deepdebug-local-agent 1.12.0 → 1.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepdebug-local-agent",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "DeepDebug Local Agent - AI-powered code debugging assistant",
   "private": false,
   "type": "module",

package/src/la-protocol-v2/jobs/git-exec.js

@@ -15,20 +15,20 @@ const KEEP_ENV = Object.freeze(["PATH", "HOME", "USERPROFILE", "LANG", "TMPDIR",
     "XDG_CONFIG_HOME", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "https_proxy", "http_proxy", "no_proxy", "GH_TOKEN", "GITHUB_TOKEN", "GITLAB_TOKEN", "GH_CONFIG_DIR", "GH_HOST"]);
 
 /** Minimal env for git: the names above from this process (what a credential helper needs), never prompts, never the agent's own secrets. */
-export function gitEnv(env = process.env, { askpass = null, tokenFile = null } = {}) {
+export function gitEnv(env = process.env, { askpass = null, tokenFile = null, host = null } = {}) {
     const out = {};
     for (const k of KEEP_ENV) if (env[k] !== undefined) out[k] = env[k];
     out.GIT_TERMINAL_PROMPT = "0";
     out.GCM_INTERACTIVE = "never";
     out.LC_ALL = "C";
-    if (askpass && tokenFile) { out.GIT_ASKPASS = askpass; out.LA_GIT_TOKEN_FILE = tokenFile; out.SSH_ASKPASS = askpass; }
+    if (askpass && tokenFile) { out.GIT_ASKPASS = askpass; out.LA_GIT_TOKEN_FILE = tokenFile; out.LA_GIT_HOST = host || ""; out.SSH_ASKPASS = askpass; }
     return out;
 }
 
 /** A 0700 shell script that answers git's askpass questions from a token file: the username is a constant, the password is the file's content. POSIX only. */
 export function ensureAskpassScript(dir) {
     const file = path.join(dir, ".vh-git-askpass.sh");
-    const body = "#!/bin/sh\ncase \"$1\" in\n  Username*|username*) printf '%s\\n' 'x-access-token' ;;\n  *) cat -- \"$LA_GIT_TOKEN_FILE\" ;;\nesac\n";
+    const body = "#!/bin/sh\ncase \"$1\" in\n  Username*|username*) printf '%s\\n' 'x-access-token' ;;\n  *) case \"$1\" in *\"//${LA_GIT_HOST}\"*|*\"@${LA_GIT_HOST}\"*) cat -- \"$LA_GIT_TOKEN_FILE\" ;; *) exit 1 ;; esac ;;\nesac\n";
     let current = null;
     try { current = fs.readFileSync(file, "utf8"); } catch { current = null; }
     if (current !== body) { const tmp = `${file}.${process.pid}.tmp`; fs.writeFileSync(tmp, body, { mode: 0o700 }); fs.renameSync(tmp, file); }
@@ -37,7 +37,8 @@ export function ensureAskpassScript(dir) {
 }
 
 /** The config every git call gets: no exotic transports (a URL is built by us, https only). */
-export const SAFE_GIT_CONFIG = Object.freeze(["-c", "protocol.ext.allow=never", "-c", "protocol.file.allow=never", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null"]);
+export const SAFE_GIT_CONFIG = Object.freeze(["-c", "protocol.ext.allow=never", "-c", "protocol.file.allow=never", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null",
+    "-c", "http.followRedirects=false", "-c", "http.lowSpeedLimit=1000", "-c", "http.lowSpeedTime=60"]);
 
