@levr-one/cli 0.10.19 → 0.10.21

package/dist/artifact-upload-BnqeVY_b.js

@@ -0,0 +1,296 @@
+import { uploadAttachment } from "./sdk-client-B_urshDp.js";
+import { sleep } from "./sleep-BpJ39Ypm.js";
+import { constants, promises, readlinkSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+
+//#region src/utils/artifact-upload.ts
+/** The per-file ceiling the server enforces (DD5): bigger files are skipped. */
+const MAX_ARTIFACT_BYTES = 50 * 1024 * 1024;
+/** Retries after the first attempt, for failures that are safe to repeat. */
+const MAX_UPLOAD_RETRIES = 2;
+/** Related types with an attachment table (the upload route accepts these). */
+const TYPED_TARGET_TYPES = [
+	"issue",
+	"test",
+	"run",
+	"run_result",
+	"run_result_variant",
+	"import_job",
+	"project",
+	"project_update",
+	"automation_run_result"
+];
+/** A target string the CLI cannot interpret; a usage error, exit 1. */
+var TargetParseError = class extends Error {
+	constructor(input) {
+		super(`Invalid target "${input}". Use an identifier (ENG-42, TC-5, TR-3) or <related_type>:<uuid|identifier> with related_type one of ${TYPED_TARGET_TYPES.join(", ")}.`);
+		this.name = "TargetParseError";
+	}
+};
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const IDENTIFIER_RE = /^([A-Z][A-Z0-9]*)(?:-[A-Z0-9]{2,10})?-(\d+)$/;
+/**
+* `ENG-42` → issue, `TC-5` → test, `TR-3` → run (the server resolves the
+* identifier); `<related_type>:<uuid>` for any typed target.
+*/
+function parseTarget(input) {
+	const trimmed = input.trim();
+	const ident = IDENTIFIER_RE.exec(trimmed);
+	if (ident) {
+		const prefix = ident[1];
+		return {
+			relatedType: prefix === "TC" ? "test" : prefix === "TR" ? "run" : "issue",
+			relatedId: trimmed
+		};
+	}
+	const sep = trimmed.indexOf(":");
+	if (sep > 0) {
+		const type = trimmed.slice(0, sep);
+		const id = trimmed.slice(sep + 1);
+		if (TYPED_TARGET_TYPES.includes(type) && (UUID_RE.test(id) || IDENTIFIER_RE.test(id))) return {
+			relatedType: type,
+			relatedId: id
+		};
+	}
+	throw new TargetParseError(input);
+}
+/**
+* Resolve a path a REPORT supplied (untrusted: a fork PR controls its own
+* JUnit) against `baseDir`, confined to `root` (audit P1). An absolute path
+* is taken as-is and accepted when it lies inside `root` (R1-23).
+*
+* fail_closed: returns null — never read, counted as rejected — when the
+* real path (symlinks followed) is outside `root`. A path that does not
+* exist inside `root` is `{ status: 'missing' }`, never a throw.
+*/
+function resolveArtifactPath(ref, baseDir, root = process.cwd()) {
+	const realRoot = safeRealpath(root) ?? path.resolve(root);
+	const candidate = path.isAbsolute(ref) ? ref : path.resolve(baseDir, ref);
+	const real = safeRealpath(candidate);
+	if (real === void 0) return isInside(realRoot, realpathOfNearest(path.resolve(candidate))) ? { status: "missing" } : null;
+	if (!isInside(realRoot, real)) return null;
+	let st;
+	try {
+		st = statSync(real);
+	} catch {
+		return { status: "missing" };
+	}
+	if (!st.isFile()) return { status: "missing" };
+	return {
+		status: "ok",
+		path: real,
+		dev: st.dev,
+		ino: st.ino,
+		root: realRoot
+	};
+}
+function safeRealpath(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return;
+	}
+}
+/** `p` with its longest existing prefix replaced by that prefix's real path. */
+function realpathOfNearest(p) {
+	const missing = [];
+	let current = p;
+	for (;;) {
+		const real = safeRealpath(current);
+		if (real !== void 0) return path.join(real, ...missing.reverse());
+		const parent = path.dirname(current);
+		if (parent === current) return p;
+		missing.push(path.basename(current));
+		current = parent;
+	}
+}
+function isInside(root, p) {
+	const rel = path.relative(root, p);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
+/**
+* Upload one file. Never throws: every outcome is a status.
