mtech-ai-local-runner 0.1.94 → 0.1.95

package/dist/src/publication/git-snapshot.js

@@ -1,7 +1,7 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { constants } from 'node:fs';
-import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, readlink, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
@@ -11,6 +11,7 @@ const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const structural = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^\.git$/i.test(s));
 const safe = (p) => structural(p) && p.split('/').every(s => !/^(?:\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
+const TRACKED_SYMLINK = /^120000 blob ([a-f0-9]{40})\t(.+)$/s;
 /** P1 branch shape only. Authority still requires exact frozen-fence equality. */
 /** Whole-checkout memory bound for a snapshot, per file and in total. A snapshot reads every
  * file of the checkout, so callers bound candidate size on the changed files instead. */
@@ -136,6 +137,19 @@ export class GitSnapshotHost {
             await fd.close();
         }
     }
+    /** A tracked symlink must stay the exact base link. Its target is read with readlink and never followed. */
+    async assertTrackedSymlink(relative, target) {
+        let component = this.options.root;
+        const parts = relative.split('/');
+        for (let i = 0; i < parts.length; i++) {
+            component = path.join(component, parts[i]);
+            const stat = await lstat(component);
+            if (i < parts.length - 1 ? stat.isSymbolicLink() || !stat.isDirectory() : !stat.isSymbolicLink())
+                throw denied();
+        }
+        if (!(await readlink(component, { encoding: 'buffer' })).equals(target))
+            throw denied();
+    }
     /** Checks the options every read relies on, then that HEAD is the base commit on the working branch. */
     async head() {
         const o = this.options, branchAllowed = o.p1WorkingBranch === undefined ? /^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) : o.p1WorkingBranch === o.workingBranch && isP1WorkingBranch(o.workingBranch);
@@ -149,7 +163,7 @@ export class GitSnapshotHost {
         const o = this.options;
         await this.head();
         const head = o.baseCommitSha, branch = o.workingBranch;
-        const base = new Map(), gitlinks = new Map(), protectedNames = new Set(), baseListing = await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha]);
+        const base = new Map(), gitlinks = new Map(), symlinks = new Map(), protectedNames = new Set(), baseListing = await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha]);
         for (const line of baseListing.toString().split('\0').filter(Boolean)) {
             const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
             if (link) {
@@ -158,6 +172,13 @@ export class GitSnapshotHost {
                 gitlinks.set(link[2], link[1]);
                 continue;
             }
+            const symlink = TRACKED_SYMLINK.exec(line);
+            if (symlink) {
+                if (!safe(symlink[2]))
+                    throw denied();
+                symlinks.set(symlink[2], symlink[1]);
+                continue;
+            }
             const match = /^(100644|100755) blob ([a-f0-9]{40})\t(.+)$/s.exec(line);
             if (!match || !structural(match[3]))
                 throw denied();
@@ -166,11 +187,11 @@ export class GitSnapshotHost {
                 protectedNames.add(match[3]);
         }
         // Protected names the base commit already tracks stay as exact base content; only a change to one is refused.
-        // Gitlinks remain exact base-tree references. Never traverse or copy their source.
+        // Gitlinks and tracked symlinks remain exact base-tree references. Never traverse or copy their source.
         // Staged replacement/deletion is refused rather than publishing hidden changes.
         const staged = new Map(), stagedListing = await this.git(['ls-files', '--stage', '-z']);
         for (const line of stagedListing.toString().split('\0').filter(Boolean)) {
-            const entry = /^(100644|100755|160000) ([a-f0-9]{40}) 0\t(.+)$/s.exec(line);
+            const entry = /^(100644|100755|120000|160000) ([a-f0-9]{40}) 0\t(.+)$/s.exec(line);
             if (!entry || !structural(entry[3]))
                 throw denied();
             staged.set(entry[3], entry[1] + ' ' + entry[2]);
@@ -178,15 +199,26 @@ export class GitSnapshotHost {
         const expected = new Map([...base.entries()].map(([name, value]) => [name, value.mode.toString(8) + ' ' + value.blob]));
         for (const [name, oid] of gitlinks)
             expected.set(name, '160000 ' + oid);
+        for (const [name, oid] of symlinks)
+            expected.set(name, '120000 ' + oid);
         if (protocolHash([...expected].sort()) !== protocolHash([...staged].sort()))
             throw denied();
         const untrackedListing = await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--']);
         const names = [...new Set([...base.keys(), ...untrackedListing.toString().split('\0').filter(Boolean)])].sort();
-        const blobs = await this.batchObjects([...base.values()].map(v => v.blob));
+        const blobs = await this.batchObjects([...[...base.values()].map(v => v.blob), ...symlinks.values()]);
+        const symlinkTargets = new Map();
+        for (const [name, oid] of symlinks) {
+            const blob = blobs.get(oid);
+            if (!blob || blob.type !== 'blob')
+                throw denied();
+            symlinkTargets.set(name, blob.bytes);
+            await this.assertTrackedSymlink(name, blob.bytes);
+        }
+        const kept = [...gitlinks.keys(), ...symlinks.keys()];
         const files = [], changes = [];
         let total = 0;
         for (const name of names) {
-            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
+            if (kept.some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
                 throw denied();
             const current = await this.currentFile(name, protectedNames.has(name)), prior = base.get(name);
             let before = null;
@@ -211,7 +243,7 @@ export class GitSnapshotHost {
                 changes.push({ path: name, status: !prior ? 'added' : !current ? 'deleted' : 'modified', before: before?.toString('base64') ?? null, after: current?.bytes.toString('base64') ?? null, before_mode: prior?.mode ?? null, after_mode: current?.mode ?? null });
         }
         const observation = { base_commit_sha: o.baseCommitSha, head_commit_sha: head, working_branch: branch, diff: JSON.stringify({ format: 'local-candidate-binary-diff-v1', changes }), changed_files: changes.map(({ path, status }) => ({ path, status })) };
-        const listing = { base: digest(baseListing), staged: digest(stagedListing), untracked: digest(untrackedListing), names, protectedNames };
+        const listing = { base: digest(baseListing), staged: digest(stagedListing), untracked: digest(untrackedListing), names, protectedNames, symlinks: symlinkTargets };
         return { observation, files, listing, fingerprint: protocolHash({ observation, files: files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) })) }) };
     }
     /** The checkout still equals a capture when HEAD, the branch, the three Git listings and every
@@ -222,6 +254,8 @@ export class GitSnapshotHost {
         await this.head();
         if (digest(await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha])) !== listing.base || digest(await this.git(['ls-files', '--stage', '-z'])) !== listing.staged || digest(await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--'])) !== listing.untracked)
             throw denied();
+        for (const [name, target] of listing.symlinks)
+            await this.assertTrackedSymlink(name, target);
         const files = [];
         let total = 0;
         for (const name of listing.names) {
@@ -264,7 +298,7 @@ export class GitSnapshotHost {
             for (const entry of (await this.git(['ls-tree', '-r', '-t', '-z', o.baseCommitSha])).toString().split('\0').filter(Boolean)) {
                 if (/^160000 commit [a-f0-9]{40}\t/.test(entry))
                     continue;
-                const match = /^(?:100644|100755|040000) (blob|tree) ([a-f0-9]{40})\t/.exec(entry);
+                const match = /^(?:100644|100755|120000|040000) (blob|tree) ([a-f0-9]{40})\t/.exec(entry);
                 if (!match)
                     throw denied();
                 objects.set(match[2], match[1]);
@@ -344,6 +378,9 @@ export class GitSnapshotHost {
                 const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
                 if (link)
                     entries.push({ path: link[2], mode: 0o160000, bytes: Buffer.alloc(0), gitlink: link[1] });
+                const symlink = TRACKED_SYMLINK.exec(line);
+                if (symlink)
+                    entries.push({ path: symlink[2], mode: 0o120000, bytes: Buffer.alloc(0), baseBlob: symlink[1] });
             }
             const objects = new RawGitObjects(root), tree = await objects.tree(entries, true), commitSha = await objects.object('commit', Buffer.from(`tree ${tree}\nparent ${this.options.baseCommitSha}\nauthor Local Runner Verification <runner-verification@invalid> 1 +0000\ncommitter Local Runner Verification <runner-verification@invalid> 1 +0000\n\nLocal runner verification candidate v1\n`), true);
             await writeFile(path.join(root, '.git', 'HEAD'), commitSha + '\n', { mode: 0o600 });

