peaks-loop 4.0.0-beta.6 → 4.0.0-beta.8

package/dist/src/services/config/config-safety.js

@@ -1,359 +0,0 @@
-import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
-import { homedir } from 'node:os';
-export function getUserConfigPath() {
-    return resolve(homedir(), '.peaks', 'config.json');
-}
-export function isInsidePath(childPath, parentPath) {
-    const relativePath = relative(parentPath, childPath);
-    return relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath));
-}
-function isSafeProjectConfigMarker(projectRoot) {
-    const peaksPath = resolve(projectRoot, '.peaks');
-    const markerPath = resolve(peaksPath, 'config.json');
-    try {
-        const projectRootReal = realpathSync(projectRoot);
-        const peaksStats = lstatSync(peaksPath);
-        const peaksReal = realpathSync(peaksPath);
-        const markerStats = lstatSync(markerPath);
-        if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink())
-            return false;
-        if (!markerStats.isFile() || markerStats.isSymbolicLink() || markerStats.nlink !== 1)
-            return false;
-        const markerReal = realpathSync(markerPath);
-        if (!isInsidePath(peaksReal, projectRootReal))
-            return false;
-        if (!isInsidePath(markerReal, projectRootReal))
-            return false;
-        return isInsidePath(markerReal, peaksReal);
-    }
-    catch {
-        return false;
-    }
-}
-function normalizeBoundaryPath(path) {
-    const resolved = resolve(path);
-    let realPath = resolved;
-    try {
-        realPath = existsSync(resolved) ? realpathSync.native(resolved) : resolved;
-    }
-    catch {
-        realPath = resolved;
-    }
-    return process.platform === 'win32' || process.platform === 'darwin' ? realPath.toLowerCase() : realPath;
-}
-function getHomeBoundaryPaths() {
-    return new Set([homedir(), process.env.HOME, process.env.USERPROFILE].filter((path) => typeof path === 'string' && path.length > 0).map(normalizeBoundaryPath));
-}
-export function findProjectRoot(startPath) {
-    const homeBoundaryPaths = getHomeBoundaryPaths();
-    let current = resolve(startPath);
-    let parent = dirname(current);
-    let pkgRoot = null;
-    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
-        if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
-            return current;
-        }
-        // .git is the definitive project root — return immediately
-        if (existsSync(resolve(current, '.git'))) {
-            return current;
-        }
-        // package.json alone is ambiguous in monorepos — keep walking up for .git
-        if (pkgRoot === null && existsSync(resolve(current, 'package.json'))) {
-            pkgRoot = current;
-        }
-        parent = current;
-        current = dirname(parent);
-    }
-    return pkgRoot;
-}
-export function resolveProjectRootForConfig(startPath) {
-    const start = resolve(startPath);
-    const homeBoundaryPaths = getHomeBoundaryPaths();
-    let current = start;
-    let parent = dirname(current);
-    let pkgRoot = null;
-    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
-        if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
-            return current;
-        }
-        if (existsSync(resolve(current, '.git'))) {
-            return current;
-        }
-        if (pkgRoot === null && existsSync(resolve(current, 'package.json'))) {
-            pkgRoot = current;
-        }
-        parent = current;
-        current = dirname(parent);
-    }
-    return pkgRoot ?? start;
-}
-/**
- * Canonicalise a user-supplied project root path against git's view of the
- * repository root. This is the fix for the nested-directory regression
- * where peaks-loop would write `.peaks/` under a nested sub-folder
- * (e.g. `prompt-project/prompt-project/.peaks/`) because the LLM passed
- * `$(pwd)` from inside a sub-directory of a real git repo. Without
- * canonicalisation, peaks accepted the cwd as-is, built the .peaks/
- * tree there, and left the team with two parallel state stores.
- *
- * Strategy:
- *   1. If `startPath` (or any ancestor) is inside a git repo, return
- *      `git rev-parse --show-toplevel` from `startPath`. The git root
- *      is the *only* correct answer for "where does the .peaks/ tree
- *      belong?" — sub-folders of a git repo are not their own projects.
- *   2. If `startPath` is not inside a git repo, fall back to
- *      `findProjectRoot` (the existing heuristic) so the CLI still
- *      works for non-git projects.
