@memorax/memorax-code 0.1.5 → 0.1.6

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/secure-command.mjs

@@ -0,0 +1,340 @@
+import { spawn } from "node:child_process";
+import { TextDecoder } from "node:util";
+
+export const MAX_SECURE_CREDENTIAL_BYTES = 4096;
+export const DEFAULT_SECURE_COMMAND_TIMEOUT_MS = 30_000;
+export const DEFAULT_SECURE_COMMAND_OUTPUT_BYTES = 8192;
+
+const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+const NAMESPACE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const ERROR_REASONS = new Set([
+  "backend_unavailable",
+  "command_failed",
+  "command_timeout",
+  "invalid_namespace",
+  "invalid_response",
+  "invalid_secret",
+  "output_limit",
+  "secret_too_large",
+  "storage_failed",
+  "unsafe_path",
+]);
+
+export class SecureCredentialBackendError extends Error {
+  constructor({ backend, operation, reason }) {
+    super("Secure credential backend operation failed.");
+    this.name = "SecureCredentialBackendError";
+    this.code = "TRIAL_CREDENTIAL_BACKEND_ERROR";
+    this.backend = safeIdentifier(backend, "unknown");
+    this.operation = safeIdentifier(operation, "unknown");
+    this.reason = ERROR_REASONS.has(reason) ? reason : "command_failed";
+  }
+}
+
+export function secureCredentialBackendError(backend, operation, reason) {
+  return new SecureCredentialBackendError({ backend, operation, reason });
+}
+
+export function validateSecureCredentialNamespace(namespace, backend, operation = "initialize") {
+  if (typeof namespace !== "string" || !NAMESPACE_PATTERN.test(namespace)) {
+    throw secureCredentialBackendError(backend, operation, "invalid_namespace");
+  }
+  return namespace;
+}
+
+export function encodeSecureCredential(serialized, backend, operation = "save") {
+  if (typeof serialized !== "string" || serialized.length === 0 || serialized.includes("\0")) {
+    throw secureCredentialBackendError(backend, operation, "invalid_secret");
+  }
+  const encoded = Buffer.from(serialized, "utf8");
+  if (encoded.length > MAX_SECURE_CREDENTIAL_BYTES) {
+    encoded.fill(0);
+    throw secureCredentialBackendError(backend, operation, "secret_too_large");
+  }
+  return encoded;
+}
+
+export function decodeSecureCredential(encoded, backend, operation = "load") {
+  const bytes = bufferFrom(encoded);
+  try {
+    if (bytes.length === 0 || bytes.length > MAX_SECURE_CREDENTIAL_BYTES) {
+      throw secureCredentialBackendError(
+        backend,
+        operation,
+        bytes.length > MAX_SECURE_CREDENTIAL_BYTES ? "secret_too_large" : "invalid_response",
+      );
+    }
+    let decoded;
+    try {
+      decoded = UTF8_DECODER.decode(bytes);
+    } catch {
+      throw secureCredentialBackendError(backend, operation, "invalid_response");
+    }
+    if (!decoded || decoded.includes("\0")) {
+      throw secureCredentialBackendError(backend, operation, "invalid_response");
+    }
+    return decoded;
+  } finally {
+    bytes.fill(0);
+  }
+}
+
+export async function executeSecureCommand(runner, specification) {
+  const backend = safeIdentifier(specification?.backend, "unknown");
+  const operation = safeIdentifier(specification?.operation, "unknown");
+  let result;
+  try {
+    result = await runner(specification);
+  } catch (error) {
+    if (error instanceof SecureCredentialBackendError) {
+      throw secureCredentialBackendError(backend, operation, error.reason);
+    }
+    throw secureCredentialBackendError(backend, operation, "command_failed");
+  }
+  if (!result || typeof result !== "object") {
+    throw secureCredentialBackendError(backend, operation, "invalid_response");
+  }
+  let rawStdout;
+  let rawStderr;
