@polderlabs/bizar 3.23.1 → 4.2.0

package/bizar-dash/src/server/lib/path-safe.mjs

@@ -0,0 +1,283 @@
+/**
+ * src/server/lib/path-safe.mjs
+ *
+ * Helpers for the file-browser / scan endpoints that need to accept
+ * an arbitrary absolute path from the authenticated client and decide
+ * whether it is safe to operate on.
+ *
+ * The dashboard runs on a developer's machine, so the boundary here
+ * is the user's home directory. Any path outside `os.homedir()` (and
+ * any explicitly-listed additional allowed root, validated by the
+ * caller) is rejected before we ever call `fs` on it.
+ *
+ * No `..` traversal escapes — `path.resolve` normalizes first, then
+ * we check the resolved string against the allow-list.
+ */
+import { resolve as pathResolve, sep, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+
+/**
+ * Normalize an arbitrary list of root paths and dedupe them. Empty /
+ * non-string entries are dropped silently so callers can pass
+ * `readSettings().dashboard.projectsDirectory` directly.
+ *
+ * @param {Array<string | null | undefined>} roots
+ * @returns {string[]}
+ */
+function normalizeRoots(roots) {
+  const out = [];
+  const seen = new Set();
+  for (const raw of roots) {
+    if (typeof raw !== 'string') continue;
+    const trimmed = raw.trim();
+    if (!trimmed) continue;
+    const resolved = pathResolve(trimmed);
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    out.push(resolved);
+  }
+  return out;
+}
+
+/**
+ * Build the default allow-list: the user's home plus any explicit
+ * extra roots. The caller is expected to validate the extras against
+ * home before calling this (we don't try to be clever about Windows
+ * reparse points, symlinks, etc. — this is a developer-tool boundary,
+ * not a chroot).
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.home]           — override for `os.homedir()`
+ * @param {Array<string>} [opts.extras]  — additional absolute roots (already resolved)
+ * @returns {string[]}
+ */
+export function defaultAllowedRoots({ home, extras } = {}) {
+  return normalizeRoots([home || homedir(), ...(extras || [])]);
+}
+
+/**
+ * Build the per-request allow-list straight from a settings object.
+ * Each configured entry is re-validated against home; entries that
+ * fail validation (escape home, empty, non-string, NUL/backslash,
+ * …) are silently dropped. The intent is to survive a tampered
+ * settings.json: the writer (`validateDashboardSettings`) catches
+ * the bad values, but the reader has to be robust against anything
+ * on disk.
+ *
+ * Includes both:
+ *   - `dashboard.allowedRoots[]` (operator-declared extras)
+ *   - `dashboard.projectsDirectory` (single legacy extra)
+ *
+ * @param {object} opts
+ * @param {Record<string, unknown> | null | undefined} opts.settings
+ * @param {string} [opts.home]             — override for `os.homedir()`
+ * @returns {string[]}
+ */
+export function buildAllowedRootsFromSettings({ settings, home } = {}) {
+  const homeResolved = home || homedir();
+  const extras = [];
+  const configured = settings?.dashboard?.allowedRoots;
+  if (Array.isArray(configured)) {
+    for (const candidate of configured) {
+      if (typeof candidate !== 'string' || !candidate.trim()) continue;
+      const safe = resolveSafePath(candidate, [homeResolved]);
+      if (safe) extras.push(safe);
+      // Silently skip entries that fail validation. The Settings UI
+      // (frontend) is responsible for surfacing a warning when a
+      // user-typed root is silently dropped.
+    }
+  }
+  const proj = settings?.dashboard?.projectsDirectory;
+  if (typeof proj === 'string' && proj.trim()) {
+    const safe = resolveSafePath(proj, [homeResolved]);
+    if (safe) extras.push(safe);
+  }
+  return defaultAllowedRoots({ home: homeResolved, extras });
+}
+
+/**
+ * Resolve and authorize a requested absolute path against an
+ * allow-list of roots.
+ *
+ * Rules:
+ *   - The input must be a non-empty string.
+ *   - The path is `path.resolve()`d — `..` segments collapse.
+ *   - The resolved path must be `===` to one of the allowed roots,
+ *     OR live strictly beneath it (segment-aware — `pathA` does NOT
+ *     count as "inside" `pathB` if `pathB` is just a prefix string).
