@youdie006/prodex 0.38.0 → 0.38.1

package/dist/store-writer.js

@@ -0,0 +1,210 @@
+// Write a bridge record into a directory the kernel has pinned for us.
+//
+// The store's normal path renders an open directory handle as /proc/self/fd/N
+// and joins the file name onto it, so the write lands in the directory that was
+// validated rather than in one a symlink swap redirected. macOS has no
+// traversable equivalent - /dev/fd/N stands in for the descriptor, not for a
+// walkable directory - so that path fails there with a bare ENOENT and takes the
+// whole ledger with it.
+//
+// This process buys the same guarantee a different way. It is spawned with its
+// cwd already set to the directory to descend from, it refuses to continue
+// unless "." is the very inode the parent validated, and it descends by chdir
+// one no-symlink segment at a time, re-checking the inode after each step. The
+// kernel holds the cwd's vnode, so once a step is confirmed nothing can redirect
+// the relative paths that follow. That is precisely what the fd path bought.
+//
+// Everything after the anchoring uses the same helpers the in-process path uses,
+// on relative names.
+import { closeSync, constants, fstatSync, openSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { link, lstat, readdir, rename, rm } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { writeVerifiedUtf8File } from "./safe-file.js";
+function identityOfOpenDirectory(fd) {
+    const stat = fstatSync(fd, { bigint: true });
+    if (!stat.isDirectory())
+        throw new Error("Anchored writer expected a directory");
+    return { dev: stat.dev.toString(), ino: stat.ino.toString() };
+}
+function sameIdentity(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+/** Open a name relative to the cwd, refusing symlinks and non-directories. */
+function openDirectoryHere(name) {
+    const directoryFlag = typeof constants.O_DIRECTORY === "number" ? constants.O_DIRECTORY : 0;
+    const noFollowFlag = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+    return openSync(name, constants.O_RDONLY | directoryFlag | noFollowFlag);
+}
+function currentDirectoryIdentity() {
+    const fd = openDirectoryHere(".");
+    try {
+        return identityOfOpenDirectory(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Confirm the cwd is the directory the parent meant, then descend the segments
+ * so that the cwd ends up pinned to the directory the record belongs in.
+ */
+export function anchorCurrentDirectory(anchor, segments) {
+    let here = currentDirectoryIdentity();
+    if (!sameIdentity(here, anchor)) {
+        throw new Error("Anchored writer was not started in the directory the caller validated");
+    }
+    for (const segment of segments) {
+        if (segment.length === 0 || segment === "." || segment === ".." || segment.includes("/")) {
+            throw new Error(`Anchored writer refuses to descend into ${JSON.stringify(segment)}`);
+        }
+        // O_NOFOLLOW proves the name is a real directory rather than a symlink, and
+        // the identity check after chdir proves we landed on that same directory
+        // and not on something swapped in between the two calls.
