codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/update-service.js

@@ -0,0 +1,266 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_service_exports = {};
+__export(update_service_exports, {
+  checkForUpdate: () => checkForUpdate,
+  detectPlatform: () => detectPlatform,
+  findDesktopRelease: () => findDesktopRelease,
+  getUpdateState: () => getUpdateState,
+  pickAssetForPlatform: () => pickAssetForPlatform,
+  startUpdatePolling: () => startUpdatePolling,
+  stopUpdatePolling: () => stopUpdatePolling
+});
+module.exports = __toCommonJS(update_service_exports);
+var import_build_info = require("../../shared/build-info");
+var import_settings_service = require("./settings-service");
+const POLL_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+const CACHE_TTL_MS = 60 * 60 * 1e3;
+const REQUEST_TIMEOUT_MS = 8e3;
+const DEFAULT_OTA_URL = "https://codetrellis.dev";
+const DEFAULT_GITHUB_REPO = "lionroseway/codetrellis-releases";
+let state = {
+  status: "idle",
+  lastCheckedAt: null,
+  result: null,
+  lastError: null,
+  platform: detectPlatform(),
+  currentVersion: import_build_info.BUILD_INFO.version
+};
+let pollTimer = null;
+let inFlight = null;
+function getUpdateState() {
+  return state;
+}
+async function checkForUpdate(opts = {}) {
+  if (!opts.force && state.result !== null && state.lastCheckedAt !== null && Date.now() - state.lastCheckedAt < CACHE_TTL_MS) {
+    return state;
+  }
+  if (inFlight) return inFlight;
+  inFlight = (async () => {
+    state = { ...state, status: "checking" };
+    try {
+      const result = await runCheck();
+      state = {
+        ...state,
+        status: result.available ? "available" : "up-to-date",
+        result,
+        lastCheckedAt: Date.now(),
+        lastError: null
+      };
+    } catch (err) {
+      state = {
+        ...state,
+        status: "error",
+        lastCheckedAt: Date.now(),
+        lastError: err instanceof Error ? err.message : String(err)
+      };
+    } finally {
+      inFlight = null;
+    }
+    return state;
+  })();
+  return inFlight;
+}
+function startUpdatePolling() {
+  if (pollTimer) return;
+  const autoCheck = () => (0, import_settings_service.getSettings)().updates.autoCheck;
+  if (autoCheck()) {
+    checkForUpdate().catch(() => {
+    });
+  }
+  pollTimer = setInterval(() => {
+    if (!autoCheck()) return;
+    checkForUpdate().catch(() => {
+    });
+  }, POLL_INTERVAL_MS);
+  if (typeof pollTimer.unref === "function") pollTimer.unref();
+}
+function stopUpdatePolling() {
+  if (pollTimer) {
+    clearInterval(pollTimer);
+    pollTimer = null;
+  }
+}
+function getOtaUrl() {
+  return process.env.CODETRELLIS_OTA_URL || DEFAULT_OTA_URL;
+}
+function getGithubApi() {
+  return (process.env.CODETRELLIS_GITHUB_API || "https://api.github.com").replace(/\/+$/, "");
+}
+function getGithubRepo() {
+  return process.env.CODETRELLIS_GITHUB_REPO || DEFAULT_GITHUB_REPO;
+}
+function detectPlatform() {
+  const p = process.platform;
+  const a = process.arch;
+  if (p === "darwin") return a === "arm64" ? "darwin-arm64" : "darwin-x64";
+  if (p === "win32") return a === "arm64" ? "win32-arm64" : "win32-x64";
+  if (p === "linux") return a === "arm64" ? "linux-arm64" : "linux-x64";
+  return `${p}-${a}`;
+}
+async function runCheck() {
+  const platform = state.platform;
+  const current = state.currentVersion;
+  try {
+    const websiteResult = await checkViaWebsite(platform, current);
+    if (websiteResult) return websiteResult;
+  } catch {
+  }
+  const githubResult = await checkViaGithub(platform, current);
+  return githubResult;
+}
