promigence 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/account.js

@@ -333,7 +333,7 @@ function stateFlag(ctx, states) {
     }
     return wanted;
 }
-const BUILD_STATES = ["queued", "running", "verified", "rejected", "failed"];
+const BUILD_STATES = ["queued", "running", "verified", "built", "rejected", "failed"];
 const RUN_STATES = ["running", "completed", "cap_killed", "aborted"];
 const snapshotBuilds = async (ctx) => {
     const wanted = stateFlag(ctx, BUILD_STATES);

package/dist/commands.d.ts

@@ -99,5 +99,6 @@ export declare function outputTails(c: PromigenceClient, sandboxes: ReadonlyArra
     }>;
 }>): Promise<Map<string, OutputTail>>;
 export declare function positional(ctx: Ctx, what: string, example: string): string;
+export declare function filesPutTarArgs(out: string, parent: string, base: string, noMetadata?: string[]): string[];
 export declare const HANDLERS: Readonly<Record<string, Handler>>;
 export {};

package/dist/commands.js

@@ -3,11 +3,12 @@ import { createHash, randomBytes } from "node:crypto";
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, packContext, readCredentials, } from "./sdk/index.js";
+import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, listContext, packContext, readCredentials, } from "./sdk/index.js";
 import { fmtMs, recordTiming } from "./timing.js";
 import { capacityLine, queuedClause, queuedLines, statusLine } from "./capacity.js";
-import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 import { detect, ecosystemOfCommands, imageCreateCommand, readConfig } from "./init.js";
+import { CREDENTIAL_REMEDY, confirmOverride, credentialRefusal, emitUploadList, localTarNoMetadataArgs } from "./uploadguard.js";
 import { emit, errorEnvelope, errorTextLines, exitWith, forkLine, forkSummary, gradeLine, ms, noCommandFix, okEnvelope, parseMaxOutput, recordNotice, sandboxGrade, parseCommandTimeout, parseCount, parseDuration, parseUsd, pickExit, reportSummaryLines, toPromigenceError, totalsLine, usageError, write, writeBytes, } from "./io.js";
 import { buildPrice } from "./pricing.js";
 import { DOCS_URL, WAIT_TIMEOUT_DEFAULT } from "./surface.js";
@@ -366,7 +367,7 @@ const secretsSet = async (ctx) => {
         `${sh `promigence secrets set ${name}`}: stored ${res.bytes} bytes from ${source}`,
         ...(res.hosts?.length
             ? [
-                `  bound to ${res.hosts.join(", ")}: the sandbox never sees its value (the variable holds ${res.placeholder ?? "a stand-in"})`,
+                `  bound to ${res.hosts.join(", ")}: the value stays out of the sandbox unless a run asks for it (the variable holds ${res.placeholder ?? "something else"})`,
                 ...boundUseLines(res),
                 ...(res.raw === "refused" ? ["  its value can never be given to a sandbox"] : []),
             ]
@@ -440,7 +441,7 @@ function isBuilding(b) {
     return b.state === "queued" || b.state === "running";
 }
 function buildExit(b) {
-    if (b.state === "verified")
+    if (b.state === "verified" || b.state === "built")
         return 0;
     if (b.state === "rejected")
         return 6;
@@ -463,7 +464,7 @@ export function verifyTiming(v) {
 function buildLines(b) {
     const note = b.deduped ? " (deduped: an identical build already ran)"
         : b.idempotent_replay === true ? " (reused: the same request already built it)" : "";
-    const unverified = b.state === "verified" && b.verified === false;
+    const unverified = b.state === "built" || (b.state === "verified" && b.verified === false);
     const shown = unverified ? "built (no --verify: not verified)" : b.state;
     const lines = [`build ${b.build_id}: ${shown}${note}`];
     if (b.snapshot_id)
@@ -487,7 +488,7 @@ async function emitBuild(ctx, b, extra = {}, more = []) {
     const exit = buildExit(b);
     const next = b.snapshot_deleted === true
         ? nexts(["promigence snapshot list", "this build's snapshot was deleted; the snapshots you have now"])
-        : b.snapshot_id && (b.state === "verified" || (!isBuilding(b) && b.state !== "rejected" && b.state !== "failed"))
+        : b.snapshot_id && (b.state === "verified" || b.state === "built" || (!isBuilding(b) && b.state !== "rejected" && b.state !== "failed"))
             ? nexts([sh `promigence run --snapshot ${b.snapshot_id} --count 2 --cap 1 -- CMD`, "fork it and run a command in every sandbox"], [sh `promigence snapshot inspect ${b.snapshot_id}`, "the manifest: provenance and verification"])
             : b.state === "running"
                 ? nexts([sh `promigence snapshot status ${b.build_id} --wait`, "keep waiting; the build is untouched"])
@@ -643,7 +644,27 @@ function refuseRepoCredentials(ctx) {
         checkRepoUrl(withoutPin(context), "--context");
     }
 }
-function dockerfileOpts(ctx) {
+async function packedContext(ctx, dir, path) {
+    const listed = listContext(dir, { dockerfile: path });
+    if (bool(ctx, "--list-files")) {
+        return emitUploadList(ctx, {
