impel-cli 0.18.17 → 0.19.0

package/src/remote/transfer.js

@@ -0,0 +1,293 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { tenantCliProfilePaths } from "../cliProfiles.js";
+import { redactSecretText } from "../config.js";
+import { runBuffer, runCapture, runInteractive, sleep } from "./process.js";
+import { runPaths } from "./state.js";
+
+const REMOTE_REPO = "/workspace/repo";
+const REMOTE_BUNDLE = "/tmp/impel-remote-repo.bundle";
+const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
+const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+
+function git(args, options = {}) {
+  return runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", args, options).stdout.trim();
+}
+
+function sshArgs(state, command) {
+  return [state.alias, command];
+}
+
+function sshCapture(state, command, options = {}) {
+  return runCapture(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", sshArgs(state, command), options);
+}
+
+function remoteShellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function remoteNode(state, source, payload) {
+  const evaluator = "eval(Buffer.from(process.argv[1],'base64').toString('utf8'))";
+  const encodedSource = Buffer.from(source, "utf8").toString("base64");
+  return sshCapture(state, `node -e ${remoteShellQuote(evaluator)} ${remoteShellQuote(encodedSource)}`, {
+    input: `${JSON.stringify(payload)}\n`,
+  });
+}
+
+function writePrivate(filePath, contents) {
+  fs.writeFileSync(filePath, contents, { mode: 0o600 });
+  try { fs.chmodSync(filePath, 0o600); } catch { /* Best effort on Windows. */ }
+}
+
+export function inspectRepository(requestedPath = process.cwd()) {
+  const requested = path.resolve(requestedPath);
+  const candidate = fs.realpathSync(requested);
+  const root = fs.realpathSync(git(["-C", candidate, "rev-parse", "--show-toplevel"]));
+  const head = git(["-C", root, "rev-parse", "HEAD"]);
+  const branchResult = runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", root, "symbolic-ref", "--quiet", "--short", "HEAD",
+  ], { allowFailure: true });
+  const originResult = runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", root, "remote", "get-url", "origin",
+  ], { allowFailure: true });
+  const userNameResult = runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", root, "config", "--get", "user.name",
+  ], { allowFailure: true });
+  const userEmailResult = runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", root, "config", "--get", "user.email",
+  ], { allowFailure: true });
+  const relativeProjectPath = path.relative(root, candidate) || ".";
+  if (relativeProjectPath === ".." || relativeProjectPath.startsWith(`..${path.sep}`)) {
+    throw new Error(`${candidate} is not inside its Git repository`);
+  }
+  return {
+    root,
+    head,
+    branch: branchResult.status === 0 ? branchResult.stdout.trim() : null,
+    origin: originResult.status === 0 ? originResult.stdout.trim() : null,
+    userName: userNameResult.status === 0 ? userNameResult.stdout.trim() : null,
+    userEmail: userEmailResult.status === 0 ? userEmailResult.stdout.trim() : null,
+    relativeProjectPath: relativeProjectPath.split(path.sep).join("/"),
+    remoteProjectPath: relativeProjectPath === "."
+      ? REMOTE_REPO
+      : `${REMOTE_REPO}/${relativeProjectPath.split(path.sep).join("/")}`,
+  };
+}
+
+export function createRepositoryTransfer(state, repository) {
+  const paths = runPaths(state.runId);
+  runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", repository.root, "bundle", "create", paths.bundle, "--all",
+  ]);
+
+  const deleted = runBuffer(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", repository.root, "ls-files", "--deleted", "-z",
+  ]).stdout;
+  writePrivate(paths.deletedList, deleted);
+  const deletedPaths = new Set(splitNullBuffer(deleted).map((entry) => entry.toString("base64")));
+  const listedFiles = runBuffer(process.env.IMPEL_REMOTE_GIT_BIN || "git", [
+    "-C", repository.root, "ls-files", "--cached", "--others", "--exclude-standard", "-z",
+  ]).stdout;
+  const files = joinNullBuffer(splitNullBuffer(listedFiles).filter(
+    (entry) => !deletedPaths.has(entry.toString("base64")),
+  ));
+  writePrivate(paths.fileList, files);
+  runCapture(process.env.IMPEL_REMOTE_TAR_BIN || "tar", [
+    "-cf", paths.archive,
+    "--no-xattrs",
+    "--null",
+    "-T", paths.fileList,
