@dsh-cc/plugin-cc-grok-bridge 0.8.1

package/scripts/lib/home.mjs

@@ -0,0 +1,240 @@
+/**
+ * Shadow-state primitives for the cc-grok-bridge launcher (§3.1 steps 5–6):
+ * canonical per-cwd state home under a uid-suffixed canonical-tmpdir
+ * subroot, fail-loud ownership/mode validation, a single-flight lock with
+ * heartbeat (NO signal/exit handlers inside this module — the launcher owns
+ * the lifecycle and receives a sync `release()`), the D14 allowlist sweep
+ * (runs BEFORE the credential sync), the D19 nofollow atomic credential
+ * sync of `auth.json` only, and the D10 child-env builder.
+ */
+import {
+  closeSync,
+  constants as fsConstants,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  realpathSync,
+  utimesSync,
+  writeFileSync,
+  writeSync,
+  fsyncSync,
+} from 'node:fs'
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import os from 'node:os'
+import path from 'node:path'
+
+const LOCK_STALE_MS = 6 * 60 * 60 * 1000
+
+/**
+ * R = <canonical tmpdir>/grok-review-home-<uid>, H = R/sha256(realpath(cwd))
+ * (canonicalize FIRST — macOS /var and /tmp are symlinks and every
+ * path-boundary comparison is against canonical realpaths).
+ */
+export function homePaths({ cwd = process.cwd(), tmpdir = os.tmpdir() } = {}) {
+  const tmp = realpathSync(tmpdir)
+  const R = path.join(tmp, `grok-review-home-${process.getuid()}`)
+  const H = path.join(
+    R,
+    createHash('sha256').update(realpathSync(cwd)).digest('hex').slice(0, 16),
+  )
+  return { tmp, R, H }
+}
+
+function assertOwnPrivateDir(dir, label) {
+  const st = lstatSync(dir) // throws if missing → fail loud
+  if (st.isSymbolicLink()) throw new Error(`${label} ${dir} is a symlink`)
+  if (!st.isDirectory()) throw new Error(`${label} ${dir} is not a directory`)
+  if (st.uid !== process.getuid()) throw new Error(`${label} ${dir} is not owned by the current uid`)
+  if ((st.mode & 0o777) !== 0o700) throw new Error(`${label} ${dir} mode is not 0700`)
+}
+
+/**
+ * Parent chain: only directories-that-are-not-symlinks are checked — a
+ * root-owned /tmp is normal and must not fail.
+ */
+function assertPlainAncestor(dir) {
+  const st = lstatSync(dir)
+  if (st.isSymbolicLink()) throw new Error(`parent ${dir} is a symlink`)
+  if (!st.isDirectory()) throw new Error(`parent ${dir} is not a directory`)
+}
+
+/** mkdir -m 0700 R and H, then lstat-validate both. */
+export function prepareHome(opts = {}) {
+  const { tmp, R, H } = homePaths(opts)
+  let parent = path.dirname(R)
+  while (parent !== path.dirname(parent)) {
+    assertPlainAncestor(parent)
+    parent = path.dirname(parent)
+  }
+  mkdirSync(R, { mode: 0o700, recursive: true })
+  assertOwnPrivateDir(R, 'state subroot')
+  mkdirSync(H, { mode: 0o700, recursive: true })
+  assertOwnPrivateDir(H, 'workspace home')
+  return { tmp, R, H }
+}
+
+/**
+ * Acquire the single-flight lock `mkdir H/.lock`. Carries an owner nonce,
+ * is heartbeat-touched while held, stale (>6h mtime) is reclaimed. This is
+ * an accidental-concurrency guard for cooperative callers, NOT an
+ * adversarial cost cap — a same-UID process can always delete it or run
+ * grok directly. NO signal/exit handlers are wired here (D18): the
+ * launcher registers its own lifecycle and calls the returned sync
+ * `release()` in its finalize path.
+ */
+export function acquireLock(H) {
+  const lockDir = path.join(H, '.lock')
+  try {
+    mkdirSync(lockDir, { mode: 0o700 })
+  } catch {
+    const st = lstatSync(lockDir)
+    if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+      rmSync(lockDir, { recursive: true, force: true })
+      mkdirSync(lockDir, { mode: 0o700 })
+    } else {
+      throw new Error(`another launch holds ${lockDir} (not stale)`)
+    }
+  }
+  writeFileSync(path.join(lockDir, 'owner'), `${randomUUID()}\n`, { mode: 0o600 })
+  const heartbeat = setInterval(() => {
+    try {
+      utimesSync(lockDir, new Date(), new Date())
+    } catch {
+      /* lock vanished underneath us — release will notice too */
+    }
+  }, 60_000)
+  heartbeat.unref() // hygiene handle: never keep a process alive by itself
+  let released = false
+  return () => {
+    if (released) return
+    released = true
+    clearInterval(heartbeat)
+    try {
+      rmSync(lockDir, { recursive: true, force: true })
+    } catch {
+      /* best-effort */
+    }
+  }
+}
+
+/**
+ * D14 allowlist sweep (probe P13): enumerate H's children; keep EXACTLY
+ * `auth.json`, `sessions`, `.lock`; remove (recursive force) everything
+ * else. Kept names are lstat-type-validated: `sessions` absent-or-real-dir,
+ * `auth.json` absent-or-regular-file — symlink/foreign types are removed.