package/dist/src/publication/git-transport.js

@@ -67,13 +67,13 @@ export class GitPublicationTransport {
         if (protocolHash(entries.map(e => ({ path: e.path, mode: e.mode, sha256: createHash('sha256').update(e.bytes).digest('hex') }))) !== o.sealedTreeFingerprint)
             throw denied();
         for (const line of (await this.git(['ls-tree', '-r', '-z', request.base_commit_sha])).split('\0').filter(Boolean)) {
-            const gitlink = /^160000 commit ([a-f0-9]{40})\t(.+)$/.exec(line);
-            if (!gitlink)
+            const gitlink = /^160000 commit ([a-f0-9]{40})\t(.+)$/.exec(line), symlink = /^120000 blob ([a-f0-9]{40})\t(.+)$/.exec(line), kept = gitlink ?? symlink;
+            if (!kept)
                 continue;
-            const name = gitlink[2];
+            const name = kept[2];
             if (!name || name.split('/').some(p => !p || p === '.' || p === '..' || p === '.git') || name.includes('\\') || entries.some(e => e.path === name || e.path.startsWith(name + '/') || name.startsWith(e.path + '/')))
                 throw denied();
-            entries.push({ path: name, mode: 0o160000, bytes: Buffer.alloc(0), gitlink: gitlink[1] });
+            entries.push(gitlink ? { path: name, mode: 0o160000, bytes: Buffer.alloc(0), gitlink: gitlink[1] } : { path: name, mode: 0o120000, bytes: Buffer.alloc(0), baseBlob: symlink[1] });
         }
         if (!await o.current())
             throw denied();

package/dist/src/publication/raw-git-objects.js

@@ -42,7 +42,7 @@ export class RawGitObjects {
             if (slash >= 0)
                 children.add(rest.slice(0, slash));
             else
-                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
+                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? entry.baseBlob ?? await this.object('blob', entry.bytes, write) });
         }
         for (const child of children)
             names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.94",
+  "version": "0.1.95",
   "private": false,
   "license": "UNLICENSED",
   "bin": {