bootproof 0.1.0 → 0.3.0

package/dist/remote.js

@@ -1,51 +1,91 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+const REMOTE_PROVIDERS = {
+    "github.com": "github",
+    "gitlab.com": "gitlab",
+    "bitbucket.org": "bitbucket",
+    "codeberg.org": "codeberg",
+};
 export function isRemoteTarget(value) {
     return /^[a-z][a-z0-9+.-]*:\/\//i.test(value) || /^git@/i.test(value);
 }
-export function parseGithubRemote(value) {
+export function parseRemoteTarget(value) {
     let url;
     try {
         url = new URL(value);
     }
     catch {
-        throw new Error("Remote targets must be full HTTPS GitHub repository URLs.");
+        throw new Error("Remote targets must be full HTTPS Git repository URLs.");
     }
-    if (url.protocol !== "https:" || url.hostname.toLowerCase() !== "github.com") {
-        throw new Error("Remote mode currently accepts only public HTTPS GitHub repository URLs.");
+    const host = url.hostname.toLowerCase();
+    const provider = REMOTE_PROVIDERS[host];
+    if (url.protocol !== "https:" || !provider) {
+        throw new Error("Remote mode accepts credential-free HTTPS repositories from GitHub, GitLab, Bitbucket, or Codeberg.");
     }
     if (url.username || url.password || url.port || url.search || url.hash) {
         throw new Error("Remote URLs must not contain credentials, custom ports, query strings, or fragments.");
     }
     const parts = url.pathname.split("/").filter(Boolean);
-    if (parts.length !== 2) {
-        throw new Error("Remote GitHub URLs must identify exactly one repository: https://github.com/owner/repo.");
+    if (parts.length < 2 || (provider !== "gitlab" && parts.length !== 2)) {
+        throw new Error(provider === "gitlab"
+            ? "GitLab URLs must identify a namespace and repository."
+            : `Remote ${provider} URLs must identify exactly one namespace and repository.`);
     }
-    const owner = parts[0];
-    const repo = parts[1].replace(/\.git$/i, "");
+    const repo = parts.at(-1).replace(/\.git$/i, "");
+    const namespaceParts = parts.slice(0, -1);
     const safeSegment = /^[A-Za-z0-9_.-]+$/;
-    if (!safeSegment.test(owner) || !safeSegment.test(repo) || owner === "." || owner === ".." || repo === "." || repo === "..") {
-        throw new Error("Remote GitHub owner and repository names contain unsupported characters.");
+    if (!namespaceParts.length ||
+        [...namespaceParts, repo].some(segment => !safeSegment.test(segment) || segment === "." || segment === ".." || segment === "-")) {
+        throw new Error("Remote namespace or repository names contain unsupported characters.");
     }
+    const namespace = namespaceParts.join("/");
     return {
         originalUrl: value,
-        canonicalUrl: `https://github.com/${owner}/${repo}.git`,
-        owner,
+        canonicalUrl: `https://${host}/${namespace}/${repo}.git`,
+        provider,
+        host,
+        namespace,
         repo,
     };
 }
-export function cloneGithubRemote(value, cwd) {
-    const remote = parseGithubRemote(value);
-    const ownerRoot = path.join(cwd, ".bootproof", "remotes", "github.com", remote.owner);
-    fs.mkdirSync(ownerRoot, { recursive: true });
-    const runRoot = fs.mkdtempSync(path.join(ownerRoot, `${remote.repo}-`));
+export function parseGithubRemote(value) {
+    const remote = parseRemoteTarget(value);
+    if (remote.provider !== "github") {
+        throw new Error("Expected a public HTTPS GitHub repository URL.");
+    }
+    return {
+        originalUrl: remote.originalUrl,
+        canonicalUrl: remote.canonicalUrl,
+        owner: remote.namespace,
+        repo: remote.repo,
+    };
+}
+export function cloneRemoteTarget(value, cwd) {
+    const remote = parseRemoteTarget(value);
+    const namespaceRoot = path.join(cwd, ".bootproof", "remotes", remote.host, ...remote.namespace.split("/"));
+    fs.mkdirSync(namespaceRoot, { recursive: true });
+    const runRoot = fs.mkdtempSync(path.join(namespaceRoot, `${remote.repo}-`));
     const repoPath = path.join(runRoot, "repo");
+    const isolatedGitConfig = path.join(runRoot, "gitconfig");
+    fs.writeFileSync(isolatedGitConfig, "");
     try {
-        execFileSync("git", ["clone", "--depth", "1", "--single-branch", "--no-tags", "--", remote.canonicalUrl, repoPath], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+        execFileSync("git", ["-c", "credential.helper=", "clone", "--depth", "1", "--single-branch", "--no-tags", "--", remote.canonicalUrl, repoPath], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                GIT_ASKPASS: "",
+                GIT_CONFIG_GLOBAL: isolatedGitConfig,
+                GIT_CONFIG_NOSYSTEM: "1",
+                GIT_TERMINAL_PROMPT: "0",
+            },
+        });
+        fs.rmSync(isolatedGitConfig, { force: true });
         const marker = {
             schema: "bootproof/remote-source/v1",
             canonicalUrl: remote.canonicalUrl,
+            provider: remote.provider,
             repoDirectory: "repo",
         };
         fs.writeFileSync(path.join(runRoot, "source.json"), JSON.stringify(marker, null, 2) + "\n");
@@ -57,6 +97,10 @@ export function cloneGithubRemote(value, cwd) {
     }
     return { ...remote, repoPath };
 }
+export function cloneGithubRemote(value, cwd) {
+    parseGithubRemote(value);
+    return cloneRemoteTarget(value, cwd);
+}
 export function managedRemoteSource(repoPath) {
     const markerPath = path.join(path.dirname(path.resolve(repoPath)), "source.json");
     try {

