peaks-loop 4.0.0-beta.8 → 4.0.0-beta.9

package/dist/services/config/config-safety.js

@@ -0,0 +1,359 @@
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { homedir } from 'node:os';
+export function getUserConfigPath() {
+    return resolve(homedir(), '.peaks', 'config.json');
+}
+export function isInsidePath(childPath, parentPath) {
+    const relativePath = relative(parentPath, childPath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath));
+}
+function isSafeProjectConfigMarker(projectRoot) {
+    const peaksPath = resolve(projectRoot, '.peaks');
+    const markerPath = resolve(peaksPath, 'config.json');
+    try {
+        const projectRootReal = realpathSync(projectRoot);
+        const peaksStats = lstatSync(peaksPath);
+        const peaksReal = realpathSync(peaksPath);
+        const markerStats = lstatSync(markerPath);
+        if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink())
+            return false;
+        if (!markerStats.isFile() || markerStats.isSymbolicLink() || markerStats.nlink !== 1)
+            return false;
+        const markerReal = realpathSync(markerPath);
+        if (!isInsidePath(peaksReal, projectRootReal))
+            return false;
+        if (!isInsidePath(markerReal, projectRootReal))
+            return false;
+        return isInsidePath(markerReal, peaksReal);
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeBoundaryPath(path) {
+    const resolved = resolve(path);
+    let realPath = resolved;
+    try {
+        realPath = existsSync(resolved) ? realpathSync.native(resolved) : resolved;
+    }
+    catch {
+        realPath = resolved;
+    }
+    return process.platform === 'win32' || process.platform === 'darwin' ? realPath.toLowerCase() : realPath;
+}
+function getHomeBoundaryPaths() {
+    return new Set([homedir(), process.env.HOME, process.env.USERPROFILE].filter((path) => typeof path === 'string' && path.length > 0).map(normalizeBoundaryPath));
+}
+export function findProjectRoot(startPath) {
+    const homeBoundaryPaths = getHomeBoundaryPaths();
+    let current = resolve(startPath);
+    let parent = dirname(current);
+    let pkgRoot = null;
+    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
+        if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
+            return current;
+        }
+        // .git is the definitive project root — return immediately
+        if (existsSync(resolve(current, '.git'))) {
+            return current;
+        }
+        // package.json alone is ambiguous in monorepos — keep walking up for .git
+        if (pkgRoot === null && existsSync(resolve(current, 'package.json'))) {
+            pkgRoot = current;
+        }
+        parent = current;
+        current = dirname(parent);
+    }
+    return pkgRoot;
+}
+export function resolveProjectRootForConfig(startPath) {
+    const start = resolve(startPath);
+    const homeBoundaryPaths = getHomeBoundaryPaths();
+    let current = start;
+    let parent = dirname(current);
+    let pkgRoot = null;
+    while (current !== parent && !homeBoundaryPaths.has(normalizeBoundaryPath(current))) {
+        if (existsSync(resolve(current, '.peaks', 'config.json')) && isSafeProjectConfigMarker(current)) {
+            return current;
+        }
+        if (existsSync(resolve(current, '.git'))) {
+            return current;
+        }
+        if (pkgRoot === null && existsSync(resolve(current, 'package.json'))) {
+            pkgRoot = current;
+        }
+        parent = current;
+        current = dirname(parent);
+    }
+    return pkgRoot ?? start;
+}
+/**
+ * Canonicalise a user-supplied project root path against git's view of the
+ * repository root. This is the fix for the nested-directory regression
+ * where peaks-loop would write `.peaks/` under a nested sub-folder
+ * (e.g. `prompt-project/prompt-project/.peaks/`) because the LLM passed
+ * `$(pwd)` from inside a sub-directory of a real git repo. Without
+ * canonicalisation, peaks accepted the cwd as-is, built the .peaks/
+ * tree there, and left the team with two parallel state stores.
+ *
+ * Strategy:
+ *   1. If `startPath` (or any ancestor) is inside a git repo, return
+ *      `git rev-parse --show-toplevel` from `startPath`. The git root
+ *      is the *only* correct answer for "where does the .peaks/ tree
+ *      belong?" — sub-folders of a git repo are not their own projects.
+ *   2. If `startPath` is not inside a git repo, fall back to
+ *      `findProjectRoot` (the existing heuristic) so the CLI still
+ *      works for non-git projects.
