glimmervoid 0.0.0-stage → 0.30.0

package/dist/chunks/remote-config-C2ytQwrs.js

@@ -0,0 +1,525 @@
+import { X as equalsIgnoringCaseOnWindows, g as writeJsonAtomicSync, h as writeJsonAtomic, q as canonicalizePath, s as glimmervoidHomeDir } from "./config-store-mm7MgzoL.js";
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+//#region server/core/pairing-token.ts
+var DEFAULT_TOKEN_TTL_MS = 6e5;
+var DEFAULT_DEVICE_MAX_AGE_MS = 15552e6;
+function hashSecret(value) {
+	return crypto.createHash("sha256").update(String(value), "utf8").digest("hex");
+}
+function mintPairingToken({ now = Date.now(), ttlMs = DEFAULT_TOKEN_TTL_MS, randomBytes = crypto.randomBytes } = {}) {
+	const token = Buffer.from(randomBytes(32)).toString("base64url");
+	return {
+		token,
+		tokenHash: hashSecret(token),
+		createdAt: now,
+		expiresAt: now + ttlMs
+	};
+}
+function decideRedemption({ record, now = Date.now() }) {
+	if (!record) return {
+		ok: false,
+		reason: "unknown"
+	};
+	if (record.usedAt) return {
+		ok: false,
+		reason: "used"
+	};
+	if (typeof record.expiresAt === "number" && now > record.expiresAt) return {
+		ok: false,
+		reason: "expired"
+	};
+	return {
+		ok: true,
+		reason: null
+	};
+}
+function mintDeviceCredential({ randomBytes = crypto.randomBytes } = {}) {
+	const id = Buffer.from(randomBytes(8)).toString("base64url");
+	const secret = Buffer.from(randomBytes(32)).toString("base64url");
+	return {
+		id,
+		secret,
+		secretHash: hashSecret(secret),
+		cookieValue: `${id}.${secret}`
+	};
+}
+function decideDeviceAuth({ record, now = Date.now(), maxAgeMs = DEFAULT_DEVICE_MAX_AGE_MS, secretMatches } = {}) {
+	if (!record) return {
+		ok: false,
+		reason: "unknown"
+	};
+	if (record.revokedAt) return {
+		ok: false,
+		reason: "revoked"
+	};
+	if (typeof record.createdAt === "number" && maxAgeMs > 0 && now - record.createdAt > maxAgeMs) return {
+		ok: false,
+		reason: "expired"
+	};
+	if (secretMatches !== true) return {
+		ok: false,
+		reason: "bad-secret"
+	};
+	return {
+		ok: true,
+		reason: null
+	};
+}
+var UA_PATTERNS = [
+	[/iphone/i, "iPhone"],
+	[/ipad/i, "iPad"],
+	[/android/i, "Android"],
+	[/mac os x|macintosh/i, "Mac"],
+	[/windows/i, "Windows"],
+	[/cros/i, "ChromeOS"],
+	[/linux/i, "Linux"]
+];
+function deviceNameFromUserAgent(ua) {
+	if (typeof ua !== "string" || ua.trim() === "") return "unnamed device";
+	for (const [pattern, label] of UA_PATTERNS) if (pattern.test(ua)) return label;
+	return "unnamed device";
+}
+//#endregion
+//#region server/pairings-store.ts
+var SNAPSHOT_RELOAD_MS = 3e4;
+var REVOCATION_PROPAGATION_SECONDS = Math.ceil(SNAPSHOT_RELOAD_MS / 1e3);
+var LOCK_SUFFIX = ".lock";
+var LOCK_RETRY_MS = 50;
+var LOCK_MAX_ATTEMPTS = 10;
+var LOCK_STALE_MS = 5e3;
+function errorLabel(err) {
+	const failure = err ?? {};
+	return String(failure.code || failure.message || err);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+function sleepSync(ms) {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function emptyDoc() {
+	return {
+		version: 1,
+		pending: [],
+		devices: []
+	};
+}
+function configSiblingPath(configPath, name) {
+	if (configPath) return path.join(path.dirname(configPath), name);
+	return path.join(glimmervoidHomeDir(), name);
+}
+function defaultPairingsPath(configPath) {
+	return configSiblingPath(configPath, "pairings.json");
+}
+function defaultSeenPath(configPath) {
+	return configSiblingPath(configPath, "pairings-seen.json");
+}
+function coerceDoc(parsed) {
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return emptyDoc();
+	const source = parsed;
+	return {
+		version: 1,
+		pending: Array.isArray(source.pending) ? source.pending.filter((r) => r && typeof r.tokenHash === "string") : [],
+		devices: Array.isArray(source.devices) ? source.devices.filter((r) => r && typeof r.id === "string") : []
