@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.6

package/src/project/config.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { sanitizedGitEnvironment } from '../runtime/git-adapter.mjs'
 
 export const PROJECT_CONFIG_ARG_PREFIX = '--project-config='
 export const PROJECT_CONFIG_ENV = 'MNSTRY_ATELIER_PROJECT_CONFIG'
@@ -195,25 +196,25 @@ function overlayRepoPath(overlay, repoName) {
   return firstString(direct, repo.path, repo.localPath)
 }
 
-function resolveRepoPath({ repo, repoName, configDir, workspaceRoot, overlay, cliRepoPaths }) {
+function resolveRepoPath({ repo, repoName, configDir, workspaceRoot, overlay, cliRepoPaths, gitExecutable, env }) {
   if (repoName && cliRepoPaths.has(repoName)) return cliRepoPaths.get(repoName)
   const overlayPath = overlayRepoPath(overlay, repoName)
   const fromOverlay = resolvePathValue(overlayPath, configDir)
   if (fromOverlay) return fromOverlay
   const fromConfig = resolvePathValue(repo.path, configDir) || resolvePathValue(repo.path, workspaceRoot)
   if (fromConfig) return fromConfig
-  return discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot })
+  return discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot, gitExecutable, env })
 }
 
-function repoPathSource({ repo, repoName, overlay, cliRepoPaths, workspaceRoot, configDir }) {
+function repoPathSource({ repo, repoName, overlay, cliRepoPaths, workspaceRoot, configDir, gitExecutable, env }) {
   if (repoName && cliRepoPaths.has(repoName)) return 'cli'
   if (overlayRepoPath(overlay, repoName)) return 'local-overlay'
   if (firstString(repo.path)) return 'tracked-config'
-  if (discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot })) return 'sibling-discovery'
+  if (discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot, gitExecutable, env })) return 'sibling-discovery'
   return null
 }
 
-function discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot }) {
+function discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot, gitExecutable = 'git', env = process.env }) {
   if (!repoName) return null
   const candidates = [
     path.join(workspaceRoot, repoName),
@@ -222,14 +223,14 @@ function discoverSiblingRepoPath({ repo, repoName, configDir, workspaceRoot }) {
   ]
   for (const candidate of candidates) {
     if (!fs.existsSync(candidate)) continue
-    if (repo.remote && !gitRemoteMatches(candidate, repo.remote)) continue
+    if (repo.remote && !gitRemoteMatches(candidate, repo.remote, { gitExecutable, env })) continue
     return path.resolve(candidate)
   }
   return null
 }
 
-function gitRemoteMatches(repoPath, expected) {
-  const result = spawnSync('git', ['-C', repoPath, 'remote', 'get-url', 'origin'], { encoding: 'utf8' })
+function gitRemoteMatches(repoPath, expected, { gitExecutable = 'git', env = process.env } = {}) {
+  const result = spawnSync(gitExecutable, ['-C', repoPath, 'remote', 'get-url', 'origin'], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
   if (result.status !== 0) return false
   const actual = normalizeRemote(result.stdout.trim())
   return actual === normalizeRemote(expected)
@@ -243,9 +244,9 @@ function normalizeRemote(value) {
     .toLowerCase()
 }
 
-export function gitRemoteUrl(repoPath) {
+export function gitRemoteUrl(repoPath, { gitExecutable = 'git', env = process.env } = {}) {
   if (!repoPath || !fs.existsSync(repoPath)) return null
-  const result = spawnSync('git', ['-C', repoPath, 'remote', 'get-url', 'origin'], { encoding: 'utf8' })
+  const result = spawnSync(gitExecutable, ['-C', repoPath, 'remote', 'get-url', 'origin'], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
   return result.status === 0 ? firstString(result.stdout) : null
 }
 
