zelari-code 2.15.0 → 2.16.0

package/dist/cli/extensions/loader.js

@@ -0,0 +1,213 @@
+/**
+ * extensions/loader.ts — disk loading for the ExtensionAPI seam (t30).
+ *
+ * Trust model (mirrors safety/lifecycleHooks.ts):
+ *   1. `~/.zelari-code/extensions/*`  — user-global, ALWAYS active
+ *   2. `<project>/.zelari/extensions/*` — active ONLY when the folder is
+ *      trusted (folderTrust.ts). Like project MCP + project hooks, trust
+ *      gates project self-execution; it NEVER touches policy.json.
+ *
+ * Code arrives from DISK ONLY — `import()` of real files, never strings
+ * from the model/prompt (ADR-0022: seam, not a plugin framework).
+ *
+ * Optional `extensions.lock` (same dir, JSON): maps FILE name → sha256 of
+ * the file bytes. The hash check runs BEFORE the dynamic import, so an
+ * unverified module is never evaluated. If a lock exists and any candidate
+ * file is missing from it or hashes differently:
+ *   - strict surface (activePolicyLoadMode strict — headless/mission/CI):
+ *     the WHOLE load FAILS with a typed ExtensionLockError (no silent skip,
+ *     no partial load); the host decides how loudly to die.
+ *   - permissive (TUI): warn + skip the offending file, load the rest.
+ *
+ * @since 2.22.0 (t30)
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readdirSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+import { ExtensionRegistry, } from '@zelari/core/harness';
+import { activePolicyLoadMode } from '../safety/policyLoadMode.js';
+import { isFolderTrusted } from '../safety/folderTrust.js';
+import { bindSandboxedFs } from './sandboxedFs.js';
+/** `~/.zelari-code/extensions` — user-global extensions (always active). */
+export function globalExtensionsDir() {
+    return join(homedir(), '.zelari-code', 'extensions');
+}
+/** `<project>/.zelari/extensions` — project extensions (trusted only). */
+export function projectExtensionsDir(projectRoot) {
+    return join(projectRoot, '.zelari', 'extensions');
+}
+/** Lockfile name, co-located with the extension files. */
+export const EXTENSIONS_LOCK_FILE = 'extensions.lock';
+const EXTENSION_FILE_EXTS = new Set(['.js', '.mjs', '.cjs']);
+/**
+ * Typed strict-mode failure (same spirit as PolicyLoadError): the caller
+ * gets a machine-readable reason list, one entry per offending file.
+ */
+export class ExtensionLockError extends Error {
+    mismatches;
+    constructor(message, mismatches) {
+        super(message);
+        this.mismatches = mismatches;
+        this.name = 'ExtensionLockError';
+    }
+}
+function sha256File(file) {
+    return createHash('sha256').update(readFileSync(file)).digest('hex');
+}
+function candidateFiles(dir) {
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return []; // dir missing → no extensions (same as hooks/MCP dirs)
+    }
+    return names
+        .filter((n) => EXTENSION_FILE_EXTS.has(n.slice(n.lastIndexOf('.')).toLowerCase()))
+        .sort()
+        .map((n) => join(dir, n));
+}
+/** Extract + validate the ZelariExtension export from a module namespace. */
+function extractExtension(mod) {
+    const m = mod;
+    const candidate = (m && typeof m === 'object' && m !== null ? m['default'] : undefined) ??
+        (m && typeof m === 'object' ? m['extension'] : undefined) ??
+        (m && typeof m === 'object' ? m['zelariExtension'] : undefined);
+    if (!candidate || typeof candidate !== 'object')
+        return null;
+    const ext = candidate;
+    if (typeof ext['id'] !== 'string' || ext['id'].trim() === '')
+        return null;
+    if (typeof ext['register'] !== 'function')
+        return null;
+    return candidate;
+}
+/**
+ * Load extensions from explicit dirs (global first, project second).
+ * Never throws: strict lock violations come back as `{ ok: false, error }`,
+ * everything else is a loud skip recorded in `skipped`.
+ */
+export async function loadExtensionsFromDirs(dirs, options = {}) {
+    const logger = options.logger ?? ((msg) => console.error(`[extensions] ${msg}`));
+    const mode = options.mode ?? activePolicyLoadMode();
+    const importModule = options.importModule ?? ((file) => import(pathToFileURL(file).href));
+    const skipped = [];
+    const runtime = {
+        registry: new ExtensionRegistry(),
+        loaded: [],
+        skipped,
+    };
+    const fsRoot = options.fsRoot ?? process.cwd();
+    let fs = null;
+    // Phase 1 — INTEGRITY: verify every candidate against its dir lock (if
+    // any) BEFORE importing anything. A strict mismatch aborts the whole load.
+    const pending = [];
+    for (const dir of dirs) {
+        const files = candidateFiles(dir.path);
+        if (files.length === 0)
+            continue;
+        let lock = null;
+        try {
+            lock = JSON.parse(readFileSync(join(dir.path, EXTENSIONS_LOCK_FILE), 'utf8'));
+        }
+        catch {
+            lock = null; // no/invalid lock file → no hash gate (documented optional)
+            if (dirHasLockFile(dir.path)) {
+                skipped.push(`${EXTENSIONS_LOCK_FILE} in ${dir.path}: unreadable — lock ignored`);
+            }
+        }
+        for (const file of files) {
+            if (!lock) {
+                pending.push({ file, scope: dir.scope });
+                continue;
+            }
+            const expected = lock[basenameOf(file)];
+            const actual = sha256File(file);
+            if (typeof expected !== 'string' || expected.toLowerCase() !== actual.toLowerCase()) {
+                const why = typeof expected !== 'string'
+                    ? 'not listed in extensions.lock'
+                    : 'sha256 mismatch vs extensions.lock';
+                if (mode === 'strict') {
+                    // Collected across ALL dirs first? No — fail fast keeps the typed
+                    // error focused; remaining files were never imported anyway.
+                    return {
+                        ok: false,
+                        error: new ExtensionLockError(`extension "${basenameOf(file)}" in ${dir.path}: ${why}`, [`${file}: ${why}`]),
+                        skipped,
+                    };
+                }
+                logger(`[extensions] skipping ${file}: ${why} (permissive mode)`);
+                skipped.push(`${file}: ${why}`);
+                continue;
+            }
+            pending.push({ file, scope: dir.scope });
+        }
+    }
+    // Phase 2 — IMPORT + REGISTER. One bad module never takes down the batch.
+    for (const { file, scope } of pending) {
+        let ext = null;
+        try {
+            ext = extractExtension(await importModule(file));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logger(`failed to import extension ${file}: ${msg}`);
+            skipped.push(`${file}: import failed (${msg})`);
+            continue;
+        }
+        if (!ext) {
+            logger(`skipping ${file}: no default/extension export shaped like ZelariExtension`);
+            skipped.push(`${file}: missing ZelariExtension export`);
+            continue;
+        }
+        if (!fs)
+            fs = bindSandboxedFs(fsRoot);
+        try {
+            await runtime.registry.registerExtension(ext, { fs });
+            runtime.loaded.push({ id: ext.id, file, scope });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logger(`extension "${ext.id}" (${file}) failed to register: ${msg}`);
+            skipped.push(`${file}: registration failed (${msg})`);
+            runtime.registry.removeExtension(ext.id);
+        }
+    }
+    return { ok: true, runtime };
+}
+function basenameOf(file) {
+    const i = Math.max(file.lastIndexOf('/'), file.lastIndexOf('\\'));
+    return i === -1 ? file : file.slice(i + 1);
+}
+function dirHasLockFile(dir) {
+    try {
+        readFileSync(join(dir, EXTENSIONS_LOCK_FILE));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Standard dir layout for a workspace: global extensions ALWAYS, project
+ * extensions only when `projectRoot` is trusted. This is the ONLY place
+ * the trust decision is made for extensions — and it never affects
+ * policy.json.
+ */
+export function extensionSourceDirs(projectRoot) {
+    const dirs = [{ path: globalExtensionsDir(), scope: 'global' }];
+    if (isFolderTrusted(projectRoot)) {
+        dirs.push({ path: projectExtensionsDir(projectRoot), scope: 'project' });
+    }
+    return dirs;
+}
+/** Convenience: load with the standard dir layout for a workspace. */
+export function loadDefaultExtensionRuntime(projectRoot, options = {}) {
+    return loadExtensionsFromDirs(extensionSourceDirs(projectRoot), {
+        fsRoot: projectRoot,
+        ...options,
+    });
+}
+//# sourceMappingURL=loader.js.map

