@dotobokuri/fleet-console 1.39.0 → 1.41.0

package/dist/fleet-plugins/repository/routes.mjs

@@ -8,12 +8,12 @@ import fs2 from 'fs/promises';
 function definePlugin(definition) {
   return definition;
 }
-function registerRouter(ctx, path9, handler) {
-  ctx.registerRouter(normalizePath(path9), handler);
+function registerRouter(ctx, path10, handler) {
+  ctx.registerRouter(normalizePath(path10), handler);
 }
-function normalizePath(path9) {
-  if (path9.length === 0 || path9 === "/") return "/";
-  return path9;
+function normalizePath(path10) {
+  if (path10.length === 0 || path10 === "/") return "/";
+  return path10;
 }
 
 // ../../packages/core-process/src/hidden.ts
@@ -36,9 +36,25 @@ var GitExecutorError = class extends Error {
 };
 var DEFAULT_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_BUFFER = 8 * 1024 * 1024;
+var STDERR_MAX_BUFFER = 1024 * 1024;
+var GIT_HARDENING_PREFIX = ["-c", "core.fsmonitor=false", "--no-optional-locks"];
+function sanitizeGitEnvironment(environment) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(environment)) {
+    const normalizedKey = key.toUpperCase();
+    if (normalizedKey.startsWith("GIT_") || normalizedKey === "LC_ALL" || normalizedKey === "SSH_ASKPASS" || normalizedKey === "SSH_ASKPASS_REQUIRE") continue;
+    if (value !== void 0) sanitized[key] = value;
+  }
+  sanitized.GIT_OPTIONAL_LOCKS = "0";
+  sanitized.GIT_TERMINAL_PROMPT = "0";
+  sanitized.GIT_ALLOW_PROTOCOL = "ssh:git:http:https:file";
+  sanitized.LC_ALL = "C";
+  return sanitized;
+}
 function runGit(args, opts) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
+  const hardenedArgs = [...GIT_HARDENING_PREFIX, ...args];
   return new Promise((resolve, reject) => {
     if (opts.signal?.aborted) {
       reject(new GitExecutorError("timeout"));
@@ -46,7 +62,11 @@ function runGit(args, opts) {
     }
     let child;
     try {
-      child = spawn("git", args, withHidden({ cwd: opts.cwd, shell: false }));
+      child = spawn("git", hardenedArgs, withHidden({
+        cwd: opts.cwd,
+        env: sanitizeGitEnvironment(process.env),
+        shell: false
+      }));
     } catch (error) {
       const code = error.code === "ENOENT" ? "git_unavailable" : "spawn_failed";
       reject(new GitExecutorError(code, String(error)));
@@ -55,7 +75,9 @@ function runGit(args, opts) {
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutLen = 0;
+    let stderrLen = 0;
     let truncated = false;
+    let stderrTruncated = false;
     let timedOut = false;
     const abort = () => {
       timedOut = true;
@@ -83,7 +105,16 @@ function runGit(args, opts) {
       }
     });
     child.stderr.on("data", (chunk) => {
-      stderrChunks.push(chunk);
+      if (stderrTruncated) return;
+      const remaining = STDERR_MAX_BUFFER - stderrLen;
+      if (chunk.length >= remaining) {
+        stderrChunks.push(chunk.subarray(0, remaining));
+        stderrLen += remaining;
+        stderrTruncated = true;
+      } else {
+        stderrChunks.push(chunk);
+        stderrLen += chunk.length;
+      }
     });
     child.on("error", (error) => {
       cleanup();
@@ -97,7 +128,7 @@ function runGit(args, opts) {
       if (code !== 0) {
         if (code !== null && (opts.allowExitCodes?.includes(code) ?? false)) {
           const stdout2 = Buffer.concat(stdoutChunks).toString("utf8");
-          resolve({ stdout: stdout2, truncated });
+          resolve({ stdout: stdout2, stderr, truncated, stderrTruncated });
           return;
         }
         const isNoRepo = stderr.toLowerCase().includes("not a git repository");
@@ -105,7 +136,7 @@ function runGit(args, opts) {
         return;
       }
       const stdout = Buffer.concat(stdoutChunks).toString("utf8");
-      resolve({ stdout, truncated });
+      resolve({ stdout, stderr, truncated, stderrTruncated });
     });
   });
 }
@@ -796,10 +827,232 @@ async function handleRepositoryCompareFile(req, res, ctx) {
     throw error;
   }
 }
+var AUTO_FETCH_THROTTLE_MS = 3e5;
+var autoFetchInFlight = /* @__PURE__ */ new Map();
