+   *  carve-out: managed SSH workspace anchors live under `~/.dsh` (a
+   *  declared local root), so routing a sibling anchor to local would
+   *  silently run a remote-workspace file operation on this machine. */
+  worldForAnchorPath?(path: string): WorkspaceWorld | undefined
+}
+
+function normalizeForEquality(path: string): string {
+  return path.replace(/\\/g, '/').replace(/\/+$/, '')
+}
+
+/** Whether `path` is `root` itself or under it. Case-folding is applied ONLY
+ *  when the root is a Windows-style path (drive letter) — no OS guessing. */
+function isUnder(root: string | undefined, path: string): boolean {
+  if (root === undefined || root === '') return false
+  const r = normalizeForEquality(root)
+  const p = normalizeForEquality(path)
+  const fold = /^[a-zA-Z]:\//.test(r)
+  const nr = fold ? r.toLowerCase() : r
+  const np = fold ? p.toLowerCase() : p
+  return np === nr || np.startsWith(nr + '/')
+}
+
+/** Membership test for a REMOTE world. Default: EVERYTHING routes remote —
+ *   a bound session's work lives on the server (including absolute paths
+ *   outside the workspace tree, e.g. another project dir on that host).
+ *   The ONLY exclusion is the DECLARED client infrastructure (`localRoots`:
+ *   dsh's own `~/.dsh` with skills + harness state, plugin configs, …),
+ *   which stays local on any client OS. `localRootExclusions` subtract the
+ *   workspace-anchor window from that exception, because anchors physically
+ *   live under `~/.dsh` and must never be treated as local. No host-OS
+ *   syntax guessing. */
+function belongsToRemoteWorld(path: string, deps: Pick<SwitchFsDeps, 'localRoots' | 'localRootExclusions'>): boolean {
+  if (deps.localRootExclusions?.some((root) => isUnder(root, path)) === true) return true
+  if (deps.localRoots !== undefined && deps.localRoots.some((root) => isUnder(root, path))) return false
+  return true
 }
 
 /** The routing filesystem facade. */
@@ -70,8 +127,14 @@ export class SwitchFileSystem extends FileSystem {
     this.local = deps.local
   }
 
-  /** Sandbox default from the local backend (remote worlds are unconfined —
-   *  the docs/doc of the tool layer reads this once at mount). */
+  /** The deployment's local backend is still a sandboxed filesystem, and
+   *  `dsh-tool-fs` reads this capability fact ONCE at apply() to decide whether
+   *  to advertise `sandbox_permissions` / `justification` at all. Returning
+   *  undefined here disabled that escalation entry for EVERY session,
+   *  including purely local ones, so the local backend's mode is the honest
+   *  answer. Remote worlds are not confined by the local sandbox, so a wider
+   *  per-call policy is meaningless for them and is dropped at the call site
+   *  instead of being silently swallowed by a 4-parameter remote backend. */
   override get sandboxMode(): SandboxMode | undefined {
     return this.local.sandboxMode
   }
@@ -110,11 +173,58 @@ export class SwitchFileSystem extends FileSystem {
       // undefined decode as "cannot route this target".
       return undefined
     }
+    // A plain key addresses the LOCAL world, and this is the funnel every
+    // target-based operation decodes through (stat/readText/streamText/
+    // readBytes/listDir/writeText/editText) — not just resolve/lstat. The deny
+    // check therefore lives here as well, so a protected client directory stays
+    // unreachable no matter how the target was obtained. The local backend keys
+    // targets by CANONICAL path, so a symlink into the protected directory is
+    // refused too.
+    this.assertNotDenied(key, '')
     return { rawKey: key, world: { backend: this.local, namespace: '' } }
   }
 