+async function checkViaWebsite(platform, current) {
+  const base = getOtaUrl().replace(/\/+$/, "");
+  const url = `${base}/api/updates/check?platform=${encodeURIComponent(platform)}&current=${encodeURIComponent(current)}`;
+  const res = await timedFetch(url, { headers: { Accept: "application/json" } });
+  if (!res.ok) return null;
+  const ctype = res.headers.get("content-type") || "";
+  if (!ctype.includes("application/json")) return null;
+  const data = await res.json();
+  if (typeof data.available !== "boolean" || typeof data.latest !== "string") {
+    return null;
+  }
+  const newer = data.available === true;
+  return {
+    available: newer && !!data.download,
+    noAssetForPlatform: newer && !data.download,
+    latest: data.latest,
+    current: data.current ?? current,
+    publishedAt: data.publishedAt,
+    download: data.download,
+    releaseNotes: data.releaseNotes,
+    source: "website"
+  };
+}
+async function checkViaGithub(platform, current) {
+  const repo = getGithubRepo();
+  const url = `${getGithubApi()}/repos/${repo}/releases/latest`;
+  const res = await timedFetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!res.ok) {
+    throw new Error(`GitHub releases API ${res.status}`);
+  }
+  const release = await res.json();
+  const tag = (release.tag_name || "").replace(/^v/, "");
+  if (!tag) throw new Error("GitHub release had no tag");
+  const asset = pickAssetForPlatform(release.assets ?? [], platform);
+  const newer = compareSemver(tag, current) > 0;
+  const available = newer && asset !== null;
+  return {
+    available,
+    noAssetForPlatform: newer && asset === null,
+    latest: tag,
+    current,
+    publishedAt: release.published_at,
+    download: asset ? {
+      url: asset.browser_download_url,
+      filename: asset.name,
+      size: asset.size,
+      contentType: asset.content_type,
+      sha256: extractSha256(asset.digest)
+    } : void 0,
+    releaseNotes: release.html_url ? { url: release.html_url, markdown: release.body } : void 0,
+    source: "github",
+    websiteFellBackToGithub: true
+  };
+}
+async function findDesktopRelease(platform, version) {
+  if (version !== void 0 && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`"${version}" is not a version (for example 0.2.0)`);
+  }
+  const repo = getGithubRepo();
+  const which = version ? `tags/v${encodeURIComponent(version)}` : "latest";
+  const res = await timedFetch(`${getGithubApi()}/repos/${repo}/releases/${which}`, {
+    headers: { Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" }
+  });
+  if (res.status === 404) throw new Error(version ? `There is no CodeTrellis ${version} release` : "There is no CodeTrellis release yet");
+  if (!res.ok) throw new Error(`GitHub releases API ${res.status}`);
+  const release = await res.json();
+  const tag = (release.tag_name || "").replace(/^v/, "");
+  if (!tag) throw new Error("GitHub release had no tag");
+  const asset = pickAssetForPlatform(release.assets ?? [], platform);
+  return {
+    version: tag,
+    platform,
+    download: asset ? { url: asset.browser_download_url, filename: asset.name, size: asset.size, contentType: asset.content_type, sha256: extractSha256(asset.digest) } : null,
+    releaseUrl: release.html_url
+  };
+}
+function pickAssetForPlatform(assets, platform) {
+  const matches = (name, pattern) => pattern.test(name);
+  const byPlatform = {
+    "darwin-arm64": [/-arm64\.dmg$/i],
+    "darwin-x64": [/-x64\.dmg$/i],
+    // Windows arm64 runs x64 binaries under emulation, so these are not
+    // an arch fallback — they are the artifact that platform is served.
