@rightkit/release 0.6.13 → 0.6.15

package/snapshot-check.mjs

@@ -22,7 +22,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { LIVE_SCAN_IDS, defaultSpawn, isLiveScan, isRegistryScan, launchGuardEnv, planScans, runScans } from "./deterministic-scans.mjs";
 import { compileLaunch } from "./class-a-launch-guard.mjs";
-import { SnapshotError, isInside, snapshotProblem, snapshotTree, treeEntries } from "./snapshot.mjs";
+import { SnapshotError, dependencyDirs, isInside, snapshotProblem, snapshotTree, treeEntries } from "./snapshot.mjs";
 import { discoveryRun, sealedRun } from "./snapshot-git.mjs";
 
 export const CHECK_ERROR = "RK_CHECK_ERROR";
@@ -49,7 +49,8 @@ export function snapshotOption(args, { checkout }) {
   const dir = args[i + 1];
   if (!dir || dir.startsWith("--")) throw new CheckError("check --snapshot needs a directory");
   if (!path.isAbsolute(dir)) throw new CheckError(`check --snapshot needs an absolute directory, not ${JSON.stringify(dir)}`);
-  if (!args.includes("--full-a") || !args.includes("--commit")) throw new CheckError("check --snapshot is full class A of a selected commit: it needs --commit <sha> and --full-a");
+  // Full class A (`--full-a`, the door's) or the content checks alone (plain `check --commit`): either way the snapshot is the commit's bytes.
+  if (!args.includes("--commit")) throw new CheckError("check --snapshot judges the snapshot of a selected commit: it needs --commit <sha>");
   if (args.includes("--worktree")) throw new CheckError("check --snapshot never checks the working tree: drop --worktree");
   let st;
   try { st = fs.lstatSync(dir); } catch { throw new CheckError(`snapshot ${dir} does not exist`); }
@@ -197,15 +198,92 @@ export function probeSkippedBuilds({ dir, root, names, spawn = defaultSpawn, env
 /**
  * Installs each pnpm root's dependencies into the snapshot from the commit's lockfile and the primary checkout's existing store.
  * Returns one record per root ({ root, storeDir, storeSource, pnpm, lockfileSha256, ms, allowedBuildsNotRun }); throws CheckError on a
- * store miss, a pnpm that is not the pinned one, or any install failure.
+ * store miss, a pnpm that is not the pinned one, or any install failure. A failed install invalidates only that root's generated
+ * dependency directories: remove them without following links before reporting the original error. Other roots and stores stay warm.
  */
-export function installSnapshotDependencies({ checkout, snapshot, roots, env = process.env, spawn = defaultSpawn, now = () => Date.now(), readFile, exists, probe = probeSkippedBuilds }) {
+export function installSnapshotDependencies({ checkout, snapshot, commit, tree, ledger, roots, packageDirs, env = process.env, spawn = defaultSpawn, now = () => Date.now(), readFile, exists, probe = probeSkippedBuilds }) {
   const records = [];
+  // Cleanup authority comes from the selected commit, never a path supplied by pnpm or an untracked manifest. Verify before any
+  // installer runs; a preflight failure has generated nothing and must not remove existing dependencies.
+  if (!commit || !tree) throw new CheckError("snapshot dependency install needs the selected commit and tree");
+  const base = path.resolve(snapshot);
+  try {
+    const st = fs.lstatSync(base);
+    if (!st.isDirectory() || fs.realpathSync.native(base) !== base) throw new Error("not a real directory");
+  } catch (error) { throw new CheckError(`snapshot dependency install needs a real snapshot directory: ${snapshot}: ${error.message}`); }
+  if (inside(base, checkout) || inside(checkout, base)) throw new CheckError(`snapshot ${base} and checkout ${checkout} overlap`);
+  verifySnapshotDir({ checkout, dir: base, commit, tree, when: "before dependency installation", ...(ledger !== undefined ? { ledger } : {}) });
+  const entries = treeEntries(checkout, commit);
+  const fold = (s) => process.platform === "darwin" || process.platform === "win32" ? s.toLowerCase() : s;
+  const dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
+  const lockRoots = entries.filter((e) => e.path === "pnpm-lock.yaml" || e.path.endsWith("/pnpm-lock.yaml")).map((e) => fold(dirOf(e.path))).filter((p) => !p.split("/").includes("node_modules"));
+  // The verifier folds names on Mac/Windows. Filesystem operations retain committed spelling even on a case-sensitive Mac volume.