+  ], { cwd: repository.root });
+  return paths;
+}
+
+function splitNullBuffer(buffer) {
+  const entries = [];
+  let start = 0;
+  while (start < buffer.length) {
+    const end = buffer.indexOf(0, start);
+    if (end === -1) throw new Error("Git returned a malformed NUL-delimited path list");
+    if (end > start) entries.push(buffer.subarray(start, end));
+    start = end + 1;
+  }
+  return entries;
+}
+
+function joinNullBuffer(entries) {
+  if (entries.length === 0) return Buffer.alloc(0);
+  return Buffer.concat(entries.flatMap((entry) => [entry, Buffer.from([0])]));
+}
+
+export async function waitForSsh(state, timeoutSeconds = 120) {
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  let lastError = "SSH did not accept a connection";
+  while (Date.now() < deadline) {
+    const result = sshCapture(state, "true", { allowFailure: true });
+    if (result.status === 0) return;
+    lastError = redactSecretText(result.stderr || lastError).trim();
+    await sleep(Number(process.env.IMPEL_REMOTE_SSH_POLL_MS || 2000));
+  }
+  throw new Error(`remote runner did not become SSH-ready within ${timeoutSeconds} seconds: ${lastError}`);
+}
+
+export function uploadRemoteConfiguration(state, {
+  config,
+  credential,
+  tenant,
+  environmentNames = [],
+}) {
+  const remoteConfig = {
+    pat: credential.token,
+    gatewayUrl: config.gatewayUrl,
+    appUrl: config.appUrl,
+    ...(config.sessionsUrl ? { sessionsUrl: config.sessionsUrl } : {}),
+    tenantId: tenant.tenantId,
+    tenantName: tenant.tenantName,
+    ...(tenant.productAccess ? { productAccess: tenant.productAccess } : {}),
+    scopes: [...credential.scopes],
+    remoteRunId: state.runId,
+    updatedAt: new Date().toISOString(),
+  };
+  const selectedEnvironment = {
+    IMPEL_REMOTE_RUN_ID: state.runId,
+    IMPEL_REMOTE_DANGEROUS_MODE: "1",
+  };
+  for (const name of environmentNames) {
+    if (!ENV_NAME_RE.test(name)) throw new Error(`invalid environment variable name ${JSON.stringify(name)}`);
+    if (!Object.hasOwn(process.env, name)) throw new Error(`environment variable ${name} is not set`);
+    selectedEnvironment[name] = process.env[name];
+  }
+  const shellQuote = (value) => `'${String(value).replaceAll("'", `'"'"'`)}'`;
+  const environmentFile = Object.entries(selectedEnvironment)
+    .map(([name, value]) => `export ${name}=${shellQuote(value)}`)
+    .join("\n") + "\n";
+  const profileRoot = `/home/agent/.config/impel/cli/tenants/${tenant.tenantId}`;
+  const claudeSettings = {
+    permissions: { defaultMode: "bypassPermissions" },
+    sandbox: { enabled: false },
+  };
+  const files = [
+    { path: "/home/agent/.config/impel/config.json", contents: `${JSON.stringify(remoteConfig, null, 2)}\n` },
+    { path: "/home/agent/.config/impel/remote/env.sh", contents: environmentFile },
+    {
+      path: "/home/agent/.config/impel/remote/run.json",
+      contents: `${JSON.stringify({
+        runId: state.runId,
+        credentialTokenId: credential.tokenId,
+        expiresAt: state.expiresAt,
+      }, null, 2)}\n`,
+    },
+    { path: `${profileRoot}/claude/settings.json`, contents: `${JSON.stringify(claudeSettings, null, 2)}\n` },
+  ];
+  remoteNode(state, String.raw`
+const fs = require("node:fs");
+const path = require("node:path");
+const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+for (const file of payload.files) {
+  const target = path.resolve(file.path);
+  if (!target.startsWith("/home/agent/.config/impel/")) throw new Error("refusing remote path");
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(target, file.contents, { mode: 0o600 });
+  fs.chmodSync(target, 0o600);
+}
+`, { files });
+}
+
+export function uploadRepository(state, repository) {
+  const paths = runPaths(state.runId);
+  runInteractive(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", sshArgs(state, `cat > ${REMOTE_BUNDLE}`), {
+    inputFile: paths.bundle,
+  });
+  remoteNode(state, String.raw`
+const fs = require("node:fs");
+const cp = require("node:child_process");
+const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+const repo = "/workspace/repo";
+fs.rmSync(repo, { recursive: true, force: true });
+fs.mkdirSync("/workspace", { recursive: true });
+cp.execFileSync("git", ["clone", "/tmp/impel-remote-repo.bundle", repo], { stdio: "inherit" });
+cp.execFileSync("git", ["-C", repo, "checkout", "--detach", payload.head], { stdio: "inherit" });