+        const fd = openDirectoryHere(segment);
+        let expected;
+        try {
+            expected = identityOfOpenDirectory(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        process.chdir(segment);
+        here = currentDirectoryIdentity();
+        if (!sameIdentity(here, expected)) {
+            throw new Error(`Anchored writer landed somewhere other than ${JSON.stringify(segment)}`);
+        }
+    }
+    return here;
+}
+async function assertRegularFileIfExists(name) {
+    try {
+        const stat = await lstat(name);
+        if (stat.isSymbolicLink() || !stat.isFile()) {
+            throw new Error("Bridge record path must be a regular file and must not be a symlink");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+function temporaryName(fileName) {
+    return `.${fileName}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
+}
+export async function runAnchoredJob(job) {
+    const pinned = anchorCurrentDirectory(job.anchor, job.segments);
+    const stillPinned = async () => {
+        if (!sameIdentity(currentDirectoryIdentity(), pinned)) {
+            throw new Error("Anchored writer's directory changed underneath it");
+        }
+    };
+    const { fileName } = job;
+    if (fileName.length === 0 || fileName.includes("/") || fileName === "." || fileName === "..") {
+        throw new Error(`Anchored writer refuses the file name ${JSON.stringify(fileName)}`);
+    }
+    if (job.op === "deleteIfPresent") {
+        let stat;
+        try {
+            stat = await lstat(fileName);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return { ok: true };
+            throw error;
+        }
+        if (stat.isSymbolicLink() || !stat.isFile()) {
+            throw new Error("Bridge record path must be a regular file and must not be a symlink");
+        }
+        await rm(fileName, { force: true });
+        return { ok: true };
+    }
+    if (job.op === "cleanupTempHardLinks") {
+        let targetStat;
+        try {
+            targetStat = await lstat(fileName);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return { ok: true };
+            throw error;
+        }
+        if (targetStat.isSymbolicLink() || !targetStat.isFile() || targetStat.nlink <= 1)
+            return { ok: true };
+        const prefix = `.${fileName}.`;
+        for (const entry of await readdir(".", { withFileTypes: true })) {
+            if (!entry.isFile() || !entry.name.startsWith(prefix) || !entry.name.endsWith(".tmp"))
+                continue;
+            const tempStat = await lstat(entry.name).catch(() => undefined);
+            if (!tempStat?.isFile() || tempStat.isSymbolicLink())
+                continue;
+            if (tempStat.dev === targetStat.dev && tempStat.ino === targetStat.ino) {
+                await rm(entry.name, { force: true });
+            }
+        }
+        return { ok: true };
+    }
+    const content = job.content ?? "";
+    const tmpName = temporaryName(fileName);
+    if (job.op === "writeByRename") {
+        await assertRegularFileIfExists(fileName);
+        try {
+            await writeVerifiedUtf8File(tmpName, content, stillPinned, { create: true, mode: job.mode });
+            await rename(tmpName, fileName);
+            await assertRegularFileIfExists(fileName);
+        }
+        catch (error) {
+            await rm(tmpName, { force: true }).catch(() => undefined);
+            throw error;
+        }
+        return { ok: true };
+    }
+    // linkIfAbsent: the hard link is what makes "create only if absent" atomic.
+    let linked = false;
+    try {
+        await writeVerifiedUtf8File(tmpName, content, stillPinned, { create: true, exclusive: true, mode: job.mode });
+        try {
+            await link(tmpName, fileName);
+        }
+        catch (error) {
+            if (error.code === "EEXIST") {
+                await rm(tmpName, { force: true }).catch(() => undefined);
+                return { ok: true, created: false };
+            }
+            throw error;
+        }
+        linked = true;
+        await rm(tmpName, { force: true });
+        await assertRegularFileIfExists(fileName);
+    }
+    catch (error) {
+        if (!linked)
+            await rm(tmpName, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    return { ok: true, created: true };
+}
+async function readAllStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function main() {
+    let outcome;
+    try {
+        outcome = await runAnchoredJob(JSON.parse(await readAllStdin()));
+    }
+    catch (error) {
+        const maybe = error;
+        outcome = { ok: false, error: maybe.message ?? String(error), code: maybe.code };
+    }
+    process.stdout.write(`${JSON.stringify(outcome)}\n`);
+    if (!outcome.ok)
+        process.exitCode = 1;
+}
+// Only run when this file is the entry point, so the exported pieces stay
+// importable from tests without the process trying to read stdin.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    await main();
