@geekmidas/cli 10.0.0-alpha.63 → 10.0.0-alpha.65

package/dist/sandbox-Dm247NGx.mjs

@@ -0,0 +1,117 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { existsSync, realpathSync } from "node:fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/sandbox/sandbox.ts
+/**
+* Where a deploy runs the project's own code.
+*
+* A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
+* and loading `gkm.config.ts`, sniffing an app's environment and building it
+* all execute code from the repository being deployed. On a developer's own
+* laptop that is the developer's code. On a CI job for a fork, or a shared
+* build runner, it is not, and that code should not be able to read the
+* credentials used to deploy it, hang the deploy, or reach outside the
+* checkout.
+*
+* So every step that runs project code goes through a `Sandbox`: one call,
+* with an argument array rather than a shell line, the complete environment
+* the step needs rather than the host's, a timeout it cannot outlive, secrets
+* as files rather than variables, and a working directory inside the project.
+* The steps that need credentials — provisioning, pushing, releasing — are
+* the deploy's own code and never run in one.
+*
+* `LocalSandbox` is the default: a child process on this machine with an
+* allowlisted environment. A host that builds repositories it does not trust
+* passes its own — a container per build, a VM — through `deploy()`'s
+* `sandbox`.
+*/
+/** The variable naming the directory a command's secrets are mounted in. */
+const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
+/** A command was asked to run outside the project. */
+var SandboxCwdEscape = class extends Error {
+	cwd;
+	root;
+	constructor(cwd, root) {
+		super(`Refusing to run in '${cwd}': it is outside the project at '${root}'. A sandboxed step only runs inside the project it was given — check the app paths in gkm.config.ts for \`..\` or an absolute path.`);
+		this.cwd = cwd;
+		this.root = root;
+		this.name = "SandboxCwdEscape";
+	}
+};
+/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */
+function real(path) {
+	return existsSync(path) ? realpathSync(path) : path;
+}
+/**
+* `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.
+*
+* Symlinks are resolved on both sides first, so a link inside the project
+* that points out of it is an escape, and a project reached through a link
+* (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call
+* before it runs anything.
+*/
+function confineCwd(root, cwd) {
+	const absolute = resolve(root, cwd);
+	const from = relative(real(resolve(root)), real(absolute));
+	if (from === ".." || from.startsWith(`..${sep}`) || isAbsolute(from)) throw new SandboxCwdEscape(cwd, root);
+	return absolute;
+}
+/** A secret's file name: one path segment, so it cannot be written elsewhere. */
+var SecretNameInvalid = class extends Error {
+	secretName;
+	constructor(secretName) {
+		super(`'${secretName}' cannot be a secret's name: it becomes a file name in the secrets directory, so it must be one segment of letters, digits, '.', '-' or '_' and not start with '.'.`);
+		this.secretName = secretName;
+		this.name = "SecretNameInvalid";
+	}
+};
+const SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/** Every secret name, checked before anything is written. */
+function assertSecretNames(secrets) {
+	for (const name of Object.keys(secrets ?? {})) if (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);
+}
+const active = new AsyncLocalStorage();
+/**
+* Run `fn` with `sandbox` as the one its steps use.
+*
+* Per run rather than global, as `withOutput` routes a run's lines: two
+* deploys in one host process each build in their own sandbox. A step deep in
+* the engine — discovering constructs, sniffing an app — asks
+* {@link activeSandbox} rather than every function between `deploy()` and it
+* taking one more parameter.
+*/
+function withSandbox(sandbox, fn) {
+	return active.run({
+		sandbox,
+		answers: /* @__PURE__ */ new Map()
+	}, fn);
+}
+/** The sandbox of the run this is part of, if it was started with one. */
+function activeSandbox() {
+	return active.getStore()?.sandbox;
+}
+/**
+* `ask()`'s answer, asked once per run.
+*
+* A deploy loads its config and discovers its constructs from several places
+* — the first load, the engine, the Dockerfile generator — and in a sandbox
+* each was a child process of its own, for the same answer: the checkout does
+* not change while it deploys. Within a run in `sandbox`, the first answer
+* for `key` is the one every later ask gets. Outside one, or for another
+* sandbox, `ask()` runs each time.
