@cloudcli-ai/cloudcli 1.37.2 → 1.37.4

package/server/modules/projects/services/project-clone.service.ts

@@ -44,7 +44,11 @@ type CloneProjectDependencies = {
     tokenId: number,
     userId: number,
   ) => Promise<{ github_token: string } | null>;
-  spawnGitClone: (cloneUrl: string, clonePath: string) => GitCloneProcess;
+  spawnGitClone: (
+    cloneUrl: string,
+    clonePath: string,
+    environment: NodeJS.ProcessEnv,
+  ) => GitCloneProcess;
   registerProject: (projectPath: string, customName: string) => Promise<{ project: Record<string, unknown> }>;
   logError: (message: string, error: unknown) => void;
 };
@@ -67,16 +71,42 @@ async function defaultPathExists(targetPath: string): Promise<boolean> {
   }
 }
 
-function sanitizeGitError(message: string, token: string | null): string {
-  if (!message || !token) {
-    return message;
+/**
+ * The only origin the credential helper answers for. The token is a GitHub
+ * token; a helper that answered every challenge would hand it to whatever
+ * host the clone URL names — and over plain http, in the clear.
+ */
+const GITHUB_TOKEN_CREDENTIAL_SCOPE = 'credential.https://github.com.helper';
+
+/**
+ * Builds the environment the clone runs in. The token never goes into the
+ * clone URL: git echoes that URL on stderr (which is the SSE progress stream),
+ * it sits in the process argv (readable through /proc) and it is written to the
+ * cloned repo's `.git/config` as the remote. Instead env-only config points git
+ * at a credential helper that reads the token from its own environment, so no
+ * channel git exposes carries it. The empty first helper entry clears any
+ * helper configured on the machine so a credential stored there cannot shadow
+ * the one the user selected; the helper itself is scoped to github.com over
+ * https, so a clone from any other host gets no credential at all.
+ */
+function buildGitCloneEnvironment(githubToken: string | null): NodeJS.ProcessEnv {
+  if (!githubToken) {
+    return { ...process.env, GIT_TERMINAL_PROMPT: '0' };
   }
 
-  const escapedToken = token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  return message.replace(new RegExp(escapedToken, 'g'), '***');
+  return {
+    ...process.env,
+    GIT_CONFIG_COUNT: '2',
+    GIT_CONFIG_KEY_0: 'credential.helper',
+    GIT_CONFIG_VALUE_0: '',
+    GIT_CONFIG_KEY_1: GITHUB_TOKEN_CREDENTIAL_SCOPE,
+    GIT_CONFIG_VALUE_1: '!f() { echo username=x-access-token; echo "password=$CLOUDCLI_GITHUB_TOKEN"; }; f',
+    CLOUDCLI_GITHUB_TOKEN: githubToken,
+    GIT_TERMINAL_PROMPT: '0',
+  };
 }
 
-function resolveCloneFailureMessage(lastError: string, sanitizedError: string): string {
+function resolveCloneFailureMessage(lastError: string): string {
   if (lastError.includes('Authentication failed') || lastError.includes('could not read Username')) {
     return 'Authentication failed. Please check your credentials.';
   }
@@ -89,11 +119,7 @@ function resolveCloneFailureMessage(lastError: string, sanitizedError: string):
     return 'Directory already exists';
   }
 
-  if (sanitizedError) {
-    return sanitizedError;
-  }
-
-  return 'Git clone failed';
+  return lastError || 'Git clone failed';
 }
 
 function resolveErrorMessage(error: unknown): string {
@@ -126,13 +152,14 @@ const defaultDependencies: CloneProjectDependencies = {
       | null;
     return tokenRow;
   },
-  spawnGitClone: (cloneUrl: string, clonePath: string): GitCloneProcess =>
+  spawnGitClone: (
+    cloneUrl: string,
+    clonePath: string,
+    environment: NodeJS.ProcessEnv,
+  ): GitCloneProcess =>
     spawn('git', ['clone', '--progress', '--', cloneUrl, clonePath], {
       stdio: ['ignore', 'pipe', 'pipe'],
-      env: {
-        ...process.env,
-        GIT_TERMINAL_PROMPT: '0',
-      },
+      env: environment,
     }) as unknown as GitCloneProcess,
   registerProject: async (
     projectPath: string,
@@ -147,11 +174,40 @@ const defaultDependencies: CloneProjectDependencies = {
   },
 };
 
