@danneillouven/remote-workspace 0.0.0-stage → 0.1.0

package/runtime/server/src/modules/exec/command-runner.js

@@ -0,0 +1,91 @@
+import { spawn } from 'node:child_process';
+import { AppError } from "../../lib/errors.js";
+import { buildShellCommand, quoteShellArg } from "../../lib/shell-quote.js";
+const DEFAULT_TIMEOUT_MS = 30_000;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Executes over SSH. The remote side always interprets exec requests with the
+ * user's login shell, so every argument is single-quoted; this assumes a
+ * POSIX-compatible login shell (bash, zsh, dash, ksh).
+ */
+export class SshCommandRunner {
+    #ssh;
+    constructor(ssh) {
+        this.#ssh = ssh;
+    }
+    async run(argv, options) {
+        const envArgs = Object.entries(options.env ?? {}).map(([name, value]) => {
+            if (!ENV_NAME.test(name))
+                throw new Error(`Invalid environment variable name: ${name}`);
+            return `${name}=${value}`;
+        });
+        const command = `cd -- ${quoteShellArg(options.cwd)} && exec ${buildShellCommand(['env', ...envArgs, ...argv])}`;
+        const result = await this.#ssh.exec(command, {
+            maxOutputBytes: options.maxOutputBytes,
+            timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            input: options.input,
+        });
+        return {
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr.toString('utf8'),
+            stdoutTruncated: result.stdoutTruncated,
+        };
+    }
+}
+/** Executes on the machine running the backend (WORKSPACE_BACKEND=local). */
+export class LocalCommandRunner {
+    run(argv, options) {
+        const [file, ...args] = argv;
+        if (!file)
+            return Promise.reject(new Error('Empty command'));
+        return new Promise((resolve, reject) => {
+            const child = spawn(file, args, {
+                cwd: options.cwd,
+                env: { ...process.env, ...options.env },
+                stdio: [options.input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+                timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            });
+            child.stdin?.on('error', () => undefined);
+            child.stdin?.end(options.input);
+            const stdout = [];
+            const stderr = [];
+            let stderrBytes = 0;
+            let stdoutBytes = 0;
+            let stdoutTruncated = false;
+            child.stdout.on('data', (chunk) => {
+                if (stdoutTruncated)
+                    return;
+                const room = options.maxOutputBytes - stdoutBytes;
+                if (chunk.length > room) {
+                    stdout.push(chunk.subarray(0, room));
+                    stdoutTruncated = true;
+                    child.kill();
+                    return;
+                }
+                stdout.push(chunk);
+                stdoutBytes += chunk.length;
+            });
+            child.stderr.on('data', (chunk) => {
+                const room = Math.max(0, options.maxOutputBytes - stderrBytes);
+                stderr.push(chunk.subarray(0, room));
+                stderrBytes += Math.min(chunk.length, room);
+                if (chunk.length > room)
+                    child.kill();
+            });
+            child.on('error', (error) => {
+                if (error.code === 'ENOENT')
+                    resolve({ exitCode: 127, stdout: Buffer.alloc(0), stderr: `${file}: command not found`, stdoutTruncated });
+                else
+                    reject(error);
+            });
+            child.on('close', (code, signal) => {
+                if (signal === 'SIGTERM' && !stdoutTruncated) {
+                    reject(new AppError('TIMEOUT', 'Command timed out.'));
+                    return;
+                }
+                resolve({ exitCode: code, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr).toString('utf8'), stdoutTruncated });
+            });
+        });
+    }
+}

package/runtime/server/src/modules/filesystem/file-system-driver.js

@@ -0,0 +1 @@
+export {};

