@voobase/cli 0.1.1-nonprod.2069 → 0.1.1-nonprod.2070

package/dist-bundle/index.mjs

@@ -2254,7 +2254,8 @@ foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.S
 `}function emitCredentialSecurityWarnings(report,options={}){let warningFindings=report.findings.filter(finding=>finding.level==="warning");if(warningFindings.length===0)return!1;let now=options.now??new Date,fingerprint=createCredentialWarningFingerprint(report),readState=options.readState??(()=>readCredentialWarningState(report.state.dir)),writeState=options.writeState??(state=>writeCredentialWarningState(report.state.dir,state)),previous=readState(),lastNotifiedAt=previous?Date.parse(previous.last_notified_at):Number.NaN;if(previous?.fingerprint===fingerprint&&Number.isFinite(lastNotifiedAt)&&now.getTime()-lastNotifiedAt>=0&&now.getTime()-lastNotifiedAt<(options.intervalMs??DEFAULT_WARNING_INTERVAL_MS))return!1;let message=warningFindings.flatMap(finding=>[`[${finding.code}] ${finding.message}`,`\u5EFA\u8BAE\uFF1A${finding.action}`]).join(`
 `);(options.emit??(value=>process.stderr.write(`${value}
 `)))(message);try{writeState({fingerprint,last_notified_at:now.toISOString()})}catch{}return!0}function createCredentialWarningFingerprint(report){return createHash3("sha256").update(JSON.stringify({backend:report.backend,state_dir:report.state.dir,state_source:report.state.source,inside_workspace:report.state.inside_workspace,permission_detail:report.permissions.detail,findings:report.findings.map(finding=>finding.code).sort()})).digest("hex")}function readCredentialWarningState(stateDir){try{let payload=JSON.parse(readFileSync7(join4(stateDir,CREDENTIAL_WARNING_STATE_FILE),"utf8"));if(typeof payload.fingerprint=="string"&&typeof payload.last_notified_at=="string")return{fingerprint:payload.fingerprint,last_notified_at:payload.last_notified_at}}catch{}return null}function writeCredentialWarningState(stateDir,state){mkdirSync2(stateDir,{recursive:!0});let targetPath=join4(stateDir,CREDENTIAL_WARNING_STATE_FILE),temporaryPath=`${targetPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;writeFileSync3(temporaryPath,`${JSON.stringify(state,null,2)}
-`,"utf8");try{chmodSync(temporaryPath,384),renameSync(temporaryPath,targetPath)}catch(error){try{existsSync7(temporaryPath)&&unlinkSync(temporaryPath)}catch{}throw error}}function inspectCredentialPermissions(credentialPath,platform,options){if(platform==="win32"){if(options.probeWindowsAcl===!1)return{status:"unknown",detail:"windows_acl_probe_deferred"};try{return(options.windowsAclInspector??inspectWindowsCredentialAcl)(credentialPath)}catch{return{status:"unknown",detail:"windows_acl_probe_failed"}}}try{let stat2=(options.statCredential??(path3=>{let value=lstatSync2(path3);return{mode:value.mode,uid:value.uid,isFile:value.isFile()}}))(credentialPath);if(stat2.isFile===!1)return{status:"unknown",detail:"credential_path_not_regular_file"};let currentUid=options.currentUid??(typeof process.getuid=="function"?process.getuid():void 0),mode=stat2.mode&511;return currentUid===void 0?{status:"unknown",detail:"posix_current_uid_unavailable"}:(mode&63)===0&&stat2.uid===currentUid?{status:"secure",detail:"owner_read_write_only"}:{status:"warning",detail:(mode&63)!==0?"posix_mode_too_broad":"posix_owner_mismatch"}}catch{return{status:"unknown",detail:"posix_permission_probe_failed"}}}function inspectWindowsCredentialAcl(credentialPath){let result=spawnSync(resolveWindowsPowerShellExecutable(),["-NoLogo","-NoProfile","-NonInteractive","-Command",WINDOWS_ACL_SCRIPT],{encoding:"utf8",env:{...process.env,VOOBASE_CREDENTIAL_PATH:credentialPath},shell:!1,timeout:5e3,windowsHide:!0});if(result.error||result.status!==0)return{status:"unknown",detail:result.error?.code==="ETIMEDOUT"?"windows_acl_probe_timeout":"windows_acl_probe_failed"};try{return classifyWindowsAclPayload(JSON.parse(result.stdout.trim()))}catch{}return{status:"unknown",detail:"windows_acl_probe_invalid_output"}}function classifyWindowsAclPayload(value){if(!isWindowsAclPayload(value))return{status:"unknown",detail:"windows_acl_probe_invalid_output"};if(value.owner_sid!