@geminixiang/mikan 1.0.0-beta.9 → 1.0.0-beta.91

package/dist/vault/index.js

@@ -1,15 +1,12 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs";
-import { dirname, isAbsolute, join, normalize, sep } from "path";
-import { readTextFileIfExists } from "../utils/file-guards.js";
-import { atomicWritePrivateFile } from "../utils/fs-atomic.js";
-import { reportUserFacingError } from "../observability/sentry.js";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import { guestHomePath } from "../sandbox/layout.js";
+import { atomicWritePrivateFile, readTextFileIfExists } from "../file-guards.js";
+import { reportUserFacingError } from "../observability/index.js";
 const PRIVATE_DIR_MODE = 0o700;
 const SHARED_VAULT_DIR = "shared";
-/**
- * Top-level vault namespaces that are not user vaults: `shared/<name>` holds
- * shared login profiles, `extensions/<slug>` holds extension secrets (read
- * host-side via the harness `api.secrets`, never mounted into sandboxes).
- */
+const LEGACY_MOUNT_TARGETS_FILE = ".mount-targets.json";
+const MOUNT_TARGETS_DIR = "vault-mount-targets";
 const RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, "extensions"]);
 export function normalizeSharedVaultName(name) {
     const trimmed = name.trim();
@@ -21,52 +18,44 @@ export function sharedVaultKey(name) {
     const normalized = normalizeSharedVaultName(name);
     return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;
 }
-function sanitizeCloudflareSandboxId(value) {
-    return (value
-        .toLowerCase()
-        .replace(/[^a-z0-9-]+/g, "-")
-        .replace(/^-+|-+$/g, "") || "unknown");
-}
-// ── parseEnvFile ───────────────────────────────────────────────────────────────
-/**
- * Parse a KEY=VALUE env file. Supports:
- * - Lines starting with # are comments
- * - Empty lines are skipped
- * - Values can be quoted with single or double quotes (quotes are stripped)
- * - No variable expansion
- * - The value is everything after the first `=` to end of line (no inline comments)
- */
 export function parseEnvFile(content) {
     const env = {};
-    const lines = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
-    for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#"))
-            continue;
-        const eqIndex = trimmed.indexOf("=");
-        if (eqIndex === -1)
-            continue;
-        const key = trimmed.slice(0, eqIndex).trim();
-        if (!key)
-            continue;
-        let value = trimmed.slice(eqIndex + 1);
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        env[key] = value;
+    for (const line of content.split(/\r\n|\r|\n/)) {
+        const entry = parseEnvLine(line);
+        if (entry)
+            env[entry[0]] = entry[1];
     }
     return env;
 }
-// ── FileVaultManager ───────────────────────────────────────────────────────────
+function parseEnvLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+        return undefined;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1)
+        return undefined;
+    const key = trimmed.slice(0, eqIndex).trim();
+    if (!key)
+        return undefined;
+    return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];
+}
+function unquoteEnvValue(value) {
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote))
+        return value.slice(1, -1);
+    return value;
+}
 export class FileVaultManager {
     constructor(stateDir) {
         this.vaultsDir = join(stateDir, "vaults");
+        this.mountTargetsDir = join(stateDir, MOUNT_TARGETS_DIR);
     }
     isEnabled() {
         return existsSync(this.vaultsDir);
     }
     hasEntry(key) {
+        if (!isSafeVaultKey(key))
+            return false;
         return existsSync(join(this.vaultsDir, key));
     }
     listSharedVaults() {
@@ -85,9 +74,12 @@ export class FileVaultManager {
         const dir = join(this.vaultsDir, key);
         const existed = existsSync(dir);
         rmSync(dir, { recursive: true, force: true });
+        rmSync(this.mountTargetsPath(key), { force: true });
         return existed;
     }
     copySharedVaultTo(name, targetKey) {
+        if (!isSafeVaultKey(targetKey))
+            throw new Error(`vault: invalid vault key: ${targetKey}`);
         const sourceKey = sharedVaultKey(name);
         if (!sourceKey)
             throw new Error(`vault: invalid shared login name: ${name}`);
