svamp-cli 0.2.342 → 0.2.346

package/dist/cron-hHGdb5kU.mjs

@@ -0,0 +1,132 @@
+const FIELD_RANGES = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
+const MONTH_NAMES = ["JAN", "FEB", "MAR", "APR", "MAY", "JUN", "JUL", "AUG", "SEP", "OCT", "NOV", "DEC"];
+const DOW_NAMES = ["SUN", "MON", "TUE", "WED", "THU", "FRI", "SAT"];
+function substituteNames(token, fieldIndex) {
+  const names = fieldIndex === 3 ? MONTH_NAMES : fieldIndex === 4 ? DOW_NAMES : null;
+  if (!names) return token;
+  return token.replace(/[A-Za-z]+/g, (word) => {
+    const i = names.indexOf(word.toUpperCase());
+    if (i < 0) return word;
+    return String(fieldIndex === 3 ? i + 1 : i);
+  });
+}
+function normalizeDow(set) {
+  if (!set.has(7)) return set;
+  const out = new Set(set);
+  out.delete(7);
+  out.add(0);
+  return out;
+}
+function parseField(token, [min, max]) {
+  const set = /* @__PURE__ */ new Set();
+  for (const part of token.split(",")) {
+    let m;
+    if (part === "*") {
+      for (let i = min; i <= max; i++) set.add(i);
+    } else if (m = part.match(/^\*\/(\d+)$/)) {
+      const s = +m[1];
+      if (s <= 0) throw new Error(`invalid cron step (must be >= 1): "${token}"`);
+      for (let i = min; i <= max; i += s) set.add(i);
+    } else if (m = part.match(/^(\d+)-(\d+)\/(\d+)$/)) {
+      const s = +m[3];
+      if (s <= 0) throw new Error(`invalid cron step (must be >= 1): "${token}"`);
+      if (+m[1] > +m[2]) throw new Error(`invalid cron range (start > end): "${token}"`);
+      for (let i = +m[1]; i <= +m[2]; i += s) set.add(i);
+    } else if (m = part.match(/^(\d+)-(\d+)$/)) {
+      if (+m[1] > +m[2]) throw new Error(`invalid cron range (start > end): "${token}"`);
+      for (let i = +m[1]; i <= +m[2]; i++) set.add(i);
+    } else if (m = part.match(/^(\d+)$/)) {
+      set.add(+m[1]);
+    } else throw new Error(`invalid cron field: "${token}"`);
+  }
+  for (const v of set) if (v < min || v > max) throw new Error(`cron value ${v} out of range [${min},${max}]`);
+  return set;
+}
+function parseCron(expr) {
+  const fields = String(expr).trim().split(/\s+/);
+  if (fields.length !== 5) throw new Error(`cron must have 5 fields, got ${fields.length}: "${expr}"`);
+  const [minute, hour, dom, month, dow] = fields.map((f, i) => parseField(substituteNames(f, i), FIELD_RANGES[i]));
+  return { minute, hour, dom, month, dow: normalizeDow(dow), domRestricted: fields[2] !== "*", dowRestricted: fields[4] !== "*" };
+}
+function validateCronExpr(expr) {
+  parseCron(expr);
+}
+function cronMatches(expr, date) {
+  const c = typeof expr === "string" ? parseCron(expr) : expr;
+  if (!c.minute.has(date.getMinutes())) return false;
+  if (!c.hour.has(date.getHours())) return false;
+  if (!c.month.has(date.getMonth() + 1)) return false;
+  const domOk = c.dom.has(date.getDate());
+  const dowOk = c.dow.has(date.getDay());
+  if (c.domRestricted && c.dowRestricted) return domOk || dowOk;
+  return domOk && dowOk;
+}
+const _zoneFormatters = /* @__PURE__ */ new Map();
+function zoneFormatter(tz) {
+  let f = _zoneFormatters.get(tz);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour12: false,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit"
+    });
+    _zoneFormatters.set(tz, f);
+  }
+  return f;
+}
+function inZone(date, tz) {
+  if (!tz) return date;
+  try {
+    const p = zoneFormatter(tz).formatToParts(date).reduce((o, x) => {
+      o[x.type] = x.value;
+      return o;
+    }, {});
+    const midnight24 = p.hour === "24";
+    return new Date(+p.year, +p.month - 1, +p.day + (midnight24 ? 1 : 0), midnight24 ? 0 : +p.hour, +p.minute);
+  } catch {
+    return date;
+  }
+}
+function nextFire(expr, from, tz) {
+  const c = parseCron(expr);
+  if (tz && scanForMatch(c, from, void 0) === null) return null;
+  return scanForMatch(c, from, tz);
+}
+function scanForMatch(c, from, tz) {
