@playcraft/cli 0.1.0 → 0.1.2

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -0,0 +1,276 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { chmod, chown, lstat, unlink, open, mkdir, mkdtemp, writeFile, readFile, rename, rm } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { WorkspaceGitDirectStore } from './git-direct-store.js';
+const exec = promisify(execFile);
+/** Only this control process sees the callback credential. Development processes use the local socket. */
+export class WorkspaceGitCredentialBroker {
+    state;
+    socketPath;
+    server;
+    closed = false;
+    ready = false;
+    cache = new Map();
+    pending = new Map();
+    direct;
+    constructor(state) {
+        this.state = state;
+        this.direct = new WorkspaceGitDirectStore(state);
+        const id = createHash('sha256').update(state.config.stateDir).digest('hex').slice(0, 24);
+        this.socketPath = `/tmp/playcraft-git-${id}.sock`;
+    }
+    async start() {
+        await this.direct.sweep(this.state.journal.destroyed());
+        const old = await lstat(this.socketPath).catch(error => {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return undefined;
+        });
+        if (old) {
+            if (!old.isSocket() || old.uid !== process.getuid?.())
+                throw new Error('git_broker_socket_conflict');
+            await unlink(this.socketPath);
+        }
+        const server = this.server = createServer({ maxHeaderSize: 2048, requestTimeout: 10_000 }, async (request, response) => {
+            try {
+                if (request.method !== 'POST' || request.url !== '/credential')
+                    throw new Error();
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of request) {
+                    size += chunk.length;
+                    if (size > 16_384)
+                        throw new Error();
+                    chunks.push(Buffer.from(chunk));
+                }
+                const result = await this.credential(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+                response.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+                response.end(JSON.stringify(result));
+            }
+            catch {
+                response.writeHead(403, { 'cache-control': 'no-store', connection: 'close' });
+                response.end();
+            }
+        });
+        server.maxConnections = 32;
+        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(this.socketPath, resolve); });
+        // The workspace group is the image's development group; other system users cannot connect.
+        const directory = await lstat(this.state.config.workspaceRoot);
+        await chown(this.socketPath, process.getuid(), directory.gid);
+        await chmod(this.socketPath, 0o660);
+        this.ready = true;
+    }
+    async close() {
+        this.closed = true;
+        this.cache.clear();
+        if (this.server?.listening) {
+            this.server.closeAllConnections();
+            await new Promise(resolve => this.server.close(() => resolve()));
+            await unlink(this.socketPath).catch(() => undefined);
+        }
+    }
+    async configure(binding, preparation) {
+        preparation = workspacePreparationSchema.parse(preparation);
+        const transport = preparation.transport;
+        const isDirect = isLocalWorkspaceGitAuthMode(preparation.authMode);
+        if (!isDirect && transport?.kind !== 'git-gateway-v2')
+            return;
+        if (isDirect) {
+            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || (preparation.directAccess && preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
+                throw new Error('git_access_denied');
+        }
+        else {
+            const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+            if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
+                throw new Error('workspace_git_gateway_unavailable');
+        }
+        // Revocation and switching to gateway invalidate first; direct rotation keeps the old file until rename.
+        if (!isDirect)
+            await this.direct.remove(binding.workspaceId);
+        else if (preparation.directAccess === null)
+            await this.direct.put(binding, null);
+        this.cache.delete(binding.workspaceId);
+        const cloneUrl = isDirect ? binding.repositoryUrl : transport.cloneUrl;
+        const root = join(this.state.config.workspaceRoot, binding.workspaceId);
+        const helper = `!${quote(process.execPath)} ${quote(fileURLToPath(new URL('./git-credential-helper.js', import.meta.url)))} ${quote(this.socketPath)} ${quote(binding.workspaceId)}`;
+        await configureGitFile(root, this.state.config.stateDir, [
+            ...(!isDirect ? [['--replace-all', `url.${cloneUrl}.insteadOf`, binding.repositoryUrl]] : []),
+            ['--replace-all', `credential.${cloneUrl}.useHttpPath`, 'true'],
+            ['--replace-all', `credential.${cloneUrl}.helper`, ''],
+            ['--add', `credential.${cloneUrl}.helper`, helper],
+            ['--replace-all', `http.${cloneUrl}.followRedirects`, 'false'],
+            ['--replace-all', 'playcraft.gitAuthUrl', cloneUrl],
+        ], binding.repositoryUrl);
+        if (isDirect)
+            await this.direct.put(binding, preparation.directAccess);
+        this.cache.delete(binding.workspaceId);
+    }
+    async credential(input) {
+        if (!this.ready || this.closed || this.state.journal.destroyed() || !input || !['get', 'erase'].includes(input.action)
+            || typeof input.workspaceId !== 'string' || !/^[a-f0-9-]{36}$/.test(input.workspaceId)
+            || !['http', 'https'].includes(input.protocol) || typeof input.host !== 'string'
+            || typeof input.path !== 'string')
+            throw new Error('git_access_denied');
+        const binding = this.state.journal.getWorkspace(input.workspaceId);
