@dsh-electron/dsh-plugin-multi-root-workspace 0.1.11 → 0.1.13

package/lib/protocol-CJOvAvOS.js

@@ -0,0 +1,652 @@
+import { closeSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, unlinkSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { z } from "zod";
+import { Socket } from "node:net";
+//#region src/authority/native.ts
+/** Kernel-authenticated local IPC. No credential file and no inherited capability. */
+function storeIdentity(root) {
+	mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	const physical = realpathSync.native(root);
+	const info = statSync(physical, { bigint: true });
+	const id = createHash("sha256").update(`${info.dev}:${info.ino}:${process.platform === "win32" ? physical.toLowerCase() : physical}`).digest("hex");
+	if (process.platform === "win32") return {
+		root: physical,
+		id,
+		endpoint: `\\\\.\\pipe\\LOCAL\\dsh-registry-${id}`
+	};
+	const directory = `/tmp/dsh-registry-${process.getuid()}`;
+	try {
+		mkdirSync(directory, { mode: 448 });
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	}
+	const entry = lstatSync(directory);
+	if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid() || (entry.mode & 63) !== 0) throw new Error("unsafe registry IPC directory");
+	return {
+		root: physical,
+		id,
+		endpoint: join(directory, `${id.slice(0, 48)}.sock`)
+	};
+}
+let posixPromise;
+async function loadPosix() {
+	const koffi = (await import("koffi")).default;
+	const libc = koffi.load(process.platform === "darwin" ? "/usr/lib/libSystem.B.dylib" : "libc.so.6");
+	const bind = (name, ret, args) => libc.func(name, ret, args);
+	const socketpair = bind("socketpair", "int", [
+		"int",
+		"int",
+		"int",
+		"void *"
+	]);
+	const socket = bind("socket", "int", [
+		"int",
+		"int",
+		"int"
+	]);
+	const connect = bind("connect", "int", [
+		"int",
+		"void *",
+		"uint"
+	]);
+	const bindSocket = bind("bind", "int", [
+		"int",
+		"void *",
+		"uint"
+	]);
+	const listen = bind("listen", "int", ["int", "int"]);
+	const accept = bind("accept", "int", [
+		"int",
+		"void *",
+		"void *"
+	]);
+	const fcntlCall = libc.func("int fcntl(int fd, int command, ...)");
+	const fcntl = (fd, command, value) => fcntlCall(fd, command, "int", value);
+	const getsockopt = bind("getsockopt", "int", [
+		"int",
+		"int",
+		"int",
+		"void *",
+		"void *"
+	]);
+	const poll = bind("poll", "int", [
+		"void *",
+		"uint",
+		"int"
+	]);
+	let auditCheck;
+	if (process.platform === "darwin") {
+		const tokenType = koffi.struct({ val: koffi.array("uint32", 8) });
+		auditCheck = koffi.load("/usr/lib/libsandbox.dylib").func("sandbox_check_by_audit_token", "int", [
+			tokenType,
+			"void *",
+			"int"
+		]);
+	}
+	function option(fd, level, name, size) {
+		const bytes = Buffer.alloc(size), length = Buffer.alloc(4);
+		length.writeUInt32LE(size);
+		if (getsockopt(fd, level, name, bytes, length) !== 0 || length.readUInt32LE() !== size) throw new Error("kernel peer attestation is unavailable");
+		return bytes;
+	}
+	function authenticate(fd) {
+		const uid = process.getuid();
+		if (process.platform === "darwin") {
+			const token = option(fd, 0, 6, 32);
+			if (token.readUInt32LE(4) !== uid || auditCheck({ val: [...new Uint32Array(token.buffer, token.byteOffset, 8)] }, null, 0) !== 0) throw new Error("registry IPC refuses a different user or sandboxed peer");
+			return () => {};
+		}
+		const cred = option(fd, 1, 17, 12);
+		const pidfd = option(fd, 1, 77, 4).readInt32LE();
+		try {
+			const pfd = Buffer.alloc(8);
+			pfd.writeInt32LE(pidfd);
+			pfd.writeInt16LE(1, 4);
+			const status = readFileSync(`/proc/${cred.readInt32LE()}/status`, "utf8");
+			const ids = /^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(status);
+			if (cred.readUInt32LE(4) !== uid || ids === null || ids.slice(1).some((value) => Number(value) !== uid) || !/^NoNewPrivs:\s+0$/m.test(status) || poll(pfd, 1, 0) !== 0) throw new Error("registry IPC refuses a different user, exited or restricted peer");
