@playcraft/cli 0.1.29 → 0.1.30

package/dist/workspace-runtime/workspaces/git-credential-helper.js

@@ -0,0 +1,68 @@
+import { request } from 'node:http';
+// Git invokes this executable directly. Keep standard output exclusively for the credential protocol.
+const [socketPath, workspaceId, third, fourth] = process.argv.slice(2);
+const directoryName = fourth === undefined ? 'basic' : third;
+const action = fourth ?? third;
+try {
+    if (action === 'get' || action === 'erase') {
+        const fields = {};
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            size += chunk.length;
+            if (size > 16_384)
+                throw new Error();
+            chunks.push(Buffer.from(chunk));
+        }
+        for (const line of Buffer.concat(chunks).toString('utf8').split('\n')) {
+            if (!line)
+                break;
+            const separator = line.indexOf('=');
+            if (separator < 1)
+                throw new Error();
+            const key = line.slice(0, separator);
+            // Git may repeat extension fields such as capability[] and wwwauth[].
+            if (!['protocol', 'host', 'path', 'password'].includes(key))
+                continue;
+            if (key in fields)
+                throw new Error();
+            fields[key] = line.slice(separator + 1);
+        }
+        const credential = await new Promise((resolve, reject) => {
+            const client = request({ socketPath, path: '/credential', method: 'POST',
+                headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(12_000) }, async (response) => {
+                try {
+                    if (response.statusCode !== 200) {
+                        response.resume();
+                        throw new Error();
+                    }
+                    const parts = [];
+                    let length = 0;
+                    for await (const chunk of response) {
+                        length += chunk.length;
+                        if (length > 16_384)
+                            throw new Error();
+                        parts.push(Buffer.from(chunk));
+                    }
+                    resolve(JSON.parse(Buffer.concat(parts).toString('utf8')));
+                }
+                catch {
+                    reject(new Error());
+                }
+            });
+            client.once('error', reject);
+            client.end(JSON.stringify({ workspaceId, directoryName, action, protocol: fields.protocol, host: fields.host,
+                path: fields.path, ...(action === 'erase' ? { password: fields.password } : {}) }));
+        });
+        if (action === 'get') {
+            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
+                throw new Error();
+            process.stdout.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
+        }
+    }
+}
+catch {
+    if (action === 'get')
+        process.stdout.write('quit=true\n\n');
+    process.exitCode = 1;
+}

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -0,0 +1,155 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { join, resolve, sep } from 'node:path';
+import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema, workspaceDirectoryNameSchema, sameWorkspaceRegistration } from '@playcraft/common/cloud-workspace/runtime';
+/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
+export class WorkspaceGitDirectStore {
+    state;
+    mutation = Promise.resolve();
+    constructor(state) {
+        this.state = state;
+    }
+    exclusive(action) {
+        const result = this.mutation.then(action);
+        this.mutation = result.catch(() => undefined);
+        return result;
+    }
+    identity() {
+        const c = this.state.config;
+        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
+    }
+    name(id, directoryName = 'basic') {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('git_access_denied');
+        workspaceDirectoryNameSchema.parse(directoryName);
+        return `${id}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`;
+    }
+    async directory(create, action) {
+        const stateDir = resolve(this.state.config.stateDir);
+        const directory = join(stateDir, 'direct-git');
+        if (!create && !(await lstat(directory).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        })))
+            return undefined;
+        const root = await realpath(this.state.config.workspaceRoot);
+        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
+            throw new Error('git_control_directory_rejected');
+        }
+        for (const path of [stateDir, directory]) {
+            if (path === directory && create)
+                await mkdir(path, { mode: 0o700 }).catch(error => {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                });
+            const stat = await lstat(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
+                throw new Error('git_control_directory_rejected');
+            }
+        }
+        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
+            return await action(pinned);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async read(path) {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!handle)
+            return undefined;
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
+                throw new Error('git_credential_file_rejected');
+            }
+            return JSON.parse(await handle.readFile('utf8'));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async get(binding, directoryName = 'basic') {
+        return this.directory(false, async (path) => {
+            const stored = await this.read(join(path, this.name(binding.workspaceId, directoryName)));
+            if (!stored)
+                return undefined;
+            if (stored.identity !== this.identity() || !sameWorkspaceRegistration(stored.binding, binding)
+                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                throw new Error('git_access_denied');
+            if (stored.access !== null) {
+                const access = workspaceGitDirectAccessSchema.parse(stored.access);
+                if (access.repositoryUrl !== binding.repositoryUrl)
+                    throw new Error('git_access_denied');
+            }
+            return stored;
+        });
+    }
+    async put(binding, access, rejectedPassword, directoryName = 'basic') {
+        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
+            throw new Error('git_access_denied');
+        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
+            throw new Error('git_access_denied');
+        await this.exclusive(() => this.directory(true, async (path) => {
+            const target = join(path, this.name(binding.workspaceId, directoryName));
+            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
+            const old = await this.read(target);
+            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
+                return;
+            const temporary = join(path, `${randomUUID()}.tmp`);
+            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
+                await handle.sync();
+                await handle.close();
+                if (this.state.journal.destroyed())
+                    throw new Error('git_access_denied');
+                await rename(temporary, target);
+                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+                try {
+                    await dir.sync();
+                }
+                finally {
+                    await dir.close();
+                }
+            }
+            finally {
+                await handle.close();
+                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        }));
+    }
+    async remove(workspaceId, directoryName = 'basic') {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            const target = join(path, this.name(workspaceId, directoryName));
+            await this.read(target);
+            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
+                throw error; });
+        }));
+    }
+    async sweep(destroy = false) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            for (const name of await readdir(path)) {
+                if (!/^[a-f0-9-]{36}(?:--remix-[a-z0-9][a-z0-9-]{3,63})?\.(json|tmp)$/.test(name))
+                    throw new Error('git_credential_file_rejected');
+                const target = join(path, name);
+                if (name.endsWith('.tmp')) {
+                    await unlink(target);
+                    continue;
+                }
+                const stored = await this.read(target);
+                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                    await unlink(target);
+            }
+        }));
+    }
+}