 /**
  * @param {string[]} args  after the safe config

package/src/la-protocol-v2/jobs/workspace-materializer.js

@@ -88,7 +88,7 @@ export function resolveMaterializeConfig(env = process.env, warn = console.warn)
 /** Validates a repoRef and builds { host, org, repo, branch, key, url } or null. The url has NO credentials and is only https. */
 export function repoTarget(repoRef) {
     if (!repoRef || typeof repoRef !== "object") return null;
-    const host = HOSTS[repoRef.provider];
+    const host = typeof repoRef.provider === "string" && Object.hasOwn(HOSTS, repoRef.provider) ? HOSTS[repoRef.provider] : null;
     const { org, repo, branch } = repoRef;
     if (!host || typeof org !== "string" || typeof repo !== "string" || typeof branch !== "string") return null;
     if (!SEG.test(org) || !SEG.test(repo) || org === "." || org === ".." || repo === "." || repo === "..") return null;
@@ -128,7 +128,7 @@ export function createWorkspaceMaterializer({ config, tenantId, wsManager, audit
     const tenant = String(tenantId).toLowerCase();
     const git = seams.runGit || runGit;
     const stats = { admitted: 0, refused: {}, cloned: 0, reused: 0, failed: {} };
-    const inflight = new Map();   // workspaceId -> Promise<{root}>
+    const inflight = new Map();   // workspaceId -> { p:Promise<{root}>, ctl, waiters }
     let chain = Promise.resolve();   // one clone/fetch at a time on this agent
     const note = (event, extra) => { try { audit?.record({ event, ...extra }); } catch { /* the audit never breaks the data path */ } };
     const refuse = (why, extra) => { stats.refused[why] = (stats.refused[why] || 0) + 1; note("workspace_refused", { why, ...extra }); return null; };
@@ -179,7 +179,7 @@ export function createWorkspaceMaterializer({ config, tenantId, wsManager, audit
             if (!tokenUsable()) fail("credential_unavailable");
             try { askpass = ensureAskpassScript(root); } catch { fail("cache_unavailable"); }
         }
-        const env2 = gitEnv(env, { askpass, tokenFile: config.tokenFile });
+        const env2 = { ...gitEnv(env, { askpass, tokenFile: config.tokenFile, host: t.host }), GIT_CEILING_DIRECTORIES: root };   // git never discovers a repository above the cache
         const extraConfig = seams.gitConfig || [];
         const remote = seams.remoteUrl ? seams.remoteUrl(t) : t.url;
         let st = null;
@@ -189,6 +189,9 @@ export function createWorkspaceMaterializer({ config, tenantId, wsManager, audit
             const sc = readWorkspaceSidecar(dir);
             if (!sc || sc.id !== workspaceId) fail("foreign_directory");
             if (!sc.tenantId || sc.tenantId.toLowerCase() !== tenant) fail("tenant_mismatch");
+            let gitSt = null;
+            try { gitSt = fs.lstatSync(path.join(dir, ".git")); } catch { gitSt = null; }
+            if (!gitSt || !gitSt.isDirectory()) fail("not_a_clone");   // a multi-repo parent or non-git workspace: never fetch/checkout/merge in whatever repo is above it
             // existing clone: fetch the branch; move only a CLEAN tree (the previous job's local work is never reset)
             const f = await git(["fetch", "--depth", String(config.depth), "--no-tags", "--", "origin", t.branch], { cwd: dir, env: env2, timeoutMs: config.gitTimeoutMs, signal, extraConfig });
             if (!f.ok) fail(f.code === "failed" ? "fetch_failed" : f.code);
@@ -202,10 +205,21 @@ export function createWorkspaceMaterializer({ config, tenantId, wsManager, audit
             const tmp = path.join(root, `.tmp-${workspaceId}-${crypto.randomBytes(4).toString("hex")}`);
             let ok = false;
             try {
