salmon-loop 0.2.3

package/dist/cli/utils/safe-fs.js

@@ -0,0 +1,184 @@
+import * as fsPromises from 'fs/promises';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ensureInSandbox, safeJoin } from '../../core/facades/cli-utils-path.js';
+function resolvePath(targetPath, rootContext) {
+    if (!rootContext)
+        return targetPath;
+    // Allow passing either absolute paths or paths relative to the root context.
+    const candidate = targetPath.startsWith(rootContext)
+        ? targetPath
+        : safeJoin(rootContext, targetPath);
+    ensureInSandbox(rootContext, candidate);
+    return path.resolve(candidate);
+}
+async function resolveRealRoot(rootContext) {
+    try {
+        return await fsPromises.realpath(rootContext);
+    }
+    catch {
+        return path.resolve(rootContext);
+    }
+}
+function resolveRealRootSync(rootContext) {
+    try {
+        return fs.realpathSync(rootContext);
+    }
+    catch {
+        return path.resolve(rootContext);
+    }
+}
+async function assertNoSymlinkEscape(resolvedPath, rootContext) {
+    if (!rootContext)
+        return;
+    const [realRoot, realTarget] = await Promise.all([
+        resolveRealRoot(rootContext),
+        fsPromises.realpath(resolvedPath),
+    ]);
+    ensureInSandbox(realRoot, realTarget);
+}
+function assertNoSymlinkEscapeSync(resolvedPath, rootContext) {
+    if (!rootContext)
+        return;
+    const realRoot = resolveRealRootSync(rootContext);
+    const realTarget = fs.realpathSync(resolvedPath);
+    ensureInSandbox(realRoot, realTarget);
+}
+async function assertParentInSandbox(resolvedPath, rootContext) {
+    if (!rootContext)
+        return;
+    if (!fs.existsSync(rootContext))
+        return;
+    const realRoot = await resolveRealRoot(rootContext);
+    let current = path.dirname(resolvedPath);
+    let depth = 0;
+    while (depth < 40) {
+        try {
+            const realParent = await fsPromises.realpath(current);
+            ensureInSandbox(realRoot, realParent);
+            return;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error && error.code !== 'ENOENT')
+                throw error;
+            const next = path.dirname(current);
+            if (next === current) {
+                throw error;
+            }
+            current = next;
+            depth += 1;
+        }
+    }
+    throw new Error(`Security Violation: Parent directory ascent exceeded limit for: ${resolvedPath}`);
+}
+async function assertNotSymlink(resolvedPath) {
+    try {
+        const stats = await fsPromises.lstat(resolvedPath);
+        if (stats.isSymbolicLink()) {
+            throw new Error(`Security Violation: Refusing to follow symlink: ${resolvedPath}`);
+        }
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+}
+export function existsSync(targetPath, rootContext) {
+    try {
+        const resolved = resolvePath(targetPath, rootContext);
+        if (!fs.existsSync(resolved))
+            return false;
+        assertNoSymlinkEscapeSync(resolved, rootContext);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function stat(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    await assertNoSymlinkEscape(resolved, rootContext);
+    return fsPromises.stat(resolved);
+}
+export function statSync(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    assertNoSymlinkEscapeSync(resolved, rootContext);
+    return fs.statSync(resolved);
+}
+export async function readdirDirents(dirPath, rootContext) {
+    const resolved = resolvePath(dirPath, rootContext);
+    await assertNoSymlinkEscape(resolved, rootContext);
+    return fsPromises.readdir(resolved, { withFileTypes: true });
+}
+export function readdirDirentsSync(dirPath, rootContext) {
+    const resolved = resolvePath(dirPath, rootContext);
+    assertNoSymlinkEscapeSync(resolved, rootContext);
+    return fs.readdirSync(resolved, { withFileTypes: true });
+}
+export async function readdir(dirPath, rootContext) {
+    const resolved = resolvePath(dirPath, rootContext);
+    await assertNoSymlinkEscape(resolved, rootContext);
+    return fsPromises.readdir(resolved);
+}
+export async function readFileUtf8(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    await assertNoSymlinkEscape(resolved, rootContext);
+    return fsPromises.readFile(resolved, 'utf-8');
+}
+export function readFileUtf8Sync(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    assertNoSymlinkEscapeSync(resolved, rootContext);
+    return fs.readFileSync(resolved, 'utf-8');
+}
+export async function mkdirp(dirPath, rootContext) {
+    const resolved = resolvePath(dirPath, rootContext);
+    await assertParentInSandbox(resolved, rootContext);
+    await fsPromises.mkdir(resolved, { recursive: true });
+}
+export async function unlink(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    await assertParentInSandbox(resolved, rootContext);
+    await fsPromises.unlink(resolved);
+}
+export async function writeFileUtf8(targetPath, content, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    await assertParentInSandbox(resolved, rootContext);
+    await assertNotSymlink(resolved);
+    await fsPromises.writeFile(resolved, content, 'utf-8');
+}
+export async function rename(fromPath, toPath, rootContext) {
+    const resolvedFrom = resolvePath(fromPath, rootContext);
+    const resolvedTo = resolvePath(toPath, rootContext);
+    await assertParentInSandbox(resolvedFrom, rootContext);
+    await assertParentInSandbox(resolvedTo, rootContext);
+    await fsPromises.rename(resolvedFrom, resolvedTo);
+}
+export async function copyFile(fromPath, toPath, rootContext) {
+    const resolvedFrom = resolvePath(fromPath, rootContext);
+    const resolvedTo = resolvePath(toPath, rootContext);
+    await assertNoSymlinkEscape(resolvedFrom, rootContext);
+    await assertParentInSandbox(resolvedTo, rootContext);
+    await assertNotSymlink(resolvedTo);
+    await fsPromises.copyFile(resolvedFrom, resolvedTo);
+}
+export async function openFile(targetPath, flags, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    await assertParentInSandbox(resolved, rootContext);
+    return fsPromises.open(resolved, flags);
+}
+export async function realpath(targetPath, rootContext) {
+    const resolved = resolvePath(targetPath, rootContext);
+    const resolvedReal = await fsPromises.realpath(resolved);
+    if (rootContext) {
+        const realRoot = await resolveRealRoot(rootContext);
+        ensureInSandbox(realRoot, resolvedReal);
+    }
+    return resolvedReal;
+}
+export function safePathJoin(root, ...parts) {
+    const joined = safeJoin(root, ...parts);
+    ensureInSandbox(root, joined);
+    return path.resolve(joined);
+}
+//# sourceMappingURL=safe-fs.js.map

