@codyswann/lisa 4.72.6 → 4.73.0

package/all/copy-overwrite/scripts/lib/npm-update-rails-mysql.mjs

@@ -0,0 +1,220 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** The one authenticated Rails profile uses exactly four fixed test databases. */
+import { realpathSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { required } from "./npm-update-contract.mjs";
+import { runtimeSchemas } from "./npm-update-rails-runtime-contract.mjs";
+import { runtimeTime } from "./npm-update-rails-tool-identity.mjs";
+import { runProcess } from "./npm-update-process-core.mjs";
+import {
+  openMysqlResource,
+  assertMysqlRoot,
+  mysqlFailure,
+} from "./npm-update-rails-mysql-resource.mjs";
+
+const APPLICATION_KEYS = new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "TZ",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "NPM_CONFIG_USERCONFIG",
+  "NPM_CONFIG_GLOBALCONFIG",
+  "NPM_CONFIG_CACHE",
+  "NPM_CONFIG_REGISTRY",
+  "NPM_CONFIG_AUDIT",
+  "NPM_CONFIG_FUND",
+  "NPM_CONFIG_UPDATE_NOTIFIER",
+  "NPM_CONFIG_IGNORE_SCRIPTS",
+  "GIT_TERMINAL_PROMPT",
+  "BUNDLE_PATH",
+  "BUNDLE_APP_CONFIG",
+  "BUNDLE_FROZEN",
+  "BUNDLER_VERSION",
+  "BUNDLE_SILENCE_ROOT_WARNING",
+  "GEM_HOME",
+  "GEM_PATH",
+]);
+
+/** Readiness is a real authenticated SQL query; query refusal never becomes ready. */
+async function waitReady(resource, deadline) {
+  for (;;) {
+    runtimeTime(deadline);
+    try {
+      required(
+        (await resource.query("SELECT 1, @@partial_revokes;\n")) === "1\t1\n",
+        "MySQL fixed privilege mode differs"
+      );
+      return;
+    } catch (error) {
+      if (error.code === null || error.code === undefined) throw error;
+      runtimeTime(deadline);
+      await new Promise(resolve =>
+        setTimeout(resolve, Math.min(200, runtimeTime(deadline)))
+      );
+    }
+  }
+}
+
+/** Only local schema privileges are granted; underscores are literal under the checked fixed mode. */
+function grantSql(schemas, user, password) {
+  const statements = [
+    `CREATE USER '${user}'@'%' IDENTIFIED BY '${password}';`,
+    ...schemas.flatMap(name => [
+      `CREATE DATABASE \`${name}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;`,
+      `GRANT ALL PRIVILEGES ON \`${name}\`.* TO '${user}'@'%';`,
+    ]),
+  ];
+  return `${statements.join("\n")}\n`;
+}
+
+/** The least-privilege account, not administrator metadata alone, reaches every role. */
+async function verifySchemas(resource, schemas, user) {
+  const grants = (
+    await resource.query("SHOW GRANTS FOR CURRENT_USER();\n", true)
+  )
+    .trim()
+    .split("\n");
+  const account = `\`${user}\`@\`%\``;
+  const expected = [
+    `GRANT USAGE ON *.* TO ${account}`,
+    ...schemas.map(
+      name => `GRANT ALL PRIVILEGES ON \`${name}\`.* TO ${account}`
+    ),
+  ].sort();
+  required(
+    grants.sort().join("\n") === expected.join("\n"),
+    "MySQL account schema privileges differ"
+  );
+  const selected = schemas.map(name => `'${name}'`).join(",");
+  const rows = await resource.query(
+    `SELECT SCHEMA_NAME, DEFAULT_CHARACTER_SET_NAME, DEFAULT_COLLATION_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME IN (${selected}) ORDER BY SCHEMA_NAME;\n`,
+    true
+  );
+  required(
+    rows.trim().split("\n").sort().join("\n") ===
+      schemas
+        .map(name => `${name}\tutf8mb4\tutf8mb4_0900_ai_ci`)
+        .sort()
+        .join("\n"),
+    "MySQL four-schema readback differs"
+  );
+  for (const name of schemas)
+    required(
+      (await resource.query(`USE \`${name}\`; SELECT 1;\n`, true)) === "1\n",
+      "MySQL role access readback differs"
+    );
+}
+
+/** Empty administrator-created databases cannot masquerade as Rails schema preparation. */
+async function verifyPreparedSchemas(resource, schemas) {
+  const selected = schemas.map(name => `'${name}'`).join(",");
+  const rows = await resource.query(
+    `SELECT TABLE_SCHEMA, TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA IN (${selected}) AND TABLE_NAME IN ('ar_internal_metadata','schema_migrations') ORDER BY TABLE_SCHEMA, TABLE_NAME;\n`,
