git-daemon 0.1.5 → 0.1.7

package/README.md

@@ -39,7 +39,8 @@ npm install
 npm run daemon
 ```
 
-The daemon listens on `http://127.0.0.1:8790` by default.
+The daemon listens on `http://127.0.0.1:8790` by default, and can also expose
+HTTPS on `https://127.0.0.1:8791` when enabled.
 
 ## HTTPS support
 
@@ -175,6 +176,10 @@ Key settings live in `config.json`:
 
 Tokens are stored (hashed) in `tokens.json`. Logs are written under the configured `logging.directory` with rotation.
 
+Approvals can be scoped per repo or origin-wide. To allow a capability for all repos
+from an origin, set `"repoPath": null` in an approvals entry. When a TTY is
+available, the daemon will prompt for approval on first use.
+
 ## Development
 
 Run tests:

package/config.schema.json

@@ -174,7 +174,11 @@
                 "format": "uri"
               },
               "repoPath": {
-                "type": "string"
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "description": "Repo path to scope approvals. Null means all repos for the origin."
               },
               "capabilities": {
                 "type": "array",

package/design.md

@@ -64,6 +64,7 @@ These components are **not part of this project**; they are listed only to defin
 
    * Binds to `127.0.0.1` only
    * Implements a small HTTP JSON API + streaming logs (SSE)
+   * Optional HTTPS listener can be enabled alongside HTTP
    * Runs **system git** for native credentials & compatibility
    * Runs **package manager installs** in sandboxed repos
    * Provides OS integrations: open folder/terminal/VS Code
@@ -85,6 +86,7 @@ These components are **not part of this project**; they are listed only to defin
 #### 1) Bind to loopback only
 
 * Listen on `127.0.0.1:<daemonPort>` (not `0.0.0.0`)
+* HTTPS listener may also bind to loopback when enabled
 * Reject requests to non-loopback interfaces.
 
 #### 2) Origin allowlist (hard gate)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-daemon",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "private": false,
   "type": "commonjs",
   "main": "dist/daemon.js",

package/src/app.ts

@@ -3,7 +3,9 @@ import rateLimit from "express-rate-limit";
 import type { Logger } from "pino";
 import type { Request, Response, NextFunction } from "express";
 import { promises as fs } from "fs";
+import * as fsSync from "fs";
 import path from "path";
+import readline from "readline";
 import { createHttpLogger } from "./logger";
 import type { AppConfig, Capabilities } from "./types";
 import {
@@ -48,7 +50,8 @@ import { openTarget } from "./os";
 import type { TokenStore } from "./tokens";
 import type { PairingManager } from "./pairing";
 import type { JobManager } from "./jobs";
-import { requireApproval } from "./approvals";
+import { hasApproval, requireApproval } from "./approvals";
+import { saveConfig } from "./config";
 
 export type DaemonContext = {
   config: AppConfig;
@@ -365,8 +368,8 @@ export const createApp = (ctx: DaemonContext) => {
       );
 
       if (payload.target === "terminal") {
-        requireApproval(
-          ctx.config,
+        await ensureApproval(
+          ctx,
           origin,
           resolved,
           "open-terminal",
@@ -374,8 +377,8 @@ export const createApp = (ctx: DaemonContext) => {
         );
       }
       if (payload.target === "vscode") {
-        requireApproval(
-          ctx.config,
+        await ensureApproval(
+          ctx,
           origin,
           resolved,
           "open-vscode",
@@ -411,8 +414,8 @@ export const createApp = (ctx: DaemonContext) => {
         } catch {
           throw repoNotFound();
         }
-        requireApproval(
-          ctx.config,
+        await ensureApproval(
+          ctx,
           origin,
           resolved,
           "deps/install",
@@ -462,8 +465,22 @@ export const createApp = (ctx: DaemonContext) => {
     }
   });
 
-  app.use((err: unknown, _req: Request, res: Response, _next: NextFunction) => {
