orizu 0.5.16 → 0.5.18

package/dist/git-credential.js

@@ -22,6 +22,80 @@ import { dirname, join } from 'path';
 import { authedFetch } from './http.js';
 import { readJsonManifest } from './workspace.js';
 const GITHUB_HOST = 'github.com';
+const ARTIFACTS_HOST = /^[0-9a-f]{32}\.artifacts\.cloudflare\.net$/;
+/**
+ * ALI-1285: the Artifacts contract declares the credential OPAQUE
+ * (`plaintext: string`) with no documented body format. Pinning
+ * `art_v1_<40 hex>` would reject a contract-conformant credential that the
+ * broker and the runtime contract both accept. Only what the git Basic-auth
+ * transport requires is enforced: bounded, no whitespace, no control
+ * characters, and at least 16 characters (a security floor, not a format
+ * claim). Mirrors `workers/artifacts-runtime/contracts.ts` GIT_PASSWORD.
+ */
+const ARTIFACTS_PASSWORD = /^[^\s\u0000-\u001f\u007f]{16,1024}$/;
+const ARTIFACTS_MAX_EXPIRY_SKEW_MS = 305_000;
+const SAFE_REMOTE_COMPONENT = /^[^\u0000-\u0020\u007f\\?#]+$/;
+export const REPO_TOKEN_PURPOSES = [
+    'read',
+    'write',
+];
+function isRepoTokenPurpose(value) {
+    return REPO_TOKEN_PURPOSES.includes(value);
+}
+/**
+ * Git appends get/store/erase after the configured helper command, so an
+ * explicit path-aware configuration looks like:
+ * `!orizu git-credential --purpose=write`.
+ *
+ * Session credentials use the hosted runtime helper, which carries the
+ * server-bound session ID. This local helper deliberately accepts only
+ * sessionless developer read/write purposes.
+ */
+export function parseGitCredentialInvocation(args) {
+    let operation = null;
+    let purpose = null;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--purpose') {
+            if (purpose !== null)
+                return null;
+            const value = args[index + 1];
+            if (!value || !isRepoTokenPurpose(value))
+                return null;
+            purpose = value;
+            index += 1;
+            continue;
+        }
+        if (arg.startsWith('--purpose=')) {
+            if (purpose !== null)
+                return null;
+            const value = arg.slice('--purpose='.length);
+            if (!isRepoTokenPurpose(value))
+                return null;
+            purpose = value;
+            continue;
+        }
+        if (arg === 'get' || arg === 'store' || arg === 'erase') {
+            if (operation !== null)
+                return null;
+            operation = arg;
+            continue;
+        }
+        return null;
+    }
+    return operation === null ? null : { operation, purpose };
+}
+export async function runGitCredentialInvocation(args, io) {
+    const invocation = parseGitCredentialInvocation(args);
+    if (!invocation) {
+        io.printErr('Invalid git-credential invocation');
+        return 1;
+    }
+    return runGitCredential(invocation.operation, {
+        ...io,
+        purpose: invocation.purpose ?? undefined,
+    });
+}
 export function parseCredentialInput(stdin) {
     const map = {};
     for (const rawLine of stdin.split('\n')) {
@@ -80,17 +154,47 @@ export function resolveWorkspaceId(io) {
         return fromEnv;
     return resolveAttachedWorkspaceId(io.cwd);
 }
-async function mintToken(fetcher, workspaceId, purpose) {
+async function mintToken(fetcher, workspaceId, purpose, expectedRepoFullName) {
     const response = await fetcher(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ purpose }),
     });
     if (response.ok) {
-        const data = (await response.json());
-        if (data.token)
-            return { ok: true, token: data.token };
-        return { ok: false, status: response.status, error: 'Broker returned no token' };
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch {
+            return {
+                ok: false,
+                status: response.status,
+                error: 'Broker returned invalid JSON',
+            };
+        }
+        if (typeof data !== 'object' || data === null) {
+            return {
+                ok: false,
+                status: response.status,
+                error: 'Broker returned an invalid GitHub credential',
+            };
+        }
+        const credential = data;
+        if (!(credential.provider === undefined ||
+            credential.provider === 'github') ||
+            credential.remote !== undefined ||
+            credential.repo !== expectedRepoFullName ||
+            typeof credential.token !== 'string' ||
+            credential.token.length === 0 ||
+            credential.token.length > 512 ||
+            /[\u0000-\u0020\u007f]/u.test(credential.token)) {
+            return {
+                ok: false,
+                status: response.status,
+                error: 'Broker returned a credential for a different repository provider or path',
+            };
+        }
+        return { ok: true, token: credential.token };
     }
     let error = `status ${response.status}`;
     try {
@@ -103,24 +207,226 @@ async function mintToken(fetcher, workspaceId, purpose) {
     }
     return { ok: false, status: response.status, error };
 }
+function isArtifactsHost(host) {
+    if (!host)
+        return false;
+    const normalized = host.toLowerCase();
+    return ARTIFACTS_HOST.test(normalized);
+}
+function exactGithubRepoFullName(input) {
