glimmervoid 0.32.1 → 0.33.0

package/dist/chunks/{pair-cli-DQkrt_-s.js → pair-cli-BuyzST-U.js}

@@ -1,6 +1,6 @@
 import { r as errorMessage } from "./text-DoirglWV.js";
-import { l as resolveConfigPath } from "./config-store-aZpWeX92.js";
-import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-Da4C7tMG.js";
+import { l as resolveConfigPath } from "./config-store-DYsZJDux.js";
+import { c as defaultPairingsPath, i as REVOCATION_PROPAGATION_SECONDS, l as defaultSeenPath, n as normalizeRemoteConfig, o as createPairingsStore, s as createSeenStore } from "./remote-config-DJHVb-HU.js";
 import fs from "node:fs";
 //#region server/text-format.ts
 function trimIso(iso) {

package/dist/chunks/{remote-config-Da4C7tMG.js → remote-config-DJHVb-HU.js}

@@ -3,7 +3,7 @@ import { i as equalsIgnoringCaseOnWindows, t as canonicalizePath } from "./paths
 import { n as isRecord } from "./coerce-NSst8oRP.js";
 import { n as unrefTimer, t as DEFAULT_TIMER_FNS } from "./timer-deps-u2DAQLok.js";
 import { a as jsonStateLoadError, d as writeJsonAtomicSync, l as sleepSync, s as loadJsonStateFileSync, u as writeJsonAtomic } from "./json-file-oEH9vt-0.js";
-import { s as glimmervoidHomeDir } from "./config-store-aZpWeX92.js";
+import { s as glimmervoidHomeDir } from "./config-store-DYsZJDux.js";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";

package/dist/chunks/{session-Dtkp9o3r.js → session-C7rstCmA.js}

@@ -136,6 +136,20 @@ function isSamePromptQuestion(left, right) {
 	return left.text === right.text && left.multiSelect === right.multiSelect && left.options.length === right.options.length && left.options.every((option, index) => option === right.options[index]);
 }
 var AGENT_URL_ENV = "GLIMMERVOID_AGENT_URL";
+var SIGN_URL_ENV = "GLIMMERVOID_SIGN_URL";
+var SSH_SIGN_BODY_CAP_BYTES = 1048576;
+var SshSignRequest = z.object({
+	namespace: z.literal("git", { error: "namespace must be git" }),
+	publicKey: z.string({ error: "publicKey must be a string" }).min(1, { error: "publicKey must not be empty" }).max(16384, { error: "publicKey must be at most 16384 characters" }),
+	payload: z.base64({ error: "payload must be base64" })
+}).strict();
+var SshSignReply = z.union([z.object({
+	ok: z.literal(true),
+	signature: z.string()
+}).strict(), z.object({
+	ok: z.literal(false),
+	error: z.string()
+}).strict()]);
 var AGENT_API_VERBS = [
 	"spawn",
 	"attention",
@@ -193,4 +207,4 @@ z.discriminatedUnion("ok", [z.object({
 	reason: z.string()
 })]);
 //#endregion
-export { firstDetailLine as C, MERGEABLE_LIVE_STATES as D, KILLABLE_STATES as E, RESTARTABLE_STATES as O, isSamePromptQuestion as S, toolDetailLine as T, SessionDoc as _, AgentDispatchRequest as a, TASK_TITLE_CONTROL_CHARACTERS as b, AgentTicketRequest as c, PendingPromptDetail as d, PendingPromptQuestion as f, SESSION_DOC_PATH_MAX_CHARS as g, SESSION_DOC_BODY_CAP_BYTES as h, AgentAttentionRequest as i, STATES as k, ORCHESTRATOR_AGENT_VERBS as l, RefinedTaskTitle as m, AGENT_URL_ENV as n, AgentEditRequest as o, PendingWakeup as p, ASK_USER_QUESTION_TOOL_NAME as r, AgentSpawnRequest as s, AGENT_API_VERBS as t, PROMPT_DETAIL_HIDDEN_CHARACTERS as u, SessionSnapshot as v, toolDetailFieldValue as w, TaskTitle as x, SessionState as y };
+export { KILLABLE_STATES as A, SshSignRequest as C, firstDetailLine as D, isSamePromptQuestion as E, RESTARTABLE_STATES as M, STATES as N, toolDetailFieldValue as O, SshSignReply as S, TaskTitle as T, SIGN_URL_ENV as _, AgentDispatchRequest as a, SessionSnapshot as b, AgentTicketRequest as c, PendingPromptDetail as d, PendingPromptQuestion as f, SESSION_DOC_PATH_MAX_CHARS as g, SESSION_DOC_BODY_CAP_BYTES as h, AgentAttentionRequest as i, MERGEABLE_LIVE_STATES as j, toolDetailLine as k, ORCHESTRATOR_AGENT_VERBS as l, RefinedTaskTitle as m, AGENT_URL_ENV as n, AgentEditRequest as o, PendingWakeup as p, ASK_USER_QUESTION_TOOL_NAME as r, AgentSpawnRequest as s, AGENT_API_VERBS as t, PROMPT_DETAIL_HIDDEN_CHARACTERS as u, SSH_SIGN_BODY_CAP_BYTES as v, TASK_TITLE_CONTROL_CHARACTERS as w, SessionState as x, SessionDoc as y };