+            kind: "dockerfile", root: dir, paths: listed.paths, files: listed.files, bytes: listed.bytes,
+            secrets: listed.secrets, notes: listed.notes, ignoreFile: listed.ignoreFile,
+        });
+    }
+    if (listed.notes.length) {
+        await write(process.stderr, ctx.mode === "json"
+            ? jsonLine(process.stderr, { hint: "context", notes: listed.notes })
+            : listed.notes.map((n) => fieldForTerminal(process.stderr, `  note: ${n}`)).join("\n") + "\n");
+    }
+    if (listed.secrets.length && !bool(ctx, "--allow-secrets"))
+        throw credentialRefusal(listed.secrets, CREDENTIAL_REMEDY.dockerfile);
+    const secretsAllowed = await confirmOverride(ctx, {
+        flag: "--allow-secrets", what: "files that look like credentials", items: listed.secrets,
+    });
+    return { context: packContext(dir, { dockerfile: path, allowSecrets: true }), secretsAllowed };
+}
+async function dockerfileOpts(ctx) {
     const df = required(ctx, "--dockerfile", "Pass --dockerfile ./Dockerfile.");
     const context = str(ctx, "--context");
     if (context !== undefined && CONTEXT_GIT_RE.test(context.trim())) {
@@ -667,11 +688,17 @@ function dockerfileOpts(ctx) {
     if (!existsSync(df)) {
         throw usageError(`no Dockerfile at ${JSON.stringify(df)}`, "Pass --dockerfile with the path to your Dockerfile, or --context URL@SHA to build one from a repository.");
     }
-    return { context: packContext(dir, { keep: [path] }), path };
+    const packed = await packedContext(ctx, dir, path);
+    return { context: packed.context, path, ...(packed.secretsAllowed.length ? { secretsAllowed: packed.secretsAllowed } : {}) };
 }
-function devcontainerCreate(ctx, plan) {
+async function devcontainerCreate(ctx, plan) {
     let source;
     let label;
+    let secretsAllowed = [];
+    const localEnvBaked = await confirmOverride(ctx, {
+        flag: "--devcontainer-local-env", what: "values from your environment, baked into the snapshot",
+        items: plan.localEnvBaked ?? [],
+    });
     if (plan.source.kind === "image") {
         source = { image: plan.source.image };
         label = plan.source.image;
@@ -681,7 +708,9 @@ function devcontainerCreate(ctx, plan) {
             throw usageError(`the devcontainer names a Dockerfile that is not here: ${plan.source.dockerfile}`, "Check `build.dockerfile` and `build.context` in the devcontainer.json, relative to the file itself.");
         }
         const path = contextRelative(plan.source.context, plan.source.dockerfile);
-        source = { dockerfile: { context: packContext(plan.source.context, { keep: [path] }), path } };
+        const packed = await packedContext(ctx, plan.source.context, path);
+        source = { dockerfile: { context: packed.context, path } };
+        secretsAllowed = packed.secretsAllowed;
         label = `${path} in ${plan.source.context}`;
     }
     const repo = str(ctx, "--repo");
@@ -693,7 +722,8 @@ function devcontainerCreate(ctx, plan) {
         throw usageError(`--commit must be a full 40-character sha, got ${JSON.stringify(commit)}`, "A branch is not a pin: pass --commit $(git rev-parse HEAD).");
     }
     const setup = planSetup(plan, { repo, commit, userSetup: list(ctx, "--setup") });
-    const opts = { ...source, ...(setup.length ? { setup } : {}) };
+    const env = snapshotEnv(plan);
+    const opts = { ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}) };
     const verify = str(ctx, "--verify");
     if (verify !== undefined)
         opts.verify = { cmd: wrapCommand(plan, verify) };
@@ -709,6 +739,8 @@ function devcontainerCreate(ctx, plan) {
         devcontainer: json,
         ...(repo === undefined ? {} : { repo, commit }),
         ...(tier === undefined ? {} : { requested_tier: tier }),
+        ...(secretsAllowed.length ? { secret_files_allowed: secretsAllowed } : {}),
+        ...(localEnvBaked.length ? { local_env_baked: localEnvBaked } : {}),
     };
     const lines = planLines(plan, setup);
     if (repo !== undefined && commit !== undefined) {
@@ -739,7 +771,7 @@ const snapshotCreate = async (ctx) => {
         ({ opts, label, submitted, tier } = gh);
     }
     else if (plan !== undefined) {
-        const built = devcontainerCreate(ctx, plan);
+        const built = await devcontainerCreate(ctx, plan);
         opts = built.opts;
         label = built.label;
         submitted = built.submitted;
@@ -767,11 +799,14 @@ const snapshotCreate = async (ctx) => {
             submitted = { build_price: null, image };
         }
         else {
-            const dockerfile = dockerfileOpts(ctx);
+            const { secretsAllowed, ...dockerfile } = await dockerfileOpts(ctx);
             source = { dockerfile };
             const where = dockerfile.context.startsWith("tar;") ? (str(ctx, "--context") ?? dirname(str(ctx, "--dockerfile") ?? ".")) : dockerfile.context;
             label = `${dockerfile.path ?? "Dockerfile"} in ${where}`;
