@getparallel/parx 0.0.0-stage → 0.4.0

package/dist/seguridad.js

@@ -0,0 +1,164 @@
+import { existsSync, realpathSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+const NOMBRES_DE_CREDENCIAL = [
+    /^\.env(\..+)?$/i,
+    /^\.envrc$/i,
+    /^id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
+    /\.(pem|key|p12|pfx|jks|keystore|kdbx|ppk|gpg|asc|der|crt|cer|p8|mobileprovision)$/i,
+    /^\.(npmrc|pypirc|netrc|git-credentials|htpasswd|pgpass|my\.cnf|s3cfg|boto|dockercfg|supabase-token|velora-secrets)$/i,
+    /^_netrc$/i,
+    /^credentials(\.json|\.yml|\.yaml|\.toml)?$/i,
+    /^credenciales\.json$/i,
+    /^(service[-_]?account|client[-_]?secret)[^/]*\.json$/i,
+    /^secrets?\.(json|ya?ml|toml|env)$/i,
+    /^terraform\.tfstate(\.backup)?$/i,
+    /^\.?vault[-_]?token$/i,
+];
+const PLANTILLAS = /^\.env\.(example|sample|template|dist|defaults)$/i;
+const CARPETAS_DE_CREDENCIAL = ['.ssh', '.aws', '.gnupg', '.azure', '.kube', '.password-store', '.docker', 'Keychains', '1Password', '.vercel', '.supabase'];
+const RUTAS_DE_CREDENCIAL = [join('.config', 'gcloud'), join('.config', 'gh'), join('.config', 'parallel-code'), join('AppData', 'Roaming', 'parallel-code'), join('.config', 'parx'), join('AppData', 'Roaming', 'parx')];
+export function esCredencial(ruta) {
+    const nombre = basename(ruta);
+    if (PLANTILLAS.test(nombre))
+        return false;
+    if (NOMBRES_DE_CREDENCIAL.some((r) => r.test(nombre)))
+        return true;
+    const partes = ruta.split(/[\\/]+/);
+    if (partes.some((p) => CARPETAS_DE_CREDENCIAL.includes(p)))
+        return true;
+    const normal = ruta.replace(/[\\/]+/g, sep);
+    return RUTAS_DE_CREDENCIAL.some((r) => normal.includes(`${sep}${r}${sep}`) || normal.endsWith(`${sep}${r}`));
+}
+export function rutaReal(abs) {
+    let actual = abs;
+    const resto = [];
+    while (!existsSync(actual)) {
+        const padre = dirname(actual);
+        if (padre === actual)
+            break;
+        resto.unshift(basename(actual));
+        actual = padre;
+    }
+    try {
+        return join(realpathSync.native(actual), ...resto);
+    }
+    catch {
+        return abs;
+    }
+}
+export function estaDentro(abs, dir) {
+    const rel = relative(dir, abs);
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+export function resolverRuta(raiz, pedida) {
+    const raizReal = rutaReal(resolve(raiz));
+    const expandida = pedida === '~' || pedida.startsWith('~/') || pedida.startsWith('~\\') ? join(homedir(), pedida.slice(1)) : pedida;
+    const abs = rutaReal(isAbsolute(expandida) ? resolve(expandida) : resolve(raizReal, expandida));
+    const rel = relative(raizReal, abs);
+    const dentro = rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+    return { absoluta: abs, mostrar: dentro ? rel || '.' : abs, dentro, credencial: esCredencial(abs) || esCredencial(pedida) };
+}
+const BLOQUEADOS = [
+    [/(^|[\s'"=/\\(<])\.env(\.[\w.-]+)?(?=$|[\s'";|&)>])/i, 'reads a .env file'],
+    [/(^|[\s'"/\\])\.(ssh|aws|gnupg|azure|kube|docker|password-store|npmrc|pypirc|netrc|git-credentials|supabase-token|velora-secrets|vercel)([\s'"/\\;|&)]|$)/i, 'touches a credentials location'],
+    [/\bid_(rsa|dsa|ecdsa|ed25519)\b/i, 'touches an SSH key'],
+    [/\b(security\s+(find|dump|export)-(generic|internet)?-?(password|keychain)|security\s+dump-keychain)\b/i, 'reads the macOS keychain'],
+    [/\b(cmdkey|vaultcmd)\b|Get-StoredCredential|CredentialManager/i, 'reads the Windows credential store'],
+    [/\bgit\s+credential\b|\bgh\s+auth\s+token\b|\bnpm\s+token\b|\bvercel\s+(env\s+pull|tokens?)\b|\bsupabase\s+.*access-token\b/i, 'asks a tool for its token'],
+    [/credenciales\.json|(parallel-code|parx)[\\/]+credenciales|par_key_|PARALLEL_API_KEY|PARX_API_KEY/i, 'touches parx credentials'],
