@zgeoff/atc 2.11.0 → 2.13.0

package/src/workspace/resolve-path-source.ts

@@ -0,0 +1,170 @@
+import { statSync } from 'node:fs';
+import { normalizeGitURL } from './normalize-git-url';
+import { runGit } from './run-git';
+
+interface PathSourceOptions {
+  readonly allowDirty?: 'refuse' | 'warn';
+}
+
+interface ResolvedPathSource {
+  readonly ok: true;
+  readonly url: string;
+  readonly sha: string;
+  readonly branch: string | null;
+  readonly dirty: boolean;
+  readonly warnings: readonly string[];
+}
+
+type PathSourceRefusalCode =
+  | 'not_a_git_repo'
+  | 'no_commits'
+  | 'unreadable_tree'
+  | 'has_submodules'
+  | 'workspace_dirty'
+  | 'no_origin'
+  | 'invalid_git_url'
+  | 'unpushed_head';
+
+interface PathSourceRefusal {
+  readonly ok: false;
+  readonly code: PathSourceRefusalCode;
+  readonly message: string;
+}
+
+/**
+ * Turns a local checkout into the repository URL and commit another host
+ * can clone, so a workspace never carries files that exist only here. The
+ * commit is HEAD, and it must already be on origin: a remote-tracking ref
+ * under origin contains it, or origin advertises it as a ref tip. A tree
+ * with uncommitted or untracked changes is refused, or with `allowDirty:
+ * 'warn'` resolves to HEAD and leaves those changes behind with a warning.
+ * Submodules are refused. The URL is origin's, with any credential stripped.
+ */
+export async function resolvePathSource(
+  path: string,
+  options: PathSourceOptions = {},
+): Promise<PathSourceRefusal | ResolvedPathSource> {
+  if (statSync(path, { throwIfNoEntry: false })?.isDirectory() !== true) {
+    return { ok: false, code: 'not_a_git_repo', message: `${path} is not a directory` };
+  }
+
+  const toplevel = await runGit(['rev-parse', '--show-toplevel'], { cwd: path });
+
+  if (toplevel.exitCode !== 0) {
+    return { ok: false, code: 'not_a_git_repo', message: `${path} is not inside a git work tree` };
+  }
+
+  const root = toplevel.stdout.trim();
+
+  const head = await runGit(['rev-parse', '--verify', '--quiet', 'HEAD^{commit}'], { cwd: root });
+
+  if (head.exitCode !== 0) {
+    return { ok: false, code: 'no_commits', message: `${root} has no commit to check out` };
+  }
+
+  const sha = head.stdout.trim();
+
+  const tree = await runGit(['ls-tree', '-r', '--full-tree', sha], { cwd: root });
+
+  if (tree.exitCode !== 0) {
+    return {
+      ok: false,
+      code: 'unreadable_tree',
+      message: `cannot list the tree of ${sha} in ${root}: ${tree.stderr.trim()}`,
+    };
+  }
+
+  if (hasSubmodules(tree.stdout)) {
+    return { ok: false, code: 'has_submodules', message: `${root} uses submodules` };
+  }
+
+  const status = await runGit(['status', '--porcelain', '--untracked-files=normal'], { cwd: root });
+
+  if (status.exitCode !== 0) {
+    return {
+      ok: false,
+      code: 'unreadable_tree',
+      message: `cannot read the status of ${root}: ${status.stderr.trim()}`,
+    };
+  }
+
+  const dirty = status.stdout.trim() !== '';
+  const warnings: string[] = [];
+
+  if (dirty && options.allowDirty !== 'warn') {
+    return {
+      ok: false,
+      code: 'workspace_dirty',
+      message: `${root} has uncommitted or untracked changes`,
+    };
+  }
+
+  if (dirty) {
+    warnings.push(`uncommitted and untracked changes in ${root} stay behind; using ${sha}`);
+  }
+
+  const origin = await runGit(['ls-remote', '--get-url', 'origin'], { cwd: root });
+
+  const originURL = origin.stdout.trim();
+
+  // With no origin configured, git echoes the remote name back.
+  if (origin.exitCode !== 0 || originURL === '' || originURL === 'origin') {
+    return { ok: false, code: 'no_origin', message: `${root} has no origin remote` };
+  }
+
+  const url = normalizeGitURL(originURL);
+
+  if (!url.ok) {
+    return { ok: false, code: url.code, message: `origin of ${root}: ${url.message}` };
+  }
+
+  const pushed = await isOnOrigin(root, sha);
+
+  if (!pushed) {
+    return { ok: false, code: 'unpushed_head', message: `${sha} is not on origin; push it first` };
+  }
+
+  const branch = await runGit(['symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd: root });
+
+  return {
+    ok: true,
+    url: url.url,
+    sha,
+    branch: branch.exitCode === 0 ? branch.stdout.trim() : null,
+    dirty,
+    warnings,
+  };
+}
+
+/**
+ * Whether a recursive tree listing holds a gitlink or a `.gitmodules` file at
+ * its root. A workspace clone never initializes submodules, so either would
+ * ship an incomplete tree.
+ */
+function hasSubmodules(listing: string): boolean {
+  return listing
+    .split('\n')
+    .some((line) => line.startsWith('160000 ') || line.endsWith('\t.gitmodules'));
+}
+
+/**
+ * Whether origin already has the commit. A local remote-tracking ref proves
+ * it without network access; failing that, origin's advertised ref tips are
+ * checked, which catches a push whose tracking ref was never fetched.
+ */
+async function isOnOrigin(root: string, sha: string): Promise<boolean> {
+  const tracking = await runGit(['branch', '-r', '--contains', sha, '--list', 'origin/*'], {
+    cwd: root,
+  });
+
+  if (tracking.exitCode === 0 && tracking.stdout.trim() !== '') {
+    return true;
+  }
+
+  const advertised = await runGit(['ls-remote', 'origin'], { cwd: root });
+
+  return (
+    advertised.exitCode === 0 &&
+    advertised.stdout.split('\n').some((line) => line.split('\t')[0] === sha)
+  );
+}