-                const c = await git(["clone", "--branch", t.branch, "--single-branch", "--depth", String(config.depth), "--no-tags", "--", remote, tmp], { env: env2, cwd: root, timeoutMs: config.cloneTimeoutMs, signal, extraConfig });
+                // the size limit is enforced WHILE cloning (not only after): a watcher aborts git as soon as the partial clone passes the limit
+                const guard = new AbortController();
+                const onAbort = () => guard.abort();
+                if (signal) { if (signal.aborted) guard.abort(); else signal.addEventListener("abort", onAbort, { once: true }); }
+                let over = false;
+                const watch = setInterval(() => { if (dirBytes(tmp, config.maxBytes) > config.maxBytes) { over = true; guard.abort(); } }, 1000);
+                let c;
+                try { c = await git(["clone", "--branch", t.branch, "--single-branch", "--depth", String(config.depth), "--no-tags", "--", remote, tmp], { env: env2, cwd: root, timeoutMs: config.cloneTimeoutMs, signal: guard.signal, extraConfig }); }
+                finally { clearInterval(watch); if (signal) signal.removeEventListener("abort", onAbort); }
+                if (over) fail("too_large");
                 if (!c.ok) fail(c.code === "failed" ? "clone_failed" : c.code);
                 if (dirBytes(tmp, config.maxBytes) > config.maxBytes) fail("too_large");
                 // the remote of the clone is the credential-free URL we built; nothing else was ever written to its config
+                // a repository may ship names that wsManager.open() writes through (a symlink at `.vh-workspace.json*`): drop them before registering
+                for (const n of fs.readdirSync(tmp)) if (n.startsWith(".vh-workspace.json")) fs.rmSync(path.join(tmp, n), { recursive: true, force: true });
                 fs.renameSync(tmp, dir);
                 ok = true;
             } finally {
@@ -231,14 +245,23 @@ export function createWorkspaceMaterializer({ config, tenantId, wsManager, audit
          * One clone at a time; a second call for the same id shares the first one's promise.
          */
         ensure(workspaceId, repoRef, signal) {
-            const running = inflight.get(workspaceId);
-            if (running) return running;
-            const p = chain.then(() => { if (signal && signal.aborted) throw new MaterializeError("aborted"); return doEnsure(workspaceId, repoRef, signal); });
-            chain = p.catch(() => {});
-            inflight.set(workspaceId, p);
-            const clear = () => { if (inflight.get(workspaceId) === p) inflight.delete(workspaceId); };
-            p.then(clear, clear);
-            return p;
+            let shared = inflight.get(workspaceId);
+            if (!shared) {
+                // the clone has its OWN controller: it is aborted only when EVERY job waiting for it has been cancelled
+                const ctl = new AbortController();
+                const p = chain.then(() => { if (ctl.signal.aborted) throw new MaterializeError("aborted"); return doEnsure(workspaceId, repoRef, ctl.signal); });
+                chain = p.catch(() => {});
+                shared = { p, ctl, waiters: 0 };
+                inflight.set(workspaceId, shared);
+                const clear = () => { if (inflight.get(workspaceId) === shared) inflight.delete(workspaceId); };
+                p.then(clear, clear);
+            }
+            shared.waiters++;
+            if (signal) {
+                const left = () => { if (--shared.waiters <= 0) shared.ctl.abort(); };
+                if (signal.aborted) left(); else signal.addEventListener("abort", left, { once: true });
+            }
+            return shared.p;
         },
     };
 }

