@catalyst-cloud/cli 0.14.6 → 0.14.7

package/dist/daemon-authority.js

@@ -0,0 +1,216 @@
+import { configPathFor, } from "./config.js";
+import { personCacheScope } from "./daemon-cache.js";
+import { ownedFetch } from "./owned-fetch.js";
+import { fetchMe } from "./transport.js";
+import { onboardFileSnapshot } from "./onboard-file-snapshot.js";
+export class DaemonAuthorityError extends Error {
+    kind;
+    constructor(kind, code) {
+        super(code);
+        this.kind = kind;
+        this.name = "DaemonAuthorityError";
+    }
+}
+const refused = (code) => new DaemonAuthorityError("authentication", code);
+const changed = () => new DaemonAuthorityError("identity", "daemon_authority_changed");
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+function currentConfig(ctx) {
+    let bytes;
+    try {
+        bytes = onboardFileSnapshot(configPathFor(ctx.home));
+    }
+    catch {
+        throw refused("daemon_config_unverified");
+    }
+    if (bytes === null)
+        throw refused("daemon_login_required");
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        throw refused("daemon_config_unverified");
+    }
+    const config = object(parsed), user = object(config?.user);
+    if (!config ||
+        !user ||
+        typeof config.account !== "string" ||
+        typeof config.baseUrl !== "string" ||
+        typeof config.slug !== "string" ||
+        typeof config.name !== "string" ||
+        typeof config.joinedAt !== "string" ||
+        typeof config.lastSkillBundleVersion !== "string" ||
+        config.principal !== "service" ||
+        typeof user.id !== "string" ||
+        typeof user.label !== "string" ||
+        !(user.email === null || typeof user.email === "string") ||
+        !(user.linearUserId === null || typeof user.linearUserId === "string") ||
+        (user.role !== "owner" && user.role !== "admin" && user.role !== "member"))
+        throw refused("daemon_config_unverified");
+    let permissions = null;
+    if (config.permissions !== null) {
+        if (!Array.isArray(config.permissions) || config.permissions.length > 128)
+            throw refused("daemon_config_unverified");
+        permissions = [];
+        for (const permission of config.permissions) {
+            if (typeof permission !== "string")
+                throw refused("daemon_config_unverified");
+            permissions.push(permission);
+        }
+    }
+    let credential;
+    if (typeof config.key === "string" &&
+        config.key.length > 0 &&
+        config.auth === undefined)
+        credential = { key: config.key };
+    else {
+        const auth = object(config.auth);
+        if (config.key !== undefined ||
+            !auth ||
+            auth.kind !== "oauth" ||
+            typeof auth.sessionId !== "string" ||
+            typeof auth.accessToken !== "string" ||
+            !auth.accessToken.length ||
+            auth.accessToken.length > 8192 ||
+            typeof auth.refreshToken !== "string" ||
+            typeof auth.expiresAt !== "string")
+            throw refused("daemon_config_unverified");
+        credential = {
+            auth: {
+                kind: "oauth",
+                sessionId: auth.sessionId,
+                accessToken: auth.accessToken,
+                refreshToken: auth.refreshToken,
+                expiresAt: auth.expiresAt,
+            },
+        };
+    }
+    return {
+        ...credential,
+        account: config.account,
+        baseUrl: config.baseUrl,
+        slug: config.slug,
+        name: config.name,
+        principal: config.principal,
+        permissions,
+        joinedAt: config.joinedAt,
+        lastSkillBundleVersion: config.lastSkillBundleVersion,
+        user: {
+            id: user.id,
+            label: user.label,
+            email: user.email,
+            linearUserId: user.linearUserId,
+            role: user.role,
+        },
+    };
+}
+function currentToken(config, now) {
+    if (config.key && !config.auth)
+        return config.key;
+    if (!config.key &&
+        config.auth &&
+        Date.parse(config.auth.expiresAt) - now > 30_000)
+        return config.auth.accessToken;
+    // This reader never refreshes or writes the saved login. Renewal needs separately owned IO.