package/dist/cli/extensions/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/cli/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGhC;IAFX,YACE,OAAe,EACN,UAA6B;QAEtC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,eAAU,GAAV,UAAU,CAAmB;QAGtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAmCD,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,uDAAuD;IACpE,CAAC;IACD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SACjF,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,CAAC,GAAG,GAAiD,CAAC;IAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,SAAoC,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,SAAuC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAmC,EACnC,UAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAA2B;QACtC,QAAQ,EAAE,IAAI,iBAAiB,EAAE;QACjC,MAAM,EAAE,EAAE;QACV,OAAO;KACR,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/C,IAAI,EAAE,GAAuB,IAAI,CAAC;IAElC,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,OAAO,GAAyD,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,GAAmC,IAAI,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC3G,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC,CAAC,4DAA4D;YACzE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,oBAAoB,OAAO,GAAG,CAAC,IAAI,6BAA6B,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpF,MAAM,GAAG,GACP,OAAO,QAAQ,KAAK,QAAQ;oBAC1B,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,oCAAoC,CAAC;gBAC3C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,kEAAkE;oBAClE,6DAA6D;oBAC7D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,IAAI,kBAAkB,CAC3B,cAAc,UAAU,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EACxD,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CACpB;wBACD,OAAO;qBACR,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,yBAAyB,IAAI,KAAK,GAAG,oBAAoB,CAAC,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,GAAG,GAA2B,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,GAAG,GAAG,gBAAgB,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,8BAA8B,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,YAAY,IAAI,2DAA2D,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE;YAAE,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,MAAM,IAAI,yBAAyB,GAAG,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,GAAG,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,IAAI,GAAyB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,UAAiC,EAAE;IAEnC,OAAO,sBAAsB,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE;QAC9D,MAAM,EAAE,WAAW;QACnB,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/extensions/sandboxedFs.js

