promigence 0.1.0-beta.12

package/dist/templates.js

@@ -0,0 +1,53 @@
+import { PromigenceClient } from "./sdk/index.js";
+import { bool, clientOpts, nexts, positional } from "./commands.js";
+import { emit, okEnvelope, recordNotice } from "./io.js";
+import { sh } from "./term.js";
+function client(ctx) {
+    return new PromigenceClient({ ...clientOpts(ctx), onNotice: recordNotice });
+}
+const templatesList = async (ctx) => {
+    const all = await client(ctx).templates.list();
+    const first = all[0];
+    const next = nexts(...(first
+        ? [[sh `promigence templates show ${first.name}`, "what it has installed, and its versions"],
+            [sh `promigence fork --snapshot ${first.name} --count 1 --cap 1`, "start a sandbox from it"]]
+        : [["promigence examples", "what forks with no build"]]));
+    const width = Math.max(4, ...all.map((t) => t.name.length));
+    const lines = [
+        all.length ? `templates: ${all.length}` : "templates: none published yet",
+        ...all.map((t) => `  ${t.name.padEnd(width)}  v${t.version}  ${t.category.padEnd(9)}  ${t.summary}`),
+    ];
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { templates: all, count: all.length }, next), lines, 0, ctx.pointer);
+};
+const templatesShow = async (ctx) => {
+    const name = positional(ctx, "a template's name", "promigence templates show python-3.12");
+    const t = await client(ctx).templates.get(name);
+    const all = bool(ctx, "--packages");
+    const deps = t.dependencies;
+    const managers = Object.entries(deps?.packages ?? {});
+    const lines = [
+        `${t.title} (${t.name}) — version ${t.version}`,
+        `  ${t.summary}`,
+        `  starts from  ${t.image}`,
+        `  tier         ${t.tier}`,
+        `  verify       ${t.verify}`,
+        ...(t.setup.length ? ["  setup", ...t.setup.map((s) => `    $ ${s}`)] : []),
+        ...(deps
+            ? [
+                `  installed    ${deps.os}${deps.arch ? ` (${deps.arch})` : ""}`,
+                ...Object.entries(deps.tools ?? {}).map(([k, v]) => `    ${k.padEnd(12)} ${v}`),
+                ...managers.map(([m, pkgs]) => all
+                    ? `    ${m}: ${pkgs.map((p) => `${p.name} ${p.version}`).join(", ")}`
+                    : `    ${m}: ${pkgs.length} package(s)${pkgs.length ? " (--packages lists them)" : ""}`),
+            ]
+            : ["  installed    not recorded for this version"]),
+        "  versions",
+        ...t.versions.map((v) => `    v${v.version}${v.current ? " (current)" : ""}${v.security ? " security" : ""}  ${v.published_at ?? ""}  ${v.notes}`),
+    ];
+    const next = nexts([sh `promigence fork --snapshot ${t.name} --count 1 --cap 1`, "start a sandbox from it"], ["promigence templates", "every template"]);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { template: t }, next), lines, 0, ctx.pointer);
+};
+export const TEMPLATES_HANDLERS = {
+    "templates": templatesList,
+    "templates show": templatesShow,
+};

package/dist/term.js

@@ -0,0 +1,50 @@
+const BIDI = "\u202a-\u202e\u2066-\u2069";
+const CONTROLS = new RegExp(`[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f${BIDI}]`, "g");
+const JSON_RAW = new RegExp(`[\\u007f-\\u009f${BIDI}]`, "g");
+export function escapeControls(text) {
+    return text.replace(CONTROLS, (c) => {
+        const n = c.charCodeAt(0);
+        if (n === 0x0d)
+            return "\\r";