+    "win32-x64": [/-Setup-.+\.exe$/i, /-Portable-.+\.exe$/i],
+    "win32-arm64": [/-Setup-.+\.exe$/i, /-Portable-.+\.exe$/i],
+    "linux-arm64": [/-arm64\.AppImage$/i],
+    "linux-x64": [/-x86_64\.AppImage$/i, /(?<!arm64)\.AppImage$/i]
+  };
+  const patterns = byPlatform[platform] ?? [];
+  for (const pattern of patterns) {
+    const found = assets.find((a) => matches(a.name, pattern));
+    if (found) return found;
+  }
+  return null;
+}
+function extractSha256(digest) {
+  if (!digest) return void 0;
+  const m = digest.match(/^sha256:([a-f0-9]{64})$/i);
+  return m ? m[1] : void 0;
+}
+function compareSemver(a, b) {
+  const partsA = a.split(/[-+]/)[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const partsB = b.split(/[-+]/)[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const len = Math.max(partsA.length, partsB.length);
+  for (let i = 0; i < len; i++) {
+    const x = partsA[i] ?? 0;
+    const y = partsB[i] ?? 0;
+    if (x > y) return 1;
+    if (x < y) return -1;
+  }
+  const preA = a.includes("-");
+  const preB = b.includes("-");
+  if (preA && !preB) return -1;
+  if (!preA && preB) return 1;
+  return 0;
+}
+async function timedFetch(url, init) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkForUpdate,
+  detectPlatform,
+  findDesktopRelease,
+  getUpdateState,
+  pickAssetForPlatform,
+  startUpdatePolling,
+  stopUpdatePolling
+});

package/src/backend/services/watch-ignore.js

@@ -0,0 +1,76 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var watch_ignore_exports = {};
+__export(watch_ignore_exports, {
+  HEAVY_DIRS: () => HEAVY_DIRS,
+  checkoutWatchOptions: () => checkoutWatchOptions,
+  isIgnoredByWatchers: () => isIgnoredByWatchers
+});
+module.exports = __toCommonJS(watch_ignore_exports);
+var import_node_path = __toESM(require("node:path"));
+const HEAVY_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "out",
+  "build",
+  "__pycache__",
+  "venv",
+  "env",
+  "target",
+  "vendor",
+  // Go's convention for fixture input that is deliberately not valid
+  // source — mirrors project-scanner's ALWAYS_IGNORED.
+  "testdata",
+  "coverage",
+  "test-results",
+  "playwright-report",
+  "cypress",
+  // Xcode and CocoaPods / Carthage: generated, and in a React Native or
+  // Expo checkout the biggest tree there is.
+  "Pods",
+  "Carthage",
+  "DerivedData"
+]);
+function isIgnoredByWatchers(p, root) {
+  const rel = root ? import_node_path.default.relative(root, p) : p;
+  if (rel === "") return false;
+  if (/(^|[\\/])\.[^\\/]/.test(rel)) return true;
+  for (const seg of rel.split(/[\\/]/)) {
+    if (HEAVY_DIRS.has(seg)) return true;
+  }
+  return rel.endsWith(".log");
+}
+function checkoutWatchOptions(root) {
+  return { ignored: (p) => isIgnoredByWatchers(p, root), followSymlinks: false };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HEAVY_DIRS,
+  checkoutWatchOptions,
+  isIgnoredByWatchers
+});

package/src/backend/services/webhook-egress.js

@@ -0,0 +1,206 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var webhook_egress_exports = {};
+__export(webhook_egress_exports, {
+  WebhookBlocked: () => WebhookBlocked,
+  isLoopbackAddress: () => isLoopbackAddress,
+  isPrivateAddress: () => isPrivateAddress,
+  postWebhookJson: () => postWebhookJson,
+  resolveWebhookTarget: () => resolveWebhookTarget
+});
+module.exports = __toCommonJS(webhook_egress_exports);
+var import_node_http = __toESM(require("node:http"));
+var import_node_https = __toESM(require("node:https"));
+var import_promises = __toESM(require("node:dns/promises"));
+var import_node_net = __toESM(require("node:net"));
+class WebhookBlocked extends Error {
+  code = "EWEBHOOK_BLOCKED";
+  constructor(message) {
+    super(message);
+    this.name = "WebhookBlocked";
+  }
+}
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "upgrade",
+  "keep-alive",
+  "proxy-authorization",
+  "te",
+  "trailer"
+]);
+function isPrivateAddress(address) {
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+  if (mapped) return isPrivateAddress(mapped[1]);
+  if (import_node_net.default.isIPv4(address)) {
+    const [a, b] = address.split(".").map(Number);
+    if (a === 0) return true;
+    if (a === 10) return true;
+    if (a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 192 && b === 0) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a === 198 && (b === 18 || b === 19)) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+  if (import_node_net.default.isIPv6(address)) {
+    const lower = address.toLowerCase();
+    if (lower === "::" || lower === "::1") return true;
+    if (/^f[cd][0-9a-f]{2}:/.test(lower)) return true;
