@vantran-se/openchamber-web 2.0.3 → 2.0.5

package/server/lib/spaces/code-in-bait.js

@@ -1,5 +1,6 @@
-// Test support, never imported by product code. The bait repository and the host state that code
-// in must leave byte-identical, shared by code-in.test.js and places/code-in.docker.live.test.js.
+// Test support, never imported by product code. The bait repository, the host state that code in
+// and code out must leave byte-identical, and a stand-in for a space in a local folder, shared by
+// code-in.test.js, code-out.test.js and the live files under places/.
 
 import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
@@ -7,8 +8,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+import { expect } from 'vitest';
+
 import { createCodeIn } from './code-in.js';
+import { createCodeOut } from './code-out.js';
+import { SpaceError } from './errors.js';
 import { createHostGit, hostGitEnvironment } from './host-git.js';
+import { IMAGE_ONLY_PATH, IMAGE_SH, IMAGE_TIMEOUT } from './layout.js';
 import { runCommand } from './run-command.js';
 
 const WIN = process.platform === 'win32';
@@ -64,7 +70,11 @@ export function createTestHost({ config = '', identity = true, ownHome = true }
   };
   // Config that would break the setup itself goes in afterwards.
   const addConfig = (text) => fs.appendFileSync(globalConfig, `\n${text}\n`);
-  return { root, environment, git, sh, addConfig, codeIn: (place = null, options = {}) => createCodeIn({ git, place, temporaryDirectory: root, ...options }) };
+  return {
+    root, environment, git, sh, addConfig,
+    codeIn: (place = null, options = {}) => createCodeIn({ git, place, temporaryDirectory: root, ...options }),
+    codeOut: (place = null, options = {}) => createCodeOut({ git, place, temporaryDirectory: root, ...options }),
+  };
 }
 
 /** The bait repository: every kind of change and every kind of file that must or must not travel. */
@@ -162,7 +172,16 @@ export const hostState = (directory) => {
 //    a nested repository's `.git`, is a difference like any other;
 // 2. the start ref of the spaces named, `.git/refs/openchamber/spaces/<id>/start`, with the three
 //    folders git makes for it, added or removed. A start ref that moved to another commit is a difference.
+// With `codeOut`, also what code out writes by design:
+// 3. new packs, which a fetch writes when it brings many objects, as additions only;
+// 4. the result ref of the spaces named, `.git/refs/openchamber/spaces/<id>/result`, the ref of what
+//    the last apply as uncommitted changes wrote, `.../applied`, the intent written while an apply
+//    runs, `.../applying`, what the patch of each was built from, `.../applied-from` and
+//    `.../applying-from`, the user's HEAD at each, `.../applied-head` and `.../applying-head`, and the
+//    one that says this space is applied as a branch from now on,
+//    `.../changes-closed`, added, removed or moved, because a later call moves each of them.
 const LOOSE_OBJECT = /^\.git\/objects\/[0-9a-f]{2}(?:\/(?:[0-9a-f]{38}|[0-9a-f]{62}))?$/;
+const NEW_PACK = /^\.git\/objects\/pack\/pack-(?:[0-9a-f]{40}|[0-9a-f]{64})\.(?:pack|idx|rev)$/;
 const spaceRefPaths = (spaceId) => [
   '.git/refs/openchamber',
   '.git/refs/openchamber/spaces',
@@ -170,16 +189,136 @@ const spaceRefPaths = (spaceId) => [
   `.git/refs/openchamber/spaces/${spaceId}/start`,
 ];
 
