@volter/twin-github 2.0.0 → 2.0.1

package/dist/src/github-events.js

@@ -3,17 +3,19 @@
 import { createHash, createHmac } from 'node:crypto';
 import { applyTwinWrite, applyTwinWriteAtomic, ownFields, twinResources, worldNow } from '@volter/world-core';
 import { GITHUB_WORLD_USER, githubApps, githubState, handleGithubRequest, toGithubWebhook } from "./github-twin.js";
+import { appDestination, appFetch } from '@volter/world-core/app-route';
 import { worldEgressRefusal } from '@volter/world-core/network-policy';
 const TYPE = 'webhook_delivery';
 export function signGithubPayload(secret, body) {
     return `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;
 }
 const httpDelivery = async (url, _event, _payload, headers, body) => {
-    // the World's egress rule: a refused hook URL fails as a transport failure, recorded on the delivery
-    const refusal = worldEgressRefusal(url);
+    // the World's egress rule: a refused hook URL fails as a transport failure, recorded on the delivery; the
+    // application's own hostnames reach it inside the World. GitHub follows no redirect: the 3xx is the delivery's answer.
+    const refusal = appDestination(url) ? null : worldEgressRefusal(url);
     if (refusal !== null)
         throw new Error(refusal);
-    const response = await fetch(url, { method: 'POST', headers, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
+    const response = await appFetch(url, { method: 'POST', headers, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
     return { status: response.status, headers: Object.fromEntries(response.headers), body: await response.text() };
 };
 async function nativeObject(path, root) {

package/dist/src/github-git-http.js

@@ -30,7 +30,7 @@
 //
 // Offline + deterministic: everything here is the kernel's git library over the World's
 // blob store (no network, no rate budget, no `git` binary).
-import { applyTwinWrite, git } from '@volter/world-core';
+import { applyTwinWrite, git, worldNow } from '@volter/world-core';
 const { serveSmartHttp, serveSmartHttpPost } = git;
 import { ensureBareRepo, hasBareRepo, listGitPlaneRefs, planeRepo } from "./github-git-plane.js";
 import { closePrsForDeletedBranch, githubState, kernelAtomic, syncPrHeadsToBranchTip } from "./github-twin.js";
@@ -134,7 +134,7 @@ let reconcileSeq = 0; // counter: strictly increasing within the process; never
  */
 export async function reconcileGitPlaneRefs(repo, before, opts = {}) {
     const root = opts.root;
-    const occurredAt = opts.occurredAt ?? new Date().toISOString();
+    const occurredAt = opts.occurredAt ?? worldNow();
     const after = await listGitPlaneRefs(repo, root);
     const beforeBy = new Map(before.map((r) => [r.ref, r]));
     const afterBy = new Map(after.map((r) => [r.ref, r]));

package/dist/src/index.js

@@ -91,6 +91,9 @@ export const pack = {
         { host: 'uploads.github.com', pathPattern: '^/repos/[^/]+/[^/]+/releases/\\d+/assets$' },
         { host: 'github.com', pathPattern: '^/[^/]+/[^/]+/(info/refs|git-upload-pack|git-receive-pack)$' },
         { host: 'github.com', pathPattern: '^/login/oauth/(authorize|access_token)$' },
+        // the sign-in the consent and the other pages send a visitor who is not signed in to, and its two-factor step
+        // (src/screens/session.tsx); without these a browser following the redirect leaves the World
+        { host: 'github.com', pathPattern: '^/(login|session|sessions/two-factor(/app)?)$' },
         { host: 'github.com', pathPattern: '^/apps/[^/]+/installations/new$' },
         { host: 'github.com', pathPattern: '^/(organizations/[^/]+/)?settings/apps/new$' },
         { host: 'npm.pkg.github.com', pathPattern: '^/@' },

package/dist/src/screens/session.js

@@ -49,8 +49,19 @@ export function toSignIn(request, suggested, page) {
     const url = new URL(request.url);
     return new Response(null, { status: 302, headers: { location: `/login?return_to=${encodeURIComponent(page ?? url.pathname + url.search)}${suggested ? `&login=${encodeURIComponent(suggested)}` : ''}` } });
 }
-/** A return_to GitHub follows: a path on github.com, never another site. */
-const returnTo = (raw) => (raw && raw.startsWith('/') && !raw.startsWith('//') ? raw : '/');
+/** A return_to GitHub follows: a path on github.com, never another site. Resolved as a browser resolves it (a backslash
+ *  or a control character can turn `/\evil.test` into another origin), and kept only when it stays on github.com. */
+function returnTo(raw) {
+    if (!raw || !raw.startsWith('/') || /[\u0000-\u001f\\]/.test(raw))
+        return '/';
+    try {
+        const url = new URL(raw, 'https://github.com');
+        return url.origin === 'https://github.com' ? url.pathname + url.search : '/';
+    }
+    catch {
+        return '/';
+    }
+}
 function page(fields, error) {
     return flowPage({
         title: 'Sign in to GitHub · GitHub',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-github",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Local GitHub twin — PR-evidence REST; your real `@octokit/rest` talks to it unmodified. Mirror, simulate, and fork. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -57,16 +57,16 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "dependencies": {
-    "@volter/world-ui": "0.1.0",
+    "@volter/world-ui": "0.1.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "graphql": "16.14.2"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.0"
+    "@volter/world-core": "2.0.1"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.0",
+    "@volter/world-core": "2.0.1",
     "@volter/world-tooling": "0.1.0",
     "@octokit/rest": "^22.0.1",
     "playwright": "^1.61.0",

