@garuda-agent/garuda 0.0.1 → 0.15.0

package/dist/proxy-XJAHCZB2.js

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+import {
+  defaultResolve
+} from "./chunk-4P26OKTP.js";
+import {
+  checkAddress,
+  isIpLiteral
+} from "./chunk-ATW7BNIG.js";
+
+// src/net/proxy.ts
+import { mkdtempSync, rmSync } from "fs";
+import { createServer, request as httpRequest } from "http";
+import { connect } from "net";
+import { tmpdir } from "os";
+import { join } from "path";
+var NetworkProxy = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  servers = [];
+  sockets = /* @__PURE__ */ new Set();
+  blocked = [];
+  dir;
+  port = 0;
+  socketPath = "";
+  async start() {
+    this.dir = mkdtempSync(join(tmpdir(), "garuda-net-"));
+    this.socketPath = join(this.dir, "proxy.sock");
+    const tcp = this.server();
+    const unix = this.server();
+    await new Promise((resolve, reject) => {
+      tcp.once("error", reject);
+      tcp.listen(0, "127.0.0.1", () => resolve());
+    });
+    await new Promise((resolve, reject) => {
+      unix.once("error", reject);
+      unix.listen(this.socketPath, () => resolve());
+    });
+    const address = tcp.address();
+    this.port = typeof address === "object" && address !== null ? address.port : 0;
+    return { port: this.port, socketPath: this.socketPath };
+  }
+  /** The hosts blocked since the last call. */
+  takeBlocked() {
+    const out = this.blocked;
+    this.blocked = [];
+    return out;
+  }
+  async close() {
+    for (const socket of this.sockets) socket.destroy();
+    await Promise.all(
+      this.servers.map((s) => new Promise((resolve) => s.close(() => resolve())))
+    );
+    if (this.dir !== void 0) rmSync(this.dir, { recursive: true, force: true });
+  }
+  server() {
+    const server = createServer((req, res) => {
+      void this.forwardHttp(req, res);
+    });
+    server.on("connect", (req, client, head) => {
+      void this.tunnel(req, client, head);
+    });
+    server.on("connection", (socket) => {
+      this.sockets.add(socket);
+      socket.on("close", () => this.sockets.delete(socket));
+    });
+    this.servers.push(server);
+    return server;
+  }
+  /** https: CONNECT host:port, then a raw tunnel. */
+  async tunnel(req, client, head) {
+    client.on("error", () => {
+    });
+    const target = parseAuthority(req.url ?? "");
+    if (target === void 0) {
+      refuse(client, 400, "Garuda's proxy: a CONNECT request needs host:port.");
+      return;
+    }
+    const address = await this.check(target.host, target.port);
+    if (typeof address !== "string") {
+      refuse(client, 403, address.reason);
+      return;
+    }
+    const upstream = connect(target.port, address);
+    this.sockets.add(upstream);
+    upstream.on("close", () => this.sockets.delete(upstream));
+    upstream.on("error", () => client.destroy());
+    client.on("close", () => upstream.destroy());
+    upstream.once("connect", () => {
+      client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (head.length > 0) upstream.write(head);
+      upstream.pipe(client);
+      client.pipe(upstream);
+    });
+  }
+  /** http: a request with an absolute URL. */
+  async forwardHttp(req, res) {
+    let url;
+    try {
+      url = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400).end("Garuda's proxy: only absolute http URLs.\n");
+      return;
+    }
+    if (url.protocol !== "http:") {
+      res.writeHead(400).end("Garuda's proxy: only http here; https goes through CONNECT.\n");
+      return;
+    }
+    const port = url.port === "" ? 80 : Number(url.port);
+    const address = await this.check(url.hostname, port);
+    if (typeof address !== "string") {
+      res.writeHead(403, { "content-type": "text/plain" }).end(`${address.reason}
+`);
+      return;
+    }
+    const headers = { ...req.headers };
+    for (const name of Object.keys(headers)) {
+      if (name.startsWith("proxy-")) delete headers[name];
+    }
+    const upstream = httpRequest(
+      {
+        host: address,
+        port,
+        method: req.method,
+        path: `${url.pathname}${url.search}`,
+        headers: { ...headers, host: url.host }
+      },
+      (answer) => {
+        res.writeHead(answer.statusCode ?? 502, answer.headers);
+        answer.pipe(res);
+      }
+    );
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502).end("Garuda's proxy: the host did not answer.\n");
+      else res.destroy();
+    });
+    req.pipe(upstream);
+  }
+  /** The checked address to connect to, or why not. */
+  async check(host, port) {
+    const block = (reason) => {
+      this.blocked.push({ host, port, reason });
+      return { reason };
+    };
+    const bare = host.replace(/^\[|\]$/g, "").toLowerCase();
+    if (isIpLiteral(bare)) {
+      return block(`Garuda's network allowlist: use a host name, not the address ${bare}.`);
+    }
+    const decision = await this.options.decide(bare, port).catch(() => ({ allowed: false, reason: "the check failed" }));
+    if (!decision.allowed) {
+      return block(
+        `Garuda's network allowlist blocked ${bare}:${port}${decision.reason === void 0 ? "" : `: ${decision.reason}`}.`
+      );
+    }
+    let addresses;
+    try {
+      addresses = await (this.options.resolve ?? defaultResolve)(bare);
+    } catch {
+      return block(`Garuda's proxy: ${bare} has no address.`);
+    }
+    const allowed = this.options.addressAllowed ?? ((a) => checkAddress(a, false).ok);
+    if (addresses.length === 0 || !addresses.every((a) => allowed(a.address))) {
+      return block(`Garuda's proxy: ${bare} does not resolve to public addresses only.`);
+    }
+    return addresses[0].address;
+  }
+};
+function parseAuthority(text) {
+  const m = /^(\[[^\]]+\]|[^:/]+):(\d{1,5})$/.exec(text);
+  if (m === null) return void 0;
+  const port = Number(m[2]);
+  if (port < 1 || port > 65535) return void 0;
+  return { host: m[1].replace(/^\[|\]$/g, ""), port };
+}
+function refuse(client, status, text) {
+  const body = `${text}
+`;
+  client.end(
+    `HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : "Bad Request"}\r
+content-type: text/plain\r
+content-length: ${Buffer.byteLength(body)}\r
+connection: close\r
+\r
+${body}`
+  );
+}
+export {
+  NetworkProxy,
+  parseAuthority
+};
+//# sourceMappingURL=proxy-XJAHCZB2.js.map