package/dist/repair.d.ts

@@ -0,0 +1,110 @@
+import type { Attestation, FailureClass, PackageManager } from "./types.js";
+export type RepairKind = "repo-diff" | "plan-step" | "environment";
+export interface RepairReceipt {
+    schema: "bootproof/repair-receipt/v1";
+    tool: string;
+    repo: {
+        remote: string | null;
+        commit: string | null;
+        dirty: boolean | null;
+    };
+    environment: {
+        os: string;
+        arch: string;
+        node: string;
+    };
+    failure: {
+        class: FailureClass;
+        beforeAttestationSha256: string;
+    };
+    repair: {
+        id: string;
+        kind: RepairKind;
+        description: string;
+        diff: string | null;
+        filesChanged: string[];
+        fileChanges: RepairReceiptFileChange[];
+        preconditions: RepairReceiptPrecondition[];
+        planDelta: string | null;
+        envDelta: string | null;
+    };
+    verification: {
+        before: {
+            booted: false;
+            failureClass: FailureClass;
+            attestationSha256: string;
+        };
+        after: {
+            booted: true;
+            healthObservation: string;
+            attestationSha256: string;
+        };
+    };
+    startedAt: string;
+    finishedAt: string;
+    signer: {
+        publicKey: string;
+        algorithm: "ed25519";
+    } | null;
+    signature: string | null;
+}
+export interface RepairResult {
+    schema: "bootproof/repair-result/v1";
+    repaired: boolean;
+    failureClass: FailureClass | null;
+    repairId: string | null;
+    receiptPath: string | null;
+    patchPath: string | null;
+    afterAttestationPath: string | null;
+    explanation: string;
+}
+export interface RepairApplyResult {
+    schema: "bootproof/repair-apply-result/v1";
+    applied: boolean;
+    receiptPath: string;
+    filesChanged: string[];
+    explanation: string;
+}
+export interface RepairOptions {
+    provider?: "docker" | "local";
+    unsafeLocal: boolean;
+    timeoutMs: number;
+    port?: number;
+    remoteSource?: string;
+}
+export interface RepairFileChange {
+    path: string;
+    before: string | null;
+    after: string;
+}
+export interface RepairReceiptFileChange {
+    path: string;
+    beforeSha256: string | null;
+    afterSha256: string;
+    beforeContent: string | null;
+    afterContent: string;
+}
+export interface RepairReceiptPrecondition {
+    path: string;
+    sha256: string;
+}
+export declare function assertRepairTargetPath(repoPath: string, file: string): void;
+export declare function assertRepairScope(changes: RepairFileChange[]): void;
+export declare function verifyRepairReceipt(receipt: RepairReceipt): boolean;
+export declare function sha256Attestation(attestation: Attestation): string;
+export declare function composePortRepair(source: string, service: string, occupiedPort: number, replacementPort: number, containerPort: number): string;
+export declare function packageManagerActivationCommand(packageManager: PackageManager, version: string | null): string | null;
+export declare function prismaRepairCommand(repo: string): string;
+export interface MigrationRepair {
+    id: string;
+    framework: "prisma" | "django" | "rails" | "knex" | "drizzle";
+    command: string;
+    source: string;
+}
+export declare function migrationRepairFor(repo: string, evidence: string): MigrationRepair | null;
+export declare function registeredRemediationsFor(failureClass: FailureClass): {
+    id: string;
+    kind: RepairKind;
+}[];
+export declare function applyVerifiedRepair(repoPath: string, receiptFile?: string): RepairApplyResult;
+export declare function repairRepo(repoPath: string, options: RepairOptions): Promise<RepairResult>;