@wrongstack/tools 0.296.3 → 0.296.4

package/dist/codebase-index/project-server-client.d.ts

@@ -51,8 +51,20 @@ export type ProjectIndexDaemonAvailability = {
 /** No server entry point exists in any known output layout. */
  | {
     readonly kind: 'missing-build';
+}
+/**
+ * The derived socket path cannot be bound on this platform (over the
+ * `sun_path` byte limit — seen on macOS whose per-user TMPDIR is ~48 bytes).
+ * A daemon spawned onto this endpoint dies silently (`stdio: 'ignore'`), so
+ * callers must degrade explicitly instead of entering the connect loop.
+ */
+ | {
+    readonly kind: 'endpoint-invalid';
+    readonly endpoint: string;
+    readonly byteLength: number;
+    readonly maxBytes: number;
 };
-export declare function resolveProjectIndexDaemonAvailability(): ProjectIndexDaemonAvailability;
+export declare function resolveProjectIndexDaemonAvailability(projectRoot?: string, indexDir?: string): ProjectIndexDaemonAvailability;
 export declare function projectIndexServerExpectedBuildId(): string | null;
 export declare function isProjectIndexServerAvailable(): boolean;
 export declare function getProjectIndexServerConnectionState(projectRoot?: string, indexDir?: string): ProjectIndexServerConnectionState;

package/dist/codebase-index/project-server-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-server-client.d.ts","sourceRoot":"","sources":["../../src/codebase-index/project-server-client.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAG9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AA4B7D,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,SAAS,GACT,YAAY,GACZ,WAAW,GACX,UAAU,GACV,cAAc,GACd,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,kCAAkC,CAAC;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAClD,MAAM,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACrD;AAED,KAAK,oCAAoC,GAAG,CAAC,KAAK,EAAE,iCAAiC,KAAK,IAAI,CAAC;AAS/F;;;;;;;;GAQG;AACH,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE;AACnD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,+DAA+D;GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAEvC,wBAAgB,qCAAqC,IAAI,8BAA8B,CAetF;AAOD,wBAAgB,iCAAiC,IAAI,MAAM,GAAG,IAAI,CAKjE;AAED,wBAAgB,6BAA6B,IAAI,OAAO,CAEvD;AAQD,wBAAgB,oCAAoC,CAClD,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,iCAAiC,CAmBnC;AAED,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,oCAAoC,GAC7C,MAAM,IAAI,CAGZ;AAmlBD,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACrD,EAAE,EAAE,CAAC,EACL,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EACzB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAEhC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC/C,OAAO,CAAC,8BAA8B,CAAC,CAKzC;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gCAAgC,CAAC,CAU3C;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,IAAI,IAAI,CAUrD"}
+{"version":3,"file":"project-server-client.d.ts","sourceRoot":"","sources":["../../src/codebase-index/project-server-client.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAG9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AA4B7D,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,kCAAkC,GAC1C,aAAa,GACb,SAAS,GACT,YAAY,GACZ,WAAW,GACX,UAAU,GACV,cAAc,GACd,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,kCAAkC,CAAC;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAClD,MAAM,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACrD;AAED,KAAK,oCAAoC,GAAG,CAAC,KAAK,EAAE,iCAAiC,KAAK,IAAI,CAAC;AAS/F;;;;;;;;GAQG;AACH,MAAM,MAAM,8BAA8B,GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE;AACnD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,+DAA+D;GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE;AACpC;;;;;GAKG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,wBAAgB,qCAAqC,CACnD,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,8BAA8B,CAqChC;AAOD,wBAAgB,iCAAiC,IAAI,MAAM,GAAG,IAAI,CAKjE;AAED,wBAAgB,6BAA6B,IAAI,OAAO,CAEvD;AAQD,wBAAgB,oCAAoC,CAClD,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,iCAAiC,CAmBnC;AAED,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,oCAAoC,GAC7C,MAAM,IAAI,CAGZ;AAmlBD,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACrD,EAAE,EAAE,CAAC,EACL,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EACzB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAEhC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC/C,OAAO,CAAC,8BAA8B,CAAC,CAKzC;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gCAAgC,CAAC,CAU3C;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,IAAI,IAAI,CAUrD"}