+    [/\.pem\b|\.p12\b|\.pfx\b|\.kdbx\b/i, 'touches a key file'],
+];
+const CON_RIESGO = [
+    [/(^|[;&|]\s*|\s)(sudo|doas|su)\s/, 'runs as administrator'],
+    [/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s+)+(\/|~|\$HOME|\.\.|\*\s*$)/, 'deletes recursively outside or at the root'],
+    [/\brm\s+-[a-zA-Z]*r[a-zA-Z]*f|\brm\s+-[a-zA-Z]*f[a-zA-Z]*r/, 'deletes recursively'],
+    [/Remove-Item\b[^\n]*-Recurse|\b(rd|rmdir)\s+\/s\b|\bdel\s+\/[sq]/i, 'deletes recursively'],
+    [/\bgit\s+(push|reset\s+--hard|clean\s+-[a-z]*f|checkout\s+--\s|rebase|filter-branch|branch\s+-D)/, 'rewrites or publishes git history'],
+    [/\b(npm|pnpm|yarn|bun)\s+(publish|unpublish|deprecate|owner|login|adduser)\b/, 'publishes or changes a registry account'],
+    [/\b(npm|pnpm|yarn|bun)\s+(i|install|add)\b[^\n]*\s(-g|--global)\b|\bbrew\s+(install|uninstall|upgrade)|\bpip3?\s+install\b(?![^\n]*(-r\s|--user|\.venv|venv))|\b(apt|apt-get|dnf|yum|pacman|choco|winget|scoop)\s/, 'installs software on the system'],
+    [/\b(curl|wget|iwr|Invoke-WebRequest|irm|Invoke-RestMethod)\b[^\n|]*\|\s*(sh|bash|zsh|python3?|node|iex|Invoke-Expression|pwsh|powershell)\b/i, 'pipes a download into an interpreter'],
+    [/\b(ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\s/, 'connects to another machine'],
+    [/\b(curl|wget)\b[^\n]*\s(-X\s*(POST|PUT|DELETE|PATCH)|--data|-d\s|-F\s|--upload-file|-T\s)/i, 'sends data over the network'],
+    [/\b(chmod|chown)\s+-R\b|\bchmod\s+[0-7]*7[0-7]*7\b/, 'changes permissions recursively'],
+    [/\b(mkfs|fdisk|diskutil|dd\s+if=|format\s+[a-z]:|shutdown|reboot|halt|launchctl|systemctl|crontab|reg\s+(add|delete)|Set-ExecutionPolicy|bcdedit|schtasks)\b/i, 'changes the system'],
+    [/\b(kill|killall|pkill|taskkill|Stop-Process)\b/i, 'stops processes'],
+    [/(^|\s)(>|>>)\s*(\/|~|\$HOME|[A-Za-z]:\\)/, 'writes outside the project'],
+    [/(^|[\s;&|])cd\s+(\/|~|\.\.|\$HOME|[A-Za-z]:\\)/, 'leaves the project folder'],
+    [/\b(docker|podman)\s+(run|rm|rmi|system\s+prune|volume\s+rm)\b/, 'manages containers'],
+    [/\bdeploy\b|\bvercel\b|\bnetlify\b|\bfirebase\s+deploy\b|\bfly\s+deploy\b/i, 'deploys'],
+    [/:\(\)\s*\{\s*:\|:&\s*\};:/, 'fork bomb'],
+];
+export function nivelDeComando(comando) {
+    const sinPlantillas = comando.replace(/\.env\.(example|sample|template|dist|defaults)\b/gi, '');
+    for (const [r, motivo] of BLOQUEADOS)
+        if (r.test(sinPlantillas))
+            return { nivel: 'credencial', motivo };
+    for (const [r, motivo] of CON_RIESGO)
+        if (r.test(comando))
+            return { nivel: 'riesgo', motivo };
+    return { nivel: 'normal', motivo: null };
+}
+export function familiaDeComando(comando) {
+    const palabras = comando.trim().split(/\s+/).filter((p) => !/^[A-Z_]+=/.test(p));
+    return palabras.slice(0, 2).join(' ');
+}
+const SECRETO = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|PRIVATE|COOKIE|SESSION|AUTH|DSN|_PAT$|^PAT_)/i;
+const SE_QUEDAN = new Set(['TERM_SESSION_ID', 'XPC_SERVICE_NAME', 'SESSIONNAME', 'XDG_SESSION_TYPE', 'XDG_SESSION_ID', 'XDG_SESSION_CLASS', 'XDG_SESSION_DESKTOP', 'DESKTOP_SESSION']);
+const SIEMPRE_FUERA = new Set(['SSH_AUTH_SOCK', 'GPG_AGENT_INFO', 'DATABASE_URL', 'POSTGRES_URL', 'REDIS_URL', 'MONGODB_URI', 'NPM_CONFIG_USERCONFIG']);
+export function entornoLimpio(env = process.env) {
+    const limpio = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v === undefined)
+            continue;
+        if (SIEMPRE_FUERA.has(k.toUpperCase()))
+            continue;
+        if (SECRETO.test(k) && !SE_QUEDAN.has(k.toUpperCase()))
+            continue;
+        if (/^[a-z]+:\/\/[^\s:@/]+:[^\s@/]+@/i.test(v))
+            continue;
+        limpio[k] = v;
+    }
+    limpio.CI = '1';
+    limpio.PARALLEL_CODE = '1';
+    limpio.PARX = '1';
