@runuai/host 0.9.0 → 0.9.2

package/lib/github-git-auth.ts

@@ -0,0 +1,207 @@
+/**
+ * Ephemeral host-side Git credential for a task's initial mirror fetch.
+ *
+ * Projects/mirrors are shared, but GitHub credentials are per user and host.
+ * A private credential-cache socket keeps those boundaries intact: the token
+ * is seeded over stdin, only the non-secret socket path reaches task-up.sh,
+ * and the daemon + socket directory are removed as soon as task-up finishes.
+ */
+
+import { spawn } from "node:child_process";
+import { chmodSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+import { requestAccessToken } from "./github-tokens";
+
+// A derived-image build can legitimately keep task-up busy for well over 15
+// minutes before the first authenticated fetch. Keep the daemon available for
+// the bounded task-up lifetime; close() and user invalidation still terminate
+// it immediately once that operation settles.
+const CACHE_TIMEOUT_SECONDS = 6 * 60 * 60;
+const GIT_TIMEOUT_MS = 10_000;
+
+type GitRunner = (
+  args: string[],
+  input: string,
+) => Promise<{ status: number | null; stderr: string }>;
+
+const runGit: GitRunner = (args, input) =>
+  new Promise((resolve, reject) => {
+    const child = spawn("git", args, {
+      stdio: ["pipe", "ignore", "pipe"],
+      env: process.env,
+    });
+    let stderr = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), GIT_TIMEOUT_MS);
+    child.stderr.on("data", (chunk) => {
+      // Bound diagnostics; credential input is on stdin and never appears here.
+      if (stderr.length < 8_192) stderr += chunk.toString("utf8");
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (status) => {
+      clearTimeout(timer);
+      resolve({ status, stderr });
+    });
+    // If git exits before consuming the credential (spawn failure, malformed
+    // helper, timeout), the pipe may close first. The child status/error is
+    // authoritative; swallow EPIPE so it cannot become an unhandled event.
+    child.stdin.on("error", () => {});
+    child.stdin.end(input);
+  });
+
+export interface TaskGithubGitCredential {
+  /** Non-secret path consumed by task-up's isolated credential helper. */
+  socketPath: string;
+  /**
+   * Run the complete credential-using task-up operation under the user's
+   * disconnect/account-switch fence. A stale handle is rejected before the
+   * operation starts; invalidation waits for an already-started operation.
+   */
+  run<T>(operation: () => Promise<T>): Promise<T>;
+  /** Idempotently stop the daemon and remove its private directory. */
+  close(): Promise<void>;
+}
+
+interface PrepareDeps {
+  requestToken?: typeof requestAccessToken;
+  git?: GitRunner;
+  platform?: NodeJS.Platform;
+}
+
+const credentialGeneration = new Map<string, number>();
+const activeCredentials = new Map<string, Set<TaskGithubGitCredential>>();
+const activeCredentialOperations = new Map<string, Set<Promise<void>>>();
+
+function currentGeneration(userId: string): number {
+  return credentialGeneration.get(userId) ?? 0;
+}
+
+/**
+ * Invalidate every in-flight/active host fetch credential for a user. Used by
+ * Disconnect so its acknowledgement also covers task-up processes that were
+ * between token exchange and container reconciliation.
+ */
+export async function invalidateTaskGithubGitCredentials(
+  userId: string,
+): Promise<void> {
+  credentialGeneration.set(userId, currentGeneration(userId) + 1);
+  const operations = [...(activeCredentialOperations.get(userId) ?? [])];
+
+  // Let credential-using Git finish before stopping its helper daemon. The
+  // generation increment above prevents every old handle that has not started
+  // yet from entering run(), while operations already registered here drain.
+  await Promise.allSettled(operations);
+
+  const credentials = [...(activeCredentials.get(userId) ?? [])];
+  await Promise.allSettled(credentials.map((credential) => credential.close()));
+}
+
+/**
+ * Prepare the task owner's GitHub token for host-side HTTPS Git. Returns null
+ * when that user has not connected GitHub on this host, which selects the SSH
+ * fallback. Throws when a stored connection exists but cannot be prepared.
