@mnstry/atelier 0.2.0-alpha.1 → 0.2.0-alpha.10

package/src/boundary/content-rules.mjs

@@ -1,11 +1,18 @@
 import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
 import { matchesPathPattern, normalizeRelPath } from '../project/path-match.mjs'
+import { sanitizedGitEnvironment } from '../runtime/git-adapter.mjs'
 
 export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'
 export const ZERO_SHA_RE = /^0{40,}$/
 
 export const RULE_KINDS = Object.freeze(['content', 'path'])
 export const RULE_SEVERITIES = Object.freeze(['error', 'warning'])
+export const DIFF_RESULT_MAX_BYTES = 16 * 1024 * 1024
+export const CHECK_AGGREGATE_MAX_BYTES = 64 * 1024 * 1024
+export const BINARY_FILE_MAX_BYTES = 8 * 1024 * 1024
+export const BINARY_AGGREGATE_MAX_BYTES = 32 * 1024 * 1024
 
 // A blanket exception is not an exception, it is switching the rule off. The
 // contract requires a rule, a repo, real paths, and a reason a reviewer can act on.
@@ -33,7 +40,8 @@ export const DEFAULT_CONTENT_RULES = Object.freeze(
       id: 'private-financial-filename',
       kind: 'path',
       severity: 'error',
-      pattern: '(\\.env($|\\.)|invoice|payroll|(^|[-_/])salar(y|ies)|bank[-_]?statement|tax[-_]?return|credential|(^|[-_/])password([-_.]|$)|(^|[-_/])secret([-_.]|$)|id_rsa)',
+      pattern:
+        '((^|/)\\.env(?:$|[.-])|invoice|payroll|(^|[-_/])salar(y|ies)|bank[-_]?statement|tax[-_]?return|credential|(^|[-_/])password([-_.]|$)|(^|[-_/])secret([-_.]|$)|id_rsa)',
       description: 'Private or financial material does not belong in a source repo.',
     },
   ].map(Object.freeze),
@@ -45,6 +53,7 @@ const trimmed = (value) => (typeof value === 'string' ? value.trim() : '')
 export function validateContentRules(rules, { label = 'contentRules' } = {}) {
   const errors = []
   if (!Array.isArray(rules)) return [`${label} must be an array`]
+  if (rules.length === 0) errors.push(`${label} must contain at least one rule; omit the field to use the defaults`)
   const seen = new Set()
   for (const [index, rule] of rules.entries()) {
     const at = `${label}[${index}]`
@@ -112,7 +121,8 @@ export function validateContentRuleExceptions(exceptions, rules = DEFAULT_CONTEN
 
 export function resolveContentRules(policy) {
   const declared = Array.isArray(policy?.contentRules) ? policy.contentRules : null
-  return declared ?? DEFAULT_CONTENT_RULES
+  if (!declared?.length || validateContentRules(declared).length > 0) return DEFAULT_CONTENT_RULES
+  return declared
 }
 
 export function findException({ exceptions = [], rule, repo, path: filePath }) {
@@ -209,36 +219,237 @@ export function parseAddedContent(diff) {
 
 /** Ref updates arrive on the pre-push hook's stdin as `<localRef> <localSha> <remoteRef> <remoteSha>`. */
 export function parsePushRefUpdates(text) {
+  return parsePushRefInput(text).updates
+}
+
+export function parsePushRefInput(text) {
   const updates = []
-  for (const raw of String(text ?? '').split('\n')) {
+  const issues = []
+  const input = String(text ?? '')
+  if (!input.trim()) return { ok: true, kind: 'empty', updates, issues }
+  for (const [index, raw] of input.split(/\r?\n/).entries()) {
+    if (!raw.trim()) continue
     const parts = raw.trim().split(/\s+/).filter(Boolean)
-    if (parts.length < 4) continue
+    if (parts.length !== 4) {
+      issues.push(`line ${index + 1}: expected four pre-push fields`)
+      continue
+    }
     const [localRef, localSha, remoteRef, remoteSha] = parts
+    if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i.test(localSha) || !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i.test(remoteSha)) {
+      issues.push(`line ${index + 1}: ref update contains an invalid object id`)
+      continue
+    }
+    if (!localRef || !remoteRef) {
+      issues.push(`line ${index + 1}: ref names are required`)
+      continue
+    }
     if (ZERO_SHA_RE.test(localSha)) continue // branch deletion pushes no content
     updates.push({ localRef, localSha, remoteRef, remoteSha })
   }
-  return updates
+  return issues.length > 0
+    ? { ok: false, kind: 'invalid', updates: [], issues }
+    : { ok: true, kind: updates.length > 0 ? 'valid' : 'empty', updates, issues: [] }
 }
 