+}

package/dist/store.js

@@ -1,8 +1,12 @@
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createRequire } from "node:module";
 import { registerBridgeRoot } from "./registry.js";
-import { constants, existsSync } from "node:fs";
+import { closeSync, constants, existsSync, openSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { link, lstat, mkdir, open, readdir, realpath, rename, rm, stat } from "node:fs/promises";
 import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertRepoRelativePath } from "./repo.js";
 import { readVerifiedUtf8File, writeVerifiedUtf8File } from "./safe-file.js";
 import { makeBridgeId, nowIso, ReceiptSchema, ResultSchema, SCHEMA_VERSION, SessionSchema, TaskSchema } from "./schema.js";
@@ -656,6 +660,16 @@ export class BridgeStore {
         const artifactPath = this.resolveArtifactPath(relativePath);
         const parentPath = path.dirname(artifactPath);
         await this.assertArtifactParentDirectory(parentPath);
+        if (!hasStableDirectoryFdPaths()) {
+            const segments = path.relative(this.bridgeDir, parentPath).split(path.sep).filter((part) => part.length > 0);
+            await runAnchoredWrite(this.bridgeDir, segments, {
+                op: "deleteIfPresent",
+                fileName: path.basename(artifactPath),
+                mode: BRIDGE_FILE_MODE
+            });
+            await this.assertArtifactParentDirectory(parentPath);
+            return;
+        }
         const parentHandle = await openNoFollowDirectory(parentPath, "Artifact directory");
         try {
             const targetPath = path.join(directoryFdPath(parentHandle.fd), path.basename(artifactPath));
@@ -975,13 +989,31 @@ export class BridgeStore {
             await this.writeTextByStableStorageRename(kind, filePath, content);
             return;
         }
-        throw new Error("Bridge record writes require stable directory file descriptor paths on this platform.");
+        await this.runAnchoredRecordJob(kind, filePath, { op: "writeByRename", content });
     }
     async writeTextByCreateExclusive(kind, filePath, content) {
         if (hasStableDirectoryFdPaths()) {
             return await this.writeTextByStableStorageLinkIfAbsent(kind, filePath, content);
         }
-        throw new Error("Bridge record writes require stable directory file descriptor paths on this platform.");
+        const outcome = await this.runAnchoredRecordJob(kind, filePath, { op: "linkIfAbsent", content });
+        return outcome.created !== false;
+    }
+    /**
+     * Run one record operation in the anchored child, with the same storage
+     * directory checks the in-process path makes on either side of it.
+     */
+    async runAnchoredRecordJob(kind, filePath, job) {
+        if (path.dirname(filePath) !== this.dir(kind)) {
+            throw new Error(`Bridge record path must stay under .bridge/${kind}`);
+        }
+        await this.assertStorageDirIsRealDirectory(kind);
+        const outcome = await runAnchoredWrite(this.bridgeDir, [kind], {
+            ...job,
+            fileName: path.basename(filePath),
+            mode: BRIDGE_FILE_MODE
+        });
+        await this.assertStorageDirIsRealDirectory(kind);
+        return outcome.ok ? outcome : {};
     }
     async deleteRecordIfPresent(kind, id) {
         const filePath = this.pathFor(kind, id);
@@ -990,6 +1022,10 @@ export class BridgeStore {
         if (path.dirname(filePath) !== expectedDir) {
             throw new Error(`Bridge record path must stay under .bridge/${kind}`);
         }
+        if (!hasStableDirectoryFdPaths()) {
+            await this.runAnchoredRecordJob(kind, filePath, { op: "deleteIfPresent" });
+            return;
+        }
         const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
         try {
             const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
@@ -1115,6 +1151,10 @@ export class BridgeStore {
         if (path.dirname(filePath) !== expectedDir) {
             throw new Error(`Bridge record path must stay under .bridge/${kind}`);
         }
+        if (!hasStableDirectoryFdPaths()) {
+            await this.runAnchoredRecordJob(kind, filePath, { op: "cleanupTempHardLinks" });
+            return;
+        }
         const bridgeHandle = await openNoFollowDirectory(this.bridgeDir, "Bridge directory");
         try {
             const storageHandle = await openNoFollowDirectory(path.join(directoryFdPath(bridgeHandle.fd), kind), `Bridge storage directory .bridge/${kind}`);
@@ -1552,14 +1592,112 @@ function directoryFdPath(fd) {
     }
     return `${base}/${fd}`;
 }
+// Whether a base can be USED, not merely whether it exists. macOS has /dev/fd,
+// so an existence check accepted it, and every record write then failed with
+// ENOENT on a path like /dev/fd/12/receipts - measured there, /dev/fd exists and
+// is not traversable, which took down the whole bridge write surface while the
+// same checks pass on Linux. Existence was never the property being relied on.