package/src/workspace-manager.js

@@ -1,5 +1,6 @@
 import path from "path";
 import fs from "fs";
+import crypto from "crypto";
 import { exists, listRecursive, readFile, stat } from "./fs-utils.js";
 import { WORKSPACE_SIDECAR, readWorkspaceSidecar } from "./utils/open-gate.js";
 import { detectProject } from "./detectors.js";
@@ -87,13 +88,13 @@ export class WorkspaceManager {
         try {
             // Atomic (temp + rename) and owner-only: the sidecar's tenantId is
             // read by ROOT-RECOVERY, so it must never be observed half-written.
-            const tmp = `${file}.${process.pid}.tmp`;
+            const tmp = `${file}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
             fs.writeFileSync(tmp, JSON.stringify({
                 id: state.id,
                 tenantId: state.tenantId || null,
                 root: state.root,
                 openedAt: state.openedAt
-            }, null, 2) + "\n", { mode: 0o600 });
+            }, null, 2) + "\n", { mode: 0o600, flag: "wx" });   // wx: never write through a pre-existing file/symlink
             fs.renameSync(tmp, file);
             // Single-repo clones ARE git repos and the PR path runs `git add -A`:
             // keep the sidecar out of git via .git/info/exclude (never touches

package/test/la-protocol-v2/workspace-materializer-hostile.test.js

@@ -0,0 +1,105 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs"; import os from "node:os"; import path from "node:path"; import http from "node:http";
+import { execFileSync, execSync } from "node:child_process";
+import { createWorkspaceMaterializer, resolveMaterializeConfig, repoTarget } from "../../src/la-protocol-v2/jobs/workspace-materializer.js";
+import { WorkspaceManager } from "../../src/workspace-manager.js";
+const TENANT = "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const WS = "11111111-2222-4333-8444-555555555555";
+const REF = { provider: "github", org: "acme", repo: "app", branch: "main" };
+const tmp = (p) => fs.mkdtempSync(path.join(os.tmpdir(), `hos-${p}-`));
+const git = (cwd, ...a) => execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", ...a], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+function mk(files = (w) => fs.writeFileSync(path.join(w, "a.txt"), "one\n")) {
+  const bare = tmp("remote"), work = tmp("seed");
+  git(bare, "init", "--bare", "-b", "main", "."); git(work, "init", "-b", "main", ".");
+  files(work); git(work, "add", "-A"); git(work, "commit", "-m", "one"); git(work, "remote", "add", "origin", bare); git(work, "push", "origin", "main");
+  return { bare, work };
+}
+function setup({ remote, cacheDir, env = {}, runGitSeam, allow = "github.com/acme/app" } = {}) {
+  const cache = cacheDir || tmp("cache");
+  const cfg = resolveMaterializeConfig({ LOCAL_AGENT_JOBS_AUTO_WORKSPACE: "true", LOCAL_AGENT_ALLOWED_REPOS: allow, LOCAL_AGENT_WORKSPACE_CACHE: cache, ...env }, () => {});
+  const wsManager = new WorkspaceManager();
+  const seams = { remoteUrl: () => remote, gitConfig: ["-c", "protocol.file.allow=always"] };
+  if (runGitSeam) seams.runGit = runGitSeam;
+  const mat = createWorkspaceMaterializer({ config: cfg, tenantId: TENANT, wsManager, audit: { record() {} }, env: { PATH: process.env.PATH, HOME: process.env.HOME }, seams });
+  return { mat, cache, wsManager, cfg };
+}
+
+
+
+test("hostile repo: a symlink planted at the sidecar temp name never makes open() overwrite a file outside the clone", async () => {
+  const victim = path.join(tmp("victim"), "important.txt"); fs.writeFileSync(victim, "KEEP ME\n");
+  const r = mk((w) => { fs.writeFileSync(path.join(w, "a.txt"), "x\n"); fs.symlinkSync(victim, path.join(w, `.vh-workspace.json.${process.pid}.tmp`)); });
+  const { mat } = setup({ remote: r.bare });
+  assert.equal(mat.admit(WS, REF), true);
+  await mat.ensure(WS, REF);
+  const after = fs.readFileSync(victim, "utf8");
+  console.log("VICTIM AFTER:", JSON.stringify(after.slice(0, 80)));
+  assert.equal(after, "KEEP ME\n", "victim file was clobbered through repo-planted symlink");
+});
+
+test("existing dir with a sidecar but no .git under an ancestor git repository: refused, git never touches the ancestor", async () => {
+  const home = tmp("fakehome"); // acts as $HOME dotfiles repo
+  const up = mk(); // upstream of the "dotfiles" repo with branch main
+  git(home, "init", "-b", "main", "."); fs.writeFileSync(path.join(home, ".zshrc"), "a\n"); git(home, "add", "-A"); git(home, "commit", "-m", "d");
+  git(home, "remote", "add", "origin", up.bare); git(home, "fetch", "origin");