-            submitted = { build_price: null, dockerfile: { path: dockerfile.path ?? "Dockerfile", context: where } };
+            submitted = {
+                build_price: null, dockerfile: { path: dockerfile.path ?? "Dockerfile", context: where },
+                ...(secretsAllowed?.length ? { secret_files_allowed: secretsAllowed } : {}),
+            };
         }
         const verify = str(ctx, "--verify");
         const start = str(ctx, "--start");
@@ -863,7 +898,7 @@ const snapshotCreate = async (ctx) => {
             .map((s) => `  also      ${s.repo}@${s.commit.slice(0, 7)} -> ${s.path ?? "beside the workspace, under its own name"}`)
             .join("\n") + "\n");
     }
-    if (started.deduped || started.state === "verified" || (started.snapshot_id && !isBuilding(started))) {
+    if (started.deduped || started.state === "verified" || started.state === "built" || (started.snapshot_id && !isBuilding(started))) {
         return emitBuild(ctx, started, submitted);
     }
     const joined = started.joined === true;
@@ -1575,7 +1610,7 @@ async function runImageSnapshot(ctx, c) {
     const buildOpts = { image, allowBuild: true };
     const snapshotId = await imageSnapshot(c, buildOpts, {
         onBuild: async (b) => {
-            const free = b.deduped === true || b.joined === true || b.idempotent_replay === true || b.state === "verified";
+            const free = b.deduped === true || b.joined === true || b.idempotent_replay === true || b.state === "verified" || b.state === "built";
             charged = free ? 0 : (typeof b.build_price === "number" ? b.build_price : price);
             buildId = b.build_id;
             await write(process.stderr, ctx.mode === "json"
@@ -2306,7 +2341,7 @@ const snapshotVerify = async (ctx) => {
     return emit(ctx.mode, env, lines, exit, ctx.pointer);
 };
 function localTar(args, what) {
-    const r = spawnSync("tar", args, { encoding: "utf8" });
+    const r = spawnSync("tar", args, { encoding: "utf8", env: { ...process.env, COPYFILE_DISABLE: "1" } });
     if (r.error && r.error.code === "ENOENT") {
         throw usageError("`tar` is not on PATH, and a directory transfer needs one locally", "Install tar (macOS and every Linux ship one), or move the files one at a time without --recursive.");
     }
@@ -2328,13 +2363,14 @@ const filesPut = async (ctx) => {
     const { sid, src, dst } = filesArgs(ctx);
     if (!dst.startsWith("/"))
         throw usageError(`DST ${dst} must be absolute inside the sandbox`, "Example: /tmp/fixture.json.");
-    const r = await withLocalFile(src, (source) => client(ctx).sandboxes.files.putFrom(sid, dst, source));
+    const r = await withLocalFile(src, (source) => client(ctx).sandboxes.files.putFrom(sid, dst, source, source.mode === undefined ? {} : { mode: source.mode }));
     const next = nexts([sh `promigence exec --sandbox ${sid} -- ls -l ${dst}`, "see it in the sandbox"]);
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { sandbox_id: sid, src, dst, bytes: r.bytes, chunks: r.chunks, mode: r.mode }, next), [`${src} -> ${sid}:${dst} (${bytes(r.bytes)}${r.chunks > 1 ? `, ${r.chunks} chunks` : ""})`], 0, ctx.pointer);
 };
 async function withLocalFile(path, fn) {
     let fd;
     let size;
+    let mode;
     try {
         fd = openSync(path, "r");
         const st = fstatSync(fd);
@@ -2343,6 +2379,7 @@ async function withLocalFile(path, fn) {
             throw Object.assign(new Error("it is a directory"), { code: "EISDIR" });
         }
         size = st.isFile() ? st.size : -1;
+        mode = st.isFile() && process.platform !== "win32" ? st.mode & 0o777 : undefined;
     }
     catch (e) {
         const code = e.code;
@@ -2358,6 +2395,7 @@ async function withLocalFile(path, fn) {
         const buf = Buffer.alloc(FILE_PUT_CHUNK_BYTES);
         return await fn({
             size,
+            mode,
             read: (offset, len) => {
                 const want = Math.min(len, buf.length);
                 let got = 0;
@@ -2375,6 +2413,9 @@ async function withLocalFile(path, fn) {
         closeSync(fd);
     }
 }
+export function filesPutTarArgs(out, parent, base, noMetadata = localTarNoMetadataArgs()) {
+    return ["-c", "-f", out, ...noMetadata, "-C", parent, base];
+}
 const filesPutDir = async (ctx) => {
     const { sid, src, dst } = filesArgs(ctx);
     if (!dst.startsWith("/"))
@@ -2384,7 +2425,7 @@ const filesPutDir = async (ctx) => {
     const tmp = join(mkdtempSync(join(tmpdir(), "promigence-put-")), "dir.tar");
     const parent = dirname(resolve(src));
     const base = basename(resolve(src));
-    localTar(["cf", tmp, "-C", parent, base], `tarring ${src}`);
+    localTar(filesPutTarArgs(tmp, parent, base), `tarring ${src}`);
     const bytesIn = statSync(tmp).size;
     const c = client(ctx);
     const scratch = `/tmp/.promigence-upload/cli-${Date.now().toString(36)}-${randomBytes(6).toString("hex")}.tar`;

