dsh-a2a-server 0.2.0 → 0.4.0

package/lib/visitor-worker.py

@@ -0,0 +1,78 @@
+"""Trusted bounded reader. Public data and a visitor's disk are the only roots."""
+import json
+import os
+import pathlib
+import stat
+import sys
+
+def read_request(args):
+    if not isinstance(args, dict) or set(args) - {'root', 'path', 'offset', 'limit'}:
+        raise ValueError('Invalid read request')
+    root_name = args.get('root', 'public')
+    if root_name not in ('public', 'workspace'):
+        raise ValueError('Unknown data root')
+    root = pathlib.Path('/source' if root_name == 'public' else '/work')
+    requested = args.get('path')
+    offset, limit = args.get('offset', 1), args.get('limit', 200)
+    if not isinstance(requested, str) or not 1 <= len(requested) <= 4096 or any(c in requested for c in ('\0', '\\', ':')):
+        raise ValueError('Invalid file path')
+    if type(offset) is not int or not 1 <= offset <= 10000000 or type(limit) is not int or not 1 <= limit <= 500:
+        raise ValueError('Invalid read pagination')
+    target = pathlib.Path(os.path.abspath(root / requested))
+    try:
+        parts = target.relative_to(root).parts
+    except ValueError:
+        raise ValueError('Path is outside the authorized data directory')
+    current = root
+    for component in ('',) + parts:
+        current = current / component
+        if stat.S_ISLNK(current.lstat().st_mode):
+            raise ValueError('Symbolic links are not available')
+    before = target.lstat()
+    if stat.S_ISDIR(before.st_mode):
+        entries, truncated = [], False
+        with os.scandir(target) as iterator:
+            for index, entry in enumerate(iterator):
+                if index >= 1000:
+                    truncated = True
+                    break
+                if entry.is_symlink():
+                    continue
+                if entry.is_file(follow_symlinks=False) or entry.is_dir(follow_symlinks=False):
+                    entries.append(entry.name + ('/' if entry.is_dir(follow_symlinks=False) else ''))
+        entries.sort()
+        text = '\n'.join(entries[offset - 1:offset - 1 + limit])
+        truncated = truncated or len(entries) > offset - 1 + limit
+        kind = 'directory'
+    else:
+        if not stat.S_ISREG(before.st_mode) or before.st_nlink != 1:
+            raise ValueError('Only regular files without hard links can be read')
+        if before.st_size > 2 * 1024 * 1024:
+            raise ValueError('File exceeds the 2 MiB read limit')
+        fd = os.open(target, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        with os.fdopen(fd, 'rb') as stream:
+            opened = os.fstat(stream.fileno())
+            if (opened.st_dev, opened.st_ino, opened.st_nlink) != (before.st_dev, before.st_ino, 1):
+                raise ValueError('File changed during open')
+            data = stream.read(2 * 1024 * 1024 + 1)
+        if len(data) > 2 * 1024 * 1024:
+            raise ValueError('File exceeds the 2 MiB read limit')
+        text = data.decode('utf-8', errors='strict')
+        if '\0' in text:
+            raise ValueError('Binary files are not supported by read_file')
+        lines = text.replace('\r\n', '\n').split('\n')
+        text = '\n'.join(lines[offset - 1:offset - 1 + limit])
+        truncated = len(lines) > offset - 1 + limit
+        kind = 'file'
+    after = target.lstat()
+    if (before.st_dev, before.st_ino) != (after.st_dev, after.st_ino):
+        raise ValueError('Path changed during read')
+    return {'kind': kind, 'path': str(target.relative_to(root)), 'content': text[:32000], 'truncated': truncated or len(text) > 32000}
+
+try:
+    if len(sys.argv[1].encode('utf-8')) > 8192:
+        raise ValueError('Read request too large')
+    print(json.dumps({'result': read_request(json.loads(sys.argv[1]))}, ensure_ascii=False))
+except Exception as error:
+    print(json.dumps({'error': str(error)}, ensure_ascii=False))
+    sys.exit(1)

