codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/trusted-roots.js

@@ -0,0 +1,186 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var trusted_roots_exports = {};
+__export(trusted_roots_exports, {
+  evictedHint: () => evictedHint,
+  getActiveProjectRoot: () => getActiveProjectRoot,
+  isTrustedPlanDir: () => isTrustedPlanDir,
+  isTrustedProjectRoot: () => isTrustedProjectRoot,
+  listTrustedRoots: () => listTrustedRoots,
+  projectRelative: () => projectRelative,
+  resolveTrustedPlanDir: () => resolveTrustedPlanDir,
+  resolveTrustedProjectRoot: () => resolveTrustedProjectRoot,
+  setActiveProjectRoot: () => setActiveProjectRoot
+});
+module.exports = __toCommonJS(trusted_roots_exports);
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+var import_confined_fs = require("./confined-fs");
+var import_recent_projects_service = require("./recent-projects-service");
+var import_plans_home = require("./plans-home");
+function canonicaliseForCompare(p) {
+  try {
+    return fs.realpathSync.native(path.resolve(p));
+  } catch {
+    return null;
+  }
+}
+let activeProjectRoot = null;
+function setActiveProjectRoot(projectPath) {
+  activeProjectRoot = projectPath;
+}
+function getActiveProjectRoot() {
+  return activeProjectRoot;
+}
+function listTrustedRoots() {
+  const roots = /* @__PURE__ */ new Set();
+  if (activeProjectRoot) roots.add(activeProjectRoot);
+  try {
+    for (const p of (0, import_recent_projects_service.listRecentProjects)()) {
+      if (p?.path) roots.add(p.path);
+    }
+  } catch (err) {
+    console.warn("[TrustedRoots] Recent projects unavailable, using the active project only:", err);
+  }
+  return [...roots];
+}
+function resolveTrustedProjectRoot(candidate, label = "projectRoot", opts = {}) {
+  if (typeof candidate !== "string" || candidate.trim().length === 0) {
+    throw new import_confined_fs.ConfinementError(`${label}: a project path is required`);
+  }
+  const canonCandidate = canonicaliseForCompare(candidate);
+  if (!canonCandidate) {
+    if (opts.allowAbsent) {
+      const lexical = path.resolve(candidate);
+      const known = listTrustedRoots().some((r) => path.resolve(r) === lexical);
+      if (known) return lexical;
+    }
+    throw new import_confined_fs.ConfinementError(
+      `${label}: "${candidate}" does not exist or cannot be resolved`
+    );
+  }
+  for (const root of listTrustedRoots()) {
+    const canonRoot = canonicaliseForCompare(root);
+    if (canonRoot && canonRoot === canonCandidate) return path.resolve(root);
+  }
+  const evicted = evictedHint(candidate);
+  throw new import_confined_fs.ConfinementError(
+    `${label}: "${candidate}" is not an opened project. ` + (evicted ? evicted : "Project roots are derived from the projects this app has opened, not from the request.")
+  );
+}
+function evictedHint(candidate) {
+  if (typeof candidate !== "string" || candidate.trim().length === 0) return null;
+  let evicted;
+  try {
+    evicted = (0, import_recent_projects_service.listEvictedProjects)();
+  } catch {
+    return null;
+  }
+  const lexical = path.resolve(candidate);
+  const canon = canonicaliseForCompare(candidate);
+  const hit = evicted.find(
+    (e) => path.resolve(e.path) === lexical || canon !== null && canonicaliseForCompare(e.path) === canon
+  );
+  if (!hit) return null;
+  return `It was opened before, but dropped off Recent Projects on ${new Date(hit.evictedAt).toISOString().slice(0, 10)} when newer projects pushed it past the ${import_recent_projects_service.MAX_RECENT_UNPINNED} unpinned ones kept, and only projects on that list are trusted. Open it again to restore access, and pin it in Recent Projects to stop it dropping off.`;
+}
+function resolveTrustedPlanDir(candidate, label = "planDir") {
+  if (typeof candidate !== "string" || candidate.trim().length === 0) {
+    throw new import_confined_fs.ConfinementError(`${label}: a plan directory is required`);
+  }
+  const dir = /[\\/]plan\.ya?ml$/.test(candidate) ? path.dirname(candidate) : candidate;
+  let canon;
+  try {
+    canon = fs.realpathSync.native(path.resolve(dir));
+  } catch {
+    throw new import_confined_fs.ConfinementError(`${label}: "${candidate}" does not exist or cannot be resolved`);
+  }
+  for (const root of listTrustedRoots()) {
+    const canonRoot = canonicaliseForCompare(root);
+    if (canonRoot && path.dirname(canon) === path.join(canonRoot, ".codetrellis", "plans")) return canon;
+  }
+  const trusted = new Set(listTrustedRoots().map(canonicaliseForCompare).filter(Boolean));
+  for (const { project, home } of (0, import_plans_home.linkedPlansHomes)()) {
+    const canonHome = canonicaliseForCompare(home);
+    if (canonHome && trusted.has(canonicaliseForCompare(project)) && path.dirname(canon) === path.join(canonHome, ".codetrellis", "plans")) return canon;