+var lastSuccessfulFetchAt = /* @__PURE__ */ new Map();
+function isPlainObject6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function classifyFetchError(stderr) {
+  if (/permission denied|authentication failed|could not read username|terminal prompts disabled|repository not found/i.test(stderr)) {
+    return "auth_failed";
+  }
+  if (/could not resolve host|failed to connect|connection (refused|reset)|operation timed out|network is unreachable/i.test(stderr)) {
+    return "network";
+  }
+  if (/no remote repository specified|does not appear to be a git repository/i.test(stderr)) {
+    return "no_remote";
+  }
+  return null;
+}
+async function resolveGitIdentity(gitCwd) {
+  const [gitDirResult, commonDirResult] = await Promise.all([
+    runGit(["rev-parse", "--absolute-git-dir"], { cwd: gitCwd }),
+    runGit(["rev-parse", "--git-common-dir"], { cwd: gitCwd })
+  ]);
+  const [gitDir, commonDir] = await Promise.all([
+    fs2.realpath(path4.resolve(gitCwd, gitDirResult.stdout.trim())),
+    fs2.realpath(path4.resolve(gitCwd, commonDirResult.stdout.trim()))
+  ]);
+  return { gitDir, commonDir };
+}
+async function readLastFetchAt(gitDirs) {
+  let newest = null;
+  for (const gitDir of gitDirs) {
+    try {
+      const stats = await fs2.stat(path4.join(gitDir, "FETCH_HEAD"));
+      if (stats.size === 0) continue;
+      if (!newest || stats.mtime.getTime() > newest.getTime()) newest = stats.mtime;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return newest;
+}
+function countFetchProgress(stderr, marker) {
+  return stderr.split(/\r?\n/).filter((line) => line.includes(marker)).length;
+}
+function countFetchUpdatedRefs(stderr) {
+  return stderr.split(/\r?\n/).filter(
+    (line) => line.includes(" -> ") && /\S+\.\.\S+/.test(line) && !line.includes("[deleted]") && !line.includes("[new ")
+  ).length;
+}
+var NoRemoteError = class extends Error {
+};
+var SAFE_CREDENTIAL_HELPERS = /* @__PURE__ */ new Set([
+  "cache",
+  "store",
+  "osxkeychain",
+  "wincred",
+  "libsecret",
+  "gnome-libsecret",
+  "manager",
+  "manager-core"
+]);
+async function resolveCredentialHelperArgs(gitCwd) {
+  const raw = (await runGit(["config", "--get-all", "credential.helper"], { cwd: gitCwd, allowExitCodes: [1] })).stdout;
+  const helpers = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const kept = helpers.filter((helper) => {
+    if (!/^[A-Za-z0-9-]+$/.test(helper)) return false;
+    return SAFE_CREDENTIAL_HELPERS.has(helper) || SAFE_CREDENTIAL_HELPERS.has(helper.replace(/^git-credential-/, ""));
+  });
+  return ["-c", "credential.helper=", ...kept.flatMap((helper) => ["-c", `credential.helper=${helper}`]), "-c", "core.askPass="];
+}
+async function resolveDefaultRemote(gitCwd) {
+  const branch = (await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: gitCwd })).stdout.trim();
+  if (branch && branch !== "HEAD") {
+    const upstream = (await runGit(["config", "--get", `branch.${branch}.remote`], { cwd: gitCwd, allowExitCodes: [1] })).stdout.trim();
+    if (upstream && upstream !== ".") return upstream;
+  }
+  const remotes = (await runGit(["remote"], { cwd: gitCwd })).stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (remotes.includes("origin")) return "origin";
+  return remotes[0] ?? null;
+}
+async function readThrottleResult(gitDirs, commonDir) {
+  const fsNewest = await readLastFetchAt(gitDirs);
+  const recorded = lastSuccessfulFetchAt.get(commonDir);
+  let newest = fsNewest;
+  if (recorded !== void 0 && (!newest || recorded > newest.getTime())) newest = new Date(recorded);
+  if (!newest || Date.now() - newest.getTime() >= AUTO_FETCH_THROTTLE_MS) return null;
+  return { ok: true, skipped: "throttled", lastFetchAt: newest.toISOString() };
+}
+async function fetchRepository(gitCwd) {
+  const remote = await resolveDefaultRemote(gitCwd);
+  if (!remote) throw new NoRemoteError();
+  const credentialArgs = await resolveCredentialHelperArgs(gitCwd);
+  const result = await runGit([
+    "-c",
+    "core.sshCommand=ssh",
+    "-c",
+    // git 예약어 none만 프록시 우회다 — 다른 값은 프록시 "명령"으로 실행된다.