+    throw refused("daemon_login_refresh_required");
+}
+function scopeOf(config, me) {
+    let scope;
+    try {
+        scope = personCacheScope(config, me);
+    }
+    catch {
+        throw changed();
+    }
+    if (scope.permissions !== null && !scope.permissions.includes("mirror:feed"))
+        throw refused("daemon_feed_permission_required");
+    return scope;
+}
+function sameScope(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** A read-only proof expires 30s after request ENTRY, not after a potentially slow response.
+ * The owner must stop peers at expiry and join this promise before releasing any writer lease.
+ * Cancellation can remain pending beyond the deadline until actual upstream IO acknowledges it. */
+export async function readDaemonAuthority(ctx, parent) {
+    if (parent.aborted)
+        throw parent.reason;
+    const enteredAt = ctx.now().getTime();
+    if (!Number.isSafeInteger(enteredAt))
+        throw refused("daemon_clock_invalid");
+    const config = currentConfig(ctx);
+    // Saved claims only preflight destination/credential shape; they never establish live authority.
+    scopeOf(config, config);
+    const bearer = currentToken(config, enteredAt);
+    const stopped = new AbortController();
+    const signal = AbortSignal.any([parent, stopped.signal]);
+    const request = ownedFetch(ctx.fetch, signal, { maxBodyBytes: 1024 * 1024 });
+    const timer = setTimeout(() => stopped.abort(refused("daemon_authority_expired")), 30_000);
+    let primary;
+    let failed = false;
+    let proof;
+    try {
+        const me = await fetchMe(config.baseUrl, bearer, request.fetch, 30_000);
+        if (signal.aborted)
+            throw signal.reason;
+        const scope = scopeOf(config, me);
+        const expiresAt = enteredAt + 30_000;
+        const assertCurrent = () => {
+            if (parent.aborted)
+                throw parent.reason;
+            const current = currentConfig(ctx);
+            if (!sameScope(scope, scopeOf(current, me)))
+                throw changed();
+            const now = ctx.now().getTime();
+            currentToken(current, now);
+            // No saved-file read follows the final clock/parent boundary.
+            if (parent.aborted)
+                throw parent.reason;
+            if (!Number.isSafeInteger(now) || now < enteredAt || now >= expiresAt)
+                throw refused("daemon_authority_expired");
+        };
+        assertCurrent();
+        proof = Object.freeze({
+            scope,
+            expiresAt,
+            assertCurrent,
+            async getToken() {
+                assertCurrent();
+                const current = currentConfig(ctx);
+                if (!sameScope(scope, scopeOf(current, me)))
+                    throw changed();
+                // A saved rotation is not proof about that new bearer. Use only the /me-verified token
+                // until a separately owned fresh read replaces this proof.
+                assertCurrent();
+                return bearer;
+            },
+        });
+    }
+    catch (error) {
+        primary = signal.aborted
+            ? signal.reason
+            : error instanceof DaemonAuthorityError
+                ? error
+                : refused("daemon_authority_unavailable");
+        failed = true;
+    }
+    finally {
+        clearTimeout(timer);
+        // The wrapper joins entered headers, readers and FIRST cancel; a timeout is never an ACK.
+        try {
+            await request.settle();
+        }
+        catch (cleanup) {
+            throw new AggregateError(failed ? [primary, cleanup] : [cleanup], "daemon_authority_cleanup_failed");
+        }
+    }
+    if (failed)
+        throw primary;
+    if (!proof)
+        throw refused("daemon_authority_unverified");
+    // Even natural-response cleanup can be slow; publication checks the ORIGINAL expiry again.