package/dist/cli/utils/verify-resolver.js

@@ -0,0 +1,34 @@
+import { getLogger } from '../../core/facades/cli-observability.js';
+import { text } from '../../locales/index.js';
+import { autoDetectVerifyCommand } from './detectors/index.js';
+/**
+ * Resolves the verification command based on priority:
+ * 1. CLI explicit disable (--no-verify) -> undefined
+ * 2. CLI explicit command (--verify "cmd") -> "cmd"
+ * 3. Config file command -> "cmd"
+ * 4. Auto-detection -> "detected-cmd"
+ */
+export async function resolveVerifyOption(repoPath, cliVerify, configVerify) {
+    // 1. Explicitly disabled via --no-verify
+    // Commander sets options.verify to false when --no-verify is used
+    if (cliVerify === false) {
+        getLogger().debug(text.verify.explicitlyDisabled);
+        return undefined;
+    }
+    // 2. Explicitly provided via CLI --verify "cmd"
+    if (typeof cliVerify === 'string') {
+        return cliVerify;
+    }
+    // 3. Provided via config file
+    if (configVerify) {
+        return configVerify;
+    }
+    // 4. Auto-detect
+    const detected = await autoDetectVerifyCommand(repoPath);
+    if (detected) {
+        getLogger().info(text.verify.autoDetected(detected));
+        return detected;
+    }
+    return undefined;
+}
+//# sourceMappingURL=verify-resolver.js.map

