looply-cli 0.0.0-stage → 0.3.0

package/dist/toolchain-mirror.js

@@ -0,0 +1,307 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolchainId = toolchainId;
+exports.sourceFingerprint = sourceFingerprint;
+exports.forgetFingerprints = forgetFingerprints;
+exports.toolchainsRoot = toolchainsRoot;
+exports.ensureToolchainMirror = ensureToolchainMirror;
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** The files copied, relative to the toolchain root. Order is not meaningful. */
+const MIRRORED = [
+    'node.exe',
+    'npm.cmd',
+    'npx.cmd',
+    'npm',
+    'npx',
+    'node_modules/npm',
+];
+function sourceDir(deps) {
+    const exe = deps.nodeExe ?? process.execPath;
+    // `realpathSync` because the usual Windows install is a junction: nvm points
+    // `C:\Program Files\nodejs` at a per-version directory under the user's own
+    // AppData. Following it gets the real files and the real owner.
+    try {
+        return (0, node_path_1.dirname)((0, node_fs_1.realpathSync)(exe));
+    }
+    catch {
+        return (0, node_path_1.dirname)(exe);
+    }
+}
+function versionOf(exe) {
+    try {
+        return (0, node_child_process_1.execFileSync)(exe, ['--version'], { encoding: 'utf8' }).trim();
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * An identity that changes when the toolchain does.
+ *
+ * Version plus the runtime's own size, not a timestamp: an upgrade must produce
+ * a different id so the old mirror is not used for ever, and a rebuild of the
+ * same toolchain must produce the same one so it is not copied twice.
+ *
+ * Not a content hash of a 71-megabyte binary — that is minutes of work for a
+ * distinction the version and size already make, and this is a cache key rather
+ * than a security boundary.
+ */
+function toolchainId(deps = {}) {
+    const exe = deps.nodeExe ?? process.execPath;
+    const version = versionOf(exe).replace(/[^0-9a-zA-Z.]/g, '');
+    return `node-${version || 'unknown'}-${sourceFingerprint(sourceDir(deps)).slice(0, 16)}`;
+}
+/**
+ * Cached per process, because the answer cannot change under a running daemon
+ * without the files changing, and hashing eighty megabytes before every gate
+ * step would be a real cost for a question asked many times a minute.
+ */
+/** Separators built from char codes: an escape in this file has been
+ *  collapsed by tooling more than once, and a silently wrong separator
+ *  produces a digest that is stable and meaningless. */
+const SLASH = String.fromCharCode(47);
+const NL = String.fromCharCode(10);
+const SEP = String.fromCharCode(0);
+const fingerprints = new Map();
+/**
+ * A digest of what is actually mirrored — CONTENTS, not metadata.
+ *
+ * Version and size were not enough. A rebuild at the same version, or a patched
+ * binary of the same length, or a change anywhere in the npm tree while
+ * `node.exe` stands still, all left the old identity in place and the old mirror
+ * in use. That is a cache serving yesterday's runtime to today's gate.
+ *
+ * Sorted `path\u0000size\u0000sha256` lines, hashed as one canonical list, so the
+ * digest depends on the set of files and every byte in them and on nothing
+ * else — not on walk order, not on timestamps.
+ *
+ * This is a CACHE KEY, not an authority: it decides whether the copy is current,
+ * never whether anything is allowed.