package/dist/codebase-index/project-server-endpoint.d.ts

@@ -1,5 +1,19 @@
 export declare const PROJECT_INDEX_SERVER_PROTOCOL_VERSION = 1;
 export declare const PROJECT_INDEX_SERVER_METADATA_FILE = "server.json";
+/**
+ * Short directory name that owns the per-project Unix socket on Linux.
+ *
+ * The directory is created `0o700` by `ensureProjectIndexSocketDirectory`: on
+ * multi-user Linux `/tmp` the kernel's sticky bit otherwise lets a local
+ * attacker pre-bind a predictable socket name (project paths are guessable
+ * via the public `buildId` handshake), hijacking clients whose `bind()` hits
+ * EADDRINUSE. macOS is unaffected because each user already has a private
+ * TMPDIR, so the subdirectory adds no extra ownership boundary there.
+ *
+ * The name is kept short to stay under the 103-byte `sun_path` cap on macOS
+ * (48 bytes of `/var/folders/<xx>/<30 chars>/T` + 8 + 24 + 5 = 85 bytes).
+ */
+export declare const PROJECT_INDEX_SERVER_SOCKET_DIR = "wsci-v1";
 /**
  * Content identity for the actual server artifact.
  *
@@ -17,7 +31,21 @@ export declare function projectIndexServerBuildId(entrypoint: string | URL): str
  * physically separate SQLite indexes.
  */
 export declare function projectIndexServerKey(projectRoot: string, indexDir?: string): string;
-/** Deterministic per-project local IPC endpoint. */
+/**
+ * Deterministic per-project local IPC endpoint.
+ *
+ * The Unix layout places the socket inside a short `wsci-v1/` subdirectory of
+ * the temp dir: macOS's per-user TMPDIR is ~48 bytes of
+ * `/var/folders/<xx>/<30 chars>/T`, and `sun_path` caps the whole socket path
+ * at 104 bytes including the NUL on macOS/BSD (108 on Linux). The previous
+ * `wrongstack-codebase-index-v1/<key>.sock` subdirectory layout came to ~107
+ * bytes there, so `bind()` failed with ENAMETOOLONG inside a detached child
+ * whose stderr was discarded — clients saw only a 10s connect timeout. The
+ * short `wsci-v1/` subdirectory stays well under both limits (85 bytes on the
+ * worst-case macOS TMPDIR) and restores the `0o700` ownership boundary the
+ * flat layout lost on multi-user Linux `/tmp`. The pipe name keeps the long
+ * prefix because named pipes have no such limit.
+ */
 export declare function projectIndexServerEndpoint(projectRoot: string, indexDir?: string): string;
 export declare function projectIndexServerMetadataPath(projectRoot: string, indexDir?: string): string;
 export declare function ensureProjectIndexSocketDirectory(endpoint: string): void;

package/dist/codebase-index/project-server-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-server-endpoint.d.ts","sourceRoot":"","sources":["../../src/codebase-index/project-server-endpoint.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,qCAAqC,IAAI,CAAC;AACvD,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAWhE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAsB1E;AAOD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,oDAAoD;AACpD,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAUzF;AAED,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7F;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIxE"}
+{"version":3,"file":"project-server-endpoint.d.ts","sourceRoot":"","sources":["../../src/codebase-index/project-server-endpoint.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,qCAAqC,IAAI,CAAC;AACvD,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAChE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,YAAmD,CAAC;AAWhG;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAsB1E;AAOD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAUzF;AAED,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7F;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQxE"}

package/dist/codebase-index/project-server.js

@@ -4503,8 +4503,10 @@ import * as fs9 from "node:fs";
 import * as os3 from "node:os";
 import * as path12 from "node:path";
 import { fileURLToPath } from "node:url";
+import { assertUnixSocketPathWithinLimit } from "@wrongstack/core/utils";
 var PROJECT_INDEX_SERVER_PROTOCOL_VERSION = 1;
 var PROJECT_INDEX_SERVER_METADATA_FILE = "server.json";
+var PROJECT_INDEX_SERVER_SOCKET_DIR = `wsci-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}`;
 var buildIdCache;
 function projectIndexServerBuildId(entrypoint) {
   const file = entrypoint instanceof URL || entrypoint.startsWith("file:") ? fileURLToPath(entrypoint) : path12.resolve(entrypoint);
@@ -4533,11 +4535,7 @@ function projectIndexServerEndpoint(projectRoot2, indexDir2) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\wrongstack-codebase-index-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}-${key}`;
   }
-  return path12.join(
-    os3.tmpdir(),
-    `wrongstack-codebase-index-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}`,
-    `${key}.sock`
-  );
+  return path12.join(os3.tmpdir(), PROJECT_INDEX_SERVER_SOCKET_DIR, `${key}.sock`);
 }
 function projectIndexServerMetadataPath(projectRoot2, indexDir2) {
   return path12.join(
@@ -4547,6 +4545,7 @@ function projectIndexServerMetadataPath(projectRoot2, indexDir2) {
 }
 function ensureProjectIndexSocketDirectory(endpoint2) {
   if (process.platform !== "win32") {
+    assertUnixSocketPathWithinLimit(endpoint2, "codebase-index");
     fs9.mkdirSync(path12.dirname(endpoint2), { recursive: true, mode: 448 });
   }
 }