+        if (n === 0x7f)
+            return "^?";
+        if (n < 0x20)
+            return `^${String.fromCharCode(n + 0x40)}`;
+        if (n <= 0x9f)
+            return `\\x${n.toString(16)}`;
+        return `\\u${n.toString(16)}`;
+    });
+}
+export function escapeField(text) {
+    return escapeControls(text).replace(/\n/g, "\\n");
+}
+export function fieldForTerminal(stream, text) {
+    return stream.isTTY ? escapeField(text) : text;
+}
+export function jsonForTerminal(stream, json) {
+    if (!stream.isTTY)
+        return json;
+    return json.replace(JSON_RAW, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+export function jsonLine(stream, value) {
+    return jsonForTerminal(stream, JSON.stringify(value)) + "\n";
+}
+export function forTerminal(stream, text) {
+    return stream.isTTY ? escapeControls(text) : text;
+}
+export function escapeLine(line) {
+    return escapeControls(line.endsWith("\r") ? line.slice(0, -1) : line);
+}
+const PLAIN_ARG = /^[A-Za-z0-9_./:@,][A-Za-z0-9_./:@,=-]*$/;
+export function shellArg(value) {
+    const s = String(value);
+    if (PLAIN_ARG.test(s))
+        return s;
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+export function sh(strings, ...values) {
+    let out = strings[0];
+    for (let i = 0; i < values.length; i++)
+        out += shellArg(values[i]) + strings[i + 1];
+    return out;
+}

package/dist/timing.js

@@ -0,0 +1,71 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const seen = [];
+export function recordTiming(t) {
+    seen.push(t);
+}
+export function timings() {
+    return seen.filter((t) => t.ourMs !== null);
+}
+export function networkMs(list = timings()) {
+    let best;
+    for (const t of list) {
+        if (t.ourMs === null)
+            continue;
+        const n = Math.max(0, t.totalMs - t.ourMs);
+        if (best === undefined || n < best)
+            best = n;
+    }
+    return best;
+}
+export function ourSideLine(ourMs, totalMs) {
+    const ours = `${fmtMs(ourMs)} on our side`;
+    return totalMs === undefined ? ours : `${ours} · ${fmtMs(totalMs)} round trip`;
+}
+export function fmtMs(ms) {
+    return ms >= 10 ? `${Math.round(ms)} ms` : `${Math.round(ms * 10) / 10} ms`;
+}
+export function where(location) {
+    return location ? `our servers on the ${location}` : "our servers";
+}
+export const FAR_MS = 150;
+export function farMarker(env = process.env) {
+    const base = env["XDG_CONFIG_HOME"] ? join(env["XDG_CONFIG_HOME"], "promigence") : join(homedir(), ".config", "promigence");
+    return join(base, "far-notice-shown");
+}
+export function farNoticeText(ms, location) {
+    return `promigence: You're about ${Math.round(ms)} ms from ${where(location)}. ` +
+        "Times marked 'on our side' are the platform's own; the rest is your network. " +
+        "(Shown once. `promigence ping` measures it again.)\n";
+}
+export async function maybeFarNotice(opts) {
+    const env = opts.env ?? process.env;
+    if (opts.json || env["PROMIGENCE_QUIET"] === "1")
+        return undefined;
+    if (!(opts.isTTY ?? process.stderr.isTTY))
+        return undefined;
+    const ms = networkMs(opts.list ?? timings());
+    if (ms === undefined || ms < FAR_MS)
+        return undefined;
+    const marker = farMarker(env);
+    if (existsSync(marker))
+        return undefined;
+    const loc = await opts.location().catch(() => undefined);