@@ -95,36 +87,43 @@ export class FileVaultManager {
         if (!existsSync(sourceDir))
             throw new Error(`vault: shared login "${name}" does not exist`);
         const targetDir = join(this.vaultsDir, targetKey);
+        assertNoLegacyMountTargetsCollision(sourceDir);
+        assertNoLegacyMountTargetsCollision(targetDir);
+        const sourceTargets = readMountTargets(this.mountTargetsPath(sourceKey));
+        const targetTargets = readMountTargets(this.mountTargetsPath(targetKey));
         ensurePrivateDir(this.vaultsDir);
         ensurePrivateDir(targetDir);
-        return copyVaultDir(sourceDir, targetDir);
+        const result = copyVaultDir(sourceDir, targetDir);
+        writeMountTargets(this.mountTargetsPath(targetKey), {
+            ...targetTargets,
+            ...sourceTargets,
+        });
+        return result;
     }
     resolve(userId) {
+        if (!isSafeVaultKey(userId))
+            return undefined;
         const dir = join(this.vaultsDir, userId);
         if (!existsSync(dir))
             return undefined;
         return this.buildResolved(userId);
     }
-    getSandboxConfig(userId, baseConfig) {
-        if (baseConfig.type === "cloudflare") {
-            return {
-                type: "cloudflare",
-                sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,
-            };
-        }
-        return baseConfig;
-    }
     list() {
         if (!existsSync(this.vaultsDir))
             return [];
         const keys = new Set();
         for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {
-            if (entry.isDirectory() && !RESERVED_VAULT_DIRS.has(entry.name))
+            if (entry.isDirectory() &&
+                !RESERVED_VAULT_DIRS.has(entry.name) &&
+                isSafeVaultKey(entry.name)) {
                 keys.add(entry.name);
+            }
         }
         return Array.from(keys, (key) => this.buildResolved(key));
     }
     upsertEnv(key, env) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
         const dir = join(this.vaultsDir, key);
         const envPath = join(dir, "env");
         ensurePrivateDir(this.vaultsDir);
@@ -138,51 +137,61 @@ export class FileVaultManager {
             .join("\n") + "\n";
         atomicWritePrivateFile(envPath, content);
     }
+    deleteEnvKey(key, envKey) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
+        const envPath = join(this.vaultsDir, key, "env");
+        const existingContent = readTextFileIfExists(envPath);
+        if (existingContent === undefined)
+            return false;
+        const existing = parseEnvFile(existingContent);
+        if (!(envKey in existing))
+            return false;
+        delete existing[envKey];
+        const content = Object.entries(existing)
+            .toSorted(([left], [right]) => left.localeCompare(right))
+            .map(([name, value]) => `${name}=${value}`)
+            .join("\n") + "\n";
+        atomicWritePrivateFile(envPath, content);
+        return true;
+    }
     upsertFile(key, relativePath, content, targetPath) {
+        if (!isSafeVaultKey(key))
+            throw new Error(`vault: invalid vault key: ${key}`);
         const normalizedPath = normalizeVaultRelativePath(relativePath);
-        if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {
+        const normalizedTarget = normalizeVaultTargetPath(targetPath);
+        if (!normalizedPath ||
+            normalizedPath === LEGACY_MOUNT_TARGETS_FILE ||
+            (targetPath !== undefined && !normalizedTarget)) {
             throw new Error(`vault: invalid relative secret file path for "${key}": ${relativePath}`);
         }
         const dir = join(this.vaultsDir, key);
         const filePath = join(dir, normalizedPath);
+        assertNoLegacyMountTargetsCollision(dir);
         ensurePrivateDir(this.vaultsDir);
         ensurePrivateDir(dir);
         const parentDir = dirname(filePath);
         if (parentDir !== dir)
             ensurePrivateDir(parentDir);
         atomicWritePrivateFile(filePath, content);
+        updateMountTarget(this.mountTargetsPath(key), normalizedPath, normalizedTarget);
     }
-    // ── private ────────────────────────────────────────────────────────────────
     buildResolved(key) {
         const dir = join(this.vaultsDir, key);