package/dist/remove-LE7Q7K46.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import {
+  git
+} from "./chunk-2TAXSFWN.js";
+import "./chunk-SI2QJYCR.js";
+import "./chunk-WMOLXTBU.js";
+import "./chunk-HUIK3WXO.js";
+import {
+  JOBS_DIR,
+  jobPath
+} from "./chunk-KKB5W47S.js";
+import "./chunk-3NJNVZTK.js";
+
+// src/jobs/remove.ts
+import { existsSync } from "fs";
+import { rm } from "fs/promises";
+import { join } from "path";
+async function jobLeftovers(executor, job) {
+  const files = [
+    jobPath(job.root, job.id),
+    ...["md", "log"].map((e) => join(job.root, JOBS_DIR, `${job.id}.${e}`))
+  ].filter((f) => existsSync(f));
+  const ref = await git(
+    executor,
+    job.root,
+    ["rev-parse", "--verify", "--quiet", `refs/heads/${job.branch}`],
+    {
+      check: false
+    }
+  );
+  const branch = ref.exitCode === 0;
+  const merged = branch && (await git(executor, job.root, ["merge-base", "--is-ancestor", job.branch, "HEAD"], {
+    check: false
+  })).exitCode === 0;
+  return { files, worktree: existsSync(job.worktree), branch, merged };
+}
+async function removeJob(executor, job, left, withBranch) {
+  const gone = [];
+  if (left.worktree) {
+    await git(executor, job.root, ["worktree", "remove", "--force", job.worktree], {
+      check: false
+    });
+    await rm(job.worktree, { recursive: true, force: true });
+    gone.push("the worktree");
+  }
+  await git(executor, job.root, ["worktree", "prune"], { check: false });
+  if (withBranch && left.branch) {
+    await git(executor, job.root, ["branch", "-D", job.branch]);
+    gone.push(`the branch ${job.branch}`);
+  }
+  for (const file of left.files) await rm(file, { force: true });
+  if (left.files.length > 0) gone.unshift("the job file, report and log");
+  return gone;
+}
+export {
+  jobLeftovers,
+  removeJob
+};
+//# sourceMappingURL=remove-LE7Q7K46.js.map