+ */
+function sourceFingerprint(src) {
+    const cached = fingerprints.get(src);
+    if (cached !== undefined)
+        return cached;
+    const lines = [];
+    const walk = (abs, rel) => {
+        let st;
+        try {
+            st = (0, node_fs_1.statSync)(abs);
+        }
+        catch {
+            return;
+        }
+        if (st.isDirectory()) {
+            for (const name of (0, node_fs_1.readdirSync)(abs).sort())
+                walk((0, node_path_1.join)(abs, name), `${rel}/${name}`);
+            return;
+        }
+        const h = (0, node_crypto_1.createHash)('sha256').update((0, node_fs_1.readFileSync)(abs)).digest('hex');
+        lines.push(`${rel}\u0000${st.size}\u0000${h}`);
+    };
+    for (const rel of MIRRORED)
+        walk((0, node_path_1.join)(src, ...rel.split(SLASH)), rel);
+    const digest = (0, node_crypto_1.createHash)('sha256').update(lines.sort().join(NL), 'utf8').digest('hex');
+    fingerprints.set(src, digest);
+    return digest;
+}
+/** For tests that change a fixture and need the next answer computed afresh. */
+function forgetFingerprints() {
+    fingerprints.clear();
+}
+/** Every mirrored entry is present in the copy, not merely named by a manifest. */
+function mirrorIsComplete(dir, manifest) {
+    for (const rel of manifest.files) {
+        if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(dir, ...rel.split(SLASH))))
+            return false;
+    }
+    return (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'node.exe'));
+}
+/** Where mirrors live: outside every repository, under the user's own home. */
+function toolchainsRoot(deps = {}) {
+    return (0, node_path_1.join)(deps.home ?? (0, node_os_1.homedir)(), '.looply', 'toolchains');
+}
+function manifestAt(dir) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'looply-toolchain.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** The manifest at `dir`, but only when the copy it describes is actually there. */
+function completeAt(dir) {
+    const m = manifestAt(dir);
+    return m !== null && mirrorIsComplete(dir, m) ? m : null;
+}
+/**
+ * The mirror for the current toolchain, building it if it is not there.
+ *
+ * ATOMIC, because two gates can start at once and a half-copied runtime must
+ * never be executed. The copy goes into a private staging directory named for
+ * this process, is verified, and only then becomes the real one by a single
+ * rename. A racing caller either sees no mirror and builds its own staging copy,
+ * or sees a complete one — never a partial.
+ *
+ * The manifest is written INSIDE the staging directory before the rename, so a
+ * directory that exists without a readable manifest is a directory that lost the
+ * race to be renamed away, not a mirror to trust.
+ */
+/**
+ * Remove directories an earlier rename-aside could not.
+ *
+ * A superseded mirror is named for the process that set it aside, so nothing
+ * else will ever adopt it — but a locked file can outlive that process, and a
+ * directory nobody sweeps is a directory that grows. Best effort, on the
+ * rebuild path only, and never a reason to fail a build.
+ */
+function sweepSuperseded(root) {
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)(root);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!name.includes('.superseded-'))
+            continue;
+        try {
+            (0, node_fs_1.rmSync)((0, node_path_1.join)(root, name), { recursive: true, force: true });
+        }
+        catch {
+            /* still locked; next time */
+        }
+    }
+}
+function ensureToolchainMirror(deps = {}) {
+    const id = toolchainId(deps);
+    const root = toolchainsRoot(deps);
+    const target = (0, node_path_1.join)(root, id);
+    const src = sourceDir(deps);
+    const found = completeAt(target);
+    // A MANIFEST IS NOT A MIRROR. A readable manifest beside a missing `node.exe`
+    // is a copy that was interrupted or half-deleted, and reusing it would hand
+    // the gate a runtime that is not there.
+    if (found !== null && found.id === id) {
+        return { ok: true, path: target, id, manifest: found, built: false };
+    }
+    const exe = deps.nodeExe ?? process.execPath;
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(src, 'node.exe'))) {
+        return { ok: false, because: `no runtime to mirror at ${src}` };
+    }
+    const staging = `${target}.staging-${process.pid}-${Date.now()}`;
+    try {
+        (0, node_fs_1.mkdirSync)(staging, { recursive: true });
+        const copied = [];
+        for (const rel of MIRRORED) {
+            const from = (0, node_path_1.join)(src, rel.replace(/\//g, '\\'));
+            if (!(0, node_fs_1.existsSync)(from))
+                continue;
+            const to = (0, node_path_1.join)(staging, rel.replace(/\//g, '\\'));
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(to), { recursive: true });
+            (0, node_fs_1.cpSync)(from, to, { recursive: true });
+            copied.push(rel);
+        }
+        if (!copied.includes('node.exe')) {
+            return { ok: false, because: 'the runtime did not copy' };
+        }
+        const manifest = {
+            id,
+            nodeVersion: versionOf(exe),
+            npmVersion: copied.includes('npm.cmd') ? readNpmVersion(src) : null,
+            source: src,
+            sourceBytes: (0, node_fs_1.statSync)(exe).size,
+            files: copied,
+            createdAt: new Date().toISOString(),
+        };
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(staging, 'looply-toolchain.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+        (0, node_fs_1.mkdirSync)(root, { recursive: true });
+        // A directory already sitting at the target is a build that died before it
+        // could be renamed into place, or a mirror that has since lost files.
