stitchkit 0.114.2 → 0.115.0

package/dist/index-j8kf56wx.js

@@ -0,0 +1,100 @@
+import {
+  loadDarwinBinding
+} from "./index-2kbysk9s.js";
+import {
+  descriptorPath,
+  NumericFileHandle
+} from "./index-x0ddbj85.js";
+import {
+  stagingName
+} from "./index-tt30h7mr.js";
+
+// src/internal/contained-write.ts
+import { constants, fchmod, open as openDescriptor, write as writeDescriptor } from "node:fs";
+import { rename, unlink } from "node:fs/promises";
+import path from "node:path";
+function entryPath(directory, name) {
+  return path.join(descriptorPath(directory), name);
+}
+async function openExclusive(directory, name, mode) {
+  if (process.platform === "darwin") {
+    return loadDarwinBinding().createFileAt(directory.fd, name, mode);
+  }
+  return new Promise((resolve, reject) => {
+    openDescriptor(entryPath(directory, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode, (error, descriptor) => error ? reject(error) : resolve(descriptor));
+  });
+}
+async function renameEntry(directory, source, target) {
+  if (process.platform === "darwin") {
+    loadDarwinBinding().renameAt(directory.fd, source, target);
+    return;
+  }
+  await rename(entryPath(directory, source), entryPath(directory, target));
+}
+async function discardEntry(directory, name) {
+  try {
+    if (process.platform === "darwin")
+      loadDarwinBinding().unlinkAt(directory.fd, name);
+    else
+      await unlink(entryPath(directory, name));
+  } catch {}
+}
+async function writeDescriptorFully(descriptor, content) {
+  const bytes = typeof content === "string" ? Buffer.from(content) : content;
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const written = await new Promise((resolve, reject) => {
+      writeDescriptor(descriptor, bytes, offset, bytes.byteLength - offset, null, (error, bytesWritten) => error ? reject(error) : resolve(bytesWritten));
+    });
+    if (written === 0)
+      throw new Error("Contained file write made no progress");
+    offset += written;
+  }
+}
+async function applyMode(file, mode) {
+  if (((await file.stat()).mode & 511) === mode)
+    return;
+  await new Promise((resolve, reject) => {
+    fchmod(file.fd, mode, (error) => error ? reject(error) : resolve());
+  });
+}
+async function createFile(directory, name, content, mode) {
+  const descriptor = await openExclusive(directory, name, mode ?? 438);
+  const file = new NumericFileHandle(descriptor);
+  let failed;
+  try {
+    await writeDescriptorFully(descriptor, content);
+    if (mode !== undefined)
+      await applyMode(file, mode);
+  } catch (error) {
+    failed = error;
+  } finally {
+    try {
+      await file.close();
+    } catch (error) {
+      failed ??= error;
+    }
+  }
+  if (failed) {
+    await discardEntry(directory, name);
+    throw failed;
+  }
+}
+async function writeContainedFile(input) {
+  const { handle, basename } = input.parent;
+  const mode = input.mode === undefined ? undefined : input.mode & 511;
+  if (!input.replace) {
+    await createFile(handle, basename, input.content, mode);
+    return;
+  }
+  const temporary = stagingName();
+  await createFile(handle, temporary, input.content, mode);
+  try {
+    await renameEntry(handle, temporary, basename);
+  } catch (error) {
+    await discardEntry(handle, temporary);
+    throw error;
+  }
+}
+
+export { writeContainedFile };

package/dist/index-jj9228tt.js

@@ -0,0 +1,6 @@
+// src/internal/errno.ts
+function errnoOf(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : undefined;
+}
+
+export { errnoOf };

