@struktoai/mirage-core/dist/policy/builtin/mount_root.d.ts

A Unified Virtual Filesystem For AI Agents

import type { Policy } from '../base.ts';
import type { Action, CommandContext, Deny, MountRootQuery } from '../types.ts';
import type { PathSpec } from '../../types.ts';
export declare function lnFlagPresent(argv: readonly string[], letter: string, long: string): boolean;
/**
 * Spot mkdir's -p/--parents by raw token scan. The policy fires before
 * flag parsing (its refusals must win over parse errors and stay
 * consistent across the single-mount and cross-mount paths), so the
 * shorthand cluster (-pv) is detected on the raw argv rather than
 * through the spec parser.
 */
export declare function hasParentsFlag(argv: readonly string[]): boolean;
/**
 * What an rm line asks of a directory operand, by raw token scan: recurse
 * (-r, -R), remove an empty one (-d), and keep `/` out of a recursive
 * removal, which is the default; the last of --preserve-root and
 * --no-preserve-root wins. A long word is read against rm's whole table, so
 * an abbreviation counts too. Mirrors Python's rm_options.
 */
export declare function rmOptions(argv: readonly string[]): [boolean, boolean, boolean];
export declare function ftsName(raw: string): string;
/**
 * rm's refusal of a mount root, in GNU rm's order and words: a recursive `.`
 * or `..` is skipped before anything is looked at, a directory without -r or
 * -d is not removed at all, and a recursive `/` meets the root failsafe; only
 * what is left reaches the mountpoint and is busy. Mirrors Python's
 * rm_root_refusal.
 */
export declare function rmRootRefusal(path: PathSpec, recursive: boolean, emptyDir: boolean, preserve: boolean): Deny;
/**
 * The built-in rule: a mount root is not an ordinary directory.
 *
 * Two rules, one boundary. The first mirrors the kernel's refusal to unlink
 * or replace a mountpoint (EBUSY on Linux), with each command's own GNU
 * message: rm, rmdir, mv, mkdir, touch and ln.
 *
 * The second is mirage's own, and is a deliberate divergence: an archiver or
 * a recursive copy pointed at a mount root would read an entire backend into
 * one object. Real tar and cp allow it because a mountpoint there is just
 * another directory; here the mount table is the deployment's configuration,
 * and consuming a whole mount is neither what the operand looks like it costs
 * nor something an agent should be able to do to data it was merely given a
 * view of. The refusal names the boundary in each tool's own voice rather
 * than inventing a mirage error, so a caller sees a filesystem answer.
 *
 * Only positional operands are tested. tar's `-C` and unzip's `-d` are
 * destinations to extract INTO, which is ordinary use of a mount, so reading
 * them here would refuse the safe direction as well.
 *
 * Fires before mount resolution and cross-mount routing so the refusal is the
 * same however the operands span mounts, and before runtime placement so a
 * routed command is refused identically. MountRegistry seeds it as the first
 * policy (mount-root semantics belong to the mount layer), so its exact
 * messages win over user policies by order, not by privilege. `registry` is
 * the mount table it asks.
 */
export declare class MountRootPolicy implements Policy {
    private readonly registry;
    constructor(registry: MountRootQuery);
    preCommand(ctx: CommandContext): Action | null;
}
//# sourceMappingURL=mount_root.d.ts.map