hammerkit 1.26.0 → 1.27.0-next.2

package/dist/server/sandbox-files.js

@@ -0,0 +1,1054 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostSandboxFiles = exports.isRunState = exports.RUN_STATE_DIRECTORY = exports.deniedPath = exports.checkPath = exports.SandboxFileError = exports.MAX_CHANGES_BYTES = exports.READ_LINES = exports.MAX_FILE_BYTES = void 0;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const minimatch_1 = require("minimatch");
+const source_manifest_1 = require("../remote/source-manifest");
+const sandbox_patch_1 = require("./sandbox-patch");
+// The largest file the API reads into memory, edits or writes: the limit of an upload.
+exports.MAX_FILE_BYTES = source_manifest_1.MAX_SOURCE_FILE_BYTES;
+// what one typed read answers at most
+exports.READ_LINES = 2000;
+const MAX_READ_LINES = 10000;
+const MAX_READ_BYTES = 256 * 1024;
+const MAX_LINE_CHARS = 2000;
+const TREE_LIMIT = 1000;
+const MAX_TREE_LIMIT = 10000;
+const SEARCH_LIMIT = 250;
+const MAX_SEARCH_LIMIT = 5000;
+// a search counts its results up to this many past the page, then stops ripgrep
+const SEARCH_COUNT = 20000;
+const SEARCH_TIMEOUT_MS = 60000;
+// the most a diff or patch of the changes may take
+exports.MAX_CHANGES_BYTES = 64 * 1024 * 1024;
+class SandboxFileError extends Error {
+    constructor(status, message, details = {}) {
+        super(message);
+        this.status = status;
+        this.details = details;
+    }
+}
+exports.SandboxFileError = SandboxFileError;
+/**
+ * A path as the API takes it: relative, `/` between names, no `.` or `..`, and nothing the
+ * deny list of uploads names (`.git/`, `.env`, keys).
+ */
+function checkPath(path) {
+    if (path.length === 0 ||
+        path.length > 4096 ||
+        path.startsWith('/') ||
+        path.includes('\\') ||
+        path.includes('\0') ||
+        /^[A-Za-z]:/.test(path) ||
+        path.split('/').some((part) => part === '' || part === '.' || part === '..')) {
+        throw new SandboxFileError(400, `${JSON.stringify(path.slice(0, 200))} is not a path in the sandbox: relative, / between names, no . or ..`);
+    }
+    const denied = deniedPath(path);
+    if (denied) {
+        throw new SandboxFileError(403, `${path}: ${denied}, the API does not read or write it`);
+    }
+    return path;
+}
+exports.checkPath = checkPath;
+// The deny list of uploads, with the last name taken as a directory too, so `.git` itself
+// is as denied as what is in it.
+function deniedPath(path) {
+    return (0, source_manifest_1.deniedSourcePath)(path) ?? (0, source_manifest_1.deniedSourcePath)(`${path}/-`);
+}
+exports.deniedPath = deniedPath;
+const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+// What hammerkit itself writes next to a task while it runs: `.hammerkit/` in the task's
+// directory, at any depth (the last resolved cache entry, the state of local tasks). It is
+// the run's, not a change to the sandbox's files, so changes and pushes leave it out.
+exports.RUN_STATE_DIRECTORY = '.hammerkit';
+function isRunState(path) {
+    return path.split('/').slice(0, -1).includes(exports.RUN_STATE_DIRECTORY);
+}
+exports.isRunState = isRunState;
+function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function decodeCursor(cursor, type) {
+    if (cursor === undefined || cursor === '') {
+        return undefined;
+    }
+    try {
+        const value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (typeof value === type) {
+            return value;
+        }
+    }
+    catch {
+        // answered below
+    }
+    throw new SandboxFileError(400, 'the cursor is not one this API gave out');
+}
+function clamp(value, fallback, max) {
+    return Math.min(Math.max(1, Math.floor(value ?? fallback)), max);
+}
+// A commit of `tree` (the index when left out) on top of the commit the sandbox is at.
+async function writeCommit(run, author, tree) {
+    const identity = {
+        GIT_AUTHOR_NAME: author.name,
+        GIT_AUTHOR_EMAIL: author.email,
+        GIT_COMMITTER_NAME: author.name,
+        GIT_COMMITTER_EMAIL: author.email,
+    };
+    const written = tree ?? (await run(['write-tree'], 'read')).trim();
+    return (await run(['commit-tree', written, '-p', 'HEAD', '-m', author.message], 'read', { env: identity })).trim();
+}
+function sha256(content) {
+    return (0, crypto_1.createHash)('sha256').update(content).digest('hex');
+}
+function isNotFound(e) {
+    const code = e.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
+}
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+// The text of a file, or why it has none.
+function decodeText(path, content) {
+    if (content.subarray(0, 8000).includes(0)) {
+        throw new SandboxFileError(415, `${path} is a binary file, read it raw (?raw) or write it with PUT`);
+    }
+    try {
+        return utf8.decode(content);
+    }
+    catch {
+        throw new SandboxFileError(415, `${path} is not UTF-8 text, read it raw (?raw) or write it with PUT`);
+    }
+}
+// Files larger than this are read one by one, across sandboxes: a read holds a few times
+// the size of its file at once.
