@davesheffer/hunch 1.41.5 → 1.42.0

package/dist/integrations/team.js

@@ -6,12 +6,13 @@
  * Written ONLY by `hunch shared --repo <url>` — `hunch private` never publishes its URL.
  */
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { writeFileAtomic } from "../core/io.js";
+import { machineFile } from "../core/machine.js";
 import { hunchTreeAttributesAreSafe, safeOverlayGitTreeListing, safeOverlayTree } from "../core/overlaySafety.js";
 import { hunchPaths, hunchPathsForDir } from "../core/paths.js";
-import { canonicalRemoteUrl, gitNullDevice, mainWorktreeRoot, sameRemoteUrl } from "../extractors/git.js";
+import { canonicalRemoteUrl, checkoutCommonDir, gitNullDevice, mainWorktreeRoot, sameFilesystemEntry, sameRemoteUrl } from "../extractors/git.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { JsonStore } from "../store/jsonStore.js";
 import { ensureSharedOverlayPointer } from "./worktree.js";
@@ -43,8 +44,8 @@ export function teamSharedRef(team) {
     return team.shared_ref ?? DEFAULT_TEAM_REF;
 }
 /** SECURITY GATE for team.json's URL. team.json is COMMITTED — in a freshly cloned
- *  (possibly untrusted) repo it is attacker-controlled, and ensureTeamOverlay auto-clones
- *  it on MCP server start. Without this gate a value like `--upload-pack=…` (argument
+ *  (possibly untrusted) repo it is attacker-controlled, and every consumer parses and
+ *  compares it before the user's trust is checked. Without this gate a value like `--upload-pack=…` (argument
  *  smuggling) or `ext::sh -c …` (git's ext transport) is remote code execution from
  *  merely opening a repo. Allow only credential-free https://, ssh://, git://,
  *  scp-style git@host:path, and never anything that could parse as a Git flag. */
@@ -57,10 +58,15 @@ export function safeGitUrl(url) {
     // an inevitably incomplete list of token/password parameter names.
     if (/[?#]/.test(u))
         return null;
-    // A plain absolute path (POSIX / Windows drive / UNC) — a network-mount team store or a
-    // local test remote. Safe: a local clone never executes hooks or remote helpers. The
-    // file:// URL FORM stays rejected (no legitimate team.json uses it; keeps the gate tight).
-    if (u.startsWith("/") || /^[A-Za-z]:[\\/]/.test(u) || u.startsWith("\\\\"))
+    // A network path (`\\host\share`, `//host/share`, `\\?\UNC\…`, and any mix of the
+    // two separators) is not local: on Windows, merely resolving or comparing it contacts
+    // and authenticates to the named host. Reject every form before any consumer touches it.
+    if (/^[\\/]{2}/.test(u))
+        return null;
+    // A plain absolute path (POSIX / Windows drive) — a mounted team store or a local test
+    // remote. Safe: a local clone never executes hooks or remote helpers. The file:// URL
+    // FORM stays rejected (no legitimate team.json uses it; keeps the gate tight).
+    if (u.startsWith("/") || /^[A-Za-z]:[\\/]/.test(u))
         return u;
     // SCP syntax carries an SSH account name, not an embedded authentication secret.
     // Its deliberately narrow account/host grammar cannot encode a password delimiter.