+  const generated = [...dependencyDirs(entries, "linux")];
+  const generatedFolded = new Set(generated.map(fold));
+  const nearestLock = (member) => lockRoots.filter((r) => !r || member === r || member.startsWith(`${r}/`)).sort((a, b) => b.length - a.length)[0];
+  const selectedByRoot = new Map();
+  if (packageDirs !== undefined) {
+    if (!Array.isArray(packageDirs)) throw new CheckError("snapshot dependency packageDirs must be an array of committed manifest directories");
+    const manifests = new Map(entries.filter((e) => e.path === "package.json" || e.path.endsWith("/package.json")).map((e) => [fold(dirOf(e.path)), dirOf(e.path)]));
+    const installRoots = new Set(roots.map((r) => fold(path.relative(base, path.resolve(base, r)).split(path.sep).join("/"))));
+    for (const selected of packageDirs) {
+      if (typeof selected !== "string" || path.isAbsolute(selected) || !inside(path.resolve(base, selected), base)) throw new CheckError(`dependency package ${String(selected)} is not relative to the snapshot`);
+      const relative = path.relative(base, path.resolve(base, selected)).split(path.sep).join("/");
+      const actual = manifests.get(fold(relative));
+      const owner = nearestLock(fold(relative));
+      if (actual === undefined || owner === undefined || !installRoots.has(owner) || /[*?\[\]{}!^()\\]/.test(actual) || actual.includes("...")) throw new CheckError(`dependency package ${selected} is not an exact committed manifest directory owned by an install root`);
+      if (!selectedByRoot.has(owner)) selectedByRoot.set(owner, new Set());
+      selectedByRoot.get(owner).add(actual);
+    }
+  }
+  const cleanupFor = (root) => {
+    const relative = path.relative(base, path.resolve(base, root)).split(path.sep).join("/");
+    const owner = fold(relative);
+    if (!inside(path.resolve(base, root), base) || !lockRoots.includes(owner) || !generatedFolded.has(owner ? `${owner}/node_modules` : "node_modules")) throw new CheckError(`root ${root}: not a committed pnpm install root inside the snapshot`);
+    const dirs = generated.filter((d) => {
+      const member = fold(dirOf(d));
+      return nearestLock(member) === owner;
+    });
+    for (const d of dirs) {
+      if (entries.some((e) => fold(e.path) === fold(d) || fold(e.path).startsWith(`${fold(d)}/`))) throw new CheckError(`root ${root}: cannot install over committed dependency path ${d}`);
+    }
+    // Capture physical source parents before pnpm starts. During cleanup check them from the snapshot down, never traversing a
+    // replaced parent or a junction. rmSync unlinks a dependency-directory symlink itself and never follows links within a tree.