package/dist/connectreq.js

@@ -0,0 +1,125 @@
+import { PromigenceError } from "./sdk/index.js";
+import { bool, nexts } from "./commands.js";
+import { emit, okEnvelope, write } from "./io.js";
+import { headless, openBrowser } from "./login.js";
+import { jsonLine } from "./term.js";
+const NAMES = { github: "GitHub", gitlab: "GitLab" };
+const CONNECTED = new Set(["connected", "updated", "already_connected"]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export async function consoleTicket(mint) {
+    try {
+        return await mint();
+    }
+    catch (e) {
+        if (e instanceof PromigenceError && e.code === "not_found")
+            return null;
+        throw e;
+    }
+}
+function endLine(host, r) {
+    const a = r.account ?? `the ${NAMES[host]} account`;
+    switch (r.state) {
+        case "connected":
+            return `connected: ${a}`;
+        case "updated":
+            return `already connected: ${a} (repository access updated)`;
+        case "already_connected":
+            return `already connected: ${a}`;
+        default:
+            return `${r.state}: ${r.message}`;
+    }
+}
+function fixFor(host, r) {
+    const again = `\`promigence ${host} connect\``;
+    const n = NAMES[host];
+    switch (r.state) {
+        case "wrong_user":
+            return `The page was opened in a browser signed in to another Promigence account, so nothing was started. Run ${again} again and open the page where you are signed in to the console as yourself.`;
+        case "declined":
+            return `The connection was declined, so nothing was connected. Run ${again} again to start over.`;
+        case "other_org":
+            return `That ${n} account is connected to another Promigence organization. Disconnect it there first (\`promigence ${host} disconnect\` with that organization's key), then run ${again} again.`;
+        case "needs_admin":
+            return `Connect it signed in to ${n} as an owner (admin) of that account, or ask one of its owners to; then run ${again} again.`;
+        case "not_installer":
+            return `The ${n} user who installed the App on that account can connect it now; an owner of the account can 15 minutes after the install. Then run ${again} again.`;
+        default:
+            return `Run ${again} again. If it fails the same way, write to support@promigence.ai with the time it happened.`;
+    }
+}
+export async function consoleConnect(ctx, host, o) {
+    const n = NAMES[host];
+    const url = o.ticket.connect_url;
+    const opened = bool(ctx, "--no-open") || headless() ? false : openBrowser(url);
+    const noWait = bool(ctx, "--no-wait");
+    if (ctx.mode === "json") {
+        await write(process.stderr, jsonLine(process.stderr, {
+            hint: "connect_url", connect_url: url, request_id: o.ticket.request_id, expires_at: o.ticket.expires_at, opened,
+        }));
+    }
+    else {
+        await write(process.stderr, [
+            opened
+                ? `Opening the Promigence console to connect ${n}…`
+                : `Open this page in a browser where you are signed in to the Promigence console (any device works):`,
+            `  ${opened ? "If it did not open: " : ""}${url}`,
+            host === "github"
+                ? "  It starts the connection on GitHub, where you choose the account, and all repositories or only the ones you pick."
+                : "  It starts the connection on GitLab, where you approve read-only access.",
+            "  The page works once, within 5 minutes, and only signed in to the console as you, an owner of this organization: keep it to yourself.",
+            ...(noWait ? [] : [`  Waiting up to ${o.waitText} (Ctrl-C stops waiting; the connection still finishes in the browser).`]),