+			return () => closeSync(pidfd);
+		} catch (error) {
+			closeSync(pidfd);
+			throw error;
+		}
+	}
+	function address(path) {
+		const data = Buffer.from(path);
+		if (data.length >= (process.platform === "darwin" ? 104 : 108)) throw new Error("registry IPC path is too long");
+		const bytes = Buffer.alloc(data.length + 3);
+		if (process.platform === "darwin") {
+			bytes[0] = bytes.length;
+			bytes[1] = 1;
+		} else bytes.writeUInt16LE(1);
+		data.copy(bytes, 2);
+		return bytes;
+	}
+	function open() {
+		const fd = socket(1, 1, 0);
+		if (fd < 0) throw new Error("cannot create registry IPC socket");
+		if (fcntl(fd, 2, 1) !== 0 || fcntl(fd, 4, process.platform === "darwin" ? 4 : 2048) !== 0) {
+			closeSync(fd);
+			throw new Error("cannot make registry socket non-inheritable/non-blocking");
+		}
+		return fd;
+	}
+	function channel(fd) {
+		let cleanup;
+		try {
+			if (fcntl(fd, 2, 1) !== 0 || fcntl(fd, 4, process.platform === "darwin" ? 4 : 2048) !== 0) throw new Error("cannot make registry connection non-inheritable/non-blocking");
+			cleanup = authenticate(fd);
+			const result = new Socket({
+				fd,
+				readable: true,
+				writable: true
+			});
+			result.on("close", cleanup);
+			result.on("error", () => {});
+			return result;
+		} catch (error) {
+			cleanup?.();
+			closeSync(fd);
+			throw error;
+		}
+	}
+	return {
+		open,
+		channel,
+		address,
+		connect,
+		bindSocket,
+		listen,
+		accept,
+		authenticate,
+		socketpair
+	};
+}
+function posix$1() {
+	return posixPromise ??= loadPosix();
+}
+async function connectNative(endpoint) {
+	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).connectWindows(endpoint);
+	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
+	if (api.connect(fd, address, address.length) !== 0) {
+		closeSync(fd);
+		throw new Error("registry authority is not ready");
+	}
+	return api.channel(fd);
+}
+/** Called only by the kernel lease holder. Never removes another epoch's socket. */
+async function listenNative(endpoint, accepted) {
+	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).listenWindows(endpoint, accepted);
+	const api = await posix$1(), address = api.address(endpoint), fd = api.open();
+	try {
+		unlinkSync(endpoint);
+	} catch (error) {
+		if (error.code !== "ENOENT") {
+			closeSync(fd);
+			throw error;
+		}
+	}
+	if (api.bindSocket(fd, address, address.length) !== 0 || api.listen(fd, 32) !== 0) {
+		closeSync(fd);
+		throw new Error("cannot listen for registry Hosts");
+	}
+	const inode = lstatSync(endpoint).ino;
+	let closed = false;
+	const timer = setInterval(() => {
+		for (let i = 0; i < 8 && !closed; i++) {
+			const client = api.accept(fd, null, null);
+			if (client < 0) break;
+			let channel;
+			try {
+				channel = api.channel(client);
+				accepted(channel);
+			} catch {
+				channel?.destroy();
+			}
+		}
+	}, 20);
+	timer.unref();
+	return { close() {
+		if (closed) return;
+		closed = true;
+		clearInterval(timer);
+		closeSync(fd);
+		try {
+			if (lstatSync(endpoint).ino === inode) unlinkSync(endpoint);
+		} catch {}
+	} };
+}
+/** Capability probe for native tests and diagnostics; not an authorization bypass. */
+async function nativeHostAvailability() {
+	if (process.platform === "win32") return (await import("./native-win32-2waCRkPI.js")).windowsHostAvailability();
+	if (process.platform === "linux") {
+		if (!/^NoNewPrivs:\s+0$/m.test(readFileSync("/proc/self/status", "utf8"))) return {
+			available: false,
+			reason: "the Host itself has NoNewPrivs; shared IPC refuses restricted peers"
+		};
+	} else if (process.platform === "darwin") {
+		if ((await import("koffi")).default.load("/usr/lib/libsandbox.dylib").func("int sandbox_check(int pid, const char *operation, int filter)")(process.pid, null, 0) !== 0) return {
+			available: false,
+			reason: "the Host itself is sandboxed; shared IPC refuses sandboxed peers"
+		};
+	}