+	};
+}
+function pairingsSignature(doc) {
+	const safe = coerceDoc(doc);
+	return JSON.stringify(safe);
+}
+function createPairingsStore({ filePath = defaultPairingsPath(), now = Date.now, randomBytes, warn = console.warn, setIntervalFn = (fn, ms) => setInterval(fn, ms), clearIntervalFn = (handle) => clearInterval(handle) } = {}) {
+	const pairingsPath = filePath;
+	let snapshot = emptyDoc();
+	function readDocSync() {
+		let raw;
+		try {
+			raw = fs.readFileSync(pairingsPath, "utf8");
+		} catch (err) {
+			if (err?.code === "ENOENT") return {
+				doc: emptyDoc(),
+				missing: true,
+				corrupt: false
+			};
+			warn(`[pairings] Failed to read ${pairingsPath}: ${errorLabel(err)}`);
+			return {
+				doc: emptyDoc(),
+				missing: false,
+				corrupt: true
+			};
+		}
+		try {
+			return {
+				doc: coerceDoc(JSON.parse(raw)),
+				missing: false,
+				corrupt: false
+			};
+		} catch (err) {
+			warn(`[pairings] Invalid JSON in ${pairingsPath}: ${errorMessage(err)} - treating as no paired devices`);
+			return {
+				doc: emptyDoc(),
+				missing: false,
+				corrupt: true
+			};
+		}
+	}
+	function load() {
+		snapshot = readDocSync().doc;
+		return snapshot;
+	}
+	const lockPath = `${pairingsPath}${LOCK_SUFFIX}`;
+	function ensureDir() {
+		fs.mkdirSync(path.dirname(pairingsPath), {
+			recursive: true,
+			mode: 448
+		});
+	}
+	function removeIfStale() {
+		try {
+			const stat = fs.statSync(lockPath);
+			if (Date.now() - stat.mtimeMs <= LOCK_STALE_MS) return false;
+			fs.unlinkSync(lockPath);
+			warn("[pairings] Removed a stale write lock left by an earlier process");
+			return true;
+		} catch {
+			return true;
+		}
+	}
+	function acquireLock() {
+		for (let attempt = 0; attempt < LOCK_MAX_ATTEMPTS; attempt += 1) {
+			try {
+				fs.closeSync(fs.openSync(lockPath, "wx", 384));
+				return true;
+			} catch (err) {
+				if (err?.code !== "EEXIST") {
+					warn(`[pairings] Could not take the write lock: ${errorLabel(err)}`);
+					return false;
+				}
+			}
+			if (removeIfStale()) continue;
+			sleepSync(LOCK_RETRY_MS);
+		}
+		return false;
+	}
+	function releaseLock() {
+		try {
+			fs.unlinkSync(lockPath);
+		} catch {}
+	}
+	function save(mutator) {
+		try {
+			ensureDir();
+		} catch (err) {
+			warn(`[pairings] Failed to create ${path.dirname(pairingsPath)}: ${errorLabel(err)}`);
+			return null;
+		}
+		if (!acquireLock()) {
+			warn("[pairings] Another process holds the pairings write lock - nothing was written");
+			return null;
+		}
+		try {
+			const { doc, corrupt } = readDocSync();
+			if (corrupt) {
+				warn("[pairings] Refusing to write over an unreadable pairings file");
+				return null;
+			}
+			if (!mutator(doc)) {
+				snapshot = doc;
+				return doc;
+			}
+			writeJsonAtomicSync(pairingsPath, doc, { mode: 384 });
+			snapshot = doc;
+			return doc;
+		} catch (err) {
+			warn(`[pairings] Failed to write ${pairingsPath}: ${errorLabel(err)}`);
+			return null;
+		} finally {
+			releaseLock();
+		}
+	}
+	function isDeadPending(record, at) {
+		if (!record) return true;
+		if (record.usedAt) return true;
+		return typeof record.expiresAt === "number" && at > record.expiresAt;
+	}
+	function mintPending({ name = "", ttlMs } = {}) {
+		const minted = mintPairingToken({
+			now: now(),
+			ttlMs,
+			randomBytes
+		});
+		if (!save((doc) => {
+			doc.pending = doc.pending.filter((p) => !isDeadPending(p, now()));
+			doc.pending.push({
+				tokenHash: minted.tokenHash,
+				name: String(name || ""),
+				createdAt: minted.createdAt,
+				expiresAt: minted.expiresAt,
+				usedAt: null
+			});
+			return true;
+		})) return null;
+		return {
+			token: minted.token,
+			expiresAt: minted.expiresAt,
+			name: String(name || "")
+		};
+	}
+	function redeem(token, { fallbackName = "" } = {}) {