@@ -461,12 +467,19 @@ function checkoutIsolatedEnv() {
         GIT_ATTR_NOSYSTEM: "1",
     };
 }
+/** Bound for each post-clone validation spawn: 2s by default, widened (never
+ *  narrowed) by HUNCH_TEAM_CLONE_TIMEOUT_MS so slow disks or loaded CI do not turn a
+ *  valid clone into a validation failure. */
+function teamValidationTimeout() {
+    const override = teamCloneTimeoutOverride();
+    return override === undefined ? 2_000 : Math.max(2_000, override);
+}
 function exactCommit(root, revision, env) {
     const result = spawnSync("git", ["-C", root, "rev-parse", "--verify", `${revision}^{commit}`], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         env,
-        timeout: 2_000,
+        timeout: teamValidationTimeout(),
     });
     const oid = result.status === 0 ? result.stdout.trim() : "";
     return {
@@ -479,7 +492,7 @@ function exactTreeListing(root, oid, env) {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         env,
-        timeout: 2_000,
+        timeout: teamValidationTimeout(),
         maxBuffer: 64 * 1024 * 1024,
     });
     return result.status === 0 && safeOverlayGitTreeListing(result.stdout) ? result.stdout : null;
@@ -489,7 +502,7 @@ function repositoryHasNoRefs(root, env) {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         env,
-        timeout: 2_000,
+        timeout: teamValidationTimeout(),
     });
     return result.status === 0 && result.stdout.trim() === "";
 }
@@ -499,7 +512,7 @@ function treeAttributesAreSafe(root, listing, env) {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "ignore"],
             env,
-            timeout: 2_000,
+            timeout: teamValidationTimeout(),
             maxBuffer: 4 * 1024 * 1024,
         });
         return blob.status === 0 ? blob.stdout : null;
@@ -572,7 +585,7 @@ function materializeValidatedClone(team, teamRoot, overlayRoot, emptyHooks) {
     ], {
         stdio: "ignore",
         env,
-        timeout: 5_000,
+        timeout: Math.max(5_000, teamCloneTimeoutOverride() ?? 0),
     });
     if (reset.status !== 0) {
         reportTeamCloneFailure("materialize-reset", reset);
@@ -594,6 +607,16 @@ function materializeValidatedClone(team, teamRoot, overlayRoot, emptyHooks) {
     }
     return safe ? { sharedRef, empty: false } : null;
 }
+/** HUNCH_TEAM_CLONE_TIMEOUT_MS: a per-process override for every team-store clone
+ *  and materialization timeout (default: the caller's own bound). For slow disks,
+ *  networks, or heavily parallel CI; ignored unless a positive integer. */
+export function teamCloneTimeoutOverride() {
+    const raw = process.env.HUNCH_TEAM_CLONE_TIMEOUT_MS?.trim();
+    if (!raw || !/^\d+$/.test(raw))
+        return undefined;
+    const value = Number(raw);
+    return value > 0 ? Math.min(600_000, value) : undefined;
+}
 /** Clone a shared memory repository without checking out attacker-controlled
  * paths, validate its exact route/OID/tree/attributes, and only then publish the
  * fully materialized clone at `destination`. Failure removes both quarantine and
@@ -606,9 +629,10 @@ export function cloneValidatedTeamOverlay(sharedRepo, sharedRepoCwd, destination
         return null;
     }
     const requestedTimeout = opts.timeoutMs ?? 5_000;
-    const timeoutMs = Number.isFinite(requestedTimeout)
+    const defaultTimeoutMs = Number.isFinite(requestedTimeout)
         ? Math.min(30_000, Math.max(1, Math.trunc(requestedTimeout)))
         : 5_000;
+    const timeoutMs = Math.max(defaultTimeoutMs, teamCloneTimeoutOverride() ?? 0);
     const parent = dirname(destination);
     const prefix = basename(destination);
     let stagedDest = "";
@@ -682,12 +706,120 @@ export function cloneValidatedTeamOverlay(sharedRepo, sharedRepoCwd, destination
             rmSync(destination, { recursive: true, force: true });
     }
 }
+/** Local consent for team auto-wiring. team.json is COMMITTED, so its URL is chosen
+ *  by whoever wrote the repository, not by this user, and wiring it means cloning that
+ *  remote, reading its records as memory, and pushing captures to it. The consent lives
+ *  OUTSIDE every repository (beside machine.json), keyed by this checkout's main
+ *  worktree and the exact advertised URL: a changed URL needs fresh consent, and no
+ *  repository content can grant it. */
+const TEAM_TRUST_MAX_BYTES = 256 * 1024;
+export function teamTrustFile() {
+    return join(dirname(machineFile()), "team-trust.json");
+}
+function teamTrustKey(root) {
+    // Anchored through checkoutCommonDir so a `.git` file cannot borrow another checkout's key.
+    const common = checkoutCommonDir(root);
+    return realpathSync(common && basename(common) === ".git" ? dirname(common) : root);
+}
+/** The parsed consent file. Absent → empty; unreadable or malformed → null, which
+ *  callers treat as "nothing trusted" and writers refuse to clobber. */
+function readTeamTrust(file) {
+    let raw;
+    try {
+        const stat = lstatSync(file);
+        if (!stat.isFile() || stat.size > TEAM_TRUST_MAX_BYTES)
+            return null;
+        raw = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? { version: 1, stores: {} } : null;
+    }
+    try {
+        const value = JSON.parse(raw);
+        if (value.version !== 1 || !value.stores || typeof value.stores !== "object" || Array.isArray(value.stores))
+            return null;
+        return { version: 1, stores: value.stores };
+    }
+    catch {
+        return null;
+    }
+}
+export function isTeamStoreTrusted(root, team) {
+    try {
+        const entry = readTeamTrust(teamTrustFile())?.stores[teamTrustKey(root)];
+        return !!entry && typeof entry.shared_repo === "string" && entry.shared_repo === team.shared_repo;
+    }
+    catch {
+        return false;
+    }
+}
+/** Record this user's explicit consent to wire `root` to `team.shared_repo`. Returns an
+ *  undo that removes only THIS checkout's key (restoring its prior entry if one existed),
+ *  never the whole file byte-for-byte: another checkout's concurrent trust write must
+ *  survive the undo. The file is deleted only if it ends up empty and did not exist
+ *  before, so a caller can make consent conditional on a later step. */
+export function trustTeamStore(root, team) {
+    const sharedRepo = safeGitUrl(team.shared_repo);
+    if (!sharedRepo)
+        throw new Error("refusing to trust an unsafe team repository URL");
+    const file = teamTrustFile();
+    const current = readTeamTrust(file);
+    if (!current)
+        throw new Error(`refusing to overwrite unreadable team trust file: ${file}`);
+    // readTeamTrust proved the file is absent or a plain, bounded, parseable file.
+    const fileExistedBefore = existsSync(file);
+    const key = teamTrustKey(root);
+    const priorEntry = current.stores[key];
+    current.stores[key] = { shared_repo: sharedRepo, trusted_at: new Date().toISOString() };
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileAtomic(file, JSON.stringify(current, null, 2) + "\n");
+    return () => {
+        const latest = readTeamTrust(file);
+        if (!latest)
+            return; // file went missing or unreadable out from under us: nothing safe to undo
+        if (priorEntry)
+            latest.stores[key] = priorEntry;
+        else
+            delete latest.stores[key];
+        if (Object.keys(latest.stores).length === 0 && !fileExistedBefore) {
+            rmSync(file, { force: true });
+            return;
+        }
+        writeFileAtomic(file, JSON.stringify(latest, null, 2) + "\n");
+    };
+}
+/** Whether this user consented to `root` using `privateDir` as the advertised team
+ *  store. The per-worktree `.hunch/local.json` alone proves nothing: a repository can
+ *  ship one that points at another checkout's store. Consent is an explicit trust
+ *  entry, or the git-common-dir pointer that only this machine's own setup writes
+ *  (a git clone never delivers the source's `.git`; an archive that ships its own `.git`
+ *  already ships hooks that run on the next git command), naming the same store. */
+export function teamWiringConsented(root, team, privateDir) {
+    if (isTeamStoreTrusted(root, team))
+        return true;
+    try {
+        const common = checkoutCommonDir(root);
+        if (!common)
+            return false;
+        const pointer = JSON.parse(readFileSync(join(common, "hunch", "local.json"), "utf8"));
+        return typeof pointer.privateDir === "string" && isAbsolute(pointer.privateDir)
+            && sameFilesystemEntry(pointer.privateDir, privateDir);
+    }
+    catch {
+        return false;
+    }
+}
+export function untrustedTeamStoreMessage(team) {
+    return `.hunch/team.json advertises a shared memory store (${team.shared_repo}) that you have not trusted on this machine. ` +
+        "Connecting would clone it, serve its records as memory, and push your captures to it. " +
+        "If this is your team's store, run `hunch shared --trust`; otherwise leave it untrusted.";
+}
 /** Auto-wire this checkout to the team's shared store advertised in `.hunch/team.json`:
  *  clone it to the worktree-stable anchor, and register the gitignored local pointer +
  *  the git-common-dir pointer (mode "shared", auto-commit on) so every consumer — CLI,
  *  MCP server, hooks, all worktrees — resolves the same single source of truth.
