@nurix/nustack 0.26.4 → 0.26.5

package/dist/lib/auth_grant.js

@@ -161,6 +161,10 @@ export async function readStoredCredential() {
         credential: { deviceToken: credential.device_token, studioBaseUrl: credential.studio_base_url, deviceId, userEmail: credential.user_email },
     };
 }
+const deviceTokenOrigins = new Map();
+export function deviceTokenOrigin(token) {
+    return deviceTokenOrigins.get(token) ?? null;
+}
 export async function resolveAccessToken(origin) {
     const fromEnv = envToken();
     if (fromEnv) {
@@ -185,6 +189,8 @@ export async function resolveAccessToken(origin) {
     const refused = refusedContractOrigin(credential.studioBaseUrl, origin);
     if (refused)
         return { kind: "origin_mismatch", error: originMismatchError(refused, credential.studioBaseUrl, "device") };
+    if (credential.studioBaseUrl)
+        deviceTokenOrigins.set(credential.deviceToken, credential.studioBaseUrl);
     return { kind: "ok", session: { accessToken: credential.deviceToken, userEmail: credential.userEmail, deviceId } };
 }
 export async function ensureAccessToken(origin) {

package/dist/lib/harness/legacyMount.js

@@ -4,11 +4,26 @@ import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { HarnessError, HARNESS_CODES } from "./codes.js";
+import { nustackHomeDir } from "../local_store/paths.js";
 export const LEGACY_MOUNT_RECORD_PATH = ".claude/state/legacy-mount.json";
 export const LEGACY_EXCLUDE_START = "# etna:mount:start";
 export const LEGACY_EXCLUDE_END = "# etna:mount:end";
 const SHA256 = /^[0-9a-f]{64}$/;
 const REQUEST_TIMEOUT_MS = 15_000;
+export function harnessObjectCachePath(sha256) {
+    return path.join(nustackHomeDir(), "cache", "harness-objects", sha256);
+}
+async function cachedObject(sha256) {
+    const held = await readIfPresent(harnessObjectCachePath(sha256));
+    return held && sha256Of(held) === sha256 ? held : null;
+}
+async function keepObject(sha256, bytes) {
+    try {
+        await writeAtomic(harnessObjectCachePath(sha256), bytes);
+    }
+    catch {
+    }
+}
 const FETCH_CONCURRENCY = 8;
 const sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
 export function isMountedPath(file) {
@@ -164,10 +179,16 @@ export async function mountLegacyManifest(root, manifestUrl, origin) {
     const worker = async () => {
         while (next < needed.length) {
             const file = needed[next++];
+            const cached = await cachedObject(file.sha256);
+            if (cached) {
+                fetched.set(file, cached);
+                continue;
+            }
             const bytes = await fetchBytes(objectUrlOf(manifestUrl, file.key));
             if (sha256Of(bytes) !== file.sha256) {
                 throw new HarnessError(HARNESS_CODES.HARNESS_DIGEST_MISMATCH, `the object for ${file.path} does not match its sha256; nothing was written`);
             }
+            await keepObject(file.sha256, bytes);
             fetched.set(file, bytes);
         }
     };

package/dist/lib/nustack_client.js

@@ -1,9 +1,9 @@
 import { assertSafeNuStackUrl, assertSafeOpaqueId } from "./guards.js";
-import { deadCredentialCopy, DEVICE_HEADER, envToken, forgetRefusedToken, knownDeviceId, TokenRefusedError, userAgent } from "./auth_grant.js";
+import { deadCredentialCopy, DEVICE_HEADER, deviceTokenOrigin, envToken, forgetRefusedToken, knownDeviceId, TokenRefusedError, userAgent } from "./auth_grant.js";
 import { getOrCreateDeviceId } from "./device_identity.js";
 import { readStoredCredential } from "./auth_grant.js";
 import { readProjectContractSync } from "./project_contract.js";
-import { contractOrigins, isContractOrigin, isPlatformDefault, originMismatchError, PLATFORM_DEFAULT_ORIGIN, recordContractOrigin, refusedContractOrigin, } from "./origin_guard.js";
+import { contractOrigins, isContractOrigin, statedOrigins, isPlatformDefault, originMismatchError, originOf, PLATFORM_DEFAULT_ORIGIN, recordContractOrigin, refusedContractOrigin, } from "./origin_guard.js";
 const DEFAULT_NUSTACK_URL = PLATFORM_DEFAULT_ORIGIN;
 export { contractOrigins };
 const REQUEST_TIMEOUT_MS = 10_000;
@@ -11,12 +11,19 @@ export async function authorizedFetch(input, init = {}) {
     const headers = new Headers(init.headers);
     if (headers.has("Authorization"))
         await assertCredentialOrigin(String(input));
+    const sent = headers.get("Authorization")?.replace(/^Bearer\s+/i, "");
+    const minted = sent ? deviceTokenOrigin(sent) : null;
+    const isForeign = minted !== null && originOf(String(input)) !== originOf(minted);
+    if (isForeign && !statedOrigins.has(originOf(String(input))))
+        throw originMismatchError(originOf(String(input)), minted, "device");
     headers.set(DEVICE_HEADER, knownDeviceId() ?? (await getOrCreateDeviceId()));
     headers.set("User-Agent", userAgent());
     const response = await globalThis.fetch(input, { ...init, headers });
     const bearer = headers.get("Authorization")?.replace(/^Bearer\s+/i, "");
     if (response.status !== 401 || !bearer)
         return response;
+    if (isForeign)
+        return response;
     if (envToken())
         throw new TokenRefusedError();
     await forgetRefusedToken(bearer).catch(() => undefined);
@@ -39,10 +46,16 @@ export function errorMessage(payload, status, label, plane) {
     return enveloped ?? payload?.message ?? `${label}: HTTP ${status}`;
 }
 export function resolveNuStackOrigin(options, cwd) {
-    if (options.nustackUrl)
-        return { url: assertSafeNuStackUrl(options.nustackUrl), source: "flag" };
-    if (process.env.NUSTACK_URL)
-        return { url: assertSafeNuStackUrl(process.env.NUSTACK_URL), source: "env" };
+    if (options.nustackUrl) {
+        const url = assertSafeNuStackUrl(options.nustackUrl);
+        statedOrigins.add(originOf(url));
+        return { url, source: "flag" };
+    }
+    if (process.env.NUSTACK_URL) {
+        const url = assertSafeNuStackUrl(process.env.NUSTACK_URL);
+        statedOrigins.add(originOf(url));
+        return { url, source: "env" };
+    }
     const origin = readProjectContractSync(cwd).origin;
     if (origin) {
         const url = assertSafeNuStackUrl(origin);

package/dist/lib/origin_guard.js

@@ -1,6 +1,7 @@
 import { HarnessError, HARNESS_CODES } from "./harness/codes.js";
 export const PLATFORM_DEFAULT_ORIGIN = "https://apps.nustack.ai";
 export const contractOrigins = new Set();
+export const statedOrigins = new Set();
 export function originOf(url) {
     try {
         return new URL(url).origin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,