+        ].join("\n") + "\n");
+    }
+    if (noWait) {
+        const next = nexts([`promigence ${host} status`, "once it is done: the connection"]);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: url, request_id: o.ticket.request_id, expires_at: o.ticket.expires_at, opened, waited: false, connected: [],
+        }, next), [`connect page: ${url}`, `  next: ${next[0].cmd}`], 0, ctx.pointer);
+    }
+    const t0 = Date.now();
+    let said = "";
+    for (;;) {
+        await sleep(Math.min(o.pollMs, Math.max(0, o.bound - (Date.now() - t0))));
+        const r = await o.poll();
+        if (r.state !== "pending")
+            return finish(ctx, host, r, { url, opened, waitedMs: Date.now() - t0, ...o });
+        if (r.message !== said && ctx.mode !== "json") {
+            said = r.message;
+            await write(process.stderr, `  ${r.message}\n`);
+        }
+        if (Date.now() - t0 >= o.bound) {
+            throw new PromigenceError({
+                code: "timeout",
+                message: `no ${n} connection finished within ${o.waitText}`,
+                fix: `Finish it in the browser if it is still open, then \`promigence ${host} status\`. Otherwise run \`promigence ${host} connect\` again for a new page (each works once, within 5 minutes).`,
+                exitCode: 11,
+            });
+        }
+    }
+}
+async function finish(ctx, host, r, o) {
+    const n = NAMES[host];
+    if (CONNECTED.has(r.state)) {
+        const connected = await o.connections(r);
+        const next = nexts(...o.okNext);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: o.url, opened: o.opened, waited: true, waited_ms: o.waitedMs, state: r.state, request: r, connected,
+        }, next), [endLine(host, r), `  ${r.message}`, `  next: ${next[0].cmd}`], 0, ctx.pointer);
+    }
+    if (r.state === "pending_provider_approval") {
+        const next = nexts([`promigence ${host} connect`, `once an owner of the account approved it on ${n}`]);
+        const line = `waiting for an owner of ${r.account ?? "that account"} to approve it on ${n}; run \`promigence ${host} connect\` again after`;
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: o.url, opened: o.opened, waited: true, waited_ms: o.waitedMs, state: r.state, request: r, connected: [],
+        }, next), [line, `  ${r.message}`], 0, ctx.pointer);
+    }
+    if (r.state === "expired") {
+        throw new PromigenceError({
+            code: "timeout",
+            message: r.message,
+            fix: `Nothing was connected. Run \`promigence ${host} connect\` again and finish it in the browser: the page works within 5 minutes, the connection within 15.`,
+            exitCode: 11,
+        });
+    }
+    throw new PromigenceError({ code: "not_connected", message: `${r.state}: ${r.message}`, fix: fixFor(host, r), exitCode: 7 });
+}

package/dist/devcontainer.d.ts

@@ -68,6 +68,7 @@ export interface Plan {
     tierReason: string | undefined;
     ignored: IgnoredProperty[];
     notes: string[];
+    localEnvBaked?: string[];
 }
 export interface TranslateOptions {
     workspaceRoot: string;
@@ -82,6 +83,7 @@ export declare function sizeGib(v: unknown, field: string, file: string): number
 export declare function lifecycleSteps(v: unknown, field: string, ctx: SubstitutionContext, file: string): LifecycleStep[];
 export declare function shellQuote(s: string): string;
 export declare function wrapCommand(plan: Plan, command: string): string;
+export declare function snapshotEnv(plan: Plan): Record<string, string> | undefined;
 export interface SetupOptions {
     repo?: string | undefined;
     commit?: string | undefined;