+    proof.assertCurrent();
+    return proof;
+}

package/dist/daemon-cache.js

@@ -0,0 +1,348 @@
+import { constants, closeSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, writeFileSync, } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+const fail = () => new Error("daemon_cache_identity_unverified");
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const own = (s) => process.getuid === undefined || s.uid === process.getuid();
+const sameInode = (a, b) => a.dev === b.dev && a.ino === b.ino;
+const validId = (s) => typeof s === "string" &&
+    s.length > 0 &&
+    s.length <= 256 &&
+    !Array.from(s).some((c) => c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127);
+function permissions(value) {
+    if (value === null)
+        return null;
+    if (!Array.isArray(value) ||
+        value.length > 128 ||
+        value.some((v) => !validId(v)))
+        throw fail();
+    return [...new Set(value)].sort();
+}
+function httpsOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw fail();
+    }
+    if (url.protocol !== "https:" ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.pathname !== "/" && url.pathname !== ""))
+        throw fail();
+    return url.origin;
+}
+/** Only call after a fresh authenticated /me read. Config labels and token claims are not proof. */
+export function personCacheScope(config, me) {
+    if (!me.user ||
+        !config.user ||
+        !validId(me.account) ||
+        !validId(me.user.id) ||
+        me.account !== config.account ||
+        me.user.id !== config.user.id ||
+        me.user.role !== config.user.role ||
+        !["owner", "admin", "member"].includes(me.user.role))
+        throw fail();
+    // /me does not carry project ACL revision or a personal replica dataset scope.
+    // Account-wide warm caches are therefore limited to current owners and admins.
+    if (me.user.role === "member")
+        throw new Error("daemon_cache_member_scope_unavailable");
+    const currentPermissions = permissions(me.permissions);
+    if (currentPermissions !== null &&
+        !currentPermissions.includes("mirror:read"))
+        throw fail();
+    if (JSON.stringify(currentPermissions) !==
+        JSON.stringify(permissions(config.permissions)))
+        throw fail();
+    if (Boolean(config.key) === Boolean(config.auth) ||
+        me.principal !== config.principal)
+        throw fail();
+    let credential;
+    if (config.key) {
+        if (me.principal !== "service" ||
+            !config.key.startsWith("ctc_user_") ||
+            config.key.length > 8192)
+            throw fail();
+        credential = "personal-key:" + digest(config.key);
+    }
+    else {
+        // Device-code JWTs are user-bearing service principals; session denotes browser cookies.
+        if (me.principal !== "service" ||
+            !config.auth ||
+            config.auth.kind !== "oauth" ||
+            !validId(config.auth.sessionId))
+            throw fail();
+        credential = "oauth-session:" + digest(config.auth.sessionId);
+    }
+    return Object.freeze({
+        schema: 1,
+        account: me.account,
+        person: me.user.id,
+        origin: httpsOrigin(config.baseUrl),
+        role: me.user.role,
+        permissions: currentPermissions === null ? null : Object.freeze(currentPermissions),
+        credential,
+    });
+}
+function canonical(scope) {
+    if (scope.schema !== 1 ||
+        !validId(scope.account) ||
+        !validId(scope.person) ||
+        !["owner", "admin", "member"].includes(scope.role) ||
+        httpsOrigin(scope.origin) !== scope.origin ||
+        !/^(personal-key|oauth-session):[a-f0-9]{64}$/.test(scope.credential))
+        throw fail();
+    if (scope.role === "member")
+        throw new Error("daemon_cache_member_scope_unavailable");
+    const granted = permissions(scope.permissions);
+    if (granted !== null && !granted.includes("mirror:read"))
+        throw fail();
+    return (JSON.stringify({
+        schema: 1,
+        account: scope.account,
+        person: scope.person,
+        origin: scope.origin,
+        role: scope.role,
+        permissions: permissions(scope.permissions),
+        credential: scope.credential,
+    }) + "\n");
+}
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function checkDirectory(path, privateMode) {
+    const s = lstatSync(path);
+    if (!s.isDirectory() ||
+        s.isSymbolicLink() ||
+        !own(s) ||
+        (s.mode & (privateMode ? 0o077 : 0o022)) !== 0)
+        throw fail();
+    return s;
+}
+function readWitness(path) {