+	const api = await posix$1(), pair = Buffer.alloc(8);
+	if (api.socketpair(1, 1, 0, pair) !== 0) throw new Error("cannot probe registry IPC credentials");
+	try {
+		api.authenticate(pair.readInt32LE())();
+	} catch (error) {
+		if (process.platform === "linux" && String(error).includes("kernel peer attestation is unavailable")) return {
+			available: false,
+			reason: "the kernel lacks SO_PEERPIDFD; shared IPC requires a pinned peer identity"
+		};
+		throw error;
+	} finally {
+		closeSync(pair.readInt32LE());
+		closeSync(pair.readInt32LE(4));
+	}
+	return { available: true };
+}
+//#endregion
+//#region src/authority/protocol.ts
+/** Bounded, versioned requests on an already kernel-attested connection. */
+const MAX_FRAME = 1048576;
+const MAX_PENDING = 32;
+const helloSchema = z.object({
+	protocol: z.literal(1),
+	store: z.string(),
+	epoch: z.string(),
+	limit: z.number().int()
+}).strict();
+const requestSchema = z.object({
+	protocol: z.literal(1),
+	store: z.string(),
+	id: z.string().uuid(),
+	epoch: z.string().nullable(),
+	method: z.enum([
+		"hello",
+		"snapshot",
+		"admit",
+		"add",
+		"removeAt",
+		"setAccess",
+		"setAlias",
+		"setSkillsEnabled",
+		"setAliasId",
+		"move",
+		"recheck"
+	]),
+	args: z.array(z.unknown()).max(4)
+}).strict();
+const rootSchema = z.object({
+	id: z.string(),
+	path: z.string(),
+	access: z.enum([
+		"inherit",
+		"read-only",
+		"read-write"
+	]),
+	addedAt: z.string(),
+	recordedPath: z.string().optional(),
+	readOnlyRecordedPath: z.string().optional(),
+	readWriteRecordedPath: z.string().optional(),
+	alias: z.string().optional(),
+	aliasId: z.unknown().optional(),
+	skillsEnabled: z.unknown().optional(),
+	state: z.enum([
+		"available",
+		"missing",
+		"redirected",
+		"invalid"
+	]),
+	detail: z.string().optional(),
+	invalidReason: z.literal("membership-conflict").optional()
+}).strict();
+const snapshotSchema = z.object({
+	protocol: z.literal(1),
+	store: z.string(),
+	epoch: z.string(),
+	revision: z.number().int().nonnegative().safe(),
+	primary: z.string(),
+	roots: z.array(rootSchema).max(4096),
+	available: z.boolean()
+}).strict();
+const replySchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("reply"),
+		id: z.string().uuid(),
+		value: z.unknown()
+	}).strict(),
+	z.object({
+		type: z.literal("error"),
+		id: z.string().uuid(),
+		code: z.string(),
+		message: z.string()
+	}).strict(),
+	z.object({
+		type: z.literal("change"),
+		value: snapshotSchema
+	}).strict()
+]);
+var AuthorityRpcError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+function receive(channel, body) {
+	let data = Buffer.alloc(0);
+	channel.on("data", (chunk) => {
+		try {
+			if (data.length + chunk.length > MAX_FRAME) throw new Error("registry IPC frame exceeds budget");
+			data = Buffer.concat([data, chunk]);
+			for (;;) {
+				const end = data.indexOf(10);
+				if (end < 0) break;
+				const line = data.subarray(0, end);
+				data = data.subarray(end + 1);
+				body(JSON.parse(line.toString("utf8")));
+			}
+		} catch {
+			channel.destroy();
+		}
+	});
+}
+function send(channel, value) {
+	const text = JSON.stringify(value) + "\n";
+	if (Buffer.byteLength(text) + (channel.writableLength ?? 0) > MAX_FRAME) {
+		channel.destroy();
+		return false;
+	}
+	channel.write(text);
+	return true;
+}
+var AuthorityClient = class AuthorityClient {
+	channel;
+	store;
+	limit;
+	pending = /* @__PURE__ */ new Map();
+	closed = false;
+	epoch;
+	constructor(channel, store, limit, onChange, disconnected) {
+		this.channel = channel;
+		this.store = store;
+		this.limit = limit;
+		channel.on("close", () => {
+			if (this.closed) return;
+			this.closed = true;
+			for (const request of this.pending.values()) {
+				clearTimeout(request.timer);
+				request.reject(new AuthorityRpcError("authority-disconnected", "registry request result is unknown; resynchronize before another mutation"));
+			}
+			this.pending.clear();