package/runtime/server/src/modules/filesystem/local-driver.js

@@ -0,0 +1,95 @@
+import { constants } from 'node:fs';
+import { copyFile, lstat, mkdir, open, readdir, realpath, rename, rmdir, stat, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { mapWithConcurrency } from "../../lib/concurrency.js";
+import { AppError } from "../../lib/errors.js";
+function toFileStat(stats) {
+    let type = 'other';
+    if (stats.isSymbolicLink())
+        type = 'symlink';
+    else if (stats.isDirectory())
+        type = 'directory';
+    else if (stats.isFile())
+        type = 'file';
+    return { type, size: stats.size, mtimeMs: Math.round(stats.mtimeMs) };
+}
+function mapError(error) {
+    const code = error.code;
+    if (code === 'ENOENT' || code === 'ENOTDIR')
+        throw new AppError('NOT_FOUND', 'File or directory not found.', { cause: error });
+    if (code === 'EACCES' || code === 'EPERM')
+        throw new AppError('PERMISSION_DENIED', 'Permission denied.', { cause: error });
+    if (code === 'ELOOP')
+        throw new AppError('BAD_REQUEST', 'Too many levels of symbolic links.', { cause: error });
+    if (code === 'EEXIST' || code === 'ENOTEMPTY')
+        throw new AppError('CONFLICT', 'A file or folder with that name already exists.', { cause: error });
+    throw error;
+}
+/** Filesystem access on the machine running the backend. */
+export class LocalFileSystemDriver {
+    async realpath(absolutePath) {
+        return realpath(absolutePath).catch(mapError);
+    }
+    async stat(absolutePath) {
+        return toFileStat(await stat(absolutePath).catch(mapError));
+    }
+    async readdir(absolutePath) {
+        const names = await readdir(absolutePath).catch(mapError);
+        const entries = await mapWithConcurrency(names, 32, async (name) => {
+            try {
+                return { name, stat: toFileStat(await lstat(path.join(absolutePath, name))) };
+            }
+            catch {
+                // Entry vanished between readdir and lstat.
+                return null;
+            }
+        });
+        return entries.filter((entry) => entry !== null);
+    }
+    async readFile(absolutePath, maxBytes) {
+        const handle = await open(absolutePath, 'r').catch(mapError);
+        try {
+            const buffer = Buffer.alloc(maxBytes);
+            let total = 0;
+            while (total < maxBytes) {
+                const { bytesRead } = await handle.read(buffer, total, maxBytes - total, total);
+                if (bytesRead === 0)
+                    break;
+                total += bytesRead;
+            }
+            return buffer.subarray(0, total);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async writeFile(absolutePath, data) {
+        await writeFile(absolutePath, data).catch(mapError);
+    }
+    async createReadStream(absolutePath, { start, end }) {
+        // Open first so a missing file is an AppError, not a stream error after the headers went out.
+        const handle = await open(absolutePath, 'r').catch(mapError);
+        return handle.createReadStream({ start, end, autoClose: true });
+    }
+    async lstat(absolutePath) {
+        return toFileStat(await lstat(absolutePath).catch(mapError));
+    }
+    async mkdir(absolutePath) {
+        await mkdir(absolutePath).catch(mapError);
+    }
+    async createFile(absolutePath) {
+        await writeFile(absolutePath, '', { flag: 'wx' }).catch(mapError);
+    }
+    async copyFile(sourcePath, destinationPath) {
+        await copyFile(sourcePath, destinationPath, constants.COPYFILE_EXCL).catch(mapError);
+    }
+    async rename(sourcePath, destinationPath) {
+        await rename(sourcePath, destinationPath).catch(mapError);
+    }
+    async unlink(absolutePath) {
+        await unlink(absolutePath).catch(mapError);
+    }
+    async rmdir(absolutePath) {
+        await rmdir(absolutePath).catch(mapError);
+    }
+}