+    limpio.GIT_TERMINAL_PROMPT = '0';
+    return limpio;
+}
+function escaparSb(ruta) {
+    return ruta.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+export function perfilDeJaulaMac(raiz, home = homedir(), otras = []) {
+    const raizReal = rutaReal(resolve(raiz));
+    const tmp = rutaReal(tmpdir());
+    const escribibles = [
+        raizReal,
+        ...otras.map((o) => rutaReal(resolve(o))),
+        tmp,
+        '/private/tmp',
+        '/private/var/folders',
+        join(home, '.npm'),
+        join(home, '.cache'),
+        join(home, 'Library', 'Caches'),
+        join(home, '.yarn'),
+        join(home, '.pnpm-store'),
+        join(home, '.bun', 'install', 'cache'),
+        join(home, '.cargo', 'registry'),
+        join(home, 'go', 'pkg', 'mod'),
+        join(home, '.gradle'),
+        join(home, '.m2'),
+    ];
+    const prohibidas = [...CARPETAS_DE_CREDENCIAL.map((d) => join(home, d)), join(home, '.config', 'gcloud'), join(home, '.config', 'gh'), join(home, '.config', 'parallel-code'), join(home, '.config', 'parx'), join(home, 'Library', 'Keychains')];
+    const lineas = [
+        '(version 1)',
+        '(allow default)',
+        '(deny file-write*)',
+        `(allow file-write* ${escribibles.map((r) => `(subpath "${escaparSb(r)}")`).join(' ')} (literal "/dev/null") (literal "/dev/zero") (literal "/dev/dtracehelper") (regex #"^/dev/tty") (regex #"^/dev/fd/"))`,
+        `(deny file-read* ${prohibidas.map((r) => `(subpath "${escaparSb(r)}")`).join(' ')} (regex #"/\\.env(\\.[^/]*)?$") (regex #"/\\.(npmrc|netrc|git-credentials|supabase-token|velora-secrets)$"))`,
+        `(allow file-read* (regex #"/\\.env\\.(example|sample|template)$"))`,
+    ];
+    return lineas.join('\n');
+}
+export function hayJaulaMac(plataforma = process.platform) {
+    return plataforma === 'darwin' && existsSync('/usr/bin/sandbox-exec');
+}

package/dist/shell.js

@@ -0,0 +1,108 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { entornoLimpio, hayJaulaMac, perfilDeJaulaMac } from "./seguridad.js";
+let cacheShell = null;
+export function __reiniciarShell() {
+    cacheShell = null;
+}
+function existeEnPath(programa) {
+    const r = spawnSync(process.platform === 'win32' ? 'where' : 'which', [programa], { stdio: 'ignore' });
+    return r.status === 0;
+}
+export function shellDelSistema(env = process.env, plataforma = process.platform) {
+    if (cacheShell)
+        return cacheShell;
+    const pedido = (env.PARALLEL_SHELL ?? '').toLowerCase();
+    if (plataforma === 'win32') {
+        if (pedido === 'cmd') {
+            cacheShell = { nombre: 'cmd', programa: env.ComSpec ?? 'cmd.exe', argumentos: (c) => ['/d', '/s', '/c', c] };
+        }
+        else {
+            const ps = pedido === 'powershell' ? 'powershell.exe' : existeEnPath('pwsh') ? 'pwsh' : 'powershell.exe';
+            cacheShell = { nombre: ps === 'pwsh' ? 'PowerShell 7' : 'Windows PowerShell', programa: ps, argumentos: (c) => ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', c] };
+        }
+        return cacheShell;
+    }
+    const propio = env.SHELL ?? '';
+    const valido = /\/(bash|zsh|sh|fish|dash|ksh)$/.test(propio) && existsSync(propio);
+    const programa = pedido && existsSync(pedido) ? pedido : valido ? propio : '/bin/sh';
+    cacheShell = { nombre: programa.split('/').pop() ?? 'sh', programa, argumentos: (c) => ['-c', c] };
+    return cacheShell;
+}
+export function recortar(texto, max = 24_000) {
+    if (texto.length <= max)
+        return texto;
+    const mitad = Math.floor(max / 2);
+    return `${texto.slice(0, mitad)}\n\n[… ${texto.length - max} characters omitted …]\n\n${texto.slice(-mitad)}`;
+}
+export function ejecutarComando(comando, opciones) {
+    const shell = shellDelSistema();
