@forgezero/agent 0.1.41 → 0.1.42

package/dist/fz-git-ssh.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/git-ssh.ts
+import { lstatSync } from "fs";
+import { isAbsolute } from "path";
+import { isIP } from "net";
+
+class GitSshError extends Error {
+}
+var required = (name) => {
+  const value = process.env[name];
+  if (!value)
+    throw new GitSshError(`${name} is required`);
+  return value;
+};
+var regularPrivateFile = (path, name) => {
+  if (!isAbsolute(path))
+    throw new GitSshError(`${name} must be absolute`);
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+    throw new GitSshError(`${name} must be one regular file`);
+  }
+  if ((stat.mode & 63) !== 0)
+    throw new GitSshError(`${name} must not be group/world accessible`);
+  return path;
+};
+function gitSshArgv(args) {
+  const identity = regularPrivateFile(required("FZ_GIT_SSH_IDENTITY"), "Git identity");
+  const knownHosts = regularPrivateFile(required("FZ_GIT_SSH_KNOWN_HOSTS"), "known_hosts");
+  const address = required("FZ_GIT_SSH_ADDRESS");
+  if (isIP(address) === 0)
+    throw new GitSshError("FZ_GIT_SSH_ADDRESS must be one verified IP address");
+  const alias = required("FZ_GIT_SSH_HOST_ALIAS").toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(alias)) {
+    throw new GitSshError("FZ_GIT_SSH_HOST_ALIAS is invalid");
+  }
+  let index = 0;
+  let port;
+  while (index < args.length - 2) {
+    const option = args[index++];
+    if (option === "-p") {
+      const value = args[index++];
+      if (!value || !/^[1-9][0-9]{0,4}$/.test(value) || Number(value) > 65535 || port) {
+        throw new GitSshError("Git supplied an invalid SSH port");
+      }
+      port = value;
+      continue;
+    }
+    if (option === "-o" && args[index] === "SendEnv=GIT_PROTOCOL") {
+      index += 1;
+      continue;
+    }
+    throw new GitSshError(`Git supplied an unsupported SSH option: ${option ?? "<missing>"}`);
+  }
+  if (args.length - index !== 2)
+    throw new GitSshError("Git SSH invocation must contain a destination and command");
+  const destination = args[index];
+  const command = args[index + 1];
+  const host = destination.slice(destination.lastIndexOf("@") + 1).replace(/^\[|\]$/g, "").toLowerCase();
+  if (host !== alias)
+    throw new GitSshError("Git SSH destination does not match the pinned repository host");
+  if (command.length > 8192 || /[\r\n\0]/.test(command) || !command.startsWith("git-upload-pack ")) {
+    throw new GitSshError("Git SSH permits only repository reads");
+  }
+  return [
+    "/usr/bin/ssh",
+    "-F",
+    "/dev/null",
+    "-i",
+    identity,
+    "-o",
+    "IdentitiesOnly=yes",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ConnectTimeout=15",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-o",
+    `UserKnownHostsFile=${knownHosts}`,
+    "-o",
+    `Hostname=${address}`,
+    "-o",
+    `HostKeyAlias=${alias}`,
+    "-o",
+    "CanonicalizeHostname=no",
+    "-o",
+    "ProxyCommand=none",
+    "-o",
+    "ProxyJump=none",
+    "-o",
+    "PermitLocalCommand=no",
+    "-o",
+    "ClearAllForwardings=yes",
+    ...port ? ["-p", port] : [],
+    destination,
+    command
+  ];
+}
+async function runGitSsh(args = process.argv.slice(2)) {
+  const child = Bun.spawn(gitSshArgv(args), {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: { PATH: "/usr/bin:/bin", LANG: "C.UTF-8", ...process.env.GIT_PROTOCOL ? { GIT_PROTOCOL: process.env.GIT_PROTOCOL } : {} }
+  });
+  return child.exited;
+}
+if (import.meta.main) {
+  try {
+    process.exit(await runGitSsh());
+  } catch (cause) {
+    console.error(`fz-git-ssh: ${cause instanceof Error ? cause.message : "refused"}`);
+    process.exit(64);
+  }
+}
+export {
+  runGitSsh,
+  gitSshArgv,
+  GitSshError
+};