+    const parents = new Map();
+    for (const d of dirs) {
+      const parts = d.split("/").slice(0, -1);
+      for (let i = 0; i <= parts.length; i++) {
+        const p = path.join(base, ...parts.slice(0, i));
+        if (!parents.has(p)) {
+          let stat;
+          try { stat = fs.lstatSync(p); }
+          catch (error) { throw new CheckError(`root ${root}: cannot inspect dependency parent ${p}: ${error.message}`); }
+          if (!stat.isDirectory()) throw new CheckError(`root ${root}: dependency parent is not a real directory: ${p}`);
+          parents.set(p, stat);
+        }
+      }
+    }
+    return () => {
+      for (const [p, before] of parents) {
+        const after = fs.lstatSync(p);
+        if (!after.isDirectory() || after.dev !== before.dev || after.ino !== before.ino) throw new Error(`dependency parent changed: ${p}`);
+      }
+      for (const d of dirs) fs.rmSync(path.join(base, ...d.split("/")), { recursive: true, force: true });
+      verifySnapshotDir({ checkout, dir: base, commit, tree, when: "after failed dependency installation cleanup", ...(ledger !== undefined ? { ledger } : {}) });
+    };
+  };
   const versionOf = (cwd) => { const r = spawn("pnpm", ["--version"], { cwd, env: { ...env, COREPACK_ENABLE_AUTO_PIN: "0" } }); return failed(r) ? null : text(r).trim().split(/\r?\n/).pop(); };
   for (const root of roots) {
-    const dir = path.join(snapshot, root);
+    const dir = path.resolve(base, root);
+    if (!inside(dir, base)) throw new CheckError(`root ${root}: dependency install is outside the snapshot`);
     // No lockfile: nothing to install from. Not an error here: the pnpm-lockfile scan judges it, and checks that need dependencies fail.
     if (!fs.existsSync(path.join(dir, "pnpm-lock.yaml"))) { records.push({ root, skipped: "no pnpm-lock.yaml in the commit: nothing to install from (the pnpm-lockfile scan judges it)" }); continue; }
+    const cleanup = cleanupFor(root);
+    const owner = fold(path.relative(base, dir).split(path.sep).join("/"));
+    const selected = selectedByRoot.get(owner);
+    if (packageDirs !== undefined && !selected?.size) throw new CheckError(`root ${root}: no dependency packages selected; refusing an unfiltered install`);
+    const filters = packageDirs === undefined ? [] : [...selected].sort().flatMap((p) => ["--filter", `./${path.relative(dir, path.join(base, p)).split(path.sep).join("/")}`]);
+    if (packageDirs !== undefined) filters.push("--fail-if-no-match", "--config.legacy-dir-filtering=false", "--config.include-workspace-root=false");
     const { storeDir, source } = resolvePrimaryStore({ checkout, root, env, spawn, ...(readFile ? { readFile } : {}), ...(exists ? { exists } : {}) });
     const pin = pinnedPnpm(dir) ?? pinnedPnpm(snapshot);
     // Asked where the install runs: pnpm switches itself to the root's packageManager version there (Dell 2026-10-29: an installed
@@ -216,15 +294,21 @@ export function installSnapshotDependencies({ checkout, snapshot, roots, env = p
     const started = now();
     // The virtual store is pinned inside the snapshot and the global virtual store off, whatever the host's pnpm config says: the
     // install writes nowhere but the snapshot (links to the existing store's content are the only reads outside it).
-    const r = spawn("pnpm", ["install", "--offline", "--frozen-lockfile", "--ignore-scripts", "--ignore-pnpmfile", "--store-dir", storeDir, "--virtual-store-dir", "node_modules/.pnpm", "--config.enable-global-virtual-store=false", "--reporter", "append-only"], {
-      cwd: dir, env: { ...env, COREPACK_ENABLE_AUTO_PIN: "0", CI: "true" }, maxBuffer: 1 << 28,
-    });
+    let r;
+    try {