+			disconnected();
+		});
+		channel.on("error", () => channel.destroy());
+		receive(channel, (value) => {
+			const reply = replySchema.parse(value);
+			if (reply.type === "change") {
+				if (reply.value.store !== store || reply.value.epoch !== this.epoch) throw new Error("wrong registry epoch");
+				onChange(reply.value);
+				return;
+			}
+			const request = this.pending.get(reply.id);
+			if (!request) return;
+			if (reply.type === "reply" && request.method === "hello") {
+				const hello = helloSchema.parse(reply.value);
+				if (hello.store !== store || hello.limit !== this.limit) throw new Error("registry configuration mismatch");
+				this.epoch = hello.epoch;
+			}
+			this.pending.delete(reply.id);
+			clearTimeout(request.timer);
+			if (reply.type === "reply") request.resolve(reply.value);
+			else request.reject(new AuthorityRpcError(reply.code, reply.message));
+		});
+	}
+	static async connect(endpoint, store, limit, onChange, disconnected, signal) {
+		if (signal?.aborted) throw new AuthorityRpcError("authority-cancelled", "registry handshake was cancelled");
+		const channel = await connectNative(endpoint);
+		if (signal?.aborted) {
+			channel.destroy();
+			throw new AuthorityRpcError("authority-cancelled", "registry handshake was cancelled");
+		}
+		const client = new AuthorityClient(channel, store, limit, onChange, disconnected);
+		const onAbort = () => client.close();
+		signal?.addEventListener("abort", onAbort, { once: true });
+		try {
+			const hello = helloSchema.parse(await client.request("hello", [limit]));
+			if (hello.store !== store || hello.limit !== limit) throw new Error("registry configuration mismatch");
+			client.epoch = hello.epoch;
+			return client;
+		} catch (error) {
+			client.close();
+			if (signal?.aborted) throw new AuthorityRpcError("authority-cancelled", "registry handshake was cancelled");
+			throw error;
+		} finally {
+			signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	request(method, args) {
+		if (this.closed || this.pending.size >= MAX_PENDING) return Promise.reject(new AuthorityRpcError("authority-unavailable", "registry connection is unavailable or busy"));
+		const id = randomUUID();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.channel.destroy();
+			}, 5e3);
+			this.pending.set(id, {
+				method,
+				resolve,
+				reject,
+				timer
+			});
+			send(this.channel, {
+				protocol: 1,
+				store: this.store,
+				epoch: this.epoch ?? null,
+				id,
+				method,
+				args
+			});
+		});
+	}
+	close() {
+		this.channel.destroy();
+	}
+};
+var AuthorityServer = class AuthorityServer {
+	store;
+	epoch;
+	limit;
+	dispatch;
+	listener;
+	peers = /* @__PURE__ */ new Set();
+	readyPeers = /* @__PURE__ */ new Set();
+	closed = false;
+	inFlight = 0;
+	constructor(store, epoch, limit, dispatch) {
+		this.store = store;
+		this.epoch = epoch;
+		this.limit = limit;
+		this.dispatch = dispatch;
+	}
+	static async listen(endpoint, store, epoch, limit, dispatch) {
+		const server = new AuthorityServer(store, epoch, limit, dispatch);
+		server.listener = await listenNative(endpoint, (channel) => server.accept(channel));
+		return server;
+	}
+	accept(channel) {
+		if (this.closed || this.peers.size >= 32) {
+			channel.destroy();
+			return;
+		}
+		this.peers.add(channel);
+		let ready = false, pending = 0;
+		const seen = /* @__PURE__ */ new Map();
+		const timer = setTimeout(() => {
+			if (!ready) channel.destroy();
+		}, 5e3);
+		timer.unref();
+		channel.on("close", () => {
+			clearTimeout(timer);
+			this.peers.delete(channel);
+			this.readyPeers.delete(channel);
+		});
+		channel.on("error", () => channel.destroy());
+		receive(channel, (value) => {
+			const request = requestSchema.parse(value);
+			if (request.store !== this.store || pending >= MAX_PENDING) throw new Error("registry peer violated protocol");
+			if (request.method === "hello") {