+  }
+  throw new import_confined_fs.ConfinementError(
+    `${label}: "${candidate}" is not a plan directory (.codetrellis/plans/<slug>) of a project this app has opened.`
+  );
+}
+function isTrustedPlanDir(candidate) {
+  try {
+    resolveTrustedPlanDir(candidate);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isTrustedProjectRoot(candidate) {
+  try {
+    resolveTrustedProjectRoot(candidate);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function projectRelative(projectRoot, absPath) {
+  if (!path.isAbsolute(absPath)) return absPath;
+  const canonical = (() => {
+    try {
+      return (0, import_confined_fs.canonicalRoot)(projectRoot);
+    } catch {
+      return path.resolve(projectRoot);
+    }
+  })();
+  const aliases = [projectRoot, canonical];
+  for (const root of listTrustedRoots()) {
+    try {
+      if ((0, import_confined_fs.canonicalRoot)(root) === canonical) aliases.push(root);
+    } catch {
+    }
+  }
+  for (const root of aliases) {
+    if (absPath === root) return "";
+    const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+    if (absPath.startsWith(prefix)) return path.relative(root, absPath);
+  }
+  return path.relative(projectRoot, absPath);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  evictedHint,
+  getActiveProjectRoot,
+  isTrustedPlanDir,
+  isTrustedProjectRoot,
+  listTrustedRoots,
+  projectRelative,
+  resolveTrustedPlanDir,
+  resolveTrustedProjectRoot,
+  setActiveProjectRoot
+});

package/src/backend/services/update-download-service.js

@@ -0,0 +1,342 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_download_service_exports = {};
+__export(update_download_service_exports, {
+  _internals: () => _internals,
+  _resetUpdateDownloadState: () => _resetUpdateDownloadState,
+  _setVerifiedForTest: () => _setVerifiedForTest,
+  cancelUpdateDownload: () => cancelUpdateDownload,
+  getUpdateDownloadState: () => getUpdateDownloadState,
+  saveVerifiedUpdateCopy: () => saveVerifiedUpdateCopy,
+  startUpdateDownload: () => startUpdateDownload
+});
+module.exports = __toCommonJS(update_download_service_exports);
+var import_node_https = __toESM(require("node:https"));
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_node_crypto = require("node:crypto");
+var import_persistence = require("./persistence");
+var import_release_signature = require("./release-signature");
+const ALLOWED_HOSTS = /* @__PURE__ */ new Set([
+  "github.com",
+  "objects.githubusercontent.com",
+  "release-assets.githubusercontent.com"
+]);
+const MAX_REDIRECTS = 3;
+const MAX_BYTES = 600 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 3e4;
+const IDLE = {
+  phase: "idle",
+  version: null,
+  filename: null,
+  bytesDownloaded: 0,
+  totalBytes: null,
+  filePath: null,
+  error: null,
+  sha256: null,
+  savedPath: null
+};
+let state = { ...IDLE };
+function assertArtifactMatchesOffer(url, filename, version) {
+  const haystack = `${url.pathname} ${filename}`;
+  if (!haystack.includes(version)) {
+    throw new Error(
+      `Refusing the download: the offer is for ${version} but the artifact it names (${filename}) does not carry that version. This is what a downgrade or a swapped release looks like.`
+    );
+  }
+}
+let inFlight = null;
+let cancelled = false;
+function getUpdateDownloadState() {
+  return state;
+}
+function downloadDir() {
+  return import_node_path.default.join((0, import_persistence.getSettingsDir)(), "updates");
+}
+function safeFilename(name) {
+  const base = import_node_path.default.basename(String(name ?? "")).replace(/[^A-Za-z0-9._-]/g, "");
+  if (!base || base === "." || base === "..") return "codetrellis-update";
+  return base.slice(0, 128);
+}
+function assertAllowedUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error("Update download URL is not a URL");
+  }
+  if (url.protocol !== "https:") {
+    throw new Error(`Update download must be https (got "${url.protocol}")`);
+  }
+  if (!ALLOWED_HOSTS.has(url.hostname.toLowerCase())) {
+    throw new Error(`Update download host "${url.hostname}" is not a release host`);
+  }
+  return url;
+}
+function digestsEqual(a, b) {
+  const x = Buffer.from(String(a ?? "").toLowerCase(), "utf-8");
+  const y = Buffer.from(String(b ?? "").toLowerCase(), "utf-8");
+  if (x.length !== y.length || x.length === 0) return false;
+  return (0, import_node_crypto.timingSafeEqual)(x, y);
+}
+function fetchToFile(url, dest, expectedBytes, hops = 0) {
+  return new Promise((resolve, reject) => {
+    if (hops > MAX_REDIRECTS) return reject(new Error("Too many redirects"));
+    const req = import_node_https.default.get(
+      url,
+      { timeout: REQUEST_TIMEOUT_MS, headers: { "user-agent": "CodeTrellis" } },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        if (status >= 300 && status < 400 && res.headers.location) {