+  git(up.work, "checkout", "-b", "evil"); fs.writeFileSync(path.join(up.work, "PLANTED"), "p\n"); git(up.work, "add", "-A"); git(up.work, "commit", "-m", "evil"); git(up.work, "push", "origin", "evil");
+  const cache = path.join(home, ".deepdebug", "workspaces"); fs.mkdirSync(cache, { recursive: true });
+  fs.writeFileSync(path.join(home, ".gitignore"), ".deepdebug/\n"); git(home, "add", ".gitignore"); git(home, "commit", "-m", "ig");
+  const { mat, wsManager } = setup({ remote: "unused", cacheDir: cache });
+  const dir = path.join(fs.realpathSync(cache), WS); fs.mkdirSync(dir);
+  await wsManager.open(WS, dir, { tenantId: TENANT }); wsManager.close(WS); // leaves no sidecar; write one manually
+  wsManager.workspaces.clear(); fs.writeFileSync(path.join(dir, ".vh-workspace.json"), JSON.stringify({ id: WS, tenantId: TENANT, root: dir }));
+  const before = git(home, "rev-parse", "HEAD").trim();
+  await assert.rejects(mat.ensure(WS, { ...REF, branch: "evil" }), (e) => e.code === "not_a_clone");
+  const afterHead = git(home, "rev-parse", "HEAD").trim();
+  console.log("ancestor HEAD moved:", before !== afterHead, "FETCH_HEAD exists:", fs.existsSync(path.join(home, ".git", "FETCH_HEAD")), "PLANTED in ancestor:", fs.existsSync(path.join(home, "PLANTED")));
+  assert.equal(afterHead, before); assert.ok(!fs.existsSync(path.join(home, "PLANTED")), "git operated on the ancestor repository");
+});
+
+test("cancel of one job does not abort another job waiting for the same clone", async () => {
+  let calls = 0;
+  const slow = (args, o) => new Promise((res) => { calls++; if (o.signal) o.signal.addEventListener("abort", () => res({ ok: false, code: "aborted" })); setTimeout(() => res({ ok: false, code: "failed" }), 3000); });
+  const { mat } = setup({ remote: "x", runGitSeam: slow });
+  const ac1 = new AbortController(), ac2 = new AbortController();
+  const p1 = mat.ensure(WS, REF, ac1.signal).catch((e) => e.code);
+  const p2 = mat.ensure(WS, REF, ac2.signal).catch((e) => e.code);
+  await new Promise((r) => setTimeout(r, 100)); ac1.abort();
+  console.log("job1:", await p1, "job2 (never cancelled):", await p2);
+  assert.notEqual(await p2, "aborted");
+});
+
+
+test("a redirect never makes git send the token to another host", async () => {
+  const seen = [];
+  const evil = http.createServer((q, s) => { seen.push({ host: "evil", auth: q.headers.authorization || null, url: q.url }); if (!q.headers.authorization) { s.writeHead(401, { "WWW-Authenticate": 'Basic realm="x"' }); s.end(); } else { s.writeHead(404); s.end(); } }).listen(0);
+  await new Promise((r) => evil.once("listening", r));
+  const good = http.createServer((q, s) => { seen.push({ host: "good", auth: q.headers.authorization || null, url: q.url }); s.writeHead(302, { Location: `http://127.0.0.1:${evil.address().port}${q.url}` }); s.end(); }).listen(0);
+  await new Promise((r) => good.once("listening", r));
+  const tokf = path.join(tmp("tok"), "t"); fs.writeFileSync(tokf, "SECRETTOKEN123\n", { mode: 0o600 });
+  const { mat } = setup({ remote: `http://127.0.0.1:${good.address().port}/acme/app.git`, env: { LOCAL_AGENT_GIT_TOKEN_FILE: tokf } });
+  try { await mat.ensure(WS, REF); } catch (e) { console.log("ensure:", e.code); }
+  console.log("SEEN:", JSON.stringify(seen.map((s) => ({ ...s, auth: s.auth ? "PRESENT(" + Buffer.from(s.auth.split(" ")[1], "base64").toString().replace(/:.*/, ":***") + ")" : null }))));
+  good.close(); evil.close();
+  assert.ok(!seen.some((s) => s.host === "evil" && s.auth), "token sent to redirect target");
+});
+
+
+test("repoTarget: provider is an own key of the closed list (no prototype keys)", () => {
+  for (const p of ["constructor", "__proto__", "toString", "hasOwnProperty"]) assert.equal(repoTarget({ ...REF, provider: p }), null, p);
+});
+
+test("size limit is enforced WHILE cloning: the clone is aborted once the partial clone passes the limit", async () => {
+  let aborted = false;
+  const fake = (args, o) => new Promise((res) => {
+    const tmpDir = args[args.length - 1]; fs.mkdirSync(tmpDir, { recursive: true });
+    const t = setInterval(() => fs.appendFileSync(path.join(tmpDir, "blob"), Buffer.alloc(512 * 1024)), 100);
+    const stop = (c) => { clearInterval(t); res({ ok: false, code: c }); };
+    o.signal.addEventListener("abort", () => { aborted = true; stop("aborted"); });
+    setTimeout(() => stop("failed"), 15000);
+  });
+  const { mat, cache } = setup({ remote: "x", runGitSeam: fake, env: { LOCAL_AGENT_WORKSPACE_MAX_BYTES: String(1024 * 1024) } });
+  await assert.rejects(mat.ensure(WS, REF), (e) => e.code === "too_large");
+  assert.ok(aborted);
+  assert.deepEqual(fs.readdirSync(cache), []);
+});