+const LARGE_FILE_BYTES = 1024 * 1024;
+const LARGE_READS = 4;
+let largeReads = 0;
+const waitingReads = [];
+async function readLimited(size, fn) {
+    if (size <= LARGE_FILE_BYTES) {
+        return fn();
+    }
+    if (largeReads < LARGE_READS) {
+        largeReads++;
+    }
+    else {
+        // the read that finishes hands its place over
+        await new Promise((resolve) => waitingReads.push(resolve));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        const next = waitingReads.shift();
+        if (next) {
+            next();
+        }
+        else {
+            largeReads--;
+        }
+    }
+}
+// The bytes of an open file, as many as it had when it was opened: a task of a run may
+// still be writing to it.
+async function readOpened(handle, size) {
+    const content = Buffer.alloc(size);
+    let read = 0;
+    while (read < size) {
+        const { bytesRead } = await handle.read(content, read, size - read, read);
+        if (bytesRead === 0) {
+            break;
+        }
+        read += bytesRead;
+    }
+    return content.subarray(0, read);
+}
+function numbered(line, text) {
+    const shown = text.length > MAX_LINE_CHARS ? `${text.slice(0, MAX_LINE_CHARS)}… [${text.length} chars]` : text;
+    return `${String(line).padStart(6)}\t${shown}`;
+}
+function fileType(stats) {
+    return stats.isSymbolicLink() ? 'symlink' : stats.isDirectory() ? 'directory' : stats.isFile() ? 'file' : 'other';
+}
+/**
+ * The files of a sandbox in a directory of this machine. Every path is checked name by
+ * name with `lstat`, so a symbolic link a task made is never followed; a file is opened
+ * without following a link, and on Linux the opened file is checked to be the one in the
+ * sandbox, in case a task swapped a directory for a link in between.
+ */
+class HostSandboxFiles {
+    constructor(root, git, 
+    // the environment of ripgrep: the variables runs see
+    env, 
+    // the most a diff or patch of the changes may take
+    maxChangesBytes = exports.MAX_CHANGES_BYTES) {
+        this.root = root;
+        this.git = git;
+        this.env = env;
+        this.maxChangesBytes = maxChangesBytes;
+    }
+    absolute(path) {
+        return (0, path_1.join)(this.root, ...path.split('/'));
+    }
+    // Whether the directories above `path` are there; a link or a file among them is an error.
+    async parents(path) {
+        const parts = path.split('/');
+        let current = this.root;
+        for (let i = 0; i < parts.length - 1; i++) {
+            current = (0, path_1.join)(current, parts[i]);
+            const stats = await (0, promises_1.lstat)(current).catch((e) => {
+                if (isNotFound(e)) {
+                    return undefined;
+                }
+                throw e;
+            });
+            if (!stats) {
+                return false;
+            }
+            const prefix = parts.slice(0, i + 1).join('/');
+            if (stats.isSymbolicLink()) {
+                throw new SandboxFileError(400, `${prefix} is a symbolic link, the API does not follow links`);
+            }
+            if (!stats.isDirectory()) {
+                throw new SandboxFileError(400, `${prefix} is a file, not a directory`);
+            }
+        }
+        return true;
+    }
+    async stat(path) {
+        checkPath(path);
+        if (!(await this.parents(path))) {
+            return undefined;
+        }
+        const absolute = this.absolute(path);
+        const stats = await (0, promises_1.lstat)(absolute).catch((e) => {
+            if (isNotFound(e)) {
+                return undefined;
+            }
+            throw e;
+        });
+        if (!stats) {
+            return undefined;
+        }
+        const type = fileType(stats);
+        return {
+            path,
+            type,
+            size: type === 'file' || type === 'symlink' ? stats.size : 0,
+            exec: type === 'file' && (stats.mode & 0o111) !== 0,
+            modifiedAt: stats.mtime.toISOString(),
+            ...(type === 'symlink' ? { target: await (0, promises_1.readlink)(absolute) } : {}),
+        };
+    }
+    // Opens a file of the sandbox for reading, never through a link.
+    async open(path) {
+        const found = await this.stat(path);
+        if (!found) {
+            throw new SandboxFileError(404, `${path} does not exist`);
+        }
+        if (found.type === 'symlink') {
+            throw new SandboxFileError(400, `${path} is a symbolic link to ${found.target}, the API does not follow links`);
+        }
+        if (found.type === 'directory') {
+            throw new SandboxFileError(400, `${path} is a directory, list it with tree`);
+        }
+        if (found.type === 'other') {
+            throw new SandboxFileError(400, `${path} is a pipe, a socket or a device, not a file`);
+        }
+        const absolute = this.absolute(path);
+        // without O_NONBLOCK, opening a pipe a task swapped in after the check waits for a writer
+        const flags = fs_1.constants.O_RDONLY | (fs_1.constants.O_NOFOLLOW ?? 0) | (fs_1.constants.O_NONBLOCK ?? 0);
+        const handle = await (0, promises_1.open)(absolute, flags).catch((e) => {
+            if (isNotFound(e)) {
+                throw new SandboxFileError(404, `${path} does not exist`);
+            }
+            if (e.code === 'ELOOP') {
+                throw new SandboxFileError(400, `${path} is a symbolic link, the API does not follow links`);
+            }
+            throw e;
+        });
+        try {
+            const stats = await handle.stat();
+            if (!stats.isFile()) {
+                throw new SandboxFileError(400, `${path} is not a file`);
+            }
+            await this.mustBeInside(handle, absolute, path);
+            return { handle, stat: { ...found, size: stats.size } };
+        }
+        catch (e) {
+            await handle.close();
+            throw e;
+        }
+    }
+    // The opened file is the one in the sandbox: a task may have swapped a directory above it
+    // for a link after the names were checked. Linux names the file a descriptor is open on;
+    // elsewhere the path has to lead to the same file and to no link.