+		const tokenHash = hashSecret(token);
+		let outcome = {
+			ok: false,
+			reason: "unknown",
+			device: null
+		};
+		if (!save((doc) => {
+			const record = doc.pending.find((p) => p.tokenHash === tokenHash) || null;
+			const verdict = decideRedemption({
+				record,
+				now: now()
+			});
+			if (!verdict.ok) {
+				outcome = {
+					ok: false,
+					reason: verdict.reason,
+					device: null
+				};
+				return false;
+			}
+			if (!record) return false;
+			const credential = mintDeviceCredential({ randomBytes });
+			record.usedAt = now();
+			const device = {
+				id: credential.id,
+				secretHash: credential.secretHash,
+				name: record.name || String(fallbackName || "") || "unnamed device",
+				createdAt: now(),
+				revokedAt: null
+			};
+			doc.devices.push(device);
+			outcome = {
+				ok: true,
+				reason: null,
+				device,
+				cookieValue: credential.cookieValue
+			};
+			return true;
+		})) return {
+			ok: false,
+			reason: "write-failed",
+			device: null
+		};
+		return outcome;
+	}
+	function findDevice(id) {
+		if (typeof id !== "string" || id === "") return null;
+		return snapshot.devices.find((d) => d.id === id) || null;
+	}
+	function listDevices() {
+		return snapshot.devices.map((d) => ({ ...d }));
+	}
+	function revokeDevice(id) {
+		let found = false;
+		if (!save((doc) => {
+			const device = doc.devices.find((d) => d.id === id);
+			if (!device) return false;
+			found = true;
+			device.revokedAt = now();
+			return true;
+		})) return {
+			ok: false,
+			reason: "write-failed"
+		};
+		if (!found) return {
+			ok: false,
+			reason: "unknown"
+		};
+		return {
+			ok: true,
+			reason: null
+		};
+	}
+	function prunePending() {
+		const at = now();
+		let removed = 0;
+		save((doc) => {
+			const kept = doc.pending.filter((p) => !isDeadPending(p, at));
+			removed = doc.pending.length - kept.length;
+			if (removed === 0) return false;
+			doc.pending = kept;
+			return true;
+		});
+		return removed;
+	}
+	function watch(onChange) {
+		let timer = null;
+		let watcher = null;
+		const dir = path.dirname(pairingsPath);
+		let lastSignature = pairingsSignature(snapshot);
+		function refresh() {
+			load();
+			const signature = pairingsSignature(snapshot);
+			if (signature === lastSignature) return;
+			lastSignature = signature;
+			if (onChange) onChange(snapshot);
+		}
+		const reloadInterval = setIntervalFn(refresh, SNAPSHOT_RELOAD_MS);
+		if (reloadInterval.unref) reloadInterval.unref();
+		try {
+			ensureDir();
+			watcher = fs.watch(canonicalizePath(dir), (_event, filename) => {
+				if (filename && !equalsIgnoringCaseOnWindows(path.basename(String(filename)), path.basename(pairingsPath))) return;
+				if (timer) clearTimeout(timer);
+				timer = setTimeout(refresh, 200);
+				if (timer.unref) timer.unref();
+			});
+		} catch (err) {
+			warn(`[pairings] Failed to watch ${dir}: ${errorMessage(err)} - falling back to the ${REVOCATION_PROPAGATION_SECONDS}s reload interval`);
+		}
+		return function stop() {
+			if (timer) clearTimeout(timer);
+			clearIntervalFn(reloadInterval);
+			if (watcher) try {
+				watcher.close();
+			} catch {}
+			watcher = null;
+		};
+	}
+	load();
+	return {
+		path: pairingsPath,
+		load,
+		save,
+		mintPending,
+		redeem,
+		findDevice,
+		listDevices,
+		revokeDevice,
+		prunePending,
+		watch,
+		get snapshot() {
+			return snapshot;
+		}
+	};
+}
+function createSeenStore({ filePath = defaultSeenPath(), throttleMs = 6e4, now = Date.now } = {}) {
+	const lastWriteByDevice = /* @__PURE__ */ new Map();
+	let pending = null;
+	function readAll() {
+		try {
+			const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+			return {};
+		} catch {
+			return {};
+		}
+	}
+	const doc = readAll();
+	function touch(deviceId) {