+*
+* - The file is opened ONCE, with O_NOFOLLOW (omitted on win32, where the
+*   dev/inode comparison alone guards the read), and the open handle's
+*   dev/inode must match the validated path's; otherwise the file was
+*   swapped after validation and the result is `rejected` (R1-07). The size
+*   check and the bytes sent come from that same handle.
+* - ENOENT/ENOTDIR → `missing`; over 50 MiB → `skipped` (DD5).
+* - Fields go before the file part; kind/attempt_index only for an
+*   automation_run_result target (the server rejects them elsewhere).
+* - Retries split by idempotency (R1-06), fail_retry(2) with backoff: a
+*   failure the server cannot have received (429, connection refused, DNS)
+*   is retried for any target; an ambiguous one (timeout, reset, 5xx) only
+*   for automation_run_result, whose uploads the server deduplicates. Any
+*   other target gets `failed` ("outcome unknown") instead of a duplicate.
+*/
+async function uploadArtifactFile(options) {
+	const { target, filePath } = options;
+	const sleep$1 = options.sleep ?? sleep;
+	const isAutomation = target.relatedType === "automation_run_result";
+	let validated = options.validated;
+	if (!validated) {
+		const real = safeRealpath(filePath);
+		if (real === void 0) return { status: "missing" };
+		try {
+			const st = statSync(real);
+			if (!st.isFile()) return { status: "missing" };
+			validated = {
+				path: real,
+				dev: st.dev,
+				ino: st.ino
+			};
+		} catch {
+			return { status: "missing" };
+		}
+	}
+	const flags = process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NOFOLLOW;
+	let handle;
+	try {
+		handle = await promises.open(validated.path, flags);
+	} catch (err) {
+		const code = err.code;
+		if (code === "ENOENT" || code === "ENOTDIR") return { status: "missing" };
+		if (code === "ELOOP") return {
+			status: "rejected",
+			message: "the path became a symlink"
+		};
+		return {
+			status: "failed",
+			message: err.message
+		};
+	}
+	let bytes;
+	try {
+		const st = await handle.stat();
+		if (st.dev !== validated.dev || st.ino !== validated.ino) return {
+			status: "rejected",
+			message: "the file changed after it was validated"
+		};
+		if (validated.root && !openedInside(handle.fd, validated, validated.root)) return {
+			status: "rejected",
+			message: "the opened file is outside the working directory"
+		};
+		if (st.size > MAX_ARTIFACT_BYTES) return {
+			status: "skipped",
+			reason: "too_large",
+			size: st.size
+		};
+		bytes = await handle.readFile();
+	} catch (err) {
+		return {
+			status: "failed",
+			message: err.message
+		};
+	} finally {
+		await handle.close().catch(() => void 0);
+	}
+	const name = options.name ?? path.basename(filePath);
+	const body = {
+		related_type: target.relatedType,
+		related_id: target.relatedId
+	};
+	if (isAutomation) {
+		if (options.kind) body.kind = options.kind;
+		if (options.attemptIndex !== void 0 && options.attemptIndex !== null) body.attempt_index = options.attemptIndex;
+	}
+	if (options.isPublic !== void 0) body.is_public = options.isPublic;
+	body.file = new File([new Uint8Array(bytes)], name);
+	for (let attempt = 0;; attempt++) {
+		let outcome;
+		let thrown;
+		try {
+			outcome = await uploadAttachment(body);
+		} catch (err) {
+			thrown = err;
+		}
+		if (outcome && outcome.status >= 200 && outcome.status < 300) {
+			const data = outcome.data;
+			if (!data?.id) return {
+				status: "failed",
+				message: "upload returned no attachment"
+			};
+			return {
+				status: data.deduplicated || outcome.status === 200 ? "deduplicated" : "uploaded",
+				id: data.id,
+				url: data.url ?? null,
+				target_id: data.target_id ?? null
+			};
+		}
+		const kind = classifyFailure(outcome, thrown);
+		if ((kind === "not_received" || kind === "ambiguous" && isAutomation) && attempt < MAX_UPLOAD_RETRIES) {
+			await sleep$1(500 * 2 ** attempt);
+			continue;
+		}
+		if (kind === "ambiguous" && !isAutomation) return {
+			status: "failed",
+			message: "outcome unknown, not retried to avoid a duplicate attachment"
+		};
+		return {
+			status: "failed",
+			message: describeFailure(outcome, thrown)
+		};
+	}
+}
+/**
+* Where the OPEN descriptor really lives (ENG-6165 code review F-005).