package/dist/devcontainer.js

@@ -270,8 +270,8 @@ export function substituteString(input, ctx) {
                 if (!ctx.allowContainerEnv) {
                     throw refuse("container_env_scope", `\${containerEnv:…} in ${ctx.property}: the spec defines it for remoteEnv only`, "Move the value into remoteEnv, or write it out literally.", ctx.file);
                 }
-                const [key, fallback] = splitDefault(arg ?? "");
-                return ctx.containerEnv[key] ?? fallback;
+                const [key] = splitDefault(arg ?? "");
+                return ctx.containerEnv[key] ?? whole;
             }
             default: return whole;
         }
@@ -368,7 +368,7 @@ export function translate(loaded, opts) {
     const remoteEnv = stringMap(raw["remoteEnv"], "remoteEnv", file, (s, p) => substituteString(s, ctxFor(p, containerEnv, true)));
     const env = { ...containerEnv, ...remoteEnv };
     if (Object.keys(remoteEnv).length) {
-        notes.push("remoteEnv is applied the same way as containerEnv: both end up in the environment your commands run in");
+        notes.push("remoteEnv is applied the same way as containerEnv: both are set for every command, terminal and SSH session in the snapshot's sandboxes");
     }
     let source;
     if (opts.imageOverride === undefined) {
@@ -468,6 +468,7 @@ export function translate(loaded, opts) {
         tierReason,
         ignored,
         notes,
+        ...(readFromHost.size > 0 ? { localEnvBaked: [...readFromHost].sort() } : {}),
     };
 }
 function refuseFeatures(raw, file) {
@@ -675,20 +676,14 @@ export function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 export function wrapCommand(plan, command) {
-    const exports = Object.entries(plan.env).map(([k, v]) => `${k}=${shellQuote(v)}`);
-    const inner = [
-        `cd ${shellQuote(plan.workspaceFolder)}`,
-        ...(exports.length ? [`export ${exports.join(" ")}`] : []),
-        command,
-    ].join(" && ");
+    const inner = [`cd ${shellQuote(plan.workspaceFolder)}`, command].join(" && ");
     return plan.user === undefined || plan.user === "root" ? inner : `su ${plan.user} -c ${shellQuote(inner)}`;
 }
+export function snapshotEnv(plan) {
+    return Object.keys(plan.env).length ? { ...plan.env } : undefined;
+}
 export function planSetup(plan, opts = {}) {
     const steps = [];
-    const envLines = Object.entries(plan.env).map(([k, v]) => shellQuote(`${k}=${v}`));
-    if (envLines.length) {
-        steps.push(`printf '%s\\n' ${envLines.join(" ")} >> /etc/environment`);
-    }
     if (opts.repo && opts.commit) {
         const ws = shellQuote(plan.workspaceFolder);
         const clone = [