+		if (!deviceId) return;
+		const at = now();
+		const last = lastWriteByDevice.get(deviceId);
+		if (last != null && at - last < throttleMs) return;
+		lastWriteByDevice.set(deviceId, at);
+		doc[deviceId] = at;
+		pending = writeJsonAtomic(filePath, doc, { mode: 384 }).catch(() => {});
+	}
+	return {
+		touch,
+		readAll,
+		get pending() {
+			return pending;
+		}
+	};
+}
+//#endregion
+//#region server/core/remote-config.ts
+function toPort(value) {
+	if (typeof value === "number" && Number.isInteger(value)) return value;
+	if (typeof value === "string" && /^\d+$/.test(value.trim())) return Number.parseInt(value.trim(), 10);
+	return null;
+}
+function normalizeRemoteConfig(raw) {
+	const src = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+	const enabled = src.enabled === true;
+	const port = toPort(src.port);
+	const publicHost = typeof src.publicHost === "string" ? src.publicHost.trim() : "";
+	const ownerLogin = typeof src.ownerLogin === "string" ? src.ownerLogin.trim().toLowerCase() : "";
+	if (!enabled) return {
+		enabled,
+		port,
+		publicHost,
+		allowedOrigins: [],
+		ownerLogin
+	};
+	const listed = Array.isArray(src.allowedOrigins) ? src.allowedOrigins.filter((o) => typeof o === "string" && o.trim() !== "").map((o) => o.trim()) : [];
+	if (listed.length === 0 && publicHost !== "") return {
+		enabled,
+		port,
+		publicHost,
+		allowedOrigins: [`https://${publicHost}`],
+		ownerLogin
+	};
+	return {
+		enabled,
+		port,
+		publicHost,
+		allowedOrigins: listed,
+		ownerLogin
+	};
+}
+function validateRemoteConfig(remote, localPort) {
+	if (!remote || remote.enabled !== true) return {
+		ok: true,
+		error: null
+	};
+	if (remote.port == null) return {
+		ok: false,
+		error: "remote.enabled is true but remote.port is not set"
+	};
+	if (!Number.isInteger(remote.port) || remote.port < 1 || remote.port > 65535) return {
+		ok: false,
+		error: `remote.port must be an integer 1-65535 (got ${JSON.stringify(remote.port)})`
+	};
+	if (remote.port === localPort) return {
+		ok: false,
+		error: `remote.port (${remote.port}) must differ from the local port (${localPort})`
+	};
+	return {
+		ok: true,
+		error: null
+	};
+}
+function isLoopbackHost(host) {
+	if (typeof host !== "string") return false;
+	const bare = host.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+	if (bare === "" || bare === "localhost") return bare === "localhost";
+	if (bare === "::1" || bare === "0:0:0:0:0:0:0:1") return true;
+	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(bare);
+}
+function decideBindHost({ envHost, insecureBind } = {}) {
+	const host = typeof envHost === "string" ? envHost.trim() : "";
+	if (host === "") return {
+		host: "127.0.0.1",
+		allowed: true,
+		reason: null
+	};
+	if (isLoopbackHost(host)) return {
+		host,
+		allowed: true,
+		reason: null
+	};
+	if (insecureBind === true) return {
+		host,
+		allowed: true,
+		reason: "insecure-bind"
+	};
+	return {
+		host,
+		allowed: false,
+		reason: "non-loopback"
+	};
+}
+//#endregion
+export { configSiblingPath as a, defaultPairingsPath as c, decideDeviceAuth as d, deviceNameFromUserAgent as f, REVOCATION_PROPAGATION_SECONDS as i, defaultSeenPath as l, normalizeRemoteConfig as n, createPairingsStore as o, hashSecret as p, validateRemoteConfig as r, createSeenStore as s, decideBindHost as t, DEFAULT_DEVICE_MAX_AGE_MS as u };

package/dist/chunks/rtk-hook-core-Bl6gYHPN.js

@@ -0,0 +1,133 @@
+//#region session/core/sane-yolo.ts
+var SANE_YOLO_PATH_ENV = "GLIMMERVOID_SANE_YOLO_PATH";
+var SANE_YOLO_POLICY = {
+	version: 1,
+	destructive_command_protection: {
+		enabled: true,
+		overrides: {
+			"git.branch-force-delete": "off",
+			"git.merge-abort": "off",
+			"git.rebase-abort": "off",
+			"rm.recursive-force-dynamic-target": "on"
+		}
+	},
+	secret_protection: { enabled: false }