package/dist/cli/utils/worktree-prepare-resolver.js

@@ -0,0 +1,18 @@
+import { getLogger } from '../../core/facades/cli-utils-worktree.js';
+import { text } from '../../locales/index.js';
+import { autoDetectWorktreePrepareCommand } from './detectors/index.js';
+export async function resolveWorktreePrepareOption(repoPath, strategy, cliWorktreePrepare) {
+    if (typeof cliWorktreePrepare === 'string' && cliWorktreePrepare.trim()) {
+        return cliWorktreePrepare;
+    }
+    if (strategy !== 'worktree') {
+        return undefined;
+    }
+    const detected = await autoDetectWorktreePrepareCommand(repoPath);
+    if (detected) {
+        getLogger().info(text.verify.autoDetectedWorktreePrepare(detected));
+        return detected;
+    }
+    return undefined;
+}
+//# sourceMappingURL=worktree-prepare-resolver.js.map

package/dist/core/adapters/fs/atomic-file-writer.js

@@ -0,0 +1,129 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { LIMITS } from '../../config/limits.js';
+/**
+ * AtomicFileWriter
+ * Handles secure, atomic file writes with retries for platform compatibility.
+ */
+export class AtomicFileWriter {
+    retryConfig = {
+        maxAttempts: LIMITS.retry.io.maxAttempts,
+        baseDelay: LIMITS.retry.io.initialDelayMs,
+        maxDelay: LIMITS.retry.io.maxDelayMs,
+        backoffMultiplier: 2,
+    };
+    /**
+     * Write content atomically to a file.
+     * 1. Check for symlinks (Safety).
+     * 2. Write to temp file.
+     * 3. Rename temp file to target (Atomic).
+     */
+    async writeAtomic(filePath, content) {
+        // filePath is expected to be absolute or relative to CWD.
+        // Given the new absolutePath in FileState, the caller (TransactionStrategy)
+        // passes context.file.path. We should probably verify what path is passed.
+        // TransactionStrategy passes `this.ctx.file.path`.
+        // We should probably update TransactionStrategy to pass `this.ctx.file.absolutePath`?
+        // Or AtomicFileWriter assumes it gets a path it can write to.
+        // If it receives relative path, it writes relative to CWD.
+        // It's safer to use absolute path everywhere.
+        // 1. Safety check
+        await this.ensureNoSymlink(filePath);
+        // 2. Ensure directory exists
+        const dir = path.dirname(filePath);
+        await fs.mkdir(dir, { recursive: true });
+        // 3. Write to temp file
+        const tempPath = await this.writeToTemp(filePath, content);
+        // 4. Atomic Rename with Retry
+        await this.atomicRename(tempPath, filePath);
+    }
+    /**
+     * Delete file atomically (with retries).
+     */
+    async deleteAtomic(filePath) {
+        // 1. Safety check (ensure we are not deleting a symlink that points elsewhere?
+        // Actually we probably want to delete the symlink itself if it is one.)
+        // But ensureNoSymlink throws if it is a symlink.
+        // If the intent is to delete the file at path, and it is a symlink, we delete the link.
+        // If it's a directory, we fail (this is file writer).
+        await this.retryWithBackoff(async () => {
+            try {
+                await fs.unlink(filePath);
+            }
+            catch (error) {
+                if ((error && typeof error === 'object' && 'code' in error
+                    ? error.code
+                    : undefined) === 'ENOENT')
+                    return; // Already gone
+                if ((error && typeof error === 'object' && 'code' in error
+                    ? error.code
+                    : undefined) === 'EBUSY' ||
+                    (error && typeof error === 'object' && 'code' in error
+                        ? error.code
+                        : undefined) === 'EPERM') {
+                    throw error; // Trigger retry
+                }
+                throw error;
+            }
+        });
+    }
+    /**
+     * Ensure target path is not a symlink to prevent TOCTOU attacks.
+     */
+    async ensureNoSymlink(filePath) {
+        try {
+            const stats = await fs.lstat(filePath);
+            if (stats.isSymbolicLink()) {
+                throw new Error(`Refusing to write to symbolic link: ${filePath}`);
+            }
+        }
+        catch (error) {
+            if ((error && typeof error === 'object' && 'code' in error
+                ? error.code
+                : undefined) !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+    async writeToTemp(targetPath, content) {
+        const tempPath = `${targetPath}.tmp.${Date.now()}.${Math.random().toString(36).slice(2)}`;
+        await fs.writeFile(tempPath, content, { mode: 0o644, flag: 'w' });
+        return tempPath;
+    }
+    async atomicRename(tempPath, targetPath) {
+        await this.retryWithBackoff(async () => {
+            try {
+                await fs.rename(tempPath, targetPath);
+            }
+            catch (error) {
+                if ((error && typeof error === 'object' && 'code' in error
+                    ? error.code
+                    : undefined) === 'EBUSY' ||
+                    (error && typeof error === 'object' && 'code' in error
+                        ? error.code
+                        : undefined) === 'EPERM') {
+                    throw error;
+                }
+                throw new Error(`Atomic rename failed: ${error instanceof Error ? error.message : String(error)} (${tempPath} -> ${targetPath})`);
+            }
+        });
+    }
+    async retryWithBackoff(fn) {
+        let lastError = null;
+        for (let attempt = 0; attempt < this.retryConfig.maxAttempts; attempt++) {
+            try {
+                await fn();
+                return;
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                if (attempt === this.retryConfig.maxAttempts - 1)
+                    break;
+                const delay = Math.min(this.retryConfig.baseDelay * Math.pow(this.retryConfig.backoffMultiplier, attempt), this.retryConfig.maxDelay);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+        }
+        throw lastError;
+    }
+}
+//# sourceMappingURL=atomic-file-writer.js.map