+    const enJaula = opciones.jaula && hayJaulaMac();
+    const programa = enJaula ? '/usr/bin/sandbox-exec' : shell.programa;
+    const args = enJaula ? ['-p', perfilDeJaulaMac(opciones.cwd, homedir(), opciones.carpetas ?? []), shell.programa, ...shell.argumentos(comando)] : shell.argumentos(comando);
+    const inicio = Date.now();
+    return new Promise((resolver) => {
+        const hijo = spawn(programa, args, {
+            cwd: opciones.cwd,
+            env: entornoLimpio(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+            windowsHide: true,
+        });
+        let salida = '';
+        let plazoAgotado = false;
+        let interrumpido = false;
+        const añadir = (b) => {
+            const trozo = b.toString('utf8');
+            if (salida.length < 2_000_000)
+                salida += trozo;
+            opciones.alSalir?.(trozo);
+        };
+        hijo.stdout?.on('data', añadir);
+        hijo.stderr?.on('data', añadir);
+        const matar = () => {
+            if (hijo.pid === undefined || hijo.exitCode !== null)
+                return;
+            try {
+                if (process.platform === 'win32')
+                    spawnSync('taskkill', ['/pid', String(hijo.pid), '/T', '/F'], { stdio: 'ignore' });
+                else
+                    process.kill(-hijo.pid, 'SIGKILL');
+            }
+            catch {
+                try {
+                    hijo.kill('SIGKILL');
+                }
+                catch {
+                }
+            }
+        };
+        const reloj = setTimeout(() => {
+            plazoAgotado = true;
+            matar();
+        }, opciones.plazoMs);
+        const alAbortar = () => {
+            interrumpido = true;
+            matar();
+        };
+        opciones.señal?.addEventListener('abort', alAbortar, { once: true });
+        hijo.on('error', (e) => {
+            salida += `\n${String(e.message)}`;
+        });
+        hijo.on('close', (codigo) => {
+            clearTimeout(reloj);
+            opciones.señal?.removeEventListener('abort', alAbortar);
+            resolver({ codigo, salida, plazoAgotado, interrumpido, ms: Date.now() - inicio, enJaula });
+        });
+    });
+}
+export function descripcionDelSistema() {
+    const s = shellDelSistema();
+    const so = process.platform === 'darwin' ? 'macOS' : process.platform === 'win32' ? 'Windows' : process.platform === 'linux' ? 'Linux' : process.platform;
+    return `${so} (${process.arch}), shell: ${s.nombre}`;
+}
+export function esRepoGit(dir) {
+    return existsSync(join(dir, '.git'));
+}

package/dist/texto.js

@@ -0,0 +1,165 @@
+const ESCAPE = /\x1b\[[0-9;?]*[ -/]*[@-~]/y;
+export function sinColor(t) {
+    return t.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '');
+}
+let PUNTOS = '…';
+export function puntos() {
+    return PUNTOS;
+}
+export function usarPuntosAscii(si) {
+    PUNTOS = si ? '~' : '…';
+}
+const ANCHO_DOBLE = /[ᄀ-ᅟ⺀-〾ぁ-㏿㐀-䶿一-鿿ꀀ-꓏가-힣豈-﫿︰-﹏＀-｠￠-￦]/;
+export function anchoDeCaracter(ch) {
+    const cp = ch.codePointAt(0);
+    if (cp < 32 || cp === 0x7f)
+        return 0;
+    if ((cp >= 0x300 && cp <= 0x36f) || (cp >= 0xfe00 && cp <= 0xfe0f) || cp === 0x200d || cp === 0x200b)
+        return 0;
+    if (cp > 0xffff && cp < 0xe0000)
+        return 2;
+    return ANCHO_DOBLE.test(ch) ? 2 : 1;
+}
+export function anchoDe(texto) {
+    let n = 0;
+    for (const ch of sinColor(texto))
+        n += anchoDeCaracter(ch);
+    return n;
+}
+function* trozos(texto) {
+    let i = 0;
+    while (i < texto.length) {
+        if (texto[i] === '\x1b') {
+            ESCAPE.lastIndex = i;
+            const m = ESCAPE.exec(texto);
+            if (m) {
+                yield { esc: true, v: m[0], w: 0 };
+                i += m[0].length;