+ *   3. If both fail, return `startPath` unchanged — better to write
+ *      to the cwd than to refuse the command.
+ *
+ * This is intentionally fail-open: it only *promotes* a path towards
+ * the git root, it never demotes one. A non-git user is unaffected.
+ * The function does NOT throw on a missing git binary or a non-zero
+ * `git rev-parse` exit; both fall through to the heuristic.
+ */
+export function resolveCanonicalProjectRoot(startPath) {
+    const start = resolve(startPath);
+    const gitRoot = resolveProjectRootFromGit(start);
+    if (gitRoot !== null) {
+        return gitRoot;
+    }
+    // Non-git fallback: walk the heuristic up to the home boundary.
+    // We do NOT call realpathSync on the heuristic result because the
+    // heuristic may legitimately return a path through a symlink that
+    // the caller passed in (no canonicalisation needed in that case).
+    const heuristicRoot = findProjectRoot(start);
+    if (heuristicRoot !== null) {
+        return heuristicRoot;
+    }
+    return start;
+}
+function resolveProjectRootFromGit(startPath) {
+    // execFileSync (not execSync) so a malicious `startPath` cannot
+    // inject argv into the spawned git invocation. The child only
+    // receives `startPath` as the cwd, never as a flag.
+    let rawRoot;
+    try {
+        const stdout = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd: startPath,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore']
+        });
+        const trimmed = stdout.trim();
+        if (trimmed.length === 0)
+            return null;
+        rawRoot = resolve(trimmed);
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        // git not on PATH, startPath is not in a repo, or some other
+        // benign failure — fall through to the heuristic.
+        return null;
+    }
+    // On macOS, /tmp is a symlink to /private/tmp; git returns the
+    // realpath. If the caller passed a path through the symlink, the
+    // two strings won't match byte-for-byte even though they refer
+    // to the same directory. realpathSync the git root and the
+    // startPath through the same lens so callers get a canonical
+    // answer that compares equal to the path they passed in.
+    try {
+        return realpathSync(rawRoot);
+    }
+    catch {
+        return rawRoot;
+    }
+}
+export function getProjectConfigPath(projectRoot) {
+    if (!projectRoot)
+        return null;
+    if (!isSafeProjectConfigMarker(projectRoot))
+        return null;
+    return resolve(projectRoot, '.peaks', 'config.json');
+}
+export function getProjectBootstrapConfigPath(projectRoot) {
+    const projectRootPath = resolve(projectRoot);
+    const peaksPath = resolve(projectRootPath, '.peaks');
+    const configPath = resolve(peaksPath, 'config.json');
+    if (!isInsidePath(configPath, projectRootPath)) {
+        throw new Error('Project config path must stay inside the project root');
+    }
+    if (!existsSync(peaksPath)) {
+        mkdirSync(peaksPath, { recursive: true });
+    }
+    validateProjectBootstrapConfigPath(projectRootPath, peaksPath, configPath);
+    return configPath;
+}
+function validateProjectBootstrapConfigPath(projectRootPath, peaksPath, configPath) {
+    const projectRootReal = realpathSync(projectRootPath);
+    const peaksStats = lstatSync(peaksPath);
+    const peaksReal = realpathSync(peaksPath);
+    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(projectRootReal, '.peaks')) {
+        throw new Error('Project config path must stay inside the project root');
+    }
+    try {
+        const markerStats = lstatSync(configPath);
+        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
+            throw new Error('Project config path must stay inside the project root');
+        }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
+        const markerReal = realpathSync(configPath);
+        if (!isInsidePath(markerReal, projectRootReal) || !isInsidePath(markerReal, peaksReal)) {
+            throw new Error('Project config path must stay inside the project root');
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+export function validateProjectBootstrapConfigPathForWrite(projectRoot, configPath) {
+    const projectRootPath = resolve(projectRoot);
+    validateProjectBootstrapConfigPath(projectRootPath, resolve(projectRootPath, '.peaks'), configPath);
+}
+export function validateUserConfigPathForWrite(configPath) {
+    const userRoot = resolve(homedir());
+    const peaksPath = resolve(userRoot, '.peaks');
+    const userRootReal = realpathSync(userRoot);
+    const peaksStats = lstatSync(peaksPath);
+    const peaksReal = realpathSync(peaksPath);
+    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(userRootReal, '.peaks')) {
+        throw new Error('User config path must stay inside the user root');
+    }
+    try {
+        const markerStats = lstatSync(configPath);
+        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
+            throw new Error('User config path must stay inside the user root');