+    const text = farNoticeText(ms, loc);
+    (opts.write ?? ((s) => process.stderr.write(s)))(text);
+    try {
+        mkdirSync(join(marker, ".."), { recursive: true, mode: 0o700 });
+        writeFileSync(marker, `${new Date().toISOString()} ${Math.round(ms)}\n`, { mode: 0o600 });
+    }
+    catch {
+    }
+    return text;
+}
+export function median(xs) {
+    if (!xs.length)
+        return undefined;
+    const s = [...xs].sort((a, b) => a - b);
+    const m = s.length >> 1;
+    return s.length % 2 ? s[m] : (s[m - 1] + s[m]) / 2;
+}

package/dist/untar.js

@@ -0,0 +1,324 @@
+import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readSync, readlinkSync, realpathSync, symlinkSync, unlinkSync, utimesSync, writeSync, } from "node:fs";
+import { join } from "node:path";
+const BLOCK = 512;
+const MAX_META = 64 * 1024;
+const MAX_HOPS = 40;
+export class UnsafeArchiveError extends Error {
+    refused;
+    constructor(refused) {
+        super(`the archive holds ${refused.length} entr${refused.length === 1 ? "y" : "ies"} that would write outside the destination or are not plain files: ` +
+            refused.slice(0, 5).map((r) => `${r.path} (${r.reason})`).join("; ") +
+            (refused.length > 5 ? `; and ${refused.length - 5} more` : ""));
+        this.refused = refused;
+        this.name = "UnsafeArchiveError";
+    }
+}
+function cstr(b, from, to) {
+    const s = b.subarray(from, to);
+    const z = s.indexOf(0);
+    return (z < 0 ? s : s.subarray(0, z)).toString("utf8");
+}
+function num(b, from, to) {
+    const f = b.subarray(from, to);
+    if (f.length > 0 && (f[0] & 0x80) !== 0) {
+        let v = f[0] & 0x7f;
+        for (let i = 1; i < f.length; i++)
+            v = v * 256 + f[i];
+        return v;
+    }
+    const s = cstr(b, from, to).trim();
+    if (s === "")
+        return 0;
+    if (!/^[0-7]+$/.test(s))
+        throw new Error(`a tar header field is not a number: ${JSON.stringify(s)}`);
+    return parseInt(s, 8);
+}
+function checksumOk(h) {
+    const want = num(h, 148, 156);
+    let sum = 0;
+    for (let i = 0; i < BLOCK; i++)
+        sum += i >= 148 && i < 156 ? 0x20 : h[i];
+    return sum === want;
+}
+function pax(data) {
+    const out = {};
+    let i = 0;
+    while (i < data.length) {
+        const sp = data.indexOf(0x20, i);
+        if (sp < 0)
+            break;
+        const len = parseInt(data.subarray(i, sp).toString("ascii"), 10);
+        if (!Number.isFinite(len) || len <= 0 || i + len > data.length)
+            break;
+        const rec = data.subarray(sp + 1, i + len - 1).toString("utf8");
+        const eq = rec.indexOf("=");
+        if (eq > 0)
+            out[rec.slice(0, eq)] = rec.slice(eq + 1);
+        i += len;
+    }
+    return out;
+}
+function readAt(fd, len, pos) {
+    const b = Buffer.alloc(len);
+    let got = 0;
+    while (got < len) {
+        const n = readSync(fd, b, got, len - got, pos + got);
+        if (n === 0)
+            break;
+        got += n;
+    }
+    return got === len ? b : b.subarray(0, got);
+}
+function relName(raw, strip) {
+    if (raw.startsWith("/") || /^[A-Za-z]:[\\/]/.test(raw))
+        return { reason: "an absolute name" };
+    if (raw.includes("\\"))
+        return { reason: "a backslash in the name" };
+    const parts = raw.split("/").filter((p) => p !== "" && p !== ".");
+    if (parts.some((p) => p === ".."))