package/src/github-events.ts

@@ -4,6 +4,7 @@ import { createHash, createHmac } from 'node:crypto';
 import { applyTwinWrite, applyTwinWriteAtomic, ownFields, twinResources, worldNow } from '@volter/world-core';
 import { GITHUB_WORLD_USER, githubApps, githubState, handleGithubRequest, toGithubWebhook } from './github-twin.ts';
 import type { GithubWebhook as Hook, GithubWriteEvent } from './github-twin.ts';
+import { appDestination, appFetch } from '@volter/world-core/app-route';
 import { worldEgressRefusal } from '@volter/world-core/network-policy';
 
 export type GithubWebhook = Record<string, unknown>;
@@ -23,10 +24,11 @@ export function signGithubPayload(secret: string, body: string): string {
 }
 
 const httpDelivery: GithubWebhookDelivery = async (url, _event, _payload, headers, body) => {
-  // the World's egress rule: a refused hook URL fails as a transport failure, recorded on the delivery
-  const refusal = worldEgressRefusal(url);
+  // the World's egress rule: a refused hook URL fails as a transport failure, recorded on the delivery; the
+  // application's own hostnames reach it inside the World. GitHub follows no redirect: the 3xx is the delivery's answer.
+  const refusal = appDestination(url) ? null : worldEgressRefusal(url);
   if (refusal !== null) throw new Error(refusal);
-  const response = await fetch(url, { method: 'POST', headers, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
+  const response = await appFetch(url, { method: 'POST', headers, body, redirect: 'manual', signal: AbortSignal.timeout(10_000) });
   return { status: response.status, headers: Object.fromEntries(response.headers), body: await response.text() };
 };
 

package/src/github-git-http.ts

@@ -30,7 +30,7 @@
 //
 // Offline + deterministic: everything here is the kernel's git library over the World's
 // blob store (no network, no rate budget, no `git` binary).
-import { applyTwinWrite, git } from '@volter/world-core';
+import { applyTwinWrite, git, worldNow } from '@volter/world-core';
 const { serveSmartHttp, serveSmartHttpPost } = git;
 import { ensureBareRepo, hasBareRepo, listGitPlaneRefs, planeRepo, type PlaneRef } from './github-git-plane.ts';
 import { closePrsForDeletedBranch, githubState, kernelAtomic, syncPrHeadsToBranchTip, type GithubWriteEvent } from './github-twin.ts';
@@ -161,7 +161,7 @@ export async function reconcileGitPlaneRefs(
   opts: { root?: string; occurredAt?: string } = {},
 ): Promise<GithubWriteEvent[]> {
   const root = opts.root;
-  const occurredAt = opts.occurredAt ?? new Date().toISOString();
+  const occurredAt = opts.occurredAt ?? worldNow();
   const after = await listGitPlaneRefs(repo, root);
   const beforeBy = new Map(before.map((r) => [r.ref, r]));
   const afterBy = new Map(after.map((r) => [r.ref, r]));

package/src/index.ts

@@ -118,6 +118,9 @@ export const pack: TwinPack = {
     { host: 'uploads.github.com', pathPattern: '^/repos/[^/]+/[^/]+/releases/\\d+/assets$' },
     { host: 'github.com', pathPattern: '^/[^/]+/[^/]+/(info/refs|git-upload-pack|git-receive-pack)$' },
     { host: 'github.com', pathPattern: '^/login/oauth/(authorize|access_token)$' },
+    // the sign-in the consent and the other pages send a visitor who is not signed in to, and its two-factor step
+    // (src/screens/session.tsx); without these a browser following the redirect leaves the World
+    { host: 'github.com', pathPattern: '^/(login|session|sessions/two-factor(/app)?)$' },
     { host: 'github.com', pathPattern: '^/apps/[^/]+/installations/new$' },
     { host: 'github.com', pathPattern: '^/(organizations/[^/]+/)?settings/apps/new$' },
     { host: 'npm.pkg.github.com', pathPattern: '^/@' },

package/src/screens/session.tsx

@@ -53,8 +53,15 @@ export function toSignIn(request: Request, suggested?: string, page?: string): R
   return new Response(null, { status: 302, headers: { location: `/login?return_to=${encodeURIComponent(page ?? url.pathname + url.search)}${suggested ? `&login=${encodeURIComponent(suggested)}` : ''}` } });
 }
 
-/** A return_to GitHub follows: a path on github.com, never another site. */
-const returnTo = (raw: string | undefined): string => (raw && raw.startsWith('/') && !raw.startsWith('//') ? raw : '/');
+/** A return_to GitHub follows: a path on github.com, never another site. Resolved as a browser resolves it (a backslash
+ *  or a control character can turn `/\evil.test` into another origin), and kept only when it stays on github.com. */
+function returnTo(raw: string | undefined): string {
+  if (!raw || !raw.startsWith('/') || /[\u0000-\u001f\\]/.test(raw)) return '/';
+  try {
+    const url = new URL(raw, 'https://github.com');
+    return url.origin === 'https://github.com' ? url.pathname + url.search : '/';
+  } catch { return '/'; }
+}
 
 function page(fields: { return_to: string; login?: string }, error?: string): Response {
   return flowPage({