gcb-client 0.0.0 → 0.0.2

package/lib/helper.js

@@ -0,0 +1,290 @@
+/**
+ * The container side: a git credential helper.
+ *
+ * git invokes this as `gcb <get|store|erase>` with a small `key=value`
+ * description on stdin, and reads `key=value` pairs back from stdout.
+ *
+ * What it deliberately does:
+ *  - `store` and `erase` do nothing, ever, so no credential is written to
+ *    `~/.git-credentials` or anywhere else;
+ *  - it refuses a request without a `path`, because a path-less request can only be
+ *    authorized at host granularity — exactly the over-grant this design exists to prevent;
+ *  - on any refusal it emits `quit=1` and exits 0. That is the git credential protocol's way
+ *    of saying "stop asking helpers": an exit code alone would let git fall through to
+ *    another helper and silently authenticate as someone else;
+ *  - it never prints the credential to stderr, and never prints diagnostics to stdout, where
+ *    they would corrupt the protocol;
+ *  - it forwards the protocol and lets the *broker* decide whether plaintext is acceptable
+ *    for that host. That decision is therefore host-side and cannot be widened from inside the
+ *    container; the helper only rejects a protocol it cannot reason about at all.
+ *
+ * One exception to fail-closed, and it matters because the workspace is a bind mount shared
+ * with the host: when no broker is configured at all (`GIT_BROKER_SOCKET` unset), the helper
+ * behaves as if it were not installed — no output, exit 0 — so the human's own git keeps its
+ * own credential chain for https remotes. It refuses with `quit=1` only when it *is*
+ * configured (socket set, or `GIT_BROKER_REQUIRE=1`), because that means we are meant to be
+ * the authority. Set `GIT_BROKER_REQUIRE=1` in the container so a missing socket variable
+ * can never degrade into "silently rely on something else".
+ *
+ * The helper is stateless: it holds no secret and knows no allowlist. The broker decides.
+ */
+import { readFileSync } from 'node:fs';
+import net from 'node:net';
+import { StringDecoder } from 'node:string_decoder';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { asWireResponse, encodeMessage, parseMessage } from 'gcb-core';
+/** Ceiling for the description git sends us. */
+const MAX_INPUT_BYTES = 8 * 1024;
+/** How long to wait for the broker before giving up (fail closed, fast). */
+const SOCKET_TIMEOUT_MS = 10_000;
+/**
+ * Where to look for the socket path when no environment variable is set.
+ *
+ * A file rather than only an environment variable, because git is often spawned from a
+ * non-login shell that never sources a profile: relying on the environment alone means pushes
+ * mysteriously stop working in a fresh session. Override with `GIT_BROKER_SOCKET_FILE`.
+ */
+const DEFAULT_SOCKET_FILE = ['.config', 'git-credential-broker', 'socket'];
+/**
+ * Parse git's credential description.
+ *
+ * @param text - the raw stdin contents.
+ * @returns the key/value pairs.
+ */
+export function parseCredentialInput(text) {
+    const fields = {};
+    for (const line of String(text).split('\n')) {
+        if (!line)
+            continue;
+        const separator = line.indexOf('=');
+        if (separator <= 0)
+            continue;
+        fields[line.slice(0, separator).trim()] = line.slice(separator + 1);
+    }
+    return fields;
+}
+/**
+ * Read a stream to the end, with a size ceiling.
+ *
+ * Chunks are normalized to `Buffer` rather than assumed: `process.stdin` yields buffers, but
+ * any stream in string or object mode yields strings, and `Buffer.concat` rejects those.
+ *
+ * @param stream - the stream to drain.
+ * @param maxBytes - ceiling; exceeding it rejects.
+ * @returns the decoded contents.
+ */
+export function readAll(stream, maxBytes = MAX_INPUT_BYTES) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        stream.on('data', (chunk) => {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            size += buffer.length;
+            if (size > maxBytes) {
+                reject(new Error('credential description is implausibly large'));