+ * Any sweep failure is fail-closed (throws — the sweep is a security
+ * control, not hygiene).
+ */
+export function sweepHome(H) {
+  for (const name of readdirSync(H)) {
+    if (name === '.lock') continue
+    const p = path.join(H, name)
+    if (name === 'auth.json' || name === 'sessions') {
+      let st
+      try {
+        st = lstatSync(p)
+      } catch {
+        continue // vanished between readdir and lstat — nothing to sweep
+      }
+      const valid = name === 'sessions' ? st.isDirectory() : st.isFile()
+      if (valid && !st.isSymbolicLink()) continue
+    }
+    rmSync(p, { recursive: true, force: true })
+  }
+}
+
+/**
+ * D19 credential sync inside the lock: ONLY `auth.json`, source
+ * `os.homedir()/.grok/auth.json`. Source lstat regular-file → O_NOFOLLOW
+ * open → fstat THAT fd for regular-file again → write H/.tmp-<random> 0600
+ * → fsync → atomic rename (overwrite). Source errors in
+ * {ENOENT, ENOTDIR, EACCES, EPERM} ⇒ missing/unreadable class: DELETE the
+ * shadow copy and warn on stderr ONLY when ambient XAI_API_KEY is unset;
+ * any other error aborts (throws).
+ *
+ * Source home is os.homedir() — POSIX honors $HOME, which is the test seam.
+ */
+const MISSING_CLASS = new Set(['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM'])
+
+const fsIo = {
+  lstatSync,
+  openSync,
+  fstatSync,
+  readFileSync,
+  writeSync,
+  closeSync,
+  fsyncSync,
+  renameSync,
+  rmSync,
+}
+
+/**
+ * `io` injects the fs-level ops (unit-test seam: post-open fstat swap,
+ * .tmp residue on rename failure); production default is the real fs.
+ */
+export function syncCredentials(H, { home = os.homedir(), env = process.env, warn = (m) => console.error(m), io = fsIo } = {}) {
+  const src = path.join(home, '.grok', 'auth.json')
+  const dst = path.join(H, 'auth.json')
+  let st
+  try {
+    st = io.lstatSync(src)
+  } catch (e) {
+    if (MISSING_CLASS.has(e?.code)) {
+      io.rmSync(dst, { force: true })
+      if (!env.XAI_API_KEY) {
+        warn(`grok-review: source ${src} missing/unreadable — removed shadow copy`)
+      }
+      return
+    }
+    throw e
+  }
+  if (st.isSymbolicLink() || !st.isFile()) {
+    throw new Error(`source ${src} is not a regular file`)
+  }
+  // O_NOFOLLOW at open: even if src were swapped to a symlink between the
+  // lstat above and here, the open itself refuses to follow it.
+  const rfd = io.openSync(src, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW)
+  try {
+    // Post-open fstat recheck on the SAME fd.
+    if (!io.fstatSync(rfd).isFile()) throw new Error(`source ${src} is not a regular file`)
+    const data = io.readFileSync(rfd)
+    const tmpDst = path.join(H, `.tmp-${randomBytes(8).toString('hex')}`)
+    const wfd = io.openSync(
+      tmpDst,
+      fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW,
+      0o600,
+    )
+    try {
+      io.writeSync(wfd, data)
+      io.fsyncSync(wfd)
+      io.renameSync(tmpDst, dst) // atomic, overwrite always
+    } catch (e) {
+      try {
+        io.rmSync(tmpDst, { force: true })
+      } catch {
+        /* best-effort residue cleanup */
+      }
+      throw e
+    } finally {
+      io.closeSync(wfd)
+    }
+  } finally {
+    io.closeSync(rfd)
+  }
+}
+
+/**
+ * D10 child env: pass the ambient env through with GROK_HOME pointed at the
+ * shadow home, minus GROK_SESSION_ID / GROK_AGENT (session claims) and
+ * GROK_SANDBOX (undefined profiles fail closed, probe P10). Pure helper —
+ * never mutates the caller's env object.
+ */
+export function buildChildEnv(env, H) {
+  const { GROK_SESSION_ID: _s, GROK_AGENT: _a, GROK_SANDBOX: _x, ...rest } = env
+  return { ...rest, GROK_HOME: H }
+}

package/scripts/lib/lexer.mjs

@@ -0,0 +1,145 @@
+/**
+ * §3.2-a mini POSIX-shell lexer for the codex-rescue-bridge matcher.