+    true
+  );
+  const expected = schemas
+    .flatMap(name =>
+      ["ar_internal_metadata", "schema_migrations"].map(
+        table => `${name}\t${table}`
+      )
+    )
+    .sort();
+  required(
+    rows.trim().split("\n").sort().join("\n") === expected.join("\n"),
+    "MySQL prepared four-schema metadata differs"
+  );
+}
+
+/** Caller-authenticated profile and frozen Bundler must precede this fixed resource lifecycle. */
+export async function openRailsMysqlRuntime(
+  { cwd, root, deadline, profile, docker },
+  env
+) {
+  const schemas = runtimeSchemas({ runtime: profile });
+  runtimeTime(deadline);
+  assertMysqlRoot(root);
+  required(realpathSync(cwd) === cwd, "MySQL application cwd is aliased");
+  required(
+    env &&
+      Object.keys(env).every(name => APPLICATION_KEYS.has(name)) &&
+      Object.values(env).every(value => typeof value === "string") &&
+      env.BUNDLE_FROZEN === "true",
+    "MySQL application environment is not closed frozen Bundler data"
+  );
+  required(
+    env.BUNDLER_VERSION === "2.4.10",
+    "MySQL Bundler version is not qualified"
+  );
+  const user = `lisa_${randomBytes(12).toString("hex")}`;
+  const password = randomBytes(32).toString("hex");
+  const resource = await openMysqlResource({
+    root,
+    deadline,
+    docker,
+    user,
+    password,
+  });
+  let prepared = false;
+  const environment = Object.freeze({
+    ...env,
+    DATABASE_NAME: profile.database,
+    DATABASE_USER: user,
+    DATABASE_PASSWORD: password,
+    DATABASE_PORT: resource.state.port,
+    PRIMARY_DB_HOST: "127.0.0.1",
+    DATABASE_REPLICA_HOST: "127.0.0.1",
+    DATABASE_SSL: "false",
+    DATABASE_IAM_AUTH: "false",
+    RAILS_ENV: "test",
+    RACK_ENV: "test",
+  });
+  try {
+    await waitReady(resource, deadline);
+    await resource.query(grantSql(schemas, user, password));
+    await verifySchemas(resource, schemas, user);
+  } catch (error) {
+    try {
+      await resource.close();
+    } catch (cleanup) {
+      throw new AggregateError(
+        [error, cleanup],
+        "MySQL readiness and cleanup failed",
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+  return {
+    env: environment,
+    async prepareSchemas() {
+      required(!resource.state.closed, "MySQL runtime is closed");
+      try {
+        await runProcess("bundle", ["exec", "rails", "db:prepare"], {
+          cwd,
+          env: environment,
+          timeout: runtimeTime(deadline, 1800000),
+          maximum: 3145728,
+        });
+      } catch (error) {
+        throw mysqlFailure(error, "Rails prepare");
+      }
+      await verifySchemas(resource, schemas, user);
+      await verifyPreparedSchemas(resource, schemas);
+      prepared = true;
+    },
+    close: resource.close,
+    get receipt() {
+      return Object.freeze({
+        ...resource.state,
+        schemas: [...schemas],
+        prepared,
+      });
+    },
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-rails-runtime-contract.mjs

@@ -0,0 +1,75 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Closed committed runtime data cannot select commands, credentials or tool versions. */
+import { keys, required } from "./npm-update-invariants.mjs";
+import { canonicalJson } from "./automation-provenance-contract.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+
+/** Explicit absence preserves the historical npm-only contract byte for byte. */
+export function railsRuntime(policy) {
+  if (!Object.hasOwn(policy, "runtime")) return undefined;
+  const value = policy.runtime;
+  keys(value, ["profile", "database", "browser", "dockerFixtures"]);
+  required(
+    value.profile === "rails-mysql" &&
+      typeof value.database === "string" &&
+      /^[a-z][a-z0-9_]{0,40}$/.test(value.database) &&
+      typeof value.browser === "boolean" &&
+      typeof value.dockerFixtures === "boolean",
+    "unsupported closed Rails runtime profile"
+  );
+  return structuredClone(value);
+}
+
+/** All four finite fields enter the signed proposal, independently of caller inputs. */
