dsh-remote-workspaces 0.1.0

package/src/routing-fs.js

@@ -0,0 +1,230 @@
+/**
+ * Routing filesystem: the plugin's `ctx.fs` provider.
+ *
+ * Routes by the session cwd. Two remote triggers:
+ *   - an `ssh://[user@]host[:port]/path` cwd (URI form), and
+ *   - a LOCAL anchor directory registered in the remote-workspace registry
+ *     (`anchors.json`), whose real content lives on the remote host.
+ * Everything else goes to the local backend (with the workspace-write fence).
+ *
+ * The world identity is ENCODED into the target key (`ssh://host/path` for
+ * remote, bare absolute path for local) and decoded on every later operation.
+ *
+ * Self-contained: it does not extend `@deepseek-ai/dsh-fs`'s `FileSystem`
+ * (whose base class is a Service marker plus a `sandboxMode` getter only), so
+ * the bundle resolves with no harness dependency. Consumers read the service
+ * structurally (`ctx.fs.resolve/readText/…` and `ctx.fs.sandboxMode`), never
+ * via `instanceof`.
+ */
+
+import { isAbsolute, posix } from 'node:path'
+import { LocalBackend } from './local-backend.js'
+import { SftpBackend } from './fs-sftp.js'
+import { isRemoteCwd, parseSshUri } from './ssh-uri.js'
+import { findByCwd } from './registry.js'
+import { fsError } from './errors.js'
+
+export class RoutingFileSystem {
+  constructor({ getPolicy, clientForRemote } = {}) {
+    this.getPolicy = getPolicy
+    this.local = new LocalBackend({ getPolicy })
+    this.clientForRemote = clientForRemote
+    this.remoteBackends = new Map()
+  }
+
+  /**
+   * Report a DEFINED `sandboxMode` so the tool layer treats this provider as
+   * confining: it resolves the per-session policy, stamps every mutation with
+   * it, and advertises escalation. Only definedness is read — the value itself
+   * is a stand-in; the real per-call mode rides `sandboxPolicy`. The local
+   * half fences writes in `LocalBackend.checkedTarget`; the remote half is
+   * fenced here (`read-only` denies, `workspace-write` contains to the remote
+   * workspace root, `danger-full-access` delegates). The SSH account's own
+   * permissions remain the outer boundary.
+   */
+  get sandboxMode() {
+    return 'workspace-write'
+  }
+
+  remoteBackend(host, user, port) {
+    const key = `${user ?? ''}@${host}:${port ?? 22}`
+    if (!this.remoteBackends.has(key)) {
+      this.remoteBackends.set(key, new SftpBackend(this.clientForRemote(host, user, port)))
+    }
+    return this.remoteBackends.get(key)
+  }
+
+  /**
+   * Resolve the remote execution-world cwd for a session cwd: either the
+   * `ssh://` URI form or a registered anchor directory. Returns
+   * `{ host, user, port, remoteCwd }` or null for a local cwd.
+   */
+  remoteCwd(cwd) {
+    if (isRemoteCwd(cwd)) {
+      const parsed = parseSshUri(cwd)
+      if (parsed !== null) return { host: parsed.host, user: parsed.user, port: parsed.port, remoteCwd: parsed.path }
+      return null
+    }
+    const hit = findByCwd(cwd)
+    if (hit === undefined) return null
+    const remoteCwd = hit.remoteSubpath === '' ? hit.remotePath : posix.join(hit.remotePath, hit.remoteSubpath)
+    return { host: hit.host, user: hit.user, port: hit.port, remoteCwd }
+  }
+
+  encodeTarget(host, user, port, subKey) {
+    return `ssh://${user ? `${user}@` : ''}${host}${port ? `:${port}` : ''}${subKey}`
+  }
+
+  /** Decode a target key into { backend, target } using the encoded world prefix. */
+  splitTarget(target) {
+    const key = String(target.targetKey)
+    if (key.startsWith('ssh://')) {
+      const parsed = parseSshUri(key)
+      if (parsed !== null) {
+        return {
+          backend: this.remoteBackend(parsed.host, parsed.user, parsed.port),
+          target: { targetKey: parsed.path, displayPath: target.displayPath ?? parsed.path },
+        }
+      }
+    }
+    return { backend: this.local, target }
+  }
+
+  async resolve(path, opts) {
+    const cwd = opts && opts.cwd
+    const remote = this.remoteCwd(cwd)
+    if (remote !== null) {
+      const backend = this.remoteBackend(remote.host, remote.user, remote.port)
+      const sub = await backend.resolve(path, { cwd: remote.remoteCwd })
+      return {
+        targetKey: this.encodeTarget(remote.host, remote.user, remote.port, sub.targetKey),
+        displayPath: sub.displayPath,
+      }
+    }
+    return this.local.resolve(path, opts)
+  }
+
+  processPath(target) {
+    const { backend, target: sub } = this.splitTarget(target)
+    return backend.processPath(sub)
+  }
+
+  processPathFromHostPath(hostPath) {
+    // Attachments and other host-owned files live in the LOCAL world; the
+    // remote world has no host path. Mirror `fs-local`: absolute identity.