+*/
+function oncePerRun(sandbox, key, ask) {
+	const run = active.getStore();
+	if (!run || run.sandbox !== sandbox) return ask();
+	let answer = run.answers.get(key);
+	if (!answer) {
+		answer = ask();
+		run.answers.set(key, answer);
+		answer.catch(() => run.answers.delete(key));
+	}
+	return answer;
+}
+//#endregion
+export { assertSecretNames as a, withSandbox as c, activeSandbox as i, SandboxCwdEscape as n, confineCwd as o, SecretNameInvalid as r, oncePerRun as s, SECRETS_DIR_ENV as t };
+
+//# sourceMappingURL=sandbox-Dm247NGx.mjs.map

package/dist/sandbox-Dm247NGx.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-Dm247NGx.mjs","names":[],"sources":["../src/sandbox/sandbox.ts"],"sourcesContent":["/**\n * Where a deploy runs the project's own code.\n *\n * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —\n * and loading `gkm.config.ts`, sniffing an app's environment and building it\n * all execute code from the repository being deployed. On a developer's own\n * laptop that is the developer's code. On a CI job for a fork, or a shared\n * build runner, it is not, and that code should not be able to read the\n * credentials used to deploy it, hang the deploy, or reach outside the\n * checkout.\n *\n * So every step that runs project code goes through a `Sandbox`: one call,\n * with an argument array rather than a shell line, the complete environment\n * the step needs rather than the host's, a timeout it cannot outlive, secrets\n * as files rather than variables, and a working directory inside the project.\n * The steps that need credentials — provisioning, pushing, releasing — are\n * the deploy's own code and never run in one.\n *\n * `LocalSandbox` is the default: a child process on this machine with an\n * allowlisted environment. A host that builds repositories it does not trust\n * passes its own — a container per build, a VM — through `deploy()`'s\n * `sandbox`.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { existsSync, realpathSync } from 'node:fs';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\n\n/** Where a command's output goes. */\nexport type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';\n\nexport interface SandboxExecOptions {\n\t/**\n\t * Where the command runs: the project root or a directory below it, as an\n\t * absolute path or relative to the root. Anywhere else is refused with\n\t * {@link SandboxCwdEscape}.\n\t */\n\tcwd: string;\n\t/**\n\t * The command's whole environment. Nothing of the host's is added to it:\n\t * start from {@link Sandbox.env} and add what the step needs.\n\t */\n\tenv: Readonly<Record<string, string>>;\n\t/**\n\t * How long the command may run before it is killed. Required: a step that\n\t * waits forever — a sniffed entry that opens a server, a build stuck on a\n\t * prompt — would otherwise hold the deploy, and its lock, forever.\n\t */\n\ttimeoutMs: number;\n\t/**\n\t * Files the command can read, by name. Mounted in a directory of their own\n\t * — named by `GKM_SECRETS_DIR` in the command's environment — and removed\n\t * when it exits. Never set as variables, which every child inherits, a\n\t * crash report prints and `/proc/<pid>/environ` shows.\n\t */\n\tsecrets?: Readonly<Record<string, string>>;\n\t/**\n\t * `capture` (the default) returns stdout and stderr in the result;\n\t * `inherit` gives the command the host's terminal; `stderr` sends both\n\t * streams to the host's stderr; `ignore` discards them.