+      r = spawn("pnpm", [...filters, "install", "--offline", "--frozen-lockfile", "--ignore-scripts", "--ignore-pnpmfile", "--store-dir", storeDir, "--virtual-store-dir", "node_modules/.pnpm", "--config.enable-global-virtual-store=false", "--reporter", "append-only"], {
+        cwd: dir, env: { ...env, COREPACK_ENABLE_AUTO_PIN: "0", CI: "true" }, maxBuffer: 1 << 28,
+      });
+    } catch (error) { r = { error }; }
     const ms = now() - started;
-    if (failed(r)) {
+    if (failed(r) || /No projects matched the filters/.test(`${r?.stdout ?? ""}\n${r?.stderr ?? ""}`)) {
       const out = `${r?.stdout ?? ""}\n${r?.stderr ?? ""}`;
       const miss = /ERR_PNPM_NO_OFFLINE_TARBALL[^\n]*?(https?:\/\/\S+?\/-\/(\S+?)\.tgz)/.exec(out);
-      if (miss) throw new CheckError(`root ${root}: ${miss[2]} is missing from the store ${storeDir} (offline install, no network fallback); install the checkout's dependencies so the store holds it, then run the check again`);
-      throw new CheckError(`root ${root}: offline dependency install failed (store ${storeDir}): ${tail(r) || r?.error?.message || `exit ${r?.status}`}`);
+      const message = miss
+        ? `root ${root}: ${miss[2]} is missing from the store ${storeDir} (offline install, no network fallback); install the checkout's dependencies so the store holds it, then run the check again`
+        : `root ${root}: offline dependency install failed (store ${storeDir}): ${tail(r) || r?.error?.message || `exit ${r?.status}`}`;
+      try { cleanup(); } catch (error) { throw new CheckError(`${message}; dependency cleanup failed: ${error.message}`); }
+      throw new CheckError(`${message}; invalidated generated dependency output for owning lockroot ${root}`);
     }
     const lockfileSha256 = crypto.createHash("sha256").update(fs.readFileSync(path.join(dir, "pnpm-lock.yaml"))).digest("hex");
     const skipped = probe ? probe({ dir, root, names: allowedBuilds(dir), spawn, env }) : [];

package/snapshot-metadata.mjs

@@ -0,0 +1,123 @@
+// The gate's own read-only Cargo calls inside a managed snapshot on a broker host (rightkit#1311).
+//
+// RustRight refuses a ROOT request whose workspace is inside a managed snapshot ("a root request cannot run inside a managed snapshot",
+// rustright job_service/service.rs). The gate reads the snapshot's Cargo metadata to discover units, and every Class A Cargo scan of a
+// snapshot (metadata, fetch, cargo-deny, cargo-audit) reads the snapshot too, never the primary checkout (docs/GATE-CONTRACT.md: no
+// dirty-tree condition; class A for a build reads the snapshot). So on a broker host each such call is a CARRIED read-only request: the
+// same carrier, nonce, signed-receipt verification and ownership mark as every other carried call (snapshot-broker.mjs carryBrokerCargo).
+// The broker admits a carried call that compiles nothing only for the exact shapes below (rustright_policy::command_policy::
+// snapshot_read_only). This module carries exactly those and refuses every other call inside the snapshot with RK_SNAPSHOT_CARRIED_REFUSED,
+// never running it as a root request.
+//
+//   cargo metadata [--no-deps] [--locked] [--frozen] [--offline] [--format-version 1]   (with dependencies: --locked or --frozen)
+//   cargo fetch --locked
+//   cargo deny [--frozen] [--metadata-path <file>] [--config <file>] check              (each flag at most once, spaced form, nothing after `check`)
+//   cargo audit --db <dir> --no-fetch
+//   cargo fmt -p <unit> --check | cargo fmt --all --check                                 (command_policy.rs fmt_check_shape; check only, nothing after)
+//
+// Cargo's own `--config` and `-Z`, a `+toolchain`, `--manifest-path`, a `--` and every other word never ride along. The files deny reads and
+// the database directory audit reads are absolute, exist (a file; a directory) and lie outside the live checkout.