-/** The paths that differ between two `hostState`s, apart from what code in writes by design for `spaceIds`. */
-export const unexpectedChanges = (before, after, { spaceIds = [] } = {}) => {
+/**
+ * The paths that differ between two `hostState`s, apart from what code in writes by design for
+ * `spaceIds`, and with `codeOut: true` also what code out writes by design for them.
+ */
+export const unexpectedChanges = (before, after, { spaceIds = [], codeOut = false } = {}) => {
   const ownRefs = new Set(spaceIds.flatMap(spaceRefPaths));
+  const resultRefs = new Set(codeOut
+    ? spaceIds.flatMap((spaceId) => ['result', 'applied', 'applied-from', 'applied-head', 'applying', 'applying-from', 'applying-head', 'changes-closed'].map((name) => `.git/refs/openchamber/spaces/${spaceId}/${name}`))
+    : []);
   const names = new Set([...Object.keys(before), ...Object.keys(after)]);
   return [...names].filter((name) => {
     if (before[name] === after[name]) return false;
+    if (resultRefs.has(name)) return false;
     const addedOrRemoved = before[name] === undefined || after[name] === undefined;
     if (ownRefs.has(name) && addedOrRemoved) return false;
-    return !(before[name] === undefined && LOOSE_OBJECT.test(name));
+    const added = before[name] === undefined;
+    if (added && codeOut && NEW_PACK.test(name)) return false;
+    return !(added && LOOSE_OBJECT.test(name));
   }).sort();
 };
 