+  let stdout;
+  let stderr;
+  let returned = false;
+  try {
+    rawStdout = result.stdout;
+    rawStderr = result.stderr;
+    const rawStatus = result.status;
+    const status = rawStatus === null || Number.isInteger(rawStatus)
+      ? rawStatus
+      : undefined;
+    if (status === undefined) {
+      throw secureCredentialBackendError(backend, operation, "invalid_response");
+    }
+    stdout = resultBuffer(rawStdout);
+    stderr = resultBuffer(rawStderr);
+    if (stdout === undefined || stderr === undefined) {
+      throw secureCredentialBackendError(backend, operation, "invalid_response");
+    }
+    const outputLimit = positiveInteger(
+      specification.maxOutputBytes,
+      DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+    );
+    if (stdout.length > outputLimit || stderr.length > outputLimit) {
+      throw secureCredentialBackendError(backend, operation, "output_limit");
+    }
+    const signal = result.signal;
+    returned = true;
+    return {
+      status,
+      signal: typeof signal === "string" ? signal : null,
+      stdout,
+      stderr,
+    };
+  } catch (error) {
+    if (error instanceof SecureCredentialBackendError) {
+      throw secureCredentialBackendError(backend, operation, error.reason);
+    }
+    throw secureCredentialBackendError(backend, operation, "invalid_response");
+  } finally {
+    wipeByteArray(rawStdout);
+    wipeByteArray(rawStderr);
+    if (!returned) {
+      stdout?.fill(0);
+      stderr?.fill(0);
+    }
+  }
+}
+
+export function wipeSecureCommandResult(result) {
+  if (!result || typeof result !== "object") return;
+  try {
+    wipeByteArray(result.stdout);
+  } catch {
+    // Best-effort cleanup must not replace the operation result.
+  }
+  try {
+    wipeByteArray(result.stderr);
+  } catch {
+    // Best-effort cleanup must not replace the operation result.
+  }
+}
+
+export function runSecureCommand(specification) {
+  const backend = safeIdentifier(specification?.backend, "unknown");
+  const operation = safeIdentifier(specification?.operation, "unknown");
+  const timeoutMs = positiveInteger(
+    specification?.timeoutMs,
+    DEFAULT_SECURE_COMMAND_TIMEOUT_MS,
+  );
+  const maxOutputBytes = positiveInteger(
+    specification?.maxOutputBytes,
+    DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+  );
+  const input = bufferFrom(specification?.input);
+  let child;
+  try {
+    child = spawn(specification.command, specification.args ?? [], {
+      env: specification.env ?? Object.create(null),
+      shell: false,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+    });
+  } catch {
+    input.fill(0);
+    return Promise.reject(secureCredentialBackendError(
+      backend,
+      operation,
+      "backend_unavailable",
+    ));
+  }
+
+  return new Promise((resolve, reject) => {
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let settled = false;
+    let timer;
+
+    const wipeInput = () => input.fill(0);
+    const wipeOutput = () => {
+      for (const chunk of stdout) chunk.fill(0);
+      for (const chunk of stderr) chunk.fill(0);
+    };
+    const closePipes = () => {
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+    };
+    const finishError = (reason, { terminate = false } = {}) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (terminate) stopChild();
+      closePipes();
+      child.unref?.();
+      wipeInput();
+      wipeOutput();
+      reject(secureCredentialBackendError(backend, operation, reason));
+    };
+    const stopChild = () => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+        // Best effort; the caller still receives the bounded, redacted failure.
