@provos/ironcurtain 0.6.0 → 0.7.0

package/dist/cron/git-sync.js

@@ -0,0 +1,121 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+/**
+ * Allowlisted git URI schemes. Git's ext:: protocol allows arbitrary
+ * command execution and must never be accepted.
+ *
+ * Accepted forms:
+ *   - https://host/repo.git
+ *   - http://host/repo.git
+ *   - ssh://user@host/repo.git
+ *   - git://host/repo.git
+ *   - git@host:org/repo.git  (SCP-style shorthand for SSH)
+ *   - file:///path/to/repo
+ */
+const SAFE_URI_PATTERNS = [
+    /^https:\/\//i,
+    /^http:\/\//i,
+    /^ssh:\/\//i,
+    /^git:\/\//i,
+    /^file:\/\//i,
+    /^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+:/, // SCP-style: user@host:path
+];
+/**
+ * Validates that a git URI uses a safe transport protocol.
+ *
+ * Rejects dangerous protocols like ext:: which allow arbitrary
+ * command execution, and any other unrecognized scheme.
+ *
+ * @throws {Error} if the URI uses a disallowed protocol
+ */
+export function validateGitUri(uri) {
+    const trimmed = uri.trim();
+    if (!trimmed) {
+        throw new Error('Git URI must not be empty');
+    }
+    const isSafe = SAFE_URI_PATTERNS.some((pattern) => pattern.test(trimmed));
+    if (!isSafe) {
+        throw new Error(`Rejected git URI with disallowed protocol: "${trimmed}". ` +
+            `Only https, http, ssh, git, file, and SCP-style (user@host:path) URIs are allowed.`);
+    }
+}
+/**
+ * Determines the remote's default branch by inspecting origin/HEAD.
+ * Falls back to 'main' if the symbolic ref is not set.
+ */
+function resolveDefaultBranch(dir, env) {
+    try {
+        // origin/HEAD is set automatically on clone; resolve it to a branch name.
+        const ref = execFileSync('git', ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], {
+            cwd: dir,
+            stdio: 'pipe',
+            env,
+        })
+            .toString()
+            .trim();
+        // ref is "origin/main" or "origin/master" — strip the "origin/" prefix.
+        return ref.replace(/^origin\//, '');
+    }
+    catch {
+        // origin/HEAD may not exist if the repo was cloned with an old git version
+        // or if HEAD was never set. Probe for common default branch names.
+        for (const candidate of ['main', 'master']) {
+            try {
+                execFileSync('git', ['rev-parse', '--verify', `origin/${candidate}`], {
+                    cwd: dir,
+                    stdio: 'pipe',
+                    env,
+                });
+                return candidate;
+            }
+            catch {
+                // Branch doesn't exist, try next
+            }
+        }
+        return 'main';
+    }
+}
+/**
+ * Clones or refreshes a git repository in the given directory.
+ *
+ * - First call: clones the repo into dir (dir must exist and be empty)
+ * - Subsequent calls: fetches from origin and resets tracked files to
+ *   FETCH_HEAD, leaving untracked files (agent artifacts) intact.
+ *
+ * @param verbose Pass true to inherit stdio (show git output in terminal)
+ * @returns diff --stat of tracked-file changes discarded by a hard reset,
+ *          or null on first clone / when there are no local changes.
+ * @throws {Error} if the URI uses a disallowed protocol
+ */
+export function syncGitRepo(uri, dir, verbose = false) {
+    validateGitUri(uri);
+    const stdio = verbose ? 'inherit' : 'pipe';
+    const env = { ...process.env, GIT_ALLOW_PROTOCOL: 'https:http:ssh:git:file' };
+    if (existsSync(resolve(dir, '.git'))) {
+        execFileSync('git', ['fetch', 'origin'], { cwd: dir, stdio, env });
+        // Resolve the remote's default branch (e.g., main, master).
+        const defaultBranch = resolveDefaultBranch(dir, env);
+        const target = `origin/${defaultBranch}`;
+        // Capture tracked-file changes that will be discarded by the hard reset.
+        let discarded = null;
+        try {
+            const diff = execFileSync('git', ['diff', '--stat', target], { cwd: dir, stdio: 'pipe', env });
+            const diffStr = diff.toString().trim();
+            if (diffStr) {
+                discarded = diffStr;
+            }
+        }
+        catch {
+            // Non-fatal: proceed with reset even if diff fails
+        }
+        // Ensure the default branch is checked out, then reset to latest remote.
+        execFileSync('git', ['checkout', '-B', defaultBranch, target], { cwd: dir, stdio, env });
+        return discarded;
+    }
+    else {
+        execFileSync('git', ['clone', '--', uri, '.'], { cwd: dir, stdio, env });
+        return null;
+    }
+}
+//# sourceMappingURL=git-sync.js.map

package/dist/cron/git-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-sync.js","sourceRoot":"","sources":["../../src/cron/git-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,MAAM,iBAAiB,GAA0B;IAC/C,cAAc;IACd,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,mCAAmC,EAAE,4BAA4B;CAClE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,KAAK;YACzD,oFAAoF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,GAAsB;IAC/D,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE;YACvF,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,MAAM;YACb,GAAG;SACJ,CAAC;aACC,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;QACV,wEAAwE;QACxE,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,mEAAmE;QACnE,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,SAAS,EAAE,CAAC,EAAE;oBACpE,GAAG,EAAE,GAAG;oBACR,KAAK,EAAE,MAAM;oBACb,GAAG;iBACJ,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW,EAAE,OAAO,GAAG,KAAK;IACnE,cAAc,CAAC,GAAG,CAAC,CAAC;IAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,MAAgB,CAAC;IACjE,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;IACjG,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACrC,YAAY,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,aAAa,EAAE,CAAC;QAEzC,yEAAyE;QACzE,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,GAAG,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;QAED,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cron/headless-transport.d.ts