-        const mounts = inferMountsFromDir(dir);
-        let env = {};
+        assertNoLegacyMountTargetsCollision(dir);
+        const mounts = resolveMountsFromDir(dir, readMountTargets(this.mountTargetsPath(key)));
         const envContent = readTextFileIfExists(join(dir, "env"));
-        if (envContent !== undefined) {
-            try {
-                env = parseEnvFile(envContent);
-            }
-            catch (err) {
-                console.error(`vault: failed to parse env file for "${key}":`, err);
-                reportUserFacingError(err, {
-                    domain: "sandbox",
-                    surface: "vault_injection",
-                    operation: "parse_env",
-                    severity: "warning",
-                    context: { vaultKey: key, fatal: false },
-                });
-            }
-        }
+        const env = envContent === undefined ? {} : parseEnvFile(envContent);
         return {
-            userId: key,
-            displayName: key,
-            dir,
             mounts,
             env,
         };
     }
+    mountTargetsPath(key) {
+        return join(this.mountTargetsDir, `${key}.json`);
+    }
 }
-function inferMountsFromDir(dir) {
+function resolveMountsFromDir(dir, explicitTargets) {
     if (!existsSync(dir))
         return [];
     const mounts = [];
@@ -190,49 +199,149 @@ function inferMountsFromDir(dir) {
         if (entry.name === "env")
             continue;
         const source = join(dir, entry.name);
-        const target = inferredVaultTargetPath(entry.name);
-        if (!target)
+        const inferredTarget = inferredVaultTargetPath(entry.name);
+        if (!inferredTarget)
+            continue;
+        const explicitTarget = Object.hasOwn(explicitTargets, entry.name)
+            ? explicitTargets[entry.name]
+            : undefined;
+        if (explicitTarget) {
+            mounts.push({ source, target: explicitTarget });
+            continue;
+        }
+        const nestedPrefix = `${entry.name}/`;
+        const hasExplicitDescendant = Object.keys(explicitTargets).some((relativePath) => relativePath.startsWith(nestedPrefix));
+        if (!entry.isDirectory() || !hasExplicitDescendant) {
+            mounts.push({ source, target: inferredTarget });
             continue;
-        mounts.push({ source, target });
+        }
+        mounts.push(...resolveNestedMounts(dir, entry.name, inferredTarget, explicitTargets));
     }
     return mounts;
 }
+function resolveNestedMounts(rootDir, relativeDir, targetDir, explicitTargets) {
+    const mounts = [];
+    for (const entry of readdirSync(join(rootDir, relativeDir), { withFileTypes: true })) {
+        const relativePath = `${relativeDir}/${entry.name}`;
+        const source = join(rootDir, relativePath);
+        const inferredTarget = `${targetDir}/${entry.name}`;
+        const explicitTarget = Object.hasOwn(explicitTargets, relativePath)
+            ? explicitTargets[relativePath]
+            : undefined;
+        if (explicitTarget) {
+            mounts.push({ source, target: explicitTarget });
+            continue;
+        }
+        const nestedPrefix = `${relativePath}/`;
+        const hasExplicitDescendant = Object.keys(explicitTargets).some((candidate) => candidate.startsWith(nestedPrefix));
+        if (!entry.isDirectory() || !hasExplicitDescendant) {
+            mounts.push({ source, target: inferredTarget });
+            continue;
+        }
+        mounts.push(...resolveNestedMounts(rootDir, relativePath, inferredTarget, explicitTargets));
+    }
+    return mounts;
+}
+function assertNoLegacyMountTargetsCollision(dir) {
+    const path = join(dir, LEGACY_MOUNT_TARGETS_FILE);
+    if (existsSync(path)) {
+        throw new Error(`vault: reserved mount metadata filename collision: ${path}`);
+    }
+}
+function readMountTargets(path) {
+    const raw = readTextFileIfExists(path);
+    if (raw === undefined)
+        return Object.create(null);
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`vault: invalid mount target metadata: ${path}`, { cause: error });
+    }
+    if (!isRecord(value))
+        throw new Error(`vault: invalid mount target metadata: ${path}`);
+    const targets = Object.create(null);
+    for (const [relativePath, targetPath] of Object.entries(value)) {