+let directoryFdBaseProbe;
+function probeDirectoryFdBase() {
+    for (const base of ["/proc/self/fd", "/dev/fd"]) {
+        if (!existsSync(base))
+            continue;
+        let fd;
+        try {
+            fd = openSync(tmpdir(), constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+            // Reading the directory THROUGH the rendered path is exactly what the
+            // writes do, so that is what gets tested.
+            readdirSync(`${base}/${fd}`);
+            return base;
+        }
+        catch {
+            // this base cannot be walked here; try the next
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch {
+                    // best effort
+                }
+            }
+        }
+    }
+    return undefined;
+}
+/** Exported so a test can hold the probe to what the running platform can do. */
+export function directoryFdPathsUsable() {
+    return hasStableDirectoryFdPaths();
+}
+// Running the write in a child process whose cwd the kernel has pinned is how
+// platforms without a traversable /proc/self/fd keep the guarantee the fd path
+// gives everywhere else. See src/store-writer.ts for what the child checks.
+function anchoredWriterCommand() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const built = path.join(here, "store-writer.js");
+    if (existsSync(built))
+        return { command: process.execPath, args: [built] };
+    const source = path.join(here, "store-writer.ts");
+    if (existsSync(source)) {
+        // Only reachable when running from TypeScript sources. The child's cwd is
+        // the bridge directory, so tsx has to be named by absolute URL or Node
+        // looks for it next to the records.
+        const tsx = pathToFileURL(createRequire(import.meta.url).resolve("tsx/esm")).href;
+        return { command: process.execPath, args: ["--import", tsx, source] };
+    }
+    throw new Error("Bridge record writes need the anchored writer, which is missing from this installation.");
+}
+async function runAnchoredWrite(bridgeDir, segments, job) {
+    const bridgeHandle = await openNoFollowDirectory(bridgeDir, "Bridge directory");
+    let anchor;
+    try {
+        const stat = await bridgeHandle.stat({ bigint: true });
+        anchor = { dev: stat.dev.toString(), ino: stat.ino.toString() };
+    }
+    finally {
+        await bridgeHandle.close();
+    }
+    const { command, args } = anchoredWriterCommand();
+    // cwd is resolved by path here, which is exactly the lookup an attacker could
+    // redirect - so the child refuses to proceed unless the directory it landed in
+    // is the inode just measured through the no-follow handle.
+    const child = spawn(command, args, { cwd: bridgeDir, stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    const finished = new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", () => resolve());
+    });
+    child.stdin.end(JSON.stringify({ ...job, anchor, segments }));
+    await finished;
+    const text = Buffer.concat(stdout).toString("utf8").trim();
+    let outcome;
+    try {
+        outcome = text.length > 0 ? JSON.parse(text) : undefined;
+    }
+    catch {
+        outcome = undefined;
+    }
+    if (!outcome) {
+        const detail = Buffer.concat(stderr).toString("utf8").trim() || text || "no output";
+        throw new Error(`Bridge record write helper failed: ${detail}`);
+    }
+    if (!outcome.ok) {
+        const error = new Error(outcome.error);
+        if (outcome.code)
+            error.code = outcome.code;
+        throw error;
+    }
+    return outcome;
+}
 function directoryFdPathBase() {
     if (storeTestHooks.disableDirectoryFdPaths)
         return undefined;
-    if (existsSync("/proc/self/fd"))
-        return "/proc/self/fd";
-    if (existsSync("/dev/fd"))
-        return "/dev/fd";
-    return undefined;
+    directoryFdBaseProbe ??= { base: probeDirectoryFdBase() };
+    return directoryFdBaseProbe.base;
 }
 function assertBridgeRecordId(kind, id) {
     if (!isBridgeRecordId(kind, id)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youdie006/prodex",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "description": "Local receipt bus for coordinating Codex execution with ChatGPT Pro/Projects consultation.",
   "author": "youdie006",
   "license": "MIT",