+        // Rename will not replace a directory on Windows, so leaving it there would
+        // block every future rebuild — an incomplete mirror would stay incomplete
+        // for ever, and the gate would keep refusing to run.
+        //
+        // JUDGED BY COMPLETENESS, NOT BY THE MANIFEST. A readable manifest beside a
+        // missing `node.exe` used to survive this check, which made a half-deleted
+        // mirror permanent: the reuse gate rejected it, the rebuild could not
+        // replace it, and the catch below adopted it again unchanged.
+        //
+        // A mirror another process completed while we were copying IS complete, so
+        // it is not removed; we lose the rename and adopt theirs instead.
+        /**
+         * 🔴 RENAMED ASIDE, NEVER REMOVED, BECAUSE THIS PATH IS SHARED.
+         *
+         * `~/.looply/toolchains/<id>` is where EVERY workspace, every project and
+         * every concurrent looply process on this machine resolves `node.exe`. This
+         * was `rmSync(target, { recursive: true, force: true })`, and under N
+         * workspaces that is a delete of a directory a sibling's gate may be
+         * executing out of right now.
+         *
+         * ⚠️ AND `force: true` DOES NOT MAKE IT SAFE — it suppresses ENOENT and
+         * nothing else. A locked file makes `rmSync` throw PART OF THE WAY THROUGH,
+         * which is the worst outcome available: the shared mirror is now genuinely
+         * half-deleted, this build fails, and the next one finds exactly the
+         * incomplete directory this branch exists to clear.
+         *
+         * A rename is all-or-nothing. Either the directory moves aside whole — and
+         * what moved is then ours alone, named for this process — or it does not
+         * move at all and nothing was destroyed. On failure this falls through to
+         * the rename below, which fails, and the catch adopts whatever is really
+         * there. That is the same recovery the lost-race path already takes, and it
+         * cannot leave a shared mirror in pieces.
+         */
+        if ((0, node_fs_1.existsSync)(target) && !completeAt(target)) {
+            const aside = `${target}.superseded-${process.pid}-${Date.now().toString(36)}`;
+            try {
+                (0, node_fs_1.renameSync)(target, aside);
+                // Ours alone now: a directory Windows let us rename held no open handle.
+                // Best effort even so — tidying must never become this function's verdict.
+                try {
+                    (0, node_fs_1.rmSync)(aside, { recursive: true, force: true });
+                }
+                catch {
+                    /* left for the sweep below */
+                }
+            }
+            catch {
+                // In use, or locked. Nothing was destroyed; the rename below will fail
+                // and the catch will adopt what is actually on disk.
+            }
+        }
+        sweepSuperseded(root);
+        try {
+            (0, node_fs_1.renameSync)(staging, target);
+        }
+        catch {
+            // Somebody else got there first between the clear above and this rename.
+            // Adopt theirs only if it is a mirror and not merely a manifest — the
+            // whole point of this rebuild was that a manifest alone is not enough.