+  app.use((err: unknown, req: Request, res: Response, _next: NextFunction) => {
     if (err instanceof ApiError) {
+      if (err.status === 409) {
+        console.warn(
+          `[Git Daemon] 409 ${err.body.errorCode} ${req.method} ${req.originalUrl} origin=${req.headers.origin ?? ""}`,
+        );
+        ctx.logger.warn(
+          {
+            errorCode: err.body.errorCode,
+            method: req.method,
+            path: req.originalUrl,
+            origin: req.headers.origin,
+          },
+          "Request rejected with conflict",
+        );
+      }
       res.status(err.status).json(err.body);
       return;
     }
@@ -480,3 +497,86 @@ export const createApp = (ctx: DaemonContext) => {
 
   return app;
 };
+
+const ensureApproval = async (
+  ctx: DaemonContext,
+  origin: string,
+  repoPath: string,
+  capability: "open-terminal" | "open-vscode" | "deps/install",
+  workspaceRoot?: string | null,
+) => {
+  if (hasApproval(ctx.config, origin, repoPath, capability, workspaceRoot)) {
+    return;
+  }
+  const approved = await promptApproval(origin, repoPath, capability);
+  if (!approved) {
+    requireApproval(ctx.config, origin, repoPath, capability, workspaceRoot);
+    return;
+  }
+  upsertOriginApproval(ctx, origin, capability);
+  await saveConfig(ctx.configDir, ctx.config);
+};
+
+const createPromptInterface = () => {
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    return readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+  }
+  const ttyPath = process.platform === "win32" ? "CON" : "/dev/tty";
+  try {
+    const input = fsSync.createReadStream(ttyPath, { encoding: "utf8" });
+    const output = fsSync.createWriteStream(ttyPath);
+    return readline.createInterface({ input, output });
+  } catch {
+    return null;
+  }
+};
+
+const askQuestion = (rl: readline.Interface, question: string) =>
+  new Promise<string>((resolve) => {
+    rl.question(question, (answer) => resolve(answer));
+  });
+
+const promptApproval = async (
+  origin: string,
+  repoPath: string,
+  capability: string,
+) => {
+  const rl = createPromptInterface();
+  if (!rl) {
+    return false;
+  }
+  const answer = await askQuestion(
+    rl,
+    `Approve ${capability} for origin ${origin} (all repos)? [y/N] Requested path: ${repoPath} `,
+  );
+  rl.close();
+  const normalized = answer.trim().toLowerCase();
+  return normalized === "y" || normalized === "yes";
+};
+
+const upsertOriginApproval = (
+  ctx: DaemonContext,
+  origin: string,
+  capability: "open-terminal" | "open-vscode" | "deps/install",
+) => {
+  const existing = ctx.config.approvals.entries.find(
+    (entry) =>
+      entry.origin === origin &&
+      (entry.repoPath === null || entry.repoPath === "*"),
+  );
+  if (existing) {
+    if (!existing.capabilities.includes(capability)) {
+      existing.capabilities.push(capability);
+    }
+    return;
+  }
+  ctx.config.approvals.entries.push({
+    origin,
+    repoPath: null,
+    capabilities: [capability],
+    approvedAt: new Date().toISOString(),
+  });
+};

package/src/approvals.ts

@@ -13,10 +13,13 @@ export const hasApproval = (
     if (entry.origin !== origin || !entry.capabilities.includes(capability)) {
       return false;
     }
+    if (entry.repoPath === null || entry.repoPath === "*") {
+      return true;
+    }
     if (entry.repoPath === repoPath) {
       return true;
     }
-    if (workspaceRoot && !path.isAbsolute(entry.repoPath)) {
+    if (workspaceRoot && entry.repoPath && !path.isAbsolute(entry.repoPath)) {
       return path.resolve(workspaceRoot, entry.repoPath) === repoPath;
     }
     return false;

package/src/types.ts

@@ -2,7 +2,7 @@ export type Capability = "open-terminal" | "open-vscode" | "deps/install";
 
 export type ApprovalEntry = {
   origin: string;
-  repoPath: string;
+  repoPath: string | null;
   capabilities: Capability[];
   approvedAt: string;
 };