@topline-build/harness-mcp 0.5.2 → 0.6.0

package/dist/source-checkout.js

@@ -0,0 +1,146 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { gunzipSync } from "node:zlib";
+export const MAX_SOURCE_ARCHIVE_BYTES = 64 * 1024 * 1024;
+const MAX_CONTENT_BYTES = 512 * 1024 * 1024;
+const MAX_FILES = 25_000;
+const BLOCK = 512;
+const forbiddenDirs = new Set([".git", "node_modules", ".next", ".vite", ".turbo", ".cache", "dist", "build", "coverage"]);
+/** All path rules apply on every host, including Windows aliases and devices. */
+export function safeSourcePath(raw) {
+    if (!raw || raw.startsWith("/") || raw.includes("\\"))
+        throw new Error("artifact_source_path_invalid");
+    const segments = raw.replace(/^\.\//, "").split("/");
+    if (segments.at(-1) === "")
+        segments.pop();
+    if (!segments.length || segments.length > 64 || segments.some(part => !part || part === "." || part === ".." || /[\u0000-\u001f\u007f:]/u.test(part) || /[. ]$/.test(part) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)))
+        throw new Error("artifact_source_path_invalid");
+    if (segments.some(part => forbiddenDirs.has(part.toLowerCase()) || part.toLowerCase().startsWith(".env") || /(?:\.(?:pem|key|p12|pfx)|^\.?(?:credentials|netrc|npmrc|aws|ssh)$)/i.test(part)))
+        throw new Error("artifact_source_credential_or_cache_forbidden");
+    return segments.join("/");
+}
+function text(header, offset, length) {
+    const field = header.subarray(offset, offset + length);
+    const nul = field.indexOf(0);
+    return field.subarray(0, nul < 0 ? field.length : nul).toString("utf8");
+}
+function octal(header, offset, length) {
+    const value = text(header, offset, length).trim();
+    if (!/^[0-7]+$/.test(value))
+        throw new Error("artifact_source_tar_invalid");
+    const number = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(number) || number < 0)
+        throw new Error("artifact_source_tar_invalid");
+    return number;
+}
+/** Extract only regular files into a task-created empty staging directory. */
+export async function extractArtifactSourceArchive(body, stagingRoot) {
+    if (!body.length || body.length > MAX_SOURCE_ARCHIVE_BYTES)
+        throw new Error("artifact_source_transfer_too_large");
+    let tar;
+    try {
+        tar = gunzipSync(body, { maxOutputLength: MAX_CONTENT_BYTES + MAX_FILES * 1024 });
+    }
+    catch {
+        throw new Error("artifact_source_archive_invalid");
+    }
+    let position = 0;
+    let fileCount = 0;
+    let byteCount = 0;
+    let ended = false;
+    let entryCount = 0;
+    const files = new Set();
+    const dirs = new Set();
+    const paths = new Map();
+    while (position + BLOCK <= tar.length) {
+        const header = tar.subarray(position, position + BLOCK);
+        position += BLOCK;
+        if (header.every(byte => byte === 0)) {
+            if (position + BLOCK > tar.length || !tar.subarray(position).every(byte => byte === 0))
+                throw new Error("artifact_source_tar_invalid");
+            ended = true;
+            break;
+        }
+        if (++entryCount > MAX_FILES * 2)
+            throw new Error("artifact_source_unpacked_too_large");
+        const expectedChecksum = octal(header, 148, 8);
+        const checksum = header.reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
+        if (checksum !== expectedChecksum || text(header, 257, 6) !== "ustar")
+            throw new Error("artifact_source_tar_invalid");
+        const prefix = text(header, 345, 155);
+        const rawName = `${prefix ? prefix + "/" : ""}${text(header, 0, 100)}`;
+        const size = octal(header, 124, 12);
+        const padded = Math.ceil(size / BLOCK) * BLOCK;
+        if (position + padded > tar.length)
+            throw new Error("artifact_source_tar_invalid");
+        const kind = String.fromCharCode(header[156]);
+        if ((rawName === "." || rawName === "./") && kind === "5" && size === 0)
+            continue;
+        const relative = safeSourcePath(rawName);
+        const key = relative.toLowerCase();
+        const segments = relative.split("/");
+        for (let length = 1; length <= segments.length; length++) {
+            const actual = segments.slice(0, length).join("/");
+            const canonical = actual.toLowerCase();
+            if (paths.has(canonical) && paths.get(canonical) !== actual)
+                throw new Error("artifact_source_duplicate_path");
+            paths.set(canonical, actual);
+        }
+        if (paths.size > MAX_FILES * 2)
+            throw new Error("artifact_source_unpacked_too_large");
+        if (kind !== "0" && kind !== "\0" && kind !== "5")
+            throw new Error("artifact_source_entry_type_forbidden");
+        if (files.has(key) || dirs.has(key))
+            throw new Error("artifact_source_duplicate_path");
+        const ancestors = key.split("/").slice(0, -1);
+        if (ancestors.some((_, index) => files.has(ancestors.slice(0, index + 1).join("/"))))
+            throw new Error("artifact_source_duplicate_path");
+        const output = path.resolve(stagingRoot, relative);
+        const diff = path.relative(stagingRoot, output);
+        if (diff === ".." || diff.startsWith(`..${path.sep}`) || path.isAbsolute(diff))
+            throw new Error("artifact_source_path_invalid");
+        if (kind === "5") {
+            if (size !== 0)
+                throw new Error("artifact_source_tar_invalid");
+            dirs.add(key);
+            await mkdir(output, { recursive: true, mode: 0o700 });
+        }
+        else {
+            if (++fileCount > MAX_FILES || (byteCount += size) > MAX_CONTENT_BYTES)
+                throw new Error("artifact_source_unpacked_too_large");
+            files.add(key);
+            await mkdir(path.dirname(output), { recursive: true, mode: 0o700 });
+            await writeFile(output, tar.subarray(position, position + size), { flag: "wx", mode: 0o600 });
+        }
+        position += padded;
+    }
+    if (!ended || !fileCount)
+        throw new Error("artifact_source_archive_invalid");
+    return { fileCount, byteCount, sha256: createHash("sha256").update(body).digest("hex") };
+}
+export async function boundedTransfer(response, maxBytes, expectedSize) {
+    const rawLength = response.headers.get("content-length");
+    const declared = rawLength === null ? null : Number(rawLength);
+    if (declared !== null && (!Number.isSafeInteger(declared) || declared < 0 || declared > maxBytes || (expectedSize !== undefined && declared !== expectedSize)))
+        throw new Error("build_transfer_size_invalid");
+    if (!response.body)
+        throw new Error("build_transfer_size_invalid");
+    const chunks = [];
+    let total = 0;
+    const reader = response.body.getReader();
+    for (;;) {
+        const part = await reader.read();
+        if (part.done)
+            break;
+        total += part.value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            throw new Error("build_transfer_size_invalid");
+        }
+        chunks.push(Buffer.from(part.value));
+    }
+    if ((!total && expectedSize !== 0) || (declared !== null && total !== declared) || (expectedSize !== undefined && total !== expectedSize))
+        throw new Error("build_transfer_size_invalid");
+    return Buffer.concat(chunks);
+}