- *  No-op (null) when an overlay is already configured, there's no team.json, or the
- *  clone fails (best-effort: never throws, never blocks startup). Returns the overlay
+ *  No-op (null) when an overlay is already configured, there's no team.json, this user
+ *  has not trusted its URL (see trustTeamStore), or the clone fails (best-effort: never throws, never blocks startup). Returns the overlay
  *  hunch dir when wired. */
 export function ensureTeamOverlay(root) {
     try {
@@ -705,12 +837,18 @@ export function ensureTeamOverlay(root) {
             // an existing pointer as a total no-op would leave those teams permanently
             // vulnerable until they deleted and recloned their memory.
             const configuredRoot = join(configured, "..");
+            if (!teamWiringConsented(root, team, configured))
+                return null;
             if (!overlayMatchesTeamRemote(root, configuredRoot))
                 return null;
             installMergeDriver(configuredRoot, resolveInvocation().shell);
             ensureGitignore(configuredRoot);
             return null; // already wired and alive
         }
+        // Everything below creates NEW wiring (a clone, or adopting a pre-existing
+        // directory), so it needs this user's explicit consent to the advertised URL.
+        if (!isTeamStoreTrusted(root, team))
+            return null;
         const anchor = mainWorktreeRoot(root);
         const dest = join(anchor, ".hunch-private");
         if (!existsSync(dest)) {

package/dist/integrations/worktree.d.ts

@@ -4,5 +4,6 @@
  *  Carries the overlay MODE so every worktree routes captures identically (shared =
  *  unified store, private = split). Returns true once the shared pointer is in place
  *  (memory is worktree-shared), false when there's no overlay configured or no git
- *  common dir. Reused by `init`/`worktree`/`private`/`shared`. */
-export declare function ensureSharedOverlayPointer(root: string, overlayDir: string | undefined, autoCommit: boolean, mode?: "private" | "shared"): boolean;
+ *  common dir. Reused by `init`/`worktree`/`private`/`shared`, which pass
+ *  `claimSeparateGitDirLayout` (see claimSeparateGitDir). */
+export declare function ensureSharedOverlayPointer(root: string, overlayDir: string | undefined, autoCommit: boolean, mode?: "private" | "shared", claimSeparateGitDirLayout?: boolean): boolean;

package/dist/integrations/worktree.js

@@ -6,7 +6,7 @@
  */
 import { existsSync, readFileSync, mkdirSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { gitCommonDir } from "../extractors/git.js";
+import { checkoutCommonDir, claimSeparateGitDir } from "../extractors/git.js";
 import { writeFileAtomic } from "../core/io.js";
 /** Register the resolved private overlay at the shared git common dir, so every worktree
  *  of this repo auto-discovers the same memory. Idempotent (writes only when missing or
@@ -14,9 +14,12 @@ import { writeFileAtomic } from "../core/io.js";
  *  Carries the overlay MODE so every worktree routes captures identically (shared =
  *  unified store, private = split). Returns true once the shared pointer is in place
  *  (memory is worktree-shared), false when there's no overlay configured or no git
- *  common dir. Reused by `init`/`worktree`/`private`/`shared`. */
-export function ensureSharedOverlayPointer(root, overlayDir, autoCommit, mode = "private") {
-    const common = overlayDir ? gitCommonDir(root) : "";
+ *  common dir. Reused by `init`/`worktree`/`private`/`shared`, which pass
+ *  `claimSeparateGitDirLayout` (see claimSeparateGitDir). */
+export function ensureSharedOverlayPointer(root, overlayDir, autoCommit, mode = "private", claimSeparateGitDirLayout = false) {
+    // Only an explicit setup command the user ran in this checkout may claim a
+    // `git init --separate-git-dir` layout — never a store open or team auto-wiring.
+    const common = overlayDir ? checkoutCommonDir(root) || (claimSeparateGitDirLayout ? claimSeparateGitDir(root) : "") : "";
     if (!common || !overlayDir)
         return false;
     const file = join(common, "hunch", "local.json");