+            (0, node_fs_1.rmSync)(staging, { recursive: true, force: true });
+            const other = completeAt(target);
+            if (other === null)
+                return { ok: false, because: 'the toolchain mirror could not be placed' };
+            return { ok: true, path: target, id, manifest: other, built: false };
+        }
+        return { ok: true, path: target, id, manifest, built: true };
+    }
+    catch (e) {
+        (0, node_fs_1.rmSync)(staging, { recursive: true, force: true });
+        return { ok: false, because: `the toolchain mirror could not be built (${e.message})` };
+    }
+}
+function readNpmVersion(src) {
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(src, 'node_modules', 'npm', 'package.json'), 'utf8'));
+        return pkg.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=toolchain-mirror.js.map

package/dist/toolchain-mirror.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain-mirror.js","sourceRoot":"","sources":["../src/toolchain-mirror.ts"],"names":[],"mappings":";;AAqGA,kCAIC;AA+BD,8CAsBC;AAGD,gDAEC;AAWD,wCAEC;AAiED,sDAkHC;AAnWD,6CAAyC;AACzC,2DAAkD;AAClD,qCAWiB;AACjB,qCAAkC;AAClC,yCAA0C;AAsC1C,iFAAiF;AACjF,MAAM,QAAQ,GAAsB;IAClC,UAAU;IACV,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,kBAAkB;CACnB,CAAC;AASF,SAAS,SAAS,CAAC,IAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC7C,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,CAAC;QACH,OAAO,IAAA,mBAAO,EAAC,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAA,iCAAY,EAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,OAAsB,EAAE;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,QAAQ,OAAO,IAAI,SAAS,IAAI,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH;;wDAEwD;AACxD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACtC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAEnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,IAAI,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,SAAgB,kBAAkB;IAChC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,GAAW,EAAE,QAA2B;IAChE,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,OAAsB,EAAE;IACrD,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC/D,CAAC;AAaD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC;YACH,IAAA,gBAAM,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAsB,EAAE;IAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,GAAG,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,YAAY,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,MAAM,EAAE,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACnD,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAsB;YAClC,EAAE;YACF,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,IAAI;YAC/B,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAEhG,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,0EAA0E;QAC1E,qDAAqD;QACrD,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,8DAA8D;QAC9D,EAAE;QACF,2EAA2E;QAC3E,kEAAkE;QAClE;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,GAAG,MAAM,eAAe,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC;gBACH,IAAA,oBAAU,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC1B,yEAAyE;gBACzE,2EAA2E;gBAC3E,IAAI,CAAC;oBACH,IAAA,gBAAM,EAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,8BAA8B;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,qDAAqD;YACvD,CAAC;QACH,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,IAAA,oBAAU,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;YAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,4CAA6C,CAAW,CAAC,OAAO,GAAG,EAAE,CAAC;IACrG,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/trusted-git.d.ts

@@ -0,0 +1,243 @@
+/**
+ * The first executable key this config defines, in words, or null if none.
+ *
+ * Takes the text rather than a path so the rule is testable without a
+ * repository, and so the caller decides what an unreadable config means.
+ */
+export declare function repoConfigTrouble(text: string): string | null;
+/**
+ * WHERE A REPOSITORY ACTUALLY KEEPS ITS CONFIG.
+ *
+ * `<cwd>/.git` is a directory in an ordinary checkout and a FILE in a linked
+ * worktree, where it holds one line — `gitdir: <path>` — pointing at
+ * `<common>/worktrees/<name>`. That directory in turn holds a `commondir` file
+ * naming the shared metadata directory, and the config git reads for the
+ * repository lives in the SHARED one.
+ *
+ * ⚠️ THIS IS A SECURITY BOUNDARY, NOT A PATH CONVENIENCE. Reading
+ * `join(cwd, '.git', 'config')` in a linked worktree throws ENOTDIR, and the
+ * catch that used to sit here answered "no evidence of an attack" — so every
+ * `filter.<ANY>.clean` in the shared config would have gone live against `add`,
+ * `reset --hard`, `diff HEAD` and `status` the moment the first worktree
+ * existed, silently and with no log line.