@@ -268,6 +269,7 @@ export function resolveProjectConfig({
   env = process.env,
   cwd = process.cwd(),
   configArgPrefix = PROJECT_CONFIG_ARG_PREFIX,
+  gitExecutable = 'git',
   configEnv = PROJECT_CONFIG_ENV,
   defaults = {},
 } = {}) {
@@ -373,7 +375,7 @@ export function resolveProjectConfig({
     localOverlay,
     repos: (Array.isArray(config.repos) ? config.repos : []).map((repo) => {
       const repoName = firstString(repo.name) || (repo.path ? path.basename(repo.path) : null)
-      const repoPath = resolveRepoPath({ repo, repoName, configDir, workspaceRoot, overlay: localOverlay.overlay, cliRepoPaths })
+      const repoPath = resolveRepoPath({ repo, repoName, configDir, workspaceRoot, overlay: localOverlay.overlay, cliRepoPaths, gitExecutable, env })
       const external = isExternalRepo(repo)
       return {
         ...repo,
@@ -381,16 +383,16 @@ export function resolveProjectConfig({
         path: repoPath,
         external,
         readBoundary: external ? null : firstString(repo.readBoundary) || 'team',
-        pathSource: repoPath ? repoPathSource({ repo, repoName, overlay: localOverlay.overlay, cliRepoPaths, workspaceRoot, configDir }) : null,
+        pathSource: repoPath ? repoPathSource({ repo, repoName, overlay: localOverlay.overlay, cliRepoPaths, workspaceRoot, configDir, gitExecutable, env }) : null,
       }
     }),
   }
-  resolved.localState = ensureLocalState(resolved, { write: true })
+  resolved.localState = ensureLocalState(resolved, { write: true, gitExecutable, env })
   return resolved
 }
 
-export function commandProject({ argv = process.argv.slice(2), env = process.env, cwd = process.cwd() } = {}) {
-  const project = resolveProjectConfig({ argv, env, cwd })
+export function commandProject({ argv = process.argv.slice(2), env = process.env, cwd = process.cwd(), gitExecutable = 'git' } = {}) {
+  const project = resolveProjectConfig({ argv, env, cwd, gitExecutable })
   // Fail closed at CLI entry, but only when a real config file was loaded; the
   // defaults/no-file path resolves with an empty config that would spuriously
   // fail document validation.
@@ -419,35 +421,35 @@ export function localStateRoot(projectOrDir) {
   return path.join(configDir || process.cwd(), LOCAL_STATE_DIR)
 }
 
-function gitRootFor(dir) {
-  const result = spawnSync('git', ['-C', dir, 'rev-parse', '--show-toplevel'], { encoding: 'utf8' })
+function gitRootFor(dir, { gitExecutable = 'git', env = process.env } = {}) {
+  const result = spawnSync(gitExecutable, ['-C', dir, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
   return result.status === 0 ? result.stdout.trim() : null
 }
 
-function gitPrefixFor(dir) {
-  const result = spawnSync('git', ['-C', dir, 'rev-parse', '--show-prefix'], { encoding: 'utf8' })
+function gitPrefixFor(dir, { gitExecutable = 'git', env = process.env } = {}) {
+  const result = spawnSync(gitExecutable, ['-C', dir, 'rev-parse', '--show-prefix'], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
   return result.status === 0 ? result.stdout.trim() : null
 }
 
-function isIgnoredByGit(gitRoot, rel) {
-  const result = spawnSync('git', ['-C', gitRoot, 'check-ignore', '-q', rel], { encoding: 'utf8' })
+function isIgnoredByGit(gitRoot, rel, { gitExecutable = 'git', env = process.env } = {}) {
+  const result = spawnSync(gitExecutable, ['-C', gitRoot, 'check-ignore', '-q', rel], { encoding: 'utf8', env: sanitizedGitEnvironment(env) })
   return result.status === 0
 }
 