+    async mustBeInside(handle, absolute, path) {
+        let actual;
+        if (process.platform === 'linux') {
+            actual = await (0, promises_1.readlink)(`/proc/self/fd/${handle.fd}`).catch(() => undefined);
+        }
+        if (actual === undefined) {
+            const [opened, named] = await Promise.all([handle.stat(), (0, promises_1.lstat)(absolute)]);
+            if (opened.ino !== named.ino || opened.dev !== named.dev) {
+                throw new SandboxFileError(400, `${path} changed while it was opened, read it again`);
+            }
+            actual = await (0, promises_1.realpath)(absolute);
+        }
+        this.realRoot ?? (this.realRoot = (0, promises_1.realpath)(this.root));
+        const expected = (0, path_1.join)(await this.realRoot, ...path.split('/'));
+        const same = process.platform === 'win32' || process.platform === 'darwin'
+            ? (0, path_1.normalize)(actual).toLowerCase() === (0, path_1.normalize)(expected).toLowerCase()
+            : (0, path_1.normalize)(actual) === (0, path_1.normalize)(expected);
+        if (!same) {
+            throw new SandboxFileError(400, `${path} is reached through a symbolic link, the API does not follow links`);
+        }
+    }
+    async read(path, query) {
+        const { handle, stat } = await this.open(path);
+        if (stat.size > exports.MAX_FILE_BYTES) {
+            await handle.close();
+            throw new SandboxFileError(413, `${path} takes ${stat.size} bytes, more than a read answers: read it raw`);
+        }
+        return readLimited(stat.size, async () => {
+            let content;
+            try {
+                content = await readOpened(handle, stat.size);
+            }
+            finally {
+                await handle.close();
+            }
+            return this.lines(path, content, query);
+        });
+    }
+    lines(path, content, query) {
+        const text = decodeText(path, content);
+        const offset = Math.max(1, Math.floor(query.offset ?? 1));
+        const limit = clamp(query.limit, exports.READ_LINES, MAX_READ_LINES);
+        const shown = [];
+        let bytes = 0;
+        let next = offset;
+        let full = false;
+        // line by line: splitting a file of empty lines at once takes many times its size
+        let lines = 0;
+        for (let start = 0; start < text.length;) {
+            const end = text.indexOf('\n', start);
+            const stop = end < 0 ? text.length : end;
+            lines++;
+            if (!full && lines === next && next < offset + limit) {
+                const line = numbered(next, text.slice(start, stop));
+                if (shown.length > 0 && bytes + line.length > MAX_READ_BYTES) {
+                    full = true;
+                }
+                else {
+                    shown.push(line);
+                    bytes += line.length + 1;
+                    next++;
+                }
+            }
+            start = stop + 1;
+        }
+        const truncated = next <= lines;
+        return {
+            path,
+            sha256: sha256(content),
+            size: content.length,
+            lines,
+            offset,
+            content: shown.join('\n'),
+            truncated,
+            nextOffset: truncated ? next : null,
+        };
+    }
+    async raw(path) {
+        const { handle, stat } = await this.open(path);
+        if (stat.size > exports.MAX_FILE_BYTES) {
+            return { stat, stream: handle.createReadStream({ start: 0, end: Math.max(0, stat.size - 1) }) };
+        }
+        return readLimited(stat.size, async () => {
+            try {
+                const content = await readOpened(handle, stat.size);
+                return { stat: { ...stat, size: content.length }, content, sha256: sha256(content) };
+            }
+            finally {
+                await handle.close();
+            }
+        });
+    }
+    // The files git sees in the sandbox below `path`: committed or not, without what
+    // `.gitignore` leaves out, without the deny list.
