@bunshin-cc/bunshin 0.5.2 → 0.6.0

package/dist/git-remote-bunshin.js

@@ -1,13 +1,25 @@
 #!/usr/bin/env node
 
 // src/v2/gitremote.ts
-import fs from "node:fs";
+import fs3 from "node:fs";
 import os from "node:os";
-import path from "node:path";
+import path2 from "node:path";
 import readline from "node:readline";
 import { spawnSync } from "node:child_process";
 
+// src/trust.ts
+import fs2 from "node:fs";
+import path from "node:path";
+
 // src/util.ts
+import fs from "node:fs";
+function readJson(file, fallback) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
 var STOPWORDS = new Set(
   "a an the and or but if then else of to in on at for from by with without as is are was were be been being do does did done have has had can could should would will shall may might must this that these those it its i we you they he she them us our your my me not no yes so just also very really please now new use using make get set add fix run change update create write need want like about into over under out up down how what when where why which who whom there here some any all each every more most less least than too own same other".split(" ")
 );
@@ -15,6 +27,50 @@ function homeDir() {
   return process.env.HOME || process.env.USERPROFILE || "/";
 }
 
+// src/trust.ts
+var HOSTED_API = "https://api.bunshin.cc";
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var configDir = () => path.join(homeDir(), ".config/bunshin");
+var trustFile = () => path.join(configDir(), "trusted-stores.json");
+var credentialDir = () => path.join(configDir(), "credentials");
+function secureUrl(raw) {
+  try {
+    const url = new URL(raw ?? "");
+    return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK.has(url.hostname);
+  } catch {
+    return false;
+  }
+}
+function urlOrigin(raw) {
+  try {
+    return new URL(raw ?? "").origin;
+  } catch {
+    return null;
+  }
+}
+function trustedStores() {
+  const list = readJson(trustFile(), {}).stores;
+  return Array.isArray(list) ? list.filter((x) => typeof x === "string") : [];
+}
+function trustedOrigins() {
+  const out = /* @__PURE__ */ new Set([HOSTED_API]);
+  for (const root of trustedStores()) {
+    const url = readJson(path.join(root, "config.json"), {}).apiUrl;
+    if (url) out.add(url);
+  }
+  for (const url of Object.keys(readJson(path.join(configDir(), "git-credentials.json"), {}))) out.add(url);
+  let files = [];
+  try {
+    files = fs2.readdirSync(credentialDir()).filter((f) => f.endsWith(".json"));
+  } catch {
+  }
+  for (const f of files) {
+    const url = readJson(path.join(credentialDir(), f), {}).apiUrl;
+    if (url) out.add(url);
+  }
+  return new Set([...out].map(urlOrigin).filter((x) => !!x));
+}
+
 // src/v2/gitremote.ts
 var ZERO_SHA = "0".repeat(40);
 var REMOTE_PATH = "/v1/git/repos/";
@@ -25,27 +81,30 @@ function parseRemoteUrl(url) {
   const apiUrl = raw.slice(0, i);
   const repo = decodeURIComponent(raw.slice(i + REMOTE_PATH.length));
   if (!/^https?:\/\//.test(apiUrl) || repo.split("/").length !== 2) throw new Error(`not a Bunshin repository address: ${url}`);
+  if (!secureUrl(apiUrl)) throw new Error(`refusing ${apiUrl}: Bunshin repositories need https (http only on localhost)`);
   return { apiUrl, repo };
 }
-var gitCredentialFile = () => path.join(homeDir(), ".config/bunshin/git-credentials.json");
+var gitCredentialFile = () => path2.join(homeDir(), ".config/bunshin/git-credentials.json");
 function resolveGitKey(apiUrl) {
   const base = apiUrl.replace(/\/$/, "");
-  if (process.env.BUNSHIN_API_KEY) return process.env.BUNSHIN_API_KEY;
+  if (!secureUrl(base)) return void 0;
+  const origin = urlOrigin(base);
+  if (process.env.BUNSHIN_API_KEY && origin && trustedOrigins().has(origin)) return process.env.BUNSHIN_API_KEY;
   try {
-    const all = JSON.parse(fs.readFileSync(gitCredentialFile(), "utf8"));
+    const all = JSON.parse(fs3.readFileSync(gitCredentialFile(), "utf8"));
     if (all[base]) return all[base];
