release-skill 0.1.1 → 0.1.4

package/src/snapshot/frozen.mjs

@@ -169,14 +169,66 @@ export async function verifyFrozenDirectoryStructure(directory, label = 'frozen
   await walk(directory);
 }
 
-export async function verifyFrozenGitRepository({ root, gitObjectDir, commit, tree, exec = execFile }) {
+/**
+ * Verify an already-frozen Git object directory against the plan.
+ *
+ * Consumption only: this never rebuilds objects and never reads the wall
+ * clock. When `commitTimestamp` (the plan's `frozenSnapshot.commitTimestamp`)
+ * is provided, the frozen commit's real `%aI`/`%cI` dates must match it
+ * exactly, so a commit carrying any other author/committer time can never
+ * pass pre-publish verification.
+ */
+export async function verifyFrozenGitRepository({
+  root,
+  gitObjectDir,
+  commit,
+  tree,
+  parentCommit,
+  commitTimestamp,
+  exec = execFile,
+}) {
   const gitDir = await resolveFrozenPath(root, gitObjectDir, 'frozen git object directory');
   await verifyFrozenDirectoryStructure(gitDir, 'frozen git object directory');
   const { stdout } = await exec('git', ['--git-dir', gitDir, 'rev-parse', `${commit}^{tree}`], { shell: false });
   if (stdout.trim() !== tree) {
     throw frozenError('frozen git object tree mismatch', { commit, expectedTree: tree, observedTree: stdout.trim() });
   }
-  return { gitDir, commit, tree };
+  if (commitTimestamp !== undefined) {
+    const expectedTimestamp = normalizeGitTimestamp(commitTimestamp, 'frozen commit timestamp');
+    const { stdout: datesOut } = await exec(
+      'git',
+      ['--git-dir', gitDir, 'show', '-s', '--format=%aI%n%cI', commit],
+      { shell: false },
+    );
+    const [authorDate, committerDate] = datesOut.trim().split('\n');
+    if (authorDate !== expectedTimestamp || committerDate !== expectedTimestamp) {
+      throw frozenError('frozen git commit dates do not match the plan freeze timestamp', {
+        commit,
+        expectedTimestamp,
+        observedAuthorDate: authorDate,
+        observedCommitterDate: committerDate,
+      });
+    }
+  }
+  if (parentCommit) {
+    if (!/^[a-f0-9]{40,64}$/.test(parentCommit)) {
+      throw frozenError('frozen Git parent must be a full hexadecimal object id');
+    }
+    const { stdout: parentsOut } = await exec(
+      'git',
+      ['--git-dir', gitDir, 'rev-list', '--parents', '-n', '1', commit],
+      { shell: false },
+    );
+    const [observedCommit, ...parents] = parentsOut.trim().split(/\s+/);
+    if (observedCommit !== commit || parents.length !== 1 || parents[0] !== parentCommit) {
+      throw frozenError('frozen Git commit parent mismatch', {
+        commit,
+        expectedParent: parentCommit,
+        observedParents: parents,
+      });
+    }
+  }
+  return { gitDir, commit, tree, ...(parentCommit ? { parentCommit } : {}) };
 }
 
 async function verifyGitTreeContent({ snapshotDir, repositoryDir, commit, expectedSnapshotDigest, exec }) {
@@ -224,10 +276,154 @@ async function verifyGitTreeContent({ snapshotDir, repositoryDir, commit, expect
   }
 }
 