+        if (!binding)
+            throw new Error('git_access_denied');
+        const cloneUrl = `${input.protocol}://${input.host}/${input.path}`;
+        const direct = await this.direct.get(binding);
+        if (direct) {
+            if (!direct.access || cloneUrl !== binding.repositoryUrl)
+                throw new Error('git_access_denied');
+            if (input.action === 'erase') {
+                if (input.password === direct.access.password)
+                    await this.direct.put(binding, null, input.password);
+                return {};
+            }
+            return { username: direct.access.username, password: direct.access.password };
+        }
+        const matched = matchWorkspaceGitGatewayCloneUrl(cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
+            throw new Error('git_access_denied');
+        if (input.action === 'erase') {
+            if (this.cache.get(input.workspaceId)?.preparation.gitAccess?.password === input.password)
+                this.cache.delete(input.workspaceId);
+            return {};
+        }
+        const key = JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]);
+        const cached = this.cache.get(input.workspaceId);
+        let preparation = cached?.key === key && Date.parse(cached.preparation.gitAccess.expiresAt) > Date.now() + 60_000
+            ? cached.preparation : undefined;
+        if (!preparation) {
+            const pendingKey = `${input.workspaceId}:${key}`;
+            let pending = this.pending.get(pendingKey);
+            if (!pending) {
+                pending = this.refresh(binding, key).finally(() => this.pending.delete(pendingKey));
+                this.pending.set(pendingKey, pending);
+            }
+            preparation = await pending;
+        }
+        if (await this.direct.get(binding) || preparation.transport?.cloneUrl !== cloneUrl || !preparation.gitAccess)
+            throw new Error('git_access_denied');
+        return { username: preparation.gitAccess.username, password: preparation.gitAccess.password };
+    }
+    async destroy() {
+        await this.close();
+        await this.direct.sweep(true);
+    }
+    async refresh(binding, key) {
+        const endpoint = new URL('/runtime/internal/git-credentials', this.state.config.callbackUrl);
+        if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
+            throw new Error('git_broker_unavailable');
+        const epoch = this.state.runtimeEpoch;
+        const response = await fetch(endpoint, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+            headers: { authorization: `Bearer ${this.state.config.controlToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ runtimeId: this.state.config.runtimeId, generation: this.state.config.generation,
+                runtimeEpoch: epoch, workspaceId: binding.workspaceId }),
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error('git_broker_unavailable');
+        }
+        const preparation = workspacePreparationSchema.parse(await response.json());
+        const matched = preparation.transport && matchWorkspaceGitGatewayCloneUrl(preparation.transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (this.closed || this.state.journal.destroyed() || this.state.runtimeEpoch !== epoch
+            || JSON.stringify(this.state.journal.getWorkspace(binding.workspaceId)) !== JSON.stringify(binding)
+            || preparation.transport?.kind !== 'git-gateway-v2' || !matched?.ok || matched.requestId !== `v2/${binding.workspaceId}`
+            || !preparation.gitAccess || Date.parse(preparation.gitAccess.issuedAt) > Date.now()
+            || Date.parse(preparation.gitAccess.expiresAt) <= Date.now() + 10_000)
+            throw new Error('git_access_denied');
+        if (this.cache.size >= 128)
+            this.cache.clear();
+        this.cache.set(binding.workspaceId, { key, preparation });
+        return preparation;
+    }
+}
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+/** Pin directories in Linux sandboxes and replace config atomically without following user-owned symlinks. */
+async function configureGitFile(root, stateDir, commands, repositoryUrl) {
+    const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+    const directory = await open(root, directoryFlags);
+    const pinnedRoot = process.platform === 'linux' ? `/proc/self/fd/${directory.fd}` : root;
+    let gitDirectory;
+    let lock;
+    let temporary;
+    let lockPath;
+    try {
+        gitDirectory = await open(join(pinnedRoot, '.git'), directoryFlags);
+        const gitPath = process.platform === 'linux' ? `/proc/self/fd/${gitDirectory.fd}` : join(root, '.git');
+        const configPath = join(gitPath, 'config');
+        lock = await open(join(gitPath, 'config.lock'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o640);
+        lockPath = join(gitPath, 'config.lock');
+        const source = await open(configPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let content;
+        try {
+            const stat = await source.stat();
+            if (!stat.isFile() || stat.size > 1024 * 1024 || stat.nlink !== 1)
+                throw new Error('invalid_git_config');
+            content = await source.readFile('utf8');
+            await lock.chmod(stat.mode & 0o666);
+        }
+        finally {
+            await source.close();
+        }
+        await mkdir(stateDir, { recursive: true, mode: 0o700 });
+        temporary = await mkdtemp(join(stateDir, 'git-config-'));
+        const staging = join(temporary, 'config');
+        await writeFile(staging, content, { mode: 0o600 });
+        await clearManagedGitConfig(staging, repositoryUrl);
+        for (const args of commands)
+            await exec('git', ['config', '--file', staging, '--no-includes', ...args], {