+ *   - Dotfile / dotdir roots (e.g. `~/.ssh`, `~/.aws`) are rejected
+ *     even when they live under home. The frontend can still SEE them
+ *     in listings (so users know the directory exists) but cannot
+ *     enter them via the browser.
+ *
+ * Returns `null` on any failure. The caller is expected to translate
+ * `null` into a 403 with a clear message.
+ *
+ * @param {unknown} requestedPath
+ * @param {string[]} allowedRoots
+ * @returns {string | null}
+ */
+export function resolveSafePath(requestedPath, allowedRoots) {
+  if (typeof requestedPath !== 'string') return null;
+  const trimmed = requestedPath.trim();
+  if (!trimmed) return null;
+  const resolved = pathResolve(trimmed);
+
+  const roots = Array.isArray(allowedRoots) ? allowedRoots : [];
+  for (const root of roots) {
+    if (typeof root !== 'string' || !root) continue;
+    const resolvedRoot = pathResolve(root);
+    if (resolved === resolvedRoot) {
+      if (isDotRoot(resolved)) return null;
+      return resolved;
+    }
+    // Strict segment-aware prefix: ensure a separator boundary so
+    // `/home/user/foo` is NOT considered inside `/home/user/foobar`.
+    const rootWithSep = resolvedRoot.endsWith(sep)
+      ? resolvedRoot
+      : resolvedRoot + sep;
+    if (resolved.startsWith(rootWithSep)) {
+      if (isDotRoot(resolved)) return null;
+      return resolved;
+    }
+  }
+  return null;
+}
+
+/**
+ * Return `true` if the path is (or lives directly inside) a dotdir
+ * at the home root. We deliberately do NOT match deeper dotdirs
+ * (`/home/user/projects/.secret` is fine to enter) — only the ones
+ * at the top of the home tree are treated as sensitive.
+ *
+ * @param {string} resolvedPath
+ * @param {string} [home]
+ * @returns {boolean}
+ */
+export function isDotRoot(resolvedPath, home = homedir()) {
+  if (typeof resolvedPath !== 'string') return false;
+  const homeRoot = pathResolve(home);
+  const homeWithSep = homeRoot.endsWith(sep) ? homeRoot : homeRoot + sep;
+  if (resolvedPath === homeRoot) return false;
+  if (!resolvedPath.startsWith(homeWithSep)) return false;
+  const tail = resolvedPath.slice(homeWithSep.length);
+  if (!tail) return false;
+  // Only first-level dotdirs under home are blocked.
+  const first = tail.split(sep)[0];
+  return first.startsWith('.') && first.length > 1;
+}
+
+// --- Background-agent logPath reconstruction ------------------------------
+//
+// The plugin's `bgr_<id>.json` state files include a `logPath` field
+// built as `${worktree}/.opencode/log/${id}.log`. If `worktree` was
+// empty or `/` when the bg instance was spawned, the resulting
+// `logPath` is broken (e.g. `//.opencode/log/...`) and no log file
+// can ever be written. The bg-retry loop calls into this helper to
+// repair the field before re-dispatching.
+//
+// `deriveAbsoluteBgLogPath(worktree, instanceId)` always returns an
+// absolute path. It falls back to the user's home directory when
+// `worktree` is missing or non-absolute. Never throws — a bad input
+// produces a synthetic `~/.cache/bizar/logs/<id>.log` rather than
+// crashing the retry loop.
+//
+// v3.11.1 — Note on log path correctness:
+//   The plugin's `LogWriter` (plugins/bizar/src/report.ts:147) writes
+//   to `${logDir}/${sessionId}.log` where `logDir` defaults to
+//   `~/.cache/bizar/logs` (plugins/bizar/src/options.ts:88). The
+//   bg-spawn tool records a DIFFERENT path —
+//   `${worktree}/.opencode/log/${instanceId}.log` — in the state
+//   file. Nothing ever writes to that path. This module's
+//   `deriveAbsoluteBgLogPath` historically returned the same broken
+//   path; the new `getActualBgLogPath` below returns the path the
+//   LogWriter actually writes to. Use that for any operator-facing
+//   `tail -F` (e.g. the tmux wrap in task-delegator.mjs).