+        const normalizedPath = normalizeVaultRelativePath(relativePath);
+        const normalizedTarget = typeof targetPath === "string" ? normalizeVaultTargetPath(targetPath) : undefined;
+        if (normalizedPath !== relativePath || !normalizedTarget || normalizedTarget !== targetPath) {
+            throw new Error(`vault: invalid mount target metadata: ${path}`);
+        }
+        targets[relativePath] = targetPath;
+    }
+    return targets;
+}
+function updateMountTarget(path, relativePath, targetPath) {
+    const targets = readMountTargets(path);
+    if (targetPath === undefined)
+        delete targets[relativePath];
+    else
+        targets[relativePath] = targetPath;
+    writeMountTargets(path, targets);
+}
+function writeMountTargets(path, targets) {
+    if (Object.keys(targets).length === 0) {
+        rmSync(path, { force: true });
+        return;
+    }
+    ensurePrivateDir(dirname(path));
+    atomicWritePrivateFile(path, `${JSON.stringify(targets, null, 2)}\n`);
+}
 function ensurePrivateDir(path) {
     mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });
     chmodSync(path, PRIVATE_DIR_MODE);
 }
 function copyVaultDir(sourceDir, targetDir) {
-    let filesCopied = 0;
-    let envKeysCopied = 0;
+    const total = { filesCopied: 0, envKeysCopied: 0 };
     for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
-        const sourcePath = join(sourceDir, entry.name);
-        const targetPath = join(targetDir, entry.name);
-        if (entry.name === "env" && entry.isFile()) {
-            const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? "");
-            const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? "");
-            const merged = { ...targetEnv, ...sourceEnv };
-            const content = Object.entries(merged)
-                .toSorted(([left], [right]) => left.localeCompare(right))
-                .map(([envKey, value]) => `${envKey}=${value}`)
-                .join("\n") + "\n";
-            atomicWritePrivateFile(targetPath, content);
-            envKeysCopied += Object.keys(sourceEnv).length;
-            continue;
-        }
-        if (entry.isDirectory()) {
-            ensurePrivateDir(targetPath);
-            const nested = copyVaultDir(sourcePath, targetPath);
-            filesCopied += nested.filesCopied;
-            envKeysCopied += nested.envKeysCopied;
-            continue;
-        }
-        if (!entry.isFile())
-            continue;
-        copyFileSync(sourcePath, targetPath);
-        chmodSync(targetPath, 0o600);
-        filesCopied++;
+        const counts = copyVaultEntry(sourceDir, targetDir, entry);
+        total.filesCopied += counts.filesCopied;
+        total.envKeysCopied += counts.envKeysCopied;
+    }
+    return total;
+}
+function copyVaultEntry(sourceDir, targetDir, entry) {
+    const sourcePath = join(sourceDir, entry.name);
+    const targetPath = join(targetDir, entry.name);
+    if (entry.name === "env" && entry.isFile()) {
+        return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };
     }
-    return { filesCopied, envKeysCopied };
+    if (entry.isDirectory()) {
+        ensurePrivateDir(targetPath);
+        return copyVaultDir(sourcePath, targetPath);
+    }
+    if (!entry.isFile())
+        return { filesCopied: 0, envKeysCopied: 0 };
+    copyFileSync(sourcePath, targetPath);
+    chmodSync(targetPath, 0o600);
+    return { filesCopied: 1, envKeysCopied: 0 };
+}
+function mergeVaultEnvFile(sourcePath, targetPath) {
+    const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? "");
+    const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? "");
+    const merged = { ...targetEnv, ...sourceEnv };
+    const content = Object.entries(merged)
+        .toSorted(([left], [right]) => left.localeCompare(right))
+        .map(([envKey, value]) => `${envKey}=${value}`)
+        .join("\n") + "\n";
+    atomicWritePrivateFile(targetPath, content);
+    return Object.keys(sourceEnv).length;
+}
+function isSafeVaultKey(key) {
+    if (typeof key !== "string" || !key || isAbsolute(key))
+        return false;
+    if (/^[A-Za-z]:[\\/]/.test(key))
+        return false;
+    return key.split(/[\\/]/).every((segment) => {
+        return (segment !== "" && segment !== "." && segment !== ".." && !hasUnsafeControlCharacter(segment));
+    });
+}