-export async function buildFrozenGitRepository({ snapshotDir, repositoryDir, version, expectedSnapshotDigest, exec = execFile }) {
+/**
+ * Strict ISO 8601 timestamp with an explicit UTC offset (Z or ±HH:MM),
+ * optional fractional seconds. Naive/local timestamps (no offset) are rejected
+ * so the frozen commit time is never interpreted in the builder's local zone.
+ */
+const GIT_ISO8601_STRICT_RE =
+  /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,9})?(Z|[+-]\d{2}:\d{2})$/;
+
+/**
+ * Validate and canonicalize a plan freeze timestamp.
+ *
+ * The value must be a non-empty, strict ISO 8601 timestamp with an explicit UTC
+ * offset and a parseable calendar date. It is normalized to UTC with second
+ * precision and a `+00:00` offset, which is exactly the form Git stores and
+ * re-emits via `%aI`/`%cI`. Missing, empty, malformed, or out-of-range values
+ * throw a closed `GATE_FAILED` error.
+ *
+ * Normalization is idempotent: re-normalizing an already-canonical value returns
+ * the identical string, so prepare and the Git builder always agree byte-for-byte.
+ *
+ * @param {unknown} value - Candidate timestamp.
+ * @param {string} [label] - Label used in error messages.
+ * @returns {string} Canonical `YYYY-MM-DDTHH:MM:SS+00:00` timestamp.
+ * @throws {ReleaseError} GATE_FAILED when the value is not a valid timestamp.
+ */
+export function normalizeGitTimestamp(value, label = 'freeze timestamp') {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw frozenError(`${label} must be a non-empty strict ISO 8601 timestamp string`, {
+      received: typeof value === 'string' ? value : typeof value,
+    });
+  }
+  const trimmed = value.trim();
+  const match = GIT_ISO8601_STRICT_RE.exec(trimmed);
+  if (!match) {
+    throw frozenError(`${label} must be strict ISO 8601 with an explicit UTC offset`, {
+      received: trimmed,
+    });
+  }
+  const [, yearStr, monthStr, dayStr, hourStr, minuteStr, secondStr, zone] = match;
+  const inputYear = Number(yearStr);
+  const inputMonth = Number(monthStr);
+  const inputDay = Number(dayStr);
+  const inputHour = Number(hourStr);
+  const inputMinute = Number(minuteStr);
+  const inputSecond = Number(secondStr);
+  if (inputYear < 1000 || inputYear > 9999) {
+    throw frozenError(`${label} year must be a four-digit ISO year`, { received: trimmed });
+  }
+  // Reject impossible calendar dates and out-of-range time fields. Date.UTC
+  // silently rolls values over (Feb 30 -> Mar 2), so compare the constructed
+  // UTC fields against the declared input fields instead of trusting parsing.
+  const probeMs = Date.UTC(inputYear, inputMonth - 1, inputDay, inputHour, inputMinute, inputSecond);
+  const probe = new Date(probeMs);
+  if (
+    probe.getUTCFullYear() !== inputYear || probe.getUTCMonth() !== inputMonth - 1 ||
+    probe.getUTCDate() !== inputDay || probe.getUTCHours() !== inputHour ||
+    probe.getUTCMinutes() !== inputMinute || probe.getUTCSeconds() !== inputSecond
+  ) {
+    throw frozenError(`${label} is not a valid calendar date`, { received: trimmed });
+  }
+  let offsetMs = 0;
+  if (zone !== 'Z') {
+    const sign = zone.startsWith('-') ? -1 : 1;
+    const zoneHours = Number(zone.slice(1, 3));
+    const zoneMinutes = Number(zone.slice(4, 6));
+    if (zoneHours > 23 || zoneMinutes > 59) {
+      throw frozenError(`${label} has an invalid UTC offset`, { received: trimmed });
+    }
+    offsetMs = sign * (zoneHours * 60 + zoneMinutes) * 60_000;
+  }
+  const date = new Date(probeMs - offsetMs);
+  if (date.getUTCFullYear() < 1000 || date.getUTCFullYear() > 9999) {
+    throw frozenError(`${label} normalizes outside the four-digit ISO year range`, { received: trimmed });
+  }
+  const pad = (num) => String(num).padStart(2, '0');
+  return `${date.getUTCFullYear()}-${pad(date.getUTCMonth() + 1)}-${pad(date.getUTCDate())}` +
+    `T${pad(date.getUTCHours())}:${pad(date.getUTCMinutes())}:${pad(date.getUTCSeconds())}+00:00`;
+}
+
+function publicGitRemote({ repo, githubHost = 'github.com' }) {
+  if (typeof repo !== 'string' || !/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(repo)) {
+    throw frozenError('Git parent repo must use owner/name format');
+  }
+  if (
+    typeof githubHost !== 'string' || !/^[A-Za-z0-9.-]+$/.test(githubHost) ||
+    githubHost.startsWith('.') || githubHost.endsWith('.') || githubHost.includes('..')