@@ -0,0 +1,27 @@
+/**
+ * HeadlessTransport -- Minimal transport for headless cron sessions.
+ *
+ * Unlike SignalSessionTransport which blocks run() indefinitely,
+ * HeadlessTransport's run() resolves when the single-shot task
+ * message completes. It does not accept follow-up messages.
+ *
+ * Escalations raised during the cron session follow the normal
+ * daemon escalation resolution path and will be auto-denied
+ * if no human approval is provided within the timeout.
+ */
+import { BaseTransport } from '../session/base-transport.js';
+import type { Session } from '../session/types.js';
+export interface HeadlessTransportOptions {
+    /** The initial task message to send. */
+    readonly taskMessage: string;
+}
+export declare class HeadlessTransport extends BaseTransport {
+    private readonly taskMessage;
+    private response;
+    private closed;
+    constructor(options: HeadlessTransportOptions);
+    protected runSession(session: Session): Promise<void>;
+    /** Returns the agent's response from the task. */
+    getResponse(): string | undefined;
+    close(): void;
+}

package/dist/cron/headless-transport.js

@@ -0,0 +1,43 @@
+/**
+ * HeadlessTransport -- Minimal transport for headless cron sessions.
+ *
+ * Unlike SignalSessionTransport which blocks run() indefinitely,
+ * HeadlessTransport's run() resolves when the single-shot task
+ * message completes. It does not accept follow-up messages.
+ *
+ * Escalations raised during the cron session follow the normal
+ * daemon escalation resolution path and will be auto-denied
+ * if no human approval is provided within the timeout.
+ */
+import { BaseTransport } from '../session/base-transport.js';
+import * as logger from '../logger.js';
+export class HeadlessTransport extends BaseTransport {
+    taskMessage;
+    response;
+    closed = false;
+    constructor(options) {
+        super();
+        this.taskMessage = options.taskMessage;
+    }
+    async runSession(session) {
+        if (this.closed)
+            return;
+        try {
+            logger.info(`[HeadlessTransport] Sending task message (${this.taskMessage.length} chars)`);
+            this.response = await this.sendAndLog(session, this.taskMessage);
+            logger.info(`[HeadlessTransport] Task completed, response: ${this.response.length} chars`);
+        }
+        catch (err) {
+            logger.warn(`[HeadlessTransport] Task failed: ${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
+    }
+    /** Returns the agent's response from the task. */
+    getResponse() {
+        return this.response;
+    }
+    close() {
+        this.closed = true;
+    }
+}
+//# sourceMappingURL=headless-transport.js.map

package/dist/cron/headless-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-transport.js","sourceRoot":"","sources":["../../src/cron/headless-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAOvC,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IACjC,WAAW,CAAS;IAC7B,QAAQ,CAAqB;IAC7B,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAiC;QAC3C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IAES,KAAK,CAAC,UAAU,CAAC,OAAgB;QACzC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAExB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC;YAC3F,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,iDAAiD,IAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF"}

package/dist/cron/job-commands.d.ts

@@ -0,0 +1,39 @@
+/**
+ * CLI subcommands for cron job management.
+ *
+ * These commands work without a running daemon -- they read/write
+ * job files directly from ~/.ironcurtain/jobs/. When a daemon is
+ * running, daemon-command.ts forwards commands via the control socket
+ * instead of calling these functions directly.
+ */
+import { type JobDefinition, type RunRecord } from './types.js';
+/** Creates a new scheduled job interactively. */
+export declare function runAddJobWizard(): Promise<void>;
+/** Edits an existing job interactively. Re-compiles policy if task changed. */
+export declare function runEditJobWizard(jobIdStr: string): Promise<void>;
+export declare function runListJobs(): void;
+/** Daemon job list entry received over the control socket. */
+export interface DaemonJobListEntry {
+    job: JobDefinition;
+    nextRun: string | null;
+    lastRun: RunRecord | undefined;
+    isRunning: boolean;
+}
+/**
+ * Formats job list data received from the daemon control socket.
+ * Used when list-jobs is forwarded to a running daemon, which provides
+ * live running status and next-run times from the scheduler.
+ */
+export declare function formatDaemonJobList(jobs: DaemonJobListEntry[]): void;
+/** Manually triggers a job run. */
+export declare function runJobCommand(jobIdStr: string): Promise<void>;
+/** Removes a job. Prompts for confirmation unless force is true. */
+export declare function runRemoveJob(jobIdStr: string, force?: boolean): Promise<void>;
+/** Disables a job. */
+export declare const runDisableJob: (jobIdStr: string) => Promise<void>;
+/** Enables a job. */
+export declare const runEnableJob: (jobIdStr: string) => Promise<void>;
+/** Re-runs policy compilation for a job. */
+export declare function runRecompileJob(jobIdStr: string): Promise<void>;
+/** Shows recent run logs for a job. */
+export declare function runShowLogs(jobIdStr: string, limit: number): void;