+ */
+export async function prepareTaskGithubGitCredential(
+  userId: string,
+  deps: PrepareDeps = {},
+): Promise<TaskGithubGitCredential | null> {
+  const generation = currentGeneration(userId);
+  const token = await (deps.requestToken ?? requestAccessToken)(userId);
+  if (!token) return null;
+  if (generation !== currentGeneration(userId)) {
+    throw new Error("GitHub credential changed while preparing task Git auth");
+  }
+  if ((deps.platform ?? process.platform) === "win32") {
+    throw new Error(
+      "GitHub host credentials require Unix sockets; run the Uai host agent in WSL or another Unix environment",
+    );
+  }
+
+  // credential-cache invokes its helper string through a shell. Use a
+  // controlled, whitespace-free Unix root so the socket never needs to carry
+  // user/TMPDIR-controlled shell syntax. The host task runner itself requires
+  // a Unix-like environment (bash + Unix sockets).
+  const directory = mkdtempSync(join("/tmp", "uai-git-credential-"));
+  chmodSync(directory, 0o700);
+  const socketPath = join(directory, "socket");
+  const helper = `credential.helper=cache --timeout=${CACHE_TIMEOUT_SECONDS} --socket=${socketPath}`;
+  const git = deps.git ?? runGit;
+  let closePromise: Promise<void> | null = null;
+
+  let taskCredential: TaskGithubGitCredential | null = null;
+  const close = async (): Promise<void> => {
+    if (!closePromise) {
+      closePromise = (async () => {
+        try {
+          await git(["credential-cache", `--socket=${socketPath}`, "exit"], "");
+        } finally {
+          rmSync(directory, { recursive: true, force: true });
+          if (taskCredential) {
+            const userCredentials = activeCredentials.get(userId);
+            userCredentials?.delete(taskCredential);
+            if (userCredentials?.size === 0) activeCredentials.delete(userId);
+          }
+        }
+      })();
+    }
+    await closePromise;
+  };
+
+  const run = async <T>(operation: () => Promise<T>): Promise<T> => {
+    if (generation !== currentGeneration(userId)) {
+      throw new Error("GitHub credential changed before task Git operation");
+    }
+    let finish!: () => void;
+    const fence = new Promise<void>((resolve) => {
+      finish = resolve;
+    });
+    const operations =
+      activeCredentialOperations.get(userId) ?? new Set<Promise<void>>();
+    operations.add(fence);
+    activeCredentialOperations.set(userId, operations);
+    try {
+      return await operation();
+    } finally {
+      finish();
+      operations.delete(fence);
+      if (operations.size === 0) activeCredentialOperations.delete(userId);
+    }
+  };
+
+  const credential = [
+    "protocol=https",
+    "host=github.com",
+    "username=x-access-token",
+    `password=${token.accessToken}`,
+    "",
+    "",
+  ].join("\n");
+
+  try {
+    const seeded = await git(
+      ["-c", "credential.helper=", "-c", helper, "credential", "approve"],
+      credential,
+    );
+    if (seeded.status !== 0) {
+      throw new Error(
+        `git credential cache setup failed: ${seeded.stderr.trim() || `exit ${seeded.status}`}`,
+      );
+    }
+    taskCredential = { socketPath, run, close };
+    if (generation !== currentGeneration(userId)) {
+      await close();
+      throw new Error("GitHub credential changed while preparing task Git auth");
+    }
+    const userCredentials =
+      activeCredentials.get(userId) ?? new Set<TaskGithubGitCredential>();
+    userCredentials.add(taskCredential);
+    activeCredentials.set(userId, userCredentials);
+    return taskCredential;
+  } catch (err) {
+    await close().catch(() => {});
+    throw err;
+  }
+}