package/dist/core/adapters/fs/file-adapter.js

@@ -0,0 +1,95 @@
+import { promises as fs, constants } from 'fs';
+import * as path from 'path';
+import { AtomicFileWriter } from './atomic-file-writer.js';
+/**
+ * Unified file system adapter for all file operations.
+ * Provides both atomic and non-atomic operations with consistent error handling.
+ */
+export class FileAdapter {
+    atomicWriter = new AtomicFileWriter();
+    /**
+     * Read file (non-atomic, for configuration/session files)
+     */
+    async readFile(filePath, encoding = 'utf-8') {
+        return fs.readFile(filePath, encoding);
+    }
+    /**
+     * Write file (non-atomic, for application data)
+     * Use this for session files, configs, logs where atomicity is not required
+     */
+    async writeFile(filePath, content) {
+        const dir = path.dirname(filePath);
+        await fs.mkdir(dir, { recursive: true });
+        await fs.writeFile(filePath, content, 'utf-8');
+    }
+    /**
+     * Write file atomically (for user code modifications)
+     * Use this when modifying user's source code
+     */
+    async writeFileAtomic(filePath, content) {
+        return this.atomicWriter.writeAtomic(filePath, content);
+    }
+    /**
+     * Append to file (non-atomic, for logs)
+     */
+    async appendFile(filePath, content) {
+        const dir = path.dirname(filePath);
+        await fs.mkdir(dir, { recursive: true });
+        await fs.appendFile(filePath, content, 'utf-8');
+    }
+    /**
+     * Check if file exists
+     */
+    async exists(filePath) {
+        try {
+            await fs.access(filePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Resolve real path (follows symlinks).
+     */
+    async realpath(filePath) {
+        return fs.realpath(filePath);
+    }
+    /**
+     * Read directory
+     */
+    async readdir(dirPath) {
+        return fs.readdir(dirPath);
+    }
+    /**
+     * Read directory entries with file type metadata.
+     */
+    async readdirWithTypes(dirPath) {
+        return fs.readdir(dirPath, { withFileTypes: true });
+    }
+    /**
+     * Get file stats
+     */
+    async stat(filePath) {
+        return fs.stat(filePath);
+    }
+    /**
+     * Create directory recursively
+     */
+    async mkdir(dirPath) {
+        await fs.mkdir(dirPath, { recursive: true });
+    }
+    /**
+     * Delete file atomically (with retries)
+     */
+    async deleteFile(filePath) {
+        return this.atomicWriter.deleteAtomic(filePath);
+    }
+    /**
+     * Check permissions/access for a file or directory.
+     */
+    async access(filePath, mode = constants.R_OK | constants.W_OK) {
+        await fs.access(filePath, mode);
+    }
+}
+//# sourceMappingURL=file-adapter.js.map

