pi-ultracode 0.3.2 → 0.5.0

package/src/workflow/repository-context.ts

@@ -0,0 +1,76 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { hermeticGitEnvironment, stripOneLineEnding } from "./hermetic-git.ts";
+
+const MAX_GIT_PATH_BYTES = 1024 * 1024;
+
+export interface RepositoryContext {
+  identity: string;
+  cwd: string;
+  repoRoot?: string;
+  relativeCwd?: string;
+  gitDir?: string;
+  gitCommonDir?: string;
+}
+
+/** Resolve the immutable working-tree target used by resume and delivery. */
+export function resolveRepositoryContext(cwd: string): RepositoryContext {
+  const realCwd = fs.realpathSync(cwd);
+  if (gitLine(realCwd, ["rev-parse", "--is-inside-work-tree"], true) !== "true") {
+    const identity = JSON.stringify({
+      kind: "directory",
+      cwd: realCwd,
+      cwdFile: fileIdentity(realCwd),
+    });
+    return { identity, cwd: realCwd };
+  }
+
+  const repoRoot = fs.realpathSync(gitLine(realCwd, ["rev-parse", "--show-toplevel"]));
+  const gitDir = fs.realpathSync(gitLine(realCwd, ["rev-parse", "--path-format=absolute", "--git-dir"]));
+  const gitCommonDir = fs.realpathSync(
+    gitLine(realCwd, ["rev-parse", "--path-format=absolute", "--git-common-dir"]),
+  );
+  const relativeCwd = path.relative(repoRoot, realCwd);
+  if (relativeCwd.startsWith("..") || path.isAbsolute(relativeCwd)) {
+    throw new Error("workflow cwd must remain inside its Git working tree");
+  }
+  const repositoryRootCommit = gitLine(realCwd, ["rev-list", "--max-parents=0", "HEAD"], true);
+  const identity = JSON.stringify({
+    kind: "git-worktree",
+    repoRoot,
+    repoRootFile: fileIdentity(repoRoot),
+    cwdFile: fileIdentity(realCwd),
+    gitDir,
+    gitDirFile: fileIdentity(gitDir),
+    gitCommonDir,
+    gitCommonDirFile: fileIdentity(gitCommonDir),
+    repositoryRootCommit,
+    relativeCwd,
+  });
+  return { identity, cwd: realCwd, repoRoot, relativeCwd, gitDir, gitCommonDir };
+}
+
+/** Read one Git plumbing line without stripping valid path whitespace. */
+function gitLine(cwd: string, args: string[], optional = false): string {
+  try {
+    const output = execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: hermeticGitEnvironment(),
+      maxBuffer: MAX_GIT_PATH_BYTES,
+      timeout: 25_000,
+      killSignal: "SIGKILL",
+    });
+    return stripOneLineEnding(output);
+  } catch (error) {
+    if (optional) return "";
+    throw error;
+  }
+}
+
+function fileIdentity(filePath: string): { dev: number; ino: number; birthtimeMs: number } {
+  const stat = fs.statSync(filePath);
+  return { dev: stat.dev, ino: stat.ino, birthtimeMs: stat.birthtimeMs };
+}

package/src/workflow/run-artifacts.ts

@@ -16,21 +16,30 @@ export function ensurePrivateArtifactDirectory(dir: string, trustedRoot?: string
     ensureContainedDirectory(trustedRoot, dir);
     return;
   }
-  let created = false;
-  try {
-    fs.lstatSync(dir);
-  } catch (error: any) {
-    if (error?.code !== "ENOENT") throw error;
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    created = true;
+  const target = path.resolve(dir);
+  const missing: string[] = [];
+  let current = target;
+  while (true) {
+    try {
+      assertRealDirectory(current);
+      break;
+    } catch (error: any) {
+      if (error?.code !== "ENOENT") throw error;
+      missing.push(current);
+      const parent = path.dirname(current);
+      if (parent === current) throw error;
+      current = parent;
+    }
   }
-  assertRealDirectory(dir);
-  if (process.platform !== "win32") fs.chmodSync(dir, 0o700);
-  if (created) {
-    fsyncArtifactDirectory(dir);
-    const parent = path.dirname(dir);
-    if (parent !== dir) fsyncArtifactDirectory(parent);
+  for (const directory of missing.reverse()) {
+    fs.mkdirSync(directory, { mode: 0o700 });
+    assertRealDirectory(directory);
+    if (process.platform !== "win32") fs.chmodSync(directory, 0o700);
+    fsyncArtifactDirectory(directory);
+    fsyncArtifactDirectory(path.dirname(directory));
   }
+  assertRealDirectory(target);
+  if (process.platform !== "win32") fs.chmodSync(target, 0o700);
 }
 
 function ensureContainedDirectory(trustedRoot: string, dir: string): void {
@@ -112,6 +121,10 @@ export function readContainedArtifactFile(
   maxBytes = 16 * 1024 * 1024,
 ): string {
   const root = path.resolve(trustedRoot);
+  const rootStat = fs.lstatSync(root);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(`${label} trusted root must be a real directory: ${root}`);
+  }
   const target = path.resolve(filePath);
   const relative = path.relative(root, target);
   if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
@@ -130,7 +143,40 @@ export function readContainedArtifactFile(
   return readArtifactFile(target, label, maxBytes);
 }
 
+export function readContainedArtifactBytes(
+  trustedRoot: string,
+  filePath: string,
+  label: string,
+  maxBytes = 16 * 1024 * 1024,
+): Buffer {
+  const root = path.resolve(trustedRoot);
+  const rootStat = fs.lstatSync(root);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(`${label} trusted root must be a real directory: ${root}`);
+  }
+  const target = path.resolve(filePath);
+  const relative = path.relative(root, target);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error(`${label} must stay inside ${root}`);
+  }
+  let current = root;
+  const parts = relative.split(path.sep);
+  for (const [index, part] of parts.entries()) {
+    current = path.join(current, part);
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink()) throw new Error(`${label} path may not contain symlinks: ${current}`);
+    if (index < parts.length - 1 && !stat.isDirectory()) {
+      throw new Error(`${label} parent must be a directory: ${current}`);
+    }
+  }
+  return readArtifactBytes(target, label, maxBytes);
+}
+
 export function readArtifactFile(filePath: string, label: string, maxBytes = 16 * 1024 * 1024): string {
+  return readArtifactBytes(filePath, label, maxBytes).toString("utf8");
+}
+
+export function readArtifactBytes(filePath: string, label: string, maxBytes = 16 * 1024 * 1024): Buffer {
   assertRegularArtifactFile(filePath, label);
   const fd = fs.openSync(filePath, fs.constants.O_RDONLY | NO_FOLLOW);
   try {
@@ -147,7 +193,7 @@ export function readArtifactFile(filePath: string, label: string, maxBytes = 16
       total += bytesRead;
     }
     if (total > maxBytes) throw new Error(`${label} exceeds ${maxBytes} bytes: ${filePath}`);
-    return Buffer.concat(chunks, total).toString("utf8");
+    return Buffer.concat(chunks, total);
   } finally {
     fs.closeSync(fd);
   }