- *   3. If both fail, return `startPath` unchanged — better to write
- *      to the cwd than to refuse the command.
- *
- * This is intentionally fail-open: it only *promotes* a path towards
- * the git root, it never demotes one. A non-git user is unaffected.
- * The function does NOT throw on a missing git binary or a non-zero
- * `git rev-parse` exit; both fall through to the heuristic.
- */
-export function resolveCanonicalProjectRoot(startPath) {
-    const start = resolve(startPath);
-    const gitRoot = resolveProjectRootFromGit(start);
-    if (gitRoot !== null) {
-        return gitRoot;
-    }
-    // Non-git fallback: walk the heuristic up to the home boundary.
-    // We do NOT call realpathSync on the heuristic result because the
-    // heuristic may legitimately return a path through a symlink that
-    // the caller passed in (no canonicalisation needed in that case).
-    const heuristicRoot = findProjectRoot(start);
-    if (heuristicRoot !== null) {
-        return heuristicRoot;
-    }
-    return start;
-}
-function resolveProjectRootFromGit(startPath) {
-    // execFileSync (not execSync) so a malicious `startPath` cannot
-    // inject argv into the spawned git invocation. The child only
-    // receives `startPath` as the cwd, never as a flag.
-    let rawRoot;
-    try {
-        const stdout = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-            cwd: startPath,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore']
-        });
-        const trimmed = stdout.trim();
-        if (trimmed.length === 0)
-            return null;
-        rawRoot = resolve(trimmed);
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        // git not on PATH, startPath is not in a repo, or some other
-        // benign failure — fall through to the heuristic.
-        return null;
-    }
-    // On macOS, /tmp is a symlink to /private/tmp; git returns the
-    // realpath. If the caller passed a path through the symlink, the
-    // two strings won't match byte-for-byte even though they refer
-    // to the same directory. realpathSync the git root and the
-    // startPath through the same lens so callers get a canonical
-    // answer that compares equal to the path they passed in.
-    try {
-        return realpathSync(rawRoot);
-    }
-    catch {
-        return rawRoot;
-    }
-}
-export function getProjectConfigPath(projectRoot) {
-    if (!projectRoot)
-        return null;
-    if (!isSafeProjectConfigMarker(projectRoot))
-        return null;
-    return resolve(projectRoot, '.peaks', 'config.json');
-}
-export function getProjectBootstrapConfigPath(projectRoot) {
-    const projectRootPath = resolve(projectRoot);
-    const peaksPath = resolve(projectRootPath, '.peaks');
-    const configPath = resolve(peaksPath, 'config.json');
-    if (!isInsidePath(configPath, projectRootPath)) {
-        throw new Error('Project config path must stay inside the project root');
-    }
-    if (!existsSync(peaksPath)) {
-        mkdirSync(peaksPath, { recursive: true });
-    }
-    validateProjectBootstrapConfigPath(projectRootPath, peaksPath, configPath);
-    return configPath;
-}
-function validateProjectBootstrapConfigPath(projectRootPath, peaksPath, configPath) {
-    const projectRootReal = realpathSync(projectRootPath);
-    const peaksStats = lstatSync(peaksPath);
-    const peaksReal = realpathSync(peaksPath);
-    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(projectRootReal, '.peaks')) {
-        throw new Error('Project config path must stay inside the project root');
-    }
-    try {
-        const markerStats = lstatSync(configPath);
-        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
-            throw new Error('Project config path must stay inside the project root');
-        }
-        if (markerStats.nlink !== 1) {
-            throw new Error('Config path must not be hardlinked');
-        }
-        const markerReal = realpathSync(configPath);
-        if (!isInsidePath(markerReal, projectRootReal) || !isInsidePath(markerReal, peaksReal)) {
-            throw new Error('Project config path must stay inside the project root');
-        }
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT') {
-            throw error;
-        }
-    }
-}
-export function validateProjectBootstrapConfigPathForWrite(projectRoot, configPath) {
-    const projectRootPath = resolve(projectRoot);
-    validateProjectBootstrapConfigPath(projectRootPath, resolve(projectRootPath, '.peaks'), configPath);
-}
-export function validateUserConfigPathForWrite(configPath) {
-    const userRoot = resolve(homedir());
-    const peaksPath = resolve(userRoot, '.peaks');
-    const userRootReal = realpathSync(userRoot);
-    const peaksStats = lstatSync(peaksPath);
-    const peaksReal = realpathSync(peaksPath);
-    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(userRootReal, '.peaks')) {
-        throw new Error('User config path must stay inside the user root');
-    }
-    try {
-        const markerStats = lstatSync(configPath);
-        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
-            throw new Error('User config path must stay inside the user root');
-        }
-        if (markerStats.nlink !== 1) {
