@remnic/core 1.1.31 → 9.3.516

package/src/network/webdav.ts

@@ -1,5 +1,6 @@
-import { createReadStream } from "node:fs";
-import { mkdir, readdir, realpath, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import { mkdir, open, readdir, realpath, stat } from "node:fs/promises";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import path from "node:path";
@@ -38,10 +39,49 @@ interface AllowedRoot {
   name: string;
 }
 
+type WebDavReadOpenResult =
+  | { ok: true; handle: FileHandle; size: number }
+  | { ok: false; code: number; message: string };
+
+function validateWebDavAuth(auth: WebDavAuth): WebDavAuth {
+  if (typeof auth.username !== "string" || auth.username.trim().length === 0) {
+    throw new Error("webdav auth.username must be a non-empty string");
+  }
+  if (typeof auth.password !== "string" || auth.password.trim().length === 0) {
+    throw new Error("webdav auth.password must be a non-empty string");
+  }
+  return auth;
+}
+
+export async function openWebDavFileForRead(absolutePath: string): Promise<WebDavReadOpenResult> {
+  let handle: FileHandle | null = null;
+  try {
+    handle = await open(absolutePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const info = await handle.stat();
+    if (!info.isFile()) {
+      await handle.close().catch(() => {});
+      return { ok: false, code: 403, message: "path is not a file" };
+    }
+    return { ok: true, handle, size: info.size };
+  } catch (err) {
+    await handle?.close().catch(() => {});
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "ELOOP") {
+      return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
+    }
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, code: 404, message: "not found" };
+    }
+    return { ok: false, code: 404, message: "not found" };
+  }
+}
+
 export class WebDavServer {
   private readonly options: Required<Omit<WebDavServerOptions, "auth">> & Pick<WebDavServerOptions, "auth">;
   private readonly allowedRoots: AllowedRoot[];
   private server: Server | null = null;
+  private startPromise: Promise<WebDavServerStatus> | null = null;
+  private listening = false;
   private boundPort: number;
 
   private constructor(
@@ -59,7 +99,7 @@ export class WebDavServer {
       host: input.host ?? "127.0.0.1",
       port: input.port,
       allowlistDirs: input.allowlistDirs,
-      auth: input.auth,
+      auth: input.auth ? validateWebDavAuth(input.auth) : undefined,
     };
 
     if (!Array.isArray(options.allowlistDirs) || options.allowlistDirs.length === 0) {
@@ -90,9 +130,10 @@ export class WebDavServer {
     if (!this.options.enabled) {
       throw new Error("webdav server is disabled; set enabled=true to start");
     }
-    if (this.server) {
+    if (this.server && this.listening) {
       return this.status();
     }
+    if (this.startPromise) return this.startPromise;
 
     const server = createServer((req, res) => {
       this.handle(req, res).catch((err) => {
@@ -105,48 +146,80 @@ export class WebDavServer {
       });
     });
     this.server = server;
+    this.listening = false;
+
+    this.startPromise = (async () => {
+      try {
+        await new Promise<void>((resolve, reject) => {
+          const onError = (err: Error) => {
+            server.removeListener("listening", onListening);
+            server.removeListener("close", onClose);
+            reject(err);
+          };
+          const onListening = () => {
+            server.removeListener("error", onError);
+            server.removeListener("close", onClose);
+            resolve();
+          };
+          const onClose = () => {
+            server.removeListener("error", onError);
+            server.removeListener("listening", onListening);
+            reject(new Error("webdav server closed before listening"));
+          };
+          server.once("error", onError);
+          server.once("listening", onListening);
+          server.once("close", onClose);
+          server.listen(this.options.port, this.options.host);
+        });
+      } catch (err) {
+        if (this.server === server) {
+          this.server = null;
+        }
+        this.listening = false;
+        server.close();
+        throw err;
+      }
 
