@playcraft/cli 0.1.33 → 0.1.35-prod

package/dist/workspace-runtime/workspaces/git-credential-helper.js

@@ -1,68 +0,0 @@
-import { request } from 'node:http';
-// Git invokes this executable directly. Keep standard output exclusively for the credential protocol.
-const [socketPath, workspaceId, third, fourth] = process.argv.slice(2);
-const directoryName = fourth === undefined ? 'basic' : third;
-const action = fourth ?? third;
-try {
-    if (action === 'get' || action === 'erase') {
-        const fields = {};
-        const chunks = [];
-        let size = 0;
-        for await (const chunk of process.stdin) {
-            size += chunk.length;
-            if (size > 16_384)
-                throw new Error();
-            chunks.push(Buffer.from(chunk));
-        }
-        for (const line of Buffer.concat(chunks).toString('utf8').split('\n')) {
-            if (!line)
-                break;
-            const separator = line.indexOf('=');
-            if (separator < 1)
-                throw new Error();
-            const key = line.slice(0, separator);
-            // Git may repeat extension fields such as capability[] and wwwauth[].
-            if (!['protocol', 'host', 'path', 'password'].includes(key))
-                continue;
-            if (key in fields)
-                throw new Error();
-            fields[key] = line.slice(separator + 1);
-        }
-        const credential = await new Promise((resolve, reject) => {
-            const client = request({ socketPath, path: '/credential', method: 'POST',
-                headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(12_000) }, async (response) => {
-                try {
-                    if (response.statusCode !== 200) {
-                        response.resume();
-                        throw new Error();
-                    }
-                    const parts = [];
-                    let length = 0;
-                    for await (const chunk of response) {
-                        length += chunk.length;
-                        if (length > 16_384)
-                            throw new Error();
-                        parts.push(Buffer.from(chunk));
-                    }
-                    resolve(JSON.parse(Buffer.concat(parts).toString('utf8')));
-                }
-                catch {
-                    reject(new Error());
-                }
-            });
-            client.once('error', reject);
-            client.end(JSON.stringify({ workspaceId, directoryName, action, protocol: fields.protocol, host: fields.host,
-                path: fields.path, ...(action === 'erase' ? { password: fields.password } : {}) }));
-        });
-        if (action === 'get') {
-            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
-                throw new Error();
-            process.stdout.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
-        }
-    }
-}
-catch {
-    if (action === 'get')
-        process.stdout.write('quit=true\n\n');
-    process.exitCode = 1;
-}

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -1,155 +0,0 @@
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { join, resolve, sep } from 'node:path';
-import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema, workspaceDirectoryNameSchema, sameWorkspaceRegistration } from '@playcraft/common/cloud-workspace/runtime';
-/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
-export class WorkspaceGitDirectStore {
-    state;
-    mutation = Promise.resolve();
-    constructor(state) {
-        this.state = state;
-    }
-    exclusive(action) {
-        const result = this.mutation.then(action);
-        this.mutation = result.catch(() => undefined);
-        return result;
-    }
-    identity() {
-        const c = this.state.config;
-        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
-    }
-    name(id, directoryName = 'basic') {
-        if (!/^[a-f0-9-]{36}$/.test(id))
-            throw new Error('git_access_denied');
-        workspaceDirectoryNameSchema.parse(directoryName);
-        return `${id}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`;
-    }
-    async directory(create, action) {
-        const stateDir = resolve(this.state.config.stateDir);
-        const directory = join(stateDir, 'direct-git');
-        if (!create && !(await lstat(directory).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        })))
-            return undefined;
-        const root = await realpath(this.state.config.workspaceRoot);
-        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
-            throw new Error('git_control_directory_rejected');
-        }
-        for (const path of [stateDir, directory]) {
-            if (path === directory && create)
-                await mkdir(path, { mode: 0o700 }).catch(error => {
-                    if (error.code !== 'EEXIST')
-                        throw error;
-                });
-            const stat = await lstat(path);
-            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
-                throw new Error('git_control_directory_rejected');
-            }
-        }
-        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-        try {
-            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
-            return await action(pinned);
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async read(path) {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!handle)
-            return undefined;
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
-                throw new Error('git_credential_file_rejected');
-            }
-            return JSON.parse(await handle.readFile('utf8'));
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async get(binding, directoryName = 'basic') {
-        return this.directory(false, async (path) => {
-            const stored = await this.read(join(path, this.name(binding.workspaceId, directoryName)));
-            if (!stored)
-                return undefined;
-            if (stored.identity !== this.identity() || !sameWorkspaceRegistration(stored.binding, binding)
-                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                throw new Error('git_access_denied');
-            if (stored.access !== null) {
-                const access = workspaceGitDirectAccessSchema.parse(stored.access);
-                if (access.repositoryUrl !== binding.repositoryUrl)
-                    throw new Error('git_access_denied');
-            }
-            return stored;
-        });
-    }
-    async put(binding, access, rejectedPassword, directoryName = 'basic') {
-        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
-            throw new Error('git_access_denied');
-        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
-            throw new Error('git_access_denied');
-        await this.exclusive(() => this.directory(true, async (path) => {
-            const target = join(path, this.name(binding.workspaceId, directoryName));
-            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
-            const old = await this.read(target);
-            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
-                return;
-            const temporary = join(path, `${randomUUID()}.tmp`);
-            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-            try {
-                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
-                await handle.sync();
-                await handle.close();
-                if (this.state.journal.destroyed())
-                    throw new Error('git_access_denied');
-                await rename(temporary, target);
-                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
-                try {
-                    await dir.sync();
-                }
-                finally {
-                    await dir.close();
-                }
-            }
-            finally {
-                await handle.close();
-                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
-                    throw error; });
-            }
-        }));
-    }
-    async remove(workspaceId, directoryName = 'basic') {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            const target = join(path, this.name(workspaceId, directoryName));
-            await this.read(target);
-            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
-                throw error; });
-        }));
-    }
-    async sweep(destroy = false) {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            for (const name of await readdir(path)) {
-                if (!/^[a-f0-9-]{36}(?:--remix-[a-z0-9][a-z0-9-]{3,63})?\.(json|tmp)$/.test(name))
-                    throw new Error('git_credential_file_rejected');
-                const target = join(path, name);
-                if (name.endsWith('.tmp')) {
-                    await unlink(target);
-                    continue;
-                }
-                const stored = await this.read(target);
-                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                    await unlink(target);
-            }
-        }));
-    }
-}