+        }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
+        const markerReal = realpathSync(configPath);
+        if (!isInsidePath(markerReal, userRootReal) || !isInsidePath(markerReal, peaksReal)) {
+            throw new Error('User config path must stay inside the user root');
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+export function validateArtifactWorkspaceRoot(artifactRoot, _workspaceRoot) {
+    const artifactStats = lstatSync(artifactRoot);
+    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+}
+export function validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath) {
+    const artifactStats = lstatSync(artifactRoot);
+    if (!artifactStats.isDirectory() || artifactStats.isSymbolicLink()) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+    const artifactRootReal = realpathSync(artifactRoot);
+    const peaksStats = lstatSync(peaksPath);
+    const peaksReal = realpathSync(peaksPath);
+    if (!peaksStats.isDirectory() || peaksStats.isSymbolicLink() || peaksReal !== resolve(artifactRootReal, '.peaks')) {
+        throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+    }
+    try {
+        const markerStats = lstatSync(markerPath);
+        if (!markerStats.isFile() || markerStats.isSymbolicLink()) {
+            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+        }
+        if (markerStats.nlink !== 1) {
+            throw new Error('Config path must not be hardlinked');
+        }
+        const markerReal = realpathSync(markerPath);
+        if (!isInsidePath(markerReal, artifactRootReal) || !isInsidePath(markerReal, peaksReal)) {
+            throw new Error('Artifact workspace marker must stay inside the artifact workspace');
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+function validateOpenConfigFile(fd, tempPath, errorMessage) {
+    const fdStats = fstatSync(fd);
+    const pathStats = lstatSync(tempPath);
+    if (!fdStats.isFile() || !pathStats.isFile() || fdStats.dev !== pathStats.dev || fdStats.ino !== pathStats.ino) {
+        throw new Error(errorMessage);
+    }
+    if (fdStats.nlink !== 1 || pathStats.nlink !== 1) {
+        throw new Error('Config path must not be hardlinked');
+    }
+}
+function getSafeTempOpenFlags() {
+    const baseFlags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL;
+    return typeof constants.O_NOFOLLOW === 'number' ? baseFlags | constants.O_NOFOLLOW : baseFlags;
+}
+function getSafeReadOpenFlags() {
+    return typeof constants.O_NOFOLLOW === 'number' ? constants.O_RDONLY | constants.O_NOFOLLOW : constants.O_RDONLY;
+}
+export function readConfigFileSafely(configPath, errorMessage) {
+    const fd = openSync(configPath, getSafeReadOpenFlags());
+    try {
+        validateOpenConfigFile(fd, configPath, errorMessage);
+        return readFileSync(fd, 'utf-8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function writeConfigFileSafely(configPath, content, validateBeforeWrite, errorMessage) {
+    validateBeforeWrite();
+    const tempPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
+    let fd = openSync(tempPath, getSafeTempOpenFlags(), 0o600);
+    let renamed = false;
+    let closeError;
+    try {
+        validateOpenConfigFile(fd, tempPath, errorMessage);
+        fchmodSync(fd, 0o600);
+        writeFileSync(fd, content, 'utf-8');
+        const writeFd = fd;
+        fd = null;
+        closeSync(writeFd);
+        validateBeforeWrite();
+        const readFd = openSync(tempPath, getSafeReadOpenFlags());
+        try {
+            validateOpenConfigFile(readFd, tempPath, errorMessage);
+        }
+        finally {
+            closeSync(readFd);
+        }
+        renameSync(tempPath, configPath);
+        renamed = true;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch (error) {
+                closeError = error;
+            }
+        }
+        try {
+            if (!renamed && existsSync(tempPath)) {
+                unlinkSync(tempPath);
+            }
+        }
+        finally {
+            if (closeError) {
+                throw closeError;
+            }
+        }
+    }
+}
+export function writeProjectConfigFile(projectRoot, configPath, content) {
+    writeConfigFileSafely(configPath, content, () => validateProjectBootstrapConfigPathForWrite(projectRoot, configPath), 'Project config path must stay inside the project root');
+}
+export function writeUserConfigFile(configPath, content) {
+    writeConfigFileSafely(configPath, content, () => validateUserConfigPathForWrite(configPath), 'User config path must stay inside the user root');
+}

package/dist/services/config/config-service.d.ts

@@ -0,0 +1,69 @@
+import type { ConfigGetOptions, ConfigLayer, ConfigSetOptions, ConfigV2, MiniMaxProviderConfig, OcrAuthHeader, OcrConfig, OcrLlmConfig, PeaksConfig, TokenRef, WorkspaceConfig } from './config-types.js';
+export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
+/**
+ * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
+ * object when the file is at schema 2.0.0; returns null when the
+ * file is absent (fresh install, no global config yet).
