@join-pantheon/cli 0.29.0 → 0.30.0

package/dist/which.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { platform } from "node:os";
@@ -40,35 +41,82 @@ export function whichWindows(name, env = process.env, exists = runnable) {
     }
     return null;
 }
-export function which(name, os = platform(), env = process.env) {
+export function which(name, os = platform(), env = process.env, opts = {}) {
     if (isWindows(os))
         return whichWindows(name, env);
-    return loginShellWhich(name) ?? posixOnPath(name, env);
+    const ok = opts.runnable ?? runnable;
+    const wsl = os === "linux" && (opts.wsl ?? onWsl(env));
+    const usable = (p) => ok(p) && !(wsl && isWslWindowsShim(p));
+    const login = (opts.login ?? loginShellLookup)(name);
+    if (login?.found && usable(login.found))
+        return login.found;
+    if (login?.found && login.path) {
+        const hit = posixOnPath(name, { PATH: login.path }, usable);
+        if (hit)
+            return hit;
+    }
+    return posixOnPath(name, env, usable);
 }
-function posixOnPath(name, env) {
+export const isWslWindowsShim = (p) => /^\/mnt\/[a-z]\//i.test(p) && !/\.exe$/i.test(p);
+function onWsl(env) {
+    if (env.WSL_DISTRO_NAME || env.WSL_INTEROP)
+        return true;
+    try {
+        return /microsoft/i.test(readFileSync("/proc/version", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+function posixOnPath(name, env, ok = runnable) {
     if (!name)
         return null;
     if (name.includes("/"))
-        return runnable(name) ? name : null;
+        return ok(name) ? name : null;
     for (const dir of (env.PATH ?? "").split(":")) {
         if (!dir)
             continue;
         const full = posix.join(dir, name);
-        if (runnable(full))
+        if (ok(full))
             return full;
     }
     return null;
 }
-function loginShellWhich(name) {
+export function loginShellLookup(name, run = runLoginShell) {
+    if (!name)
+        return null;
+    const mark = `__pantheon_which_${randomBytes(6).toString("hex")}__`;
+    let out;
     try {
-        const out = execFileSync("sh", ["-lc", `command -v ${name}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-        if (!out)
-            return null;
-        return out.startsWith("/") && !runnable(out) ? null : out;
+        out = run(`printf '\\n%s\\n' "$1"; command -v "$2"; printf '\\n%s\\n' "$1"; printf '%s' "$PATH"`, [mark, name]);
     }
     catch {
         return null;
     }
+    return parseLoginAnswer(out, mark);
+}
+export function parseLoginAnswer(out, mark) {
+    const open = `\n${mark}\n`;
+    const first = out.indexOf(open);
+    if (first < 0)
+        return null;
+    const rest = out.slice(first + open.length);
+    const second = rest.indexOf(open);
+    const said = (second < 0 ? rest : rest.slice(0, second)).split("\n").map((l) => l.trim()).filter(Boolean);
+    const path = second < 0 ? null : rest.slice(second + open.length);
+    const found = said.length === 1 && said[0].startsWith("/") ? said[0] : null;
+    return { found, path };
+}
+function runLoginShell(script, args) {
+    try {
+        return execFileSync("sh", ["-lc", script, "sh", ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15_000 });
+    }
+    catch (e) {
+        const out = e.stdout;
+        if (typeof out === "string" && out)
+            return out;
+        throw e;
+    }
 }
 export const onPathNamed = (name, os = platform(), env = process.env) => which(name, os, env) !== null;
 export function spawnShape(binary, os = platform()) {
@@ -112,8 +160,11 @@ catch {
     const dir = dirname(shim);
     const re = /"%(?:~dp0|dp0%)\\?([^"%\r\n]+)"[ \t]*%\*[ \t]*\)?[ \t]*\r?$/gm;
     let rel = null;
-    for (let m = re.exec(text); m; m = re.exec(text))
+    let before = "";
+    for (let m = re.exec(text); m; m = re.exec(text)) {
         rel = m[1];
+        before = text.slice(text.lastIndexOf("\n", m.index) + 1, m.index);
+    }
     if (!rel)
         return { why: "was read but not recognised as a package manager's shim" };
     const parts = rel.split(/[\\/]+/).filter(Boolean);
@@ -134,7 +185,13 @@ catch {
         return { why: `was read, but it runs ${target}, which is not something Pantheon can start without cmd.exe` };