@@ -0,0 +1,69 @@
+/**
+ * sandboxedFs.ts — CLI binding for the core `SandboxedFs` seam (t30).
+ *
+ * Core defines the extension-facing INTERFACE; this module binds it to the
+ * real, symlink-safe sandbox resolver (safety/sandboxPath.ts): every path
+ * an extension passes is resolved against the workspace root (lexical +
+ * realpath layers) and writes get a `verifyContainment` re-check as the
+ * last step before touching disk. Escapes surface as typed
+ * `{ ok: false, error: '[extension-fs] …' }` results — never a throw into
+ * extension code, and never a silent fallback.
+ *
+ * @since 2.22.0 (t30)
+ */
+import { promises as fsp } from 'node:fs';
+import path from 'node:path';
+import { typedErr, typedOk } from '@zelari/core/harness/tools/toolTypes';
+import { resolveSandboxedPath, verifyContainment } from '../safety/sandboxPath.js';
+function errText(prefix, p, err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `[extension-fs] ${prefix} "${p}": ${msg}`;
+}
+/**
+ * Bind the extension FS seam to `root` (normally the workspace root).
+ * Relative paths are joined to the root; absolute paths must already sit
+ * inside it — anything else is rejected by the shared sandbox resolver,
+ * so an extension has exactly the same containment guarantees as the
+ * built-in filesystem tools.
+ */
+export function bindSandboxedFs(root) {
+    const resolvedRoot = path.resolve(root);
+    return {
+        root: resolvedRoot,
+        async readFile(relativePath) {
+            try {
+                const target = resolveSandboxedPath(relativePath, { root: resolvedRoot });
+                const data = await fsp.readFile(target, 'utf8');
+                return typedOk(data);
+            }
+            catch (err) {
+                return typedErr(errText('readFile denied', relativePath, err));
+            }
+        },
+        async writeFile(relativePath, data) {
+            try {
+                const target = resolveSandboxedPath(relativePath, { root: resolvedRoot });
+                // TOCTOU re-check 〔PW §5〕: BOTH layers on fresh syscalls as the LAST
+                // step before the mutation (same discipline as wrapWithSandbox t26).
+                verifyContainment(target, { root: resolvedRoot });
+                await fsp.mkdir(path.dirname(target), { recursive: true });
+                await fsp.writeFile(target, data, 'utf8');
+                return typedOk({ path: target });
+            }
+            catch (err) {
+                return typedErr(errText('writeFile denied', relativePath, err));
+            }
+        },
+        async listFiles(relativePath = '.') {
+            try {
+                const target = resolveSandboxedPath(relativePath, { root: resolvedRoot });
+                const entries = await fsp.readdir(target, { withFileTypes: true });
+                return typedOk(entries.map((e) => (e.isDirectory() ? `${e.name}/` : e.name)).sort());
+            }
+            catch (err) {
+                return typedErr(errText('listFiles denied', relativePath, err));
+            }
+        },
+    };
+}
+//# sourceMappingURL=sandboxedFs.js.map

package/dist/cli/extensions/sandboxedFs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxedFs.js","sourceRoot":"","sources":["../../../src/cli/extensions/sandboxedFs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,SAAS,OAAO,CAAC,MAAc,EAAE,CAAS,EAAE,GAAY;IACtD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,kBAAkB,MAAM,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,YAAY;QAElB,KAAK,CAAC,QAAQ,CAAC,YAAoB;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,IAAY;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1E,qEAAqE;gBACrE,qEAAqE;gBACrE,iBAAiB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClD,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1C,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,YAAY,GAAG,GAAG;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC1E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}