+};
+var SANE_YOLO_RULES = {
+	version: 1,
+	rules: ["infra"],
+	overrides: {},
+	transparent_wrappers: ["rtk", "npx"]
+};
+var INFRA_REASON = "Sane YOLO blocks infrastructure teardown; run this command by hand.";
+var TERRAFORM_DESTROY_FLAGS = [
+	"-destroy",
+	"--destroy",
+	"-destroy=true",
+	"--destroy=true"
+];
+var SANE_YOLO_FILES = {
+	"policy.json": SANE_YOLO_POLICY,
+	"rules/rule.json": SANE_YOLO_RULES,
+	"rules/infra/rulebook.json": {
+		rulebook_version: 1,
+		name: "infra",
+		version: "1.1.0",
+		allowed_commands: [
+			"terraform",
+			"tofu",
+			"pulumi",
+			"kubectl"
+		],
+		rules: [
+			{
+				name: "terraform-destroy",
+				command: "terraform",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "terraform-apply-destroy",
+				command: "terraform",
+				subcommand: "apply",
+				block_args: TERRAFORM_DESTROY_FLAGS,
+				reason: INFRA_REASON
+			},
+			{
+				name: "tofu-destroy",
+				command: "tofu",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "tofu-apply-destroy",
+				command: "tofu",
+				subcommand: "apply",
+				block_args: TERRAFORM_DESTROY_FLAGS,
+				reason: INFRA_REASON
+			},
+			{
+				name: "pulumi-destroy",
+				command: "pulumi",
+				subcommand: "destroy",
+				block_args: ["destroy"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "pulumi-down",
+				command: "pulumi",
+				subcommand: "down",
+				block_args: ["down"],
+				reason: INFRA_REASON
+			},
+			{
+				name: "kubectl-delete-namespace",
+				command: "kubectl",
+				subcommand: "delete",
+				block_args: [
+					"ns",
+					"namespace",
+					"namespaces"
+				],
+				reason: INFRA_REASON
+			}
+		]
+	}
+};
+function saneYoloEnv(homeDir) {
+	return {
+		CC_SAFETY_NET_HOME: homeDir,
+		CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY: "1",
+		CC_SAFETY_NET_AUDIT_HOME: homeDir,
+		CC_SAFETY_NET_AUDIT_SCOPE: "blocked"
+	};
+}
+//#endregion
+//#region session/core/rtk-hook-core.ts
+var RTK_PATH_ENV = "GLIMMERVOID_RTK_PATH";
+var MAX_RTK_STDOUT_BYTES = 65536;
+function isPlainObject(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeRtkHookResponse(stdoutText) {
+	if (typeof stdoutText !== "string") return "";
+	const trimmed = stdoutText.trim();
+	if (!trimmed) return "";
+	if (Buffer.byteLength(trimmed) > 65536) return "";
+	let parsed = null;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return "";
+	}
+	if (!isPlainObject(parsed)) return "";
+	const hookSpecificOutput = parsed.hookSpecificOutput;
+	if (isPlainObject(hookSpecificOutput) && isPlainObject(hookSpecificOutput.updatedInput)) {
+		if (typeof hookSpecificOutput.permissionDecision !== "string") hookSpecificOutput.permissionDecision = "allow";
+	}
+	return JSON.stringify(parsed);
+}
+//#endregion
+export { SANE_YOLO_PATH_ENV as a, SANE_YOLO_FILES as i, RTK_PATH_ENV as n, saneYoloEnv as o, normalizeRtkHookResponse as r, MAX_RTK_STDOUT_BYTES as t };

package/dist/chunks/rtk-resolver-CLo-gZzw.js

@@ -0,0 +1,21 @@
+import { i as execSync } from "./child-process-safe-DRGsp0TE.js";
+import { n as glimmervoidHomeDir } from "./config-path-core-DFt-TemS.js";
+import { r as resolveRtkPath } from "./hook-tools-pSJia7ks.js";
+import fs from "node:fs";
+import os from "node:os";
+//#region server/rtk-resolver.ts
+function resolveRtkPathFromSystem() {
+	return resolveRtkPath({
+		glimmervoidHome: glimmervoidHomeDir(os.homedir(), process.env),
+		platform: process.platform,
+		exec: execSync,
+		fsApi: fs
+	});
+}
+var cachedRtkPath = null;
+function getRtkPath(resolve = resolveRtkPathFromSystem) {
+	if (!cachedRtkPath) cachedRtkPath = resolve();
+	return cachedRtkPath;
+}
+//#endregion
+export { getRtkPath as t };

package/dist/chunks/rtk-resolver-CMQAidlI.js

@@ -0,0 +1,2 @@
+import { t as getRtkPath } from "./rtk-resolver-CLo-gZzw.js";
+export { getRtkPath };