package/src/workspace/run-git.ts

@@ -0,0 +1,87 @@
+import { REPOSITORY_ENV_VARS } from './repository-env-vars';
+
+interface GitRunOptions {
+  readonly cwd?: string;
+  readonly env?: Readonly<Record<string, string>>;
+  readonly input?: string;
+  readonly isolated?: boolean;
+}
+
+interface GitRun {
+  readonly exitCode: number;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Runs one git command to completion, feeding it any given input, and
+ * returns its exit code and output.
+ * git never prompts on a terminal here, since the daemon has none to answer
+ * with, and its messages stay in the C locale so callers can read them.
+ * Variables that pin git to some other repository, such as the `GIT_DIR` a
+ * git hook exports, are dropped so the command acts on its own directory.
+ *
+ * An isolated command reads only the repository's own config and
+ * attributes: the host's system and global config and its system and global
+ * attributes files are ignored, and every LFS filter is switched off. A
+ * checkout run this way runs no filter the host configured, so it can
+ * neither execute host code nor reach the network with the host's
+ * credentials.
+ */
+const ISOLATED_ARGS = [
+  '-c',
+  'core.attributesFile=/dev/null',
+  '-c',
+  'filter.lfs.smudge=',
+  '-c',
+  'filter.lfs.process=',
+  '-c',
+  'filter.lfs.required=false',
+];
+
+const ISOLATED_ENV = {
+  GIT_CONFIG_NOSYSTEM: '1',
+  GIT_ATTR_NOSYSTEM: '1',
+  GIT_CONFIG_GLOBAL: '/dev/null',
+  GIT_LFS_SKIP_SMUDGE: '1',
+};
+
+export async function runGit(
+  args: readonly string[],
+  options: GitRunOptions = {},
+): Promise<GitRun> {
+  const isolated = options.isolated === true;
+
+  const proc = Bun.spawn(['git', ...(isolated ? ISOLATED_ARGS : []), ...args], {
+    ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+    env: {
+      ...collectHostEnv(),
+      ...options.env,
+      ...(isolated ? ISOLATED_ENV : {}),
+      GIT_TERMINAL_PROMPT: '0',
+      LC_ALL: 'C',
+    },
+    stdin: options.input === undefined ? 'ignore' : Buffer.from(options.input),
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+
+  return { exitCode, stdout, stderr };
+}
+
+function collectHostEnv(): Record<string, string | undefined> {
+  return Object.fromEntries(
+    Object.entries(process.env).filter(
+      ([name]) =>
+        !REPOSITORY_ENV_VARS.has(name) &&
+        !name.startsWith('GIT_CONFIG_KEY_') &&
+        !name.startsWith('GIT_CONFIG_VALUE_'),
+    ),
+  );
+}