+import fs from "node:fs";
+import path from "node:path";
+import { BROKER_REFUSAL_STATUS, brokerSection, carryBrokerCargo } from "./snapshot-broker.mjs";
+
+export const CARRIED_METADATA_REFUSED = "RK_SNAPSHOT_CARRIED_REFUSED";
+
+const real = (p) => { try { return fs.realpathSync.native(p); } catch { return path.resolve(p); } };
+const within = (child, parent) => { const rel = path.relative(parent, child); return rel === "" || !(rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)); };
+
+/** The flags of `rest` as a Map (flag to value, or true); null when one repeats, is unknown (`--flag=value` included) or lacks its value. */
+function flagsOf(rest, spec) {
+  const found = new Map();
+  for (let i = 0; i < rest.length; i += 1) {
+    const w = rest[i];
+    if (!Object.hasOwn(spec, w) || found.has(w)) return null;
+    if (spec[w] === "value") {
+      const v = rest[i + 1];
+      if (typeof v !== "string" || v === "" || v.startsWith("-")) return null;
+      found.set(w, v); i += 1;
+    } else found.set(w, true);
+  }
+  return found;
+}
+
+/**
+ * Why the broker would not admit `words` (cargo's argv without `cargo`) as a carried read-only request, or null when it does. Without
+ * `checkout` only the shape (and that the named paths are absolute) is judged; with it (the live primary checkout) the files the call
+ * names must also exist, be of the right kind, and lie outside that checkout.
+ */
+export function carriedScanRefusal(words, { checkout = null } = {}) {
+  if (!Array.isArray(words) || !words.every((w) => typeof w === "string")) return "the argv is not a list of words";
+  const [sub, ...rest] = words;
+  const pathProblem = (flag, value, kind) => {
+    if (!path.isAbsolute(value)) return `${flag} ${value} is not absolute`;
+    if (checkout === null) return null;
+    let stat; try { stat = fs.statSync(value); } catch { return `${flag} ${value} does not exist`; }
+    if (kind === "file" ? !stat.isFile() : !stat.isDirectory()) return `${flag} ${value} is not ${kind === "file" ? "a file" : "a directory"}`;
+    return within(real(value), real(checkout)) ? `${flag} ${value} is inside the live checkout ${checkout}` : null;
+  };
+  if (sub === "metadata") {
+    const f = flagsOf(rest, { "--no-deps": "flag", "--locked": "flag", "--frozen": "flag", "--offline": "flag", "--format-version": "value" });
+    if (f === null) return "`metadata` takes only --no-deps, --locked, --frozen, --offline and --format-version 1, each once";
+    if (f.has("--format-version") && f.get("--format-version") !== "1") return "`metadata` takes --format-version 1 only";
+    if (!f.has("--no-deps") && !f.has("--locked") && !f.has("--frozen")) return "`metadata` with dependencies must be --locked or --frozen";
+    return null;
+  }
+  if (sub === "fetch") return rest.length === 1 && rest[0] === "--locked" ? null : "`fetch` is admitted as `fetch --locked` only";
+  if (sub === "deny") {
+    if (rest.at(-1) !== "check") return "`deny` must end with `check`, with nothing after it";
+    const f = flagsOf(rest.slice(0, -1), { "--frozen": "flag", "--metadata-path": "value", "--config": "value" });
+    if (f === null) return "`deny` takes only --frozen, --metadata-path <file> and --config <file> before `check`, each once, spaced form";
+    for (const flag of ["--metadata-path", "--config"]) if (f.has(flag)) { const problem = pathProblem(flag, f.get(flag), "file"); if (problem) return problem; }
+    return null;
+  }
+  // rustright command_policy.rs fmt_check_shape: exactly `-p <unit> --check` or `--all --check`; no `--`, so no rustfmt argument reaches it.
+  if (sub === "fmt") {
+    const shapeOk = (rest.length === 3 && rest[0] === "-p" && rest[1] !== "" && !rest[1].startsWith("-") && rest[2] === "--check") || (rest.length === 2 && rest[0] === "--all" && rest[1] === "--check");
+    return shapeOk ? null : "`fmt` is admitted as `fmt -p <unit> --check` or `fmt --all --check` only";
+  }
+  if (sub === "audit") {
+    const f = flagsOf(rest, { "--db": "value", "--no-fetch": "flag" });
+    if (f === null || f.size !== 2 || !f.has("--db") || !f.has("--no-fetch")) return "`audit` is admitted as `audit --db <dir> --no-fetch` only";
+    return pathProblem("--db", f.get("--db"), "directory");
+  }
+  // rustright command_policy.rs:407-409: class_a_scan "package" -> observation_only_cargo. Exactly: -p <unit> --list --locked [--allow-dirty].