+    "core.gitProxy=none",
+    "-c",
+    // protocol.allow=user는 ext를 never에서 허용으로 뒤집는다(GIT_PROTOCOL_FROM_USER unset) —
+    // 기본 정책을 유지한 채 실행형 transport만 명시 차단한다.
+    "protocol.ext.allow=never",
+    "-c",
+    // ref transaction 훅(reference-transaction 등)의 zero-click 실행을 플랫폼 널 장치로 차단한다.
+    `core.hooksPath=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
+    ...credentialArgs,
+    "fetch",
+    remote,
+    // 명시 refspec이 configured refspec을 대체한다 — prune의 파괴 범위를
+    // refs/remotes/<remote>/ 아래로 고정해 로컬 refs를 보호한다.
+    `+refs/heads/*:refs/remotes/${remote}/*`,
+    // repo config의 remote.<name>.uploadpack이 로컬 transport에서 명령 실행되므로 표준 명령을 강제한다.
+    "--upload-pack=git-upload-pack",
+    // 하드닝된 상위 fetch를 빠져나가는 재귀(중첩 네트워크+하위 upload-pack)를 끊는다.
+    "--no-recurse-submodules",
+    "--prune",
+    "--no-tags",
+    // fetch.pruneTags=true인 저장소가 --prune과 결합해 로컬 전용 태그를 지우는 것을 막는다.
+    "--no-prune-tags"
+  ], { cwd: gitCwd });
+  const fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    ok: true,
+    fetchedAt,
+    lastFetchAt: fetchedAt,
+    pruned: countFetchProgress(result.stderr, " - [deleted] "),
+    newRefs: countFetchProgress(result.stderr, " * [new branch] "),
+    updatedRefs: countFetchUpdatedRefs(result.stderr)
+  };
+}
+async function fetchHeadCandidates(identity) {
+  const candidates = /* @__PURE__ */ new Set([identity.gitDir, identity.commonDir]);
+  try {
+    const worktreesDir = path4.join(identity.commonDir, "worktrees");
+    for (const entry of await fs2.readdir(worktreesDir, { withFileTypes: true })) {
+      if (entry.isDirectory()) candidates.add(path4.join(worktreesDir, entry.name));
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  return [...candidates];
+}
+async function runAutoFetch(gitCwd, identity) {
+  const throttled = await readThrottleResult(await fetchHeadCandidates(identity), identity.commonDir);
+  return throttled ?? fetchRepository(gitCwd);
+}
+async function fetchAutoSingleFlight(gitCwd, identity) {
+  const key = identity.commonDir;
+  const existing = autoFetchInFlight.get(key);
+  if (existing) {
+    await existing;
+    const throttled = await readThrottleResult(await fetchHeadCandidates(identity), identity.commonDir);
+    if (throttled) return throttled;
+  }
+  const operation = runAutoFetch(gitCwd, identity);
+  autoFetchInFlight.set(key, operation);
+  try {
+    return await operation;
+  } finally {
+    if (autoFetchInFlight.get(key) === operation) autoFetchInFlight.delete(key);
+  }
+}
+async function handleRepositoryFetch(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject6(body) || "subPath" in body || typeof body.theaterId !== "string" || body.mode !== void 0 && body.mode !== "auto") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(body.theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  let gitCwd;
+  try {
+    ({ gitCwd } = await resolveGitCwd(theaterPath, body.repoRel));
+  } catch (error) {
+    if (error instanceof InvalidRepoError) {
+      ctx.host.http.writeJson(res, 400, { error: error.code });
+      return;
+    }
+    throw error;
+  }
+  try {
+    const identity = await resolveGitIdentity(gitCwd);
+    const result = body.mode === "auto" ? await fetchAutoSingleFlight(gitCwd, identity) : await (autoFetchInFlight.get(identity.commonDir) ?? fetchRepository(gitCwd));
+    if ("fetchedAt" in result) lastSuccessfulFetchAt.set(identity.commonDir, Date.parse(result.fetchedAt));
+    ctx.host.http.writeJson(res, 200, result);
+  } catch (error) {
+    if (error instanceof NoRemoteError) {