+    const protocol = input.protocol?.toLowerCase();
+    const host = input.host?.toLowerCase();
+    const rawPath = input.path;
+    if (protocol !== 'https' ||
+        host !== GITHUB_HOST ||
+        !rawPath ||
+        !SAFE_REMOTE_COMPONENT.test(rawPath)) {
+        return null;
+    }
+    const path = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
+    try {
+        const url = new URL(`https://${GITHUB_HOST}${path}`);
+        if (url.origin !== `https://${GITHUB_HOST}` ||
+            url.username ||
+            url.password ||
+            url.port ||
+            url.search ||
+            url.hash ||
+            url.pathname !== path) {
+            return null;
+        }
+        const segments = url.pathname
+            .slice(1)
+            .split('/')
+            .filter(Boolean);
+        if (segments.length !== 2)
+            return null;
+        const [owner, rawRepository] = segments;
+        const repository = rawRepository.endsWith('.git')
+            ? rawRepository.slice(0, -4)
+            : rawRepository;
+        if (!/^[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,99})$/.test(owner) ||
+            !/^[A-Za-z0-9_.-]{1,100}$/.test(repository)) {
+            return null;
+        }
+        return `${owner}/${repository}`;
+    }
+    catch {
+        return null;
+    }
+}
+function exactArtifactsCredentialKey(input) {
+    const protocol = input.protocol?.toLowerCase();
+    const host = input.host?.toLowerCase();
+    const rawPath = input.path;
+    if (protocol !== 'https' ||
+        !host ||
+        !isArtifactsHost(host) ||
+        !rawPath ||
+        !SAFE_REMOTE_COMPONENT.test(host) ||
+        !SAFE_REMOTE_COMPONENT.test(rawPath)) {
+        return null;
+    }
+    const path = rawPath.startsWith('/') ? rawPath : `/${rawPath}`;
+    try {
+        const url = new URL(`https://${host}${path}`);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.port ||
+            url.search ||
+            url.hash ||
+            url.hostname !== host ||
+            !ARTIFACTS_HOST.test(url.hostname) ||
+            !url.pathname.startsWith('/git/') ||
+            !url.pathname.endsWith('.git') ||
+            `${url.origin}${url.pathname}` !==
+                `https://${host}${path}`) {
+            return null;
+        }
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+async function mintArtifactsCredential(fetcher, workspaceId, purpose, expectedCredentialKey, nowMs) {
+    const response = await fetcher(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ purpose }),
+    });
+    if (!response.ok) {
+        return {
+            ok: false,
+            error: `repository credential service returned status ${response.status}`,
+        };
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        return {
+            ok: false,
+            error: 'repository credential service returned invalid JSON',
+        };
+    }
+    if (typeof data !== 'object' || data === null) {
+        return {
+            ok: false,
+            error: 'repository credential service returned an invalid credential',
+        };
+    }
+    const credential = data;
+    const remote = typeof credential.remote === 'string'
+        ? credential.remote
+        : null;
+    let resolvedCredentialKey = null;
+    if (remote !== null) {
+        try {
+            const url = new URL(remote);
+            if (url.protocol === 'https:' &&
+                !url.username &&
+                !url.password &&
+                !url.port &&
+                !url.search &&
+                !url.hash &&
+                ARTIFACTS_HOST.test(url.hostname) &&
+                url.pathname.startsWith('/git/') &&
+                url.pathname.endsWith('.git') &&
+                url.toString() === remote) {
+                resolvedCredentialKey = `${url.origin}${url.pathname}`;
+            }
+        }
+        catch {
+            resolvedCredentialKey = null;
+        }
+    }
+    if (resolvedCredentialKey !== expectedCredentialKey) {
+        return {
+            ok: false,
+            error: 'server-resolved repository does not match Git exact path',
+        };
+    }
+    if (credential.provider !== 'cloudflare_artifacts' ||
+        credential.username !== 'x' ||
+        typeof credential.token !== 'string' ||
+        !ARTIFACTS_PASSWORD.test(credential.token)) {
+        return {
+            ok: false,
+            error: 'repository credential service returned an invalid credential',
+        };
+    }
+    const expiresAt = typeof credential.expiresAt === 'string'
+        ? credential.expiresAt
+        : '';
+    const expiresAtMs = Date.parse(expiresAt);
+    if (!Number.isSafeInteger(nowMs) ||
+        !Number.isFinite(expiresAtMs) ||
+        new Date(expiresAtMs).toISOString() !== expiresAt ||
+        expiresAtMs <= nowMs ||
+        expiresAtMs > nowMs + ARTIFACTS_MAX_EXPIRY_SKEW_MS) {
+        return {
+            ok: false,
+            error: 'repository credential service returned an invalid credential expiry',
+        };
+    }
+    return {
+        ok: true,
+        username: 'x',
+        password: credential.token,
+    };
+}
 export async function runGitCredential(op, io) {
     // store/erase are no-ops: we never persist a credential to disk.