+    async listFiles(path) {
+        const spec = path ? ['--', `:(literal)${path}`] : [];
+        const list = async (args) => (await this.git.run(['ls-files', '-z', ...args, ...spec], 'list the files of', { maxBuffer: 256 * 1024 * 1024 }))
+            .split('\0')
+            .filter((file) => file.length > 0);
+        const deleted = new Set(await list(['--deleted']));
+        const files = await list(['--cached', '--others', '--exclude-standard']);
+        return [...new Set(files)].filter((file) => !deleted.has(file) && !deniedPath(file.replace(/\/$/, '')));
+    }
+    async tree(query) {
+        const path = query.path ? checkPath(query.path) : undefined;
+        if (path) {
+            const found = await this.stat(path);
+            if (!found) {
+                throw new SandboxFileError(404, `${path} does not exist`);
+            }
+            if (found.type !== 'directory') {
+                const what = { file: 'file, read it', symlink: 'symbolic link', other: 'pipe, a socket or a device' };
+                throw new SandboxFileError(400, `${path} is a ${what[found.type]}`);
+            }
+        }
+        const depth = clamp(query.depth, 1, 64);
+        const limit = clamp(query.limit, TREE_LIMIT, MAX_TREE_LIMIT);
+        const after = decodeCursor(query.cursor, 'string');
+        const glob = query.glob ? new minimatch_1.Minimatch(query.glob, { dot: true }) : undefined;
+        const prefix = path ? `${path}/` : '';
+        const entries = new Map();
+        for (const listed of await this.listFiles(path)) {
+            // an untracked repository inside the sandbox is listed as `dir/`
+            const directory = listed.endsWith('/');
+            const file = directory ? listed.slice(0, -1) : listed;
+            const relative = file.slice(prefix.length);
+            if (glob) {
+                if (!directory && glob.match(relative)) {
+                    entries.set(file, 'file');
+                }
+                continue;
+            }
+            const parts = relative.split('/');
+            for (let level = 1; level <= Math.min(depth, parts.length); level++) {
+                const entry = prefix + parts.slice(0, level).join('/');
+                entries.set(entry, level < parts.length || directory ? 'directory' : 'file');
+            }
+        }
+        const all = [...entries.keys()].sort().filter((entry) => after === undefined || entry > after);
+        const page = all.slice(0, limit);
+        const result = [];
+        for (const entry of page) {
+            const type = entries.get(entry);
+            if (type === 'directory') {
+                result.push({ path: entry, type });
+                continue;
+            }
+            const stats = await (0, promises_1.lstat)(this.absolute(entry)).catch(() => undefined);
+            const found = stats ? fileType(stats) : 'file';
+            result.push(found === 'symlink'
+                ? { path: entry, type: found, target: await (0, promises_1.readlink)(this.absolute(entry)).catch(() => '') }
+                : found === 'other'
+                    ? { path: entry, type: found }
+                    : { path: entry, type: 'file', size: stats?.size ?? 0 });
+        }
+        const truncated = all.length > page.length;
+        return {
+            path: path ?? '',
+            entries: result,
+            total: entries.size,
+            truncated,
+            cursor: truncated ? encodeCursor(page[page.length - 1]) : null,
+        };
+    }
+    async search(query) {
+        const mode = query.output_mode ?? 'files_with_matches';
+        const limit = clamp(query.head_limit, SEARCH_LIMIT, MAX_SEARCH_LIMIT);
+        const skip = decodeCursor(query.cursor, 'number') ?? 0;
+        const path = query.path ? checkPath(query.path) : undefined;
+        if (path) {
+            const found = await this.stat(path);
+            if (!found) {
+                throw new SandboxFileError(404, `${path} does not exist`);
+            }
+            if (found.type === 'symlink') {
+                throw new SandboxFileError(400, `${path} is a symbolic link, the API does not follow links`);
+            }
+            if (found.type === 'other') {
+                throw new SandboxFileError(400, `${path} is a pipe, a socket or a device, not a file`);
+            }
+        }
+        if (query.type !== undefined && !/^[A-Za-z0-9_+-]{1,40}$/.test(query.type)) {
+            throw new SandboxFileError(400, `${JSON.stringify(query.type.slice(0, 40))} is not a file type of ripgrep`);
+        }
+        const args = [
+            '--no-config',
+            // `.gitignore` counts although the git data is not in the files
+            '--no-require-git',
+            '--hidden',
+            '--sort=path',
+            '--path-separator=/',
+            `--max-filesize=${exports.MAX_FILE_BYTES}`,
+            '--color=never',
+            '--no-messages',
+        ];
+        if (query.i) {
+            args.push('--ignore-case');
+        }
+        if (query.fixed_strings) {
+            args.push('--fixed-strings');
+        }
+        if (query.multiline) {
+            args.push('--multiline', '--multiline-dotall');
+        }
+        for (const glob of query.glob ?? []) {
+            args.push(`--glob=${glob}`);
+        }
+        // after the caller's globs, which would otherwise take precedence
+        // in any case, as a case-insensitive disk opens `.SSH` as `.ssh`; the paths found are
+        // checked against the deny list as well
+        for (const directory of DENIED_DIRECTORIES) {
+            args.push(`--iglob=!${directory}`);
+        }
+        if (query.type) {
+            args.push(`--type=${query.type}`);
+        }
+        if (mode === 'content') {
+            args.push('--json');
+            for (const flag of ['A', 'B', 'C']) {