     }
     const localNode = join(dir, "node.exe");
-    return { command: exists(localNode) ? localNode : process.execPath, args: [target] };
+    return { command: exists(localNode) ? localNode : process.execPath, args: [...shimNodeFlags(before), target] };
+}
+export function shimNodeFlags(linePrefix) {
+    const m = /(?:"%_prog%"|"%~?dp0%?\\?node\.exe"|(?:^|[\s&|(])node(?:\.exe)?)((?:[ \t]+-[^\s"%]+)*)[ \t]*$/i.exec(linePrefix);
+    if (!m || !m[1])
+        return [];
+    return m[1].trim().split(/[ \t]+/).filter((f) => /^--?[A-Za-z0-9][\w.-]*(?:=[^\s"%^&|<>!]*)?$/.test(f));
 }
 export function resolveCmdShim(shim, read, exists) {
     const r = inspectCmdShim(shim, read, exists);

package/dist/worker-policy.js

@@ -1,6 +1,8 @@
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CONFIG_PATH } from "./config.js";
+import { trustWrite } from "./home-guard.js";
+import { parseJsonText } from "./text-file.js";
 export const ASK_COOLDOWN_MS = 24 * 60 * 60 * 1_000;
 export const ASK_EXPIRY_MS = 14 * 24 * 60 * 60 * 1_000;
 export function policyHome(home) {
@@ -9,19 +11,120 @@ export function policyHome(home) {
 export function policyPath(home) {
     return join(policyHome(home), "worker-policy.json");
 }
+const isRecord = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+function readWakers(x) {
+    if (!isRecord(x))
+        return undefined;
+    const out = {};
+    for (const [team, v] of Object.entries(x)) {
+        if (!Array.isArray(v))
+            continue;
+        const ids = v.filter((m) => typeof m === "string" && m.length > 0);
+        if (ids.length)
+            out[team] = ids;
+    }
+    return out;
+}
 export function loadPolicy(home) {
     try {
-        const raw = JSON.parse(readFileSync(policyPath(home), "utf8"));
-        return { grants: raw.grants ?? {}, asks: raw.asks ?? {}, denied: raw.denied ?? {}, attempts: raw.attempts ?? {} };
+        const raw = parseJsonText(readFileSync(policyPath(home), "utf8"));
+        const obj = (v) => (isRecord(v) ? v : {});
+        const wakers = readWakers(raw.wakers);
+        return {
+            grants: obj(raw.grants), asks: obj(raw.asks), denied: obj(raw.denied), attempts: obj(raw.attempts),
+            ...(wakers ? { wakers } : {}),
+            ...(isRecord(raw.wakersCarried) ? { wakersCarried: raw.wakersCarried } : {}),
+            ...(isRecord(raw.wakersDeferred) ? { wakersDeferred: raw.wakersDeferred } : {}),
+        };
     }
     catch {
         return { grants: {}, asks: {}, denied: {}, attempts: {} };
     }
 }
+export function setWaker(p, team, member, approved) {
+    const w = (p.wakers ??= {});
+    const cur = new Set(w[team] ?? []);
+    if (approved)
+        cur.add(member);
+    else
+        cur.delete(member);
+    if (cur.size)
+        w[team] = [...cur].sort();
+    else
+        delete w[team];
+}
+export const CARRY_REASON = {
+    "you-admitted": "you approved them",
+    anyone: "you had chosen that anyone may wake this machine",
+    "old-default": "wake was never chosen here, and before 0.30 that meant anyone the team lets",
+    founder: "the team's founder, and wake was never restricted here",
+};
+export function carryOverWakers(p, team, me, members, choice, now = Date.now()) {
+    if (!team || p.wakersCarried?.[team])
+        return null;
+    const all = members.filter((m) => m.admitted);
+    const others = all.filter((m) => m.member !== me);
+    const anyone = choice === "anyone" || choice === "unset-before-0.30";
+    if (!relayKnowsAdmitters(members, me) && !anyone)
+        return "deferred";
+    const founder = (all.find((m) => m.founder) ?? all.find((m) => m.admitted_by === m.member))?.member;
+    const carried = [];
+    for (const m of others) {
+        if (!m.may_wake)
+            continue;
+        const why = m.admitted_by === me ? "you-admitted"
+            : choice === "anyone" ? "anyone"
+                : choice === "unset-before-0.30" ? "old-default"
+                    : choice === undefined && m.member === founder ? "founder"
+                        : null;
+        if (why)
+            carried.push({ member: m.member, why });
+    }
+    carried.sort((a, b) => a.member.localeCompare(b.member));
+    for (const c of carried)