     if (op !== 'get')
         return 0;
     const input = parseCredentialInput(io.stdin);
-    // Only broker for github.com; anything else is git's own business.
-    if (input.host && input.host !== GITHUB_HOST)
+    const inputHost = input.host?.toLowerCase();
+    // Only broker for the legacy GitHub host or the exact Artifacts service.
+    // Anything else is git's own business.
+    if (inputHost &&
+        inputHost !== GITHUB_HOST &&
+        !isArtifactsHost(inputHost)) {
         return 0;
+    }
     const workspaceId = resolveWorkspaceId(io);
     if (!workspaceId) {
         // Unattached directory: stay silent so git falls through cleanly.
         return 0;
     }
     const fetcher = io.fetcher ?? authedFetch;
+    if (isArtifactsHost(inputHost)) {
+        if (!io.purpose) {
+            io.printErr('orizu git-credential: an Artifacts remote requires an explicit repository purpose');
+            return 1;
+        }
+        const credentialKey = exactArtifactsCredentialKey(input);
+        if (credentialKey === null) {
+            io.printErr('orizu git-credential: refusing Artifacts credential selection without an exact repository path');
+            return 1;
+        }
+        const minted = await mintArtifactsCredential(fetcher, workspaceId, io.purpose, credentialKey, (io.nowMs ?? Date.now)());
+        if (!minted.ok) {
+            io.printErr(`orizu git-credential: could not broker an Artifacts credential (${minted.error})`);
+            return 1;
+        }
+        io.print(`username=${minted.username}`);
+        io.print(`password=${minted.password}`);
+        io.print('');
+        return 0;
+    }
     // Mint write first (curators/pushers), fall back to read on 403 (members).
-    let minted = await mintToken(fetcher, workspaceId, 'write');
-    if (!minted.ok && minted.status === 403) {
-        minted = await mintToken(fetcher, workspaceId, 'read');
+    const expectedRepoFullName = exactGithubRepoFullName(input);
+    if (!expectedRepoFullName) {
+        io.printErr('orizu git-credential: refusing GitHub credential selection without an exact repository path');
+        return 1;
+    }
+    const primaryPurpose = io.purpose ?? 'write';
+    let minted = await mintToken(fetcher, workspaceId, primaryPurpose, expectedRepoFullName);
+    if (!io.purpose && !minted.ok && minted.status === 403) {
+        minted = await mintToken(fetcher, workspaceId, 'read', expectedRepoFullName);
     }
     if (!minted.ok) {
         io.printErr(`orizu git-credential: could not broker a token for this workspace (${minted.error}). ` +

package/dist/git-recovery-environment.js

@@ -0,0 +1,156 @@
+import { isAbsolute } from 'node:path';
+function assertAbsoluteDirectoryPath(value, label) {
+    if (!isAbsolute(value) ||
+        value.includes('\u0000') ||
+        /[\r\n]/.test(value)) {
+        throw new Error(`${label} must be an absolute path without control characters`);
+    }
+}
+function normalizeProtocols(protocols) {
+    const requested = protocols ?? ['https'];
+    for (const protocol of requested) {
+        if (protocol !== 'https' && protocol !== 'file') {
+            throw new Error(`unsupported Git recovery protocol: ${String(protocol)}`);
+        }
+    }
+    const requestedSet = new Set(requested);
+    const normalized = ['https', 'file'].filter(protocol => requestedSet.has(protocol));
+    if (normalized.length === 0 || !normalized.includes('https')) {
+        throw new Error('the hardened Git environment must allow HTTPS transport');
+    }
+    return normalized;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function credentialHelperConfigValue(helper) {
+    if (helper === undefined)
+        return '';
+    if (!isAbsolute(helper.executablePath)) {
+        throw new Error('recovery credential helper requires an absolute executable path');