-    try {
-      await new Promise<void>((resolve, reject) => {
-        const onError = (err: Error) => {
-          server.removeListener("listening", onListening);
-          reject(err);
-        };
-        const onListening = () => {
-          server.removeListener("error", onError);
-          resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
-        server.listen(this.options.port, this.options.host);
-      });
-    } catch (err) {
-      this.server = null;
-      server.close();
-      throw err;
-    }
+      const address = server.address();
+      if (address && typeof address !== "string") {
+        this.boundPort = address.port;
+      }
+      this.listening = true;
 
-    const address = server.address();
-    if (address && typeof address !== "string") {
-      this.boundPort = address.port;
-    }
+      return this.status();
+    })();
 
-    return this.status();
+    try {
+      return await this.startPromise;
+    } finally {
+      this.startPromise = null;
+    }
   }
 
   async stop(): Promise<void> {
     if (!this.server) return;
     const server = this.server;
-    this.server = null;
-    this.boundPort = this.options.port;
+    const pendingStart = this.startPromise;
     await new Promise<void>((resolve, reject) => {
-      server.close((err) => (err ? reject(err) : resolve()));
+      server.close((err) => {
+        if (err && (err as NodeJS.ErrnoException).code !== "ERR_SERVER_NOT_RUNNING") {
+          reject(err);
+          return;
+        }
+        resolve();
+      });
     });
+    await pendingStart?.catch(() => undefined);
+    if (this.server === server) {
+      this.server = null;
+    }
+    this.listening = false;
+    this.boundPort = this.options.port;
   }
 
   status(): WebDavServerStatus {
     return {
-      running: this.server !== null,
+      running: this.server !== null && this.listening,
       host: this.options.host,
       port: this.boundPort,
       rootCount: this.allowedRoots.length,
@@ -182,12 +255,12 @@ export class WebDavServer {
     }
 
     if (method === "PROPFIND") {
-      await this.handlePropfind(resolved.absolutePath, resolved.displayPath, res);
+      await this.handlePropfind(resolved.absolutePath, resolved.rootAbsolute, resolved.displayPath, res);
       return;
     }
 
     if (method === "GET" || method === "HEAD") {
-      await this.handleRead(method, resolved.absolutePath, res);
+      await this.handleRead(method, resolved.absolutePath, resolved.rootAbsolute, res);
       return;
     }
 
@@ -241,7 +314,7 @@ export class WebDavServer {
   }
 
   private async resolvePath(requestPathname: string): Promise<
-    | { ok: true; absolutePath: string; displayPath: string }
+    | { ok: true; absolutePath: string; displayPath: string; rootAbsolute: string }
     | { ok: false; code: number; message: string }
   > {
     let decodedPath: string;
@@ -282,11 +355,11 @@ export class WebDavServer {
       if (!this.isPathInside(root.absolute, canonicalCandidate)) {
         return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
       }
-      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join("/")}` };
+      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join("/")}`, rootAbsolute: root.absolute };
     } catch (err) {
       const code = (err as NodeJS.ErrnoException).code;
       if (code === "ENOENT") {
-        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join("/")}` };
+        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join("/")}`, rootAbsolute: root.absolute };
       }
       if (code === "ENOTDIR" || code === "ELOOP") {
         return { ok: false, code: 400, message: "invalid path" };
@@ -295,36 +368,57 @@ export class WebDavServer {
     }
   }
 
-  private async handleRead(method: "GET" | "HEAD", absolutePath: string, res: ServerResponse): Promise<void> {
-    let info;
-    try {
-      info = await stat(absolutePath);
-    } catch {
-      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("not found");
+  private async handleRead(
+    method: "GET" | "HEAD",
+    absolutePath: string,
+    rootAbsolute: string,
+    res: ServerResponse,
+  ): Promise<void> {
+    const revalidated = await this.revalidatePathInsideRoot(absolutePath, rootAbsolute);
+    if (!revalidated.ok) {
+      res.writeHead(revalidated.code, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(revalidated.message);
       return;
     }
-
-    if (!info.isFile()) {
-      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("path is not a file");
+    const opened = await openWebDavFileForRead(revalidated.absolutePath);
+    if (!opened.ok) {
+      res.writeHead(opened.code, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(opened.message);
       return;
     }
 