+      }
+    };
+    const collect = (chunk, chunks, currentBytes, setBytes) => {
+      const bytes = Buffer.from(chunk);
+      if (settled) {
+        bytes.fill(0);
+        return;
+      }
+      if (currentBytes + bytes.length > maxOutputBytes) {
+        bytes.fill(0);
+        finishError("output_limit", { terminate: true });
+        return;
+      }
+      chunks.push(bytes);
+      setBytes(currentBytes + bytes.length);
+    };
+
+    timer = setTimeout(
+      () => finishError("command_timeout", { terminate: true }),
+      timeoutMs,
+    );
+    timer.unref?.();
+
+    child.stdout.on("data", (chunk) => collect(
+      chunk,
+      stdout,
+      stdoutBytes,
+      (value) => { stdoutBytes = value; },
+    ));
+    child.stderr.on("data", (chunk) => collect(
+      chunk,
+      stderr,
+      stderrBytes,
+      (value) => { stderrBytes = value; },
+    ));
+    child.stdout.on("error", () => finishError("command_failed", { terminate: true }));
+    child.stderr.on("error", () => finishError("command_failed", { terminate: true }));
+    child.stdin.on("error", () => {
+      // A non-zero child result remains the authority for a closed stdin.
+    });
+    child.once("error", () => finishError("backend_unavailable"));
+    child.once("close", (status, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      wipeInput();
+      const collectedStdout = Buffer.concat(stdout, stdoutBytes);
+      const collectedStderr = Buffer.concat(stderr, stderrBytes);
+      wipeOutput();
+      resolve({
+        status: Number.isInteger(status) ? status : null,
+        signal: typeof signal === "string" ? signal : null,
+        stdout: collectedStdout,
+        stderr: collectedStderr,
+      });
+    });
+    child.stdin.end(input);
+  });
+}
+
+export function minimalEnvironment(source, names, overrides = undefined) {
+  const environment = Object.create(null);
+  for (const name of names) {
+    const value = environmentValue(source, name);
+    if (value !== undefined) environment[name] = value;
+  }
+  if (overrides) {
+    for (const [name, value] of Object.entries(overrides)) {
+      if (typeof value === "string" && value) environment[name] = value;
+    }
+  }
+  return environment;
+}
+
+export function environmentValue(source, requestedName) {
+  if (!source || typeof source !== "object") return undefined;
+  const exact = source[requestedName];
+  if (typeof exact === "string" && exact) return exact;
+  const requested = requestedName.toLowerCase();
+  const matchingName = Object.keys(source).find((name) => name.toLowerCase() === requested);
+  const matching = matchingName === undefined ? undefined : source[matchingName];
+  return typeof matching === "string" && matching ? matching : undefined;
+}
+
+function bufferFrom(value) {
+  if (value === undefined || value === null) return Buffer.alloc(0);
+  if (Buffer.isBuffer(value)) return Buffer.from(value);
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value);
+  }
+  if (typeof value === "string") return Buffer.from(value, "utf8");
+  return Buffer.alloc(0);
+}
+
+function resultBuffer(value) {
+  if (value === undefined || value === null) return Buffer.alloc(0);
+  if (Buffer.isBuffer(value)) return Buffer.from(value);
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value);
+  }
+  if (typeof value === "string") return Buffer.from(value, "utf8");
+  return undefined;
+}
+
+function wipeByteArray(value) {
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array) value.fill(0);
+}
+
+function positiveInteger(value, fallback) {