+      ctx.host.http.writeJson(res, 422, { error: "no_remote" });
+      return;
+    }
+    if (error instanceof GitExecutorError) {
+      if (error.code === "timeout") {
+        ctx.host.http.writeJson(res, 422, { error: "timeout" });
+        return;
+      }
+      const classified = classifyFetchError(error.stderr);
+      if (classified) {
+        ctx.host.http.writeJson(res, 422, { error: classified });
+        return;
+      }
+      if (error.code === "no_git_repo" || error.code === "git_unavailable") {
+        ctx.host.http.writeJson(res, 422, { error: error.code });
+        return;
+      }
+      ctx.host.http.writeJson(res, 500, { error: "git_failed" });
+      return;
+    }
+    throw error;
+  }
+}
 var WORKTREE_SHA_RE = /^[0-9a-f]{40}$/;
 var CANONICAL_REF_RE = /^refs\/(?:heads|remotes|tags)\//;
 var REF_METACHAR_RE = /[~^:?*\[\\\s\x00-\x1f\x7f]/;
-function isPlainObject6(value) {
+function isPlainObject7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isCanonicalRepositoryRef(ref) {
@@ -924,7 +1177,7 @@ async function handleRepositoryLog(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject6(body) || "subPath" in body) {
+  if (!isPlainObject7(body) || "subPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -1092,7 +1345,7 @@ var HARD_CAP_DEPTH = 8;
 var NESTED_BRANCH_CAP = 64;
 var SCAN_VISIT_BUDGET = 1e4;
 var DEFAULT_DEPTH = 3;
-function isPlainObject7(value) {
+function isPlainObject8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function resolveRepoBranch(repoDir) {
@@ -1181,7 +1434,7 @@ async function handleRepositoryRepos(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject7(body) || typeof body.theaterId !== "string") {
+  if (!isPlainObject8(body) || typeof body.theaterId !== "string") {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -1260,7 +1513,7 @@ async function handleRepositorySearch(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject8(body) || typeof body.theaterId !== "string" || typeof body.query !== "string" || body.query.trim() === "" || !Number.isInteger(body.limit) || body.limit < 1 || body.limit > 8 || "subPath" in body || "ref" in body) {
+  if (!isPlainObject9(body) || typeof body.theaterId !== "string" || typeof body.query !== "string" || body.query.trim() === "" || !Number.isInteger(body.limit) || body.limit < 1 || body.limit > 8 || "subPath" in body || "ref" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -1314,10 +1567,10 @@ async function handleRepositorySearch(req, res, ctx) {
     throw error;
   }
 }
-function isPlainObject8(value) {
+function isPlainObject9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isPlainObject9(value) {
+function isPlainObject10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function handleRepositoryWorktrees(req, res, ctx) {
@@ -1330,7 +1583,7 @@ async function handleRepositoryWorktrees(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject9(body) || "subPath" in body || typeof body.theaterId !== "string") {
+  if (!isPlainObject10(body) || "subPath" in body || typeof body.theaterId !== "string") {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -1411,6 +1664,10 @@ var routes_default = definePlugin({
       await handleRepositoryChanged(req, res, ctx);
       return true;
     });
+    registerRouter(ctx, "fetch", async ({ req, res }) => {
+      await handleRepositoryFetch(req, res, ctx);
+      return true;
+    });
     registerRouter(ctx, "file", async ({ req, res }) => {
       await handleRepositoryFile(req, res, ctx);
       return true;