==value.current_sid)return{status:"warning",detail:"windows_acl_owner_mismatch"};if(!value.dacl_present)return{status:"warning",detail:"windows_null_dacl"};let allowedReadSids=new Set([value.current_sid,"S-1-5-18","S-1-5-32-544"]);return value.rules.some(rule=>rule.type===0&&(rule.rights&1)!==0&&!allowedReadSids.has(rule.sid))?{status:"warning",detail:"unexpected_read_acl"}:{status:"secure",detail:"current_user_acl"}}function isWindowsAclPayload(value){if(!value||typeof value!="object")return!1;let payload=value;return typeof payload.owner_sid=="string"&&typeof payload.current_sid=="string"&&typeof payload.dacl_present=="boolean"&&Array.isArray(payload.rules)&&payload.rules.every(rule=>!!rule&&typeof rule=="object"&&typeof rule.sid=="string"&&typeof rule.type=="number"&&typeof rule.rights=="number")}function serializeStateLocation(stateLocation){return{dir:stateLocation.dir,source:stateLocation.source,inside_workspace:stateLocation.insideWorkspace}}import{createHash as createHash4,randomBytes as randomBytes2}from"node:crypto";import{spawnSync as spawnSync4}from"node:child_process";import{chmodSync as chmodSync2,existsSync as existsSync9,mkdirSync as mkdirSync4,readFileSync as readFileSync8,renameSync as renameSync2,unlinkSync as unlinkSync3,writeFileSync as writeFileSync4}from"node:fs";import{dirname as dirname6,join as join5,resolve as resolve6}from"node:path";import{spawnSync as spawnSync2}from"node:child_process";var MacOSKeychainCredentialStore=class{options;backend="keychain";spawnSyncImpl;constructor(options){this.options=options,this.spawnSyncImpl=options.spawnSyncImpl??spawnSync2}exists(){let result=this.run(["find-generic-password","-a",this.options.account,"-s",this.options.service]);return result.status===44?!1:(this.assertSucceeded(result),!0)}read(){let result=this.run(["find-generic-password","-a",this.options.account,"-s",this.options.service,"-w"]);if(result.status===44)return null;this.assertSucceeded(result);try{return parseStoredCredentials(result.stdout.trim(),this.backend)}catch(error){throw error instanceof CredentialStoreCorruptedError?error:new CredentialStoreCorruptedError(this.backend)}}write(value){let result=this.run(["add-generic-password","-a",this.options.account,"-s",this.options.service,"-U","-w"],`${JSON.stringify(value)}
+`,"utf8");try{chmodSync(temporaryPath,384),renameSync(temporaryPath,targetPath)}catch(error){try{existsSync7(temporaryPath)&&unlinkSync(temporaryPath)}catch{}throw error}}function inspectCredentialPermissions(credentialPath,platform,options){if(platform==="win32"){if(options.probeWindowsAcl===!1)return{status:"unknown",detail:"windows_acl_probe_deferred"};try{return(options.windowsAclInspector??inspectWindowsCredentialAcl)(credentialPath)}catch{return{status:"unknown",detail:"windows_acl_probe_failed"}}}try{let stat2=(options.statCredential??(path3=>{let value=lstatSync2(path3);return{mode:value.mode,uid:value.uid,isFile:value.isFile()}}))(credentialPath);if(stat2.isFile===!1)return{status:"unknown",detail:"credential_path_not_regular_file"};let currentUid=options.currentUid??(typeof process.getuid=="function"?process.getuid():void 0),mode=stat2.mode&511;return currentUid===void 0?{status:"unknown",detail:"posix_current_uid_unavailable"}:(mode&63)===0&&stat2.uid===currentUid?{status:"secure",detail:"owner_read_write_only"}:{status:"warning",detail:(mode&63)!==0?"posix_mode_too_broad":"posix_owner_mismatch"}}catch{return{status:"unknown",detail:"posix_permission_probe_failed"}}}function inspectWindowsCredentialAcl(credentialPath){let result=spawnSync(resolveWindowsPowerShellExecutable(),["-NoLogo","-NoProfile","-NonInteractive","-Command",WINDOWS_ACL_SCRIPT],{encoding:"utf8",env:{...process.env,VOOBASE_CREDENTIAL_PATH:credentialPath},shell:!1,timeout:5e3,windowsHide:!0});if(result.error||result.status!==0)return{status:"unknown",detail:result.error?.code==="ETIMEDOUT"?"windows_acl_probe_timeout":"windows_acl_probe_failed"};try{return classifyWindowsAclPayload(JSON.parse(result.stdout.trim()))}catch{}return{status:"unknown",detail:"windows_acl_probe_invalid_output"}}function classifyWindowsAclPayload(value){if(!isWindowsAclPayload(value))return{status:"unknown",detail:"windows_acl_probe_invalid_output"};if(value.owner_sid!