+    if (/^fe[89ab][0-9a-f]:/.test(lower)) return true;
+    if (/^ff[0-9a-f]{2}:/.test(lower)) return true;
+    return false;
+  }
+  return true;
+}
+function isLoopbackAddress(address) {
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+  if (mapped) return isLoopbackAddress(mapped[1]);
+  if (import_node_net.default.isIPv4(address)) return Number(address.split(".")[0]) === 127;
+  if (import_node_net.default.isIPv6(address)) return address.toLowerCase() === "::1";
+  return false;
+}
+async function resolveWebhookTarget(rawUrl, approvedHosts, opts = {}) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new WebhookBlocked(`Webhook URL is not a URL: ${String(rawUrl).slice(0, 120)}`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new WebhookBlocked(
+      `Webhook URL must be https (got "${url.protocol}").`
+    );
+  }
+  if (url.username || url.password) {
+    throw new WebhookBlocked("Webhook URL must not contain credentials");
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (!approvedHosts.some((h) => h.trim().toLowerCase() === host)) {
+    throw new WebhookBlocked(
+      `Webhook host "${host}" has not been approved. This URL comes from the project's config file, which is part of the repository \u2014 approve the host in Settings \u2192 Channels before it is used.`
+    );
+  }
+  const permitted = (addr) => !isPrivateAddress(addr) || opts.allowLoopback === true && isLoopbackAddress(addr);
+  const assertSchemeOkFor = (addr) => {
+    if (url.protocol === "https:") return;
+    if (opts.allowLoopback === true && isLoopbackAddress(addr)) return;
+    throw new WebhookBlocked(
+      `Webhook URL must be https (got "${url.protocol}"). A webhook body carries plan data.`
+    );
+  };
+  if (import_node_net.default.isIP(host)) {
+    if (!permitted(host)) {
+      throw new WebhookBlocked(`Webhook address ${host} is not a public address`);
+    }
+    assertSchemeOkFor(host);
+    return { url, address: host, family: import_node_net.default.isIPv6(host) ? 6 : 4 };
+  }
+  let records;
+  try {
+    records = await import_promises.default.lookup(host, { all: true, verbatim: true });
+  } catch (err) {
+    throw new WebhookBlocked(`Webhook host "${host}" did not resolve: ${err.message}`);
+  }
+  if (records.length === 0) {
+    throw new WebhookBlocked(`Webhook host "${host}" resolved to nothing`);
+  }
+  const priv = records.filter((r) => !permitted(r.address));
+  if (priv.length > 0) {
+    throw new WebhookBlocked(
+      `Webhook host "${host}" resolves to a non-public address (${priv[0].address})`
+    );
+  }
+  const chosen = records[0];
+  assertSchemeOkFor(chosen.address);
+  return { url, address: chosen.address, family: chosen.family === 6 ? 6 : 4 };
+}
+function postWebhookJson(target, headers, body, timeoutMs = 5e3) {
+  return new Promise((resolve, reject) => {
+    const safeHeaders = {};
+    for (const [k, v] of Object.entries(headers)) {
+      if (!FORBIDDEN_HEADERS.has(k.toLowerCase())) safeHeaders[k] = v;
+    }
+    const pinnedLookup = (_hostname, _options, callback) => {
+      callback(
+        null,
+        target.address,
+        target.family
+      );
+    };
+    const secure = target.url.protocol === "https:";
+    const transport = secure ? import_node_https.default : import_node_http.default;
+    const req = transport.request(
+      {
+        protocol: target.url.protocol,
+        hostname: target.url.hostname,
+        port: target.url.port || (secure ? 443 : 80),
+        path: `${target.url.pathname}${target.url.search}`,
+        method: "POST",
+        headers: { ...safeHeaders, "content-length": Buffer.byteLength(body) },
+        // Only meaningful over TLS; harmless on the loopback-only http path.
+        ...secure ? { servername: target.url.hostname } : {},
+        lookup: pinnedLookup,
+        timeout: timeoutMs
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        let read = 0;
+        res.on("data", (chunk) => {
+          read += chunk.length;
+          if (read > MAX_RESPONSE_BYTES) res.destroy();
+        });
+        res.on("end", () => resolve({ status, redirected: status >= 300 && status < 400 }));
+        res.on("error", reject);
+        if (status >= 300 && status < 400) {
+          res.destroy();
+          resolve({ status, redirected: true });
+        }
+      }
+    );
+    req.on("timeout", () => {
+      req.destroy(new Error("Webhook request timed out"));
+    });
+    req.on("error", reject);
+    req.end(body);
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WebhookBlocked,
+  isLoopbackAddress,
+  isPrivateAddress,
+  postWebhookJson,
+  resolveWebhookTarget
+});