 export const shortStatus = (g) => g(['--no-optional-locks', 'status', '--porcelain=v1', '--untracked-files=all']);
+
+// The other end of a push or fetch, standing in for `docker exec ... git receive-pack` or
+// `git upload-pack` in a real space. It checks that the host wrote out the fixed command, and maps
+// /spaces/ into a local folder. `slow` sends what upload-pack sends at about 3 MB/s, and every run
+// records how its git ended in `<service>.exit`, which a killed run never writes.
+const RECEIVER = `
+const { spawn } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+const [root, behaviour, services, ...command] = process.argv.slice(2);
+const [timeoutPath, dashS, signal, seconds, gitPath, service, target] = command;
+if (command.length !== 7 || timeoutPath !== '/usr/bin/timeout' || dashS !== '-s' || signal !== 'KILL' || !/^[0-9]+$/.test(seconds)
+  || gitPath !== '/usr/bin/git' || !services.split(',').includes(service) || !target.startsWith('/spaces/')) {
+  process.stderr.write('unexpected command ' + JSON.stringify(command) + '\\n');
+  process.exit(2);
+}
+fs.writeFileSync(path.join(root, 'last-command.json'), JSON.stringify(command));
+fs.appendFileSync(path.join(root, 'commands.log'), target + '\\n');
+if (behaviour === 'refuse') { process.stderr.write('refused by the space\\n'); process.exit(1); }
+if (behaviour === 'flood') {
+  const chunk = 'x'.repeat(65536);
+  const pump = () => { while (process.stderr.write(chunk)) {} process.stderr.once('drain', pump); };
+  pump();
+} else if (behaviour === 'hang') {
+  const grandchild = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+  fs.writeFileSync(path.join(root, 'hang.pid'), String(grandchild.pid));
+  setInterval(() => {}, 1000);
+} else {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')));
+  const slow = behaviour === 'slow';
+  const child = spawn('git', [service, path.join(root, target)], {
+    stdio: ['inherit', slow ? 'pipe' : 'inherit', 'inherit'],
+    env: { ...env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: ${JSON.stringify(os.devNull)} },
+  });
+  if (slow) {
+    child.stdout.on('data', (chunk) => {
+      child.stdout.pause();
+      process.stdout.write(chunk);
+      setTimeout(() => child.stdout.resume(), Math.ceil(chunk.length / 3000));
+    });
+  }
+  // The receiver ends by itself once git has closed and everything is written.
+  child.on('close', (code) => {
+    fs.writeFileSync(path.join(root, service + '.exit'), String(code));
+    process.exitCode = code ?? 1;
+  });
+}
+`;
+
+/**
+ * A stand-in place for one space in a local folder. `exec` runs the module's fixed scripts with the
+ * host's `sh` and `git`, with /spaces/ mapped into the folder and a `timeout` that only drops its
+ * limit, since the host may have none; a script may come under the image's `timeout` itself.
+ * `execArgv` points at RECEIVER, kept in a folder whose name has a space and a percent sign, so the
+ * ext escaping is exercised through git itself. `setBehaviour` changes what the next transfer meets.
+ * POSIX only: the scripts run with `/bin/sh`.
+ *
+ * Without `codeOut` it stands in for code in alone, and is as strict as code in: only `receive-pack`,
+ * and no script wrapped in the image's `timeout`. With it, `upload-pack` and a wrapped script are
+ * allowed too, and the wrapper's seconds are checked.
+ */
+export function createLocalPlace(host, behaviour = 'receive', spaceId = 'a1b2c3d4e5f6', { codeOut = false } = {}) {
+  const root = path.join(host.root, 'stand in 50% place');
+  const bin = path.join(root, 'bin');
+  fs.mkdirSync(path.join(root, 'spaces', spaceId), { recursive: true });
+  fs.mkdirSync(bin);
+  const receiver = path.join(root, 'receiver.cjs');
+  fs.writeFileSync(receiver, RECEIVER);
+  fs.writeFileSync(path.join(bin, 'timeout'), '#!/bin/sh\nshift 3\nexec "$@"\n', { mode: 0o755 });
+  const emptyConfig = path.join(root, 'inside-gitconfig');
+  fs.writeFileSync(emptyConfig, '');
+  const insideEnvironment = { PATH: `${bin}${path.delimiter}${process.env.PATH}`, HOME: root, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: emptyConfig };
+  const local = (inside) => path.join(root, inside);
+  let current = behaviour;
+  return {
+    root,
+    local,
+    setBehaviour: (next) => { current = next; },
+    inside: (args, { env = {}, input } = {}) => {
+      const result = spawnSync('git', args, { env: { ...insideEnvironment, ...env }, input, encoding: 'utf8' });
+      return { code: result.status, stdout: result.stdout, stderr: result.stderr };
+    },
+    lastCommand: () => JSON.parse(fs.readFileSync(path.join(root, 'last-command.json'), 'utf8')),
+    /** How many pushes reached the history side repository. */
+    historyPushes: () => (fs.existsSync(path.join(root, 'commands.log')) ? fs.readFileSync(path.join(root, 'commands.log'), 'utf8').split('\n').filter((line) => line.endsWith('.openchamber-history.git')).length : 0),
+    hangPid: () => Number(fs.readFileSync(path.join(root, 'hang.pid'), 'utf8')),
+    /** How the last upload-pack ended, or null when it was killed before it could say. */
+    uploadPackExit: () => (fs.existsSync(path.join(root, 'upload-pack.exit')) ? fs.readFileSync(path.join(root, 'upload-pack.exit'), 'utf8') : null),
+    place: {
+      execArgv: async (id) => {
+        if (id !== spaceId) throw new SpaceError('space_not_found', 'no such space');
+        return [process.execPath, receiver, path.join(root), current, codeOut ? 'receive-pack,upload-pack' : 'receive-pack'];
+      },
+      exec: async (id, argv, { timeoutMs }) => {
+        const wrapped = argv[0] === IMAGE_TIMEOUT;
+        const unlimited = wrapped ? argv.slice(4) : argv;
+        if (wrapped) {
+          expect(codeOut, 'code in runs no script under the image timeout').toBe(true);
+          expect(argv.slice(1, 3)).toEqual(['-s', 'KILL']);
+          expect(Number(argv[3]), 'the seconds of the inner limit').toBeGreaterThan(0);
+        }
+        const [shell, flag, script, zero, ...args] = unlimited;
+        expect([shell, flag, zero]).toEqual([IMAGE_SH, '-c', 'sh']);
+        expect(script.startsWith(IMAGE_ONLY_PATH)).toBe(true);
+        // Quoted: the stand-in's folder name has a space in it, which the image's own PATH never has.
+        const localScript = `PATH='${insideEnvironment.PATH}';${script.slice(IMAGE_ONLY_PATH.length)}`;
+        return runCommand('/bin/sh', ['-c', localScript, zero, ...args.map((arg) => (arg.startsWith('/spaces/') ? local(arg) : arg))], { env: insideEnvironment, timeoutMs });
+      },
+    },
+  };
+}