+  const d = new Date(from.getTime());
+  d.setSeconds(0, 0);
+  d.setMinutes(d.getMinutes() + 1);
+  for (let i = 0; i < 366 * 24 * 60; i++) {
+    if (cronMatches(c, tz ? inZone(d, tz) : d)) return new Date(d.getTime());
+    d.setMinutes(d.getMinutes() + 1);
+  }
+  return null;
+}
+function describeNextFire(expr, tz, from = /* @__PURE__ */ new Date()) {
+  let next;
+  try {
+    next = nextFire(expr, from, tz);
+  } catch {
+    return null;
+  }
+  if (!next) return "never fires";
+  const shown = tz ? inZone(next, tz) : next;
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp = `${shown.getFullYear()}-${pad(shown.getMonth() + 1)}-${pad(shown.getDate())} ${pad(shown.getHours())}:${pad(shown.getMinutes())}`;
+  return `next ${stamp} ${tz || "local"}`;
+}
+function resolvePath(ctx, path) {
+  return path.split(".").reduce((o, k) => o == null ? void 0 : o[k], ctx);
+}
+function renderTemplate(template, ctx) {
+  return String(template).replace(/\$\{([\w.$]+)\}/g, (_m, p) => {
+    const v = resolvePath(ctx, p);
+    return v == null ? "" : typeof v === "object" ? JSON.stringify(v) : String(v);
+  });
+}
+
+export { cronMatches as c, describeNextFire as d, inZone as i, renderTemplate as r, validateCronExpr as v };

package/dist/detectIsolation-CzoDCEnh.mjs

@@ -0,0 +1,319 @@
+import { execFile } from 'node:child_process';
+import { mkdir, rm, readFile, chmod, access, mkdtemp } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { P as PINNED_NONO_VERSION, n as nonoAssetUrl, N as NONO_CHECKSUM_ASSET, e as expectedSha256 } from './pinnedNono-5ZHb6328.mjs';
+import { I as ISOLATION_PREFERENCE } from './types-57J3Re0n.mjs';
+import { e as envFlagEnabled } from './envFlag-COOuJ3AH.mjs';
+
+const execFileAsync = promisify(execFile);
+const VERIFY_HARD_TIMEOUT_MS = 2e4;
+async function verifyWithHardTimeout(method, binaryPath, timeoutMs = VERIFY_HARD_TIMEOUT_MS) {
+  let timer;
+  try {
+    return await Promise.race([
+      verifyIsolation(method, binaryPath),
+      new Promise((resolve) => {
+        timer = setTimeout(
+          () => resolve({
+            passed: false,
+            error: `verification timed out after ${timeoutMs}ms (runtime unresponsive)`
+          }),
+          timeoutMs
+        );
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+const SVAMP_TOOLS_DIR = join(homedir(), ".svamp", "tools");
+const SVAMP_BIN_DIR = join(SVAMP_TOOLS_DIR, "bin");
+async function checkCommand(command, versionArgs) {
+  try {
+    const { stdout } = await execFileAsync(command, versionArgs, {
+      timeout: 5e3
+    });
+    const version = stdout.trim().split("\n")[0];
+    return { found: true, version, path: command };
+  } catch {
+  }
+  const localPath = join(SVAMP_BIN_DIR, command);
+  try {
+    const { stdout } = await execFileAsync(localPath, versionArgs, {
+      timeout: 5e3
+    });
+    const version = stdout.trim().split("\n")[0];
+    return { found: true, version, path: localPath };
+  } catch {
+  }
+  return { found: false };
+}
+function getNonoAssetName(version) {
+  const platform = process.platform;
+  const arch = process.arch;
+  if (platform === "darwin" && arch === "arm64") {
+    return `nono-v${version}-aarch64-apple-darwin.tar.gz`;
+  }
+  if (platform === "darwin" && arch === "x64") {
+    return `nono-v${version}-x86_64-apple-darwin.tar.gz`;
+  }
+  if (platform === "linux" && arch === "x64") {
+    return `nono-v${version}-x86_64-unknown-linux-gnu.tar.gz`;
+  }
+  return null;
+}
+async function installNono() {
+  const platform = process.platform;
+  if (platform !== "darwin" && platform !== "linux") {
+    return false;
+  }
+  console.log(`[isolation] Installing pinned nono ${PINNED_NONO_VERSION}...`);
+  try {
+    const version = PINNED_NONO_VERSION;
+    const assetName = getNonoAssetName(version);
+    if (!assetName) {
