omp-conductor 0.3.24 → 0.4.0

package/src/tracker/github.ts

@@ -5,6 +5,14 @@
  * daemon never handles a token itself: credentials stay in the user's keychain
  * or `gh` config and are never passed as argv, written to a file, or logged.
  *
+ * That reachability is exactly what #125 confines. The environment this adapter
+ * hands `gh` comes from `credentialedEnv()` — the one named construction site
+ * of credential material in the daemon — so "which processes can reach the
+ * operator's GitHub write credential" is answered by that function's call
+ * sites, not by auditing every spawn in the tree. Sessions get the opposite
+ * environment, and on a `per-run` host they are a different OS principal
+ * entirely and could not use this credential even if they found it.
+ *
  * ponytail: shelling out to `gh` is the deliberate simplification. The ceiling
  * is per-call cost (one process spawn plus one TLS handshake per operation,
  * ~200-400ms) and failure classification by matching human-readable stderr
@@ -13,9 +21,12 @@
  * `gh auth token`; the eleven Tracker methods above it stay untouched.
  */
 
+import { credentialedEnv } from "../credentials.ts";
+import { parsePrDiff } from "../diff-flags.ts";
 import type {
   IssueState,
   OpenCloser,
+  PrDiff,
   PrState,
   PrVerification,
   ProjectConfig,
@@ -129,6 +140,11 @@ async function gh(argv: string[], stdin?: string): Promise<string> {
     stdin: new Blob([stdin ?? ""]),
     stdout: "pipe",
     stderr: "pipe",
+    // The privileged side of the boundary (#125). Explicit rather than
+    // inherited so that adding a credential-scrubbing default to this process
+    // could never silently break the tracker, and so that the grep for
+    // `credentialedEnv` finds this call.
+    env: credentialedEnv(),
   });
 
   const [stdout, stderr, code] = await Promise.all([
@@ -208,6 +224,17 @@ export function firstOpenCloser(raw: string): OpenCloser | undefined {
  */
 const PR_URL = /^https?:\/\/[^\s/]+\/[^\s/]+\/[^\s/]+\/pull\/\d+\/?$/;
 
+/**
+ * How much of a pull request's diff the settlement audit will hold in memory.
+ *
+ * The daemon runs every worker in its own process, so an unbounded read of a
+ * PR that regenerated a 90 MB lockfile would be paid for out of the same
+ * resident set the live workers are using. Truncation only ever loses trailing
+ * files, which costs findings and never invents them, and the parsed diff
+ * carries `truncated` so the report never presents a short read as a clean one.
+ */
+const MAX_DIFF_BYTES = 4 * 1024 * 1024;
+
 type CheckVerdict = PrVerification["status"];
 
 function checkName(check: GhCheck): string {
@@ -528,5 +555,23 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
         return undefined;
       }
     },
+
+    async prDiff(url: string): Promise<PrDiff | undefined> {
+      if (!PR_URL.test(url)) return undefined;
+      try {
+        // `--color never` rather than relying on the default: `auto` is decided
+        // from the child's stdout, and this adapter pipes it, but a diff with
+        // ANSI escapes in it would silently stop matching every pattern the
+        // audit looks for — a failure that looks exactly like a clean PR.
+        const raw = await runGh(["pr", "diff", url, "--color", "never"]);
+        return raw.length > MAX_DIFF_BYTES
+          ? parsePrDiff(raw.slice(0, MAX_DIFF_BYTES), true)
+          : parsePrDiff(raw);
+      } catch {
+        // Advisory: an unreadable diff costs one unaudited settlement, never a
+        // run's state. Undefined is "could not tell", not "clean".
+        return undefined;
+      }
+    },
   };
 }