package/server/lib/spaces/code-in.js

@@ -10,9 +10,12 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
+import {
+  EXT_UNCARRIABLE, INNER_MARGIN_SECONDS, SNAPSHOT_IDENTITY, buildExtUrl, createTransferSession, innerSeconds, line,
+  objectIdPattern, requireInnerMargin, requireTimeout, spaceRefPrefix, startRef, zeroObjectId,
+} from './code-transfer.js';
 import { SpaceError } from './errors.js';
 import { tail } from './exec-http.js';
-import { isGitVersionAtLeast, parseGitVersion } from './host-git.js';
 import { requireSpaceId } from './labels.js';
 import { IMAGE_GIT, IMAGE_ONLY_PATH, IMAGE_SH, IMAGE_TIMEOUT, requireSpaceProjectPath, spaceHistoryPath, spaceProjectPath } from './layout.js';
 
@@ -23,28 +26,9 @@ const HISTORY_TIMEOUT_MS = 30 * 60_000;
 // A push prints nothing with `--quiet`. What it does print comes from the receiving side, which
 // is the space. More than this, and the transfer is killed like a hanging one.
 const PUSH_MAX_OUTPUT_BYTES = 1024 * 1024;
-// The limit inside is the host's limit plus this margin, so it never ends a push the host still
-// waits for, and a push the host killed leaves nothing running inside once it passes.
-const INNER_MARGIN_SECONDS = 5;
-const MAX_INNER_MARGIN_SECONDS = 3600;
 const INSIDE_TIMEOUT_MS = 5 * 60_000;
-// The oldest host git code in works with. `git init --object-format` first appears in the git-init
-// manual of 2.27.0; `rev-parse --show-object-format` and `add --pathspec-from-file` in 2.25.0; every
-// other option used here is older. See DOCUMENTATION.md, "Host git".
-const GIT_VERSION_FLOOR = Object.freeze({ major: 2, minor: 27, patch: 0 });
-const GIT_VERSION_FLOOR_TEXT = '2.27';
-
-// The snapshot commits carry a fixed identity, so a user without `user.name` can still create a space.
-const SNAPSHOT_IDENTITY = Object.freeze({
-  GIT_AUTHOR_NAME: 'OpenChamber',
-  GIT_AUTHOR_EMAIL: 'spaces@openchamber.invalid',
-  GIT_COMMITTER_NAME: 'OpenChamber',
-  GIT_COMMITTER_EMAIL: 'spaces@openchamber.invalid',
-});
 
 const MODES = new Set(['uncommitted', 'clean']);
-// A git `ext::` URL splits on spaces itself and cannot carry these at all.
-const EXT_UNCARRIABLE = /[\x00-\x1f\x7f]/;
 // A value that is copied into the space's git config: one line, and short.
 const COPYABLE_VALUE = /^[^\x00-\x1f\x7f]{1,256}$/;
 
@@ -53,9 +37,6 @@ const INSIDE_BASE = 'refs/openchamber/base';
 const INSIDE_START_INDEX = 'refs/openchamber/start-index';
 const INSIDE_START = 'refs/openchamber/start';
 
-const spaceRefPrefix = (spaceId) => `refs/openchamber/spaces/${requireSpaceId(spaceId)}/`;
-const startRef = (spaceId) => `${spaceRefPrefix(spaceId)}start`;
-
 // The fixed scripts that run inside the space. Every value is a positional argument.
 // Exit code 3 of the init script means the project path is already there.
 const PATH_IN_USE_EXIT_CODE = 3;
@@ -91,52 +72,6 @@ const UNSHALLOW_SCRIPT = [
 ].join(' ');
 const REMOVE_SIDE_SCRIPT = `${IMAGE_ONLY_PATH} rm -rf "$1"`;
 