package/runtime/server/src/modules/filesystem/restricted-driver.js

@@ -0,0 +1,114 @@
+import path from 'node:path';
+import { mapWithConcurrency } from "../../lib/concurrency.js";
+import { AppError } from "../../lib/errors.js";
+import { isWithinRoot } from "./workspace-path.js";
+const unavailable = () => new AppError('FORBIDDEN', 'This folder is unavailable to Remote Workspace. Ask the administrator to configure permitted workspace roots.');
+/** Applies administrator policy to every filesystem primitive, including recursive copies/deletes. */
+export class RestrictedFileSystemDriver {
+    #driver;
+    #roots;
+    #protectedPaths;
+    #resolvedRoots = null;
+    #protectedSnapshot = null;
+    constructor(driver, roots, protectedPaths = () => []) {
+        this.#driver = driver;
+        this.#roots = roots;
+        this.#protectedPaths = protectedPaths;
+    }
+    async #canonical(candidate) {
+        try {
+            return await this.#driver.realpath(candidate);
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || error.code !== 'NOT_FOUND')
+                throw error;
+            const parent = path.posix.dirname(candidate);
+            if (parent === candidate)
+                throw error;
+            return path.posix.join(await this.#canonical(parent), path.posix.basename(candidate));
+        }
+    }
+    async #protected() {
+        const protectedPaths = this.#protectedPaths();
+        const signature = JSON.stringify(protectedPaths);
+        if (this.#protectedSnapshot?.signature !== signature) {
+            const paths = Promise.all(protectedPaths.map((item) => this.#canonical(item))).then((canonical) => [...protectedPaths, ...canonical]);
+            this.#protectedSnapshot = { signature, paths };
+        }
+        return this.#protectedSnapshot.paths;
+    }
+    async check(candidate) {
+        if (!path.posix.isAbsolute(candidate) || candidate.includes('\0') || this.#roots.length === 0)
+            throw unavailable();
+        const normalized = path.posix.normalize(candidate);
+        const canonical = await this.#canonical(normalized);
+        // A protected name remains protected even when it has been replaced by a symlink.
+        if ([normalized, canonical].some((item) => item.split('/').includes('.ssh')))
+            throw unavailable();
+        const protectedPaths = await this.#protected();
+        if (protectedPaths.some((item) => isWithinRoot(item, normalized) || isWithinRoot(item, canonical)))
+            throw unavailable();
+        // Pin canonical roots for this driver. Replacing an allowed root symlink cannot broaden access.
+        this.#resolvedRoots ??= Promise.all(this.#roots.map((root) => this.#driver.realpath(root).catch(() => null)));
+        const roots = await this.#resolvedRoots;
+        if (!roots.some((root) => root !== null && isWithinRoot(root, canonical)))
+            throw unavailable();
+        return canonical;
+    }
+    async checkWorkspace(root) {
+        const canonical = await this.check(root);
+        // A project must not contain backend secrets, since recursive tools could expose them.
+        if ((await this.#protected()).some((item) => isWithinRoot(canonical, item)))
+            throw unavailable();
+        return canonical;
+    }
+    async roots() {
+        const entries = [];
+        for (const root of this.#roots) {
+            try {
+                const canonical = await this.check(root);
+                const stat = await this.#driver.stat(canonical);
+                if (stat.type === 'directory')
+                    entries.push({ name: canonical, stat });
+            }
+            catch {
+                // Missing or protected roots never appear in the picker.
+            }
+        }
+        return entries;
+    }
+    async realpath(candidate) { return this.#driver.realpath(await this.check(candidate)); }
+    async stat(candidate) { return this.#driver.stat(await this.check(candidate)); }
+    async lstat(candidate) { await this.check(candidate); return this.#driver.lstat(candidate); }
+    async readdir(candidate) {
+        const canonical = await this.check(candidate);
+        const entries = await this.#driver.readdir(canonical);
+        const checked = await mapWithConcurrency(entries, 16, async (entry) => {
+            try {
+                await this.check(path.posix.join(canonical, entry.name));
+                return entry;
+            }
+            catch {
+                return null;
+            }
+        });
+        return checked.filter((entry) => entry !== null);
+    }
+    async readFile(candidate, maxBytes) { return this.#driver.readFile(await this.check(candidate), maxBytes); }
+    async writeFile(candidate, data) { return this.#driver.writeFile(await this.check(candidate), data); }
+    async createReadStream(candidate, range) { return this.#driver.createReadStream(await this.check(candidate), range); }
+    async mkdir(candidate) { return this.#driver.mkdir(await this.check(candidate)); }
+    async createFile(candidate) { return this.#driver.createFile(await this.check(candidate)); }
+    async copyFile(source, destination) {
+        const from = await this.check(source);
+        const to = await this.check(destination);
+        return this.#driver.copyFile(from, to);
+    }
+    async rename(source, destination) {
+        await this.check(source);
+        await this.check(destination);
+        return this.#driver.rename(source, destination);
+    }
+    async unlink(candidate) { await this.check(candidate); return this.#driver.unlink(candidate); }
+    async rmdir(candidate) { return this.#driver.rmdir(await this.check(candidate)); }
+}