+
+const FALLBACK_LOG_DIR = pathResolve(homedir(), '.cache', 'bizar', 'logs');
+
+/**
+ * Resolve the per-session log directory used by the plugin's
+ * `LogWriter`. The plugin's default is `~/.cache/bizar/logs`
+ * (configurable via the `logDir` option in `opencode.json`). We
+ * honor the `BIZAR_LOG_DIR` env var first, fall back to the
+ * plugin's default, and never throw.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.env]  — env-var bag to read (defaults to process.env)
+ * @returns {string}
+ */
+export function getBgLogDir({ env } = {}) {
+  const source = env || process.env;
+  const fromEnv = source?.BIZAR_LOG_DIR;
+  if (typeof fromEnv === 'string' && fromEnv.trim()) {
+    const resolved = pathResolve(fromEnv);
+    return resolved;
+  }
+  return FALLBACK_LOG_DIR;
+}
+
+/**
+ * Resolve the per-session log path the plugin's `LogWriter` actually
+ * writes to. Use this for any operator-facing `tail -F` so the user
+ * sees real activity rather than a phantom-file error.
+ *
+ * Important: the LogWriter keys files by SESSION id (not instance
+ * id). When you only have an `instanceId` (e.g. `bg_<sessionId16>`),
+ * pass it as `sessionId` — the function will accept any non-empty
+ * string and sanitize it.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.sessionId]  — the opencode session id (or any unique key)
+ * @param {string} [opts.env]        — env-var bag to read
+ * @returns {string} absolute path that exists or will exist once the plugin writes
+ */
+export function getActualBgLogPath({ sessionId, env } = {}) {
+  const safeId = typeof sessionId === 'string' && sessionId.length > 0
+    ? sessionId.replace(/[^a-zA-Z0-9_.-]/g, '_')
+    : `unknown_${randomBytes(4).toString('hex')}`;
+  return pathResolve(getBgLogDir({ env }), `${safeId}.log`);
+}
+
+/**
+ * @param {unknown} worktree
+ * @param {string} instanceId
+ * @returns {string}
+ */
+export function deriveAbsoluteBgLogPath(worktree, instanceId) {
+  const safeId = typeof instanceId === 'string' && instanceId.length > 0
+    ? instanceId.replace(/[^a-zA-Z0-9_.-]/g, '_')
+    : `unknown_${randomBytes(4).toString('hex')}`;
+  const base = typeof worktree === 'string' && worktree.length > 0 && isAbsolute(worktree)
+    ? pathResolve(worktree)
+    : FALLBACK_LOG_DIR;
+  return pathResolve(base, '.opencode', 'log', `${safeId}.log`);
+}
+
+/**
+ * Decide whether a `logPath` value stored on a bg instance needs to
+ * be repaired. A path is considered broken when it is:
+ *   - not a string
+ *   - empty
+ *   - not absolute
+ *   - contains a literal double-slash sequence (`//` outside of the
+ *     protocol prefix) — a tell-tale sign of `${empty}/${...}`
+ *     concatenation
+ *
+ * @param {unknown} logPath
+ * @returns {boolean}
+ */
+export function isBrokenBgLogPath(logPath) {
+  if (typeof logPath !== 'string' || logPath.length === 0) return true;
+  if (!isAbsolute(logPath)) return true;
+  // Look for `//` not at the protocol position. Cheap heuristic that
+  // catches the user's `//.opencode/log/...` case without requiring
+  // a full URL parser.
+  const idx = logPath.indexOf('//');
+  if (idx === -1) return false;
+  // Allow a leading `//` only on Windows-style UNC paths like `\\server\share`.
+  // On POSIX, a leading `/` followed by another `/` is always broken.
+  if (idx === 0) return true;
+  return false;
+}

package/bizar-dash/src/server/memory-git.mjs

@@ -0,0 +1,329 @@
+/**
+ * src/server/memory-git.mjs
+ *
+ * Thin wrapper around the `git` binary for the Bizar Memory Service.
+ * All operations use `child_process.execFileSync` with array args — never
+ * string interpolation — to prevent injection vulnerabilities.
+ *
+ * Operations: isGitInstalled, clone, pull, commit, push, status, acquireLock,
+ * addFile, addAll.
+ */
+
+import { execFileSync, execSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * @returns {boolean} true if `git --version` exits 0.
+ */
+export function isGitInstalled() {
+  try {
+    execFileSync('git', ['--version'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Clone a remote repository.