+                const value = query[flag];
+                if (value !== undefined) {
+                    args.push(`-${flag}`, String(Math.min(Math.max(0, Math.floor(value)), 100)));
+                }
+            }
+        }
+        else if (mode === 'files_with_matches') {
+            args.push('--files-with-matches', '--null');
+        }
+        else {
+            args.push('--count-matches', '--null');
+        }
+        args.push('--regexp', query.pattern, '--', path ?? '.');
+        const result = { output_mode: mode, total: 0, exact: true, truncated: false, cursor: null };
+        const files = [];
+        const matches = [];
+        const counts = [];
+        let total = 0;
+        const found = (add) => {
+            total++;
+            if (total > skip && total <= skip + limit) {
+                add();
+            }
+            return total < skip + limit + SEARCH_COUNT;
+        };
+        // the JSON of ripgrep names paths with the separator of the system, whatever --path-separator says
+        const clean = (file) => {
+            const path = process.platform === 'win32' ? file.replace(/\\/g, '/') : file;
+            return path.startsWith('./') ? path.slice(2) : path;
+        };
+        const onRecord = (record) => {
+            if (mode === 'files_with_matches') {
+                const file = clean(record);
+                return deniedPath(file) ? true : found(() => files.push(file));
+            }
+            if (mode === 'count') {
+                const [file, count] = record.split('\0');
+                return deniedPath(clean(file)) ? true : found(() => counts.push({ path: clean(file), count: Number(count) }));
+            }
+            const message = JSON.parse(record);
+            if (message.type !== 'match' && message.type !== 'context') {
+                return true;
+            }
+            const file = clean(message.data.path?.text ?? '');
+            if (!file || deniedPath(file)) {
+                return true;
+            }
+            const lines = (message.data.lines?.text ?? '').replace(/\n$/, '').split('\n');
+            return lines.every((text, index) => found(() => matches.push({
+                path: file,
+                line: (message.data.line_number ?? 0) + index,
+                text: text.length > MAX_LINE_CHARS ? `${text.slice(0, MAX_LINE_CHARS)}… [${text.length} chars]` : text,
+                ...(message.type === 'context' ? { context: true } : {}),
+            })));
+        };
+        const { code, stderr, stopped } = await this.ripgrep(args, mode === 'files_with_matches' ? '\0' : '\n', onRecord);
+        if (code === 2 && total === 0 && !stopped) {
+            throw new SandboxFileError(400, stderr.trim() || 'ripgrep failed');
+        }
+        result.total = total;
+        result.exact = !stopped;
+        result.truncated = total > skip + limit;
+        result.cursor = result.truncated ? encodeCursor(skip + limit) : null;
+        if (mode === 'files_with_matches') {
+            result.files = files;
+        }
+        else if (mode === 'count') {
+            result.counts = counts;
+        }
+        else {
+            result.matches = matches;
+        }
+        return result;
+    }
+    // Runs ripgrep in the files and hands each record of its output to `onRecord`, which
+    // answers whether to read on.
+    ripgrep(args, separator, onRecord) {
+        const env = {};
+        for (const [key, value] of Object.entries(this.env)) {
+            if (value !== undefined && !key.toUpperCase().startsWith('RIPGREP_')) {
+                env[key] = value;
+            }
+        }
+        return new Promise((resolve, reject) => {
+            const child = (0, child_process_1.spawn)('rg', args, {
+                cwd: this.root,
+                env,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                signal: AbortSignal.timeout(SEARCH_TIMEOUT_MS),
+            });
+            let stopped = false;
+            let buffered = '';
+            let stderr = '';
+            const take = (chunk) => {
+                buffered += chunk;
+                let at;
+                while (!stopped && (at = buffered.indexOf(separator)) >= 0) {
+                    const record = buffered.slice(0, at);
+                    buffered = buffered.slice(at + 1);
+                    if (record.length > 0 && !onRecord(record)) {
+                        stopped = true;
+                        child.kill();
+                    }
+                }
+            };
+            child.stdout.setEncoding('utf8').on('data', take);
+            child.stderr.setEncoding('utf8').on('data', (chunk) => {
+                stderr = (stderr + chunk).slice(-4000);
+            });
+            child.on('error', (e) => {
+                if (e.code === 'ENOENT') {
+                    reject(new SandboxFileError(501, 'ripgrep (rg) is not installed on the server, search needs it'));
+                }
+                else if (e.name === 'AbortError') {
+                    reject(new SandboxFileError(504, `the search took longer than ${SEARCH_TIMEOUT_MS / 1000}s, narrow it`));
+                }
+                else {
+                    reject(e);
+                }
+            });
+            child.on('close', (code) => {
+                if (!stopped && buffered.length > 0) {
+                    onRecord(buffered);
+                }
+                resolve({ code, stderr, stopped });
+            });
+        });
+    }
+    // The index of `fn` holds the files as they are, without what `.gitignore` leaves out and
+    // without the deny list, so nothing on it leaves the sandbox through a diff. A repository a
+    // task made inside the files is left out too: git adds it as a link to a commit of it,
+    // whose id is not the sandbox's to tell. So is hammerkit's own run state (`isRunState`).