+                stream.destroy();
+                return;
+            }
+            chunks.push(buffer);
+        });
+        stream.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        stream.on('error', reject);
+    });
+}
+/**
+ * Send one request to the broker over its unix socket and await one response.
+ *
+ * @param socketPath - the broker socket path.
+ * @param request - the request payload.
+ * @param timeoutMs - how long to wait for an answer.
+ * @returns the parsed response.
+ */
+export function requestOverSocket(socketPath, request, timeoutMs = SOCKET_TIMEOUT_MS) {
+    return new Promise((resolve, reject) => {
+        const socket = net.connect({ path: socketPath });
+        const decoder = new StringDecoder('utf8');
+        let buffer = '';
+        let settled = false;
+        const settle = (callback, argument) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            callback(argument);
+        };
+        socket.setTimeout(timeoutMs, () => {
+            settle(reject, new Error(`the broker did not answer within ${timeoutMs}ms`));
+        });
+        socket.on('connect', () => socket.write(encodeMessage(request)));
+        socket.on('data', (chunk) => {
+            buffer += decoder.write(chunk);
+            const newline = buffer.indexOf('\n');
+            if (newline < 0)
+                return;
+            const message = parseMessage(buffer.slice(0, newline));
+            if (message)
+                settle(resolve, asWireResponse(message));
+            else
+                settle(reject, new Error('the broker sent a malformed response'));
+        });
+        socket.on('error', (error) => {
+            settle(reject, new Error(`cannot reach the broker at ${socketPath}: ${error.code ?? error.message}`));
+        });
+        socket.on('close', () => {
+            settle(reject, new Error('the broker closed the connection without answering'));
+        });
+    });
+}
+/**
+ * Decide where the broker lives, in precedence order:
+ *
+ *   1. `--socket <path>` on the command line;
+ *   2. `GIT_BROKER_SOCKET`;
+ *   3. the contents of `GIT_BROKER_SOCKET_FILE`, defaulting to
+ *      `$HOME/.config/git-credential-broker/socket`.
+ *
+ * An empty or missing result means "not configured in this environment", which the caller
+ * treats as "behave as if not installed".
+ *
+ * @param explicitSocket - the `--socket` argument, if any.
+ * @param env - the environment to read.
+ * @returns the resolved socket path, or undefined when nothing is configured.
+ */
+export function resolveSocketPath(explicitSocket, env) {
+    if (explicitSocket)
+        return explicitSocket;
+    const fromEnv = env['GIT_BROKER_SOCKET'];
+    if (fromEnv)
+        return fromEnv;
+    const file = env['GIT_BROKER_SOCKET_FILE'] ?? path.join(env['HOME'] ?? homedir(), ...DEFAULT_SOCKET_FILE);
+    try {
+        const fromFile = readFileSync(file, 'utf8').trim();
+        if (fromFile)
+            return fromFile;
+    }
+    catch {
+        // No socket file: this environment is not configured for the broker.
+    }
+    return undefined;
+}
+/**
+ * Parse the helper's own command line.
+ *
+ * @param argv - arguments after the script name.
+ * @returns the parsed arguments.
+ */
+export function parseArgs(argv) {
+    let operation = 'get';
+    let socketPath;
+    let strict = false;
+    const rest = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            continue;
+        if (argument === '--socket') {
+            socketPath = argv[index + 1];
+            index += 1;
+        }
+        else if (argument.startsWith('--socket=')) {
+            socketPath = argument.slice('--socket='.length);
+        }
+        else if (argument === '--strict') {
+            strict = true;
+        }
+        else {
+            rest.push(argument);
+        }
+    }
+    if (rest.length > 0)
+        operation = rest[0];
+    return { operation, socketPath, strict };
+}
+/**
+ * Run the helper.
+ *
+ * Always resolves with an exit code; refusals still exit 0 on purpose (see the module