==value.current_sid)return{status:"warning",detail:"windows_acl_owner_mismatch"};if(!value.dacl_present)return{status:"warning",detail:"windows_null_dacl"};let allowedReadSids=new Set([value.current_sid,"S-1-5-18","S-1-5-32-544"]);return value.rules.some(rule=>rule.type===0&&(rule.rights&1)!==0&&!allowedReadSids.has(rule.sid))?{status:"warning",detail:"unexpected_read_acl"}:{status:"secure",detail:"current_user_acl"}}function isWindowsAclPayload(value){if(!value||typeof value!="object")return!1;let payload=value;return typeof payload.owner_sid=="string"&&typeof payload.current_sid=="string"&&typeof payload.dacl_present=="boolean"&&Array.isArray(payload.rules)&&payload.rules.every(rule=>!!rule&&typeof rule=="object"&&typeof rule.sid=="string"&&typeof rule.type=="number"&&typeof rule.rights=="number")}function serializeStateLocation(stateLocation){return{dir:stateLocation.dir,source:stateLocation.source,inside_workspace:stateLocation.insideWorkspace}}import{createHash as createHash4,randomBytes as randomBytes2}from"node:crypto";import{spawnSync as spawnSync4}from"node:child_process";import{chmodSync as chmodSync2,existsSync as existsSync9,mkdirSync as mkdirSync4,readFileSync as readFileSync8,renameSync as renameSync2,unlinkSync as unlinkSync3,writeFileSync as writeFileSync4}from"node:fs";import{dirname as dirname6,join as join5,resolve as resolve6}from"node:path";import{spawnSync as spawnSync2}from"node:child_process";var MacOSKeychainCredentialStore=class{options;backend="keychain";spawnSyncImpl;constructor(options){this.options=options,this.spawnSyncImpl=options.spawnSyncImpl??spawnSync2}exists(){let result=this.run(["find-generic-password","-a",this.options.account,"-s",this.options.service]);return result.status===44?!1:(this.assertSucceeded(result),!0)}read(){let result=this.run(["find-generic-password","-a",this.options.account,"-s",this.options.service,"-w"]);if(result.status===44)return null;this.assertSucceeded(result);try{return parseStoredCredentials(result.stdout.trim(),this.backend)}catch(error){throw error instanceof CredentialStoreCorruptedError?error:new CredentialStoreCorruptedError(this.backend)}}write(value){let serialized=JSON.stringify(value),result=this.run(["add-generic-password","-a",this.options.account,"-s",this.options.service,"-U","-w"],`${serialized}
+${serialized}
 `);this.assertSucceeded(result)}delete(){let result=this.run(["delete-generic-password","-a",this.options.account,"-s",this.options.service]);result.status!==44&&this.assertSucceeded(result)}run(args,input){return this.spawnSyncImpl("/usr/bin/security",args,{encoding:"utf8",input,shell:!1,timeout:8e3,windowsHide:!0,maxBuffer:2*1024*1024})}assertSucceeded(result){if(!result.error&&result.status===0)return;let code2=result.error?.code,reason=code2==="ENOENT"?"command_missing":code2==="ETIMEDOUT"?"timeout":result.status===36||result.status===51?"access_denied":"operation_failed";throw new CredentialStoreUnavailableError(this.backend,reason)}};import{spawnSync as spawnSync3}from"node:child_process";import{existsSync as existsSync8,mkdirSync as mkdirSync3,unlinkSync as unlinkSync2}from"node:fs";import{dirname as dirname5}from"node:path";var DPAPI_SCRIPT=String.raw`
 $ErrorActionPreference = 'Stop'
 [void](Add-Type -AssemblyName System.Security -PassThru)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voobase/cli",
-  "version": "0.1.1-nonprod.2069",
+  "version": "0.1.1-nonprod.2070",
   "private": false,
   "platformDistributionProfile": {
     "name": "nonprod",
@@ -56,10 +56,10 @@
   "bundleDependencies": [],
   "platformDistributionBuild": {
     "channel": "nonprod",
-    "version": "0.1.1-nonprod.2069",
-    "sequence": 2069,
-    "gitSha": "95ecf11",
-    "fullGitSha": "95ecf117e05c061066511fb74f4235652c489629",
-    "buildId": "0.1.1-nonprod.2069+95ecf11"
+    "version": "0.1.1-nonprod.2070",
+    "sequence": 2070,
+    "gitSha": "1582cd3",
+    "fullGitSha": "1582cd3f0c3d453c553ece6e8cb568431791ae78",
+    "buildId": "0.1.1-nonprod.2070+1582cd3"
   }
 }