+ *
+ * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
+ * schema version — the caller is expected to run
+ * `peaks config migrate --apply` to bring it forward before
+ * continuing. This gate is intentional: a slim 2.0 reader must
+ * not silently pass through a 1.x shape, because every field it
+ * ignores is a field the caller is going to look for elsewhere
+ * (preferences.json, .bak, _state/).
+ */
+export declare function loadGlobalConfig(): ConfigV2 | null;
+export declare function isConfigLayer(value: string): value is ConfigLayer;
+export declare function isSensitiveConfigPath(path: string): boolean;
+export declare function isLegacyConfigKey(path: string): boolean;
+export declare function containsSensitiveConfigValue(value: unknown): boolean;
+export type RedactedConfigValue = string | number | boolean | null | RedactedConfigValue[] | {
+    [key: string]: RedactedConfigValue;
+};
+export declare function redactConfigSecrets(value: unknown, path?: string): RedactedConfigValue;
+export type MiniMaxProviderStatus = {
+    provider: 'minimax';
+    configured: boolean;
+    baseUrlConfigured: boolean;
+    apiKeyConfigured: boolean;
+    storage: 'user-plaintext-v1';
+    nextActions: string[];
+};
+export declare function getMiniMaxProviderConfig(): MiniMaxProviderConfig;
+export declare function getMiniMaxProviderStatus(): MiniMaxProviderStatus;
+export declare function setMiniMaxProviderConfig(input: MiniMaxProviderConfig): MiniMaxProviderStatus;
+/**
+ * Read the ocr LLM endpoint config from the user-layer
+ * `~/.peaks/config.json`. The user populates this themselves by
+ * pasting the `peaks code-review config-template` output (or by
+ * running `peaks config set --key ocr.llm.url --value '...'`).
+ * peaks-loop never auto-writes these values.
+ */
+export declare function getOcrConfig(): OcrConfig;
+/**
+ * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
+ * or `null` when the user has not populated the user config. The
+ * 5-state OCR detector uses this as the source of truth; when the
+ * returned block is missing required fields it produces a
+ * `config-missing` state with a templated `nextActions` payload
+ * the user can paste into their config.
+ */
+export declare function getOcrLlmConfig(): OcrLlmConfig | null;
+export declare function bootstrapProjectLanguageConfig(projectRoot: string, language: string): void;
+export declare function readConfig(projectRoot?: string | null): PeaksConfig;
+export declare function writeConfig(partial: Partial<PeaksConfig>, layer?: ConfigLayer): void;
+export declare function getConfig(options?: ConfigGetOptions): unknown;
+export declare function setConfig(options: ConfigSetOptions): void;
+export declare function getWorkspaceConfig(workspaceId: string, _projectRoot?: string | null): WorkspaceConfig | null;
+export declare function addWorkspace(workspace: WorkspaceConfig, layer?: ConfigLayer): void;
+export declare function removeWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
+export declare function setCurrentWorkspace(workspaceId: string, layer?: ConfigLayer): boolean;
+export declare function getCurrentWorkspaceConfig(): WorkspaceConfig | null;
+export declare function getWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
+export declare function ensureWorkspaceConfigForPath(path?: string): WorkspaceConfig | null;
+export declare function getWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
+export declare function ensureWorkspaceConfigForCurrentPath(): WorkspaceConfig | null;
+export type { OcrAuthHeader, OcrConfig, OcrLlmConfig, TokenRef, WorkspaceConfig, PeaksConfig, ConfigLayer };
+export { getUserConfigPath } from './config-safety.js';
+export { globalConfigPath } from './config-migration.js';