package/lib/workspace-read.d.ts

@@ -0,0 +1,9 @@
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
+export declare const WORKSPACE_READ_TOOL = "read_file";
+/**
+ * Pin a canonical root for this activation. Never mount the host's general read
+ * tool: its path policy is different. State directories remain private even
+ * when an operator puts them inside the shared data root.
+ */
+export declare function workspaceReadTool(directory: string, privateDirectories: readonly string[]): Promise<ToolDefinition>;
+//# sourceMappingURL=workspace-read.d.ts.map

package/lib/workspace-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-read.d.ts","sourceRoot":"","sources":["../src/workspace-read.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG5D,eAAO,MAAM,mBAAmB,cAAc,CAAA;AAe9C;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA0GzH"}

package/lib/workspace-read.js

@@ -0,0 +1,152 @@
+/** A single read capability rooted in the owner's configured data directory. */
+import { constants } from 'node:fs';
+import { lstat, open, opendir, realpath } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { z } from 'zod';
+export const WORKSPACE_READ_TOOL = 'read_file';
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_TEXT_CHARS = 32_000;
+const MAX_DIRECTORY_SCAN = 1000;
+const argsSchema = z.object({
+    path: z.string().min(1).max(4096),
+    offset: z.number().int().min(1).max(10_000_000).default(1),
+    limit: z.number().int().min(1).max(500).default(200),
+}).strict();
+function within(root, target) {
+    const suffix = relative(root, target);
+    return suffix === '' || (!isAbsolute(suffix) && suffix !== '..' && !suffix.startsWith(`..${sep}`));
+}
+/**
+ * Pin a canonical root for this activation. Never mount the host's general read
+ * tool: its path policy is different. State directories remain private even
+ * when an operator puts them inside the shared data root.
+ */
+export async function workspaceReadTool(directory, privateDirectories) {
+    const configuredRoot = resolve(directory);
+    const root = await realpath(directory);
+    const privatePaths = await Promise.all(privateDirectories.map(async (path) => {
+        const absolute = resolve(path);
+        return { absolute, canonical: await realpath(absolute).catch(() => absolute) };
+    }));
+    const isPrivate = (path) => privatePaths.some(p => within(p.absolute, path) || within(p.canonical, path));
+    const validatePath = async (input) => {
+        if (input.includes('\0'))
+            throw new Error('Invalid file path');
+        // Reject NT device namespaces and alternate data streams before normalization.
+        if (process.platform === 'win32' && (/^[/\\]{2}[?.][/\\]/.test(input) || input.replace(/^[a-z]:/i, '').includes(':'))) {
+            throw new Error('Device paths and alternate data streams are not available');
+        }
+        const absolute = resolve(root, input);
+        // Windows may return an expanded path for a configured 8.3 directory alias.
+        const candidate = isAbsolute(input) && within(configuredRoot, absolute)
+            ? resolve(root, relative(configuredRoot, absolute)) : absolute;
+        if (!within(root, candidate) || isPrivate(candidate))
+            throw new Error('Path is outside the authorized data directory');
+        const canonical = await realpath(candidate);
+        if (!within(root, canonical) || isPrivate(canonical))
+            throw new Error('Path is outside the authorized data directory');
+        // Refuse links/junctions along the entire relative path, even when a link
+        // currently targets this root. An authorized directory is not a link portal.
+        let current = root;
+        for (const component of ['', ...relative(root, candidate).split(sep).filter(Boolean)]) {
+            if (component)
+                current = join(current, component);
+            if ((await lstat(current)).isSymbolicLink())
+                throw new Error('Symbolic links and junctions are not available');
+        }
+        return candidate;
+    };
+    return {
+        name: WORKSPACE_READ_TOOL,
+        description: 'Read a UTF-8 text file from the owner-authorized data directory. Paths are relative to that directory (not the agent cwd); absolute paths must remain inside it. Use path "." to list its entries, or a subdirectory path to list that directory. offset is a 1-based line/entry offset; limit is at most 500. Other tools and writes are unavailable.',
+        parameters: {
+            type: 'object', additionalProperties: false, required: ['path'], properties: {
+                path: { type: 'string', minLength: 1, maxLength: 4096 },
+                offset: { type: 'integer', minimum: 1, maximum: 10_000_000 },
+                limit: { type: 'integer', minimum: 1, maximum: 500 },
+            },
+        },