package/dist/core/adapters/fs/filesystem.js

@@ -0,0 +1,31 @@
+import { FileAdapter } from './file-adapter.js';
+import { ReadOnlyFileSystem } from './readonly-filesystem.js';
+class FileAdapterFileSystem {
+    adapter;
+    constructor(adapter = new FileAdapter()) {
+        this.adapter = adapter;
+    }
+    async readFile(path, encoding = 'utf-8') {
+        return this.adapter.readFile(path, encoding);
+    }
+    async writeFile(path, content) {
+        await this.adapter.writeFile(path, content);
+    }
+    async exists(path) {
+        return this.adapter.exists(path);
+    }
+    async mkdir(path, _options) {
+        await this.adapter.mkdir(path);
+    }
+}
+/**
+ * Creates a FileSystem adapter based on the specified FlowMode.
+ * Review mode returns a ReadOnlyFileSystem to block writes.
+ */
+export function createFileSystemAdapter(mode, realFs = new FileAdapterFileSystem()) {
+    if (mode === 'review' || mode === 'research' || mode === 'answer') {
+        return new ReadOnlyFileSystem(realFs);
+    }
+    return realFs;
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/core/adapters/fs/index.js

@@ -0,0 +1,5 @@
+export { AtomicFileWriter } from './atomic-file-writer.js';
+export { FileAdapter } from './file-adapter.js';
+export { createFileSystemAdapter } from './filesystem.js';
+export { ReadOnlyFileSystem } from './readonly-filesystem.js';
+//# sourceMappingURL=index.js.map

package/dist/core/adapters/fs/node-fs.js

@@ -0,0 +1,7 @@
+import * as fs from 'fs';
+import * as fsPromises from 'fs/promises';
+export const promises = fsPromises;
+export const syncFs = Object.assign({}, fs, fsPromises);
+export const { access, appendFile, chmod, chown, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, unlink, utimes, writeFile, } = fsPromises;
+export const { existsSync, readFileSync, realpathSync } = fs;
+//# sourceMappingURL=node-fs.js.map

package/dist/core/adapters/fs/readonly-filesystem.js

@@ -0,0 +1,23 @@
+import { text } from '../../../locales/index.js';
+/**
+ * FileSystem adapter that blocks write operations.
+ */
+export class ReadOnlyFileSystem {
+    realFs;
+    constructor(realFs) {
+        this.realFs = realFs;
+    }
+    async readFile(path, encoding) {
+        return this.realFs.readFile(path, encoding);
+    }
+    async writeFile(_path, _content) {
+        throw new Error(text.grizzco.errors.readOnlyFileSystem('writeFile'));
+    }
+    async exists(path) {
+        return this.realFs.exists(path);
+    }
+    async mkdir(_path, _options) {
+        throw new Error(text.grizzco.errors.readOnlyFileSystem('mkdir'));
+    }
+}
+//# sourceMappingURL=readonly-filesystem.js.map