+  /**
+   * Refuse a protected client directory before any backend sees it.
+   *
+   * Only a LOCAL world is checked: for a remote world the path is a path on the
+   * SERVER, which may legitimately look like a client path (both can be
+   * `/home/me/.dsh/…`).
+   *
+   * @param path - the path (or canonical target key) about to be dispatched.
+   * @param namespace - the resolved world's namespace ('' = local).
+   */
+  private assertNotDenied(path: string, namespace: string): void {
+    if (namespace !== '') return
+    const denied = this.deps.deniedRoots?.find(root => isUnder(root, path))
+    if (denied !== undefined) {
+      throw new Error(`fs-hardssh: '${path}' is not accessible through the workspace filesystem (protected client directory)`)
+    }
+  }
+
+  /**
+   * The world owning one call: an explicit anchor path (this workspace's or a
+   * SIBLING's) wins over the session cwd, because anchors are physically under
+   * the local-infrastructure root and would otherwise be carved out as local.
+   * Falls back to the session cwd's world, then to the caller's default.
+   */
+  private worldForPath(path: string, cwd: string | undefined): WorkspaceWorld {
+    const anchorWorld = this.deps.worldForAnchorPath?.(path)
+    if (anchorWorld !== undefined) {
+      this.assertNotDenied(path, anchorWorld.namespace)
+      return anchorWorld
+    }
+    const pathWorld = this.deps.worldFor(path)
+    if (pathWorld.namespace !== '' && pathWorld.anchorPath !== undefined && pathWorld.remoteRoot !== undefined) {
+      return pathWorld
+    }
+    const chosen = this.deps.worldFor(cwd)
+    this.assertNotDenied(path, chosen.namespace)
+    return chosen
+  }
+
   override async resolve(path: string, opts?: { cwd?: string; signal?: AbortSignal }): Promise<FsTarget> {
-    const world = this.deps.worldFor(opts?.cwd)
+    const world = this.worldForPath(path, opts?.cwd)
     // Translate a model-supplied LOCAL ANCHOR path into the remote root when
     // the call routes to an SSH workspace: the model sees the anchor as "the
     // current directory" (the session cwd) and may pass it verbatim. Rewrite
@@ -124,6 +234,16 @@ export class SwitchFileSystem extends FileSystem {
     const effectivePath = world.anchorPath !== undefined && world.remoteRoot !== undefined
       ? this.translateAnchorPath(world.anchorPath, world.remoteRoot, path)
       : path
+    // Host-infrastructure roots are considered only after anchor translation;
+    // otherwise a valid remote anchor nested under ~/.dsh routes locally.
+    if (world.namespace !== '' && !belongsToRemoteWorld(effectivePath, this.deps)) {
+      // This is the point where the routing decision is finally LOCAL, so a
+      // protected client directory is refused here rather than handed to the
+      // local backend.
+      this.assertNotDenied(path, '')
+      const raw = await this.local.resolve(path, opts)
+      return { targetKey: String(raw.targetKey) as FsTarget['targetKey'], displayPath: raw.displayPath }
+    }
     const raw = await world.backend.resolve(effectivePath, opts)
     return {
       targetKey: this.encode(String(raw.targetKey), world.namespace) as FsTarget['targetKey'],
@@ -157,14 +277,14 @@ export class SwitchFileSystem extends FileSystem {
   }
 
   override processPath(target: FsTarget): string {
-    const key = String(target.targetKey)
-    const decoded = this.decode(key)
-    return decoded?.world.backend.processPath({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath }) ?? key
+    const decoded = this.decode(String(target.targetKey))
+    if (decoded === undefined) throw new Error('fs-ssh: cannot route stale workspace target')
+    return decoded.world.backend.processPath({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath })
   }
 
   override fileUrl(target: FsTarget): string {
     const decoded = this.decode(String(target.targetKey))
-    if (decoded === undefined) return this.local.fileUrl(target)
+    if (decoded === undefined) throw new Error('fs-ssh: cannot route stale workspace target')
     return decoded.world.backend.fileUrl({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath })
   }
 
@@ -185,10 +305,14 @@ export class SwitchFileSystem extends FileSystem {
   }
 
   override async lstat(path: string, opts?: { cwd?: string }, signal?: AbortSignal): Promise<FsPathInfo | undefined> {
-    const world = this.deps.worldFor(opts?.cwd)
+    const world = this.worldForPath(path, opts?.cwd)
     const effectivePath = world.anchorPath !== undefined && world.remoteRoot !== undefined
       ? this.translateAnchorPath(world.anchorPath, world.remoteRoot, path)
       : path
+    if (world.namespace !== '' && !belongsToRemoteWorld(effectivePath, this.deps)) {
+      this.assertNotDenied(path, '')
+      return this.local.lstat(path, opts, signal)
+    }
     return world.backend.lstat(effectivePath, opts, signal)
   }
 