+ * comment) so that git stops instead of falling through to another helper.
+ *
+ * @param argv - arguments after the script name.
+ * @param io - injectable streams and environment.
+ * @returns the process exit code.
+ */
+export async function runHelper(argv, io = {}) {
+    const { stdin = process.stdin, stdout = process.stdout, stderr = process.stderr, env = process.env, } = io;
+    const { operation, socketPath: socketArgument, strict: strictArgument } = parseArgs(argv);
+    // git calls `store` after a successful authentication and `erase` after a rejected one.
+    // Both are intentionally no-ops: nothing about a credential is ever persisted.
+    if (operation !== 'get')
+        return 0;
+    const socketPath = resolveSocketPath(socketArgument, env);
+    const strict = strictArgument || env['GIT_BROKER_REQUIRE'] === '1';
+    const refuse = (message) => {
+        stdout.write('quit=1\n');
+        stderr.write(`gcb: ${message}\n`);
+        return 0;
+    };
+    // Drain the description before deciding anything: git closes the pipe once it has
+    // written, and walking away without reading can surface as EPIPE on git's side.
+    let input;
+    try {
+        input = parseCredentialInput(await readAll(stdin));
+    }
+    catch (error) {
+        return refuse(`could not read the credential request: ${error.message}`);
+    }
+    // Only a configured environment is ours to police. Repository configuration lives in the
+    // bind-mounted workspace and is therefore shared with the host, so the human's own git may
+    // invoke this helper too. When we are not configured, act as if we were never installed:
+    // silence and exit 0 lets git move on to the next helper. Emitting `quit=1` here would stop
+    // that chain and break the host's own https credentials.
+    if (!socketPath && !strict)
+        return 0;
+    const protocol = input['protocol'];
+    if (protocol !== 'https' && protocol !== 'http') {
+        return refuse(`refusing protocol ${JSON.stringify(protocol ?? '')}: only http and https are understood`);
+    }
+    if (!input['host']) {
+        return refuse('the credential request names no host');
+    }
+    if (!input['path']) {
+        return refuse('the credential request carries no repository path, so only a host-wide credential could be issued; ' +
+            'run `git config --global credential.useHttpPath true` to let the broker authorize a single repository');
+    }
+    if (!socketPath) {
+        return refuse('GIT_BROKER_SOCKET is not set while GIT_BROKER_REQUIRE=1, so the broker cannot be reached');
+    }
+    // Git has no per-push argument channel to the credential helper, so the helper reads its
+    // environment: GCB_PROXY=<url> pins a proxy, GCB_PROXY= (empty) goes direct, unset keeps the
+    // broker's environment. This choice only affects minting the credential; the push transport's
+    // own proxy is still Git's http.proxy / HTTPS_PROXY / NO_PROXY.
+    const configuredProxy = env['GCB_PROXY'];
+    const proxy = configuredProxy === undefined ? undefined : configuredProxy === '' ? null : configuredProxy;
+    let response;
+    try {
+        response = await requestOverSocket(socketPath, {
+            v: 1,
+            op: 'credential',
+            protocol: input['protocol'],
+            host: input['host'],
+            path: input['path'],
+            proxy,
+            session: env['DSH_SESSION_ID'] ?? null,
+            pid: process.pid,
+        });
+    }
+    catch (error) {
+        return refuse(error.message);
+    }
+    if (!response.ok) {
+        const detail = response.reason ? `: ${response.reason}` : '';
+        return refuse(`the broker refused this request (${response.code ?? 'unknown'})${detail}`);
+    }
+    if (typeof response.username !== 'string' || typeof response.password !== 'string' || !response.password) {
+        return refuse('the broker returned an incomplete credential');
+    }
+    stdout.write(`username=${response.username}\npassword=${response.password}\n`);
+    return 0;
+}
+//# sourceMappingURL=helper.js.map