-    res.writeHead(200, {
-      "Content-Length": String(info.size),
-      "Content-Type": "application/octet-stream",
-    });
+    const { handle, size } = opened;
 
-    if (method === "HEAD") {
-      res.end();
-      return;
-    }
+    try {
+      res.writeHead(200, {
+        "Content-Length": String(size),
+        "Content-Type": "application/octet-stream",
+      });
+
+      if (method === "HEAD") {
+        res.end();
+        return;
+      }
 
-    await pipeline(createReadStream(absolutePath), res);
+      await pipeline(handle.createReadStream({ autoClose: false }), res);
+    } finally {
+      await handle.close().catch(() => {});
+    }
   }
 
-  private async handlePropfind(absolutePath: string, displayPath: string, res: ServerResponse): Promise<void> {
+  private async handlePropfind(
+    absolutePath: string,
+    rootAbsolute: string,
+    displayPath: string,
+    res: ServerResponse,
+  ): Promise<void> {
+    const revalidated = await this.revalidatePathInsideRoot(absolutePath, rootAbsolute);
+    if (!revalidated.ok) {
+      res.writeHead(revalidated.code, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(revalidated.message);
+      return;
+    }
+    absolutePath = revalidated.absolutePath;
     let info;
     try {
       info = await stat(absolutePath);
@@ -366,6 +460,31 @@ export class WebDavServer {
     }
     return target.startsWith(`${root}${path.sep}`);
   }
+
+  private async revalidatePathInsideRoot(
+    absolutePath: string,
+    rootAbsolute: string,
+  ): Promise<
+    | { ok: true; absolutePath: string }
+    | { ok: false; code: number; message: string }
+  > {
+    try {
+      const canonical = await realpath(absolutePath);
+      if (!this.isPathInside(rootAbsolute, canonical)) {
+        return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
+      }
+      return { ok: true, absolutePath: canonical };
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code === "ENOENT" || code === "ENOTDIR") {
+        return { ok: false, code: 404, message: "not found" };
+      }
+      if (code === "ELOOP") {
+        return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
+      }
+      throw err;
+    }
+  }
 }
 
 function xmlEscape(value: string): string {

package/src/offline-sync.test.ts

@@ -16,6 +16,7 @@ import {
   buildOfflineSyncSnapshotForPaths,
   OFFLINE_SYNC_MAX_MTIME_MS,
   readOfflineSyncFileContentChunk,
+  shouldPreferIncomingOfflineRuntimeFile,
   summarizeOfflineSyncPendingChanges,
   summarizeOfflineSyncPendingFiles,
 } from "./offline-sync.js";
@@ -110,6 +111,32 @@ test("offline snapshot captures source-of-truth files and excludes private/inter
   }
 });
 
+test("offline snapshot abort signal stops filesystem snapshot work", async () => {
+  const root = await tempDir("remnic-offline-snapshot-abort");
+  try {
+    await write(root, "facts/a.md", "alpha");
+    const controller = new AbortController();
+
+    await assert.rejects(
+      buildOfflineSyncSnapshot({
+        root,
+        sourceId: "remote",
+        signal: controller.signal,
+        readFileDigest: async () => {
+          controller.abort();
+          return {
+            sha256: createHash("sha256").update("alpha").digest("hex"),
+            bytes: Buffer.byteLength("alpha"),
+          };
+        },
+      }),
+      /offline sync request aborted/,
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("offline sync includes retrieval debug snapshots for full-fidelity offline recall", async () => {
   const root = await tempDir("remnic-offline-debug-snapshots");
   try {
@@ -313,7 +340,7 @@ test("offline snapshot from base avoids rehashing unchanged files", async () =>
       sourceId: "remote",
       includeContent: false,
     });
-    const baseCapturedAt = new Date(Date.now() + 60_000);
+    const baseCapturedAt = new Date();
     let readCount = 0;
 