@@ -234,7 +358,12 @@ export class SwitchFileSystem extends FileSystem {
   ): Promise<FsWriteOutcome> {
     const decoded = this.decode(String(target.targetKey))
     if (decoded === undefined) throw new Error('fs-ssh: cannot route target')
-    return decoded.world.backend.writeText({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath }, content, expected, signal, sandboxPolicy)
+    // A per-call escalation policy is a LOCAL sandbox concept: the remote
+    // backend takes no policy parameter (its writes are bounded by the
+    // workspace root, not by the client sandbox). Drop it explicitly for
+    // remote worlds so the intent is documented rather than silently ignored.
+    const policy = decoded.world.namespace === '' ? sandboxPolicy : undefined
+    return decoded.world.backend.writeText({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath }, content, expected, signal, policy)
   }
 
   override async editText(
@@ -246,7 +375,9 @@ export class SwitchFileSystem extends FileSystem {
   ): Promise<FsEditOutcome> {
     const decoded = this.decode(String(target.targetKey))
     if (decoded === undefined) throw new Error('fs-ssh: cannot route target')
-    return decoded.world.backend.editText({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath }, edit, expected, signal, sandboxPolicy)
+    // Same local-only semantics as writeText above.
+    const policy = decoded.world.namespace === '' ? sandboxPolicy : undefined
+    return decoded.world.backend.editText({ targetKey: decoded.rawKey as FsTarget['targetKey'], displayPath: target.displayPath }, edit, expected, signal, policy)
   }
 }
 

package/src/switch/switch-subprocess.ts

@@ -21,8 +21,53 @@ import type { Context } from '@deepseek-ai/cordis'
 /** Route one spawn cwd to a runtime. */
 export interface SwitchSubprocessDeps {
   local: SubprocessRuntime
-  /** The runtime for a spawn cwd (undefined = local). */
-  worldFor(cwd: string | undefined): SubprocessRuntime
+  /**
+   * The runtime for a spawn cwd, or `undefined` for a LOCAL cwd.
+   *
+   * Deliberately `undefined` rather than "return the local runtime": deciding
+   * "is this local?" by IDENTITY-comparing the returned service against
+   * `deps.local` is not reliable, and getting it wrong made the client-search
+   * refusal below fire for LOCAL sessions — which broke glob/grep everywhere
+   * (found by real-machine testing). The routing answer is data, so it travels
+   * as data.
+   */
+  worldFor(cwd: string | undefined): SubprocessRuntime | undefined
+  /** Bare executable names that are CLIENT tools (run locally even in a
+   *  bound workspace) — e.g. 'pwsh', 'powershell', 'cmd'. Windows-format
+   *  executables (drive/backslash paths, `*.exe/*.cmd/*.bat/*.ps1`) are
+   *  detected automatically as client binaries. */
+  clientToolNames?: ReadonlyArray<string>
+}
+
+const DEFAULT_CLIENT_TOOL_NAMES = ['pwsh', 'powershell', 'cmd'] as const
+
+const CLIENT_EXECUTABLE_RE = /\.(exe|cmd|bat|ps1|com)$/i
+
+/**
+ * Client-packaged helpers that search the WORKSPACE's files (the bundled
+ * ripgrep behind the glob/grep tools). They are client binaries, but they are
+ * not shells: running one locally while the session's world is remote searches
+ * the local anchor directory (an empty placeholder) and reports "no matches",
+ * and sending the client's absolute PATH to the server cannot work either.
+ * Either way the answer is wrong, so a path-shaped invocation is refused
+ * loudly. A BARE `rg` is left alone: that is an ordinary server command and
+ * belongs to the remote world like any other.
+ */
+const CLIENT_WORKSPACE_SEARCH_RE = /^(rg|ripgrep)(\.exe)?$/i
+
+/** True for a PATH-shaped (not bare-name) invocation of a search helper. */
+function isClientSearchHelperPath(exe: string): boolean {
+  if (!exe.includes('/') && !exe.includes('\\')) return false
+  const base = exe.split(/[\\/]/).pop() ?? exe
+  return CLIENT_WORKSPACE_SEARCH_RE.test(base)
+}
+
+/** A client-native executable: Windows-format path/extension, or a bare name
+ *  on the declared client-tool list (remote POSIX hosts never carry these). */
+function isClientNativeExecutable(exe: string, names: ReadonlyArray<string>): boolean {
+  if (exe === '') return false
+  if (/^[a-zA-Z]:[\\/]/.test(exe) || exe.includes('\\') || CLIENT_EXECUTABLE_RE.test(exe)) return true
+  return names.includes(exe)
 }
 