+/**
+ * Whether a clone URL embeds a credential: any password, or a username on an
+ * http(s) URL. An SSH URL's `git@` is a login name, not a secret.
+ */
+function carriesCredentials(url: string): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // scp-like `git@github.com:org/repo.git` and bare paths are not URLs;
+    // an scp-like user is an SSH login, which is not a credential.
+    return false;
+  }
+  if (parsed.password) {
+    return true;
+  }
+  return Boolean(parsed.username) && (parsed.protocol === 'http:' || parsed.protocol === 'https:');
+}
+
+function isParsableUrl(url: string): boolean {
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function startCloneProject(
   input: CloneProjectInput,
   handlers: CloneProjectEventHandlers,
-  dependencies: CloneProjectDependencies = defaultDependencies,
+  dependencyOverrides: Partial<CloneProjectDependencies> = {},
 ): Promise<CloneProjectOperation> {
+  const dependencies = { ...defaultDependencies, ...dependencyOverrides };
   const normalizedWorkspacePath = input.workspacePath.trim();
   const normalizedGithubUrl = input.githubUrl.trim();
 
@@ -176,6 +232,25 @@ export async function startCloneProject(
     });
   }
 
+  // An http(s) string the URL parser rejects (a bad port, a space in the
+  // host) is one curl rejects too — but only after git has carried it, and
+  // any credential in it, on its command line.
+  if (/^https?:/i.test(normalizedGithubUrl) && !isParsableUrl(normalizedGithubUrl)) {
+    throw new AppError('Invalid githubUrl', {
+      code: 'INVALID_GITHUB_URL',
+      statusCode: 400,
+    });
+  }
+
+  if (carriesCredentials(normalizedGithubUrl)) {
+    // The token field is the only way in: a credential in the URL would ride
+    // git's argv, its stderr and the clone's `.git/config`.
+    throw new AppError('Put the token in the token field, not in the URL', {
+      code: 'GITHUB_URL_CARRIES_CREDENTIALS',
+      statusCode: 400,
+    });
+  }
+
   const pathValidation = await dependencies.validatePath(normalizedWorkspacePath);
   if (!pathValidation.valid || !pathValidation.resolvedPath) {
     throw new AppError(pathValidation.error || 'Invalid workspace path', {
@@ -225,22 +300,16 @@ export async function startCloneProject(
     );
   }
 
-  let cloneUrl = normalizedGithubUrl;
-  if (githubToken) {
-    try {
-      const url = new URL(normalizedGithubUrl);
-      url.username = githubToken;
-      url.password = '';
-      cloneUrl = url.toString();
-    } catch {
-      // SSH URLs cannot be represented by URL constructor and are used as-is.
-    }
-  }
-
   handlers.onProgress(`Cloning into '${repoName}'...`);
-  const gitProcess = dependencies.spawnGitClone(cloneUrl, clonePath);
+  const gitProcess = dependencies.spawnGitClone(
+    normalizedGithubUrl,
+    clonePath,
+    buildGitCloneEnvironment(githubToken),
+  );
   let lastError = '';
 
+  // `git clone --progress` writes every byte of its progress to stderr. Git
+  // was handed a credential-free URL, so each chunk is forwarded as it arrives.
   gitProcess.stdout?.on('data', (data: Buffer | string) => {
     const message = data.toString().trim();
     if (message) {
@@ -250,8 +319,8 @@ export async function startCloneProject(
 
   gitProcess.stderr?.on('data', (data: Buffer | string) => {
     const message = data.toString().trim();
-    lastError = message;
     if (message) {
+      lastError = message;
       handlers.onProgress(message);
     }
   });
@@ -277,8 +346,7 @@ export async function startCloneProject(
         return;
       }
 