+          res.resume();
+          let next;
+          try {
+            next = assertAllowedUrl(new URL(res.headers.location, url).toString());
+          } catch (err) {
+            return reject(err);
+          }
+          return fetchToFile(next, dest, expectedBytes, hops + 1).then(resolve, reject);
+        }
+        if (status !== 200) {
+          res.resume();
+          return reject(new Error(`Update download failed: HTTP ${status}`));
+        }
+        const declared = Number(res.headers["content-length"] ?? 0);
+        if (declared && declared > MAX_BYTES) {
+          res.destroy();
+          return reject(new Error("Update download is larger than we are willing to store"));
+        }
+        if (declared && expectedBytes && declared !== expectedBytes) {
+          res.destroy();
+          return reject(new Error("Update download size does not match the published size"));
+        }
+        state = { ...state, totalBytes: declared || expectedBytes || null };
+        const hash = (0, import_node_crypto.createHash)("sha256");
+        const out = import_node_fs.default.createWriteStream(dest, { mode: 384 });
+        let written = 0;
+        const fail = (err) => {
+          res.destroy();
+          out.destroy();
+          reject(err);
+        };
+        res.on("data", (chunk) => {
+          if (cancelled) return fail(new Error("Cancelled"));
+          written += chunk.length;
+          if (written > MAX_BYTES) return fail(new Error("Update download exceeded its size cap"));
+          hash.update(chunk);
+          state = { ...state, bytesDownloaded: written };
+        });
+        res.on("error", fail);
+        out.on("error", fail);
+        res.pipe(out);
+        out.on("finish", () => resolve(hash.digest("hex")));
+      }
+    );
+    req.on("timeout", () => req.destroy(new Error("Update download timed out")));
+    req.on("error", reject);
+  });
+}
+function startUpdateDownload(version, info) {
+  if (inFlight) return inFlight;
+  cancelled = false;
+  const run = (async () => {
+    try {
+      const url = assertAllowedUrl(info.url);
+      const filename = safeFilename(info.filename || import_node_path.default.basename(url.pathname));
+      assertArtifactMatchesOffer(url, filename, version);
+      state = { ...IDLE, phase: "preparing", version, filename, totalBytes: info.size ?? null };
+      const expectedSha256 = await fetchSignedDigest(url, filename);
+      if (cancelled) throw new Error("Cancelled");
+      const dir = downloadDir();
+      import_node_fs.default.mkdirSync(dir, { recursive: true });
+      const dest = import_node_path.default.join(dir, filename);
+      const partial = `${dest}.part`;
+      state = { ...state, phase: "downloading", bytesDownloaded: 0 };
+      try {
+        import_node_fs.default.rmSync(partial, { force: true });
+      } catch {
+      }
+      const actual = await fetchToFile(url, partial, info.size ?? null);
+      state = { ...state, phase: "verifying" };
+      if (!digestsEqual(actual, expectedSha256)) {
+        try {
+          import_node_fs.default.rmSync(partial, { force: true });
+        } catch {
+        }
+        throw new Error(
+          "Downloaded file does not match the published checksum. It has been deleted."
+        );
+      }
+      import_node_fs.default.renameSync(partial, dest);
+      state = { ...state, phase: "ready", filePath: dest, sha256: expectedSha256 };
+      console.log(`[Update] Verified ${filename} \u2014 sha256 matches the published digest`);
+      return state;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const wasCancelled = message === "Cancelled" || cancelled;
+      if (!wasCancelled) console.warn(`[Update] Download failed: ${message}`);
+      state = {
+        ...state,
+        phase: wasCancelled ? "idle" : "error",
+        error: wasCancelled ? null : message,
+        filePath: null
+      };
+      return state;
+    }
+  })();
+  inFlight = run;
+  void run.finally(() => {
+    if (inFlight === run) inFlight = null;
+  });
+  return run;
+}
+async function fetchSignedDigest(assetUrl, filename) {
+  const base = assetUrl.toString().replace(/\/[^/]*$/, "");
+  const manifestUrl = assertAllowedUrl(`${base}/SHA256SUMS`);
+  const signatureUrl = assertAllowedUrl(`${base}/SHA256SUMS.sig`);
+  let manifest;
+  let signature;
+  try {
+    [manifest, signature] = await Promise.all([
+      fetchSmall(manifestUrl),
+      fetchSmall(signatureUrl).then((b) => b.toString("utf-8"))
+    ]);
+  } catch {
+    throw new Error(
+      "This release does not publish a signed checksum manifest, so the download cannot be verified. Use the download link instead."