-// One line of git output, without its line end.
-const line = (text) => text.replace(/\r?\n$/, '');
-const zeroObjectId = (objectFormat) => '0'.repeat(objectFormat === 'sha256' ? 64 : 40);
-const objectIdPattern = (objectFormat) => (objectFormat === 'sha256' ? /^[0-9a-f]{64}$/ : /^[0-9a-f]{40}$/);
-const innerSeconds = (timeoutMs, marginSeconds) => Math.ceil(timeoutMs / 1000) + marginSeconds;
-
-const MIN_TIMEOUT_MS = 1_000;
-const MAX_TIMEOUT_MS = 24 * 60 * 60_000;
-
-/** The host's limit on a push, in whole milliseconds from a second to a day. */
-const requireTimeout = (value) => {
-  if (!Number.isInteger(value) || value < MIN_TIMEOUT_MS || value > MAX_TIMEOUT_MS) {
-    throw new SpaceError('invalid_timeout', `The time limit of a transfer is a whole number of milliseconds from ${MIN_TIMEOUT_MS} to ${MAX_TIMEOUT_MS}`);
-  }
-  return value;
-};
-
-/** The margin between the host's limit and the one inside, in whole seconds: a length, and nothing else. */
-const requireInnerMargin = (value) => {
-  if (!Number.isInteger(value) || value < 1 || value > MAX_INNER_MARGIN_SECONDS) {
-    throw new SpaceError('invalid_inner_margin', `The margin of the limit inside the space is a whole number of seconds from 1 to ${MAX_INNER_MARGIN_SECONDS}`);
-  }
-  return value;
-};
-
-/**
- * A git `ext::` URL for an argv. git-remote-ext splits the text after `ext::` on spaces itself, so a
- * space inside an argument is written `% ` and a percent `%%`, as its documentation says. The docker
- * CLI on Windows can live under a path with spaces. An empty argument or one with a control
- * character cannot be carried, and is refused. The URL goes to git as one argv element, never
- * through a shell.
- */
-export function buildExtUrl(argv) {
-  if (!Array.isArray(argv) || argv.length === 0) {
-    throw new SpaceError('invalid_ext_argument', 'A command for git is a non-empty list of arguments');
-  }
-  const escaped = argv.map((argument) => {
-    const text = String(argument);
-    if (text === '' || EXT_UNCARRIABLE.test(text)) {
-      throw new SpaceError('invalid_ext_argument', 'A command for git cannot carry an empty argument or a control character');
-    }
-    return text.replaceAll('%', '%%').replaceAll(' ', '% ');
-  });
-  return `ext::${escaped.join(' ')}`;
-}
-
 /** The receiving side of a push into the space: fixed programs by absolute path, under the space's own time limit. */
 const receivePackUrl = (execArgv, seconds, target) => buildExtUrl([
   ...execArgv, IMAGE_TIMEOUT, '-s', 'KILL', String(seconds), IMAGE_GIT, 'receive-pack', target,
@@ -181,86 +116,8 @@ const asHistoryFailure = (error, step) => {
   return new SpaceError('history_transfer_failed', ours ? error.message : `The history failed on the host: ${error.message}`, details);
 };
 