+    async withFilesIndex(fn) {
+        return this.git.withIndex(async (run) => {
+            // `:<old mode> <new mode> <old id> <new id> <status>\0<path>\0`
+            const raw = (await run(['diff', '--cached', '--raw', '-z', '--no-renames', 'HEAD'], 'read')).split('\0');
+            const changed = [];
+            for (let i = 0; i + 1 < raw.length; i += 2) {
+                const file = raw[i + 1];
+                if (deniedPath(file) || isRunState(file) || raw[i].split(' ')[1] === '160000') {
+                    changed.push(file);
+                }
+            }
+            if (changed.length > 0) {
+                await run(['reset', '--quiet', 'HEAD', '--', ...changed.map((file) => `:(literal)${file}`)], 'read');
+            }
+            return fn(run);
+        });
+    }
+    async changes() {
+        return this.withFilesIndex(async (run) => {
+            const statuses = (await run(['diff', '--cached', '-M', '--name-status', '-z', 'HEAD'], 'read')).split('\0');
+            const numbers = (await run(['diff', '--cached', '-M', '--numstat', '-z', 'HEAD'], 'read')).split('\0');
+            const files = [];
+            for (let i = 0; i < statuses.length - 1;) {
+                const status = statuses[i++];
+                const letter = status[0];
+                const from = letter === 'R' || letter === 'C' ? statuses[i++] : undefined;
+                const path = statuses[i++];
+                files.push({
+                    path,
+                    status: { A: 'added', D: 'deleted', R: 'renamed', C: 'copied', T: 'type' }[letter] ?? 'modified',
+                    ...(from !== undefined ? { from } : {}),
+                    additions: null,
+                    deletions: null,
+                });
+            }
+            // `added\tdeleted\tpath\0`, or for a rename `added\tdeleted\t\0from\0to\0`
+            const byPath = new Map(files.map((file) => [file.path, file]));
+            for (let i = 0; i < numbers.length - 1;) {
+                const [added, deleted, path] = numbers[i++].split('\t');
+                const to = path === '' ? (i++, numbers[i++]) : path;
+                const file = byPath.get(to);
+                if (file && added !== '-') {
+                    file.additions = Number(added);
+                    file.deletions = Number(deleted);
+                }
+            }
+            return files;
+        });
+    }
+    async diff(format, author) {
+        return this.withFilesIndex(async (run) => {
+            if (format === 'diff') {
+                return run(['diff', '--cached', '-M', 'HEAD'], 'read', { maxBuffer: this.maxChangesBytes });
+            }
+            // a commit of the changes on top of the commit the sandbox is at, which no branch
+            // points to, written out as `git format-patch` writes it
+            const commit = await writeCommit(run, author);
+            return run(['format-patch', '-1', '--stdout', '--binary', '-M', commit], 'read', {
+                maxBuffer: this.maxChangesBytes,
+            });
+        });
+    }
+    async commit(author) {
+        return this.withFilesIndex(async (run) => {
+            const tree = (await run(['write-tree'], 'read')).trim();
+            const base = (await run(['rev-parse', 'HEAD^{tree}'], 'read')).trim();
+            return tree === base ? undefined : writeCommit(run, author, tree);
+        });
+    }
+    async plan(ops) {
+        const batch = new EditBatch(this);
+        for (const [index, op] of ops.entries()) {
+            try {
+                await batch.apply(op);
+            }
+            catch (e) {
+                if (e instanceof SandboxFileError) {
+                    throw new SandboxFileError(e.status, `op ${index} (${op.op}): ${e.message}`, { ...e.details, op: index });
+                }
+                if (e instanceof sandbox_patch_1.PatchError) {
+                    throw new SandboxFileError(422, `op ${index} (patch): ${e.message}`, { op: index });
+                }
+                throw e;
+            }
+        }
+        return batch.plan();
+    }
+    // What a path holds now, for an edit: its kind, and a file's content when it is read.
+    async load(path) {
+        if (!(await this.parents(path))) {
+            return { kind: 'absent' };
+        }
+        const absolute = this.absolute(path);
+        const stats = await (0, promises_1.lstat)(absolute).catch((e) => {
+            if (isNotFound(e)) {
+                return undefined;
+            }
+            throw e;
+        });
+        if (!stats) {
+            return { kind: 'absent' };
+        }
+        if (stats.isSymbolicLink()) {
+            return { kind: 'link' };
+        }
+        if (stats.isDirectory()) {
+            return { kind: 'directory' };
+        }
+        return { kind: 'file', size: stats.size, exec: (stats.mode & 0o111) !== 0, mode: stats.mode & 0o7777 };
+    }
+    async content(path, state) {
+        if (!state.content) {
+            if (state.size > exports.MAX_FILE_BYTES) {
+                throw new SandboxFileError(413, `${path} takes ${state.size} bytes, more than an edit reads`);
+            }
+            const { handle, stat } = await this.open(path);
+            try {
+                // the size checked above is the one when the edit started
+                if (stat.size > exports.MAX_FILE_BYTES) {
+                    throw new SandboxFileError(413, `${path} takes ${stat.size} bytes, more than an edit reads`);
+                }
+                state.content = await readLimited(stat.size, () => readOpened(handle, stat.size));
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        return state.content;
+    }
+    // Writes the changes: what a path held is moved aside first, and put back when a later
+    // write fails.