+    const before = lstatSync(path);
+    if (!before.isFile() ||
+        before.isSymbolicLink() ||
+        !own(before) ||
+        before.nlink !== 1 ||
+        (before.mode & 0o077) !== 0 ||
+        before.size > 65536)
+        throw fail();
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const opened = fstatSync(fd);
+        if (!sameInode(before, opened))
+            throw fail();
+        const buffer = Buffer.alloc(65537);
+        let count = 0;
+        while (count < buffer.length) {
+            const read = readSync(fd, buffer, count, buffer.length - count, null);
+            if (read === 0)
+                break;
+            count += read;
+        }
+        if (count > 65536)
+            throw fail();
+        const bytes = buffer.subarray(0, count).toString("utf8");
+        const after = lstatSync(path), ended = fstatSync(fd);
+        if (!sameInode(opened, after) ||
+            !sameInode(opened, ended) ||
+            opened.size !== Buffer.byteLength(bytes) ||
+            opened.mtimeMs !== after.mtimeMs ||
+            opened.mtimeMs !== ended.mtimeMs ||
+            opened.ctimeMs !== after.ctimeMs ||
+            (after.mode & 0o077) !== 0 ||
+            !own(after) ||
+            after.nlink !== 1)
+            throw fail();
+        return { bytes, stat: after };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function checkCacheFiles(directory, pinned) {
+    let observed = 0;
+    const seen = new Set();
+    const visit = (parent, depth) => {
+        if (depth > 16)
+            throw fail();
+        for (const name of readdirSync(parent)) {
+            if (++observed > 100000)
+                throw fail();
+            const path = join(parent, name), s = lstatSync(path);
+            // The enclosing scope directory is 0700. SDK-default 0644/0755 children are
+            // inaccessible to other users; writable aliases, links and special files are refused.
+            if (s.isSymbolicLink() || !own(s) || (s.mode & 0o022) !== 0)
+                throw fail();
+            if ((path === join(directory, "replica.db") && !s.isFile()) ||
+                (path === join(directory, "events") && !s.isDirectory()))
+                throw fail();
+            if (path === join(directory, "replica.db") ||
+                path === join(directory, "events")) {
+                const before = pinned.get(path);
+                if (before && !sameInode(before, s))
+                    throw fail();
+                pinned.set(path, s);
+            }
+            seen.add(path);
+            if (s.isDirectory())
+                visit(path, depth + 1);
+            else if (!s.isFile() || s.nlink !== 1)
+                throw fail();
+        }
+    };
+    visit(directory, 0);
+    for (const path of pinned.keys())
+        if (!seen.has(path))
+            throw fail();
+}
+/** SDK 0.13.1 has no IO-settlement acknowledgement. Refuse it before any cache or writer work. */
+export function requireAwaitedReplicaShutdown(replicaClass) {
+    if (!("closeAndWait" in replicaClass.prototype) ||
+        typeof replicaClass.prototype.closeAndWait !== "function")
+        throw new Error("daemon_sdk_shutdown_unavailable");
+}
+/** Creates a new person-scoped cache; never adopts legacy cfg.replicaDb or tenant event paths.
+ * assertCurrent must synchronously reject expired or changed authority before every use. These
+ * inode checks protect cooperative local use; they do not promise a filesystem CAS. */
+export function preparePersonCache(input) {
+    requireAwaitedReplicaShutdown(input.replicaClass);
+    input.assertCurrent();
+    const bytes = canonical(input.scope);
+    if (!isAbsolute(input.home))
+        throw fail();
+    const home = resolve(input.home);
+    const directory = join(home, ".config", "catalyst-cloud", "person-cache", "v1", digest(bytes));
+    const privateRoot = join(home, ".config", "catalyst-cloud", "person-cache");
+    const paths = [];
+    for (let path = directory; path !== dirname(path); path = dirname(path))
+        paths.unshift(path);
+    const pinned = new Map();
+    for (const path of paths) {
+        input.assertCurrent();
+        const withinHome = path === home || path.startsWith(home + sep);
+        const privateMode = path === privateRoot || path.startsWith(privateRoot + sep);
+        if (!stat(path)) {
+            if (!withinHome)
+                throw fail();
+            mkdirSync(path, { mode: 0o700 });
+        }
+        // System ancestors may belong to root; they must still be real directories without links.