-function gitOutput(repoRoot, args) {
-  const result = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
-  return result.status === 0 ? result.stdout : null
+export function gitOutputResult(repoRoot, args, {
+  encoding = 'utf8',
+  gitExecutable = 'git',
+  maxBuffer = DIFF_RESULT_MAX_BYTES,
+  runner = spawnSync,
+} = {}) {
+  let result
+  try {
+    result = runner(gitExecutable, ['-C', repoRoot, ...args], { encoding, maxBuffer, env: sanitizedGitEnvironment() })
+  } catch (error) {
+    return { ok: false, code: 'git-command-failed', error: error instanceof Error ? error.message : String(error), stdout: null }
+  }
+  if (result?.error?.code === 'ENOBUFS') {
+    return { ok: false, code: 'git-output-limit-exceeded', error: `Git ${args[0] ?? 'command'} exceeded the ${maxBuffer}-byte evidence limit`, stdout: null }
+  }
+  if (result?.status !== 0) {
+    return { ok: false, code: 'git-command-failed', error: `Git ${args[0] ?? 'command'} failed with status ${result?.status ?? 'unknown'}`, stdout: null }
+  }
+  const stdout = result.stdout ?? (encoding === 'buffer' ? Buffer.alloc(0) : '')
+  const bytes = Buffer.isBuffer(stdout) ? stdout.length : Buffer.byteLength(stdout)
+  if (bytes > maxBuffer) {
+    return { ok: false, code: 'git-output-limit-exceeded', error: `Git ${args[0] ?? 'command'} exceeded the ${maxBuffer}-byte evidence limit`, stdout: null }
+  }
+  return { ok: true, stdout, bytes }
 }
 
 export function pushRangeBase(repoRoot, remoteSha) {
   // A new branch has no remote counterpart, so everything it carries is new:
   // diff against the empty tree rather than silently scanning nothing.
   if (!remoteSha || ZERO_SHA_RE.test(remoteSha)) return EMPTY_TREE
-  return gitOutput(repoRoot, ['rev-parse', '--verify', '--quiet', `${remoteSha}^{commit}`]) ? remoteSha : EMPTY_TREE
+  const result = spawnSync('git', ['-C', repoRoot, 'rev-parse', '--verify', '--quiet', `${remoteSha}^{commit}`], {
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  })
+  return result.status === 0 ? remoteSha : EMPTY_TREE
 }
 
-export function diffForPushRange(repoRoot, { localSha, remoteSha }) {
+export function diffForPushRange(repoRoot, { localSha, remoteSha }, options = {}) {
   const base = pushRangeBase(repoRoot, remoteSha)
-  return gitOutput(repoRoot, ['diff', '--unified=0', base, localSha]) ?? ''
+  const result = gitOutputResult(repoRoot, ['diff', '--unified=0', base, localSha], options)
+  return result.ok ? { ...result, base, diff: result.stdout } : { ...result, base, diff: null }
+}
+
+export function stagedDiff(repoRoot, options = {}) {
+  const result = gitOutputResult(repoRoot, ['diff', '--cached', '--unified=0'], options)
+  return result.ok ? { ...result, diff: result.stdout } : { ...result, diff: null }
+}
+
+function incompleteDiagnostic({ repo, path: filePath = null, message, details = {} }) {
+  return {
+    severity: 'error',
+    code: 'content-scan-incomplete',
+    repo,
+    path: filePath,
+    line: null,
+    message: `${repo ?? 'repository'}${filePath ? `/${filePath}` : ''}: ${message}`,
+    details,
+  }
 }
 