+ *
+ * So the layout is resolved the way git resolves it, and the three answers are
+ * kept apart: there is no repository here, or here is where its metadata is, or
+ * there is a repository whose metadata could not be read — which is a REFUSAL,
+ * because a config that cannot be read is a config that cannot be cleared.
+ */
+export type GitLayout = {
+    kind: 'none';
+} | {
+    kind: 'fault';
+    because: string;
+} | {
+    kind: 'ok';
+    root: string;
+    gitDir: string;
+    commonDir: string;
+};
+/**
+ * Find the repository governing `cwd`, the way git does: look for a `.git`
+ * entry here, then in each parent, to the filesystem root.
+ *
+ * WALKING UP IS DELIBERATE. Run from a subdirectory, the old check looked at
+ * `<subdir>/.git`, found nothing, and returned "no trouble" — while every git
+ * command it was guarding still ran against the repository above. That was a
+ * second way to reach the same fail-open, and it did not need a worktree.
+ */
+export declare function resolveGitLayout(cwd: string): GitLayout;
+/**
+ * Every config file that governs this repository, most-shared first.
+ *
+ * `config.worktree` is read only when `extensions.worktreeConfig` is set, but
+ * it is scanned unconditionally: a file that git might read is a file this
+ * check must not skip, and scanning one git ignores costs a refusal nobody
+ * could have exploited anyway.
+ */
+export declare function repoConfigPaths(layout: Extract<GitLayout, {
+    kind: 'ok';
+}>): string[];
+/**
+ * Judge the config of the repository governing `cwd`, in words, or null.
+ *
+ * A missing repository is not a fault and neither is a missing config file — a
+ * config that does not exist defines nothing. A repository whose metadata or
+ * config cannot be READ is a refusal: the whole mechanism is "decline before
+ * git runs", and declining is the only answer that stays sound when the file
+ * the decision rests on is unavailable.
+ */
+export declare function repoConfigTroubleAt(cwd: string): string | null;
+/**
+ * The metadata directories of the worktree AT `dir`, or null when `dir` is not
+ * itself one.
+ *
+ * ⚠️ DELIBERATELY NOT THE ENCLOSING REPOSITORY, and the difference is the whole
+ * reason this is a separate function. {@link resolveGitLayout} walks up, which
+ * is the right answer to "whose config could execute when git runs here" — a
+ * command issued in a subdirectory is still governed by the repository above.
+ * It is the WRONG answer to "what does this grant own": a directory that merely
+ * SITS INSIDE a repository is not that repository's worktree, and protecting an
+ * ancestor's metadata would describe a boundary the container does not have.
+ *
+ * Caught by `agent-contained.spec.ts`, which passes a `projectDir` that is not
+ * a repository and pins the protected list at three entries.
+ */
+export declare function worktreeMetadata(dir: string): {
+    gitDir: string;
+    commonDir: string;
+} | null;
+/**
+ * Whether `cwd` is the root of the repository it belongs to, in words, or null.
+ *
+ * THE CHECK THAT NEVER EXISTED. `looply` derives three things from `cwd` — the
+ * project identity, `.looply/state`, and the tree every git verb operates on —
+ * and nothing established that `cwd` was a repository at all, let alone its
+ * root. Started one directory down, the run wrote its state into a subdirectory
+ * while committing, discarding and resetting the whole repository above it: a
+ * `reset --hard` scoped to a tree the person never named.
+ *
+ * A worktree layout makes it reachable by accident rather than by mistake,
+ * which is why it lands here rather than after the first worktree exists.
+ */
+export declare function repoRootTroubleAt(cwd: string): string | null;
+/**
+ * An empty directory to point `core.hooksPath` at.
+ *
+ * Created rather than merely named: a path that does not exist would also work
+ * today, but an empty directory we make is one the repository cannot fill by
+ * simply creating what git was told to look for.
+ *
+ * 🔴 AND IT IS EMPTIED EVERY TIME, WHICH IT WAS NOT.