+      console.warn(`[isolation] No nono binary for ${platform}/${process.arch}`);
+      return false;
+    }
+    const downloadUrl = nonoAssetUrl(version, assetName);
+    console.log(`[isolation] Downloading nono ${version} (pinned) from ${downloadUrl}...`);
+    await mkdir(SVAMP_BIN_DIR, { recursive: true });
+    const tarball = join(SVAMP_BIN_DIR, assetName);
+    await execFileAsync("curl", [
+      "-fsSL",
+      "-o",
+      tarball,
+      "--connect-timeout",
+      "10",
+      downloadUrl
+    ], { timeout: 6e4 });
+    let expected = null;
+    try {
+      const { stdout: sums } = await execFileAsync("curl", [
+        "-fsSL",
+        "--connect-timeout",
+        "10",
+        nonoAssetUrl(version, NONO_CHECKSUM_ASSET)
+      ], { timeout: 2e4, maxBuffer: 4 * 1024 * 1024 });
+      expected = expectedSha256(sums, assetName);
+    } catch {
+      expected = null;
+    }
+    if (!expected) {
+      console.error(`[isolation] Could not obtain a published SHA-256 for ${assetName} \u2014 refusing to install nono.`);
+      await rm(tarball, { force: true }).catch(() => {
+      });
+      return false;
+    }
+    const actual = createHash("sha256").update(await readFile(tarball)).digest("hex");
+    if (actual !== expected) {
+      console.error(`[isolation] nono checksum MISMATCH for ${assetName}: expected ${expected}, got ${actual}. Refusing to install.`);
+      await rm(tarball, { force: true }).catch(() => {
+      });
+      return false;
+    }
+    console.log(`[isolation] nono ${version} checksum verified (${actual.slice(0, 12)}\u2026)`);
+    await execFileAsync("tar", [
+      "xzf",
+      tarball,
+      "-C",
+      SVAMP_BIN_DIR
+    ], { timeout: 15e3 });
+    await rm(tarball, { force: true }).catch(() => {
+    });
+    const nonoPath = join(SVAMP_BIN_DIR, "nono");
+    await chmod(nonoPath, 493);
+    try {
+      await access(nonoPath);
+      console.log(`[isolation] nono ${version} installed at ${nonoPath}`);
+      return true;
+    } catch {
+      console.warn("[isolation] Download completed but nono binary not found");
+      return false;
+    }
+  } catch (e) {
+    console.warn(`[isolation] Failed to install nono: ${e.message}`);
+    return false;
+  }
+}
+async function parseIsolationTestOutput(stdout, probeFile) {
+  const output = stdout.trim();
+  const wMatch = output.match(/W=(\d+)/);
+  const pMatch = output.match(/P=(\d+)/);
+  if (!wMatch || !pMatch) {
+    return { passed: false, error: `unexpected test output: ${output}` };
+  }
+  const workspaceWriteOk = wMatch[1] === "0";
+  const probeExitCode = parseInt(pMatch[1], 10);
+  if (!workspaceWriteOk) {
+    return { passed: false, error: "sandbox blocked writes to allowed workspace path" };
+  }
+  if (probeExitCode === 0) {
+    try {
+      await access(probeFile);
+      return {
+        passed: false,
+        error: "writes outside workspace were NOT blocked \u2014 file leaked to host filesystem"
+      };
+    } catch {
+      return { passed: true };
+    }
+  }
+  return { passed: true };
+}
+async function verifyNonoIsolation(binaryPath) {
+  const testBase = "/tmp";
+  const workDir = await mkdtemp(join(testBase, "svamp-iso-work-"));
+  const probeFile = join(homedir(), `.svamp-iso-probe-${process.pid}`);
+  try {
+    const testScript = [
+      `echo ok > "${workDir}/test" 2>/dev/null; W=$?`,
+      `echo leak > "${probeFile}" 2>/dev/null; P=$?`,
+      `echo "W=$W P=$P"`
+    ].join("; ");
+    const { stdout } = await execFileAsync(binaryPath, [
+      "run",
+      "-s",
+      "--allow",
+      workDir,
+      // NOTE: Do NOT add --allow-cwd here. If the daemon's CWD happens to be
+      // $HOME (common when started interactively), --allow-cwd would grant
+      // access to $HOME, allowing the probe file write to succeed and making
+      // verification incorrectly fail ("file leaked to host filesystem").