-const removeWithRetries = (directory) => fs.rm(directory, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
-
-export function createCodeIn({ git, place, temporaryDirectory = os.tmpdir(), removeDirectory = removeWithRetries }) {
-  /**
-   * Runs `work(g, directory)` with a temporary directory and a host git `g` that starts nothing of
-   * the user's. `core.hooksPath` points at an empty folder of ours: without it the user's
-   * `post-index-change` hook ran three times per snapshot, with `GIT_INDEX_FILE` pointing at our
-   * copy, and their `reference-transaction` hook ran on every write of our ref. `core.fsmonitor` is
-   * empty: a user's fsmonitor program ran ten times per snapshot, and `core.fsmonitor=true` left a
-   * `git fsmonitor--daemon` running on the host with its files in the user's `.git`. Empty, and not
-   * `false`, because before git 2.36 the value is a command path, where `false` names a program.
-   *
-   * A failure that is not a SpaceError becomes one with `failureCode`. Removing the folder is retried,
-   * and it never replaces the error of the work: when it still fails, the error says which folder was
-   * left in `details.temporaryDirectoryLeft`. After a successful call a leftover folder is let go.
-   */
-  const withHostGit = async (failureCode, work) => {
-    let directory;
-    try {
-      directory = await fs.mkdtemp(path.join(temporaryDirectory, 'openchamber-code-in-'));
-    } catch (error) {
-      throw new SpaceError(failureCode, `Could not make a temporary folder for code in: ${error.message}`, { step: 'make a temporary folder', cause: error.code ?? null });
-    }
-    let outcome;
-    let failed = false;
-    try {
-      const hooks = path.join(directory, 'no-hooks');
-      await fs.mkdir(hooks);
-      const isolated = ['-c', `core.hooksPath=${hooks.replaceAll('\\', '/')}`, '-c', 'core.fsmonitor='];
-      const g = {
-        run: (where, args, options) => git.run(where, [...isolated, ...args], options),
-        output: (where, args, options) => git.output(where, [...isolated, ...args], options),
-      };
-      outcome = await work(g, directory);
-    } catch (error) {
-      failed = true;
-      outcome = error instanceof SpaceError
-        ? error
-        : new SpaceError(failureCode, `Code in failed on the host: ${error.message}`, { step: 'host side', cause: error.code ?? null });
-    }
-    const left = await removeDirectory(directory).then(() => false, () => true);
-    if (failed) {
-      if (left) outcome.details = { ...outcome.details, temporaryDirectoryLeft: directory };
-      throw outcome;
-    }
-    return outcome;
-  };
-
-  /** Refuses a host git older than the floor, with the version it needs. */
-  const requireGitVersion = async (g, directory) => {
-    const unreadable = (cause) => new SpaceError('git_version_unreadable', 'Could not tell which git this computer has. Code in needs git to be installed and working.', { cause });
-    let result;
-    try {
-      result = await g.run(directory, ['version']);
-    } catch (error) {
-      // A git that cannot be started at all, missing among them.
-      throw unreadable(error.code ?? null);
-    }
-    const version = result.code === 0 ? parseGitVersion(result.stdout) : null;
-    if (!version) {
-      throw unreadable(null);
-    }
-    if (!isGitVersionAtLeast(version, GIT_VERSION_FLOOR)) {
-      throw new SpaceError('git_too_old', `Code in needs git ${GIT_VERSION_FLOOR_TEXT} or newer, and this computer has git ${version.major}.${version.minor}.${version.patch}. Update git, then create the space.`, { version });
-    }
-  };
-
-  /** The top level of the work tree that `repository` is in, as a native path, or a refusal. */
-  const requireWorkTree = async (g, repository) => {
-    const found = await fs.stat(repository).then((stats) => stats.isDirectory(), () => false);
-    if (!found) {
-      throw new SpaceError('project_folder_missing', `${repository} does not exist, or is not a folder.`);
-    }
-    const inside = await g.run(repository, ['rev-parse', '--is-inside-work-tree']);
-    if (inside.code !== 0 || line(inside.stdout) !== 'true') {
-      throw new SpaceError('not_a_git_work_tree', `${repository} is not inside a git working tree. Code can travel into a space only from a git repository.`);
-    }
-    // git answers with forward slashes on Windows too.
-    return path.resolve(line(await g.output(repository, ['rev-parse', '--show-toplevel'])));
-  };
+export function createCodeIn({ git, place, temporaryDirectory = os.tmpdir(), removeDirectory }) {
+  const { withHostGit, requireGitVersion, requireWorkTree } = createTransferSession({ git, temporaryDirectory, removeDirectory, name: 'code in' });
 
   /** What a transfer needs to know about the repository, after the refusals that come first. */
   const inspectRepository = async (g, repository) => {
@@ -425,7 +282,10 @@ export function createCodeIn({ git, place, temporaryDirectory = os.tmpdir(), rem
    */
   const takeSnapshot = (request) => withHostGit('code_in_failed', (g, directory) => snapshot(g, directory, request ?? {}));
 
-  /** Deletes every host ref of this space under `refs/openchamber/spaces/<id>/`, in one transaction. Resolves the deleted names. */
+  /**
+   * Deletes every host ref of this space under `refs/openchamber/spaces/<id>/`, in one transaction: the
+   * start of code in and the result of code out. Resolves the deleted names.
+   */
   const removeSpaceRefs = (request) => withHostGit('code_in_failed', async (g) => {
     const { repository, spaceId } = request ?? {};
     requireSpaceId(spaceId);

package/server/lib/spaces/code-in.test.js

@@ -9,11 +9,11 @@ import path from 'node:path';
 
 import { afterAll, describe, expect, it } from 'vitest';
 
