infraweaver 0.1.0

package/src/utils/gitAuth.ts

@@ -0,0 +1,268 @@
+/**
+ * git authentication via GIT_ASKPASS.
+ *
+ * a localhost HTTP server serves tokens via UUID codes whose lifetime is
+ * bounded by the parent $git() invocation: register() makes the code active,
+ * the script (and any sibling subprocess — e.g. git-lfs pre-push) can fetch
+ * the token any number of times, and $git()'s finally calls revoke() to
+ * close the window. each $git() call writes a unique askpass script with
+ * the server port+code baked into the file body — no secrets in subprocess
+ * env. a replay of a revoked code trips a 409 and revokes the underlying
+ * github installation token.
+ *
+ * see wiki/askpass.md for full security documentation.
+ */
+
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { log } from "#app/utils/cli";
+import type { GitAuthServer } from "#app/utils/gitAuthServer";
+import { filterEnv } from "#app/utils/secrets";
+import { $ } from "#app/utils/shell";
+import { spawn } from "#app/utils/subprocess";
+
+type SafeGitSubcommand = "fetch" | "push";
+
+type GitAuthOptions = {
+  token: string;
+  cwd?: string;
+  // when true (the default), this invocation runs with `core.hooksPath=/dev/null`
+  // so a repo-/agent-planted git hook (e.g. a `pre-push` written into
+  // `.git/hooks` or via an agent-set `core.hooksPath`) cannot fire while
+  // GIT_ASKPASS is live and read the installation token back out of the askpass
+  // script. Callers pass `false` only when the operator has granted full trust
+  // (shell: enabled), where honoring repo hooks (e.g. git-lfs pre-push upload)
+  // is intended and the agent could read the token through its shell anyway.
+  disableHooks?: boolean;
+};
+
+type GitResult = {
+  stdout: string;
+  stderr: string;
+};
+
+// --- git binary resolution and tamper detection ---
+
+type GitBinaryInfo = {
+  path: string;
+  sha256: string;
+};
+
+let gitBinary: GitBinaryInfo | undefined;
+
+function hashFile(path: string): string {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+/**
+ * resolve and fingerprint the git binary. must be called once at startup
+ * (in main()) before any agent code runs, so the path and hash reflect
+ * the untampered binary.
+ *
+ * resolves symlinks via realpath so the hash is of the actual binary.
+ * a malicious agent with sudo could replace the binary later, which is
+ * caught by verifyGitBinary() before each authenticated call.
+ */
+export function resolveGit(): void {
+  // POSIX `which` / Windows `where` — the action runs on Linux, but this repo is
+  // developed on Windows, where `which git` throws and takes the whole run with
+  // it. `where` may print several matches; the first is the one that would run.
+  const lookup = process.platform === "win32" ? "where git" : "which git";
+  const whichPath = execSync(lookup, { encoding: "utf-8" }).split(/\r?\n/)[0]?.trim();
+  if (!whichPath) throw new Error("git not found on PATH");
+  const resolvedPath = realpathSync(whichPath);
+  const sha256 = hashFile(resolvedPath);
+  gitBinary = { path: resolvedPath, sha256 };
+  log.debug(`» git binary: ${resolvedPath} (sha256: ${sha256.slice(0, 12)}...)`);
+}
+
+function verifyGitBinary(): string {
+  if (!gitBinary) {
+    throw new Error("git binary not initialized — call resolveGit() at startup");
+  }
+  const currentHash = hashFile(gitBinary.path);
+  if (currentHash !== gitBinary.sha256) {
+    throw new Error(
+      `git binary tampered: expected sha256 ${gitBinary.sha256}, got ${currentHash}. ` +
+        `path: ${gitBinary.path}`,
+    );
+  }
+  return gitBinary.path;
+}
+
+// --- auth server ---
+
+let authServer: GitAuthServer | undefined;
+
+export function setGitAuthServer(server: GitAuthServer): void {
+  authServer = server;
+}
+
+/**
+ * execute authenticated git command via ASKPASS.
+ *
+ * subcommand is restricted to "fetch" | "push" — operations that talk to
+ * a remote and need credentials. working-tree operations (checkout, merge)
+ * use $() from shell.ts which has no token.