+      // We already grant --allow workDir explicitly, so --allow-cwd is redundant.
+      "--trust-override",
+      "--",
+      "sh",
+      "-c",
+      testScript
+    ], { timeout: 15e3, cwd: workDir });
+    return parseIsolationTestOutput(stdout, probeFile);
+  } catch (e) {
+    return { passed: false, error: e.message };
+  } finally {
+    await rm(workDir, { recursive: true, force: true }).catch(() => {
+    });
+    await rm(probeFile, { force: true }).catch(() => {
+    });
+  }
+}
+async function verifyContainerIsolation(method, binaryPath) {
+  try {
+    await execFileAsync(binaryPath, ["info"], { timeout: 15e3, killSignal: "SIGKILL" });
+  } catch (e) {
+    return { passed: false, error: `${method} daemon not accessible: ${e.message}` };
+  }
+  try {
+    const { stdout } = await execFileAsync(
+      binaryPath,
+      ["run", "--rm", "--network=none", "alpine", "echo", "isolation-ok"],
+      { timeout: 3e4, killSignal: "SIGKILL" }
+    );
+    if (!stdout.includes("isolation-ok")) {
+      return { passed: false, error: `container test returned unexpected output: ${stdout.trim()}` };
+    }
+    return { passed: true };
+  } catch (e) {
+    if (e.message?.includes("pull access denied") || e.message?.includes("not found")) {
+      return { passed: true };
+    }
+    return { passed: false, error: `container test failed: ${e.message}` };
+  }
+}
+async function verifyIsolation(method, binaryPath) {
+  switch (method) {
+    case "nono":
+      return verifyNonoIsolation(binaryPath);
+    case "docker":
+    case "podman":
+      return verifyContainerIsolation(method, binaryPath);
+    default:
+      return { passed: false, error: `${method} is not supported for external isolation` };
+  }
+}
+function isolationDisabledByEnv(env = process.env) {
+  const v = (env.SVAMP_ISOLATION || "").trim().toLowerCase();
+  if (v && ["none", "off", "disabled", "0", "false", "no"].includes(v)) return true;
+  return envFlagEnabled(env.SVAMP_NO_ISOLATION) || envFlagEnabled(env.SVAMP_SKIP_NONO);
+}
+async function detectIsolationCapabilities() {
+  if (isolationDisabledByEnv()) {
+    console.log(
+      "[isolation] Disabled via env (SVAMP_ISOLATION=none) \u2014 skipping nono auto-install + runtime detection. Sessions run WITHOUT per-session sandboxing; session sharing is allowed (rely on the container/host boundary)."