+* O_NOFOLLOW guards only the last component, and the dev/inode recorded at
+* validation was itself read through a path whose parent could have been
+* swapped for a symlink in between. On Linux `/proc/self/fd/<fd>` names the
+* opened file authoritatively. Elsewhere Node has no fd → path call, so the
+* path is resolved again and must still be the validated, in-root path
+* holding the same file: this narrows the window to the open itself rather
+* than closing it.
+*/
+function openedInside(fd, validated, root) {
+	if (process.platform === "linux") try {
+		return isInside(root, readlinkSync(`/proc/self/fd/${fd}`));
+	} catch {
+		return false;
+	}
+	const again = safeRealpath(validated.path);
+	if (again !== validated.path || !isInside(root, again)) return false;
+	try {
+		const st = statSync(again);
+		return st.dev === validated.dev && st.ino === validated.ino;
+	} catch {
+		return false;
+	}
+}
+/**
+* not_received: the server cannot have acted (429, connection refused, DNS).
+* ambiguous: the request may have landed (timeout, reset, 5xx, unknown).
+* rejected: a definite 4xx answer — never retried.
+*/
+function classifyFailure(outcome, thrown) {
+	if (outcome) {
+		if (outcome.status === 429) return "not_received";
+		if (outcome.status >= 500 || outcome.status === 0) return "ambiguous";
+		return "rejected";
+	}
+	const code = errorCode(thrown);
+	if (code === "ECONNREFUSED" || code === "ENOTFOUND" || code === "EAI_AGAIN") return "not_received";
+	return "ambiguous";
+}
+function errorCode(err) {
+	const e = err;
+	const code = e?.code ?? e?.cause?.code;
+	return typeof code === "string" ? code : void 0;
+}
+function describeFailure(outcome, thrown) {
+	if (outcome) {
+		const msg = outcome.error?.message;
+		const text = Array.isArray(msg) ? msg.join("; ") : typeof msg === "string" ? msg : JSON.stringify(outcome.error ?? {});
+		return `HTTP ${outcome.status}: ${text}`;
+	}
+	return thrown instanceof Error ? thrown.message : String(thrown);
+}
+/** Markdown that shows an uploaded file: an image inline, anything else as a link. */
+function embedMarkdown(name, url) {
+	return /\.(png|jpe?g|gif|webp)$/i.test(name) ? `![${name}](${url})` : `[${name}](${url})`;
+}
+
+//#endregion
+export { TargetParseError, embedMarkdown, parseTarget, resolveArtifactPath, uploadArtifactFile };

package/dist/attachHandler-BOxIqxAw.js

@@ -0,0 +1,151 @@
+import { appendActualResult, createComment } from "./sdk-client-B_urshDp.js";
+import "./env-CdwyPHGV.js";
+import "./token-refresh-DeusLK8H.js";
+import "./resolve-token-7xb7kG7h.js";
+import "./workspace-store-CnrxyYRB.js";
+import "./resolve-workspace-Dsm8Xzut.js";
+import { connect } from "./connect-CPybjrXT.js";
+import "./sleep-BpJ39Ypm.js";
+import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BnqeVY_b.js";
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+
+//#region src/commands/attachHandler.ts
+/**
+* `levr attach` (ENG-6164 D4). fail_closed: any file that fails or is
+* skipped, and any failed embed write, exits 1 — an explicit attach is a
+* request, unlike `levr push --artifacts`.
+*
+* Visibility: every upload is private, --embed included (ENG-6165 code
+* review F-006). Levr serves a private attachment's url to any signed-in
+* workspace member, so the embedded link renders in Levr without making the
+* file readable by anyone holding the link. --embed writes
+* append-only — a NEW comment on an issue, test or run, or a server-side
+* `append_actual_result` on an execution result — never a rewrite of
+* entity text (audit A3).