+				if (ready || request.epoch !== null || request.args[0] !== this.limit) throw new Error("registry handshake mismatch");
+				ready = true;
+				this.readyPeers.add(channel);
+				clearTimeout(timer);
+				send(channel, {
+					type: "reply",
+					id: request.id,
+					value: {
+						protocol: 1,
+						store: this.store,
+						epoch: this.epoch,
+						limit: this.limit
+					}
+				});
+				return;
+			}
+			if (!ready || request.epoch !== this.epoch) throw new Error("registry epoch mismatch");
+			if (this.inFlight >= MAX_PENDING) {
+				send(channel, {
+					type: "error",
+					id: request.id,
+					code: "authority-busy",
+					message: "registry is busy; request was not submitted"
+				});
+				return;
+			}
+			const mutation = request.method !== "snapshot" && request.method !== "admit";
+			if (mutation && !seen.has(request.id) && seen.size >= 2048) {
+				channel.destroy();
+				return;
+			}
+			const fingerprint = createHash("sha256").update(JSON.stringify([request.method, request.args])).digest("hex");
+			const entry = seen.get(request.id);
+			if (entry && entry.fingerprint !== fingerprint) throw new Error("registry request ID reused with different arguments");
+			pending++;
+			this.inFlight++;
+			const run = entry ? entry.outcome.then((outcome) => {
+				if (!outcome.ok) throw new AuthorityRpcError(outcome.code, outcome.message);
+				return this.dispatch("snapshot", [request.args[0]]);
+			}) : this.dispatch(request.method, request.args);
+			if (mutation && !entry) seen.set(request.id, {
+				fingerprint,
+				outcome: run.then(() => ({ ok: true }), (error) => ({
+					ok: false,
+					code: String(error?.code ?? "registry-error").slice(0, 120),
+					message: String(error?.message ?? error).slice(0, 4096)
+				}))
+			});
+			run.then((result) => send(channel, {
+				type: "reply",
+				id: request.id,
+				value: result
+			}), (error) => send(channel, {
+				type: "error",
+				id: request.id,
+				code: String(error?.code ?? "registry-error"),
+				message: String(error?.message ?? error)
+			})).finally(() => {
+				pending--;
+				this.inFlight--;
+			});
+		});
+	}
+	changed(snapshot) {
+		if (this.closed) return;
+		for (const peer of this.readyPeers) send(peer, {
+			type: "change",
+			value: snapshot
+		});
+	}
+	close() {
+		if (this.closed) return;
+		this.closed = true;
+		this.listener?.close();
+		for (const peer of this.peers) peer.destroy();
+		this.peers.clear();
+	}
+};
+const ref = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("id"),
+		id: z.string()
+	}).strict(),
+	z.object({
+		kind: z.literal("path"),
+		path: z.string()
+	}).strict(),
+	z.object({
+		kind: z.literal("ordinal"),
+		ordinal: z.number().int().positive()
+	}).strict(),
+	z.object({
+		kind: z.literal("entry"),
+		ordinal: z.number().int().positive(),
+		id: z.string(),
+		path: z.string(),
+		addedAt: z.string()
+	}).strict()
+]);
+const primary = z.string().min(1);
+const argumentSchemas = {
+	hello: z.tuple([z.number().int()]),
+	snapshot: z.tuple([primary]),
+	admit: z.tuple([primary]),
+	recheck: z.tuple([primary]),
+	add: z.tuple([primary, z.object({
+		path: z.string(),
+		alias: z.string().optional(),
+		access: z.enum([
+			"inherit",
+			"read-only",
+			"read-write"
+		]).optional()
+	}).strict()]),
+	removeAt: z.tuple([primary, ref]),
+	setAccess: z.tuple([
+		primary,
+		ref,
+		z.enum([
+			"inherit",
+			"read-only",
+			"read-write"
+		])
+	]),
+	setAlias: z.tuple([
+		primary,
+		ref,
+		z.string().nullable()
+	]),
+	setSkillsEnabled: z.tuple([
+		primary,
+		ref,
+		z.boolean()
+	]),
+	setAliasId: z.tuple([
+		primary,
+		ref,
+		z.string()
+	]),
+	move: z.tuple([
+		primary,
+		ref,
+		ref.nullable()
+	])
+};
+function parseArguments(method, args) {
+	return argumentSchemas[method].parse(args);
+}
+//#endregion
+export { snapshotSchema as a, parseArguments as i, AuthorityRpcError as n, nativeHostAvailability as o, AuthorityServer as r, storeIdentity as s, AuthorityClient as t };