+    );
+    const notFound = () => ({ found: false });
+    return {
+      available: [],
+      preferred: null,
+      disabled: true,
+      details: {
+        nono: notFound(),
+        docker: notFound(),
+        podman: notFound(),
+        srt: notFound(),
+        bwrap: notFound()
+      }
+    };
+  }
+  const checks = {
+    nono: checkCommand("nono", ["--version"]),
+    docker: checkCommand("docker", ["--version"]),
+    podman: checkCommand("podman", ["--version"])
+  };
+  const checkResults = await Promise.all(
+    Object.entries(checks).map(async ([method, promise]) => {
+      const detail = await promise;
+      return [method, detail];
+    })
+  );
+  const details = {
+    ...Object.fromEntries(checkResults),
+    // Include legacy types in details for backward compat
+    srt: { found: false },
+    bwrap: { found: false }
+  };
+  if (!details.nono.found) {
+    const installed = await installNono();
+    if (installed) {
+      details.nono = await checkCommand("nono", ["--version"]);
+    }
+  }
+  const foundMethods = ISOLATION_PREFERENCE.filter((m) => details[m].found);
+  if (foundMethods.length > 0) {
+    console.log(`[isolation] Found runtimes: ${foundMethods.join(", ")}. Verifying isolation...`);
+    await Promise.all(
+      foundMethods.map(async (method) => {
+        const binaryPath = details[method].path || method;
+        const result = await verifyWithHardTimeout(method, binaryPath);
+        details[method].verified = result.passed;
+        if (!result.passed) {
+          details[method].verificationError = result.error;
+          console.warn(
+            `[isolation] WARNING: ${method} found but verification FAILED: ${result.error}. This runtime will NOT be used for isolation.`
+          );
+        } else {
+          console.log(`[isolation] ${method}: verified OK`);
+        }
+      })
+    );
+  }
+  const available = ISOLATION_PREFERENCE.filter(
+    (m) => details[m].found && details[m].verified === true
+  );
+  const preferred = available.length > 0 ? available[0] : null;
+  if (available.length === 0 && foundMethods.length > 0) {
+    console.warn(
+      `[isolation] No isolation runtime passed verification (found: ${foundMethods.join(", ")}). Session sharing will be DISABLED.`
+    );
+  } else if (available.length === 0) {
+    console.log("[isolation] No isolation runtimes found. Session sharing will be unavailable.");
+  } else {
+    console.log(`[isolation] Preferred isolation method: ${preferred}`);
+  }
+  return { available, preferred, details };
+}
+
+export { detectIsolationCapabilities, installNono, isolationDisabledByEnv, verifyWithHardTimeout };

package/dist/envFlag-COOuJ3AH.mjs

@@ -0,0 +1,11 @@
+const NEGATIVE = /* @__PURE__ */ new Set(["", "0", "false", "no", "off"]);
+function envFlagEnabled(value) {
+  if (value == null) return false;
+  return !NEGATIVE.has(value.trim().toLowerCase());
+}
+function envFlagDisabled(value) {
+  if (value == null) return false;
+  return NEGATIVE.has(value.trim().toLowerCase());
+}
+
+export { envFlagDisabled as a, envFlagEnabled as e };

package/dist/fileLock-BMPwCrB6.mjs

@@ -0,0 +1,80 @@
+import { mkdirSync, writeFileSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const _sleepSab = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+  try {
+    Atomics.wait(_sleepSab, 0, 0, ms);
+  } catch {
+  }
+}
+function isProcessDead(pid) {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (e) {
+    return e?.code === "ESRCH";
+  }
+}
+function withFileLock(lockPath, fn, opts) {
+  const deadlineMs = opts?.deadlineMs ?? 50;
+  const staleMs = opts?.staleMs ?? 5e3;
+  const trackOwner = opts?.breakOnDeadOwner ?? false;
+  const pidPath = join(lockPath, "owner.pid");
+  const deadline = Date.now() + deadlineMs;
+  let held = false;
+  while (Date.now() < deadline) {
+    try {
+      mkdirSync(lockPath);
+      held = true;
+      if (trackOwner) {
+        try {
+          writeFileSync(pidPath, String(process.pid));
+        } catch {
+        }
+      }
+      break;
+    } catch {
+      let broke = false;
+      if (trackOwner) {
+        try {
+          const owner = Number(readFileSync(pidPath, "utf8"));
+          if (Number.isInteger(owner) && owner > 0 && owner !== process.pid && isProcessDead(owner)) {
+            rmSync(lockPath, { recursive: true, force: true });
+            broke = true;
+          }
+        } catch {
+        }
+      }
+      if (!broke) {
+        try {
+          if (Date.now() - statSync(lockPath).mtimeMs > staleMs) {
+            rmSync(lockPath, { recursive: true, force: true });
+            broke = true;
+          }
+        } catch {
+        }
+      }
+      if (broke) continue;
+      sleepSync(5);
+    }
+  }
+  if (!held) {
+    try {
+      opts?.onFailOpen?.(lockPath);
+    } catch {
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) {
+      try {
+        rmSync(lockPath, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
+export { sleepSync as s, withFileLock as w };