create-snipara 2.1.1 → 2.2.0

package/dist/source-connection.js

@@ -0,0 +1,199 @@
+// src/source-connection.ts
+import fs from "fs";
+import path from "path";
+import { execFileSync } from "child_process";
+import { TextDecoder } from "util";
+
+// src/source-binding.mjs
+import { createHash } from "crypto";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync
+} from "fs";
+import { spawnSync } from "child_process";
+import { dirname, isAbsolute, join, resolve } from "path";
+var fingerprint = (value) => createHash("sha256").update(value).digest("hex");
+var SourceBindingError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "SourceBindingError";
+    this.code = code;
+  }
+};
+function fail(code, message) {
+  throw new SourceBindingError(code, message);
+}
+function normalizeRepositoryRemote(remote) {
+  if (typeof remote !== "string" || !remote || remote.length > 2048 || /[\\%\s\x00-\x1f\x7f]/.test(remote) || /\/\.{1,2}(?:\/|$)/.test(remote))
+    fail("unsafe_remote", "Repository remote is unsupported or contains unsafe credentials.");
+  let hostname, port = "", repositoryPath;
+  try {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(remote)) {
+      const url = new URL(remote);
+      if (!["https:", "http:", "ssh:"].includes(url.protocol) || url.password || url.search || url.hash || url.protocol !== "ssh:" && url.username) throw new Error();
+      if (url.username && !/^[A-Za-z0-9_.-]+$/.test(url.username)) throw new Error();
+      hostname = url.hostname.toLowerCase();
+      port = url.port && !(url.protocol === "ssh:" && url.port === "22") ? `:${url.port}` : "";
+      repositoryPath = url.pathname;
+    } else {
+      const match = remote.match(/^(?:([A-Za-z0-9_.-]+)@)?([A-Za-z0-9.-]+):([^:]+)$/);
+      if (!match) throw new Error();
+      hostname = match[2].toLowerCase();
+      repositoryPath = match[3];
+    }
+    repositoryPath = repositoryPath.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (!hostname || !/^[A-Za-z0-9.-]+$/.test(hostname) || !repositoryPath || !/^[A-Za-z0-9_./~-]+$/.test(repositoryPath) || repositoryPath.split("/").some((part) => !part || part === "." || part === "..")) throw new Error();
+  } catch {
+    fail("unsafe_remote", "Repository remote is unsupported or contains unsafe credentials.");
+  }
+  if (["github.com", "gitlab.com", "bitbucket.org"].includes(hostname)) repositoryPath = repositoryPath.toLowerCase();
+  return `${hostname}${port}/${repositoryPath}`;
+}
+function git(cwd, args) {
+  const names = ["PATH", "HOME", "USERPROFILE", "SystemRoot", "WINDIR", "TMPDIR", "TMP", "TEMP"];
+  const env = Object.fromEntries(names.filter((key) => typeof process.env[key] === "string").map((key) => [key, process.env[key]]));
+  const result = spawnSync("git", ["--no-optional-locks", "-C", cwd, ...args], {
+    encoding: "utf8",
+    timeout: 5e3,
+    maxBuffer: 16384,
+    shell: false,
+    env: { ...env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" }
+  });
+  if (result.error || result.signal) fail("source_unavailable", "Cannot verify the current repository. Reconnect before using Snipara.");
+  return result;
+}
+function observeSource(workspacePath) {
+  if (typeof workspacePath !== "string" || !workspacePath || !isAbsolute(workspacePath))
+    fail("source_unavailable", "Choose an explicit absolute workspace folder.");
+  let folder;
+  try {
+    folder = realpathSync(workspacePath);
+    if (!lstatSync(folder).isDirectory()) throw new Error();
+  } catch {
+    fail("source_unavailable", "Workspace folder is unavailable.");
+  }
+  const rootResult = git(folder, ["rev-parse", "--show-toplevel"]);
+  if (rootResult.status !== 0) {
+    if (rootResult.status !== 128 || !rootResult.stderr.includes("not a git repository"))
+      fail("source_unavailable", "Cannot verify the current repository. Reconnect before using Snipara.");
+    return { root: folder, kind: "folder", fingerprint: fingerprint(`folder:${folder}`) };
+  }
+  let root;
+  try {
+    root = realpathSync(rootResult.stdout.trim());
+  } catch {
+    fail("source_unavailable", "Repository root is unavailable.");
+  }
+  const remote = git(root, ["config", "--includes", "--get", "remote.origin.url"]);
+  if (remote.status === 0) {
+    const repository = normalizeRepositoryRemote(remote.stdout.replace(/\r?\n$/, ""));
+    return { root, kind: "repository", fingerprint: fingerprint(`repository:${repository}`), repository };
+  }
+  if (remote.status !== 1) fail("source_unavailable", "Cannot verify the repository remote.");
+  const commonResult = git(root, ["rev-parse", "--git-common-dir"]);
+  if (commonResult.status !== 0) fail("source_unavailable", "Cannot verify the local repository identity.");
+  let common;
+  try {
+    common = realpathSync(resolve(root, commonResult.stdout.trim()));
+  } catch {
+    fail("source_unavailable", "Cannot verify the local repository identity.");
+  }
+  return { root, kind: "local-repository", fingerprint: fingerprint(`local-repository:${common}`) };
+}
+
+// src/source-connection.ts
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function boundedConfiguration(file) {
+  try {
+    const parent = fs.lstatSync(path.dirname(file));
+    if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.())