+    }
+    const values = [helper.executablePath, ...(helper.arguments ?? [])];
+    for (const value of values) {
+        if (value.length === 0 ||
+            Buffer.byteLength(value, 'utf8') > 4_096 ||
+            /[\u0000-\u001f\u007f]/.test(value)) {
+            throw new Error('recovery credential helper path and arguments must be non-empty, bounded, and control-free');
+        }
+    }
+    return `!exec ${values.map(shellQuote).join(' ')}`;
+}
+function gitConfig(hooksDir, allowedProtocols, credentialHelper) {
+    const fileAllowed = allowedProtocols.includes('file') ? 'always' : 'never';
+    return [
+        { key: 'credential.helper', value: credentialHelperConfigValue(credentialHelper) },
+        { key: 'credential.useHttpPath', value: 'true' },
+        { key: 'core.hooksPath', value: hooksDir },
+        { key: 'core.attributesFile', value: '/dev/null' },
+        { key: 'core.fsmonitor', value: 'false' },
+        { key: 'core.sshCommand', value: '/usr/bin/false' },
+        { key: 'protocol.allow', value: 'never' },
+        { key: 'protocol.version', value: '2' },
+        { key: 'protocol.https.allow', value: 'always' },
+        { key: 'protocol.http.allow', value: 'never' },
+        { key: 'protocol.file.allow', value: fileAllowed },
+        { key: 'protocol.ext.allow', value: 'never' },
+        { key: 'http.followRedirects', value: 'false' },
+        { key: 'http.sslVerify', value: 'true' },
+        { key: 'http.saveCookies', value: 'false' },
+        { key: 'fetch.fsckObjects', value: 'true' },
+        { key: 'transfer.fsckObjects', value: 'true' },
+        { key: 'receive.fsckObjects', value: 'true' },
+        // Bound Git's own parallelism and delta caches inside the independently
+        // enforced job memory/PID boundary. These only trade throughput and pack
+        // compression efficiency; all object-integrity checks remain enabled.
+        { key: 'pack.threads', value: '1' },
+        { key: 'index.threads', value: '1' },
+        { key: 'pack.windowMemory', value: '67108864' },
+        { key: 'pack.deltaCacheSize', value: '67108864' },
+        { key: 'core.deltaBaseCacheLimit', value: '67108864' },
+        { key: 'fetch.recurseSubmodules', value: 'false' },
+        { key: 'submodule.recurse', value: 'false' },
+        { key: 'filter.lfs.process', value: '' },
+        { key: 'filter.lfs.smudge', value: '' },
+        { key: 'filter.lfs.clean', value: '' },
+        { key: 'filter.lfs.required', value: 'false' },
+        { key: 'maintenance.auto', value: 'false' },
+        { key: 'gc.auto', value: '0' },
+    ];
+}
+/**
+ * Construct, rather than scrub, the environment. Only PATH crosses the
+ * boundary from the parent process. Provider tokens, cloud credentials,
+ * ambient Git repository variables, HOME config, SSH agents, and askpass
+ * helpers therefore cannot accidentally enter the recovery subprocess.
+ */
+export function buildHardenedGitEnvironment(input) {
+    assertAbsoluteDirectoryPath(input.homeDir, 'Git recovery HOME');
+    assertAbsoluteDirectoryPath(input.hooksDir, 'Git recovery hooks directory');
+    if (input.tempDir !== undefined) {
+        assertAbsoluteDirectoryPath(input.tempDir, 'Git recovery temp directory');
+    }
+    const allowedProtocols = normalizeProtocols(input.allowedProtocols);
+    const sourceEnv = input.sourceEnv ?? process.env;
+    const path = sourceEnv.PATH;
+    if (!path || /[\u0000\r\n]/.test(path)) {
+        throw new Error('Git recovery requires a safe PATH');
+    }
+    const config = gitConfig(input.hooksDir, allowedProtocols, input.credentialHelper);
+    const env = {
+        // Never inherit runtime mode across the recovery boundary. Git ignores
+        // NODE_ENV, while an explicitly installed credential helper may not.