+ *
+ * per call: registers a code with the auth server (valid for the lifetime
+ * of this invocation), writes a unique askpass script with port+code baked
+ * in, spawns git with GIT_ASKPASS pointing to the script. on completion,
+ * revokes the code and deletes the script in finally. multiple sibling
+ * askpass calls within one invocation (e.g. git itself + git-lfs pre-push)
+ * all see a valid code; replay attempts after finally trip a 409 and the
+ * server revokes the underlying github token as a tamper signal.
+ *
+ * @example
+ * await $git("fetch", ["origin", "main"], { token });
+ * await $git("push", ["-u", "origin", "feature"], { token });
+ */
+export async function $git(
+  subcommand: SafeGitSubcommand,
+  args: string[],
+  options: GitAuthOptions,
+): Promise<GitResult> {
+  const gitPath = verifyGitBinary();
+
+  if (!authServer) {
+    throw new Error("git auth server not initialized — call setGitAuthServer() at startup");
+  }
+
+  const cwd = options.cwd ?? process.cwd();
+
+  const code = authServer.register(options.token);
+  const scriptPath = authServer.writeAskpassScript(code);
+
+  // -c flags override local .git/config — defense-in-depth against
+  // agent-set config that could spawn subprocesses before ASKPASS runs.
+  // a command-line `-c` wins over any value the agent may have written into
+  // .git/config (e.g. via the MCP `git config` tool in restricted mode), which
+  // is why hook neutralization belongs here and not only at setup.
+  const fullArgs = [
+    "-c",
+    "core.fsmonitor=false",
+    "-c",
+    "credential.helper=",
+    "-c",
+    "protocol.file.allow=never",
+    "-c",
+    "core.sshCommand=ssh",
+    // neutralize git hooks for this authenticated call unless the caller opted
+    // out (shell: enabled). a planted `pre-push`/`pre-receive` would otherwise
+    // run in the action process with GIT_ASKPASS set and could exfiltrate the
+    // token by invoking the askpass script itself.
+    ...(options.disableHooks === false ? [] : ["-c", "core.hooksPath=/dev/null"]),
+    subcommand,
+    ...args,
+  ];
+
+  log.debug(`git ${fullArgs.join(" ")}`);
+
+  try {
+    const result = await spawn({
+      cmd: gitPath,
+      args: fullArgs,
+      cwd,
+      env: {
+        ...filterEnv(),
+        GIT_ASKPASS: scriptPath,
+        GIT_TERMINAL_PROMPT: "0",
+        // blocks env-based git config injection from outer processes.
+        // GIT_CONFIG_COUNT=0 blocks the newer KEY_n/VALUE_n mechanism.
+        // GIT_CONFIG_PARAMETERS="" clears the legacy quoted-list mechanism.
+        // both are needed — they are independent systems.
+        GIT_CONFIG_COUNT: "0",
+        GIT_CONFIG_PARAMETERS: "",
+      },
+      activityTimeout: 0,
+    });
+
+    if (result.stderr.includes("askpass-compromised")) {
+      log.info("askpass code was replayed after revoke — token has been revoked");
+      throw new Error("git auth failed — askpass code was replayed after revoke, token revoked");
+    }
+
+    if (result.exitCode !== 0) {
+      const stderr = result.stderr.trim();
+      const stdout = result.stdout.trim();
+      // stderr is the primary channel for git diagnostics, but in rare cases
+      // (e.g. some HTTPS smart-protocol failures) the only useful detail is
+      // on stdout — without it the agent / operator sees an empty error.
+      // include exit code so we can distinguish e.g. signal-killed (1 with
+      // empty output) from a genuine git-level rejection.
+      const detail =
+        stderr && stdout
+          ? `${stderr}\n--- stdout ---\n${stdout}`
+          : stderr || stdout || "(no output)";
+      const message = `git ${subcommand} failed (exit ${result.exitCode}): ${detail}`;
+      log.info(message);
+      throw new Error(message);
+    }
+
+    return {
+      stdout: result.stdout.trim(),
+      stderr: result.stderr.trim(),
+    };
+  } finally {
+    authServer.revoke(code);
+    try {
+      unlinkSync(scriptPath);
+    } catch {
+      // script may already be gone (e.g. tmpdir cleanup raced us)
+    }
+  }
+}
+
+/**
+ * shallow-clone unreachable: when an existing local depth is too shallow for
+ * git to traverse to the requested ref's ancestry, the remote walk fails with
+ * one of these wordings (git emits the full OID via oid_to_hex, so the bound
+ * is 40 for SHA-1 or 64 for SHA-256). detecting both lets a single deepen
+ * retry recover before the error reaches the agent — see issue #564 for the
+ * original `git_fetch` precedent and #656 for the `checkout_pr` follow-up.