\n\t */\n\toutput?: SandboxOutput;\n\t/** Kills the command when aborted; `exec` rejects with the signal's reason. */\n\tsignal?: AbortSignal;\n}\n\n/** How a command ended. A non-zero exit is a result, not an error. */\nexport interface SandboxResult {\n\texitCode: number | null;\n\tsignal: string | null;\n\t/** What it wrote to stdout, when its output was captured. */\n\tstdout: string;\n\t/** What it wrote to stderr, when its output was captured. */\n\tstderr: string;\n}\n\n/**\n * Runs a command against the project, and nothing else of the host's.\n *\n * `exec` resolves with the result however the command exited. It rejects\n * with {@link CommandTimedOut} once the timeout passes — after the command is\n * gone — with {@link SandboxCwdEscape} for a directory outside the project,\n * with the signal's reason when aborted, and with the spawn error when the\n * program cannot be started.\n */\nexport interface Sandbox {\n\t/** The project: the directory every command runs at or below. */\n\treadonly root: string;\n\t/**\n\t * Whether the code it runs is kept from the host: its files, its\n\t * processes, its memory.\n\t *\n\t * An isolating sandbox shares nothing but what crosses `exec`, so a config\n\t * reaches the deploy as data — a live object in it (a custom state store,\n\t * an inline target) cannot cross, and is refused with\n\t * `ConfigObjectNotSerializable`. A non-isolating one, like\n\t * {@link LocalSandbox}, runs on the host as the host's user; a project\n\t * whose config holds live objects is then loaded in-process as before,\n\t * because a project trusted to run there is trusted to do that.\n\t */\n\treadonly isolating: boolean;\n\t/**\n\t * The environment a command starts from: what any program needs to run\n\t * here — `PATH`, `HOME`, the locale — and no credential.\n\t */\n\treadonly env: Readonly<Record<string, string>>;\n\texec(\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions: SandboxExecOptions,\n\t): Promise<SandboxResult>;\n}\n\n/** The variable naming the directory a command's secrets are mounted in. */\nexport const SECRETS_DIR_ENV = 'GKM_SECRETS_DIR';\n\n/** A command was asked to run outside the project. */\nexport class SandboxCwdEscape extends Error {\n\tconstructor(\n\t\treadonly cwd: string,\n\t\treadonly root: string,\n\t) {\n\t\tsuper(\n\t\t\t`Refusing to run in '${cwd}': it is outside the project at '${root}'. ` +\n\t\t\t\t'A sandboxed step only runs inside the project it was given — check ' +\n\t\t\t\t'the app paths in gkm.config.ts for `..` or an absolute path.',\n\t\t);\n\t\tthis.name = 'SandboxCwdEscape';\n\t}\n}\n\n/** A path with its symlinks resolved where it exists — `/tmp` is `/private/tmp`. */\nfunction real(path: string): string {\n\treturn existsSync(path) ? realpathSync(path) : path;\n}\n\n/**\n * `cwd` as an absolute directory inside `root`, or {@link SandboxCwdEscape}.\n *\n * Symlinks are resolved on both sides first, so a link inside the project\n * that points out of it is an escape, and a project reached through a link\n * (`/tmp` on macOS) is still itself. For a sandbox of a host's own to call\n * before it runs anything.\n */\nexport function confineCwd(root: string, cwd: string): string {\n\tconst absolute = resolve(root, cwd);\n\tconst from = relative(real(resolve(root)), real(absolute));\n\tif (from === '..' || from.startsWith(`..${sep}`) || isAbsolute(from)) {\n\t\tthrow new SandboxCwdEscape(cwd, root);\n\t}\n\treturn absolute;\n}\n\n/** A secret's file name: one path segment, so it cannot be written elsewhere. */\nexport class SecretNameInvalid extends Error {\n\tconstructor(readonly secretName: string) {\n\t\tsuper(\n\t\t\t`'${secretName}' cannot be a secret's name: it becomes a file name in ` +\n\t\t\t\t'the secrets directory, so it must be one segment of letters, digits, ' +\n\t\t\t\t\"'.', '-' or '_' and not start with '.'.