     const unchanged = await buildOfflineSyncSnapshotFromBase({
@@ -438,7 +465,7 @@ test("offline snapshot from base trusts mtime precision drift without rehashing"
       root,
       sourceId: "remote",
       baseFiles: [driftedBase],
-      baseCapturedAt: new Date(Date.now() + 60_000),
+      baseCapturedAt: new Date(),
       includeContent: false,
       readFileDigest: async () => {
         throw new Error("unchanged file should reuse trusted mtime metadata");
@@ -451,6 +478,47 @@ test("offline snapshot from base trusts mtime precision drift without rehashing"
   }
 });
 
+test("offline snapshot from base rehashes metadata-only ctime churn", async () => {
+  const root = await tempDir("remnic-offline-fast-base-ctime-only");
+  try {
+    await write(root, "facts/a.md", "alpha");
+    const filePath = path.join(root, "facts/a.md");
+    const baseSnapshot = await buildOfflineSyncSnapshot({
+      root,
+      sourceId: "remote",
+      includeContent: false,
+    });
+    const baseFile = baseSnapshot.files.find((file) => file.path === "facts/a.md");
+    assert.ok(baseFile);
+    const baseCapturedAt = new Date();
+    await new Promise<void>((resolve) => setTimeout(resolve, 1_100));
+    await chmod(filePath, 0o600);
+    await chmod(filePath, 0o644);
+
+    let digestReadCount = 0;
+    const rehashed = await buildOfflineSyncSnapshotFromBase({
+      root,
+      sourceId: "remote",
+      baseFiles: baseSnapshot.files,
+      baseCapturedAt,
+      includeContent: false,
+      readFileDigest: async ({ filePath }) => {
+        digestReadCount += 1;
+        const bytes = await readFile(filePath);
+        return {
+          sha256: createHash("sha256").update(bytes).digest("hex"),
+          bytes: bytes.byteLength,
+        };
+      },
+    });
+
+    assert.equal(digestReadCount, 1);
+    assert.equal(rehashed.files[0]?.sha256, baseFile.sha256);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("offline snapshot from base rehashes preserved-mtime rewrites when ctime changed after capture", async () => {
   const root = await tempDir("remnic-offline-fast-base-preserved-mtime");
   try {
@@ -463,6 +531,8 @@ test("offline snapshot from base rehashes preserved-mtime rewrites when ctime ch
     });
     const baseFile = baseSnapshot.files[0];
     assert.ok(baseFile);
+    const baseCapturedAt = new Date();
+    await new Promise<void>((resolve) => setTimeout(resolve, 20));
     await write(root, "facts/a.md", "bravo");
     await utimes(filePath, baseFile.mtimeMs / 1000, baseFile.mtimeMs / 1000);
 
@@ -471,7 +541,7 @@ test("offline snapshot from base rehashes preserved-mtime rewrites when ctime ch
       root,
       sourceId: "remote",
       baseFiles: baseSnapshot.files,
-      baseCapturedAt: new Date(0),
+      baseCapturedAt,
       includeContent: false,
       readFileDigest: async ({ filePath }) => {
         digestReadCount += 1;
@@ -525,7 +595,7 @@ test("offline snapshot apply preserves incoming mtime for future fast-base reuse
       root,
       sourceId: "local",
       baseFiles: applied.nextBaseFiles,
-      baseCapturedAt: new Date(capturedAtMs),
+      baseCapturedAt: new Date(),
       includeContent: false,
       readFileDigest: async () => {
         throw new Error("applied file should reuse preserved mtime metadata");
@@ -1526,6 +1596,50 @@ test("offline pull skips local runtime drift when remote still matches base", as
   }
 });
 