-export function ensureLocalState(project, { write = false } = {}) {
+export function ensureLocalState(project, { write = false, gitExecutable = 'git', env = process.env } = {}) {
   const root = localStateRoot(project)
-  const gitRoot = gitRootFor(project.configDir)
+  const gitRoot = gitRootFor(project.configDir, { gitExecutable, env })
   // Git owns the repository-relative spelling. Deriving it by comparing
   // filesystem paths breaks when Windows exposes the cwd through an 8.3 short
   // name (RUNNER~1) but Git reports the same root through its long name.
-  const gitPrefix = gitRoot ? gitPrefixFor(project.configDir) : null
+  const gitPrefix = gitRoot ? gitPrefixFor(project.configDir, { gitExecutable, env }) : null
   const rel = gitRoot && gitPrefix !== null ? `${gitPrefix}${LOCAL_STATE_DIR}` : LOCAL_STATE_DIR
   // A directory-only ignore rule such as `.atelier-local/` is not evaluated
   // consistently by Git for an absent directory on every host. Probe a
   // hypothetical child as well: it proves the directory rule before Atelier
   // creates any local state, including on Git for Windows.
   const ignored = gitRoot && gitPrefix !== null
-    ? isIgnoredByGit(gitRoot, `${rel}/.atelier-ignore-probe`) || isIgnoredByGit(gitRoot, `${rel}/`) || isIgnoredByGit(gitRoot, rel)
+    ? isIgnoredByGit(gitRoot, `${rel}/.atelier-ignore-probe`, { gitExecutable, env }) || isIgnoredByGit(gitRoot, `${rel}/`, { gitExecutable, env }) || isIgnoredByGit(gitRoot, rel, { gitExecutable, env })
     : gitRoot === null
   const report = {
     root,