+        output: {
+            schema: { type: 'object', required: ['kind', 'path', 'content', 'truncated'], properties: {
+                    kind: { type: 'string' }, path: { type: 'string' }, content: { type: 'string' }, truncated: { type: 'boolean' },
+                } },
+            render: (_args, value) => [{ type: 'text', text: JSON.stringify(value) }],
+        },
+        execute: async (raw, { signal }) => {
+            const args = argsSchema.parse(raw);
+            signal.throwIfAborted();
+            const path = await validatePath(args.path);
+            const before = await lstat(path);
+            if (before.isDirectory()) {
+                const entries = [];
+                let scanned = 0;
+                let truncated = false;
+                // Read at most a bounded prefix; do not build an unbounded directory tree.
+                const dir = await opendir(path);
+                for await (const entry of dir) {
+                    signal.throwIfAborted();
+                    if (++scanned > MAX_DIRECTORY_SCAN) {
+                        truncated = true;
+                        break;
+                    }
+                    if (entry.isSymbolicLink() || isPrivate(join(path, entry.name)))
+                        continue;
+                    if (!entry.isFile() && !entry.isDirectory())
+                        continue;
+                    entries.push(`${entry.name}${entry.isDirectory() ? '/' : ''}`);
+                }
+                const after = await lstat(await validatePath(args.path));
+                if (before.dev !== after.dev || before.ino !== after.ino)
+                    throw new Error('Directory changed during read; retry');
+                entries.sort();
+                const selected = entries.slice(args.offset - 1, args.offset - 1 + args.limit).join('\n');
+                return { kind: 'directory', path: relative(root, path) || '.', content: selected.slice(0, MAX_TEXT_CHARS),
+                    truncated: truncated || entries.length > args.offset - 1 + args.limit || selected.length > MAX_TEXT_CHARS };
+            }
+            if (!before.isFile())
+                throw new Error('Only regular text files and directories can be read');
+            if (before.nlink > 1)
+                throw new Error('Hard-linked files are not available');
+            if (before.size > MAX_FILE_BYTES)
+                throw new Error('File exceeds the 2 MiB read limit');
+            // O_NOFOLLOW is supported on Unix. Windows is covered by the component
+            // checks and comparing the opened file's identity before reading any bytes.
+            const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+            try {
+                const opened = await handle.stat();
+                if (!opened.isFile() || opened.nlink > 1 || opened.dev !== before.dev || opened.ino !== before.ino)
+                    throw new Error('File changed during open; retry');
+                if (opened.size > MAX_FILE_BYTES)
+                    throw new Error('File exceeds the 2 MiB read limit');
+                await validatePath(args.path);
+                // Explicit byte limit also bounds reads if a local writer grows the file.
+                const bytes = Buffer.alloc(MAX_FILE_BYTES + 1);
+                let used = 0;
+                while (used < bytes.length) {
+                    signal.throwIfAborted();
+                    const part = await handle.read(bytes, used, bytes.length - used, used);
+                    if (!part.bytesRead)
+                        break;
+                    used += part.bytesRead;
+                }
+                if (used > MAX_FILE_BYTES)
+                    throw new Error('File exceeds the 2 MiB read limit');
+                const after = await lstat(await validatePath(args.path));
+                if (opened.dev !== after.dev || opened.ino !== after.ino || after.nlink > 1)
+                    throw new Error('File changed during read; retry');
+                signal.throwIfAborted();
+                const content = new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, used));
+                if (content.includes('\0'))
+                    throw new Error('Binary files are not supported by read_file');
+                const lines = content.split(/\r?\n/);
+                const selected = lines.slice(args.offset - 1, args.offset - 1 + args.limit).join('\n');
+                return { kind: 'file', path: relative(root, path), content: selected.slice(0, MAX_TEXT_CHARS),
+                    truncated: lines.length > args.offset - 1 + args.limit || selected.length > MAX_TEXT_CHARS };
+            }
+            finally {
+                await handle.close();
+            }
+        },
+    };
+}
+//# sourceMappingURL=workspace-read.js.map