package/dist/dirsnap.js

@@ -1,19 +1,19 @@
 import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { closeSync, fstatSync, lstatSync, mkdtempSync, openSync, readSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { closeSync, fstatSync, lstatSync, mkdtempSync, openSync, readSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, join, resolve } from "node:path";
-import { DEFAULT_SNAPSHOT, FILE_PUT_CHUNK_BYTES, PromigenceError } from "./sdk/index.js";
+import { basename, join, resolve, sep } from "node:path";
+import { DEFAULT_SNAPSHOT, FILE_PUT_CHUNK_BYTES, PromigenceError, secretLike } from "./sdk/index.js";
 import { bool, client, list, nexts, str, waitBound } from "./commands.js";
 import { emit, okEnvelope, parseDuration, usageError, write } from "./io.js";
 import { jsonLine, sh } from "./term.js";
+import { CREDENTIAL_REMEDY, confirmOverride, credentialRefusal, emitUploadList, localTarNoMetadataArgs } from "./uploadguard.js";
 const BASE_WORKSPACE = "/work";
 export const DIR_SANDBOX_TIMEOUT_DEFAULT = "30m";
 const STEP_TIMEOUT_MS = 30 * 60_000;
 const STEP_OUTPUT_BYTES = 256 * 1024;
 const FAILED_TAIL_LINES = 20;
 const PROGRESS_FROM_BYTES = 8 * 1024 * 1024;
-const SECRETS_NAMED = 10;
 const INTERRUPT_START_WAIT_MS = 15_000;
 const INTERRUPTED = {
     ended: () => "The build sandbox was ended.",
@@ -28,29 +28,7 @@ const NOT_WITH_DIR = [
     "--devcontainer", "--start", "--cpu-class", "--grade", "--holdout", "--grade-score", "--grade-timeout",
     "--grade-output", "--tier",
 ];
-const ENV_TEMPLATE = /^\.env\.(example|sample|template|dist|defaults)$/i;
-const SECRET_NAMES = [
-    /^\.env$/i, /^\.env\..+$/i, /\.env$/i, /^\.envrc$/i, /^\.dev\.vars$/i,
-    /\.(pem|key|p12|pfx|jks|keystore)$/i,
-    /^id_(rsa|ed25519|ecdsa|dsa)(?!.*\.pub$)/i,
-    /^\.npmrc$/i, /^\.pypirc$/i, /^\.netrc$/i, /^\.git-credentials$/i,
-    /^credentials$/i, /^credentials\.json$/i, /credentials.*\.json$/i, /^service-account.*\.json$/i,
-    /\.tfstate$/i, /\.tfstate\..+$/i, /\.tfvars(\.json)?$/i, /^kubeconfig$/i,
-    /^\.htpasswd$/i, /^secrets\.ya?ml$/i,
-];
-const SECRET_DIRS = new Set([".aws", ".ssh", ".gnupg"]);
-const SECRET_PATHS = [/(^|\/)\.docker\/config\.json$/i, /(^|\/)\.kube\/config$/i];
-export function secretLike(path) {
-    const parts = path.split("/").filter(Boolean);
-    const name = parts[parts.length - 1] ?? "";
-    if (parts.slice(0, -1).some((d) => SECRET_DIRS.has(d)))
-        return true;
-    if (SECRET_PATHS.some((re) => re.test(path)))
-        return true;
-    if (ENV_TEMPLATE.test(name))
-        return false;
-    return SECRET_NAMES.some((re) => re.test(name));
-}
+export { secretLike };
 function git(dir, args) {
     const r = spawnSync("git", ["-C", dir, ...args], { encoding: "buffer", maxBuffer: 512 * 1024 * 1024 });
     if (r.error && r.error.code === "ENOENT")
@@ -70,12 +48,38 @@ export function listTreeFiles(dir, opts = {}) {
         throw usageError(`git ls-files failed in ${dir}: ${tracked.err.trim()}`, "Check the repository with `git status`.");
     const seen = new Set();
     const files = [];
+    const outside = [];
     let missing = 0;
     let bytes = 0;
+    const realRoot = realpathSync(dir);
+    const linkedDirs = new Map();
+    const throughLink = (p) => {
+        const parts = p.split("/");
+        for (let i = 1; i < parts.length; i++) {
+            const d = parts.slice(0, i).join("/");
+            let linked = linkedDirs.get(d);
+            if (linked === undefined) {
+                try {
+                    linked = !lstatSync(join(dir, d)).isDirectory();
+                }
+                catch {
+                    linked = false;
+                }
+                linkedDirs.set(d, linked);
+            }
+            if (linked)
+                return true;
+        }
+        return false;
+    };
     const take = (p) => {
         if (!p || seen.has(p))
             return false;
         seen.add(p);
+        if (throughLink(p)) {
+            outside.push(p);
+            return false;
+        }
         let st;
         try {
             st = lstatSync(join(dir, p));
@@ -86,6 +90,20 @@ export function listTreeFiles(dir, opts = {}) {
         }
         if (st.isDirectory())
             return false;
+        if (!st.isSymbolicLink()) {
+            let real;
+            try {
+                real = realpathSync(join(dir, p));
+            }
+            catch {
+                missing += 1;
+                return false;
+            }
+            if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+                outside.push(p);
+                return false;
+            }
+        }
         files.push(p);
         if (st.isFile())
             bytes += st.size;
@@ -103,15 +121,13 @@ export function listTreeFiles(dir, opts = {}) {
                 untracked += 1;
     }
     files.sort();
-    return { files, missing, untracked, bytes };
+    outside.sort();
+    return { files, missing, untracked, bytes, outside };
 }
 export function refuseSecrets(files, allow) {
     const hits = files.filter(secretLike);
-    if (hits.length && !allow) {