-export function stagedDiff(repoRoot) {
-  return gitOutput(repoRoot, ['diff', '--cached', '--unified=0']) ?? ''
+function binaryPathsFromDiff(diff) {
+  const paths = new Set()
+  let current = null
+  for (const line of String(diff ?? '').split('\n')) {
+    if (line.startsWith('diff --git ')) {
+      const header = line.match(/^diff --git a\/(.*) b\/(.*)$/)
+      current = header ? normalizeRelPath(header[2]) : null
+      continue
+    }
+    if (current && (line.startsWith('Binary files ') || line === 'GIT binary patch')) paths.add(current)
+  }
+  return [...paths]
+}
+
+function isBinaryBuffer(buffer) {
+  if (buffer.subarray(0, Math.min(buffer.length, 8192)).includes(0)) return true
+  try {
+    new TextDecoder('utf-8', { fatal: true }).decode(buffer)
+    return false
+  } catch {
+    return true
+  }
+}
+
+function scanBinaryBuffer({ buffer, filePath, rules, exceptions, repo }) {
+  if (!isBinaryBuffer(buffer)) return []
+  const text = buffer.toString('latin1')
+  const findings = []
+  for (const rule of rules) {
+    if ((rule.kind ?? 'content') !== 'content' || !rulePathMatches(rule, filePath)) continue
+    if (!new RegExp(rule.pattern).test(text)) continue
+    if (findException({ exceptions, rule: rule.id, repo, path: filePath })) continue
+    findings.push({
+      severity: rule.severity ?? 'error',
+      code: 'content-rule-violation',
+      rule: rule.id,
+      repo,
+      path: filePath,
+      line: null,
+      binary: true,
+      message: `${repo ?? ''}/${filePath}: ${rule.description ?? rule.id} (binary content)`.replace(/^\//, ''),
+    })
+  }
+  return findings
+}
+
+function readBinaryChanges({ repoRoot, revision, diff, rules, exceptions, repo, gitExecutable, gitRunner }) {
+  const findings = []
+  const diagnostics = []
+  let totalBytes = 0
+  for (const filePath of binaryPathsFromDiff(diff)) {
+    const spec = revision === ':' ? `:${filePath}` : `${revision}:${filePath}`
+    const result = gitOutputResult(repoRoot, ['show', spec], {
+      encoding: 'buffer',
+      gitExecutable,
+      maxBuffer: BINARY_FILE_MAX_BYTES + 1,
+      runner: gitRunner,
+    })
+    if (!result.ok) {
+      diagnostics.push(incompleteDiagnostic({
+        repo,
+        path: filePath,
+        message: `binary content could not be read within the ${BINARY_FILE_MAX_BYTES}-byte per-file limit`,
+        details: { reason: result.code, limitBytes: BINARY_FILE_MAX_BYTES },
+      }))
+      continue
+    }
+    if (result.bytes > BINARY_FILE_MAX_BYTES) {
+      diagnostics.push(incompleteDiagnostic({
+        repo,
+        path: filePath,
+        message: `binary content exceeds the ${BINARY_FILE_MAX_BYTES}-byte per-file limit`,
+        details: { limitBytes: BINARY_FILE_MAX_BYTES, observedBytes: result.bytes },
+      }))
+      continue
+    }
+    totalBytes += result.bytes
+    if (totalBytes > BINARY_AGGREGATE_MAX_BYTES) {
+      diagnostics.push(incompleteDiagnostic({
+        repo,
+        path: filePath,
+        message: `binary content exceeds the ${BINARY_AGGREGATE_MAX_BYTES}-byte aggregate limit`,
+        details: { limitBytes: BINARY_AGGREGATE_MAX_BYTES },
+      }))
+      break
+    }
+    findings.push(...scanBinaryBuffer({ buffer: result.stdout, filePath, rules, exceptions, repo }))
+  }
+  return { findings, diagnostics, bytes: totalBytes }
+}
+
+export function scanStagedRepository({
+  repoRoot,
+  rules = DEFAULT_CONTENT_RULES,
+  exceptions = [],
+  repo = null,
+  gitExecutable = 'git',
+  gitRunner = spawnSync,
+} = {}) {
+  const acquired = stagedDiff(repoRoot, { gitExecutable, runner: gitRunner })
+  if (!acquired.ok) {
+    return {
+      findings: [],
+      diagnostics: [incompleteDiagnostic({ repo, message: 'staged evidence could not be acquired', details: { reason: acquired.code } })],
+      bytes: 0,
+    }
+  }
+  const files = parseAddedContent(acquired.diff)
+  const binary = readBinaryChanges({ repoRoot, revision: ':', diff: acquired.diff, rules, exceptions, repo, gitExecutable, gitRunner })
+  return {
+    findings: [...scanAddedContent({ files, rules, exceptions, repo }), ...binary.findings],
+    diagnostics: binary.diagnostics,
+    bytes: acquired.bytes + binary.bytes,
+  }
+}
+
+export function scanPushUpdate({
+  repoRoot,
+  update,
+  rules = DEFAULT_CONTENT_RULES,
+  exceptions = [],
+  repo = null,
+  gitRunner = spawnSync,
+} = {}) {
+  const acquired = diffForPushRange(repoRoot, update, { runner: gitRunner })
+  if (!acquired.ok) {
+    return {
+      findings: [],
+      diagnostics: [incompleteDiagnostic({ repo, message: 'push evidence could not be acquired', details: { reason: acquired.code } })],
+      bytes: 0,
+    }
+  }
+  const files = parseAddedContent(acquired.diff)
+  const binary = readBinaryChanges({ repoRoot, revision: update.localSha, diff: acquired.diff, rules, exceptions, repo })
+  return {
+    findings: [...scanAddedContent({ files, rules, exceptions, repo }), ...binary.findings],
+    diagnostics: binary.diagnostics,
+    bytes: acquired.bytes + binary.bytes,
+  }
 }
 