   } catch {
   }
-  const dir = path.join(homeDir(), ".config/bunshin/credentials");
+  const dir = path2.join(homeDir(), ".config/bunshin/credentials");
   let files = [];
   try {
-    files = fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    files = fs3.readdirSync(dir).filter((f) => f.endsWith(".json"));
   } catch {
     return void 0;
   }
   for (const f of files.sort()) {
     try {
-      const c = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
+      const c = JSON.parse(fs3.readFileSync(path2.join(dir, f), "utf8"));
       if (c.apiKey && c.apiUrl?.replace(/\/$/, "") === base) return c.apiKey;
     } catch {
     }
@@ -171,7 +230,7 @@ async function fetchObjects(client, repo, wanted, log = () => {
   const have = presentObjects([...new Set(meta.flatMap((b) => b.tips))]);
   const needed = meta.filter((b) => b.tips.some((t) => !have.has(t)));
   if (!needed.length) throw new Error("the server has no bundle with the missing objects");
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "bunshin-git-"));
+  const tmp = fs3.mkdtempSync(path2.join(os.tmpdir(), "bunshin-git-"));
   try {
     let after = needed[0].seq - 1;
     const want = new Set(needed.map((b) => b.seq));
@@ -181,10 +240,10 @@ async function fetchObjects(client, repo, wanted, log = () => {
       for (const b of page.bundles) {
         after = b.seq;
         if (!want.has(b.seq) || !b.data) continue;
-        const file = path.join(tmp, `${b.seq}.bundle`);
-        fs.writeFileSync(file, Buffer.from(b.data, "base64"));
+        const file = path2.join(tmp, `${b.seq}.bundle`);
+        fs3.writeFileSync(file, Buffer.from(b.data, "base64"));
         git(["bundle", "unbundle", file]);
-        fs.rmSync(file, { force: true });
+        fs3.rmSync(file, { force: true });
         applied++;
       }
       if (!page.more || !page.bundles.length) break;
@@ -192,7 +251,7 @@ async function fetchObjects(client, repo, wanted, log = () => {
     log(`bunshin: applied ${applied} bundle${applied === 1 ? "" : "s"}
 `);
   } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
+    fs3.rmSync(tmp, { recursive: true, force: true });
   }
   const still = wanted.filter((s) => !presentObjects([s]).has(s));
   if (still.length) throw new Error(`objects still missing after fetch: ${still.slice(0, 3).join(", ")}`);
@@ -246,7 +305,7 @@ async function pushRefs(client, repo, specs) {
   const sends = updates.filter((u) => u.new !== ZERO_SHA);
   let bundle = null;
   if (sends.length) {
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "bunshin-git-"));
+    const tmp = fs3.mkdtempSync(path2.join(os.tmpdir(), "bunshin-git-"));
     const tmpRefs = [];
     try {
       sends.forEach((u, i) => {
@@ -255,9 +314,9 @@ async function pushRefs(client, repo, specs) {
         tmpRefs.push(ref);
       });
       const known = presentObjects([...new Set(remote.values())]);
-      const file = path.join(tmp, "push.bundle");
+      const file = path2.join(tmp, "push.bundle");
       const r = git(["bundle", "create", "--quiet", file, ...tmpRefs, ...[...known].map((k) => `^${k}`)], { allowFail: true });
-      if (r.ok) bundle = new Uint8Array(fs.readFileSync(file));
+      if (r.ok) bundle = new Uint8Array(fs3.readFileSync(file));
       else if (!/empty bundle/i.test(r.err)) throw new Error(r.err.trim() || "git bundle create failed");
       else {
         for (const u of sends) {
@@ -267,7 +326,7 @@ async function pushRefs(client, repo, specs) {
       }
     } finally {
       for (const ref of tmpRefs) git(["update-ref", "-d", ref], { allowFail: true });
-      fs.rmSync(tmp, { recursive: true, force: true });
+      fs3.rmSync(tmp, { recursive: true, force: true });
     }
   }
   if (updates.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunshin-cc/bunshin",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Shared memory for company AI agents. Connect Codex, Claude Code, or Pi to Bunshin.",
   "type": "module",
   "bin": {