+        setWaker(p, team, c.member, true);
+    (p.wakersCarried ??= {})[team] = now;
+    if (p.wakersDeferred) {
+        delete p.wakersDeferred[team];
+        if (!Object.keys(p.wakersDeferred).length)
+            delete p.wakersDeferred;
+    }
+    return carried;
+}
+export const V030_AT = Date.parse("2026-09-25T06:00:00Z");
+export const OLD_RELAY_WAKE = "this relay is older than 0.30, so who may wake this machine is still decided by the team (may_wake) — until it upgrades; then the approvals you had are carried over, and anyone else needs: pantheon wake allow <name>";
+export function relayKnowsAdmitters(members, me) {
+    const all = members.filter((m) => m.admitted);
+    return !all.some((m) => m.member !== me) || all.some((m) => m.admitted_by !== undefined);
+}
+export function setLocalWaker(teams, member, approved, home, env = process.env) {
+    if (inWokenRun(env))
+        return { ok: false, why: "a woken run cannot change who may wake this machine — a person has to run this here" };
+    const keys = [...new Set(teams.filter((t) => !!t))];
+    if (!keys.length || !member)
+        return { ok: false, why: "no team to record it under" };
+    const p = loadPolicy(home);
+    const was = isApprovedWaker(p, keys, member);
+    if (approved) {
+        if (!was)
+            setWaker(p, keys[0], member, true);
+    }
+    else
+        for (const k of keys)
+            setWaker(p, k, member, false);
+    if (was === approved)
+        return { ok: true, changed: false };
+    savePolicy(p, home);
+    return { ok: true, changed: true };
+}
+export function isApprovedWaker(p, teams, member) {
+    return teams.some((t) => { const list = t ? p.wakers?.[t] : undefined; return Array.isArray(list) && list.includes(member); });
+}
 export function savePolicy(p, home) {
     const file = policyPath(home);
     mkdirSync(dirname(file), { recursive: true });
     writeFileSync(file, JSON.stringify(p, null, 2) + "\n", { mode: 0o600 });
+    trustWrite(file);
 }
 export function useGrant(p, cap) {
     const g = p.grants[cap];
@@ -61,6 +164,31 @@ export function parseGrantAnswer(body) {
         return "deny";
     return null;
 }
+export const WOKEN_RUN_ENV = "PANTHEON_WOKEN_RUN";
+export const inWokenRun = (env = process.env) => !!env[WOKEN_RUN_ENV];
+export const CAPABILITY_ARGS = { self_upgrade: "self-upgrade", run_commands: "run-commands" };
+export function applyLocalAnswer(refActId, body, home, env = process.env) {
+    if (!refActId)
+        return null;
+    const p = loadPolicy(home);
+    if (!Object.values(p.asks).some((a) => a?.act === refActId))
+        return null;
+    if (inWokenRun(env))
+        return { applied: false, why: "a woken run cannot grant this machine anything — a person has to answer it here" };
+    const r = applyAnswer(p, refActId, body);
+    if (!r)
+        return null;
+    savePolicy(p, home);
+    return { applied: true, ...r };
+}
+export function describeLocalAnswer(g) {
+    if (!g.applied)
+        return `not granted: ${g.why}`;
+    const name = CAPABILITY_ARGS[g.cap];
+    if (g.verdict === "deny")
+        return `denied ${name} on this machine — the worker will not ask again for a day`;
+    return `granted ${name} on this machine${g.verdict === "allow-once" ? " for its next use" : ""} — revoke: pantheon policy revoke ${name}`;
+}
 export function applyAnswer(p, refActId, body) {
     const entry = Object.entries(p.asks).find(([, a]) => a.act === refActId);
     if (!entry)
@@ -73,9 +201,15 @@ export function applyAnswer(p, refActId, body) {
     if (verdict === "deny")
         p.denied[cap] = Date.now();
     else
-        grant(p, cap, verdict === "allow-always" ? "always" : "once", "answered-request");
+        grant(p, cap, verdict === "allow-always" ? "always" : "once", "answered-here");
     return { cap, verdict };
 }
+export function dropLedgerGrants(p) {
+    const gone = Object.keys(p.grants).filter((c) => p.grants[c]?.by === "answered-request");
+    for (const c of gone)
+        delete p.grants[c];
+    return gone;
+}
 export const UPGRADE_RETRY_MS = 60 * 60 * 1_000;
 export function needsSelfUpgrade(localPkg, relayPkg, lastAttempt, now = Date.now()) {
     if (!relayPkg || relayPkg === localPkg)