package/dist/chunks/ssh-sign-cli-SWtTF00D.js

@@ -0,0 +1,133 @@
+import { r as errorMessage } from "./text-DoirglWV.js";
+import { S as SshSignReply, _ as SIGN_URL_ENV } from "./session-C7rstCmA.js";
+import { n as execFileAsync, o as spawn } from "./child-process-safe-DDELk9XC.js";
+import { a as isLoopbackHostname } from "./hook-relay-core-DA_bz2KA.js";
+import { t as postToAgentIngress } from "./agent-api-cli-DuT7437B.js";
+import { l as parseSshPublicKey } from "./ssh-signing-core-CRhVVWNW.js";
+import path from "node:path";
+import fsp from "node:fs/promises";
+//#region server/ssh-sign-cli.ts
+var SIGN_PATH_PREFIX = "/sign/";
+var DEFAULT_SSH_SIGNING_PROGRAM = "ssh-keygen";
+var SIGNING_PROGRAM_LOOKUP_TIMEOUT_MS = 5e3;
+var OPTIONS_TAKING_A_VALUE = /* @__PURE__ */ new Set([
+	"-Y",
+	"-n",
+	"-f",
+	"-I",
+	"-s",
+	"-O"
+]);
+function readSignInvocation(args) {
+	const optionValues = /* @__PURE__ */ new Map();
+	const operands = [];
+	for (let index = 0; index < args.length; index += 1) {
+		const argument = args[index] ?? "";
+		if (OPTIONS_TAKING_A_VALUE.has(argument)) {
+			optionValues.set(argument, args[index + 1] ?? "");
+			index += 1;
+			continue;
+		}
+		if (!argument.startsWith("-")) operands.push(argument);
+	}
+	const namespace = optionValues.get("-n");
+	const keyFile = optionValues.get("-f");
+	const bufferFile = operands.at(-1);
+	if (optionValues.get("-Y") !== "sign" || !namespace || !keyFile || operands.length !== 1 || !bufferFile) return null;
+	return {
+		namespace,
+		keyFile,
+		bufferFile
+	};
+}
+function signEndpoint(rawUrl) {
+	if (!rawUrl) return null;
+	try {
+		const endpoint = new URL(rawUrl);
+		if (endpoint.protocol !== "http:" || !isLoopbackHostname(endpoint.hostname) || !endpoint.pathname.startsWith(SIGN_PATH_PREFIX)) return null;
+		const token = endpoint.searchParams.get("t") || "";
+		endpoint.search = "";
+		return {
+			endpoint,
+			token
+		};
+	} catch {
+		return null;
+	}
+}
+function parseSignReply(text) {
+	const unanswered = {
+		ok: false,
+		error: `Glimmervoid did not answer the signing request: ${text.slice(0, 200)}`
+	};
+	try {
+		const parsed = SshSignReply.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : unanswered;
+	} catch {
+		return unanswered;
+	}
+}
+async function operatorSigningProgram(env) {
+	const envWithoutInjectedConfig = Object.fromEntries(Object.entries(env).filter(([name]) => name !== "GIT_CONFIG_PARAMETERS"));
+	const configuredProgram = await execFileAsync("git", [
+		"config",
+		"--type=path",
+		"--get",
+		"gpg.ssh.program"
+	], {
+		env: envWithoutInjectedConfig,
+		timeout: SIGNING_PROGRAM_LOOKUP_TIMEOUT_MS,
+		encoding: "utf8"
+	}).then(({ stdout }) => stdout.trim(), () => "");
+	if (!configuredProgram || path.basename(configuredProgram) === "glimmervoid-ssh-sign") return DEFAULT_SSH_SIGNING_PROGRAM;
+	return configuredProgram;
+}
+function runSigningProgram(program, args, { captureStderr }) {
+	return new Promise((resolve) => {
+		const child = spawn(program, [...args], { stdio: [
+			"inherit",
+			"inherit",
+			captureStderr ? "pipe" : "inherit"
+		] });
+		const stderrChunks = [];
+		child.stderr?.on("data", (chunk) => {
+			stderrChunks.push(chunk);
+		});
+		child.on("error", (error) => resolve({
+			exitCode: 127,
+			stderr: errorMessage(error)
+		}));
+		child.on("close", (exitCode) => resolve({
+			exitCode: exitCode ?? 1,
+			stderr: Buffer.concat(stderrChunks).toString("utf8").trim()
+		}));
+	});
+}
+async function runSshSignCli(args, env = process.env) {
+	const invocation = readSignInvocation(args);
+	const target = signEndpoint(env[SIGN_URL_ENV]);
+	const publicKeyText = invocation && target ? await fsp.readFile(invocation.keyFile, "utf8").catch(() => "") : "";
+	const publicKey = parseSshPublicKey(publicKeyText);
+	const signingProgram = await operatorSigningProgram(env);
+	if (!invocation || !target || !publicKey) return (await runSigningProgram(signingProgram, args, { captureStderr: false })).exitCode;
+	const localAttempt = env.SSH_AUTH_SOCK ? await runSigningProgram(signingProgram, args, { captureStderr: true }) : null;
+	if (localAttempt?.exitCode === 0) return 0;
+	const payload = await fsp.readFile(invocation.bufferFile);
+	const reply = await postToAgentIngress(target.endpoint, target.token, {
+		namespace: invocation.namespace,
+		publicKey: publicKeyText,
+		payload: payload.toString("base64")
+	}).then((answer) => parseSignReply(answer.text), (error) => ({
+		ok: false,
+		error: `Glimmervoid did not answer the signing request: ${errorMessage(error)}`
+	}));
+	if (reply.ok) {
+		await fsp.writeFile(`${invocation.bufferFile}.sig`, reply.signature);
+		return 0;
+	}
+	if (localAttempt?.stderr) console.error(localAttempt.stderr);
+	console.error(`glimmervoid: ${reply.error}`);
+	return 1;
+}
+//#endregion
+export { runSshSignCli };