+function hasUnsafeControlCharacter(value) {
+    return Array.from(value).some((character) => {
+        const code = character.codePointAt(0) ?? 0;
+        return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);
+    });
 }
 function normalizeVaultRelativePath(relativePath) {
     const trimmed = relativePath.trim();
@@ -253,29 +362,93 @@ function normalizeVaultTargetPath(targetPath) {
     const normalized = normalize(trimmed).split(sep).join("/");
     return normalized.startsWith("/") ? normalized : undefined;
 }
+export const GOOGLE_VAULT_CREDENTIAL_FILES = Object.freeze({
+    workspaceCli: Object.freeze({
+        relativePath: "gws.json",
+        targetPath: guestHomePath(".config/gws/credentials.json"),
+    }),
+    cloudSdk: Object.freeze({
+        relativePath: "gcloud-adc.json",
+        targetPath: guestHomePath(".config/gcloud/application_default_credentials.json"),
+    }),
+});
 export function defaultVaultTargetPath(relativePath) {
     const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\/+/, "");
-    return `/root/${normalized}`;
+    return guestHomePath(normalized);
 }
 function inferredVaultTargetPath(relativePath) {
     const normalized = normalizeVaultRelativePath(relativePath);
     if (!normalized)
         return undefined;
-    if (normalized === "gws.json") {
-        return "/root/.config/gws/credentials.json";
-    }
-    if (normalized === "gcloud-adc.json") {
-        return "/root/.config/gcloud/application_default_credentials.json";
+    for (const file of Object.values(GOOGLE_VAULT_CREDENTIAL_FILES)) {
+        if (normalized === file.relativePath)
+            return file.targetPath;
     }
     if (normalized === ".ssh" || normalized.startsWith(".ssh/")) {
-        return "/root/.ssh";
+        return guestHomePath(".ssh");
     }
     if (normalized === ".kube" || normalized.startsWith(".kube/")) {
-        return "/root/.kube";
+        return guestHomePath(".kube");
     }
     if (normalized === ".config/gh" || normalized.startsWith(".config/gh/")) {
-        return "/root/.config/gh";
+        return guestHomePath(".config/gh");
     }
     return defaultVaultTargetPath(normalized);
 }
+export function allowsAmbientDefaultSharedVault(options) {
+    const trustModel = options.trustModel ?? "membership";
+    if (trustModel === "open-trigger")
+        return false;
+    return options.sandboxType === "image" || options.sandboxType === "cloudflare";
+}
+import { isRecord } from "../unknown-values.js";
+function resolveExistingMounts(vault, sandboxType, address) {
+    const mounts = [];
+    for (const mount of vault?.mounts ?? []) {
+        if (!existsSync(mount.source)) {
+            reportUserFacingError(new Error("Vault mount source is missing"), {
+                domain: "sandbox",
+                surface: "vault_injection",
+                operation: "resolve_mounts",
+                severity: "warning",
+                context: {
+                    sandboxType,
+                    conversationId: address.conversationId,
+                    target: mount.target,
+                    hasVault: Boolean(vault),
+                },
+            });
+            continue;
+        }
+        mounts.push({ source: mount.source, target: mount.target });
+    }
+    return mounts;
+}
+export function resolveVaultInjection(options) {
+    const { vault, capabilities, sandboxType, address } = options;
+    if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {
+        throw new Error(`Sandbox type "${sandboxType}" does not support vault file mounts`);
+    }
+    const mounts = resolveExistingMounts(vault, sandboxType, address);
+    const env = capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
+    return { env, mounts };
+}
+export const disabledVaultManager = {
+    isEnabled: () => false,
+    hasEntry: () => false,
+    resolve: () => undefined,
+    list: () => [],
+    listSharedVaults: () => [],
+    deleteSharedVault: () => false,
+    copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),
+    upsertEnv: () => {
+        throw new Error("Vault not configured");
+    },
+    deleteEnvKey: () => {
+        throw new Error("Vault not configured");
+    },
+    upsertFile: () => {
+        throw new Error("Vault not configured");
+    },
+};
 //# sourceMappingURL=index.js.map