package/runtime/server/src/modules/filesystem/sftp-driver.js

@@ -0,0 +1,105 @@
+import { pipeline } from 'node:stream/promises';
+import { AppError } from "../../lib/errors.js";
+// SFTP status codes (draft-ietf-secsh-filexfer-02).
+const SFTP_NO_SUCH_FILE = 2;
+const SFTP_PERMISSION_DENIED = 3;
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFREG = 0o100000;
+const S_IFLNK = 0o120000;
+function toFileStat(attrs) {
+    const format = attrs.mode & S_IFMT;
+    let type = 'other';
+    if (format === S_IFLNK)
+        type = 'symlink';
+    else if (format === S_IFDIR)
+        type = 'directory';
+    else if (format === S_IFREG)
+        type = 'file';
+    return { type, size: attrs.size, mtimeMs: attrs.mtime ? attrs.mtime * 1000 : null };
+}
+function toAppError(error) {
+    if (error instanceof AppError)
+        return error;
+    if (error.code === SFTP_NO_SUCH_FILE)
+        return new AppError('NOT_FOUND', 'File or directory not found.', { cause: error });
+    if (error.code === SFTP_PERMISSION_DENIED)
+        return new AppError('PERMISSION_DENIED', 'Permission denied.', { cause: error });
+    return new AppError('REMOTE_UNAVAILABLE', 'Remote filesystem operation failed.', { cause: error });
+}
+/** Remote filesystem access over the shared SFTP session. */
+export class SftpFileSystemDriver {
+    #ssh;
+    constructor(ssh) {
+        this.#ssh = ssh;
+    }
+    async #call(operation) {
+        const sftp = await this.#ssh.getSftp();
+        return new Promise((resolve, reject) => {
+            operation(sftp, (error, value) => (error ? reject(toAppError(error)) : resolve(value)));
+        });
+    }
+    // OpenSSH's sftp-server resolves symlinks in realpath (it calls realpath(3)).
+    realpath(absolutePath) {
+        return this.#call((sftp, done) => sftp.realpath(absolutePath, done));
+    }
+    async stat(absolutePath) {
+        return toFileStat(await this.#call((sftp, done) => sftp.stat(absolutePath, done)));
+    }
+    async readdir(absolutePath) {
+        const list = await this.#call((sftp, done) => sftp.readdir(absolutePath, done));
+        return list
+            .filter((entry) => entry.filename !== '.' && entry.filename !== '..')
+            .map((entry) => ({ name: entry.filename, stat: toFileStat(entry.attrs) }));
+    }
+    async readFile(absolutePath, maxBytes) {
+        const sftp = await this.#ssh.getSftp();
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let total = 0;
+            const stream = sftp.createReadStream(absolutePath, { start: 0, end: maxBytes - 1 });
+            stream.on('data', (chunk) => {
+                chunks.push(chunk);
+                total += chunk.length;
+            });
+            stream.on('error', (error) => reject(toAppError(error)));
+            stream.on('end', () => resolve(Buffer.concat(chunks, total)));
+        });
+    }
+    async writeFile(absolutePath, data) {
+        await this.#call((sftp, done) => sftp.writeFile(absolutePath, data, (error) => done(error, undefined)));
+    }
+    async createReadStream(absolutePath, { start, end }) {
+        const sftp = await this.#ssh.getSftp();
+        return sftp.createReadStream(absolutePath, { start, end });
+    }
+    async lstat(absolutePath) {
+        return toFileStat(await this.#call((sftp, done) => sftp.lstat(absolutePath, done)));
+    }
+    async mkdir(absolutePath) {
+        await this.#call((sftp, done) => sftp.mkdir(absolutePath, (error) => done(error, undefined)));
+    }
+    async createFile(absolutePath) {
+        const handle = await this.#call((sftp, done) => sftp.open(absolutePath, 'wx', done));
+        await this.#call((sftp, done) => sftp.close(handle, (error) => done(error, undefined)));
+    }
+    async copyFile(sourcePath, destinationPath) {
+        // SFTP v3 has no server-side copy: stream the bytes through this process.
+        const sftp = await this.#ssh.getSftp();
+        try {
+            await pipeline(sftp.createReadStream(sourcePath), sftp.createWriteStream(destinationPath, { flags: 'wx' }));
+        }
+        catch (error) {
+            throw toAppError(error);
+        }
+    }
+    async rename(sourcePath, destinationPath) {
+        await this.#call((sftp, done) => sftp.rename(sourcePath, destinationPath, (error) => done(error, undefined)));
+    }
+    async unlink(absolutePath) {
+        await this.#call((sftp, done) => sftp.unlink(absolutePath, (error) => done(error, undefined)));
+    }
+    async rmdir(absolutePath) {
+        await this.#call((sftp, done) => sftp.rmdir(absolutePath, (error) => done(error, undefined)));
+    }
+}