+if (payload.branch) cp.execFileSync("git", ["-C", repo, "checkout", "-B", payload.branch, payload.head], { stdio: "inherit" });
+if (payload.origin) cp.execFileSync("git", ["-C", repo, "remote", "set-url", "origin", payload.origin], { stdio: "inherit" });
+if (payload.userName) cp.execFileSync("git", ["-C", repo, "config", "user.name", payload.userName]);
+if (payload.userEmail) cp.execFileSync("git", ["-C", repo, "config", "user.email", payload.userEmail]);
+`, repository);
+
+  runInteractive(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", sshArgs(state, `tar -xf - -C ${REMOTE_REPO}`), {
+    inputFile: paths.archive,
+  });
+  const deleted = fs.readFileSync(paths.deletedList);
+  remoteNode(state, String.raw`
+const fs = require("node:fs");
+const path = require("node:path");
+const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+const root = "/workspace/repo";
+for (const relative of payload.deleted) {
+  const target = path.resolve(root, relative);
+  if (target !== root && !target.startsWith(root + path.sep)) throw new Error("unsafe deleted path");
+  fs.rmSync(target, { recursive: true, force: true });
+}
+fs.rmSync("/tmp/impel-remote-repo.bundle", { force: true });
+`, { deleted: deleted.toString("utf8").split("\0").filter(Boolean) });
+}
+
+export function prepareWorkspace(state, { installMode = "auto", setupCommand = null } = {}) {
+  if (!new Set(["auto", "skip"]).has(installMode)) throw new Error("--install must be auto or skip");
+  if (installMode === "auto") {
+    runInteractive(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", ["-t", state.alias, "impel-remote-prepare", REMOTE_REPO]);
+  }
+  if (setupCommand) {
+    const encodedCommand = Buffer.from(setupCommand, "utf8").toString("base64");
+    const source = "const cp=require('node:child_process');const command=Buffer.from(process.argv[1],'base64').toString('utf8');const child=cp.spawnSync('/bin/bash',['-lc',command],{cwd:'/workspace/repo',stdio:'inherit'});process.exit(Number.isInteger(child.status)?child.status:1)";
+    runInteractive(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", [
+      "-t", state.alias, `node -e ${remoteShellQuote(source)} ${remoteShellQuote(encodedCommand)}`,
+    ]);
+  }
+}
+
+function collectSessionFiles(root, sessionId) {
+  const files = [];
+  const visit = (directory, relative = "") => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const childRelative = relative ? path.join(relative, entry.name) : entry.name;
+      const child = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) visit(child, childRelative);
+      else if (entry.isFile() && childRelative.includes(sessionId)) files.push(childRelative);
+    }
+  };
+  if (fs.existsSync(root)) visit(root);
+  return files;
+}
+
+export function transferSessionCheckpoint(state, { provider, sessionId, tenantId }) {
+  if (!SESSION_ID_RE.test(String(sessionId || ""))) throw new Error("--session must be a safe provider session id");
+  const profiles = tenantCliProfilePaths(tenantId);
+  const localRoot = provider === "claude" ? profiles.claudeConfigDir : profiles.codexHome;
+  const remoteRoot = provider === "claude"
+    ? `/home/agent/.config/impel/cli/tenants/${tenantId}/claude`
+    : `/home/agent/.config/impel/cli/tenants/${tenantId}/codex`;
+  const files = collectSessionFiles(localRoot, sessionId);
+  if (files.length === 0) {
+    throw new Error(`could not find ${provider} session ${sessionId} in the selected Impel CLI profile`);
+  }
+  const checkpointList = path.join(runPaths(state.runId).root, `checkpoint-${provider}.list`);
+  const checkpointArchive = path.join(runPaths(state.runId).root, `checkpoint-${provider}.tar`);
+  writePrivate(checkpointList, Buffer.from(`${files.join("\0")}\0`, "utf8"));
+  try {
+    runCapture(process.env.IMPEL_REMOTE_TAR_BIN || "tar", [
+      "-cf", checkpointArchive, "--no-xattrs", "--null", "-T", checkpointList,
+    ], { cwd: localRoot });
+    sshCapture(state, `mkdir -p ${remoteRoot}`);
+    runInteractive(process.env.IMPEL_REMOTE_SSH_BIN || "ssh", sshArgs(state, `tar -xf - -C ${remoteRoot}`), {
+      inputFile: checkpointArchive,
+    });
+  } finally {
+    fs.rmSync(checkpointList, { force: true });
+    fs.rmSync(checkpointArchive, { force: true });
+  }
+  return files.length;
+}
+
+export const REMOTE_PROJECT_ROOT = REMOTE_REPO;