-import { SECRET, SETUP_GIT, blob, createTestHost, forConfig, hostState, makeBait, readTree, removeTestHosts, shortStatus, unexpectedChanges } from './code-in-bait.js';
-import { buildExtUrl, createCodeIn } from './code-in.js';
+import { SECRET, SETUP_GIT, blob, createLocalPlace, createTestHost, forConfig, hostState, makeBait, readTree, removeTestHosts, shortStatus, unexpectedChanges } from './code-in-bait.js';
+import { createCodeIn } from './code-in.js';
+import { buildExtUrl } from './code-transfer.js';
 import { SpaceError } from './errors.js';
 import { createHostGit } from './host-git.js';
-import { IMAGE_ONLY_PATH, IMAGE_SH } from './layout.js';
 import { runCommand } from './run-command.js';
 
 const WIN = process.platform === 'win32';
@@ -441,6 +441,7 @@ describe('the git version floor', () => {
   });
 
   it.each([
+    ['git version 2.28.1\n', 'git_too_old'],
     ['git version 2.26.2\n', 'git_too_old'],
     ['git version 1.9.5\n', 'git_too_old'],
     ['something else\n', 'git_version_unreadable'],
@@ -451,14 +452,14 @@ describe('the git version floor', () => {
     const codeIn = createCodeIn({ git: gitAnswering(host, text), place: null, temporaryDirectory: host.root });
     const failure = await codeIn.takeSnapshot({ repository: repo, spaceId: SPACE_ID, mode: 'uncommitted' }).catch((error) => error);
     expect(failure).toMatchObject({ code });
-    if (code === 'git_too_old') expect(failure.message).toMatch(/needs git 2\.27 or newer/);
+    if (code === 'git_too_old') expect(failure.message).toMatch(/needs git 2\.29 or newer/);
     expect(changedSince(before, repo, [])).toEqual([]);
   });
 
-  it('lets 2.27.0 and every build suffix through, and refuses an old git for the history too', async () => {
+  it('lets 2.29.0 and every build suffix through, and refuses an old git for the history too', async () => {
     const host = createTestHost();
     const { repo } = makeBait(host);
-    for (const text of ['git version 2.27.0\n', 'git version 2.50.1 (Apple Git-155)\n', 'git version 2.54.0.windows.1\n']) {
+    for (const text of ['git version 2.29.0\n', 'git version 2.50.1 (Apple Git-155)\n', 'git version 2.54.0.windows.1\n']) {
       const codeIn = createCodeIn({ git: gitAnswering(host, text), place: null, temporaryDirectory: host.root });
       await codeIn.takeSnapshot({ repository: repo, spaceId: SPACE_ID, mode: 'clean' });
       await codeIn.removeSpaceRefs({ repository: repo, spaceId: SPACE_ID });
@@ -605,83 +606,6 @@ describe('failures keep their codes', () => {
   });
 });
 
