@openparachute/hub 0.7.4 → 0.7.5-rc.2

package/src/hub-server.ts

@@ -239,6 +239,8 @@ import { CONFIG_DIR, SERVICES_MANIFEST_PATH } from "./config.ts";
 import { applyCorsHeaders, corsPreflightResponse, isCorsAllowedRoute } from "./cors.ts";
 import { ensureCsrfToken } from "./csrf.ts";
 import { readExposeState } from "./expose-state.ts";
+import { notifySurfacePushed } from "./git-notify.ts";
+import { handleGitTransport } from "./git-transport.ts";
 import { HUB_DEFAULT_PORT, HUB_SVC, clearHubPort, writeHubPort } from "./hub-control.ts";
 import {
   classifyDbError,
@@ -1212,6 +1214,12 @@ export interface HubFetchDeps {
    * the doc reflect `parachute vault create` etc. without re-running expose.
    */
   manifestPath?: string;
+  /**
+   * Directory holding the per-surface bare repos for the git-transport endpoint
+   * (`/git/<name>/*` → `<gitRoot>/<name>.git`). Tests point this at a tmpdir;
+   * production defaults to `<CONFIG_DIR>/hub/git`.
+   */
+  gitRoot?: string;
   /**
    * Path to `connections.json` (the Connections store, P5). Tests point this
    * at a tmpdir; production defaults to `<CONFIG_DIR>/connections.json`.
@@ -1983,6 +1991,7 @@ export function hubFetch(
   const getDb = deps?.getDb;
   const configuredIssuer = deps?.issuer;
   const manifestPath = deps?.manifestPath ?? SERVICES_MANIFEST_PATH;
+  const gitRoot = deps?.gitRoot ?? join(CONFIG_DIR, "hub", "git");
   const spaDistDir = deps?.spaDistDir ?? defaultSpaDistDir();
   const loopbackPort = deps?.loopbackPort;
   const loadExposeHubOrigin =
@@ -3801,6 +3810,39 @@ export function hubFetch(
         return serveSpa(spaDistDir, pathname, "/admin");
       }
 
+      // /git/<name>/* — hub-authenticated git smart-HTTP transport (Surface
+      // Git Transport, Phase 0a). Placed BEFORE the generic services.json
+      // proxy so a `/git/` route is never shadowed by a module mount. The
+      // endpoint is AUTH-gated, not LAYER-gated: it's reachable from any
+      // exposure layer because the hub JWT (validated against the multi-origin
+      // iss-set) is the gate. It NEVER builds or executes the pushed tree — the
+      // hub only receives + stores bytes (the RCE-bearing build is surface-host's
+      // sandboxed job, Phase 0b). See src/git-transport.ts.
+      if (pathname.startsWith("/git/")) {
+        if (!getDb) return new Response("not found", { status: 404 });
+        const db = getDb();
+        const issuer = oauthDeps(req).issuer;
+        return handleGitTransport(req, {
+          db,
+          gitRoot,
+          knownIssuers: () => oauthDeps(req).hubBoundOrigins(),
+          peerAddr,
+          // Deploy hand-off (Phase 0b §5 step 5): on a successful push, notify
+          // the surface module over HTTP + a hub JWT so it pulls + builds +
+          // serves. NEVER a shell-out that builds the pushed tree — the hub
+          // only sends the authenticated signal (git-notify.ts). Fire-and-
+          // forget; a notify failure is logged, never surfaced to the pusher.
+          onPushed: async (name) => {
+            await notifySurfacePushed(name, {
+              db,
+              issuer: issuer ?? `http://127.0.0.1:${loopbackPort ?? 1939}`,
+              resolveModuleOrigin: makeResolveModuleOrigin(manifestPath),
+              cloneBaseOrigin: `http://127.0.0.1:${loopbackPort ?? 1939}`,
+            });
+          },
+        });
+      }
+
       // Generic services.json-driven dispatch for non-vault modules. Reaches
       // here only after every hub-owned prefix above has had its turn — so
       // `/`, `/admin/*`, `/oauth/*`, `/.well-known/*`, `/hub/*`, `/vault/*`,

package/src/oauth-handlers.ts

@@ -425,6 +425,7 @@ function oauthErrorRedirect(
 const OPTIONAL_MODULE_SCOPES: ReadonlyArray<readonly [prefix: string, short: string]> = [
   ["scribe:", "scribe"],
   ["agent:", "agent"],
+  ["surface:", "surface"],
 ];
 
 /**

package/src/scope-explanations.ts

@@ -46,12 +46,13 @@ export const SCOPE_EXPLANATIONS: Record<string, ScopeExplanation> = {
       "Read and write everything, plus admin: config & settings, triggers & automation, GitHub backup, and minting access tokens.",
     level: "admin",
   },
-  // Optional-module scopes (scribe / agent). These are in FIRST_PARTY_SCOPES
-  // (= Object.keys(this map)) but the modules may not be installed — so they're
-  // GATED in `OPTIONAL_MODULE_SCOPES` (oauth-handlers.ts) and only advertised in
-  // `scopes_supported` when the service is in services.json. If you add scopes
-  // for another optional module here, add a matching gate there too, or a
-  // vault-only hub will over-advertise them (the bug behind hub#489).
+  // Optional-module scopes (scribe / agent / surface). These are in
+  // FIRST_PARTY_SCOPES (= Object.keys(this map)) but the modules may not be
+  // installed — so they're GATED in `OPTIONAL_MODULE_SCOPES` (oauth-handlers.ts)
+  // and only advertised in `scopes_supported` when the service is in
+  // services.json. If you add scopes for another optional module here, add a
+  // matching gate there too, or a vault-only hub will over-advertise them (the
+  // bug behind hub#489).
   "scribe:transcribe": {
     label: "Send audio to Scribe for transcription.",
     level: "write",
@@ -64,6 +65,20 @@ export const SCOPE_EXPLANATIONS: Record<string, ScopeExplanation> = {
     label: "Post messages to your Agent.",
     level: "send",
   },
+  // Surface Git Transport scopes (surface-host). `surface:read` = clone/fetch a
+  // surface's hub-hosted git repo; `surface:write` = push to it. Named forms
+  // (`surface:<name>:<verb>`) collapse to these via the 3→2-segment rule in
+  // `isKnownScope`. surface-host's module.json declares them too; listing them
+  // here makes them first-party (mintable + a consent label) even on a hub
+  // where surface-host isn't installed.
+  "surface:read": {
+    label: "Clone and fetch a surface's source (its hub-hosted git repo).",
+    level: "read",
+  },
+  "surface:write": {
+    label: "Push to a surface's source (its hub-hosted git repo).",
+    level: "write",
+  },
   "hub:admin": {
     label: "Manage hub identity (user accounts, signing keys, registered OAuth clients).",
     level: "admin",