+    return isAbsolute(hostPath) ? hostPath : undefined
+  }
+
+  fileUrl(target) {
+    const key = String(target.targetKey)
+    if (key.startsWith('ssh://')) return key
+    return this.local.fileUrl(target)
+  }
+
+  contains(parent, child) {
+    const p = this.splitTarget(parent)
+    const c = this.splitTarget(child)
+    if (p.backend !== c.backend) return false
+    return p.backend.contains(p.target, c.target)
+  }
+
+  stat(target) {
+    const { backend, target: sub } = this.splitTarget(target)
+    return backend.stat(sub)
+  }
+
+  lstat(path, opts, signal) {
+    const cwd = opts && opts.cwd
+    const remote = this.remoteCwd(cwd)
+    if (remote !== null) {
+      const backend = this.remoteBackend(remote.host, remote.user, remote.port)
+      return backend.lstat(path, { cwd: remote.remoteCwd })
+    }
+    return this.local.lstat(path, opts)
+  }
+
+  readText(target) {
+    const { backend, target: sub } = this.splitTarget(target)
+    return backend.readText(sub)
+  }
+
+  streamText(target) {
+    const { backend, target: sub } = this.splitTarget(target)
+    return backend.streamText(sub)
+  }
+
+  readBytes(target, signal, maxBytes) {
+    const { backend, target: sub } = this.splitTarget(target)
+    return backend.readBytes(sub, signal, maxBytes)
+  }
+
+  async listDir(target) {
+    const key = String(target.targetKey)
+    const isRemote = key.startsWith('ssh://')
+    const { backend, target: sub } = this.splitTarget(target)
+    const entries = await backend.listDir(sub)
+    if (!isRemote) return entries
+    // Re-encode child target keys as `ssh://…` so later ops on them route back
+    // to the SFTP backend (the backend returns bare POSIX keys).
+    const parsed = parseSshUri(key)
+    return entries.map((e) => ({
+      ...e,
+      target: {
+        targetKey: this.encodeTarget(parsed.host, parsed.user, parsed.port, e.target.targetKey),
+        displayPath: e.target.displayPath,
+      },
+    }))
+  }
+
+  /** POSIX containment: `path` is `root` or a descendant of it. */
+  posixUnder(path, root) {
+    const rel = posix.relative(root, path)
+    return rel === '' || (rel !== '..' && !rel.startsWith('../') && !posix.isAbsolute(rel))
+  }
+
+  /**
+   * Enforce the per-call sandbox policy on a REMOTE mutation (the local half
+   * fences itself in `LocalBackend.checkedTarget`). `read-only` denies;
+   * `workspace-write` contains the target under the session's remote workspace
+   * root (the anchor's remote origin, plus the POSIX temp dirs); a
+   * `danger-full-access` policy — or none — delegates unfenced. The target key
+   * is already SFTP-canonicalized by `resolve`, so no re-resolve is needed.
+   */
+  remoteCheckedTarget(sub, sandboxPolicy) {
+    const policy = sandboxPolicy ?? this.getPolicy?.()?.resolve?.()
+    if (policy === undefined) return sub
+    const { mode } = policy
+    if (mode === 'danger-full-access') return sub
+    if (mode === 'read-only') {
+      throw fsError('FS_SANDBOX_DENIED', `cannot write "${sub.displayPath}": file access denied under read-only mode`)
+    }
+    // workspace-write: the policy's workspace root is the LOCAL anchor path;
+    // its remote origin is the containment boundary.