-// The receiving side of a push, standing in for `docker exec ... git receive-pack` in a real space.
-// It checks that the host wrote out the fixed command, and maps /spaces/ into a local folder.
-const RECEIVER = `
-const { spawn } = require('node:child_process');
-const fs = require('node:fs');
-const path = require('node:path');
-const [root, behaviour, ...command] = process.argv.slice(2);
-const [timeoutPath, dashS, signal, seconds, gitPath, service, target] = command;
-if (command.length !== 7 || timeoutPath !== '/usr/bin/timeout' || dashS !== '-s' || signal !== 'KILL' || !/^[0-9]+$/.test(seconds)
-  || gitPath !== '/usr/bin/git' || service !== 'receive-pack' || !target.startsWith('/spaces/')) {
-  process.stderr.write('unexpected command ' + JSON.stringify(command) + '\\n');
-  process.exit(2);
-}
-fs.writeFileSync(path.join(root, 'last-command.json'), JSON.stringify(command));
-fs.appendFileSync(path.join(root, 'commands.log'), target + '\\n');
-if (behaviour === 'refuse') { process.stderr.write('refused by the space\\n'); process.exit(1); }
-if (behaviour === 'flood') {
-  const chunk = 'x'.repeat(65536);
-  const pump = () => { while (process.stderr.write(chunk)) {} process.stderr.once('drain', pump); };
-  pump();
-} else if (behaviour === 'hang') {
-  const grandchild = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
-  fs.writeFileSync(path.join(root, 'hang.pid'), String(grandchild.pid));
-  setInterval(() => {}, 1000);
-} else {
-  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')));
-  const child = spawn('git', ['receive-pack', path.join(root, target)], { stdio: 'inherit', env: { ...env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: ${JSON.stringify(os.devNull)} } });
-  child.on('exit', (code) => process.exit(code ?? 1));
-}
-`;
-
-/**
- * A stand-in place for one space in a local folder. `exec` runs the module's fixed scripts with the
- * host's `sh` and `git`, with /spaces/ mapped into the folder and a `timeout` that only drops its
- * limit, since the host may have none. `execArgv` points at RECEIVER, kept in a folder whose name has
- * a space and a percent sign, so the ext escaping is exercised through git itself.
- */
-function createLocalPlace(host, behaviour = 'receive') {
-  const root = path.join(host.root, 'stand in 50% place');
-  const bin = path.join(root, 'bin');
-  fs.mkdirSync(path.join(root, 'spaces', SPACE_ID), { recursive: true });
-  fs.mkdirSync(bin);
-  const receiver = path.join(root, 'receiver.cjs');
-  fs.writeFileSync(receiver, RECEIVER);
-  fs.writeFileSync(path.join(bin, 'timeout'), '#!/bin/sh\nshift 3\nexec "$@"\n', { mode: 0o755 });
-  const emptyConfig = path.join(root, 'inside-gitconfig');
-  fs.writeFileSync(emptyConfig, '');
-  const insideEnvironment = { PATH: `${bin}${path.delimiter}${process.env.PATH}`, HOME: root, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: emptyConfig };
-  const local = (inside) => path.join(root, inside);
-  return {
-    root,
-    local,
-    inside: (args) => {
-      const result = spawnSync('git', args, { env: insideEnvironment, encoding: 'utf8' });
-      return { code: result.status, stdout: result.stdout };
-    },
-    lastCommand: () => JSON.parse(fs.readFileSync(path.join(root, 'last-command.json'), 'utf8')),
-    /** How many pushes reached the history side repository. */
-    historyPushes: () => (fs.existsSync(path.join(root, 'commands.log')) ? fs.readFileSync(path.join(root, 'commands.log'), 'utf8').split('\n').filter((line) => line.endsWith('.openchamber-history.git')).length : 0),
-    hangPid: () => Number(fs.readFileSync(path.join(root, 'hang.pid'), 'utf8')),
-    place: {
-      execArgv: async (spaceId) => {
-        if (spaceId !== SPACE_ID) throw new SpaceError('space_not_found', 'no such space');
-        return [process.execPath, receiver, path.join(root), behaviour];
-      },
-      exec: async (spaceId, argv, { timeoutMs }) => {
-        const [shell, flag, script, zero, ...args] = argv;
-        expect([shell, flag, zero]).toEqual([IMAGE_SH, '-c', 'sh']);
-        expect(script.startsWith(IMAGE_ONLY_PATH)).toBe(true);
-        // Quoted: the stand-in's folder name has a space in it, which the image's own PATH never has.
-        const localScript = `PATH='${insideEnvironment.PATH}';${script.slice(IMAGE_ONLY_PATH.length)}`;
-        return runCommand('/bin/sh', ['-c', localScript, zero, ...args.map((arg) => (arg.startsWith('/spaces/') ? local(arg) : arg))], { env: insideEnvironment, timeoutMs });
-      },
-    },
-  };
-}
-
 // Every hook that git on the host could run during code in, each writing a marker of its own name.
 const HOOK_NAMES = ['pre-push', 'post-index-change', 'reference-transaction', 'post-checkout', 'pre-commit', 'post-commit', 'pre-auto-gc', 'post-rewrite', 'push-to-checkout', 'pre-receive', 'post-receive', 'update', 'post-update'];