+export function runtimeBinding(policy) {
+  const value = railsRuntime(policy);
+  return value === undefined
+    ? {}
+    : { runtimeSha256: sha256(canonicalJson(value)) };
+}
+
+/** Four role names have one bounded ASCII base; no SQL or environment keys are accepted. */
+export function runtimeSchemas(policy) {
+  const value = railsRuntime(policy);
+  required(value !== undefined, "Rails runtime profile is absent");
+  return ["test", "queue_test", "cache_test", "cable_test"].map(
+    suffix => `${value.database}_${suffix}`
+  );
+}
+
+/** Original committed policy must affirm a descriptor's optional runtime authority. */
+export function assertRuntimeBinding(value, policy) {
+  const expected = runtimeBinding(policy);
+  required(
+    Object.hasOwn(value, "runtimeSha256") ===
+      Object.hasOwn(expected, "runtimeSha256") &&
+      value.runtimeSha256 === expected.runtimeSha256,
+    "original committed Rails runtime differs"
+  );
+}
+
+/** The finite workflow selector can only affirm the already signed committed choice. */
+export function affirmRuntimeProfile(value, policy, input) {
+  assertRuntimeBinding(value, policy);
+  const runtime = railsRuntime(policy);
+  required(
+    input === (runtime?.profile ?? "none"),
+    "caller Rails runtime affirmation differs"
+  );
+  return runtime;
+}
+
+/** Current native HEAD, including genuine absence, selects the sole original runtime policy. */
+export function assertCommittedRuntime(value, git) {
+  const entry = git(["ls-tree", "HEAD", "--", ".lisa.config.json"]);
+  required(
+    entry === "" ||
+      /^100644 blob [a-f0-9]{40}\t\.lisa\.config\.json$/.test(entry),
+    "original runtime configuration is not regular"
+  );
+  const original =
+    entry === "" ? {} : JSON.parse(git(["show", "HEAD:.lisa.config.json"]));
+  assertRuntimeBinding(value, original.npmUpdater ?? {});
+}

package/all/copy-overwrite/scripts/lib/npm-update-rails-tool-downloads.mjs

@@ -0,0 +1,187 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Fixed official archives are authenticated before any member becomes executable. */
+import {
+  constants,
+  openSync,
+  closeSync,
+  writeSync,
+  fsyncSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+} from "node:fs";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { required } from "./npm-update-contract.mjs";
+
+const VERSION = "154.0.8037.92";
+
+/** The verified browser paths enter a finite compatibility environment, never arbitrary policy keys. */
+export function railsBrowserEnvironment(chrome, driver, sandbox) {
+  return {
+    CHROME_BINARY: chrome,
+    CHROME_BIN: chrome,
+    CHROMEDRIVER: driver,
+    CHROME_DEVEL_SANDBOX: sandbox,
+  };
+}
+
+const DOWNLOADS = Object.freeze({
+  docker: {
+    url: "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz",
+    sha256: "995d1ef289677f74fd58d8d2c35727b6a4ee389c69db8638a3e42d0487aa5b0f",
+    binary: "6f7a95d27f98fc8c5f6b220898988bf8f61dd9b040936797917cbdc72c6cabe6",
+  },
+  compose: {
+    url: "https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-x86_64",
+    sha256: "40343e21ca777173e69cff5dbafeb37c6f81f3b0d57d9e597f036e95eb63e76a",
+  },
+  buildx: {
+    url: "https://github.com/docker/buildx/releases/download/v0.38.0/buildx-v0.38.0.linux-amd64",
+    sha256: "4fe4cc38adf48169132749b6ca22a990928db0118e3407584ee553723115d287",
+  },
+  chrome: {
+    url: `https://storage.googleapis.com/chrome-for-testing-public/${VERSION}/linux64/chrome-linux64.zip`,
+    sha256: "ff43322f335e436b2f4dcdfeeec5db032299e335a7e8c1c618b326e100ce8732",
+    binary: "439f367a9a24dde467dca9c4e4c2feedd3266899c5a8e3eb17b68b05d4da9f5f",
+    sandbox: "24beb85e4149c65db5bf40fa307721143d0883ab8952e60dde1158606f644dee",
+  },
+  chromedriver: {
+    url: `https://storage.googleapis.com/chrome-for-testing-public/${VERSION}/linux64/chromedriver-linux64.zip`,
+    sha256: "cc99c87cfd10e1da1b7d42ea9800a211df279f5a47c19a55b02c927cb9f606c2",
+    binary: "83dad64578afcd2036c3c31d02fd9e01efdd957ac45dd1de7c97b061ace9d6dc",