+    const hit = findByCwd(policy.workspaceRoot)
+    const remoteRoot = hit === undefined
+      ? undefined
+      : (hit.remoteSubpath === '' ? hit.remotePath : posix.join(hit.remotePath, hit.remoteSubpath))
+    if (remoteRoot === undefined) {
+      throw fsError('FS_SANDBOX_DENIED', `cannot write "${sub.displayPath}": file access denied under workspace-write mode`)
+    }
+    const writable = [remoteRoot, '/tmp', '/var/tmp']
+    if (!writable.some((root) => this.posixUnder(sub.targetKey, root))) {
+      throw fsError('FS_SANDBOX_DENIED', `cannot write "${sub.displayPath}": file access denied under workspace-write mode`)
+    }
+    return sub
+  }
+
+  writeText(target, content, expected, signal, sandboxPolicy) {
+    const { backend, target: sub } = this.splitTarget(target)
+    if (backend === this.local) return backend.writeText(sub, content, expected, signal, sandboxPolicy)
+    return backend.writeText(this.remoteCheckedTarget(sub, sandboxPolicy), content, expected)
+  }
+
+  editText(target, edit, expected, signal, sandboxPolicy) {
+    const { backend, target: sub } = this.splitTarget(target)
+    if (backend === this.local) return backend.editText(sub, edit, expected, signal, sandboxPolicy)
+    return backend.editText(this.remoteCheckedTarget(sub, sandboxPolicy), edit, expected)
+  }
+}
+
+export default RoutingFileSystem

package/src/search.js

@@ -0,0 +1,286 @@
+/**
+ * Remote-aware `grep` / `glob` tools (replace the harness's ripgrep-based
+ * `tool-fs-search`, which spawns the LOCAL ripgrep against the LOCAL session
+ * cwd and therefore only ever sees the empty remote-workspace anchor).
+ *
+ * These tools run ripgrep in the SAME world as the session cwd: a registered
+ * remote anchor runs `rg` over ssh2 exec on the remote host (only matches/file
+ * paths come back), while a local cwd spawns the system `rg` through
+ * `ctx.subprocess` (plain argv — no shell quoting). The schemas and output
+ * shapes mirror the built-in `grep`/`glob` so the model is unaware.
+ */
+
+import { posix } from 'node:path'
+import { shellQuote } from './transport.js'
+import { findByCwd } from './registry.js'
+
+const GREP_MAX_MATCHES = 250
+const GLOB_MAX_RESULTS = 1000
+const RAW_OUTPUT_MAX_BYTES = 20 * 1024 * 1024
+const SEARCH_TIMEOUT_MS = 30_000
+const STDERR_MAX_BYTES = 64 * 1024
+const GRACE_MS = 3_000
+
+// ---------------------------------------------------------------------------
+// ripgrep argv (mirrors @deepseek-ai/dsh-tool-fs-search)
+// ---------------------------------------------------------------------------
+function grepArgv(input) {
+  const parts = ['--json', `--regexp=${input.pattern}`]
+  if (input.include !== undefined) parts.push(`--glob=${input.include}`)
+  // Explicit search root: ripgrep 14+ does NOT search the cwd when no path is
+  // given, so a bare `rg --regexp=…` searches zero bytes.
+  parts.push('--', input.path ?? '.')
+  return parts
+}
+
+function globArgv(input) {
+  const parts = ['--files', `--glob=${input.pattern}`, '--sort=modified', '--no-ignore', '--hidden']
+  for (const name of ['.git', '.hg', '.svn']) {
+    parts.push(`--glob=!**/${name}`, `--glob=!**/${name}/**`)
+  }
+  parts.push('--', input.path ?? '.')
+  return parts
+}
+
+// ---------------------------------------------------------------------------
+// Output parsing
+// ---------------------------------------------------------------------------
+function parseGrepMatches(stdout) {
+  const matches = []
+  for (const line of stdout.split('\n')) {
+    if (line === '') continue
+    let rec
+    try { rec = JSON.parse(line) } catch { throw new Error('grep: malformed ripgrep --json output') }
+    if (rec === null || typeof rec !== 'object' || rec.type !== 'match') continue
+    const d = rec.data
+    const path = d && d.path && typeof d.path.text === 'string' ? d.path.text : undefined
+    if (path === undefined || typeof d.line_number !== 'number' || d.lines === null || typeof d.lines !== 'object') {
+      throw new Error('grep: malformed ripgrep match record')
+    }
+    let lineText
+    if (typeof d.lines.text === 'string') lineText = d.lines.text.replace(/\r?\n$/, '')
+    else if (typeof d.lines.bytes === 'string') lineText = '(line is not valid UTF-8)'
+    else throw new Error('grep: malformed ripgrep match record')
+    matches.push({ path: path.replace(/^\.\//, ''), lineNumber: d.line_number, line: lineText })
+  }
+  return matches
+}
+
+function parseGlobPaths(stdout) {
+  return stdout.split('\n').filter((p) => p !== '').map((p) => p.replace(/^\.\//, ''))
+}
+
+/**
+ * Map a model-supplied search path to a remote path. A LOCAL anchor directory
+ * (what the system prompt shows as the "working directory") is translated to
+ * its remote origin; relative paths and already-remote POSIX paths pass
+ * through unchanged (ripgrep resolves relative paths against the remote cwd).