+        if (!withinHome) {
+            const s = lstatSync(path);
+            const trustedSticky = s.uid === 0 && (s.mode & 0o1000) !== 0;
+            if (!s.isDirectory() ||
+                s.isSymbolicLink() ||
+                (!own(s) && s.uid !== 0) ||
+                ((s.mode & 0o022) !== 0 && !trustedSticky))
+                throw fail();
+        }
+        else
+            pinned.set(path, checkDirectory(path, privateMode));
+    }
+    const witnessPath = join(directory, "identity.json");
+    if (!stat(witnessPath)) {
+        if (readdirSync(directory).length !== 0)
+            throw fail();
+        input.assertCurrent();
+        const fd = openSync(witnessPath, constants.O_WRONLY |
+            constants.O_CREAT |
+            constants.O_EXCL |
+            constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, bytes);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        const directoryFd = openSync(directory, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            fsyncSync(directoryFd);
+        }
+        finally {
+            closeSync(directoryFd);
+        }
+    }
+    const witness = readWitness(witnessPath);
+    if (witness.bytes !== bytes)
+        throw fail();
+    const cacheInodes = new Map();
+    const assertWitness = () => {
+        input.assertCurrent();
+        for (const [path, original] of pinned) {
+            const privateMode = path === privateRoot || path.startsWith(privateRoot + sep);
+            if (!sameInode(original, checkDirectory(path, privateMode)))
+                throw fail();
+        }
+        const current = readWitness(witnessPath);
+        if (!sameInode(witness.stat, current.stat) || current.bytes !== bytes)
+            throw fail();
+    };
+    const assertOwnedPaths = () => {
+        assertWitness();
+        for (const [path, directoryPath] of [
+            [join(directory, "replica.db"), false],
+            [join(directory, "events"), true],
+        ]) {
+            let stat;
+            try {
+                stat = lstatSync(path);
+            }
+            catch (error) {
+                if (error.code === "ENOENT" &&
+                    !cacheInodes.has(path))
+                    continue;
+                throw fail();
+            }
+            if (stat.isSymbolicLink() ||
+                !own(stat) ||
+                (stat.mode & 0o022) !== 0 ||
+                (directoryPath
+                    ? !stat.isDirectory()
+                    : !stat.isFile() || stat.nlink !== 1))
+                throw fail();
+            const before = cacheInodes.get(path);
+            if (before && !sameInode(before, stat))
+                throw fail();
+            cacheInodes.set(path, stat);
+        }
+        // SQLite owns these transient leaves and may remove/recreate them at checkpoint/close.
+        // Reject persistent aliases before the next SQL entry without pinning or deleting them.
+        for (const suffix of ["-wal", "-shm", "-journal"]) {
+            const leaf = stat(join(directory, "replica.db" + suffix));
+            if (leaf &&
+                (!leaf.isFile() ||
+                    leaf.isSymbolicLink() ||
+                    !own(leaf) ||
+                    leaf.nlink !== 1 ||
+                    (leaf.mode & 0o022) !== 0))
+                throw fail();
+        }
+        input.assertCurrent();
+    };
+    const assertBound = () => {
+        assertWitness();
+        checkCacheFiles(directory, cacheInodes);
+        input.assertCurrent();
+    };
+    assertBound();
+    return {
+        directory,
+        replicaDb: join(directory, "replica.db"),
+        eventDirectory: join(directory, "events"),
+        assertBound,
+        assertOwnedPaths,
+    };
+}