+    async write(changes) {
+        const backups = [];
+        const written = [];
+        // the directories above every path are still the ones the edits were planned in
+        for (const [path] of changes) {
+            await this.sameParents(path);
+        }
+        try {
+            for (const [path, before] of changes) {
+                if (before.kind === 'file' || before.kind === 'link') {
+                    const absolute = this.absolute(path);
+                    const backup = (0, path_1.join)((0, path_1.dirname)(absolute), `.hammerkit-${(0, crypto_1.randomBytes)(6).toString('hex')}.bak`);
+                    await (0, promises_1.rename)(absolute, backup);
+                    backups.push([absolute, backup]);
+                }
+            }
+            for (const [path, before, after] of [...changes].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+                if (after.kind !== 'file') {
+                    continue;
+                }
+                await this.makeParents(path);
+                const absolute = this.absolute(path);
+                const temporary = (0, path_1.join)((0, path_1.dirname)(absolute), `.hammerkit-${(0, crypto_1.randomBytes)(6).toString('hex')}.tmp`);
+                const base = before.kind === 'file' ? before.mode ?? 0o644 : 0o644;
+                const mode = after.exec ? base | ((base & 0o444) >> 2) | 0o100 : base & ~0o111;
+                await (0, promises_1.writeFile)(temporary, after.content ?? Buffer.alloc(0), { flag: 'wx', mode });
+                await (0, promises_1.chmod)(temporary, mode);
+                await (0, promises_1.rename)(temporary, absolute);
+                written.push(absolute);
+            }
+        }
+        catch (e) {
+            for (const absolute of written.reverse()) {
+                await (0, promises_1.rm)(absolute, { force: true });
+            }
+            for (const [absolute, backup] of backups.reverse()) {
+                await (0, promises_1.rename)(backup, absolute).catch(() => undefined);
+            }
+            throw e;
+        }
+        for (const [, backup] of backups) {
+            await (0, promises_1.rm)(backup, { force: true });
+        }
+    }
+    async sameParents(path) {
+        const parts = path.split('/');
+        let current = this.root;
+        for (let i = 0; i < parts.length - 1; i++) {
+            current = (0, path_1.join)(current, parts[i]);
+            const stats = await (0, promises_1.lstat)(current).catch(() => undefined);
+            if (!stats) {
+                return;
+            }
+            if (stats.isSymbolicLink() || !stats.isDirectory()) {
+                throw new SandboxFileError(409, `${parts.slice(0, i + 1).join('/')} is not a directory any more`);
+            }
+        }
+    }
+    async makeParents(path) {
+        const parts = path.split('/');
+        let current = this.root;
+        for (let i = 0; i < parts.length - 1; i++) {
+            current = (0, path_1.join)(current, parts[i]);
+            const stats = await (0, promises_1.lstat)(current).catch(() => undefined);
+            if (!stats) {
+                await (0, promises_1.mkdir)(current);
+            }
+            else if (stats.isSymbolicLink() || !stats.isDirectory()) {
+                throw new SandboxFileError(409, `${parts.slice(0, i + 1).join('/')} is not a directory any more`);
+            }
+        }
+    }
+}
+exports.HostSandboxFiles = HostSandboxFiles;
+// The edits of one request, applied to what the files would hold after them, before any
+// of it is written.
+class EditBatch {
+    constructor(files) {
+        this.files = files;
+        this.before = new Map();
+        this.after = new Map();
+    }
+    async current(path) {
+        const changed = this.after.get(path);
+        if (changed) {
+            return changed;
+        }
+        let original = this.before.get(path);
+        if (!original) {
+            original = await this.files.load(path);
+            this.before.set(path, original);
+        }
+        return original;
+    }
+    async text(path, state) {
+        return decodeText(path, await this.files.content(path, state));
+    }
+    async file(path, verb) {
+        const state = await this.current(path);
+        if (state.kind === 'absent') {
+            throw new SandboxFileError(404, `${path} does not exist${verb === 'replace in' ? ', create it with write' : ''}`);
+        }
+        if (state.kind === 'link') {
+            throw new SandboxFileError(400, `${path} is a symbolic link, the API does not ${verb} links`);
+        }
+        if (state.kind === 'directory') {
+            throw new SandboxFileError(400, `${path} is a directory, ${verb} its files one by one`);
+        }
+        return state;
+    }
+    async checkHash(path, ifHash) {
+        if (ifHash === undefined) {
+            return;
+        }
+        const state = await this.current(path);
+        const actual = state.kind === 'file' ? sha256(await this.files.content(path, state)) : undefined;
+        if (actual !== ifHash.toLowerCase()) {
+            throw new SandboxFileError(412, actual
+                ? `${path} changed since you read it (sha256 ${actual}), read it again`
+                : `${path} does not exist any more, read it again`);
+        }
+    }
+    // A path a file may be written to: nothing but directories above it, no directory there.