-            throw new Error('Config path must not be hardlinked');
-        }
-        const markerReal = realpathSync(configPath);
-        if (!isInsidePath(markerReal, userRootReal) || !isInsidePath(markerReal, peaksReal)) {
-            throw new Error('User config path must stay inside the user root');
-        }
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT') {
-            throw error;
-        }
-    }
-}
-export function validateArtifactWorkspaceRoot(artifactRoot, _workspaceRoot) {
-    const artifactStats = lstatSync(artifactRoot);
-    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
-        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
-    }
-}
-export function validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath) {
-    const artifactStats = lstatSync(artifactRoot);
-    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
-        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
-    }
-    const artifactRootReal = realpathSync(artifactRoot);
-    const peaksStats = lstatSync(peaksPath);
-    const peaksReal = realpathSync(peaksPath);
-    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(artifactRootReal, '.peaks')) {
-        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
-    }
-    try {
-        const markerStats = lstatSync(markerPath);
-        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
-            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
-        }
-        if (markerStats.nlink !== 1) {
-            throw new Error('Config path must not be hardlinked');
-        }
-        const markerReal = realpathSync(markerPath);
-        if (!isInsidePath(markerReal, artifactRootReal) || !isInsidePath(markerReal, peaksReal)) {
-            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
-        }
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT') {
-            throw error;
-        }
-    }
-}
-function validateOpenConfigFile(fd, tempPath, errorMessage) {
-    const fdStats = fstatSync(fd);
-    const pathStats = lstatSync(tempPath);
-    if (!fdStats.isFile() || !pathStats.isFile() || fdStats.dev !== pathStats.dev || fdStats.ino !== pathStats.ino) {
-        throw new Error(errorMessage);
-    }
-    if (fdStats.nlink !== 1 || pathStats.nlink !== 1) {
-        throw new Error('Config path must not be hardlinked');
-    }
-}
-function getSafeTempOpenFlags() {
-    const baseFlags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL;
-    return typeof constants.O_NOFOLLOW === 'number' ? baseFlags | constants.O_NOFOLLOW : baseFlags;
-}
-function getSafeReadOpenFlags() {
-    return typeof constants.O_NOFOLLOW === 'number' ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
-}
-export function readConfigFileSafely(configPath, errorMessage) {
-    const fd = openSync(configPath, getSafeReadOpenFlags());
-    try {
-        validateOpenConfigFile(fd, configPath, errorMessage);
-        return readFileSync(fd, 'utf-8');
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export function writeConfigFileSafely(configPath, content, validateBeforeWrite, errorMessage) {
-    validateBeforeWrite();
-    const tempPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
-    let fd = openSync(tempPath, getSafeTempOpenFlags(), 0o600);
-    let renamed = false;
-    let closeError;
-    try {
-        validateOpenConfigFile(fd, tempPath, errorMessage);
-        fchmodSync(fd, 0o600);
-        writeFileSync(fd, content, 'utf-8');
-        const writeFd = fd;
-        fd = null;
-        closeSync(writeFd);
-        validateBeforeWrite();
-        const readFd = openSync(tempPath, getSafeReadOpenFlags());
-        try {
-            validateOpenConfigFile(readFd, tempPath, errorMessage);
-        }
-        finally {
-            closeSync(readFd);
-        }
-        renameSync(tempPath, configPath);
-        renamed = true;
-    }
-    finally {
-        if (fd !== null) {
-            try {
-                closeSync(fd);
-            }
-            catch (error) {
-                closeError = error;
-            }
-        }
-        try {
-            if (!renamed && existsSync(tempPath)) {
-                unlinkSync(tempPath);
-            }
-        }
-        finally {
-            if (closeError) {
-                throw closeError;
-            }
-        }
-    }
-}
-export function writeProjectConfigFile(projectRoot, configPath, content) {
-    writeConfigFileSafely(configPath, content, () => validateProjectBootstrapConfigPathForWrite(projectRoot, configPath), 'Project config path must stay inside the project root');
-}
-export function writeUserConfigFile(configPath, content) {
-    writeConfigFileSafely(configPath, content, () => validateUserConfigPathForWrite(configPath), 'User config path must stay inside the user root');
-}

package/dist/src/services/config/config-service.d.ts

@@ -1,69 +0,0 @@
-import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, ConfigV2, MiniMaxProviderConfig, OcrAuthHeader, OcrConfig, OcrLlmConfig, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
-export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
-/**
- * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
- * object when the file is at schema 2.0.0; returns null when the
- * file is absent (fresh install, no global config yet).