+    );
+  }
+  if (!(0, import_release_signature.verifyManifestSignature)(manifest, signature)) {
+    throw new Error(
+      "The release checksum manifest is not signed by CodeTrellis. Refusing to download."
+    );
+  }
+  const digest = (0, import_release_signature.digestFor)((0, import_release_signature.parseManifest)(manifest.toString("utf-8")), filename);
+  if (!digest) {
+    throw new Error(`The signed manifest does not list ${filename}. Refusing to download.`);
+  }
+  return digest;
+}
+function fetchSmall(url, hops = 0) {
+  const MAX_SMALL = 64 * 1024;
+  return new Promise((resolve, reject) => {
+    if (hops > MAX_REDIRECTS) return reject(new Error("Too many redirects"));
+    const req = import_node_https.default.get(
+      url,
+      { timeout: REQUEST_TIMEOUT_MS, headers: { "user-agent": "CodeTrellis" } },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        if (status >= 300 && status < 400 && res.headers.location) {
+          res.resume();
+          let next;
+          try {
+            next = assertAllowedUrl(new URL(res.headers.location, url).toString());
+          } catch (err) {
+            return reject(err);
+          }
+          return fetchSmall(next, hops + 1).then(resolve, reject);
+        }
+        if (status !== 200) {
+          res.resume();
+          return reject(new Error(`HTTP ${status}`));
+        }
+        const chunks = [];
+        let size = 0;
+        res.on("data", (c) => {
+          size += c.length;
+          if (size > MAX_SMALL) {
+            res.destroy();
+            return reject(new Error("Manifest too large"));
+          }
+          chunks.push(c);
+        });
+        res.on("end", () => resolve(Buffer.concat(chunks)));
+        res.on("error", reject);
+      }
+    );
+    req.on("timeout", () => req.destroy(new Error("Timed out")));
+    req.on("error", reject);
+  });
+}
+async function saveVerifiedUpdateCopy(dest) {
+  const { phase, filePath, sha256 } = state;
+  if (phase !== "ready" || !filePath || !sha256) throw new Error("No verified download to save");
+  if (!import_node_path.default.isAbsolute(dest)) throw new Error("The save location must be an absolute path");
+  const target = import_node_path.default.resolve(dest);
+  if (target === import_node_path.default.resolve(filePath)) return target;
+  const partial = `${target}.part`;
+  const hash = (0, import_node_crypto.createHash)("sha256");
+  await new Promise((resolve, reject) => {
+    const input = import_node_fs.default.createReadStream(filePath);
+    const out = import_node_fs.default.createWriteStream(partial);
+    input.on("data", (c) => hash.update(c));
+    input.on("error", reject);
+    out.on("error", reject);
+    out.on("finish", () => resolve());
+    input.pipe(out);
+  }).catch((err) => {
+    try {
+      import_node_fs.default.rmSync(partial, { force: true });
+    } catch {
+    }
+    throw err;
+  });
+  if (!digestsEqual(hash.digest("hex"), sha256)) {
+    try {
+      import_node_fs.default.rmSync(partial, { force: true });
+    } catch {
+    }
+    throw new Error("The downloaded file changed on disk since it was verified. Download it again.");
+  }
+  import_node_fs.default.renameSync(partial, target);
+  state = { ...state, savedPath: target };
+  return target;
+}
+function cancelUpdateDownload() {
+  if (inFlight) cancelled = true;
+  return state;
+}
+function _resetUpdateDownloadState() {
+  state = { ...IDLE };
+  inFlight = null;
+  cancelled = false;
+}
+function _setVerifiedForTest(v) {
+  state = { ...IDLE, phase: "ready", ...v };
+}
+const _internals = { assertAllowedUrl, safeFilename, digestsEqual, ALLOWED_HOSTS, MAX_BYTES };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  _internals,
+  _resetUpdateDownloadState,
+  _setVerifiedForTest,
+  cancelUpdateDownload,
+  getUpdateDownloadState,
+  saveVerifiedUpdateCopy,
+  startUpdateDownload
+});