+ *
+ * This was one machine-global `%TEMP%\looply-no-hooks`, created once and never
+ * looked at again — passed as `core.hooksPath` on EVERY trusted git call of
+ * every workspace of every project on the machine. `mkdirSync` is recursive and
+ * idempotent, so the first caller made it and every later caller trusted it
+ * without ever asking what was inside.
+ *
+ * `%TEMP%` is world-writable on Windows. Anything that can write there could
+ * drop a `pre-commit` into that directory and have it executed by the very
+ * mechanism that exists to guarantee no repository hook ever runs — with the
+ * daemon's own privileges, uncontained. Not a workspace-isolation problem: a
+ * one-line hole in the hook defence itself, which nothing would have noticed
+ * because the directory is invisible and the flag reads as already handled.
+ *
+ * ⚠️ SO IT IS CHECKED, NOT ASSUMED. Anything sitting in it is removed before
+ * the path is handed to git. Sweeping is cheap — the directory is empty in
+ * every ordinary case — and a sweep that fails still leaves git pointed at a
+ * directory whose contents this call has at least tried to control.
+ */
+export declare function noHooksDir(): string;
+/**
+ * The absolute path of the `git` this machine will run, resolved from PATH only.
+ *
+ * 🔴 A BARE `spawn('git', …, {cwd})` LETS THE REPOSITORY SUPPLY THE BINARY.
+ *
+ * On Windows the process creation path searches the WORKING DIRECTORY BEFORE
+ * PATH. `cwd` here is the project root, and `untrustedGrants` hands the
+ * contained agent `{ path: projectDir, write: true }` — so a `git.exe` the agent
+ * writes runs OUTSIDE the container, as the daemon, on `status`, `add -A`,
+ * `diff HEAD`, `commit`, `reset --hard`, `clean -fd` and `push`. Measured:
+ * `spawnSync('git', ['--version'], { cwd: <dir with a planted git.exe> })`
+ * executed the plant; the same call from another directory ran real git.
+ *
+ * That defeats everything else in this file at once — the config check, the
+ * root check, the rebuilt `GIT_` namespace, the `GIT_DIR` pin, `core.hooksPath`
+ * and `commit.gpgsign=false` — because none of them constrains a program that
+ * is not git. `exec-domains.ts` already makes exactly this argument for the
+ * runtime mirror ("untrusted code that could replace `node.exe` would be
+ * untrusted code choosing what every later gate runs"); it simply had never
+ * been applied to git.
+ *
+ * Resolved once and cached: PATH does not change under a running daemon, and a
+ * per-call PATH walk on every git verb would be a needless cost.
+ */
+export declare function gitBinary(): string | null;
+/**
+ * Arguments every trusted git invocation carries, before the caller's own.
+ *
+ * `-c` beats repository config, so this is enforcement rather than a request:
+ * the repository cannot override it back.
+ */
+export declare function trustedGitArgs(): string[];
+export declare function trustedGitEnv(base: NodeJS.ProcessEnv, cwd?: string): NodeJS.ProcessEnv;
+/**
+ * THE MAIN WORKTREE'S ROOT — the directory a project's shared state belongs to.
+ *
+ * 🔴 A LINKED WORKTREE IS THE SAME PROJECT, and almost nothing in looply knew
+ * that. Project identity, the loop-safety history, the single-use exemption
+ * ledger, the human's control file and the ledger the daemon uploads are all
+ * derived from the working directory — so running in a worktree silently
+ * produced a DIFFERENT project with a fresh safety history, unspent exemptions,
+ * a control file nobody writes and events nobody uploads.
+ *
+ * The main worktree is where the common dir lives: for `<root>/.git` the answer
+ * is `<root>`. A linked worktree's common dir is that same `<root>/.git`, so it
+ * resolves to the same place — which is the whole point.
+ *
+ * ⚠️ NULL, NOT A GUESS, when there is no repository or its metadata cannot be
+ * read. The caller then keeps whatever it does today, so a non-repository
+ * directory behaves exactly as it did before this existed.