+  return Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+function safeIdentifier(value, fallback) {
+  return typeof value === "string" && /^[a-z0-9_-]{1,64}$/.test(value)
+    ? value
+    : fallback;
+}

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/trial-credential-record.d.mts

@@ -0,0 +1,82 @@
+export const TRIAL_CREDENTIAL_RECORD_VERSION: 1;
+
+export type TrialCredentialRecordState = "provisioning" | "ready";
+
+type TrialCredentialIdentity = Readonly<{
+  version: 1;
+  mark_id: string;
+  mark_version: 1;
+  app_salt: "memorax-plugin-v1";
+  machine_id: string;
+  hostname: string;
+  platform: "windows" | "linux" | "macos";
+  arch: "x86_64" | "arm64";
+  mac_hash: string;
+}>;
+
+export type TrialCredentialRecord = TrialCredentialIdentity & (
+  | Readonly<{
+      state: "provisioning";
+      api_key: null;
+      account_id: null;
+      project_id: null;
+    }>
+  | Readonly<{
+      state: "ready";
+      api_key: string;
+      account_id: string;
+      project_id: string;
+    }>
+);
+
+export type TrialCredentialRecordInvalidReason =
+  | "malformed_json"
+  | "invalid_record"
+  | "unknown_fields"
+  | "missing_fields"
+  | "unsupported_version"
+  | "invalid_version"
+  | "invalid_state"
+  | "invalid_mark_id"
+  | "invalid_mark_version"
+  | "invalid_app_salt"
+  | "invalid_machine_id"
+  | "invalid_hostname"
+  | "invalid_platform"
+  | "invalid_arch"
+  | "invalid_mac_hash"
+  | "invalid_api_key"
+  | "invalid_shape"
+  | "invalid_account_id"
+  | "invalid_project_id"
+  | "invalid_transition";
+
+export class TrialCredentialRecordError extends Error {
+  constructor(reason: TrialCredentialRecordInvalidReason);
+  readonly code: "TRIAL_CREDENTIAL_RECORD_INVALID";
+  readonly reason: TrialCredentialRecordInvalidReason;
+}
+
+export function parseTrialCredentialRecord(text: string): TrialCredentialRecord;
+export function validateTrialCredentialRecord(value: unknown): TrialCredentialRecord;
+export function serializeTrialCredentialRecord(value: unknown): string;
+
+export function createInitialTrialCredentialRecord(options: Readonly<{
+  markId: string;
+  markVersion: 1;
+  appSalt: "memorax-plugin-v1";
+  machineId: string;
+  hostname: string;
+  platform: "windows" | "linux" | "macos";
+  arch: "x86_64" | "arm64";
+  macHash: string;
+}>): TrialCredentialRecord;
+
+export function completeTrialCredentialProvisioning(
+  value: unknown,
+  metadata: Readonly<{
+    accountId: string;
+    projectId: string;
+    apiKey: string;
+  }>,
+): TrialCredentialRecord;

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/trial-credential-record.mjs

@@ -0,0 +1,183 @@
+export const TRIAL_CREDENTIAL_RECORD_VERSION = 1;
+
+const RECORD_KEYS = Object.freeze([
+  "version",
+  "state",
+  "mark_id",
+  "mark_version",
+  "app_salt",
+  "machine_id",
+  "hostname",
+  "platform",
+  "arch",
+  "mac_hash",
+  "api_key",
+  "account_id",
+  "project_id",
+]);
+const RECORD_KEY_SET = new Set(RECORD_KEYS);
+const MARK_ID_PATTERN = /^mk_[0-9a-f]{64}$/;
+const MACHINE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{43}$/;
+const DECIMAL_PUBLIC_ID_PATTERN = /^[0-9]+$/;
+const ERROR_REASONS = new Set([
+  "malformed_json",
+  "invalid_record",
+  "unknown_fields",
+  "missing_fields",
+  "unsupported_version",
+  "invalid_version",
+  "invalid_state",
+  "invalid_mark_id",
+  "invalid_mark_version",
+  "invalid_app_salt",
+  "invalid_machine_id",
+  "invalid_hostname",
+  "invalid_platform",
+  "invalid_arch",
+  "invalid_mac_hash",
+  "invalid_api_key",
+  "invalid_shape",
+  "invalid_account_id",