+  if (sub === "package") {
+    const unit = rest[1];
+    // `-p <unit>` first, then --list and --locked and optionally --allow-dirty, each once in either order (the gate plans `--allow-dirty --locked`).
+    const tail = rest.slice(2);
+    const shapeOk = rest[0] === "-p" && typeof unit === "string" && unit !== "" && !unit.startsWith("-") && new Set(tail).size === tail.length && tail.every((w) => ["--list", "--locked", "--allow-dirty"].includes(w)) && tail.includes("--list") && tail.includes("--locked");
+    return shapeOk ? null : "`package` is admitted as `package -p <unit> --list --locked [--allow-dirty]` only";
+  }
+  return `\`cargo ${words.join(" ")}\` is not one of the carried read-only shapes (metadata, fetch --locked, deny, audit --db --no-fetch, fmt --check, package -p <unit> --list --locked)`;
+}
+
+/** Whether the broker admits `words` as a carried read-only request (see carriedScanRefusal). */
+export const carriedReadOnlyScan = (words, options) => carriedScanRefusal(words, options) === null;
+
+/**
+ * A `spawn(cmd, args, opts)` for the gate's Cargo calls in `snapshotRoot` on a broker host. A call to `cargoCommand` whose cwd is inside the
+ * snapshot becomes one carried read-only request (capture mode, a spawnSync-shaped result; `status` is non-zero when the call was refused or
+ * its signed receipt did not verify). Any other call passes to `spawn` unchanged (git, and Cargo in the primary checkout).
+ * `broker()` returns the gate's snapshot broker (built once); `records` collects each call's ledger record. `carrySpawn` (default `spawn`) is
+ * the synchronous spawn that starts the RustRight client and reads its receipt; `spawn` may be asynchronous for the pass-through calls.
+ */
+export function snapshotCargoSpawn({ spawn, carrySpawn = spawn, cargoCommand, snapshotRoot, broker, env, err = () => {}, records = [] }) {
+  const prefix = cargoCommand.slice(1);
+  const refused = (code, message) => { err(`rightkit-gate: ${code}: ${message}`); return { status: BROKER_REFUSAL_STATUS, signal: null, error: null, stdout: "", stderr: `rightkit-gate: ${code}: ${message}\n` }; };
+  return (cmd, args, opts = {}) => {
+    const cargo = cmd === cargoCommand[0] && prefix.every((w, i) => args[i] === w);
+    if (!cargo || typeof opts.cwd !== "string" || !within(real(opts.cwd), real(snapshotRoot))) return spawn(cmd, args, opts);
+    const words = args.slice(prefix.length);
+    const shape = carriedScanRefusal(words);
+    if (shape !== null) return refused(CARRIED_METADATA_REFUSED, `\`cargo ${words.join(" ")}\` would run inside the managed snapshot ${snapshotRoot}, and the broker admits only the carried read-only shapes there (${shape}); it is never sent as a root request`);
+    try {
+      const sb = broker();
+      // The named files are checked against the live checkout before anything is sent (absolute, existing, of the right kind, outside it).
+      const placed = carriedScanRefusal(words, { checkout: sb.checkout });
+      if (placed !== null) return refused(CARRIED_METADATA_REFUSED, `\`cargo ${words.join(" ")}\` names a path the broker would not admit (${placed}); it is not sent`);
+      const r = carryBrokerCargo({ words, cwd: opts.cwd, env: { ...env, ...(opts.env ?? {}) }, section: brokerSection(sb), workspace: real(snapshotRoot), checkoutWorkspace: sb.checkout, record: (e) => records.push(e), spawn: carrySpawn, err, stdio: "capture" });
+      return { status: r.status, signal: null, error: null, stdout: r.stdout, stderr: r.stderr };
+    } catch (e) { return refused(e.code ?? "RK_SNAPSHOT_BROKER", e.message); }
+  };
+}