+ */
+function translatePath(path) {
+  if (path === undefined || path === '' || path === '.') return '.'
+  const hit = findByCwd(path)
+  if (hit !== undefined) {
+    return hit.remoteSubpath === '' ? hit.remotePath : posix.join(hit.remotePath, hit.remoteSubpath)
+  }
+  return path
+}
+
+// ---------------------------------------------------------------------------
+// Execution (local subprocess vs remote ssh2 exec)
+// ---------------------------------------------------------------------------
+async function localRg(deps, argv, cwd, signal) {
+  const subprocess = deps.getSubprocess()
+  if (!subprocess) throw new Error('grep/glob: subprocess service unavailable')
+  const handle = subprocess.spawn({
+    argv: ['rg', ...argv],
+    cwd,
+    stdio: {
+      stdin: 'ignore',
+      stdout: { maxBytes: RAW_OUTPUT_MAX_BYTES },
+      stderr: { maxBytes: STDERR_MAX_BYTES },
+    },
+    graceMs: GRACE_MS,
+    signal,
+  })
+  const outcome = await handle.done
+  const stdout = handle.collected.stdout?.readFrom(0)
+  const stderr = handle.collected.stderr?.readFrom(0)
+  if (outcome.exitCode !== 0 && outcome.exitCode !== 1) {
+    throw new Error(`grep/glob: rg failed (exit ${outcome.exitCode}): ${stderr?.text ?? ''}`)
+  }
+  return stdout?.text ?? ''
+}
+
+async function remoteRg(client, argv, remoteCwd, signal) {
+  const command = ['rg', ...argv].map(shellQuote).join(' ')
+  const result = await client.execShell(command, {
+    cwd: remoteCwd,
+    timeoutMs: SEARCH_TIMEOUT_MS,
+    stdoutMaxBytes: RAW_OUTPUT_MAX_BYTES,
+    stderrMaxBytes: STDERR_MAX_BYTES,
+    ...(signal !== undefined ? { signal } : {}),
+  })
+  if (!result.ok) throw new Error(`grep/glob: remote rg failed: ${result.error ?? ''}`)
+  if (result.exitCode !== 0 && result.exitCode !== 1) {
+    throw new Error(`grep/glob: remote rg failed (exit ${result.exitCode}): ${result.stderr.text}`)
+  }
+  return result.stdout.text
+}
+
+// ---------------------------------------------------------------------------
+// Model-facing formatting
+// ---------------------------------------------------------------------------
+function formatGrep(matches) {
+  if (matches.length === 0) return 'No matches found'
+  const byFile = new Map()
+  for (const m of matches) {
+    const g = byFile.get(m.path)
+    if (g) g.push(m)
+    else byFile.set(m.path, [m])
+  }
+  const sections = []
+  for (const [path, group] of byFile) {
+    sections.push(`${path}\n${group.map((m) => `Line ${m.lineNumber}: ${m.line}`).join('\n')}`)
+  }
+  return `Found ${matches.length} ${matches.length === 1 ? 'match' : 'matches'}\n\n${sections.join('\n\n')}`
+}
+
+function formatGlob(paths) {
+  if (paths.length === 0) return 'No files found'
+  return paths.join('\n')
+}
+
+// ---------------------------------------------------------------------------
+// Tool construction + registration
+// ---------------------------------------------------------------------------
+export function createSearchTools(deps) {
+  function resolveWorld(exec) {
+    const cwd = exec.agent?.session.header.cwd
+    const hit = cwd ? findByCwd(cwd) : undefined
+    if (hit === undefined) return { local: true, cwd: cwd ?? process.cwd() }
+    const remoteCwd = hit.remoteSubpath === '' ? hit.remotePath : posix.join(hit.remotePath, hit.remoteSubpath)
+    return { local: false, remoteCwd, client: deps.clientForRemote(hit.host, hit.user, hit.port) }
+  }
+
+  async function runRg(exec, buildArgv, input) {
+    const world = resolveWorld(exec)
+    if (world.local) return localRg(deps, buildArgv(input), world.cwd, exec.signal)
+    const remoteInput = input.path !== undefined
+      ? { ...input, path: translatePath(input.path) }
+      : input
+    return remoteRg(world.client, buildArgv(remoteInput), world.remoteCwd, exec.signal)
+  }
+
+  const grep = {
+    name: 'grep',
+    description: 'Search file contents with a ripgrep regular expression. Returns matching lines with line numbers, grouped by file. '
+      + `Returns up to ${GREP_MAX_MATCHES} matches. Use read on a matched file for surrounding context. `
+      + 'On a remote workspace the search runs on the remote host.',
+    parameters: {