package/src/runtime/git-adapter.mjs

@@ -0,0 +1,189 @@
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
+
+const DEFAULT_TIMEOUT_MS = 30_000
+const DEFAULT_MAX_BUFFER = 16 * 1024 * 1024
+
+function executableNames(platform = process.platform, env = process.env) {
+  if (platform !== 'win32') return ['git']
+  const extensions = String(env.PATHEXT || '.EXE;.CMD;.BAT;.COM')
+    .split(';')
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean)
+  return ['git.exe', ...extensions.map((extension) => `git${extension}`).filter((name) => name !== 'git.exe')]
+}
+
+function isExecutable(file, platform = process.platform) {
+  try {
+    fs.accessSync(file, platform === 'win32' ? fs.constants.F_OK : fs.constants.X_OK)
+    return fs.statSync(file).isFile()
+  } catch {
+    return false
+  }
+}
+
+function canonicalExecutable(file) {
+  try {
+    return fs.realpathSync.native(file)
+  } catch {
+    return fs.realpathSync(file)
+  }
+}
+
+/**
+ * Resolve one exact Git executable without invoking a shell. The selected path
+ * is carried through every later operation so PATH changes cannot swap engines
+ * underneath a running supervisor.
+ */
+export function resolveGitExecutable({ env = process.env, platform = process.platform } = {}) {
+  const configured = String(env.ATELIER_GIT_PATH || '').trim()
+  if (configured) {
+    if (!path.isAbsolute(configured)) throw new Error('ATELIER_GIT_PATH must be an absolute path')
+    if (!isExecutable(configured, platform)) throw new Error(`configured Git executable is unavailable: ${configured}`)
+    return canonicalExecutable(configured)
+  }
+
+  const searchPath = String(env.PATH || '')
+  const delimiter = platform === 'win32' ? ';' : path.delimiter
+  const names = executableNames(platform, env)
+  for (const directory of searchPath.split(delimiter).filter(Boolean)) {
+    const cleanDir = directory.replace(/^"|"$/g, '')
+    for (const name of names) {
+      const candidate = path.join(cleanDir, name)
+      if (isExecutable(candidate, platform)) return canonicalExecutable(candidate)
+    }
+  }
+  throw new Error('compatible system Git was not found on PATH')
+}
+
+export function sanitizedGitEnvironment(env = process.env, allowPrompt = false) {
+  const next = { ...env }
+  for (const key of Object.keys(next)) {
+    if (key.toUpperCase().startsWith('GIT_')) delete next[key]
+  }
+  if (!allowPrompt) next.GIT_TERMINAL_PROMPT = '0'
+  next.GIT_OPTIONAL_LOCKS = next.GIT_OPTIONAL_LOCKS || '1'
+  next.GIT_NO_REPLACE_OBJECTS = '1'
+  return next
+}
+
+export function redactGitDiagnostic(value) {
+  return String(value || '')
+    .replace(/https?:\/\/[^\s]+/gi, (url) => sanitizeRemoteUrl(url))
+    .replace(/\b((?:password|passwd|token|secret|authorization|proxy-authorization|extraheader)\s*[=:]\s*)[^\s]+/gi, '$1[redacted]')
+    .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, '$1 [redacted]')
+}
+
+export class GitCommandError extends Error {
+  constructor(message, result) {
+    super(message)
+    this.name = 'GitCommandError'
+    this.result = result
+  }
+}
+
+export function runGit(gitExecutable, repoRoot, args, {
+  allowFailure = false,
+  allowPrompt = false,
+  env = process.env,
+  input = undefined,
+  timeout = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  if (!path.isAbsolute(gitExecutable)) throw new Error('Git executable must be an absolute path')
+  if (!Array.isArray(args) || args.some((value) => typeof value !== 'string')) {
+    throw new Error('Git arguments must be a string array')
+  }
+  const argv = repoRoot ? ['-C', repoRoot, ...args] : args
+  const child = spawnSync(gitExecutable, argv, {
+    encoding: 'utf8',
+    env: sanitizedGitEnvironment(env, allowPrompt),
+    input,
+    maxBuffer: DEFAULT_MAX_BUFFER,
+    shell: false,
+    timeout,
+    windowsHide: true,
+  })
+  const result = {
+    ok: !child.error && child.status === 0,
+    status: child.status,
+    signal: child.signal ?? null,
+    stdout: child.stdout || '',
+    stderr: redactGitDiagnostic(child.stderr || ''),
+    error: child.error?.message ? redactGitDiagnostic(child.error.message) : null,
+    executable: gitExecutable,
+    args: argv,
+  }
+  if (!result.ok && !allowFailure) {
+    const detail = result.error || result.stderr.trim() || `exit ${String(result.status)}`
+    throw new GitCommandError(`Git ${args[0] || 'command'} failed: ${detail}`, result)
+  }
+  return result
+}
+
+export function gitText(gitExecutable, repoRoot, args, options = {}) {
+  return runGit(gitExecutable, repoRoot, args, options).stdout.trim()
+}
+
+export function parseGitVersion(text) {
+  const match = String(text || '').match(/git version (\d+)\.(\d+)\.(\d+)/i)
+  if (!match) return null
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), text: match[0] }
+}
+
+export function isSupportedGitVersion(version) {
+  return Boolean(version && (version.major > 2 || (version.major === 2 && version.minor >= 40)))
+}
+
+export function inspectGitEngine(gitExecutable, { env = process.env } = {}) {
+  const result = runGit(gitExecutable, null, ['--version'], { env })
+  const version = parseGitVersion(result.stdout)
+  if (!version) throw new Error(`unrecognized Git version output from ${gitExecutable}`)
+  return {
+    executable: gitExecutable,
+    version: `${version.major}.${version.minor}.${version.patch}`,
+    supported: isSupportedGitVersion(version),
+    minimum: '2.40.0',
+  }
+}
+
+export function classifyRemoteAuthentication(url) {
+  const value = String(url || '').trim()
+  if (!value) return 'none'
+  if (/^(?:ssh:\/\/|[^/@\s]+@[^:/\s]+:)/i.test(value)) return 'ssh'
+  if (/^https?:\/\//i.test(value)) return 'https'
+  if (/^(?:file:\/\/|\.{0,2}[\\/]|[a-z]:[\\/]|[\\/])/i.test(value)) return 'local'
+  return 'unknown'
+}
+
+/**
+ * Remote URLs are evidence, not authentication material. Git may carry HTTP
+ * credentials in user-info or query fragments, so local observations retain
+ * only the provider/repository address needed for diagnosis.
+ */
+export function sanitizeRemoteUrl(url) {
+  const value = String(url || '').trim()
+  const scpLike = value.match(/^[^/@\s]+@([^:/\s]+:.+)$/)
+  if (scpLike) return scpLike[1]
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return value
+  try {
+    const parsed = new URL(value)
+    parsed.username = ''
+    Reflect.set(parsed, 'password', '')
+    parsed.search = ''
+    parsed.hash = ''
+    return parsed.toString()
+  } catch {
+    return value.replace(/^((?:https?|ssh):\/\/)(?:[^/@:]+:)?[^/@]+@/i, '$1')
+  }
+}
+
+export function parseNullConfig(text) {
+  const entries = []
+  for (const record of String(text || '').split('\0').filter(Boolean)) {
+    const newline = record.indexOf('\n')
+    if (newline === -1) entries.push({ key: record, value: '' })
+    else entries.push({ key: record.slice(0, newline), value: record.slice(newline + 1) })
+  }
+  return entries
+}