 /** Workspace-routing subprocess facade. */
@@ -31,11 +76,40 @@ export class SwitchSubprocessRuntime extends SubprocessRuntime {
     super(ctx)
   }
 
-  /** The runtime for one spec (by its cwd). */
-  private runtimeFor(cwd: string | undefined): SubprocessRuntime {
+  /** The runtime for one spec (by its cwd); undefined means LOCAL. */
+  private runtimeFor(cwd: string | undefined): SubprocessRuntime | undefined {
     return this.deps.worldFor(cwd)
   }
 
+  /** Client binaries run on THIS machine even from a bound workspace — their
+   *  executables cannot exist on the remote POSIX host, and the spawn cwd is
+   *  the local anchor (which exists locally), so local execution is sound.
+   *  Everything else runs in the session's world (remote on a bound host).
+   *
+   *  ONE exception is refused rather than routed: a client-side SEARCH helper
+   *  (rg) in a remote-bound session would search the empty local anchor and
+   *  report "no matches" — a confidently wrong answer about the server's
+   *  contents. There is no way to make a local index-of-files tool read the
+   *  remote workspace, so the caller is told to use the remote tools.
+   *
+   *  Locality comes from the routing answer (`undefined`), never from an
+   *  identity comparison against `deps.local`: that comparison silently failed
+   *  once and refused local ripgrep launches for every session. */
+  private effectiveRuntime(spec: { cwd?: string; argv?: readonly string[] }): SubprocessRuntime {
+    const runtime = this.runtimeFor(spec.cwd)
+    if (runtime === undefined) return this.deps.local
+    const names = this.deps.clientToolNames ?? DEFAULT_CLIENT_TOOL_NAMES
+    const exe = spec.argv !== undefined && spec.argv.length > 0 ? spec.argv[0] : ''
+    if (isClientSearchHelperPath(exe)) {
+      throw new Error(
+        `dsh-hardssh: '${exe.split(/[\\/]/).pop()}' is a client-side search tool and cannot read the remote workspace bound to this session `
+        + '(its working directory is the local anchor placeholder, not the server). '
+        + 'Search remote content with the remote_search tool (mode="glob" for file names, mode="grep" for content) or ssh_exec instead.',
+      )
+    }
+    return isClientNativeExecutable(exe, names) ? this.deps.local : runtime
+  }
+
   /** @inheritdoc */
   resolveExecutable(command: string, env?: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<string> {
     // Executable resolution is not cwd-scoped; route by the caller's cwd is
@@ -47,12 +121,12 @@ export class SwitchSubprocessRuntime extends SubprocessRuntime {
 
   /** @inheritdoc */
   spawn(spec: SubprocessSpawnSpec): SubprocessHandle {
-    return this.runtimeFor(spec.cwd).spawn(spec)
+    return this.effectiveRuntime(spec).spawn(spec)
   }
 
   /** @inheritdoc */
   spawnTerminal(spec: SubprocessTerminalSpawnSpec): Promise<SubprocessTerminalHandle> {
-    return this.runtimeFor(spec.cwd).spawnTerminal(spec)
+    return this.effectiveRuntime(spec).spawnTerminal(spec)
   }
 }