+ */
+export const SHALLOW_UNREACHABLE_PATTERNS: RegExp[] = [
+  /Could not read [a-f0-9]{40,64}/,
+  /remote did not send all necessary objects/,
+];
+
+/**
+ * large enough to clear the merge base on most real-world PRs without
+ * downloading the full history; matches the fallback used by
+ * `checkoutPrBranch` when the GitHub compare API is unavailable.
+ */
+export const DEEPEN_RETRY_DEPTH = 1000;
+
+/**
+ * authenticated `git fetch` that recovers from shallow-unreachable errors
+ * by retrying once with `--deepen=1000`. callers pass the same args they
+ * would to `$git("fetch", ...)`; on shallow-unreachable failures in a
+ * shallow repo, the second attempt prepends `--deepen=N` and strips any
+ * caller-supplied `--depth=` (the two flags are mutually exclusive, and
+ * the caller's depth is what got us into this mess).
+ *
+ * non-shallow-unreachable errors and non-shallow repos rethrow unchanged,
+ * so this is safe to wrap any fetch without changing fast-path behavior.
+ */
+export async function $gitFetchWithDeepen(
+  args: string[],
+  options: GitAuthOptions,
+  label?: string,
+): Promise<GitResult> {
+  try {
+    return await $git("fetch", args, options);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const isShallowUnreachable = SHALLOW_UNREACHABLE_PATTERNS.some((p) => p.test(msg));
+    if (!isShallowUnreachable) throw err;
+    const isShallow =
+      $("git", ["rev-parse", "--is-shallow-repository"], { log: false }).trim() === "true";
+    if (!isShallow) throw err;
+    log.info(
+      `» ${label ?? "git fetch"} hit shallow-unreachable error, retrying with --deepen=${DEEPEN_RETRY_DEPTH}`,
+    );
+    const retryArgs = args.filter((a) => !a.startsWith("--depth="));
+    return await $git("fetch", [`--deepen=${DEEPEN_RETRY_DEPTH}`, ...retryArgs], options);
+  }
+}

package/src/utils/gitAuthServer.ts

@@ -0,0 +1,186 @@
+/**
+ * ASKPASS-based git authentication server.
+ *
+ * serves tokens via a localhost HTTP server with per-$git()-call UUID codes.
+ * each $git() call gets a unique askpass script with the port+code baked in.
+ * the token never appears in subprocess env — only the script file path.
+ *
+ * lifetime: the code is valid for as long as the $git() invocation is
+ * running. multiple askpass calls within one invocation (e.g. git's own
+ * fetch/push + a git-lfs pre-push hook that also authenticates) all
+ * succeed. $git() calls revoke(code) in finally; subsequent requests for
+ * a revoked code trigger immediate token revocation via the GitHub API
+ * as a tamper-evidence precaution (an agent replaying the code after the
+ * legitimate window has closed is the realistic attack we still catch).
+ */
+
+import { randomUUID } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { PRODUCT_SLUG } from "#app/brand";
+import { log } from "#app/utils/cli";
+
+type CodeState = "active" | "revoked";
+
+type CodeEntry = {
+  token: string;
+  state: CodeState;
+  // only present once the entry is revoked — bounds the replay-trap window.
+  // active entries have no timer because $git() can take arbitrarily long
+  // (large LFS pushes, slow networks, `activityTimeout: 0` on the spawn);
+  // any wall-clock TTL here would re-introduce the original LFS bug at
+  // a different boundary. revoke() is the only way out for an active code.
+  timeout?: NodeJS.Timeout;
+};
+
+const REVOKED_TRAP_MS = 60_000;
+
+export type GitAuthServer = {
+  port: number;
+  register: (token: string) => string;
+  revoke: (code: string) => void;
+  writeAskpassScript: (code: string) => string;
+  close: () => Promise<void>;
+  [Symbol.asyncDispose]: () => Promise<void>;
+};
+
+function revokeGitHubToken(token: string): void {
+  // honor GITHUB_API_URL so the tamper-trap revocation also works on GitHub
+  // Enterprise Server (where the API host is not api.github.com); falls back to
+  // public GitHub otherwise. Mirrors src/utils/token.ts.
+  const apiBase = process.env.GITHUB_API_URL || "https://api.github.com";
+  fetch(`${apiBase}/installation/token`, {
+    method: "DELETE",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "User-Agent": PRODUCT_SLUG,
+    },
+    // best-effort revocation, but still bound it: a hung socket must not keep
+    // the process alive past teardown.