+        NODE_ENV: 'production',
+        PATH: path,
+        HOME: input.homeDir,
+        XDG_CONFIG_HOME: input.homeDir,
+        LANG: 'C',
+        LC_ALL: 'C',
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_SYSTEM: '/dev/null',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_ASKPASS: '/usr/bin/false',
+        SSH_ASKPASS: '/usr/bin/false',
+        GCM_INTERACTIVE: 'Never',
+        GIT_PROTOCOL_FROM_USER: '0',
+        GIT_NO_REPLACE_OBJECTS: '1',
+        GIT_LFS_SKIP_SMUDGE: '1',
+        GIT_OPTIONAL_LOCKS: '0',
+        GIT_ALLOW_PROTOCOL: allowedProtocols.join(':'),
+        GIT_CONFIG_COUNT: String(config.length),
+        ...(input.tempDir === undefined ? {} : { TMPDIR: input.tempDir }),
+    };
+    config.forEach(({ key, value }, index) => {
+        env[`GIT_CONFIG_KEY_${index}`] = key;
+        env[`GIT_CONFIG_VALUE_${index}`] = value;
+    });
+    return env;
+}
+/**
+ * Test/diagnostic helper for the non-secret `GIT_CONFIG_COUNT` contract.
+ * Rejecting holes also prevents a caller from constructing an ambiguous config.
+ */
+export function parseConfiguredGitEnvironment(env) {
+    const countText = env.GIT_CONFIG_COUNT;
+    if (!countText || !/^(0|[1-9][0-9]*)$/.test(countText)) {
+        throw new Error('invalid GIT_CONFIG_COUNT');
+    }
+    const count = Number(countText);
+    if (!Number.isSafeInteger(count) || count > 128) {
+        throw new Error('GIT_CONFIG_COUNT exceeds the recovery configuration budget');
+    }
+    const parsed = new Map();
+    for (let index = 0; index < count; index += 1) {
+        const key = env[`GIT_CONFIG_KEY_${index}`];
+        const value = env[`GIT_CONFIG_VALUE_${index}`];
+        if (key === undefined || value === undefined) {
+            throw new Error(`incomplete hardened Git config at index ${index}`);
+        }
+        if (parsed.has(key)) {
+            throw new Error(`duplicate hardened Git config key: ${key}`);
+        }
+        parsed.set(key, value);
+    }
+    return parsed;
+}

package/dist/github-setup.js

@@ -17,16 +17,8 @@ import { spawnSync } from 'child_process';
 import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 import { assertWorkspaceDirUsable, workspaceExists } from './workspace.js';
-/**
- * Strip terminal control characters from server-supplied strings before they
- * are printed (mirrors index.ts `sanitizeTerminalText`), so a hostile or
- * mangled provisioning `warnings[]`/`defaultBranch` value can't inject escape
- * sequences into the user's terminal.
- */
-function sanitizeServerText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 const DEFAULT_POLL_INTERVAL_MS = 2000;
 // ALI-1141: long enough for a slow org-picker + repo-selection walk, but the
 // wait MUST be finite — when the App is already installed in the target org,
@@ -231,10 +223,10 @@ export async function runHostedAttach(options, io) {
         repoFullName = data.repo;
         provisioned = true;
         if (data.rulesetApplied === true) {
-            io.print(`   Default-branch protection applied (ruleset "orizu-default-branch-protection"${data.defaultBranch ? ` on ${sanitizeServerText(data.defaultBranch)}` : ''}).`);
+            io.print(`   Default-branch protection applied (ruleset "orizu-default-branch-protection"${data.defaultBranch ? ` on ${sanitizeTerminalText(data.defaultBranch)}` : ''}).`);
         }
         for (const warning of data.warnings ?? []) {
-            io.print(`   ⚠ ${sanitizeServerText(warning)}`);
+            io.print(`   ⚠ ${sanitizeTerminalText(warning)}`);
         }
     }
     const cleanUrl = `https://github.com/${repoFullName}.git`;