+  ) {
+    throw frozenError('Git parent githubHost must be a valid hostname');
+  }
+  return `https://${githubHost}/${repo}.git`;
+}
+
+/**
+ * Build the frozen release Git objects for a sealed public snapshot.
+ *
+ * `commitTimestamp` is the plan freeze timestamp sampled exactly once during
+ * production prepare. It is strictly validated BEFORE any filesystem or Git
+ * write (missing, empty, malformed, or impossible values fail closed), then
+ * written verbatim to both GIT_AUTHOR_DATE and GIT_COMMITTER_DATE, so the
+ * frozen commit's `%aI` and `%cI` always equal the plan's
+ * `frozenSnapshot.commitTimestamp` byte-for-byte. Identical inputs therefore
+ * yield identical tree and commit identifiers, and a different freeze
+ * timestamp alone yields a different commit with an identical tree.
+ */
+export async function buildFrozenGitRepository({
+  snapshotDir,
+  repositoryDir,
+  version,
+  expectedSnapshotDigest,
+  parent,
+  commitTimestamp,
+  exec = execFile,
+}) {
+  // Fail closed before creating the object directory or running any Git
+  // command: a frozen release commit may never inherit the builder's wall
+  // clock, an ancient constant, or a value Git would reinterpret.
+  const canonicalTimestamp = normalizeGitTimestamp(commitTimestamp, 'frozen commit timestamp');
   if (!expectedSnapshotDigest) throw frozenError('Git object build requires the sealed snapshot digest');
   await mkdir(repositoryDir, { recursive: true });
   await exec('git', ['init', '--bare', repositoryDir], { shell: false });
+  let parentCommit = null;
+  if (parent) {
+    if (!parent.ref || typeof parent.ref !== 'string') {
+      throw frozenError('Git parent ref must be a non-empty string');
+    }
+    if (!parent.commit || !/^[a-f0-9]{40,64}$/.test(parent.commit)) {
+      throw frozenError('Git parent commit must be a full hexadecimal object id');
+    }
+    const remoteUrl = publicGitRemote(parent);
+    await exec(
+      'git',
+      ['--git-dir', repositoryDir, 'fetch', '--no-tags', remoteUrl, parent.ref],
+      { shell: false },
+    );
+    const { stdout: fetchedOut } = await exec(
+      'git',
+      ['--git-dir', repositoryDir, 'rev-parse', 'FETCH_HEAD^{commit}'],
+      { shell: false },
+    );
+    if (fetchedOut.trim() !== parent.commit) {
+      throw frozenError('fetched Git parent does not match the observed public baseline', {
+        expectedCommit: parent.commit,
+        observedCommit: fetchedOut.trim(),
+        ref: parent.ref,
+      });
+    }
+    parentCommit = parent.commit;
+  }
   const indexPath = join(repositoryDir, 'release-index');
   const env = { ...process.env, GIT_INDEX_FILE: indexPath };
   await exec('git', [
@@ -246,17 +442,35 @@ export async function buildFrozenGitRepository({ snapshotDir, repositoryDir, ver
     GIT_AUTHOR_EMAIL: 'release-skill@localhost',
     GIT_COMMITTER_NAME: 'release-skill',
     GIT_COMMITTER_EMAIL: 'release-skill@localhost',
-    GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',
-    GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',
+    GIT_AUTHOR_DATE: canonicalTimestamp,
+    GIT_COMMITTER_DATE: canonicalTimestamp,
   };
+  const commitArgs = ['--git-dir', repositoryDir, 'commit-tree', tree];
+  if (parentCommit) commitArgs.push('-p', parentCommit);
+  commitArgs.push('-m', `Release ${version}`);
   const { stdout: commitOut } = await exec(
     'git',
-    ['--git-dir', repositoryDir, 'commit-tree', tree, '-m', `Release ${version}`],
+    commitArgs,
     { env: commitEnv, shell: false },
   );
   const commit = commitOut.trim();
   await verifyGitTreeContent({ snapshotDir, repositoryDir, commit, expectedSnapshotDigest, exec });
-  return { tree, commit };
+  if (parentCommit) {
+    const { stdout: parentsOut } = await exec(
+      'git',
+      ['--git-dir', repositoryDir, 'rev-list', '--parents', '-n', '1', commit],
+      { shell: false },
+    );
+    const [observedCommit, ...parents] = parentsOut.trim().split(/\s+/);
+    if (observedCommit !== commit || parents.length !== 1 || parents[0] !== parentCommit) {
+      throw frozenError('derived Git commit does not have the exact planned parent', {
+        commit,
+        parentCommit,
+        observedParents: parents,
+      });
+    }
+  }
+  return { tree, commit, ...(parentCommit ? { parentCommit } : {}) };
 }
 