+    signal: AbortSignal.timeout(10_000),
+  }).then(
+    (r) => log.info(`token revocation response: ${r.status}`),
+    () => log.warning("token revocation request failed"),
+  );
+}
+
+export async function startGitAuthServer(tmpdir: string): Promise<GitAuthServer> {
+  const codes = new Map<string, CodeEntry>();
+
+  const server = createServer((req, res) => {
+    if (req.method !== "GET") {
+      res.writeHead(405).end();
+      return;
+    }
+
+    const code = req.url?.slice(1);
+    if (!code) {
+      res.writeHead(400).end();
+      return;
+    }
+
+    const entry = codes.get(code);
+    if (!entry) {
+      res.writeHead(404).end();
+      return;
+    }
+
+    if (entry.state === "active") {
+      // legitimate caller (git, git-lfs, or any subprocess of the running
+      // $git() call). hand back the token without consuming the code —
+      // revoke() in $git's finally is what closes the window.
+      res.writeHead(200, { "Content-Type": "text/plain" });
+      res.end(entry.token);
+      return;
+    }
+
+    // request for a revoked code — the $git() window has closed, so this
+    // is an agent replaying the code. revoke the token as a precaution.
+    log.info("askpass code used after revoke — revoking token");
+    revokeGitHubToken(entry.token);
+    if (entry.timeout) clearTimeout(entry.timeout);
+    codes.delete(code);
+    res.writeHead(409, { "Content-Type": "text/plain" });
+    res.end("compromised");
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+
+  const rawAddr = server.address();
+  if (!rawAddr || typeof rawAddr === "string") {
+    throw new Error("git auth server failed to bind");
+  }
+  const port = rawAddr.port;
+
+  log.debug(`git auth server listening on 127.0.0.1:${port}`);
+
+  function register(token: string): string {
+    const code = randomUUID();
+    codes.set(code, { token, state: "active" });
+    return code;
+  }
+
+  function revoke(code: string): void {
+    const entry = codes.get(code);
+    if (!entry) return;
+    entry.state = "revoked";
+    // keep the entry around briefly so a replay attempt trips the trap
+    // (token revocation) instead of returning an opaque 404.
+    entry.timeout = setTimeout(() => codes.delete(code), REVOKED_TRAP_MS);
+    entry.timeout.unref();
+  }
+
+  function writeAskpassScript(code: string): string {
+    const scriptId = randomUUID();
+    const scriptName = `askpass-${scriptId}.js`;
+    const scriptPath = join(tmpdir, scriptName);
+
+    // standalone node script — no project dependencies.
+    // git invokes this once per credential prompt — separate process spawn
+    // per prompt: one for "Username for ...", one for "Password for ...".
+    // sibling subprocesses (git-lfs pre-push, custom auth-bound hooks)
+    // invoke it independently for their own auth, also one spawn per prompt.
+    // all succeed as long as the parent $git() is still running, which is
+    // why neither the script nor the code is single-use. cleanup happens
+    // in $git()'s finally.
+    // 409 = code was already revoked by $git()'s finally (replay attempt).
+    const content = [
+      `#!/usr/bin/env node`,
+      `var a=process.argv[2]||"";`,
+      `if(/^Username/i.test(a)){process.stdout.write("x-access-token\\n")}`,
+      `else{var h=require("http");`,
+      `h.get("http://127.0.0.1:${port}/${code}",function(r){`,
+      `if(r.statusCode===409){process.stderr.write("askpass-compromised\\n");process.exit(1)}`,
+      `if(r.statusCode!==200){process.exit(1)}`,
+      `var d="";r.on("data",function(c){d+=c});`,
+      `r.on("end",function(){process.stdout.write(d+"\\n")})`,
+      `}).on("error",function(){process.exit(1)})}`,
+    ].join("\n");
+
+    writeFileSync(scriptPath, content, { mode: 0o700 });
+    return scriptPath;
+  }
+
+  async function close(): Promise<void> {
+    for (const entry of codes.values()) {
+      if (entry.timeout) clearTimeout(entry.timeout);
+    }
+    codes.clear();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    log.debug("git auth server closed");
+  }
+
+  return {
+    port,
+    register,
+    revoke,
+    writeAskpassScript,
+    close,
+    [Symbol.asyncDispose]: close,
+  };
+}