\",\n\t\t);\n\t\tthis.name = 'SecretNameInvalid';\n\t}\n}\n\nconst SECRET_NAME = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;\n\n/** Every secret name, checked before anything is written. */\nexport function assertSecretNames(\n\tsecrets: Readonly<Record<string, string>> | undefined,\n): void {\n\tfor (const name of Object.keys(secrets ?? {})) {\n\t\tif (!SECRET_NAME.test(name)) throw new SecretNameInvalid(name);\n\t}\n}\n\n/** A run's sandbox, and what its workers already answered. */\ninterface SandboxRun {\n\tsandbox: Sandbox;\n\tanswers: Map<string, Promise<unknown>>;\n}\n\nconst active = new AsyncLocalStorage<SandboxRun>();\n\n/**\n * Run `fn` with `sandbox` as the one its steps use.\n *\n * Per run rather than global, as `withOutput` routes a run's lines: two\n * deploys in one host process each build in their own sandbox. A step deep in\n * the engine — discovering constructs, sniffing an app — asks\n * {@link activeSandbox} rather than every function between `deploy()` and it\n * taking one more parameter.\n */\nexport function withSandbox<T>(sandbox: Sandbox, fn: () => T): T {\n\treturn active.run({ sandbox, answers: new Map() }, fn);\n}\n\n/** The sandbox of the run this is part of, if it was started with one. */\nexport function activeSandbox(): Sandbox | undefined {\n\treturn active.getStore()?.sandbox;\n}\n\n/**\n * `ask()`'s answer, asked once per run.\n *\n * A deploy loads its config and discovers its constructs from several places\n * — the first load, the engine, the Dockerfile generator — and in a sandbox\n * each was a child process of its own, for the same answer: the checkout does\n * not change while it deploys. Within a run in `sandbox`, the first answer\n * for `key` is the one every later ask gets. Outside one, or for another\n * sandbox, `ask()` runs each time.\n */\nexport function oncePerRun<T>(\n\tsandbox: Sandbox,\n\tkey: string,\n\task: () => Promise<T>,\n): Promise<T> {\n\tconst run = active.getStore();\n\tif (!run || run.sandbox !== sandbox) return ask();\n\n\tlet answer = run.answers.get(key) as Promise<T> | undefined;\n\tif (!answer) {\n\t\tanswer = ask();\n\t\trun.answers.set(key, answer);\n\t\t// A failure is not remembered: the next ask tries again.\n\t\tanswer.catch(() => run.answers.delete(key));\n\t}\n\treturn answer;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkHA,MAAa,kBAAkB;;AAG/B,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,KACA,MACC;EACD,MACC,uBAAuB,IAAI,mCAAmC,KAAK,qIAGpE;EAPS,KAAA,MAAA;EACA,KAAA,OAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,SAAS,KAAK,MAAsB;CACnC,OAAO,WAAW,IAAI,IAAI,aAAa,IAAI,IAAI;AAChD;;;;;;;;;AAUA,SAAgB,WAAW,MAAc,KAAqB;CAC7D,MAAM,WAAW,QAAQ,MAAM,GAAG;CAClC,MAAM,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC;CACzD,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,KAAK,KAAK,WAAW,IAAI,GAClE,MAAM,IAAI,iBAAiB,KAAK,IAAI;CAErC,OAAO;AACR;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,YAA6B;EACxC,MACC,IAAI,WAAW,oKAGhB;EALoB,KAAA,aAAA;EAMpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,cAAc;;AAGpB,SAAgB,kBACf,SACO;CACP,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,CAAC,CAAC,GAC3C,IAAI,CAAC,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,kBAAkB,IAAI;AAE/D;AAQA,MAAM,SAAS,IAAI,kBAA8B;;;;;;;;;;AAWjD,SAAgB,YAAe,SAAkB,IAAgB;CAChE,OAAO,OAAO,IAAI;EAAE;EAAS,yBAAS,IAAI,IAAI;CAAE,GAAG,EAAE;AACtD;;AAGA,SAAgB,gBAAqC;CACpD,OAAO,OAAO,SAAS,CAAC,EAAE;AAC3B;;;;;;;;;;;AAYA,SAAgB,WACf,SACA,KACA,KACa;CACb,MAAM,MAAM,OAAO,SAAS;CAC5B,IAAI,CAAC,OAAO,IAAI,YAAY,SAAS,OAAO,IAAI;CAEhD,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG;CAChC,IAAI,CAAC,QAAQ;EACZ,SAAS,IAAI;EACb,IAAI,QAAQ,IAAI,KAAK,MAAM;EAE3B,OAAO,YAAY,IAAI,QAAQ,OAAO,GAAG,CAAC;CAC3C;CACA,OAAO;AACR"}