@skydiveai/git-cache 0.1.0-beta.1635 → 0.1.0-beta.2411

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { f as startServer } from "./server-DfaJ_V9K.mjs";
+import { f as startServer } from "./server-DDcKo4yG.mjs";
 //#region src/cli.ts
 /**
 * `git-cache` CLI — the published binary for @skydiveai/git-cache.

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import http from "node:http";
 import * as _$node_stream0 from "node:stream";
 
 //#region src/server.d.ts

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as isProtocolV2Request, c as parseAdvertisement, d as shouldBackfillAfterPassthrough, f as startServer, i as explainRejection, l as parseUpstream, n as classifyUploadRequest, o as metricsSnapshot, r as copyRequestHeaders, s as mirrorHasObjects, t as SidebandPackExtractor, u as recordColdBuildOutcome } from "./server-DfaJ_V9K.mjs";
+import { a as isProtocolV2Request, c as parseAdvertisement, d as shouldBackfillAfterPassthrough, f as startServer, i as explainRejection, l as parseUpstream, n as classifyUploadRequest, o as metricsSnapshot, r as copyRequestHeaders, s as mirrorHasObjects, t as SidebandPackExtractor, u as recordColdBuildOutcome } from "./server-DDcKo4yG.mjs";
 export { SidebandPackExtractor, classifyUploadRequest, copyRequestHeaders, explainRejection, isProtocolV2Request, metricsSnapshot, mirrorHasObjects, parseAdvertisement, parseUpstream, recordColdBuildOutcome, shouldBackfillAfterPassthrough, startServer };

package/dist/{server-DfaJ_V9K.mjs → server-DDcKo4yG.mjs}

@@ -298,12 +298,12 @@ function evictAuthCache() {
 }
 function validateUpstream(credHeader, upstreamUrl) {
 	return new Promise((resolve) => {
-		const request = requestUpstream(new URL(`${upstreamUrl}/info/refs?service=git-upload-pack`), {
+		const target = new URL(`${upstreamUrl}/info/refs?service=git-upload-pack`);
+		const headers = { "user-agent": "git/git-cache-authz" };
+		if (credHeader !== null) headers["authorization"] = credHeader;
+		const request = requestUpstream(target, {
 			method: "GET",
-			headers: {
-				authorization: credHeader,
-				"user-agent": "git/git-cache-authz"
-			}
+			headers
 		}, (res) => {
 			res.resume();
 			const status = res.statusCode ?? 502;
@@ -341,7 +341,7 @@ function validateUpstream(credHeader, upstreamUrl) {
 	});
 }
 async function authorizeCheckThrough(credHeader, repo, upstreamUrl) {
-	const key = authMemoKey(credHeader, repo);
+	const key = authMemoKey(credHeader ?? "", repo);
 	const cached = authCache.get(key);
 	if (cached) {
 		const ttl = cached.allowed ? AUTH_ALLOW_TTL_MS : AUTH_DENY_TTL_MS;
@@ -437,14 +437,12 @@ function parseUpstream(rawPathname, rawSearch = "") {
 	const hadDotGit = Boolean(match[3]);
 	const operation = match[4];
 	let host = authority;
-	let port = 443;
 	const colon = authority.lastIndexOf(":");
 	if (colon !== -1) {
 		host = authority.slice(0, colon);
 		const p = authority.slice(colon + 1);
 		if (!/^\d{1,5}$/.test(p)) return null;
-		port = Number(p);
-		if (port !== 443) return null;
+		if (Number(p) !== 443) return null;
 	}
 	host = host.toLowerCase();
 	if (isIpLiteral(host)) return null;
@@ -1681,6 +1679,16 @@ async function proxyInfoRefs(req, res, repo, upstreamUrl, host, credHeader) {
 		}, cred);
 	});
 }
+function requestErrorContext(req) {
+	const rawTarget = req.url ?? "";
+	const target = (rawTarget.split("?", 1)[0] ?? "").replace(/^\/[^/?#@]+@/, "/[redacted]@").replace(/^(https?:\/\/)[^/?#@]+@/, "$1[redacted]@");
+	return {
+		method: req.method ?? null,
+		target,
+		targetLength: rawTarget.length,
+		peer: req.socket?.remoteAddress ?? null
+	};
+}
 async function handle(req, res) {
 	const parsed = new URL(req.url, "http://git-cache.local");
 	if (parsed.pathname === "/healthz") {
@@ -1737,16 +1745,15 @@ async function handle(req, res) {
 		if (config.authMode === "check-through") {
 			const header = req.headers["authorization"];
 			const raw = Array.isArray(header) ? header[0] : header;
-			if (!raw) {
-				metrics.auth_denials++;
-				res.writeHead(401, {
-					"Content-Type": "text/plain",
-					"WWW-Authenticate": "Basic realm=\"git-cache\""
-				});
-				return res.end("authentication required\n");
-			}
-			const verdict = await authorizeCheckThrough(raw, up.repo, up.upstreamUrl);
+			const verdict = await authorizeCheckThrough(raw ?? null, up.repo, up.upstreamUrl);
 			if (!verdict.allowed) {
+				if (!raw && (verdict.status === 401 || verdict.status === 403)) {
+					res.writeHead(401, {
+						"Content-Type": "text/plain",
+						"WWW-Authenticate": "Basic realm=\"git-cache\""
+					});
+					return res.end("authentication required\n");
+				}
 				log("info", "auth_denied", {
 					repo: up.repo,
 					status: verdict.status
@@ -1754,7 +1761,7 @@ async function handle(req, res) {
 				res.writeHead(verdict.status, { "Content-Type": "text/plain" });
 				return res.end("not authorized for this repository\n");
 			}
-			clientCred = raw;
+			clientCred = raw ?? null;
 		}
 		const host = up.repo.split("/")[0] ?? "";
 		let uploadBody = null;
@@ -1852,7 +1859,11 @@ async function startServer(options = {}) {
 	await cleanupQuarantine();
 	const server = http.createServer((req, res) => {
 		handle(req, res).catch((error) => {
-			log("error", "unhandled", { error: String(error) });
+			log("error", "unhandled", {
+				error: String(error),
+				stack: error instanceof Error ? error.stack : null,
+				...requestErrorContext(req)
+			});
 			if (!res.headersSent) res.writeHead(500);
 			res.end();
 		});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/git-cache",
-  "version": "0.1.0-beta.1635",
+  "version": "0.1.0-beta.2411",
   "description": "Sandbox-local Git smart-HTTP clone/fetch cache: a loopback daemon that transparently mirrors HTTPS git reads so repeated clone/fetch/ls-remote skip the origin round-trip. Runs inside an agent sandbox; pushes stay direct.",
   "homepage": "https://skydive.com",
   "license": "MIT",
@@ -20,15 +20,6 @@
     }
   },
   "publishConfig": {
-    "bin": {
-      "git-cache-daemon": "./dist/cli.mjs"
-    },
-    "exports": {
-      ".": {
-        "types": "./dist/index.d.mts",
-        "default": "./dist/index.mjs"
-      }
-    },
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },