tianshu-harness 3.23.0

package/dist/chunk-SUJERP5I.js

@@ -0,0 +1,285 @@
+#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096
+import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);
+import {
+  debugLog
+} from "./chunk-CI4R6P2B.js";
+import {
+  rawOutputDir
+} from "./chunk-XU2YXCDL.js";
+import {
+  expandHome
+} from "./chunk-ETHFACAB.js";
+import {
+  writeFileAtomicSync
+} from "./chunk-A5MNH4ER.js";
+import {
+  init_paths,
+  rivetHome
+} from "./chunk-BCQXEZPJ.js";
+import {
+  init_esm_shims
+} from "./chunk-5GGOGLSN.js";
+
+// src/tools/path-grants.ts
+init_esm_shims();
+import { existsSync, mkdirSync, readFileSync, realpathSync } from "fs";
+import { homedir } from "os";
+import { join, resolve, sep } from "path";
+init_paths();
+var RIVET_DIR = rivetHome();
+var _grants = [];
+function scopeVisible(g, cwd) {
+  if (!cwd) return true;
+  if (g.scope === void 0) return true;
+  return g.scope === canonicalize(cwd);
+}
+function canonicalize(p) {
+  const abs = resolve(p);
+  try {
+    return realpathSync(abs);
+  } catch {
+    let current = abs;
+    const tail = [];
+    while (!existsSync(current)) {
+      const parent = resolve(current, "..");
+      if (parent === current) return abs;
+      tail.unshift(current.slice(parent.length + 1));
+      current = parent;
+    }
+    try {
+      return join(realpathSync(current), ...tail);
+    } catch {
+      return abs;
+    }
+  }
+}
+var CASE_INSENSITIVE_FS = process.platform === "win32";
+function foldCase(p) {
+  return CASE_INSENSITIVE_FS ? p.toLowerCase() : p;
+}
+function isPathUnder(root, child, caseInsensitive = CASE_INSENSITIVE_FS) {
+  const fold = (p) => {
+    const norm = sep === "\\" ? p.replace(/\//g, "\\") : p;
+    return caseInsensitive ? norm.toLowerCase() : norm;
+  };
+  const r = fold(root);
+  const c = fold(child);
+  if (c === r) return true;
+  const prefix = r.endsWith(sep) ? r : r + sep;
+  return c.startsWith(prefix);
+}
+function isUnder(root, child) {
+  return isPathUnder(root, child);
+}
+function grantsFile(cwd) {
+  const slug = canonicalize(cwd).replace(/[^a-zA-Z0-9]/g, "_").slice(-64);
+  return join(RIVET_DIR, `path-grants-${slug}.json`);
+}
+function grantPath(root, mode, opts) {
+  const canonical = canonicalize(root);
+  const scope = opts?.cwd ? canonicalize(opts.cwd) : void 0;
+  const persist = opts?.persist === true;
+  const existing = _grants.find(
+    (g) => foldCase(g.root) === foldCase(canonical) && g.scope === scope
+  );
+  let grant;
+  if (existing) {
+    if (mode === "write") existing.mode = "write";
+    if (persist) existing.persisted = true;
+    grant = existing;
+  } else {
+    grant = { root: canonical, mode, grantedAt: Date.now(), ...persist ? { persisted: true } : {}, ...scope ? { scope } : {} };
+    _grants.push(grant);
+  }
+  if (persist && opts?.cwd) persistGrants(opts.cwd);
+  return grant;
+}
+function isReadGranted(absPath, cwd) {
+  const target = canonicalize(absPath);
+  return _grants.some((g) => scopeVisible(g, cwd) && isUnder(g.root, target));
+}
+function isWriteGranted(absPath, cwd) {
+  const target = canonicalize(absPath);
+  return _grants.some((g) => g.mode === "write" && scopeVisible(g, cwd) && isUnder(g.root, target));
+}
+function writeGrantedRoots(cwd) {
+  return _grants.filter((g) => g.mode === "write" && scopeVisible(g, cwd)).map((g) => g.root);
+}
+function listGrants() {
+  return _grants.map((g) => ({ ...g }));
+}
+function readPersistedFile(cwd) {
+  const file = grantsFile(cwd);
+  if (!existsSync(file)) return [];
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf-8"));
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((g) => !!g && typeof g.root === "string");
+  } catch {
+    return [];
+  }
+}
+function listPersistedGrants(cwd) {
+  return readPersistedFile(cwd).map((g) => ({
+    root: g.root,
+    mode: g.mode === "write" ? "write" : "read",
+    grantedAt: typeof g.grantedAt === "number" ? g.grantedAt : 0,
+    persisted: true
+  }));
+}
+function revokeGrant(root, opts) {
+  const canonical = canonicalize(root);
+  const matches = (candidate) => foldCase(canonicalize(candidate)) === foldCase(canonical);
+  const revocable = (g) => matches(g.root) && (g.scope === void 0 || g.scope === canonicalize(opts.cwd));
+  const hadInMemory = _grants.some(revocable);
+  if (hadInMemory) _grants = _grants.filter((g) => !revocable(g));
+  const onDisk = readPersistedFile(opts.cwd);
+  const kept = onDisk.filter((g) => !matches(g.root));
+  const removedFromDisk = kept.length < onDisk.length;
+  if (removedFromDisk) {
+    try {
+      mkdirSync(RIVET_DIR, { recursive: true });
+      writeFileAtomicSync(grantsFile(opts.cwd), JSON.stringify(kept, null, 2));
+    } catch {
+    }
+  }
+  return hadInMemory || removedFromDisk;
+}
+function persistGrants(cwd) {
+  try {
+    mkdirSync(RIVET_DIR, { recursive: true });
+    const scope = canonicalize(cwd);
+    const toSave = _grants.filter((g) => g.persisted && g.scope === scope);
+    writeFileAtomicSync(grantsFile(cwd), JSON.stringify(toSave, null, 2));
+  } catch {
+  }
+}
+function loadPersistedGrants(cwd) {
+  const file = grantsFile(cwd);
+  if (!existsSync(file)) return;
+  let saved;
+  try {
+    saved = JSON.parse(readFileSync(file, "utf-8"));
+  } catch {
+    return;
+  }
+  if (!Array.isArray(saved)) return;
+  for (const g of saved) {
+    if (!g || typeof g.root !== "string") continue;
+    if (!existsSync(g.root)) continue;
+    const mode = g.mode === "write" ? "write" : "read";
+    grantPath(g.root, mode, { persist: false, cwd });
+    const stored = _grants.find(
+      (x) => foldCase(x.root) === foldCase(canonicalize(g.root)) && x.scope === canonicalize(cwd)
+    );
+    if (stored) stored.persisted = true;
+  }
+}
+var ROOT_EXISTS_TTL_MS = 3e4;
+var rootExistsMemo = /* @__PURE__ */ new Map();
+function resetRootExistsMemoForTest() {
+  rootExistsMemo.clear();
+}
+function rootExistsCached(root, force = false) {
+  const now = Date.now();
+  if (!force) {
+    const hit = rootExistsMemo.get(root);
+    if (hit && now - hit.at < ROOT_EXISTS_TTL_MS) return hit.exists;
+  }
+  const exists = existsSync(root);
+  rootExistsMemo.set(root, { exists, at: now });
+  return exists;
+}
+function applyConfiguredPathGrants(permissions, opts) {
+  if (!permissions) return;
+  const apply = (dirs, mode) => {
+    for (const raw of dirs ?? []) {
+      const trimmed = raw.trim();
+      if (!trimmed) continue;
+      const root = resolve(expandHome(trimmed));
+      if (!rootExistsCached(root, opts?.force)) continue;
+      grantPath(root, mode, { persist: false });
+    }
+  };
+  apply(permissions.additionalReadDirs, "read");
+  apply(permissions.additionalWriteDirs, "write");
+}
+var DEFAULT_DEPENDENCY_READ_DIRS = [
+  ".npm",
+  ".npm-cache",
+  ".cache",
+  ".cargo",
+  ".rustup",
+  ".gradle",
+  ".m2",
+  ".pub-cache",
+  ".pnpm-store",
+  ".yarn",
+  ".bun",
+  ".deno",
+  ".cocoapods",
+  ".gem",
+  ".bundle",
+  ".composer",
+  ".config/composer",
+  ".android",
+  ".nuget",
+  // .NET NuGet packages
+  ".nvm",
+  // Node Version Manager installations
+  ".pyenv",
+  // Python version manager installs
+  "go"
+  // In-project node_modules / vendor / Pods already live under cwd and need no
+  // grant; this list only covers $HOME-level global caches.
+];
+var ENV_OVERRIDES = {
+  ".cargo": "CARGO_HOME",
+  ".rustup": "RUSTUP_HOME",
+  ".gradle": "GRADLE_USER_HOME",
+  ".pub-cache": "PUB_CACHE",
+  ".gem": "GEM_HOME"
+};
+function applyDefaultDependencyReadGrants() {
+  const home = homedir();
+  const granted = [];
+  const skipped = [];
+  for (const rel of DEFAULT_DEPENDENCY_READ_DIRS) {
+    const envVar = ENV_OVERRIDES[rel];
+    const root = envVar && process.env[envVar] ? resolve(process.env[envVar]) : resolve(join(home, rel));
+    if (!existsSync(root)) {
+      skipped.push(rel);
+      continue;
+    }
+    grantPath(root, "read", { persist: false });
+    granted.push(rel);
+  }
+  debugLog(`dep read grants: ${granted.length} granted` + (granted.length ? ` (${granted.join(", ")})` : "") + (skipped.length ? `; ${skipped.length} skipped (${skipped.join(", ")})` : ""));
+}
+function applyRivetRuntimeReadGrants() {
+  const roots = [rawOutputDir()];
+  for (const root of roots) {
+    grantPath(root, "read", { persist: false });
+  }
+  debugLog(`rivet runtime read grants: ${roots.join(", ")}`);
+}
+function _resetGrantsForTest() {
+  _grants = [];
+}
+
+export {
+  isPathUnder,
+  grantPath,
+  isReadGranted,
+  isWriteGranted,
+  writeGrantedRoots,
+  listGrants,
+  listPersistedGrants,
+  revokeGrant,
+  loadPersistedGrants,
+  resetRootExistsMemoForTest,
+  applyConfiguredPathGrants,
+  applyDefaultDependencyReadGrants,
+  applyRivetRuntimeReadGrants,
+  _resetGrantsForTest
+};