-      const sanitizedError = sanitizeGitError(lastError, githubToken);
-      const errorMessage = resolveCloneFailureMessage(lastError, sanitizedError);
+      const errorMessage = resolveCloneFailureMessage(lastError);
 
       try {
         await dependencies.removePath(clonePath);

package/server/modules/projects/services/project-delete.service.ts

@@ -43,11 +43,23 @@ async function unlinkJsonlIfExists(filePath: string): Promise<void> {
  */
 export async function deleteSessionJsonlFilesForProjectPath(projectPath: string): Promise<void> {
   const sessions = sessionsDb.getSessionsByProjectPathIncludingArchived(projectPath);
-  const paths = uniqueJsonlPathsFromSessions(sessions);
+  // Including the transcripts a session has left behind: editing a message on
+  // a provider that rewinds by branching moves the session onto a copy, and
+  // the row stops pointing at the file the replaced turns are still in.
+  const paths = uniqueJsonlPathsFromSessions([
+    ...sessions,
+    ...sessions.flatMap((session) => sessionsDb
+      .getSupersededTranscriptPaths(session.session_id)
+      .map((jsonl_path) => ({ jsonl_path }))),
+  ]);
 
   for (const filePath of paths) {
     await unlinkJsonlIfExists(filePath);
   }
+
+  for (const session of sessions) {
+    sessionsDb.clearSupersededProviderSessions(session.session_id);
+  }
 }
 
 /**

package/server/modules/projects/services/project-star.service.ts

@@ -40,7 +40,7 @@ export function applyLegacyStarredProjectIds(projectIds: string[]): ApplyLegacyS
       continue;
     }
 
-    if (Boolean(project.isStarred)) {
+    if (project.isStarred) {
       continue;
     }
 
@@ -71,7 +71,7 @@ export function toggleProjectStar(projectId: string): ToggleProjectStarResult {
     });
   }
 
-  const nextStarredState = !Boolean(project.isStarred);
+  const nextStarredState = !project.isStarred;
   projectsDb.updateProjectIsStarredById(normalizedProjectId, nextStarredState);
 
   return { isStarred: nextStarredState };