+test("offline pull treats last intent as remote-authoritative runtime state", async () => {
+  const root = await tempDir("remnic-offline-runtime-last-intent");
+  try {
+    const relPath = "state/last_intent.json";
+    const baseContent = Buffer.from("{\"intent\":\"base\"}");
+    const localContent = Buffer.from("{\"intent\":\"local\"}");
+    const remoteContent = Buffer.from("{\"intent\":\"remote\"}");
+    await write(root, relPath, localContent);
+    const baseFile = {
+      path: relPath,
+      sha256: createHash("sha256").update(baseContent).digest("hex"),
+      bytes: baseContent.byteLength,
+      mtimeMs: 1,
+    };
+    const incomingFile = {
+      path: relPath,
+      sha256: createHash("sha256").update(remoteContent).digest("hex"),
+      bytes: remoteContent.byteLength,
+      mtimeMs: 2,
+      contentBase64: remoteContent.toString("base64"),
+    };
+
+    assert.equal(shouldPreferIncomingOfflineRuntimeFile(relPath), true);
+    const pull = await applyOfflineSyncSnapshot({
+      root,
+      snapshot: {
+        format: "remnic.offline-sync.snapshot.v1",
+        schemaVersion: 1,
+        createdAt: new Date().toISOString(),
+        sourceId: "remote",
+        includeTranscripts: true,
+        files: [incomingFile],
+      },
+      baseFiles: [baseFile],
+    });
+
+    assert.equal(pull.upserted, 1);
+    assert.equal(pull.conflicts.length, 0);
+    assert.equal(await readUtf8(root, relPath), remoteContent.toString("utf-8"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("offline pull applies snapshots with content only for remote-changed files", async () => {
   const remote = await tempDir("remnic-offline-partial-remote");
   const local = await tempDir("remnic-offline-partial-local");
@@ -2108,14 +2222,13 @@ test("offline sync applies and snapshots through secure storage hooks", async ()
   }
 });
 
-test("offline snapshot fast-base rehashes when encrypted header probe fails", async () => {
-  const root = await tempDir("remnic-offline-fast-base-probe-error");
+test("offline snapshot fast-base does not probe file headers for trusted metadata", async () => {
+  const root = await tempDir("remnic-offline-fast-base-no-header-probe");
   const relPath = "facts/same-size.md";
-  const oldContent = Buffer.from("old!");
-  const newContent = Buffer.from("new!");
+  const content = Buffer.from("fact");
   const filePath = path.join(root, relPath);
   try {
-    await write(root, relPath, newContent);
+    await write(root, relPath, content);
     await chmod(filePath, 0o000);
     const st = await stat(filePath);
     let digestReads = 0;
@@ -2125,24 +2238,21 @@ test("offline snapshot fast-base rehashes when encrypted header probe fails", as
       sourceId: "remote",
       baseFiles: [{
         path: relPath,
-        sha256: createHash("sha256").update(oldContent).digest("hex"),
-        bytes: newContent.byteLength,
+        sha256: createHash("sha256").update(content).digest("hex"),
+        bytes: content.byteLength,
         mtimeMs: st.mtimeMs,
       }],
-      baseCapturedAt: new Date(),
+      baseCapturedAt: new Date(Date.now() + 60_000),
       readFileDigest: async ({ path: targetPath, filePath: targetFilePath }) => {
         assert.equal(targetPath, relPath);
         assert.equal(targetFilePath, filePath);
         digestReads += 1;
-        return {
-          sha256: createHash("sha256").update(newContent).digest("hex"),
-          bytes: newContent.byteLength,
-        };
+        throw new Error("trusted metadata should not read the file header or digest");
       },
     });
 
-    assert.equal(digestReads, 1);
-    assert.equal(snapshot.files[0]?.sha256, createHash("sha256").update(newContent).digest("hex"));
+    assert.equal(digestReads, 0);
+    assert.equal(snapshot.files[0]?.sha256, createHash("sha256").update(content).digest("hex"));
   } finally {
     await chmod(filePath, 0o600).catch(() => {});
     await rm(root, { recursive: true, force: true });