package/lib/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGvE,gDAAgD;AAChD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AAEjC,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAiB3E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,MAAgB,EAAE,QAAQ,GAAW,eAAe;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;YACtB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;gBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAgC,EAChC,SAAS,GAAW,iBAAiB;IAErC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,QAAgC,EAAE,QAAiB,EAAQ,EAAE;YAC3E,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,QAAiB,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,MAAgC,EAAE,IAAI,KAAK,CAAC,oCAAoC,SAAS,IAAI,CAAC,CAAC,CAAC;QACzG,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACxB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAiC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;;gBAC3E,MAAM,CAAC,MAAgC,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YAClD,MAAM,CACJ,MAAgC,EAChC,IAAI,KAAK,CAAC,8BAA8B,UAAU,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,MAAgC,EAAE,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAC;QAC5G,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAkC,EAClC,GAAsB;IAEtB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,IAAI,GACR,GAAG,CAAC,wBAAwB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,EAAE,GAAG,mBAAmB,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAA8B,CAAC;IACnC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB,EAAE,EAAE,GAAa,EAAE;IACxE,MAAM,EACJ,KAAK,GAAG,OAAO,CAAC,KAAK,EACrB,MAAM,GAAG,OAAO,CAAC,MAAM,EACvB,MAAM,GAAG,OAAO,CAAC,MAAM,EACvB,GAAG,GAAG,OAAO,CAAC,GAAG,GAClB,GAAG,EAAE,CAAC;IAEP,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE1F,wFAAwF;IACxF,+EAA+E;IAC/E,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,cAAc,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG,CAAC;IAEnE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE;QACzC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,QAAQ,OAAO,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,kFAAkF;IAClF,gFAAgF;IAChF,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,0CAA2C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,yFAAyF;IACzF,2FAA2F;IAC3F,yFAAyF;IACzF,4FAA4F;IAC5F,yDAAyD;IACzD,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,sCAAsC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,OAAO,MAAM,CACX,qGAAqG;YACnG,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,0FAA0F,CAAC,CAAC;IAC5G,CAAC;IAED,yFAAyF;IACzF,6FAA6F;IAC7F,8FAA8F;IAC9F,gEAAgE;IAChE,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;IAC1G,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE;YAC7C,CAAC,EAAE,CAAC;YACJ,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,KAAK;YACL,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,oCAAoC,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzG,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,QAAQ,cAAc,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+import type { CommandBackend } from 'gcb-core';
+export { runHelper } from './helper.ts';
+export declare const CLIENT_HELP: string;
+export declare const clientBackend: CommandBackend;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAkBxC,eAAO,MAAM,WAAW,QAsB2C,CAAC;AAoCpE,eAAO,MAAM,aAAa,EAAE,cAK3B,CAAC"}