- *
- * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
- * schema version — the caller is expected to run
- * `peaks config migrate --apply` to bring it forward before
- * continuing. This gate is intentional: a slim 2.0 reader must
- * not silently pass through a 1.x shape, because every field it
- * ignores is a field the caller is going to look for elsewhere
- * (preferences.json, .bak, _state/).
- */
-export declare function loadGlobalConfig(): ConfigV2 | null;
-export declare function isConfigLayer(value: string): value is ConfigLayer;
-export declare function isSensitiveConfigPath(path: string): boolean;
-export declare function isLegacyConfigKey(path: string): boolean;
-export declare function containsSensitiveConfigValue(value: unknown): boolean;
-export type RedactedConfigValue = string | number | boolean | null | RedactedConfigValue[] | {
-    [key: string]: RedactedConfigValue;
-};
-export declare function redactConfigSecrets(value: unknown, path?: string): RedactedConfigValue;
-export type MiniMaxProviderStatus = {
-    provider: 'minimax';
-    configured: boolean;
-    baseUrlConfigured: boolean;
-    apiKeyConfigured: boolean;
-    storage: 'user-plaintext-v1';
-    nextActions: string[];
-};
-export declare function getMiniMaxProviderConfig(): MiniMaxProviderConfig;
-export declare function getMiniMaxProviderStatus(): MiniMaxProviderStatus;
-export declare function setMiniMaxProviderConfig(input: MiniMaxProviderConfig): MiniMaxProviderStatus;
-/**
- * Read the ocr LLM endpoint config from the user-layer
- * `~/.peaks/config.json`. The user populates this themselves by
- * pasting the `peaks code-review config-template` output (or by
- * running `peaks config set --key ocr.llm.url --value '...'`).
- * peaks-loop never auto-writes these values.
- */
-export declare function getOcrConfig(): OcrConfig;
-/**
- * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
- * or `null` when the user has not populated the user config. The
- * 5-state OCR detector uses this as the source of truth; when the
- * returned block is missing required fields it produces a
- * `config-missing` state with a templated `nextActions` payload
- * the user can paste into their config.
- */
-export declare function getOcrLlmConfig(): OcrLlmConfig | null;
-export declare function bootstrapProjectLanguageConfig(projectRoot: string, language: string): void;
-export declare function readConfig(projectRoot?: string | null): PeaksConfig;
-export declare function writeConfig(partial: Partial<PeaksConfig>, layer?: ConfigLayer): void;
-export declare function getConfig(options?: ConfigGetOptions): unknown;
-export declare function setConfig(options: ConfigSetOptions): void;
-export declare function getWorkspaceConfig(workspaceId: string, _projectRoot?: string | null): WorkspaceConfig | null;
-export declare function addWorkspace(workspace: WorkspaceConfig, layer?: ConfigLayer): void;
-export declare function removeWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
-export declare function setCurrentWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
-export declare function getCurrentWorkspaceConfig(): WorkspaceConfig | null;
-export declare function getWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
-export declare function ensureWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
-export declare function getWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
-export declare function ensureWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
-export type { OcrAuthHeader, OcrConfig, OcrLlmConfig, TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
-export { getUserConfigPath } from './config-safety.js';
-export { globalConfigPath } from './config-migration.js';