+  },
+});
+
+/** Exact pinned archive bytes are rechecked through a private no-follow descriptor before extraction. */
+export function assertRailsArchive(name, file) {
+  required(
+    Object.hasOwn(DOWNLOADS, name) && realpathSync(file) === file,
+    "fixed vendor archive identity differs"
+  );
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    required(
+      st.isFile() &&
+        st.nlink === 1 &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0 &&
+        st.size > 0 &&
+        st.size <= 250000000,
+      "fixed vendor archive is not private owned data"
+    );
+    required(
+      createHash("sha256").update(readFileSync(fd)).digest("hex") ===
+        DOWNLOADS[name].sha256,
+      "fixed vendor archive integrity differs"
+    );
+    const current = lstatSync(file);
+    required(
+      current.dev === st.dev &&
+        current.ino === st.ino &&
+        !current.isSymbolicLink(),
+      "fixed vendor archive ownership changed"
+    );
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** The exclusive descriptor receives bounded vendor bytes; an existing leaf is never overwritten. */
+export async function downloadRailsTool(name, root, deadline) {
+  required(
+    Object.hasOwn(DOWNLOADS, name),
+    "unsupported fixed runtime download"
+  );
+  const remaining = deadline - Date.now();
+  required(
+    Number.isSafeInteger(deadline) && remaining > 0 && remaining <= 1800000,
+    "original runtime download deadline is absent or expired"
+  );
+  const file = join(root, `${name}.archive`);
+  const fd = openSync(
+    file,
+    constants.O_WRONLY |
+      constants.O_CREAT |
+      constants.O_EXCL |
+      constants.O_NOFOLLOW,
+    0o600
+  );
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(),
+    Math.min(remaining, 60000)
+  );
+  const digest = createHash("sha256");
+  let size = 0;
+  try {
+    const response = await fetch(DOWNLOADS[name].url, {
+      signal: controller.signal,
+    });
+    required(
+      response.ok && response.body && response.url.startsWith("https://"),
+      "fixed vendor download failed"
+    );
+    for await (const part of response.body) {
+      size += part.length;
+      required(size <= 250000000, "fixed vendor download exceeds bound");
+      digest.update(part);
+      let offset = 0;
+      while (offset < part.length) offset += writeSync(fd, part, offset);
+    }
+    fsyncSync(fd);
+    required(
+      size > 0 && digest.digest("hex") === DOWNLOADS[name].sha256,
+      "fixed vendor download integrity differs"
+    );
+    const st = fstatSync(fd);
+    const current = lstatSync(file);
+    required(
+      st.isFile() &&
+        st.nlink === 1 &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0 &&
+        current.dev === st.dev &&
+        current.ino === st.ino &&
+        !current.isSymbolicLink(),
+      "fixed vendor download ownership changed"
+    );
+    return { file, ...DOWNLOADS[name] };
+  } finally {
+    clearTimeout(timer);
+    closeSync(fd);
+  }
+}
+
+/** Only an authenticated ZIP's fixed prefix is extracted into a newly owned empty directory. */
+export async function extractRailsBrowser(name, archive, root, step) {
+  required(
+    name === "chrome" || name === "chromedriver",
+    "unsupported fixed browser archive"
+  );
+  assertRailsArchive(name, archive);
+  const prefix = `${name}-linux64/`;
+  const listing = await step("/usr/bin/unzip", ["-Z1", archive]);
+  const names = listing.stdout.toString().trimEnd().split("\n");
+  required(
+    names.length > 0 &&
+      names.length <= 400 &&
+      names.every(
+        value =>
+          value.startsWith(prefix) &&
+          !/[\0\r\\]/.test(value) &&
+          !value.split("/").some(part => part === ".." || part === ".") &&
+          /^[a-zA-Z0-9_./-]+$/.test(value)
+      ),
+    "fixed browser archive member differs"
+  );
+  const target = join(root, name);
+  mkdirSync(target, { mode: 0o700 });
+  await step("/usr/bin/unzip", ["-q", archive, "-d", target]);
+  return join(target, prefix, name);
+}