package/lib/index.js

@@ -0,0 +1,86 @@
+/**
+ * Container-side entry point: the git credential helper and the socket-backed commands.
+ *
+ * The host commands are not imported here; installing `gcb-client` never pulls `yaml`.
+ */
+import { GH_ACTIONS } from 'gcb-core';
+export { runHelper } from './helper.js';
+/**
+ * The catalogued subcommands of one domain, for the help text.
+ *
+ * The dispatch below reads the same table, so this cannot list a subcommand that does not run and a
+ * new action shows up in the help without a second edit.
+ *
+ * @param domain - the command before the colon, e.g. `pr`.
+ * @returns the subcommands, joined for one usage line.
+ */
+function cataloguedSubcommands(domain) {
+    return Object.values(GH_ACTIONS)
+        .filter((action) => action.command[0] === domain)
+        .map((action) => action.command[1])
+        .join('|');
+}
+export const CLIENT_HELP = `gcb-client — container-side git credential helper and broker client.
+
+Usage: gcb <command> [options]
+
+Commands
+  setup      Configure this environment's git to use the broker
+  probe      Ask the broker what it would do for a repository, without pushing
+  logs       Read a workflow job's log through the broker
+  pr         Use the broker's pull-request lifecycle; these run as gh actions:
+             ${cataloguedSubcommands('pr')}
+  run        Run a workflow run action: ${cataloguedSubcommands('run')}
+  gh         Run a catalogued GitHub action through the broker
+
+As a git credential helper
+  gcb get|store|erase    # what git calls; store and erase are no-ops
+
+Environment
+  GIT_BROKER_SOCKET       Broker socket path
+  GIT_BROKER_REQUIRE=1    Fail closed instead of behaving as if not installed when unconfigured
+  GIT_BROKER_SOCKET_FILE  Where to read the socket path from when no variable is set
+  GCB_PROXY               Per-push broker proxy: a URL, or empty for direct
+
+Host commands such as init/stage/compose/diagnose are in gcb-host.`;
+async function run(argv) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case 'setup':
+            return (await import('./commands/setup.js')).runSetup(rest);
+        case 'probe':
+            return (await import('./commands/probe.js')).runProbe(rest);
+        case 'logs':
+            return (await import('./commands/logs.js')).runLogs(rest);
+        case 'pr': {
+            // The catalog is the one source for an action, so the shorthand asks it rather than keeping a
+            // second list: a subcommand the catalog does not have stays with the flag-only lifecycle.
+            // Bare `pr` asks the catalog too, where `run` needs no branch: the flag-only path would only
+            // tell it that --repo is required.
+            if (rest.length === 0)
+                return (await import('./commands/gh.js')).runGh(['pr']);
+            const sub = rest[0];
+            if (sub === 'review' && rest.some((argument) => argument === '--id' || argument.startsWith('--id='))) {
+                return (await import('./commands/pr.js')).runPr(rest.slice(1));
+            }
+            if (sub !== undefined && Object.hasOwn(GH_ACTIONS, `pr:${sub}`)) {
+                return (await import('./commands/gh.js')).runGh(['pr', ...rest], { unreachableExitCode: 3 });
+            }
+            return (await import('./commands/pr.js')).runPr(rest);
+        }
+        case 'run':
+            return (await import('./commands/gh.js')).runGh(['run', ...rest]);
+        case 'gh':
+            return (await import('./commands/gh.js')).runGh(rest);
+        default:
+            process.stderr.write(`gcb: unknown client command \`${command ?? ''}\`.\n`);
+            return 1;
+    }
+}
+export const clientBackend = {
+    role: 'client',
+    commands: ['setup', 'probe', 'logs', 'pr', 'run', 'gh'],
+    help: CLIENT_HELP,
+    run,
+};
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;SAC7B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;SAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;eASZ,qBAAqB,CAAC,IAAI,CAAC;0CACA,qBAAqB,CAAC,KAAK,CAAC;;;;;;;;;;;;mEAYH,CAAC;AAEpE,KAAK,UAAU,GAAG,CAAC,IAAuB;IACxC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,IAAI,EAAE,CAAC;YACV,8FAA8F;YAC9F,0FAA0F;YAC1F,6FAA6F;YAC7F,mCAAmC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACrG,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,KAAK;YACR,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACpE,KAAK,IAAI;YACP,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;IACvD,IAAI,EAAE,WAAW;IACjB,GAAG;CACJ,CAAC"}

package/package.json

@@ -1,5 +1,36 @@
 {
   "name": "gcb-client",
-  "version": "0.0.0",
-  "packageManager": "yarn@4.18.1"
+  "version": "0.0.2",
+  "description": "Container-side gcb client: credential helper, setup, and socket-backed commands.",
+  "license": "MIT",
+  "author": "JounQin <admin@1stg.me>",
+  "homepage": "https://github.com/code-vaults/git-credential-broker#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/code-vaults/git-credential-broker.git"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "gcb": "./bin/gcb.js"
+  },
+  "files": [
+    "lib",
+    "bin"
+  ],
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    }
+  },
+  "dependencies": {
+    "gcb-core": "0.0.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
 }

package/README.md

@@ -1 +0,0 @@
-# gcb