+        return { reason: "a `..` in the name" };
+    const kept = parts.slice(strip);
+    return kept.length === 0 ? null : kept.join("/");
+}
+function scan(fd, strip) {
+    const entries = [];
+    const refused = [];
+    let pos = 0;
+    let longName = null;
+    let longLink = null;
+    let paxRec = {};
+    for (;;) {
+        const h = readAt(fd, BLOCK, pos);
+        if (h.length < BLOCK)
+            throw new Error("the archive ends in the middle of a header");
+        if (h.every((x) => x === 0))
+            break;
+        if (!checksumOk(h))
+            throw new Error(`a tar header at byte ${pos} has a bad checksum`);
+        const flag = String.fromCharCode(h[156]);
+        let size = num(h, 124, 136);
+        const data = pos + BLOCK;
+        const advance = (n) => data + Math.ceil(n / BLOCK) * BLOCK;
+        if (flag === "L" || flag === "K" || flag === "x" || flag === "g") {
+            if (size > MAX_META)
+                throw new Error(`a tar metadata record of ${size} bytes is over ${MAX_META}`);
+            const meta = readAt(fd, size, data);
+            if (flag === "L")
+                longName = cstr(meta, 0, meta.length);
+            else if (flag === "K")
+                longLink = cstr(meta, 0, meta.length);
+            else if (flag === "x")
+                paxRec = pax(meta);
+            pos = advance(size);
+            continue;
+        }
+        const prefix = h.subarray(257, 262).toString("latin1") === "ustar" ? cstr(h, 345, 500) : "";
+        const short = cstr(h, 0, 100);
+        const raw = paxRec["path"] ?? longName ?? (prefix ? `${prefix}/${short}` : short);
+        const link = paxRec["linkpath"] ?? longLink ?? cstr(h, 157, 257);
+        if (paxRec["size"] !== undefined && /^\d+$/.test(paxRec["size"]))
+            size = Number(paxRec["size"]);
+        longName = null;
+        longLink = null;
+        paxRec = {};
+        const mode = num(h, 100, 108) & 0o777;
+        const mtime = num(h, 136, 148);
+        const name = relName(raw, strip);
+        const kind = flag === "0" || flag === "\0" || flag === "7" ? "file"
+            : flag === "5" ? "dir"
+                : flag === "2" ? "symlink"
+                    : flag === "1" ? { reason: "a hard link" }
+                        : flag === "3" || flag === "4" ? { reason: "a device" }
+                            : flag === "6" ? { reason: "a fifo" }
+                                : { reason: `tar entry type ${JSON.stringify(flag)}` };
+        pos = advance(flag === "1" || flag === "2" ? 0 : size);
+        if (typeof kind === "object") {
+            refused.push({ path: raw, reason: kind.reason });
+            continue;
+        }
+        if (name === null)
+            continue;
+        if (typeof name === "object") {
+            refused.push({ path: raw, reason: name.reason });
+            continue;
+        }
+        entries.push({ kind, path: name, link, mode, mtime, size: kind === "file" ? size : 0, offset: data });
+    }
+    return { entries, refused };
+}
+function resolvesInside(root, at, target, links) {
+    if (target.startsWith("/") || /^[A-Za-z]:[\\/]/.test(target))
+        return false;
+    const stack = at.split("/").slice(0, -1);
+    const queue = target.split("/");
+    let hops = 0;
+    while (queue.length > 0) {
+        const c = queue.shift();
+        if (c === "" || c === ".")
+            continue;
+        if (c === "..") {
+            if (stack.length === 0)
+                return false;
+            stack.pop();
+            continue;
+        }
+        stack.push(c);
+        const cur = stack.join("/");
+        let next = links.get(cur);
+        if (next === undefined) {
+            try {
+                if (lstatSync(join(root, cur)).isSymbolicLink())
+                    next = readlinkSync(join(root, cur));
+            }
+            catch {
+            }
+        }
+        if (next !== undefined) {
+            if (++hops > MAX_HOPS)
+                return false;
+            if (next.startsWith("/") || /^[A-Za-z]:[\\/]/.test(next))
+                return false;
+            stack.pop();
+            queue.unshift(...next.split("/"));
+        }
+    }
+    return true;
+}
+function ensureDir(root, rel, made) {
+    if (rel === "" || made.has(rel))
+        return;
+    let cur = "";