+ *
+ * Grammar (hostile-input constraints, all strict):
+ *
+ *   command    := word (blank+ word)* EOF-without-operator
+ *   word       := segment*                ; segments concatenate into one word
+ *   segment    := unquoted | '\'' single-quoted '\'' | '"' double-quoted '"'
+ *                 | '\' escape | '$' expansion | '`' | '~' | glob
+ *
+ * Rejections (fail closed, machine-readable `reason`):
+ *   - any UNQUOTED operator: `;` `&&` `||` `|` `>` `<` newline  -> 'unquoted-operator'
+ *   - env-assignment prefix on the first word (`FOO=1 cmd`)     -> 'env-assignment-prefix'
+ *   - command substitution in UNQUOTED context ($(), backticks) -> 'command-substitution-unquoted'
+ *   - command substitution in DOUBLE-QUOTED context             -> 'command-substitution-double-quoted'
+ *     (bash evaluates those inside double quotes; SINGLE-QUOTED bytes are pure
+ *     data and pass — this is what lets hostile install paths be expressed)
+ *   - unclosed quote                                            -> 'unclosed-quote'
+ *
+ * Expansion-bearing words (tilde at word start, glob `*?[`, `$VAR`/`${...}`,
+ * `$` of any kind) are flagged with `expansion: true` so the matcher can
+ * require argv[0]/argv[1] to be expansion-free literal bytes.
+ *
+ * One word may concatenate quoted and unquoted segments ('a'\''b' is the
+ * POSIX spelling of a literal `a'b`) — byte equality of the concatenated
+ * text is what the matcher pins, never the quoting.
+ */
+
+export function lexCommand(raw) {
+  const fail = (reason) => ({ ok: false, layer: 'lexer', reason })
+  const argv = []
+  let word = null // { text, expansion } | null
+  const flush = () => {
+    if (word !== null) {
+      argv.push(word)
+      word = null
+    }
+  }
+  let i = 0
+  while (i < raw.length) {
+    const c = raw[i]
+    if (c === ' ' || c === '\t') {
+      flush()
+      i++
+      continue
+    }
+    if (c === '\n' || c === '\r') {
+      flush()
+      if (argv.length > 0) return fail('unquoted-operator')
+      i++
+      continue
+    }
+    if (';|&<>'.includes(c)) {
+      return fail('unquoted-operator')
+    }
+    if (c === '#' && word === null) {
+      // comment: skip to end of line
+      while (i < raw.length && raw[i] !== '\n') i++
+      continue
+    }
+    if (word === null) word = { text: '', expansion: false }
+    while (i < raw.length) {
+      const ch = raw[i]
+      if (ch === '\'') {
+        // single-quoted segment: pure data, no expansions ever
+        i++
+        const start = i
+        while (i < raw.length && raw[i] !== '\'') i++
+        if (i >= raw.length) return fail('unclosed-quote')
+        word.text += raw.slice(start, i)
+        i++ // closing quote
+        continue
+      }
+      if (ch === '"') {
+        // double-quoted segment: bash still evaluates $() and backticks here
+        i++
+        while (i < raw.length && raw[i] !== '"') {
+          const d = raw[i]
+          if (d === '\\') {
+            if (i + 1 >= raw.length) return fail('unclosed-quote')
+            const n = raw[i + 1]
+            if (n === '$' || n === '`' || n === '"' || n === '\\') {
+              word.text += n
+              i += 2
+            } else {
+              word.text += d
+              i++
+            }
+            continue
+          }
+          if (d === '`') return fail('command-substitution-double-quoted')
+          if (d === '$') {
+            if (raw[i + 1] === '(') return fail('command-substitution-double-quoted')
+            word.expansion = true
+            word.text += d
+            i++
+            continue
+          }
+          // quoted newline is data here; the argv grammar rejects it in prompts
+          word.text += d
+          i++
+        }
+        if (i >= raw.length) return fail('unclosed-quote')
+        i++ // closing quote
+        continue
+      }
+      if (ch === '$') {
+        if (raw[i + 1] === '(') return fail('command-substitution-unquoted')
+        word.expansion = true
+        word.text += ch
+        i++
+        continue
+      }
+      if (ch === '`') return fail('command-substitution-unquoted')
+      if (ch === '\\' && i + 1 < raw.length) {
+        // escape: the next byte is a literal (a backslash-newline is a
+        // continuation, not an operator)
+        word.text += raw[i + 1]
+        i += 2
+        continue
+      }
+      if (ch === '~' && word.text === '') {
+        // tilde expansion only at the start of an unquoted word
+        word.expansion = true
+        word.text += ch
+        i++
+        continue
+      }
+      if ('*?['.includes(ch)) {
+        word.expansion = true
+        word.text += ch
+        i++
+        continue
+      }
+      if (' \t\n\r;|&<>'.includes(ch)) break // back to outer loop, which rules on it
+      word.text += ch
+      i++
+    }
+  }
+  flush()
+  if (argv.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[0].text)) {
+    return fail('env-assignment-prefix')
+  }
+  return { ok: true, layer: 'lexer', argv }
+}