package/server/modules/projects/tests/project-clone.routes.test.ts

@@ -0,0 +1,246 @@
+import assert from 'node:assert/strict';
+import { once } from 'node:events';
+import type { AddressInfo } from 'node:net';
+import test from 'node:test';
+
+import express, {
+  type NextFunction,
+  type Request,
+  type Response,
+} from 'express';
+
+import { createProjectCloneRouter } from '@/modules/projects/project-clone.routes.js';
+import { createPendingCloneRequests } from '@/modules/projects/services/project-clone-request.service.js';
+import type { startCloneProject } from '@/modules/projects/services/project-clone.service.js';
+import { AppError } from '@/shared/utils.js';
+
+type CloneRunner = typeof startCloneProject;
+type CloneInput = Parameters<CloneRunner>[0];
+
+/**
+ * A clone runner that reports one progress line and completes at once. What
+ * it was asked to clone is recorded so a test can check the request survived
+ * the POST -> claim -> run hand-off intact.
+ */
+function createFakeCloneRunner(inputs: CloneInput[]): CloneRunner {
+  return async (input, handlers) => {
+    inputs.push(input);
+    handlers.onProgress('Receiving objects: 100% (20/20), done.');
+    handlers.onComplete({ project: { projectId: 'project-1' }, message: 'Repository cloned successfully' });
+    return { waitForCompletion: Promise.resolve(), cancel: () => undefined };
+  };
+}
+
+const unexpectedCloneRunner: CloneRunner = async () => {
+  throw new Error('startCloneProject must not run before the progress stream is opened');
+};
+
+type ServerOptions = {
+  startCloneProject: CloneRunner;
+  pendingCloneTtlMs?: number;
+};
+
+// The auth middleware is mounted ahead of the router in production; here the
+// `x-user-id` header plays its part so a test can act as two different users.
+async function withProjectsServer(
+  options: ServerOptions,
+  run: (baseUrl: string) => Promise<void>,
+): Promise<void> {
+  const app = express();
+  app.use(express.json());
+  app.use((req: Request, _res: Response, next: NextFunction) => {
+    const userId = req.header('x-user-id');
+    if (userId) {
+      (req as Request & { user?: { id: number } }).user = { id: Number(userId) };
+    }
+    next();
+  });
+  app.use('/api/projects', createProjectCloneRouter({
+    startCloneProject: options.startCloneProject,
+    pendingCloneRequests: createPendingCloneRequests(options.pendingCloneTtlMs ?? 60_000),
+  }));
+  app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {
+    if (error instanceof AppError) {
+      res.status(error.statusCode).json({ error: error.code });
+      return;
+    }
+
+    res.status(500).json({ error: 'INTERNAL_ERROR' });
+  });
+
+  const server = app.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+
+  try {
+    const address = server.address() as AddressInfo;
+    await run(`http://127.0.0.1:${address.port}`);
+  } finally {
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    });
+  }
+}
+
+const cloneBody = {
+  path: '/workspace/root',
+  githubUrl: 'https://github.com/example/repo.git',
+  githubTokenId: null,
+  newGithubToken: 'ghp_supersecrettoken1234567890abcd',
+};
+
+async function postClone(baseUrl: string, userId: number, body: Record<string, unknown> = cloneBody) {
+  const response = await fetch(`${baseUrl}/api/projects/clone`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-user-id': String(userId) },
+    body: JSON.stringify(body),
+  });
+  return { status: response.status, body: await response.json() as { cloneId?: string; error?: string } };
+}
+
+async function openProgress(baseUrl: string, userId: number, cloneId: string) {
+  const response = await fetch(
+    `${baseUrl}/api/projects/clone-progress?cloneId=${encodeURIComponent(cloneId)}`,
+    { headers: { 'x-user-id': String(userId) } },
+  );
+  const text = await response.text();
+  const events = text
+    .split('\n\n')
+    .filter((frame) => frame.startsWith('data: '))
+    .map((frame) => JSON.parse(frame.slice('data: '.length)) as { type: string; message?: string });
+  return { status: response.status, contentType: response.headers.get('content-type') ?? '', text, events };
+}
+
+test('POST /clone parks the request under a fresh id without spawning anything', async () => {
+  await withProjectsServer({ startCloneProject: unexpectedCloneRunner }, async (baseUrl) => {
+    const first = await postClone(baseUrl, 1);
+    const second = await postClone(baseUrl, 1);
+
+    assert.equal(first.status, 200);
+    assert.match(first.body.cloneId ?? '', /^[0-9a-f-]{36}$/);
+    assert.notEqual(first.body.cloneId, second.body.cloneId);
+  });
+});
+
+test('POST /clone requires an authenticated user', async () => {
+  await withProjectsServer({ startCloneProject: unexpectedCloneRunner }, async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/projects/clone`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(cloneBody),
+    });
+
+    assert.equal(response.status, 401);