+  "invalid_project_id",
+  "invalid_transition",
+]);
+
+export class TrialCredentialRecordError extends Error {
+  constructor(reason) {
+    const safeReason = ERROR_REASONS.has(reason) ? reason : "invalid_record";
+    super(`Trial credential record is invalid (${safeReason})`);
+    this.name = "TrialCredentialRecordError";
+    this.code = "TRIAL_CREDENTIAL_RECORD_INVALID";
+    this.reason = safeReason;
+  }
+}
+
+export function parseTrialCredentialRecord(text) {
+  if (typeof text !== "string") {
+    throw new TypeError("Trial credential record input must be a string");
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    fail("malformed_json");
+  }
+  return validateRecord(value);
+}
+
+export function validateTrialCredentialRecord(value) {
+  return validateRecord(value);
+}
+
+export function serializeTrialCredentialRecord(value) {
+  const record = validateTrialCredentialRecord(value);
+  return `${JSON.stringify(record, null, 2)}\n`;
+}
+
+export function createInitialTrialCredentialRecord(options) {
+  return validateRecord({
+    version: TRIAL_CREDENTIAL_RECORD_VERSION,
+    state: "provisioning",
+    mark_id: options?.markId,
+    mark_version: options?.markVersion,
+    app_salt: options?.appSalt,
+    machine_id: options?.machineId,
+    hostname: options?.hostname,
+    platform: options?.platform,
+    arch: options?.arch,
+    mac_hash: options?.macHash,
+    api_key: null,
+    account_id: null,
+    project_id: null,
+  });
+}
+
+export function completeTrialCredentialProvisioning(value, metadata) {
+  const record = validateRecord(value);
+  if (record.state !== "provisioning") fail("invalid_transition");
+  return validateRecord({
+    ...record,
+    state: "ready",
+    api_key: metadata?.apiKey,
+    account_id: metadata?.accountId,
+    project_id: metadata?.projectId,
+  });
+}
+
+function validateRecord(value) {
+  if (!isRecord(value)) fail("invalid_record");
+  const keys = Reflect.ownKeys(value);
+  if (keys.some((key) => typeof key !== "string" || !RECORD_KEY_SET.has(key))) {
+    fail("unknown_fields");
+  }
+  if (RECORD_KEYS.some((key) => !Object.hasOwn(value, key))) fail("missing_fields");
+  const snapshot = Object.fromEntries(RECORD_KEYS.map((key) => [key, value[key]]));
+
+  if (snapshot.version !== TRIAL_CREDENTIAL_RECORD_VERSION) {
+    if (Number.isSafeInteger(snapshot.version) && snapshot.version > 0) {
+      fail("unsupported_version");
+    }
+    fail("invalid_version");
+  }
+  if (snapshot.state !== "provisioning" && snapshot.state !== "ready") {
+    fail("invalid_state");
+  }
+  if (typeof snapshot.mark_id !== "string" || !MARK_ID_PATTERN.test(snapshot.mark_id)) {
+    fail("invalid_mark_id");
+  }
+  if (snapshot.mark_version !== 1) fail("invalid_mark_version");
+  if (snapshot.app_salt !== "memorax-plugin-v1") fail("invalid_app_salt");
+  if (typeof snapshot.machine_id !== "string"
+    || !MACHINE_ID_PATTERN.test(snapshot.machine_id)) {
+    fail("invalid_machine_id");
+  }
+  if (!validBoundedText(snapshot.hostname, 120)) fail("invalid_hostname");
+  if (!["windows", "linux", "macos"].includes(snapshot.platform)) {
+    fail("invalid_platform");
+  }
+  if (!["x86_64", "arm64"].includes(snapshot.arch)) fail("invalid_arch");
+  if (typeof snapshot.mac_hash !== "string"
+    || !SHA256_HEX_PATTERN.test(snapshot.mac_hash)) {
+    fail("invalid_mac_hash");
+  }
+
+  if (snapshot.state === "provisioning") {
+    if (snapshot.api_key !== null
+      || snapshot.account_id !== null
+      || snapshot.project_id !== null) {
+      fail("invalid_shape");