+      type: 'object',
+      properties: {
+        pattern: { type: 'string', description: 'Regular expression to search for (ripgrep syntax).' },
+        path: { type: 'string', description: 'File or directory to search. Defaults to the session workspace; a relative path resolves against it.' },
+        include: { type: 'string', description: 'One glob filter for which files to search (e.g. "*.ts", "*.{js,jsx}"). Not a list; negation is not supported.' },
+      },
+      required: ['pattern'],
+      additionalProperties: false,
+    },
+    timeoutMs: SEARCH_TIMEOUT_MS,
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          matches: {
+            type: 'array',
+            items: {
+              type: 'object',
+              additionalProperties: false,
+              properties: {
+                path: { type: 'string' },
+                lineNumber: { type: 'integer' },
+                line: { type: 'string' },
+              },
+              required: ['path', 'lineNumber', 'line'],
+            },
+          },
+        },
+        required: ['matches'],
+      },
+      render: (_args, value) => [{ type: 'text', text: formatGrep(value.matches) }],
+    },
+    async execute(args, exec) {
+      const input = {
+        pattern: args.pattern,
+        ...(args.path !== undefined ? { path: args.path } : {}),
+        ...(args.include !== undefined ? { include: args.include } : {}),
+      }
+      const stdout = await runRg(exec, grepArgv, input)
+      return { matches: parseGrepMatches(stdout).slice(0, GREP_MAX_MATCHES) }
+    },
+  }
+
+  const glob = {
+    name: 'glob',
+    description: 'Find files matching a glob pattern. Returns file paths, modification-time ordered. '
+      + `Returns up to ${GLOB_MAX_RESULTS} paths. On a remote workspace the search runs on the remote host.`,
+    parameters: {
+      type: 'object',
+      properties: {
+        pattern: { type: 'string', description: 'Glob pattern to match file names against (e.g. "*.ts", "src/**/*.js").' },
+        path: { type: 'string', description: 'Directory to search. Defaults to the session workspace; a relative path resolves against it.' },
+      },
+      required: ['pattern'],
+      additionalProperties: false,
+    },
+    timeoutMs: SEARCH_TIMEOUT_MS,
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          paths: { type: 'array', items: { type: 'string' } },
+        },
+        required: ['paths'],
+      },
+      render: (_args, value) => [{ type: 'text', text: formatGlob(value.paths) }],
+    },
+    async execute(args, exec) {
+      const input = { pattern: args.pattern, ...(args.path !== undefined ? { path: args.path } : {}) }
+      const stdout = await runRg(exec, globArgv, input)
+      return { paths: parseGlobPaths(stdout).slice(0, GLOB_MAX_RESULTS) }
+    },
+  }
+
+  return { grep, glob }
+}
+
+export function applySearchTools(ctx, deps) {
+  const { grep, glob } = createSearchTools(deps)
+
+  // Global registration: the fallback for a rosterless deployment (no agent
+  // preset), where the model-facing rows sit in the host composition and the
+  // built-in `tool-fs-search` is disabled by the patch layer. Under a preset
+  // this registration is harmless — it lives in the farthest layer and every
+  // nearer layer shadows it.
+  ctx.tools.register(grep)
+  ctx.tools.register(glob)
+
+  // Per-agent registration: the model-facing grep/glob actually ship in the
+  // agent PRESET (`tool-fs-search` in `agent.cordis.yml`), mounted under a
+  // STANDING scope that is an ancestor of each agent's own scope. A host-plane
+  // `disabled` patch cannot reach that composition — the web bundle already
+  // disables the HOST row, and the preset row is a separate mount. Registering
+  // in the agent's OWN scope layer (the nearest) shadows the preset's built-in
+  // grep/glob without touching the preset. The inject fiber is owned by
+  // `agent.ctx`, so it unwinds with the agent.
+  ctx.on('agent/created', ({ agent }) => {
+    agent.ctx.inject(['tools'], (scope) => {
+      scope.tools.register(grep)
+      scope.tools.register(glob)
+    })
+  })
+}
+
+export default applySearchTools