+*/
+async function attachHandler(flags, ...args) {
+	if (flags.verbose) this.logger.setVerbose(true);
+	let jobs;
+	try {
+		jobs = flags.manifest ? readManifest(flags.manifest) : [singleJob(args, flags)];
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : String(err));
+		this.process.exitCode = 1;
+		return;
+	}
+	if (flags.embed) {
+		for (const job of jobs) if (!embedWriter(job.target)) {
+			this.logger.error(`--embed is not supported for ${job.target.relatedType} targets (issue, test, run or run_result_variant only).`);
+			this.process.exitCode = 1;
+			return;
+		}
+	}
+	if (!await connect(this, flags["workspace-id"])) return;
+	let failed = false;
+	for (const job of jobs) {
+		const uploaded = [];
+		for (const file of job.files) {
+			const result = await uploadArtifactFile({
+				target: job.target,
+				filePath: file,
+				kind: job.kind,
+				attemptIndex: job.attempt
+			});
+			report(this, file, result);
+			if (result.status === "uploaded" || result.status === "deduplicated") {
+				if (result.url && result.target_id) uploaded.push({
+					name: basename(file),
+					url: result.url,
+					targetId: result.target_id
+				});
+			} else failed = true;
+		}
+		const first = uploaded[0];
+		if (flags.embed && first) {
+			const markdown = uploaded.map((u) => embedMarkdown(u.name, u.url)).join("\n");
+			try {
+				await writeEmbed(job.target, first.targetId, markdown);
+				this.process.stdout.write(`  embedded ${uploaded.length} file(s) on ${job.target.relatedId}\n`);
+			} catch (err) {
+				this.logger.error(`Embed failed for ${job.target.relatedId}: ${err instanceof Error ? err.message : String(err)}`);
+				failed = true;
+			}
+		}
+	}
+	if (failed) this.process.exitCode = 1;
+}
+function singleJob(args, flags) {
+	const [targetArg, ...files] = args;
+	if (!targetArg || files.length === 0) throw new Error("Usage: levr attach <target> <files...>  (or levr attach --manifest <json>)");
+	return {
+		target: parseTarget(targetArg),
+		files,
+		kind: flags.kind,
+		attempt: flags.attempt
+	};
+}
+/** `[{ target, files[], kind?, attempt? }]` — validated before any upload. */
+function readManifest(file) {
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(file, "utf8"));
+	} catch (err) {
+		throw new Error(`Cannot read manifest ${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (!Array.isArray(raw)) throw new Error(`Manifest ${file} must be a JSON array`);
+	return raw.map((entry, i) => {
+		const e = entry;
+		if (typeof e?.target !== "string") throw new Error(`Manifest entry ${i}: "target" must be a string`);
+		if (!Array.isArray(e.files) || e.files.length === 0 || !e.files.every((f) => typeof f === "string")) throw new Error(`Manifest entry ${i}: "files" must be a string array`);
+		if (e.attempt !== void 0 && !(Number.isInteger(e.attempt) && e.attempt >= 0)) throw new Error(`Manifest entry ${i}: "attempt" must be an integer >= 0`);
+		try {
+			return {
+				target: parseTarget(e.target),
+				files: e.files,
+				kind: typeof e.kind === "string" ? e.kind : void 0,
+				attempt: e.attempt
+			};
+		} catch (err) {
+			if (err instanceof TargetParseError) throw new Error(`Manifest entry ${i}: ${err.message}`);
+			throw err;
+		}
+	});
+}
+function embedWriter(target) {
+	if (target.relatedType === "run_result_variant") return "actual_result";
+	if (target.relatedType === "issue" || target.relatedType === "test" || target.relatedType === "run") return "comment";
+}
+/** Append-only: a new comment, or the server-side actual-result append. */
+async function writeEmbed(target, targetId, markdown) {
+	if (embedWriter(target) === "actual_result") {
+		await appendActualResult(targetId, markdown);
+		return;
+	}
+	await createComment(target.relatedType, targetId, markdown);
+}
+function report(ctx, file, result) {
+	switch (result.status) {
+		case "uploaded":
+			ctx.process.stdout.write(`  attached ${file} (${result.id})\n`);
+			return;
+		case "deduplicated":
+			ctx.process.stdout.write(`  already attached ${file} (${result.id})\n`);
+			return;
+		case "skipped":
+			ctx.logger.warning(`skipped ${file}: larger than 50 MiB`);
+			return;
+		case "missing":
+			ctx.logger.error(`not found: ${file}`);
+			return;
+		case "rejected":
+			ctx.logger.error(`refused ${file}: ${result.message}`);
+			return;
+		case "failed":
+			ctx.logger.error(`failed ${file}: ${result.message}`);
+			return;
+	}
+}
+
+//#endregion
+export { attachHandler };