 /**
@@ -246,17 +457,69 @@ export function stagedDiff(repoRoot) {
  * accepted usage, so a repo can see what it has taken on without those findings
  * stopping unrelated work from being pushed.
  */
-export function scanTree(repoRoot, { rules = DEFAULT_CONTENT_RULES, exceptions = [], repo = null } = {}) {
-  const listed = gitOutput(repoRoot, ['ls-files', '-z']) ?? ''
+export function scanTree(repoRoot, {
+  rules = DEFAULT_CONTENT_RULES,
+  exceptions = [],
+  repo = null,
+  source = 'working-tree',
+} = {}) {
+  if (!['working-tree', 'head'].includes(source)) {
+    return { findings: [], diagnostics: [incompleteDiagnostic({ repo, message: `unknown audit source ${source}` })], source }
+  }
+  const listed = source === 'head'
+    ? gitOutputResult(repoRoot, ['ls-tree', '-r', '--name-only', '-z', 'HEAD'])
+    : gitOutputResult(repoRoot, ['ls-files', '-co', '--exclude-standard', '-z'])
+  if (!listed.ok) {
+    return { findings: [], diagnostics: [incompleteDiagnostic({ repo, message: `${source} audit paths could not be acquired`, details: { reason: listed.code } })], source }
+  }
   const files = []
-  for (const rel of listed.split('\0').filter(Boolean)) {
-    const blob = gitOutput(repoRoot, ['show', `HEAD:${rel}`])
-    if (blob == null) continue
+  const findings = []
+  const diagnostics = []
+  let totalBytes = 0
+  for (const rel of listed.stdout.split('\0').filter(Boolean)) {
+    let blob
+    if (source === 'head') {
+      const result = gitOutputResult(repoRoot, ['show', `HEAD:${rel}`], { encoding: 'buffer', maxBuffer: BINARY_FILE_MAX_BYTES + 1 })
+      if (!result.ok) {
+        diagnostics.push(incompleteDiagnostic({ repo, path: rel, message: 'HEAD blob could not be read', details: { reason: result.code } }))
+        continue
+      }
+      blob = result.stdout
+    } else {
+      const abs = pathForAudit(repoRoot, rel)
+      try {
+        const stat = fs.lstatSync(abs)
+        if (!stat.isFile() && !stat.isSymbolicLink()) continue
+        blob = stat.isSymbolicLink() ? Buffer.from(fs.readlinkSync(abs)) : fs.readFileSync(abs)
+      } catch {
+        diagnostics.push(incompleteDiagnostic({ repo, path: rel, message: 'working-tree file could not be read' }))
+        continue
+      }
+    }
+    if (blob.length > BINARY_FILE_MAX_BYTES) {
+      diagnostics.push(incompleteDiagnostic({ repo, path: rel, message: `audit content exceeds the ${BINARY_FILE_MAX_BYTES}-byte per-file limit` }))
+      continue
+    }
+    totalBytes += blob.length
+    if (totalBytes > BINARY_AGGREGATE_MAX_BYTES) {
+      diagnostics.push(incompleteDiagnostic({ repo, path: rel, message: `audit content exceeds the ${BINARY_AGGREGATE_MAX_BYTES}-byte aggregate limit` }))
+      break
+    }
+    if (isBinaryBuffer(blob)) {
+      findings.push(...scanBinaryBuffer({ buffer: blob, filePath: rel, rules, exceptions, repo }))
+      continue
+    }
+    const text = blob.toString('utf8')
     files.push({
       path: rel,
       added: true,
-      addedLines: blob.split('\n').map((text, index) => ({ number: index + 1, text })),
+      addedLines: text.split('\n').map((line, index) => ({ number: index + 1, text: line })),
     })
   }
-  return scanAddedContent({ files, rules, exceptions, repo })
+  findings.push(...scanAddedContent({ files, rules, exceptions, repo }))
+  return { findings, diagnostics, source, bytes: totalBytes }
+}
+
+function pathForAudit(repoRoot, rel) {
+  return path.join(repoRoot, ...normalizeRelPath(rel).split('/'))
 }