package/lib/workspace-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-read.js","sourceRoot":"","sources":["../src/workspace-read.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACtC,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CACrD,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,SAAS,MAAM,CAAC,IAAY,EAAE,MAAc;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAA;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,kBAAqC;IAC9F,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;IAChF,CAAC,CAAC,CAAC,CAAA;IACH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IAE1H,MAAM,YAAY,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;QAC5D,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC9D,+EAA+E;QAC/E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACrC,4EAA4E;QAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC;YACrE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACtH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACtH,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,OAAO,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtF,IAAI,SAAS;gBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAChH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,wVAAwV;QACrW,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;gBAC3E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;gBAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;aACrD;SACF;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE;oBACxF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAChH,EAAE;YACH,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1E;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAa,EAAE,CAAA;gBAC5B,IAAI,OAAO,GAAG,CAAC,CAAA;gBACf,IAAI,SAAS,GAAG,KAAK,CAAA;gBACrB,2EAA2E;gBAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBAC9B,MAAM,CAAC,cAAc,EAAE,CAAA;oBACvB,IAAI,EAAE,OAAO,GAAG,kBAAkB,EAAE,CAAC;wBAAC,SAAS,GAAG,IAAI,CAAC;wBAAC,MAAK;oBAAC,CAAC;oBAC/D,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBAAE,SAAQ;oBACzE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;wBAAE,SAAQ;oBACrD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBAChE,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACxD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;gBACjH,OAAO,CAAC,IAAI,EAAE,CAAA;gBACd,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACxF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;oBACvG,SAAS,EAAE,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,cAAc,EAAE,CAAA;YAC/G,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtF,uEAAuE;YACvE,4EAA4E;YAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAA;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAClC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBACtJ,IAAI,MAAM,CAAC,IAAI,GAAG,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACtF,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC7B,0EAA0E;gBAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;gBAC9C,IAAI,IAAI,GAAG,CAAC,CAAA;gBACZ,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC3B,MAAM,CAAC,cAAc,EAAE,CAAA;oBACvB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAA;oBACtE,IAAI,CAAC,IAAI,CAAC,SAAS;wBAAE,MAAK;oBAC1B,IAAI,IAAI,IAAI,CAAC,SAAS,CAAA;gBACxB,CAAC;gBACD,IAAI,IAAI,GAAG,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBAC/E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACxD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBAC/H,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;gBACzF,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;gBACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;oBAC3F,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,cAAc,EAAE,CAAA;YAChG,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QACpC,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-a2a-server",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Inbound A2A (Agent2Agent) protocol server for DeepSeek Harness: publish an Agent Card and let any A2A-compliant peer submit tasks to a harness agent",
   "keywords": [
     "dsh",
@@ -27,57 +27,74 @@
   },
   "files": [
     "lib",
-    "cordis.patch.yml"
+    "docker",
+    "cordis.patch.yml",
+    "README.zh-CN.md",
+    "docs/visitor-isolation.md",
+    "docs/visitor-isolation.en.md",
+    "CHANGELOG.md",
+    "CHANGELOG.zh-CN.md"
   ],
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
     }
   },
+  "engines": {
+    "dsh": ">=0.2.1-rc.2 <0.3.0"
+  },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node scripts/build-worker.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:docker": "pnpm build && node scripts/test-docker.mjs",
+    "test:microsandbox": "pnpm build && node scripts/test-microsandbox.mjs",
+    "test:package": "pnpm build && node scripts/test-package.mjs",
     "serve": "tsx example/serve.ts",
     "probe": "node example/probe.mjs",
-    "prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
+    "prepublishOnly": "pnpm typecheck && pnpm test && pnpm test:package"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6"
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-agent": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-credentials": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-session-projection": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.2.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-tools": ">=0.2.1-rc.2 <0.3.0"
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.5",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/cordis-plugin-loader": "1.0.2",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-agent-loop-testkit": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-brand": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials-local": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-replay": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-scope": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session-projection": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.6",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-replay": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
     "@types/node": "^22.10.0",
+    "esbuild": "0.28.2",
+    "microsandbox": "0.7.11",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8",
-    "zod": "^4.4.3"
+    "vitest": "^2.1.8"
   },
   "repository": {
     "type": "git",