+ *
+ * @param {string} remote — URL or file path of the remote to clone
+ * @param {string} targetDir — absolute path to clone into
+ * @param {{ branch?: string, depth?: number }} [opts]
+ * @returns {{ ok: boolean, output: string, error?: string }}
+ */
+export function clone(remote, targetDir, { branch = 'main', depth = 1 } = {}) {
+  try {
+    const args = ['clone', '--branch', branch, '--depth', String(depth), remote, targetDir];
+    const output = execFileSync('git', args, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: true, output };
+  } catch (err) {
+    return { ok: false, output: '', error: err.message };
+  }
+}
+
+/**
+ * Pull changes into a local working directory.
+ *
+ * @param {string} dir — working directory (must be a git repo)
+ * @param {{ rebase?: boolean }} [opts]
+ * @returns {{ ok: boolean, output: string, error?: string }}
+ */
+export function pull(dir, { rebase = true } = {}) {
+  try {
+    const args = rebase ? ['pull', '--rebase'] : ['pull', '--ff-only'];
+    const output = execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: true, output };
+  } catch (err) {
+    return { ok: false, output: '', error: err.message };
+  }
+}
+
+/**
+ * Commit staged changes.
+ *
+ * @param {string} dir — working directory
+ * @param {string} message — commit message
+ * @param {{ author?: string }} [opts]
+ * @returns {{ ok: boolean, output: string, error?: string }}
+ */
+export function commit(dir, message, { author } = {}) {
+  try {
+    const args = ['commit', '-m', message];
+    if (author) {
+      args.push('--author', author);
+    }
+    const output = execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: true, output };
+  } catch (err) {
+    return { ok: false, output: '', error: err.message };
+  }
+}
+
+/**
+ * Push commits to a remote.
+ *
+ * @param {string} dir
+ * @param {{ remote?: string, branch?: string }} [opts]
+ * @returns {{ ok: boolean, output: string, error?: string }}
+ */
+export function push(dir, { remote = 'origin', branch = 'main' } = {}) {
+  try {
+    const output = execFileSync(
+      'git',
+      ['push', remote, branch],
+      { cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] },
+    );
+    return { ok: true, output };
+  } catch (err) {
+    return { ok: false, output: '', error: err.message };
+  }
+}
+
+/**
+ * Get the current git status for a repository.
+ *
+ * @param {string} dir
+ * @returns {{ ok: boolean, clean: boolean, branch: string, ahead: number, behind: number, modified: string[], untracked: string[], error?: string }}
+ */
+export function status(dir) {
+  try {
+    // Get branch name
+    let branch = 'main';
+    try {
+      branch = execFileSync('git', ['branch', '--show-current'], {
+        cwd: dir,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
+    } catch { /* ignore */ }
+
+    // Get status --porcelain
+    const raw = execFileSync('git', ['status', '--porcelain'], {
+      cwd: dir,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    const modified = [];
+    const untracked = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      const code = line.slice(0, 2);
+      const path = line.slice(3);
+      if (code === '??') {
+        untracked.push(path);
+      } else {
+        modified.push(path);
+      }
+    }
+
+    // Get ahead/behind vs tracking branch
+    let ahead = 0;
+    let behind = 0;
+    try {
+      const revparse = execFileSync('git', ['revparse', '--abbrev-ref', '@{upstream}'], {
+        cwd: dir,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
+      if (revparse) {
+        const aheadBehind = execFileSync('git', ['rev-list', '--left-right', '--count', `${branch}...${revparse}`], {
+          cwd: dir,
+          encoding: 'utf8',
+          stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        const [a, b] = aheadBehind.split('\t').map(Number);
+        ahead = a || 0;
+        behind = b || 0;
+      }
+    } catch { /* no upstream */ }
+
+    return {
+      ok: true,
+      clean: modified.length === 0 && untracked.length === 0,
+      branch,
+      ahead,
+      behind,
+      modified,
+      untracked,
+    };
+  } catch (err) {
+    return { ok: false, clean: false, branch: 'main', ahead: 0, behind: 0, modified: [], untracked: [], error: err.message };
+  }
+}
+
+/**
+ * Acquire a per-repo mutex lockfile. Returns a release function or an error.
+ * The lock file contains { pid, startedAt }. If another live PID holds the lock,
+ * returns { error: 'locked' }.