 function contentEntries(entries) {

package/src/snapshot/public-map.mjs

@@ -281,6 +281,7 @@ export function normalizePublicMappings({ unit } = {}) {
   return Object.freeze(
     unit.publicFiles.map((mapping) => {
       const from = canonicalPublicPath(mapping.from).path;
+      const sourceScope = mapping.sourceScope ?? 'unit';
       if (isReservedReleaseControlPath(from)) {
         throw new ReleaseError(
           PUBLIC_PATH_FORBIDDEN,
@@ -291,7 +292,7 @@ export function normalizePublicMappings({ unit } = {}) {
       const sourceRelative = posix.relative(sourcePrefix, from);
 
       // Reject `from` paths that escape `unit.source`.
-      if (sourceRelative.startsWith('../') || sourceRelative === '..') {
+      if (sourceScope === 'unit' && (sourceRelative.startsWith('../') || sourceRelative === '..')) {
         throw new ReleaseError(
           PUBLIC_PATH_FORBIDDEN,
           `public file "${mapping.from}" is outside unit source "${unit.source}"`,
@@ -301,6 +302,7 @@ export function normalizePublicMappings({ unit } = {}) {
 
       return Object.freeze({
         from,
+        sourceScope,
         sourceRelative,
         to: canonicalPublicPath(mapping.to).path,
         mode: mapping.mode,
@@ -576,7 +578,7 @@ export async function buildPublicStaging({
         continue;
       }
       // Also check real containment inside unit root
-      if (!isContained(realUnitRoot, realSrc)) {
+      if (mapping.sourceScope === 'unit' && !isContained(realUnitRoot, realSrc)) {
         preflightRecords.push({
           ok: false,
           err: new ReleaseError(
@@ -988,7 +990,8 @@ export async function buildPublicStaging({
         );
       }
 
-      // Verify realpath of the handle is inside both realSourceRoot and realUnitRoot.
+      // Verify realpath of the handle is inside the workspace and, for the
+      // default unit scope, inside the unit root as well.
       // This catches a race between preflight and open where a component
       // was replaced with a symlink.
       const handleRealPath = await fs.realpath(srcPath, { stage: 'source-open-realpath' });
@@ -999,7 +1002,7 @@ export async function buildPublicStaging({
           { from: mapping.from, realPath: handleRealPath },
         );
       }
-      if (!isContained(realUnitRoot, handleRealPath)) {
+      if (mapping.sourceScope === 'unit' && !isContained(realUnitRoot, handleRealPath)) {
         throw new ReleaseError(
           SNAPSHOT_FIDELITY_FAILED,
           `source escapes unitRoot containment after open: "${mapping.from}"`,

package/src/snapshot/scan.mjs

@@ -49,7 +49,8 @@ const BINARY_PROBE_SIZE = 8192;
  */
 const ABSOLUTE_PATH_PATTERNS = [
   /\/(?:Users|home)\/[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[^\s"'`<>]*)?/,
-  /\/(?:root|tmp)\/[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[^\s"'`<>]*)?/,
+  /\/root\/[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[^\s"'`<>]*)?/,
+  /\/tmp\/(?=[^\s"'`<>]*(?:secret|token|credential|password|private[-_]?key|id_rsa))[^\s"'`<>]+/i,
   /(?:^|[^A-Za-z0-9_])[A-Za-z]:\\[A-Za-z0-9_$-][A-Za-z0-9._$-]*(?:\\[^\s"'`<>]*)?/,
 ];