@gitroll/tacitt-cli 0.0.0-stage → 0.2.0

package/skills/tacitt/scripts/local-cli.mjs

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto'
+import { lstat, open, readdir, realpath } from 'node:fs/promises'
+import { dirname, isAbsolute, join } from 'node:path'
+
+const fail = () => {
+  throw new Error('LOCAL_CLI_BINDING_INVALID')
+}
+const object = (value) => typeof value === 'object' && value !== null && !Array.isArray(value)
+const versionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/
+const digestPattern = /^[a-f0-9]{64}$/
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex')
+
+async function regularFile(path, limit) {
+  const before = await lstat(path)
+  if (!before.isFile() || before.isSymbolicLink() || before.size > limit) fail()
+  const handle = await open(path, 'r')
+  try {
+    const opened = await handle.stat()
+    if (opened.dev !== before.dev || opened.ino !== before.ino) fail()
+    const bytes = await handle.readFile()
+    const after = await lstat(path)
+    if (
+      !after.isFile() ||
+      after.isSymbolicLink() ||
+      after.dev !== before.dev ||
+      after.ino !== before.ino ||
+      after.size !== before.size ||
+      after.mtimeMs !== before.mtimeMs ||
+      bytes.length !== before.size
+    )
+      fail()
+    return bytes
+  } finally {
+    await handle.close()
+  }
+}
+
+async function packageFiles(root) {
+  const files = []
+  let bytes = 0
+  const visit = async (name, depth = 0) => {
+    if (depth > 16 || files.length >= 10000) fail()
+    const path = join(root, name)
+    const info = await lstat(path)
+    if (info.isSymbolicLink()) fail()
+    if (info.isDirectory()) {
+      for (const child of (await readdir(path)).sort()) await visit(`${name}/${child}`, depth + 1)
+    } else if (info.isFile()) {
+      const content = await regularFile(path, 512 * 1024 * 1024 - bytes)
+      bytes += content.length
+      files.push([name, content.length, digest(content)])
+    } else fail()
+  }
+  for (const name of ['package.json', 'bin', 'dist', 'skills']) await visit(name)
+  return files
+}
+
+/** Reads only the selected installed package; it never downloads or opens application state. */
+export async function readLocalCliBinding(cliPath, expected) {
+  if (
+    typeof cliPath !== 'string' ||
+    !isAbsolute(cliPath) ||
+    cliPath
+      .split('')
+      .some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) ||
+    !object(expected) ||
+    expected.name !== '@gitroll/tacitt-cli' ||
+    typeof expected.version !== 'string' ||
+    !versionPattern.test(expected.version)
+  )
+    fail()
+  const requested = await lstat(cliPath)
+  if (!requested.isFile() || requested.isSymbolicLink()) fail()
+  const executable = await realpath(cliPath)
+  const root = dirname(dirname(executable))
+  if (executable !== join(root, 'bin', 'tacitt.cjs')) fail()
+  const metadataBytes = await regularFile(join(root, 'package.json'), 1024 * 1024)
+  const metadata = JSON.parse(metadataBytes.toString('utf8'))
+  if (
+    !object(metadata) ||
+    metadata.name !== expected.name ||
+    metadata.version !== expected.version ||
+    !object(metadata.bin) ||
+    metadata.bin['tacitt'] !== 'bin/tacitt.cjs'
+  )
+    fail()
+  const files = await packageFiles(root)
+  if (
+    !files.some(([name]) => name === 'dist/cli.mjs') ||
+    !files.some(([name, , sha256]) => name === 'package.json' && sha256 === digest(metadataBytes))
+  )
+    fail()
+  return {
+    schemaVersion: 1,
+    package: expected.name,
+    version: expected.version,
+    nodePath: await realpath(process.execPath),
+    cliPath: executable,
+    artifactSha256: digest(JSON.stringify(files)),
+  }
+}
+
+/** A receipt hash comes from the managed entry, independently of the local receipt bytes. */
+export async function verifyLocalCliBinding(receiptPath, expectedReceiptSha256) {
+  if (!isAbsolute(receiptPath) || !digestPattern.test(expectedReceiptSha256)) fail()
+  const bytes = await regularFile(receiptPath, 8192)
+  if (digest(bytes) !== expectedReceiptSha256) fail()
+  const receipt = JSON.parse(bytes.toString('utf8'))
+  if (!object(receipt) || receipt.schemaVersion !== 1) fail()
+  const actual = await readLocalCliBinding(receipt.cliPath, {
+    name: receipt.package,
+    version: receipt.version,
+  })
+  if (JSON.stringify(actual) !== JSON.stringify(receipt)) fail()
+  return actual
+}