+    async writable(path) {
+        const parts = path.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            const above = parts.slice(0, i).join('/');
+            const state = await this.current(above);
+            if (state.kind === 'file' || state.kind === 'link') {
+                throw new SandboxFileError(400, `${above} is a ${state.kind === 'file' ? 'file' : 'symbolic link'}, not a directory`);
+            }
+        }
+        for (const [other, state] of this.after) {
+            if (other.startsWith(`${path}/`) && state.kind === 'file') {
+                throw new SandboxFileError(400, `${path} is a directory of ${other}, written before in this batch`);
+            }
+        }
+        const state = await this.current(path);
+        if (state.kind === 'directory') {
+            throw new SandboxFileError(400, `${path} is a directory`);
+        }
+        return state;
+    }
+    set(path, content, exec) {
+        if (content.length > exports.MAX_FILE_BYTES) {
+            throw new SandboxFileError(413, `${path} would take ${content.length} bytes, more than ${exports.MAX_FILE_BYTES}`);
+        }
+        this.after.set(path, { kind: 'file', size: content.length, exec, content });
+    }
+    async apply(op) {
+        if (op.op === 'patch') {
+            return this.patch(op.patch);
+        }
+        const path = checkPath(op.path);
+        await this.checkHash(path, op.ifHash);
+        if (op.op === 'replace') {
+            const state = await this.file(path, 'replace in');
+            const text = await this.text(path, state);
+            if (op.old_string === '') {
+                throw new SandboxFileError(422, 'old_string is empty, write the file to create it');
+            }
+            if (op.old_string === op.new_string) {
+                throw new SandboxFileError(422, 'old_string and new_string are the same, nothing would change');
+            }
+            const at = [];
+            for (let found = text.indexOf(op.old_string); found >= 0; found = text.indexOf(op.old_string, found + op.old_string.length)) {
+                at.push(found);
+            }
+            if (at.length === 0) {
+                throw new SandboxFileError(422, `old_string is not in ${path}; it has to match the file exactly, whitespace and indentation included: read the file again`);
+            }
+            if (at.length > 1 && !op.replace_all) {
+                const lines = at.slice(0, 10).map((offset) => text.slice(0, offset).split('\n').length);
+                throw new SandboxFileError(422, `old_string is ${at.length} times in ${path}, at lines ${lines.join(', ')}${at.length > 10 ? ', …' : ''}: add lines around it until it is there once, or set replace_all`, { lines });
+            }
+            const replaced = op.replace_all
+                ? text.split(op.old_string).join(op.new_string)
+                : text.slice(0, at[0]) + op.new_string + text.slice(at[0] + op.old_string.length);
+            this.set(path, Buffer.from(replaced, 'utf8'), state.exec);
+        }
+        else if (op.op === 'write') {
+            const state = await this.writable(path);
+            const content = typeof op.content === 'string'
+                ? Buffer.from(op.content, op.encoding === 'base64' ? 'base64' : 'utf8')
+                : op.content;
+            this.set(path, content, state.kind === 'file' ? state.exec : false);
+        }
+        else if (op.op === 'delete') {
+            const state = await this.current(path);
+            if (state.kind === 'absent') {
+                throw new SandboxFileError(404, `${path} does not exist`);
+            }
+            if (state.kind === 'directory') {
+                throw new SandboxFileError(400, `${path} is a directory, delete its files one by one`);
+            }
+            this.after.set(path, { kind: 'absent' });
+        }
+        else {
+            const to = checkPath(op.to);
+            const state = await this.file(path, 'move');
+            const content = await this.files.content(path, state);
+            const target = await this.writable(to);
+            if (target.kind !== 'absent') {
+                throw new SandboxFileError(409, `${to} exists, delete it first`);
+            }
+            this.after.set(path, { kind: 'absent' });
+            this.set(to, content, state.exec);
+        }
+    }
+    async patch(text) {
+        for (const file of (0, sandbox_patch_1.parsePatch)(text)) {
+            await this.patchFile(file);
+        }
+    }
+    async patchFile(file) {
+        const from = file.from !== undefined ? checkPath(file.from) : undefined;
+        const to = file.to !== undefined ? checkPath(file.to) : undefined;
+        let content = '';
+        let exec = false;
+        if (from !== undefined) {
+            const state = await this.file(from, 'patch');
+            content = await this.text(from, state);
+            exec = state.exec;
+        }
+        if (to !== undefined && to !== from) {
+            const target = await this.writable(to);
+            if (target.kind !== 'absent') {
+                throw new SandboxFileError(409, `${to} exists, the patch ${from ? 'moves a file onto' : 'adds'} it`);
+            }
+        }
+        const result = file.apply(content);
+        if (to === undefined) {
+            if (from !== undefined && result !== '') {
+                throw new sandbox_patch_1.PatchError(`${from}: the patch deletes it, but its lines are not what the file holds`);
+            }
+            this.after.set(from, { kind: 'absent' });
+            return;
+        }
+        if (from !== undefined && from !== to && !file.copy) {
+            this.after.set(from, { kind: 'absent' });
+        }
+        this.set(to, Buffer.from(result, 'utf8'), file.exec ?? exec);
+    }
+    async plan() {
+        const changes = [];
+        for (const [path, after] of this.after) {
+            const before = this.before.get(path) ?? (await this.files.load(path));
+            if (await this.same(path, before, after)) {
+                continue;
+            }
+            changes.push([path, before, after]);
+        }
+        const size = (state) => (state.kind === 'file' ? state.size : 0);
+        return {
+            files: changes
+                .map(([path, before, after]) => {
+                if (after.kind !== 'file') {
+                    return { path, change: 'deleted' };
+                }
+                const content = after.content ?? Buffer.alloc(0);
+                return {
+                    path,
+                    change: before.kind === 'absent' ? 'added' : 'modified',
+                    sha256: sha256(content),
+                    size: content.length,
+                };
+            })
+                .sort((a, b) => (a.path < b.path ? -1 : 1)),
+            bytes: changes.reduce((sum, [, before, after]) => sum + size(after) - size(before), 0),
+            commit: () => this.files.write(changes),
+        };
+    }
+    async same(path, before, after) {
+        if (before.kind !== after.kind) {
+            return false;
+        }
+        if (before.kind !== 'file' || after.kind !== 'file') {
+            return before.kind === 'absent';
+        }
+        return (before.exec === after.exec &&
+            before.size === after.size &&
+            (await this.files.content(path, before)).equals(after.content ?? Buffer.alloc(0)));
+    }
+}
+//# sourceMappingURL=sandbox-files.js.map