+                continue;
+            }
+        }
+        const cp = texto.codePointAt(i);
+        const ch = String.fromCodePoint(cp);
+        i += ch.length;
+        yield { esc: false, v: ch, w: anchoDeCaracter(ch) };
+    }
+}
+export function cortarAlAncho(texto, max) {
+    let n = 0;
+    let out = '';
+    for (const ch of texto) {
+        const w = anchoDeCaracter(ch);
+        if (n + w > max)
+            break;
+        n += w;
+        out += ch;
+    }
+    return out;
+}
+export function recortar(texto, max, p = PUNTOS) {
+    if (max <= 0)
+        return '';
+    if (anchoDe(texto) <= max)
+        return texto;
+    const limite = max - anchoDe(p);
+    let n = 0;
+    let out = '';
+    let conColor = false;
+    for (const t of trozos(texto)) {
+        if (t.esc) {
+            out += t.v;
+            conColor = true;
+            continue;
+        }
+        if (n + t.w > limite)
+            break;
+        n += t.w;
+        out += t.v;
+    }
+    return `${out}${conColor ? '\x1b[0m' : ''}${limite >= 0 ? p : ''}`;
+}
+export function recortarMedio(texto, max) {
+    if (anchoDe(texto) <= max)
+        return texto;
+    if (max <= 1)
+        return cortarAlAncho(PUNTOS, max);
+    const chars = Array.from(texto);
+    const atras = Math.ceil((max - 1) / 2);
+    const delante = max - 1 - atras;
+    let fin = '';
+    let w = 0;
+    for (let i = chars.length - 1; i >= 0; i--) {
+        const cw = anchoDeCaracter(chars[i]);
+        if (w + cw > atras)
+            break;
+        w += cw;
+        fin = chars[i] + fin;
+    }
+    return `${cortarAlAncho(texto, delante)}${PUNTOS}${fin}`;
+}
+export function rellenar(texto, ancho) {
+    const r = recortar(texto, ancho);
+    return r + ' '.repeat(Math.max(0, ancho - anchoDe(r)));
+}
+function colorAbierto(activos, esc) {
+    const m = /^\x1b\[([0-9;]*)m$/.exec(esc);
+    if (!m)
+        return;
+    const p = m[1] ?? '';
+    if (p === '' || p === '0')
+        activos.length = 0;
+    else if (p === '39')
+        quitar(activos, (x) => /^\x1b\[(3[0-8]|9[0-7])[;m]/.test(x));
+    else if (p === '22')
+        quitar(activos, (x) => /^\x1b\[[12]m/.test(x));
+    else
+        activos.push(esc);
+}
+function quitar(a, f) {
+    for (let i = a.length - 1; i >= 0; i--)
+        if (f(a[i]))
+            a.splice(i, 1);
+}
+export function envolver(texto, ancho, sangria = '') {
+    const out = [];
+    const anchoSangria = anchoDe(sangria);
+    for (const parrafo of texto.split('\n')) {
+        let linea = '';
+        let w = 0;
+        let primera = true;
+        const activos = [];
+        const max = () => Math.max(1, primera ? ancho : ancho - anchoSangria);
+        const cerrar = () => {
+            out.push(activos.length ? `${linea}\x1b[0m` : linea);
+            linea = `${sangria}${activos.join('')}`;
+            w = 0;
+            primera = false;
+        };
+        const palabras = parrafo.match(/\s*\S+|\s+$/g) ?? [''];
+        for (const p of palabras) {
+            const anchoP = anchoDe(p);
+            if (w > 0 && w + anchoP > max()) {
+                cerrar();
+                const sinEspacio = p.replace(/^\s+/, '');
+                añadir(sinEspacio);
+                continue;
+            }
+            añadir(p);
+        }
+        out.push(activos.length && linea ? `${linea}\x1b[0m` : linea);
+        function añadir(p) {
+            for (const t of trozos(p)) {
+                if (t.esc) {
+                    linea += t.v;
+                    colorAbierto(activos, t.v);
+                    continue;
+                }
+                if (w + t.w > max() && w > 0)
+                    cerrar();
+                linea += t.v;
+                w += t.w;
+            }
+        }
+    }
+    return out;
+}