-        const named = hits.slice(0, SECRETS_NAMED).join(", ");
-        const more = hits.length > SECRETS_NAMED ? ` and ${hits.length - SECRETS_NAMED} more` : "";
-        throw usageError(`${hits.length} file${hits.length === 1 ? " looks" : "s look"} like ${hits.length === 1 ? "a credential" : "credentials"} and ${hits.length === 1 ? "was" : "were"} not uploaded: ${named}${more}; nothing was created`, "A snapshot keeps every file it holds, and every sandbox started from it has them. Remove them from git (`git rm --cached FILE` and add them to .gitignore), pass the values as secrets (`promigence secrets set`), or pass --allow-secrets if they are not real credentials.");
-    }
+    if (hits.length && !allow)
+        throw credentialRefusal(hits, CREDENTIAL_REMEDY.dir);
     return hits;
 }
 export function human(n) {
@@ -130,7 +146,7 @@ export function packFiles(dir, files, out) {
     const listPath = `${out}.list`;
     writeFileSync(listPath, files.join("\0") + (files.length ? "\0" : ""));
     try {
-        const r = spawnSync("tar", ["-c", "-f", out, "-C", dir, "--no-recursion", "--null", "-T", listPath], {
+        const r = spawnSync("tar", ["-c", "-f", out, ...localTarNoMetadataArgs(), "-C", dir, "--no-recursion", "--null", "-T", listPath], {
             encoding: "utf8", env: { ...process.env, COPYFILE_DISABLE: "1" },
         });
         if (r.error && r.error.code === "ENOENT") {
@@ -172,7 +188,19 @@ export async function dirSnapshotCreate(ctx) {
     if (!listing.files.length) {
         throw usageError(`nothing to upload: git tracks no file in ${dirArg}`, "`git add` the files first, or pass --include-untracked for files git does not ignore.");
     }
-    const allowed = refuseSecrets(listing.files, bool(ctx, "--allow-secrets"));
+    if (bool(ctx, "--list-files")) {
+        return emitUploadList(ctx, {
+            kind: "dir", root: dirArg, paths: listing.files, files: listing.files.length, bytes: listing.bytes,
+            secrets: listing.files.filter(secretLike),
+            notes: listing.outside.length
+                ? [`Left out ${listing.outside.length} path${listing.outside.length === 1 ? "" : "s"} under a directory that is now a link or outside ${dirArg}: ${listing.outside.slice(0, 10).join(", ")}${listing.outside.length > 10 ? ` and ${listing.outside.length - 10} more` : ""}.`]
+                : [],
+        });
+    }
+    const allowed = await confirmOverride(ctx, {
+        flag: "--allow-secrets", what: "files that look like credentials",
+        items: refuseSecrets(listing.files, bool(ctx, "--allow-secrets")),
+    });
     const from = str(ctx, "--from") ?? DEFAULT_SNAPSHOT;
     const alias = str(ctx, "--alias");
     const setup = list(ctx, "--setup");
@@ -192,7 +220,8 @@ export async function dirSnapshotCreate(ctx) {
     await write(process.stderr, ctx.mode === "json"
         ? jsonLine(process.stderr, { hint: "price", ...priceFields, unit: "USD" })
         : `price: the sandbox is billed per second while the upload and setup run (~$${perMin.toFixed(4)}/min at tier ${q.tier}, at most $${q.max_cost.toFixed(2)} for its ${Math.round(timeoutMs / 60_000)} min limit); the snapshot itself is not charged\n` +
-            `  uploading ${listing.files.length} file${listing.files.length === 1 ? "" : "s"} (${human(listing.bytes)}) from ${dirArg}${listing.untracked ? `, ${listing.untracked} untracked` : ""}${listing.missing ? `; ${listing.missing} deleted in the working tree, skipped` : ""}${allowed.length ? `; ${allowed.length} secret-looking, allowed by --allow-secrets` : ""}\n`);
+            `  uploading ${listing.files.length} file${listing.files.length === 1 ? "" : "s"} (${human(listing.bytes)}) from ${dirArg}${listing.untracked ? `, ${listing.untracked} untracked` : ""}${listing.missing ? `; ${listing.missing} deleted in the working tree, skipped` : ""}${allowed.length ? `; ${allowed.length} secret-looking, allowed by --allow-secrets` : ""}\n` +
+            (listing.outside.length ? `  skipped ${listing.outside.length} under a directory that is now a link or outside ${dirArg}: ${listing.outside.slice(0, 10).join(", ")}${listing.outside.length > 10 ? " ..." : ""}\n` : ""));
     const scratchDir = mkdtempSync(join(tmpdir(), "promigence-dir-"));
     const tarPath = join(scratchDir, "tree.tar");
     let runId;
@@ -331,6 +360,8 @@ export async function dirSnapshotCreate(ctx) {
         snapshot_id: result.snapshot_id,
         alias: result.alias,
         source: { kind: "dir", dir: dirArg, files: listing.files.length, untracked: listing.untracked, bytes: listing.bytes, packed_bytes: result.packed },
+        ...(allowed.length ? { secret_files_allowed: allowed } : {}),
+        ...(listing.outside.length ? { skipped_outside: listing.outside } : {}),
         from,
         workspace: result.workspace,
         setup,

package/dist/generated.d.ts

@@ -32,3 +32,4 @@ export declare const PRICING: {
     readonly granularity_seconds: 1;
     readonly interim_interval_seconds: 60;
 };
+export declare const SANDBOX_STATES: readonly ["queued", "awaiting_capacity", "ready", "running", "paused", "ended"];