+  });
+});
+
+test('GET /clone-progress streams the clone the id names, then retires the id', async () => {
+  const inputs: CloneInput[] = [];
+  await withProjectsServer({ startCloneProject: createFakeCloneRunner(inputs) }, async (baseUrl) => {
+    const { body } = await postClone(baseUrl, 7, { ...cloneBody, githubTokenId: 12, newGithubToken: null });
+    assert.equal(inputs.length, 0, 'the POST alone must not start a clone');
+
+    const stream = await openProgress(baseUrl, 7, body.cloneId ?? '');
+
+    assert.equal(stream.status, 200);
+    assert.match(stream.contentType, /^text\/event-stream/);
+    assert.deepEqual(stream.events.map((event) => event.type), ['progress', 'complete']);
+    assert.equal(stream.events[0]?.message, 'Receiving objects: 100% (20/20), done.');
+    assert.deepEqual(inputs, [{
+      workspacePath: '/workspace/root',
+      githubUrl: 'https://github.com/example/repo.git',
+      githubTokenId: 12,
+      newGithubToken: null,
+      userId: 7,
+    }]);
+
+    const replay = await openProgress(baseUrl, 7, body.cloneId ?? '');
+    assert.equal(replay.status, 404, 'a claimed id must not run the clone twice');
+  });
+});
+
+test('GET /clone-progress hands the posted token to the clone without it touching the URL', async () => {
+  const inputs: CloneInput[] = [];
+  await withProjectsServer({ startCloneProject: createFakeCloneRunner(inputs) }, async (baseUrl) => {
+    const { body } = await postClone(baseUrl, 1);
+    const stream = await openProgress(baseUrl, 1, body.cloneId ?? '');
+
+    assert.equal(stream.status, 200);
+    assert.equal(inputs[0]?.newGithubToken, cloneBody.newGithubToken);
+    assert.ok(!(body.cloneId ?? '').includes(cloneBody.newGithubToken));
+  });
+});
+
+test('GET /clone-progress rejects an unknown id with 404', async () => {
+  await withProjectsServer({ startCloneProject: unexpectedCloneRunner }, async (baseUrl) => {
+    const stream = await openProgress(baseUrl, 1, 'not-a-clone-id');
+
+    assert.equal(stream.status, 404);
+    assert.deepEqual(JSON.parse(stream.text), { error: 'CLONE_REQUEST_NOT_FOUND' });
+  });
+});
+
+test('GET /clone-progress rejects another user id with 404 and keeps it for its owner', async () => {
+  const inputs: CloneInput[] = [];
+  await withProjectsServer({ startCloneProject: createFakeCloneRunner(inputs) }, async (baseUrl) => {
+    const { body } = await postClone(baseUrl, 1);
+
+    const foreign = await openProgress(baseUrl, 2, body.cloneId ?? '');
+    assert.equal(foreign.status, 404);
+    assert.equal(inputs.length, 0, 'a foreign claim must not run the clone');
+
+    const owner = await openProgress(baseUrl, 1, body.cloneId ?? '');
+    assert.equal(owner.status, 200);
+    assert.equal(inputs[0]?.userId, 1);
+  });
+});
+
+test('GET /clone-progress rejects an expired id with 404', async () => {
+  await withProjectsServer(
+    { startCloneProject: unexpectedCloneRunner, pendingCloneTtlMs: 20 },
+    async (baseUrl) => {
+      const { body } = await postClone(baseUrl, 1);
+      await new Promise((resolve) => setTimeout(resolve, 60));
+
+      const stream = await openProgress(baseUrl, 1, body.cloneId ?? '');
+      assert.equal(stream.status, 404);
+    },
+  );
+});
+
+test('GET /clone-progress cancels a clone whose client left before the git process existed', async () => {
+  // The close listener could only cancel an operation it already had; a
+  // client gone during validation left git cloning for nobody, under an id
+  // no reconnect could reach.
+  let releaseStart: () => void = () => undefined;
+  const started = new Promise<void>((resolve) => { releaseStart = resolve; });
+  let cancelled = 0;
+  let resolveRun: () => void = () => undefined;
+  const runFinished = new Promise<void>((resolve) => { resolveRun = resolve; });
+  const slowRunner: CloneRunner = async () => {
+    await started;
+    return {
+      waitForCompletion: new Promise<void>((resolve) => { setTimeout(resolve, 20); }).then(() => resolveRun()),
+      cancel: () => { cancelled += 1; },
+    };
+  };
+
+  await withProjectsServer({ startCloneProject: slowRunner }, async (baseUrl) => {
+    const { body } = await postClone(baseUrl, 1);
+    const controller = new AbortController();
+    const request = fetch(
+      `${baseUrl}/api/projects/clone-progress?cloneId=${encodeURIComponent(body.cloneId ?? '')}`,
+      { headers: { 'x-user-id': '1' }, signal: controller.signal },
+    );
+    // Headers are flushed before the runner is awaited; drop the client
+    // while the runner is still "validating".
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+    controller.abort();
+    await request.catch(() => undefined);
+    await new Promise((resolve) => { setTimeout(resolve, 50); });
+    assert.equal(cancelled, 0, 'nothing to cancel yet');
+
+    releaseStart();
+    await runFinished;
+    assert.equal(cancelled, 1, 'the operation is cancelled as soon as it exists');
+  });
+});