+    for (const c of rel.split("/")) {
+        cur = cur ? `${cur}/${c}` : c;
+        if (made.has(cur))
+            continue;
+        const full = join(root, cur);
+        let st;
+        try {
+            st = lstatSync(full);
+        }
+        catch {
+            mkdirSync(full, { mode: 0o755 });
+            made.add(cur);
+            continue;
+        }
+        if (st.isSymbolicLink())
+            throw new UnsafeArchiveError([{ path: cur, reason: "the destination already holds a link here" }]);
+        if (!st.isDirectory())
+            throw new UnsafeArchiveError([{ path: cur, reason: "the destination already holds a file where the archive has a directory" }]);
+        made.add(cur);
+    }
+}
+function clearName(full, rel) {
+    let st;
+    try {
+        st = lstatSync(full);
+    }
+    catch {
+        return;
+    }
+    if (st.isDirectory())
+        throw new UnsafeArchiveError([{ path: rel, reason: "the destination already holds a directory here" }]);
+    if (st.isSymbolicLink())
+        unlinkSync(full);
+}
+export function untarSafe(tarPath, dst, opts) {
+    const fd = openSync(tarPath, "r");
+    try {
+        const { entries, refused } = scan(fd, opts.strip);
+        const links = new Map();
+        for (const e of entries)
+            if (e.kind === "symlink")
+                links.set(e.path, e.link);
+        mkdirSync(dst, { recursive: true });
+        const root = realpathSync(dst);
+        for (const e of entries) {
+            const parts = e.path.split("/");
+            for (let i = 1; i < parts.length; i++) {
+                if (links.has(parts.slice(0, i).join("/"))) {
+                    refused.push({ path: e.path, reason: "it is written through a link the same archive makes" });
+                    break;
+                }
+            }
+            if (e.kind === "symlink") {
+                if (entries.some((o) => o !== e && o.path === e.path && o.kind !== "symlink")) {
+                    refused.push({ path: e.path, reason: "the archive names it both as a link and as a file or directory" });
+                }
+                else if (!opts.keepLinks && !resolvesInside(root, e.path, e.link, links)) {
+                    refused.push({ path: e.path, reason: `a link to ${e.link}, outside the destination` });
+                }
+            }
+        }
+        if (refused.length > 0)
+            throw new UnsafeArchiveError(refused);
+        const made = new Set();
+        const out = { files: 0, dirs: 0, links: 0, bytes: 0 };
+        const dirs = [];
+        const buf = Buffer.alloc(1 << 20);
+        const NOFOLLOW = constants["O_NOFOLLOW"] ?? 0;
+        for (const e of entries) {
+            if (e.kind === "dir") {
+                ensureDir(root, e.path, made);
+                dirs.push(e);
+                out.dirs++;
+                continue;
+            }
+            if (e.kind !== "file")
+                continue;
+            const parent = e.path.split("/").slice(0, -1).join("/");
+            ensureDir(root, parent, made);
+            const full = join(root, e.path);
+            clearName(full, e.path);
+            const w = openSync(full, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | NOFOLLOW, e.mode | 0o600);
+            try {
+                let left = e.size;
+                let at = e.offset;
+                while (left > 0) {
+                    const n = readSync(fd, buf, 0, Math.min(buf.length, left), at);
+                    if (n === 0)
+                        throw new Error(`the archive ends inside ${e.path}`);
+                    let wrote = 0;
+                    while (wrote < n)
+                        wrote += writeSync(w, buf, wrote, n - wrote);
+                    left -= n;
+                    at += n;
+                }
+                if (e.mtime > 0)
+                    futimesSync(w, e.mtime, e.mtime);
+            }
+            finally {
+                closeSync(w);
+            }
+            out.files++;
+            out.bytes += e.size;
+        }
+        for (const e of entries) {
+            if (e.kind !== "symlink")
+                continue;
+            const parent = e.path.split("/").slice(0, -1).join("/");
+            ensureDir(root, parent, made);
+            const full = join(root, e.path);