+      throw new Error("Native configuration directory is not safely owned; preserve and repair it first");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error("Existing native configuration is not a readable regular file; preserve and repair it first");
+  }
+  try {
+    const info = fs.fstatSync(fd);
+    if (!info.isFile() || info.uid !== process.getuid?.() || info.size > 1e6 || info.mode & 18)
+      throw new Error("Existing native configuration is not safely owned; preserve and repair it first");
+    const value = fs.readFileSync(fd);
+    if (value.length > 1e6) throw new Error("Native configuration exceeds its read bound");
+    return new TextDecoder("utf8", { fatal: true }).decode(value);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function operatorPython() {
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory || !path.isAbsolute(directory)) continue;
+    const candidate = path.join(directory, "python3");
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      if (fs.statSync(candidate).isFile()) return fs.realpathSync(candidate);
+    } catch {
+    }
+  }
+  throw new Error("Reading existing Codex configuration requires Python 3.11+, or Python 3.10 with tomli; no configuration was changed");
+}
+function sourceServer(value, observed) {
+  if (!object(value) || Object.keys(value).some((key) => !["command", "args"].includes(key)) || typeof value.command !== "string" || !path.isAbsolute(value.command) || !Array.isArray(value.args) || value.args.length !== 5 || !value.args.every((item) => typeof item === "string") || value.args[1] !== "--source-fingerprint" || value.args[3] !== "--source-kind" || value.args[2] !== observed.fingerprint || value.args[4] !== observed.kind || !path.isAbsolute(value.args[0]) || path.basename(value.args[0]) !== "native-mcp.mjs")
+    throw new Error("Existing Snipara repository connection differs from this workspace; reconnect it explicitly before local-work setup");
+  try {
+    const script = value.args[0], info = fs.lstatSync(script);
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid?.() || info.mode & 18 || fs.realpathSync(script) !== script || info.size > 256e3 || !fs.statSync(value.command).isFile()) throw new Error();
+  } catch {
+    throw new Error("Existing Snipara repository launcher is unavailable or unsafe; preserve and repair its connection");
+  }
+}
+function detectSourceConnection(workspace, options = {}) {
+  const observed = observeSource(fs.realpathSync(workspace));
+  const servers = [];
+  const json = boundedConfiguration(path.join(observed.root, ".mcp.json"));
+  if (json !== null) {
+    let document;
+    try {
+      document = JSON.parse(json);
+    } catch {
+      throw new Error("Existing MCP JSON is malformed; preserve and repair it before setup");
+    }
+    if (!object(document) || document.mcpServers !== void 0 && !object(document.mcpServers))
+      throw new Error("Existing MCP server configuration is invalid; preserve and repair it before setup");
+    servers.push(document.mcpServers ?? {});
+  }
+  const toml = boundedConfiguration(path.join(observed.root, ".codex/config.toml"));
+  if (toml !== null) {
+    const script = "import json,sys\ntry:\n import tomllib\nexcept ImportError:\n import tomli as tomllib\nvalue=tomllib.loads(sys.stdin.read()).get('mcp_servers',{})\nif not isinstance(value,dict): raise ValueError('invalid servers')\nprint(json.dumps({key:value[key] for key in ['snipara-repository','snipara','snipara-plugin'] if key in value},ensure_ascii=True))";
+    try {
+      servers.push(JSON.parse(execFileSync(options.python ?? operatorPython(), ["-I", "-B", "-c", script], {
+        input: toml,
+        encoding: "utf8",
+        timeout: 5e3,
+        maxBuffer: 1e6,
+        stdio: ["pipe", "pipe", "pipe"],
+        env: { PATH: process.env.PATH, HOME: process.env.HOME, PYTHONNOUSERSITE: "1" }
+      })));
+    } catch {
+      throw new Error("Existing Codex configuration could not be parsed. Use Python 3.11+, or Python 3.10 with tomli, and repair malformed TOML before retrying; configuration was preserved");
+    }
+  }
+  const selected = servers.filter((entries) => entries["snipara-repository"] !== void 0);
+  if (!selected.length) return null;
+  if (servers.some((entries) => entries.snipara !== void 0 || entries["snipara-plugin"] !== void 0))
+    throw new Error("An existing direct Snipara connection conflicts with the repository connection; preserve and review it before setup");
+  for (const entries of selected) sourceServer(entries["snipara-repository"], observed);
+  return observed;
+}
+export {
+  detectSourceConnection
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-snipara",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Onboard Snipara Cloud or self-hosted MCP with an automatic project-grounded proof of value",
   "main": "dist/index.js",
   "type": "module",
@@ -8,8 +8,8 @@
     "create-snipara": "dist/index.js"
   },
   "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
-    "dev": "tsup src/index.ts --format esm --watch",
+    "build": "tsup --config tsup.config.ts",
+    "dev": "tsup --config tsup.config.ts --watch",
     "prepack": "npm run build",
     "pretest": "pnpm build",
     "test": "node --test test/*.test.cjs",
@@ -60,6 +60,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",
+    "@snipara/project-intelligence-contracts": "workspace:*",
     "@types/node": "^20.17.12",
     "@types/prompts": "^2.4.9",
     "@typescript-eslint/eslint-plugin": "^8.56.0",