+ *
+ * @param {string} repoDir — the git repository root
+ * @returns {{ release: () => void } | { error: 'locked' }}
+ */
+export function acquireLock(repoDir) {
+  const lockPath = join(repoDir, '.sync.lock');
+  const pid = process.pid;
+  const startedAt = Date.now();
+
+  if (existsSync(lockPath)) {
+    try {
+      const lockData = JSON.parse(readFileSync(lockPath, 'utf8'));
+      // Check if the PID is still alive
+      try {
+        process.kill(lockData.pid, 0);
+        // Still alive — someone else holds the lock
+        return { error: 'locked' };
+      } catch {
+        // PID is dead — stale lock, we'll take over
+      }
+    } catch { /* corrupt lockfile — take over */ }
+  }
+
+  writeFileSync(lockPath, JSON.stringify({ pid, startedAt }), 'utf8');
+
+  const release = () => {
+    try {
+      if (existsSync(lockPath)) {
+        const lockData = JSON.parse(readFileSync(lockPath, 'utf8'));
+        if (lockData.pid === pid) {
+          unlinkSync(lockPath);
+        }
+      }
+    } catch { /* ignore */ }
+  };
+
+  return { release };
+}
+
+/**
+ * Stage a single file for commit.
+ *
+ * @param {string} dir — working directory
+ * @param {string} filePath — path relative to dir
+ * @returns {{ ok: boolean, error?: string }}
+ */
+export function addFile(dir, filePath) {
+  try {
+    execFileSync('git', ['add', filePath], { cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+/**
+ * Stage all changes (including untracked) for commit.
+ *
+ * @param {string} dir
+ * @returns {{ ok: boolean, error?: string }}
+ */
+export function addAll(dir) {
+  try {
+    execFileSync('git', ['add', '-A'], { cwd: dir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+/**
+ * Set the URL of a git remote, idempotently.
+ *
+ * @param {string} repoDir — the git repository root
+ * @param {string} remoteName — name of the remote (e.g. 'origin')
+ * @param {string} url — the remote URL
+ * @param {{ overwrite?: boolean }} [opts]
+ * @returns {{ ok: true, action: 'added' | 'updated' | 'unchanged' }}
+ * @throws if the remote already exists with a different URL and overwrite is false,
+ *         or if the underlying git command fails.
+ */
+export function addRemote(repoDir, remoteName, url, { overwrite = false } = {}) {
+  let existing = null;
+  try {
+    existing = execFileSync('git', ['remote', 'get-url', remoteName], {
+      cwd: repoDir,
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+  } catch (err) {
+    // exit code 2 or 128 means remote doesn't exist; anything else is a real error
+    if (err.status !== 2 && err.status !== 128) {
+      throw new Error(`failed to query remote '${remoteName}': ${err.message}`);
+    }
+  }
+
+  if (existing && existing === url) {
+    return { ok: true, action: 'unchanged' };
+  }
+
+  if (existing && !overwrite) {
+    throw new Error(
+      `remote '${remoteName}' already exists with URL ${existing}.\n` +
+      `  To update it, call addRemote(dir, name, url, { overwrite: true }).`,
+    );
+  }
+
+  if (existing) {
+    execFileSync('git', ['remote', 'set-url', remoteName, url], {
+      cwd: repoDir,
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return { ok: true, action: 'updated' };
+  }
+
+  execFileSync('git', ['remote', 'add', remoteName, url], {
+    cwd: repoDir,
+    timeout: 5000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+  return { ok: true, action: 'added' };
+}
+
+/**
+ * Test whether a git remote is reachable.
+ *
+ * @param {string} repoDir — the git repository root
+ * @param {string} remoteName — name of the remote (e.g. 'origin')
+ * @param {{ timeoutMs?: number }} [opts]
+ * @returns {string} the trimmed stdout from `git ls-remote` on success,
+ *                   or '' on any failure (network, auth, timeout).
+ *                   Does NOT throw.
+ */
+export function lsRemote(repoDir, remoteName, { timeoutMs = 5000 } = {}) {
+  try {
+    const stdout = execFileSync('git', ['ls-remote', remoteName], {
+      cwd: repoDir,
+      timeout: timeoutMs,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    return stdout.trim();
+  } catch {
+    return '';
+  }
+}