+            clearName(full, e.path);
+            try {
+                unlinkSync(full);
+            }
+            catch {
+            }
+            symlinkSync(e.link, full);
+            out.links++;
+        }
+        for (const d of dirs.reverse()) {
+            if (d.mtime > 0) {
+                try {
+                    utimesSync(join(root, d.path), d.mtime, d.mtime);
+                }
+                catch {
+                }
+            }
+        }
+        return out;
+    }
+    finally {
+        closeSync(fd);
+    }
+}

package/dist/uploadguard.js

@@ -0,0 +1,75 @@
+import { spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
+import { CREDENTIAL_CHECK_NOTE, credentialRefusalMessage } from "./sdk/index.js";
+import { bool } from "./commands.js";
+import { emit, okEnvelope, usageError, write } from "./io.js";
+import { jsonLine } from "./term.js";
+export const CREDENTIAL_REMEDY = {
+    dir: "Remove them from git (`git rm --cached FILE` and add them to .gitignore), pass the values as secrets (`promigence secrets set`), or pass --allow-secrets if they are not real credentials.",
+    dockerfile: "Exclude them in .dockerignore, pass the values as secrets (`promigence secrets set`), or pass --allow-secrets if they are not real credentials.",
+};
+export function credentialRefusal(hits, remedy) {
+    return usageError(credentialRefusalMessage(hits), `A snapshot keeps every file it holds, and every sandbox started from it has them. ${remedy} ${CREDENTIAL_CHECK_NOTE} --list-files prints everything that would be sent.`);
+}
+async function ask(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await new Promise((resolve) => rl.question(prompt, resolve));
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirmOverride(ctx, o, io = {}) {
+    if (o.items.length === 0)
+        return [];
+    const tty = io.tty ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
+    await write(process.stderr, ctx.mode === "json"
+        ? jsonLine(process.stderr, { hint: "override", flag: o.flag, sending: o.items })
+        : `${o.flag}: sending ${o.items.length} ${o.what}:\n${o.items.map((i) => `  ${i}`).join("\n")}\n`);
+    if (!tty || bool(ctx, "--yes"))
+        return [...o.items];
+    const answer = await (io.ask ?? ask)(`Send ${o.items.length === 1 ? "it" : `these ${o.items.length}`}? [y/N] `);
+    if (/^\s*y(es)?\s*$/i.test(answer))
+        return [...o.items];
+    throw usageError(`not sent: ${o.flag} was not confirmed; nothing was created`, `Answer y to send them, or pass --yes with ${o.flag} to send them without the question.`);
+}
+function human(n) {
+    if (n < 1024)
+        return `${n} B`;
+    const u = ["KiB", "MiB", "GiB", "TiB"];
+    let v = n / 1024;
+    let i = 0;
+    while (v >= 1024 && i < u.length - 1) {
+        v /= 1024;
+        i++;
+    }
+    return `${v.toFixed(v < 10 ? 1 : 0)} ${u[i]}`;
+}
+export async function emitUploadList(ctx, l) {
+    const flagged = new Set(l.secrets);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+        sent: false,
+        list_files: {
+            kind: l.kind, root: l.root, files: l.files, bytes: l.bytes, paths: l.paths, secrets: l.secrets, notes: l.notes,
+            ...(l.ignoreFile === undefined ? {} : { ignore_file: l.ignoreFile }),
+        },
+    }, []), [
+        `would upload ${l.files} file${l.files === 1 ? "" : "s"} (${human(l.bytes)}) from ${l.root}${l.ignoreFile ? `, after ${l.ignoreFile}` : ""}; nothing was sent:`,
+        ...l.paths.map((p) => `  ${p}${flagged.has(p) ? "   <- looks like a credential (refused unless --allow-secrets)" : ""}`),
+        ...l.notes.map((n) => `  note: ${n}`),
+        ...(l.secrets.length
+            ? [`  ${l.secrets.length} of them look${l.secrets.length === 1 ? "s" : ""} like credentials, refused unless --allow-secrets; the check goes by file name and is best-effort.`]
+            : []),
+    ], 0, false);
+}
+export function tarNoMetadataArgs(version, platform = process.platform) {
+    if (!/bsdtar/i.test(version))
+        return [];
+    return platform === "darwin" ? ["--no-xattrs", "--no-mac-metadata"] : ["--no-xattrs"];
+}
+let localTarVersion;
+export function localTarNoMetadataArgs() {
+    localTarVersion ??= spawnSync("tar", ["--version"], { encoding: "utf8" }).stdout ?? "";
+    return tarNoMetadataArgs(localTarVersion);
+}