+                timeout: 5000, maxBuffer: 8192, env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+            });
+        await lock.writeFile(await readFile(staging));
+        await lock.sync();
+        await lock.close();
+        lock = undefined;
+        await rename(lockPath, configPath);
+        lockPath = undefined;
+    }
+    finally {
+        await lock?.close();
+        if (lockPath)
+            await unlink(lockPath).catch(() => undefined);
+        if (temporary)
+            await rm(temporary, { recursive: true, force: true });
+        await gitDirectory?.close();
+        await directory.close();
+    }
+}
+/** Only remove authentication/routing for this binding and previous PlayCraft endpoints. */
+async function clearManagedGitConfig(file, repositoryUrl) {
+    const run = (...args) => exec('git', ['config', '--file', file, '--no-includes', ...args], {
+        timeout: 5000, maxBuffer: 1024 * 1024,
+        env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+    });
+    const entries = (await run('--null', '--list')).stdout.split('\0').filter(Boolean).map(entry => {
+        const newline = entry.indexOf('\n');
+        return [entry.slice(0, newline), entry.slice(newline + 1)];
+    });
+    const urls = new Set([repositoryUrl]);
+    const remove = new Set();
+    for (const [key, value] of entries) {
+        if (key === 'playcraft.gitauthurl')
+            urls.add(value);
+        const rewrite = /^url\.(.+)\.(?:insteadof|pushinsteadof)$/.exec(key);
+        if (rewrite && value === repositoryUrl) {
+            urls.add(rewrite[1]);
+            remove.add(key);
+        }
+    }
+    for (const [key] of entries) {
+        for (const url of urls) {
+            if (key.startsWith(`credential.${url}.`) || key.startsWith(`http.${url}.`))
+                remove.add(key);
+        }
+    }
+    for (const key of remove)
+        await run('--unset-all', key);
+}

package/dist/workspace-runtime/workspaces/git-credential-helper.js

@@ -0,0 +1,66 @@
+import { request } from 'node:http';
+// Git invokes this executable directly. Keep standard output exclusively for the credential protocol.
+const [socketPath, workspaceId, action] = process.argv.slice(2);
+try {
+    if (action === 'get' || action === 'erase') {
+        const fields = {};
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            size += chunk.length;
+            if (size > 16_384)
+                throw new Error();
+            chunks.push(Buffer.from(chunk));
+        }
+        for (const line of Buffer.concat(chunks).toString('utf8').split('\n')) {
+            if (!line)
+                break;
+            const separator = line.indexOf('=');
+            if (separator < 1)
+                throw new Error();
+            const key = line.slice(0, separator);
+            // Git may repeat extension fields such as capability[] and wwwauth[].
+            if (!['protocol', 'host', 'path', 'password'].includes(key))
+                continue;
+            if (key in fields)
+                throw new Error();
+            fields[key] = line.slice(separator + 1);
+        }
+        const credential = await new Promise((resolve, reject) => {
+            const client = request({ socketPath, path: '/credential', method: 'POST',
+                headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(12_000) }, async (response) => {
+                try {
+                    if (response.statusCode !== 200) {
+                        response.resume();
+                        throw new Error();
+                    }
+                    const parts = [];
+                    let length = 0;
+                    for await (const chunk of response) {
+                        length += chunk.length;
+                        if (length > 16_384)
+                            throw new Error();
+                        parts.push(Buffer.from(chunk));
+                    }
+                    resolve(JSON.parse(Buffer.concat(parts).toString('utf8')));
+                }
+                catch {
+                    reject(new Error());
+                }
+            });
+            client.once('error', reject);
+            client.end(JSON.stringify({ workspaceId, action, protocol: fields.protocol, host: fields.host,
+                path: fields.path, ...(action === 'erase' ? { password: fields.password } : {}) }));
+        });
+        if (action === 'get') {
+            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
+                throw new Error();
+            process.stdout.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
+        }
+    }
+}
+catch {
+    if (action === 'get')
+        process.stdout.write('quit=true\n\n');
+    process.exitCode = 1;
+}

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -0,0 +1,154 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { join, resolve, sep } from 'node:path';
+import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema } from '@playcraft/common/cloud-workspace/runtime';
+/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
+export class WorkspaceGitDirectStore {
+    state;
+    mutation = Promise.resolve();
+    constructor(state) {
+        this.state = state;
+    }
+    exclusive(action) {
+        const result = this.mutation.then(action);
+        this.mutation = result.catch(() => undefined);
+        return result;
+    }
+    identity() {
+        const c = this.state.config;
+        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
+    }
+    name(id) {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('git_access_denied');
+        return `${id}.json`;
+    }
+    async directory(create, action) {
+        const stateDir = resolve(this.state.config.stateDir);
+        const directory = join(stateDir, 'direct-git');
+        if (!create && !(await lstat(directory).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        })))