package/dist/{index-bh2ht9y5.js → index-n8z3rvzw.js}

@@ -1,6 +1,9 @@
 import {
   loadDarwinBinding
 } from "./index-2kbysk9s.js";
+import {
+  errnoOf
+} from "./index-jj9228tt.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";
@@ -126,7 +129,7 @@ async function observeProcessInstanceAt(pid, procRoot) {
       readlink(`${procRoot}/self/ns/pid`),
       readFile2(`${procRoot}/self/status`, "utf8"),
       readlink(`${procRoot}/self/ns/time`).catch((error) => {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        if (errnoOf(error) === "ENOENT")
           return "";
         throw error;
       }),

package/dist/index-nregbbsc.js

@@ -0,0 +1,107 @@
+import {
+  openDirectoryAt,
+  openPinnedDirectory,
+  openFileAt,
+  listAt,
+  readContainedUtf8Handle
+} from "./index-x0ddbj85.js";
+
+// src/agent-runtime/contained-scan.ts
+import path from "node:path";
+async function walkContainedFiles(input) {
+  const scan = await scanContainedFiles({ ...input, symlinks: "refuse" });
+  if (scan.truncated)
+    throw new Error("Contained file traversal exceeded its bounds");
+  return scan.files;
+}
+async function scanContainedFiles(input) {
+  const files = [];
+  let truncated = false;
+  let skippedDirectories = 0;
+  let skippedSymlinks = 0;
+  const denied = [];
+  let deniedTruncated = false;
+  const root = await openPinnedDirectory(input.root);
+  const visit = async (directory, relativeDirectory, depth) => {
+    if (truncated)
+      return;
+    if (depth > input.maxDepth) {
+      truncated = true;
+      return;
+    }
+    const entries = [...await listAt(directory)];
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      const relative = relativeDirectory ? path.join(relativeDirectory, entry.name) : entry.name;
+      const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+      if (kind === "file" && input.includeFile && !input.includeFile(relative))
+        continue;
+      if (input.authorizePath && !await input.authorizePath(relative, kind)) {
+        if (denied.length < input.maxFiles)
+          denied.push({ relative, kind });
+        else
+          deniedTruncated = true;
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        if (input.symlinks === "refuse") {
+          throw new Error(`Contained file traversal refuses symlink: ${relative}`);
+        }
+        skippedSymlinks += 1;
+        continue;
+      }
+      if (entry.isDirectory()) {
+        if (input.excludeDirectory?.(relative)) {
+          skippedDirectories += 1;
+          continue;
+        }
+        let child;
+        try {
+          child = await openDirectoryAt(directory, entry.name);
+        } catch (error) {
+          if (input.symlinks === "skip") {
+            skippedSymlinks += 1;
+            continue;
+          }
+          throw error;
+        }
+        try {
+          await visit(child, relative, depth + 1);
+        } finally {
+          await child.close();
+        }
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      if (files.length >= input.maxFiles) {
+        truncated = true;
+        return;
+      }
+      let content;
+      if (input.readMaxBytes !== undefined) {
+        try {
+          const handle = await openFileAt(directory, entry.name);
+          try {
+            content = await readContainedUtf8Handle(handle, input.readMaxBytes);
+          } finally {
+            await handle.close();
+          }
+        } catch (error) {
+          if (input.skipUnreadable)
+            continue;
+          throw error;
+        }
+      }
+      files.push({ absolute: relative, relative, ...content && { content } });
+    }
+  };
+  try {
+    await visit(root, "", 0);
+  } finally {
+    await root.close();
+  }
+  return { files, truncated, skippedDirectories, skippedSymlinks, denied, deniedTruncated };
+}
+
+export { walkContainedFiles, scanContainedFiles };

package/dist/{index-j4zh647a.js → index-tt30h7mr.js}

@@ -1,3 +1,6 @@
+import {
+  errnoOf
+} from "./index-jj9228tt.js";
 import {
   assertPositiveSafeInteger
 } from "./index-0s4xebbg.js";
@@ -21,7 +24,7 @@ function isAtomicStagingName2(name) {
   return NAME.test(name);
 }
 function isMissing(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+  return errnoOf(error) === "ENOENT";
 }
 async function sweepAtomicStaging2(options) {
   const { directory, olderThanMs, signal } = options;