+ *
+ * ⚠️ A BARE OR SEPARATE-GITDIR REPOSITORY HAS NO MAIN WORKTREE ROOT. When the
+ * common dir is not named `.git`, this returns null rather than inventing a
+ * parent directory that may hold nothing at all.
+ */
+export declare function mainWorktreeRoot(cwd: string): string | null;
+/**
+ * WHAT ALL THE WORKTREES OF ONE REPOSITORY SHARE, when no main worktree exists.
+ *
+ * 🔴 `mainWorktreeRoot` RETURNING NULL WAS TREATED AS "NO SHARING NEEDED", and
+ * those are different statements. A repository can have several worktrees and no
+ * main one — `git clone --bare` then `git worktree add` twice is the ordinary
+ * way to get there — and for those, "no main root" was silently answered by
+ * putting the project's state inside each checkout. That is exactly the split
+ * the project/execution divide exists to prevent: a fresh loop-safety history
+ * per checkout, and one single-use exemption spendable once per checkout.
+ *
+ * The common dir is the identity every worktree of a repository agrees on, so it
+ * is what the shared location is keyed by.
+ *
+ * ⚠️ SEPARATE-GIT-DIR AND SUBMODULE LAYOUTS DO NOT REACH HERE. Both set
+ * `core.worktree`, which `repoConfigTrouble` refuses by name before any of this
+ * runs. The case this actually serves is the bare repository with linked
+ * worktrees, which nothing refuses and which was silently mis-scoped.
+ *
+ * ⚠️ NULL FOR AN ORDINARY CHECKOUT — `gitDir === commonDir` — even though one
+ * exists. There is a single worktree there, so the execution's own directory IS
+ * the project's, and answering anything else would move state that is correct
+ * where it sits.
+ */
+/**
+ * THE PATH THAT IDENTIFIES A REPOSITORY, whichever of its checkouts you are in.
+ *
+ * 🔴 PROJECT IDENTITY WAS THE CWD, AND A WORKTREE IS NOT A NEW PROJECT. Both
+ * `repoPathHash` (the server's project key) and `projectKeyFor` (the project
+ * memory key) hashed the directory the command happened to run in. So
+ * `looply run --in <workspace>` registered a SECOND project on the server for
+ * the same repository, uploaded its events there, and read an empty project
+ * memory — while the person watching saw one project stop producing evidence.
+ *
+ * ⚠️ AN ORDINARY CHECKOUT HASHES TO EXACTLY WHAT IT ALWAYS DID. The main
+ * worktree root of a normal repository IS its root, so every existing key,
+ * every cached `projects` entry in the machine store and every server-side
+ * project survives untouched. Only a linked worktree's answer changes, and it
+ * changes from "a project of its own" to "the project it was cut from".
+ *
+ * ⚠️ AND A NON-REPOSITORY IS UNCHANGED TOO — no layout, no answer, the path
+ * comes back as given. Tests that pass invented directories keep working, which
+ * is deliberate: this must not require a repository to be callable.
+ */
+/**
+ * Whether this directory IS a checkout's root — ordinary or linked.
+ *
+ * `resolveGitLayout` walks up, so every directory inside a repository has a
+ * layout. This is the question that separates `<repo>` from `<repo>/packages/a`,
+ * and it is the one both the project's identity and the project's state have to
+ * agree on or one of them is lying about what a project is.
+ */
+export declare function isCheckoutRoot(cwd: string): boolean;
+export declare function repoIdentityPath(cwd: string): string;
+export declare function linkedRepoCommonDir(cwd: string): string | null;
+//# sourceMappingURL=trusted-git.d.ts.map

package/dist/trusted-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-git.d.ts","sourceRoot":"","sources":["../src/trusted-git.ts"],"names":[],"mappings":"AAuLA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc7D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAoDpE;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAmBvD;AA2FD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,MAAM,EAAE,CAKpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK1F;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqC5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAiBnC;AAID;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAuBzC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CA4BzC;AAqGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAoCtF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0BpD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D"}