package/src/workspace/sanitize-workspace-clone.ts

@@ -0,0 +1,146 @@
+import { mkdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { normalizeGitURL } from './normalize-git-url';
+import { runGit } from './run-git';
+import type { WorkspaceProvenance } from './workspace-provenance';
+
+interface SanitizedClone {
+  readonly ok: true;
+  readonly provenance: WorkspaceProvenance;
+}
+
+interface SanitizeRefusal {
+  readonly ok: false;
+  readonly code: 'invalid_git_url' | 'sanitize_failed';
+  readonly message: string;
+}
+
+/**
+ * Strips a fresh clone of everything that could authenticate as, or run code
+ * for, the host it was cloned on, before the clone leaves that host. Objects,
+ * refs, HEAD, and the checked-out branch stay. The origin URL is reset to its
+ * token-free form; every credential setting, every http extra header, every
+ * remote URL carrying a credential, and every URL rewrite whose either side holds
+ * userinfo are removed from the repository config; hooks, reflogs (which
+ * record the clone URL), and any `.git-credentials` or `.netrc` file are
+ * deleted. The result is then checked: the history still reads and the
+ * config holds no credential.
+ */
+export async function sanitizeWorkspaceClone(
+  dir: string,
+  url: string,
+): Promise<SanitizeRefusal | SanitizedClone> {
+  const normalized = normalizeGitURL(url);
+
+  if (!normalized.ok) {
+    return normalized;
+  }
+
+  const gitDir = join(dir, '.git');
+  const configFile = join(gitDir, 'config');
+
+  for (const key of await collectCredentialKeys(configFile)) {
+    await runGit(['config', '--file', configFile, '--unset-all', key]);
+  }
+
+  const setURL = await runGit([
+    'config',
+    '--file',
+    configFile,
+    'remote.origin.url',
+    normalized.url,
+  ]);
+
+  if (setURL.exitCode !== 0) {
+    return { ok: false, code: 'sanitize_failed', message: setURL.stderr.trim() };
+  }
+
+  await rm(join(gitDir, 'hooks'), { recursive: true, force: true });
+  await mkdir(join(gitDir, 'hooks'));
+  await rm(join(gitDir, 'logs'), { recursive: true, force: true });
+
+  for (const file of ['.git-credentials', '.netrc']) {
+    await rm(join(dir, file), { force: true });
+    await rm(join(gitDir, file), { force: true });
+  }
+
+  return verifyClone(dir, configFile, normalized.url);
+}
+
+/**
+ * Every config key whose setting can carry a secret: credential helpers and
+ * usernames, http extra headers (where an Authorization header rides),
+ * remote URLs that lose something when stripped of credentials, and URL
+ * rewrites whose either side holds userinfo.
+ */
+async function collectCredentialKeys(configFile: string): Promise<string[]> {
+  const listed = await runGit(['config', '--file', configFile, '--list', '-z']);
+
+  const keys = new Set<string>();
+
+  for (const entry of listed.stdout.split('\0')) {
+    const newline = entry.indexOf('\n');
+    const key = newline === -1 ? entry : entry.slice(0, newline);
+    const value = newline === -1 ? '' : entry.slice(newline + 1);
+
+    if (isCredentialEntry(key.toLowerCase(), key, value)) {
+      keys.add(key);
+    }
+  }
+
+  return [...keys];
+}
+
+const URL_WITH_USERINFO = /^[a-z][a-z\d+.-]*:\/\/[^/]*@/iu;
+
+function isCredentialEntry(lowered: string, key: string, value: string): boolean {
+  if (lowered.startsWith('credential.')) {
+    return true;
+  }
+
+  if (lowered.startsWith('http.') && lowered.endsWith('.extraheader')) {
+    return true;
+  }
+
+  if (lowered.startsWith('remote.') && /\.(?:url|pushurl)$/u.test(lowered)) {
+    const normalized = normalizeGitURL(value);
+
+    return !normalized.ok || normalized.url !== value;
+  }
+
+  const rewrite = /^url\.(?<base>.+)\.(?:insteadof|pushinsteadof)$/iu.exec(key);
+
+  if (rewrite !== null) {
+    return URL_WITH_USERINFO.test(rewrite.groups?.['base'] ?? '') || URL_WITH_USERINFO.test(value);
+  }
+
+  return false;
+}
+
+async function verifyClone(
+  dir: string,
+  configFile: string,
+  url: string,
+): Promise<SanitizeRefusal | SanitizedClone> {
+  const log = await runGit(['log', '-1', '--format=%H'], { cwd: dir });
+
+  if (log.exitCode !== 0) {
+    return {
+      ok: false,
+      code: 'sanitize_failed',
+      message: `history unreadable: ${log.stderr.trim()}`,
+    };
+  }
+
+  const remaining = await collectCredentialKeys(configFile);
+
+  if (remaining.length > 0) {
+    return {
+      ok: false,
+      code: 'sanitize_failed',
+      message: `config still holds ${remaining.length} credential entries`,
+    };
+  }
+
+  return { ok: true, provenance: { repoURL: url, sha: log.stdout.trim() } };
+}

package/src/workspace/workspace-provenance.ts

@@ -0,0 +1,11 @@
+/**
+ * What a materialized workspace was built from: the token-free repository
+ * URL and the exact commit checked out, plus the image and harness version
+ * when the execution target reports them.
+ */
+export interface WorkspaceProvenance {
+  readonly repoURL: string;
+  readonly sha: string;
+  readonly image?: string;
+  readonly harnessVersion?: string;
+}

package/src/workspace/workspace-source.ts

@@ -0,0 +1,8 @@
+/**
+ * Where a session's workspace comes from: a directory on a host, which is
+ * resolved to a pushed commit before anything leaves that host, or a git
+ * repository and ref that the control side clones itself.
+ */
+export type WorkspaceSource =
+  | { readonly kind: 'path'; readonly host: string; readonly path: string }
+  | { readonly kind: 'git'; readonly url: string; readonly ref: string };