+    }
+    return Object.freeze(snapshot);
+  }
+
+  if (typeof snapshot.api_key !== "string" || !API_KEY_PATTERN.test(snapshot.api_key)) {
+    fail("invalid_api_key");
+  }
+  if (!decimalPublicId(snapshot.account_id)) fail("invalid_account_id");
+  if (!decimalPublicId(snapshot.project_id)) fail("invalid_project_id");
+  return Object.freeze(snapshot);
+}
+
+function decimalPublicId(value) {
+  return typeof value === "string" && DECIMAL_PUBLIC_ID_PATTERN.test(value);
+}
+
+function validBoundedText(value, maximumLength) {
+  return typeof value === "string"
+    && value.length > 0
+    && value.length <= maximumLength
+    && value === value.trim()
+    && !value.includes("\0");
+}
+
+function isRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function fail(reason) {
+  throw new TrialCredentialRecordError(reason);
+}

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/trial-credential-store.d.mts

@@ -0,0 +1,82 @@
+import type { AsyncJsonFileLockOptions } from "../config-utils.mjs";
+import type { TrialCredentialRecord } from "./trial-credential-record.mjs";
+
+export type TrialCredentialSecureBackend = Readonly<{
+  load(): Promise<string | null>;
+  save(serialized: string): Promise<void>;
+  delete(): Promise<boolean>;
+}>;
+
+export type TrialCredentialStoreOptions = Readonly<{
+  memoraxCodeHome?: string;
+  env?: Record<string, string | undefined>;
+  platform?: NodeJS.Platform;
+  backend?: TrialCredentialSecureBackend;
+  runtime?: Record<string, unknown>;
+  lockOptions?: AsyncJsonFileLockOptions;
+  provisionLockOptions?: AsyncJsonFileLockOptions;
+}>;
+
+export type TrialCredentialNamespaceOptions = Readonly<{
+  platform?: NodeJS.Platform;
+  resolveHome?: (value: string) => string;
+}>;
+
+export type TrialCredentialStorePort = Readonly<{
+  load(): Promise<TrialCredentialRecord | null>;
+  createIfAbsent(
+    value: unknown,
+  ): Promise<Readonly<{ record: TrialCredentialRecord; created: boolean }>>;
+  complete(
+    value: TrialCredentialRecord,
+    metadata: Readonly<{
+      accountId: string;
+      projectId: string;
+      apiKey: string;
+    }>,
+  ): Promise<TrialCredentialRecord>;
+  withProvisionLock<T>(
+    operation: () => T | Promise<T>,
+    options?: AsyncJsonFileLockOptions,
+  ): Promise<T>;
+}>;
+
+export function trialCredentialNamespace(
+  memoraxCodeHome: string,
+  options?: TrialCredentialNamespaceOptions,
+): string;
+
+export function trialCredentialLockPath(memoraxCodeHome: string): string;
+export function trialCredentialProvisionLockPath(memoraxCodeHome: string): string;
+
+export function withTrialCredentialProvisionLock<T>(
+  operation: () => T | Promise<T>,
+  options?: TrialCredentialStoreOptions,
+): Promise<T>;
+
+export function createTrialCredentialStorePort(
+  options?: TrialCredentialStoreOptions,
+): TrialCredentialStorePort;
+
+export function loadTrialCredentialRecord(
+  options?: TrialCredentialStoreOptions,
+): Promise<TrialCredentialRecord | null>;
+
+export function createTrialCredentialRecordIfAbsent(
+  value: unknown,
+  options?: TrialCredentialStoreOptions,
+): Promise<Readonly<{ record: TrialCredentialRecord; created: boolean }>>;
+
+export function completeTrialCredentialRecord(
+  value: TrialCredentialRecord,
+  metadata: Readonly<{
+    accountId: string;
+    projectId: string;
+    apiKey: string;
+  }>,
+  options?: TrialCredentialStoreOptions,
+): Promise<TrialCredentialRecord>;
+
+export function clearTrialCredentialRecord(
+  options?: TrialCredentialStoreOptions,
+): Promise<Readonly<{ deleted: boolean }>>;