+            return undefined;
+        const root = await realpath(this.state.config.workspaceRoot);
+        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
+            throw new Error('git_control_directory_rejected');
+        }
+        for (const path of [stateDir, directory]) {
+            if (path === directory && create)
+                await mkdir(path, { mode: 0o700 }).catch(error => {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                });
+            const stat = await lstat(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
+                throw new Error('git_control_directory_rejected');
+            }
+        }
+        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
+            return await action(pinned);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async read(path) {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!handle)
+            return undefined;
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
+                throw new Error('git_credential_file_rejected');
+            }
+            return JSON.parse(await handle.readFile('utf8'));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async get(binding) {
+        return this.directory(false, async (path) => {
+            const stored = await this.read(join(path, this.name(binding.workspaceId)));
+            if (!stored)
+                return undefined;
+            if (stored.identity !== this.identity() || JSON.stringify(stored.binding) !== JSON.stringify(binding)
+                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                throw new Error('git_access_denied');
+            if (stored.access !== null) {
+                const access = workspaceGitDirectAccessSchema.parse(stored.access);
+                if (access.repositoryUrl !== binding.repositoryUrl)
+                    throw new Error('git_access_denied');
+            }
+            return stored;
+        });
+    }
+    async put(binding, access, rejectedPassword) {
+        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
+            throw new Error('git_access_denied');
+        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
+            throw new Error('git_access_denied');
+        await this.exclusive(() => this.directory(true, async (path) => {
+            const target = join(path, this.name(binding.workspaceId));
+            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
+            const old = await this.read(target);
+            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
+                return;
+            const temporary = join(path, `${randomUUID()}.tmp`);
+            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
+                await handle.sync();
+                await handle.close();
+                if (this.state.journal.destroyed())
+                    throw new Error('git_access_denied');
+                await rename(temporary, target);
+                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+                try {
+                    await dir.sync();
+                }
+                finally {
+                    await dir.close();
+                }
+            }
+            finally {
+                await handle.close();
+                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        }));
+    }
+    async remove(workspaceId) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            const target = join(path, this.name(workspaceId));
+            await this.read(target);
+            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
+                throw error; });
+        }));
+    }
+    async sweep(destroy = false) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            for (const name of await readdir(path)) {
+                if (!/^[a-f0-9-]{36}\.(json|tmp)$/.test(name))
+                    throw new Error('git_credential_file_rejected');
+                const target = join(path, name);
+                if (name.endsWith('.tmp')) {
+                    await unlink(target);
+                    continue;
+                }
+                const stored = await this.read(target);
+                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                    await unlink(target);
+            }
+        }));
+    }
+}

package/dist/workspace-runtime/workspaces/git.js

@@ -116,10 +116,23 @@ export async function pushWorkspaceGit(root) {
     if (origin.code !== 0) {
         throw new GitWorkspaceError('remote_not_configured', 'origin');
     }
-    const pushed = await gitAllowFail(rootReal, ['push', 'origin', 'HEAD'], 20000);
-    if (pushed.code !== 0) {
-        throw new GitWorkspaceError('git_command_failed', pushed.stderr.trim() || 'git_push_failed');
+    const ref = (await git(rootReal, ['symbolic-ref', '--quiet', 'HEAD'])).trim();
+    if (!ref.startsWith('refs/heads/'))
+        throw new GitWorkspaceError('git_command_failed', 'git_branch_required');
+    const commit = (await git(rootReal, ['rev-parse', '--verify', 'HEAD^{commit}'])).trim();
+    try {
+        const pushed = await gitAllowFail(rootReal, ['push', '--porcelain', 'origin', `${commit}:${ref}`], 90000);
+        if (pushed.code === 0)
+            return;
+    }
+    catch { /* A lost response does not prove the remote rejected the update. */ }
+    try {
+        const remote = await gitAllowFail(rootReal, ['ls-remote', '--refs', 'origin', ref], 20000);
+        if (remote.code === 0 && remote.stdout.trim() === `${commit}\t${ref}`)
+            return;
     }
+    catch { /* Preserve uncertainty; never replay a write automatically. */ }
+    throw new GitWorkspaceError('git_push_outcome_unknown', 'git_push_outcome_unknown');
 }
 export async function ensureWorkspaceGit(root) {
     const rootReal = await realpath(root);