package/dist/chunks/ssh-signing-core-CRhVVWNW.js

@@ -0,0 +1,49 @@
+//#region server/core/ssh-signing-core.ts
+var LITERAL_KEY_PREFIX = "key::";
+var PUBLIC_KEY_LINE = /^(\S+) ([A-Za-z0-9+/]+={0,3})(?:\s.*)?$/;
+var SIGNABLE_GIT_OBJECT_HEADER = /^(?:tree|object) [0-9a-f]{40}(?:[0-9a-f]{24})?\n/;
+var FORWARDED_AGENT_DIR_NAME = /^(?:auth-agent|ssh-)[A-Za-z0-9_-]*$/;
+function parseSshPublicKey(text) {
+	if (text.includes("PRIVATE KEY")) return null;
+	const firstLine = text.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "";
+	const keyLine = firstLine.startsWith(LITERAL_KEY_PREFIX) ? firstLine.slice(5) : firstLine;
+	const match = PUBLIC_KEY_LINE.exec(keyLine);
+	if (!match?.[1] || !match[2]) return null;
+	return {
+		keyType: match[1],
+		keyBlob: match[2]
+	};
+}
+function formatSshPublicKey(publicKey) {
+	return `${publicKey.keyType} ${publicKey.keyBlob}`;
+}
+function isSameSshKey(left, right) {
+	return left.keyType === right.keyType && left.keyBlob === right.keyBlob;
+}
+function agentListsKey(agentListing, wantedKey) {
+	return agentListing.split("\n").some((line) => {
+		const listedKey = parseSshPublicKey(line);
+		return listedKey !== null && isSameSshKey(listedKey, wantedKey);
+	});
+}
+function isSignableGitObject(payload) {
+	return SIGNABLE_GIT_OBJECT_HEADER.test(payload.subarray(0, 128).toString("latin1"));
+}
+function isForwardedAgentDirName(entryName) {
+	return FORWARDED_AGENT_DIR_NAME.test(entryName);
+}
+function orderAgentSockets({ inheritedSocket, discovered }) {
+	const newestFirst = [...discovered].sort((left, right) => right.modifiedAtMs - left.modifiedAtMs).map((candidate) => candidate.socketPath);
+	const ordered = inheritedSocket ? [inheritedSocket, ...newestFirst] : newestFirst;
+	return ordered.filter((socketPath, index) => ordered.indexOf(socketPath) === index);
+}
+var COMMIT_SIGNING_SHIM_NAME = "glimmervoid-ssh-sign";
+function posixSingleQuote(text) {
+	return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function commitSigningShimText({ nodePath, cliPath }) {
+	return `#!/bin/sh\nexec ${posixSingleQuote(nodePath)} ${posixSingleQuote(cliPath)} ssh-sign "$@"\n`;
+}
+var NO_AGENT_HOLDS_KEY = "no reachable ssh agent holds the signing key; connect to this machine with agent forwarding (ssh -A, or ForwardAgent yes from coder config-ssh) and commit again";
+//#endregion
+export { formatSshPublicKey as a, orderAgentSockets as c, commitSigningShimText as i, parseSshPublicKey as l, NO_AGENT_HOLDS_KEY as n, isForwardedAgentDirName as o, agentListsKey as r, isSignableGitObject as s, COMMIT_SIGNING_SHIM_NAME as t };