tickmarkr 2.6.6 → 2.6.8

package/dist/run/git-trust.js

@@ -0,0 +1,334 @@
+import { execFileSync } from "node:child_process";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+// v2.6.7 T4 (GHSA-2): a seat-run linked worktree's gitdir is seat-writable (the Codex worker grant), so its
+// `commondir` and `config.worktree` can redirect every later unsandboxed host git in that checkout to a
+// hostile common directory or config program. Authority is derived afresh on every call from the seat-denied
+// worktree gitfile and the trusted ordinary common directory's own bytes — never persisted enrollment, never
+// the mutable commondir/config.worktree, never ambient GIT_DIR/GIT_COMMON_DIR. No verdict is cached: a check
+// passed once proves nothing about the next spawn. This module must not import git.ts, lease.ts or journal.ts.
+/** A covered git invocation refused before spawn; `path` names the offending metadata. */
+export class GitTrustRefusal extends Error {
+    path;
+    detail;
+    constructor(path, detail, options) {
+        super(`git trust refusal: ${path}: ${detail}`, options);
+        this.name = "GitTrustRefusal";
+        this.path = path;
+        this.detail = detail;
+    }
+}
+/** The nearest `.git` entry at or above cwd, or undefined outside any checkout. */
+const dotGitOf = (cwd) => {
+    let dir;
+    try {
+        dir = realpathSync.native(cwd);
+    }
+    catch {
+        return undefined;
+    }
+    for (;;) {
+        const candidate = join(dir, ".git");
+        try {
+            lstatSync(candidate);
+            return candidate;
+        }
+        catch { /* keep walking */ }
+        const up = dirname(dir);
+        if (up === dir)
+            return undefined;
+        dir = up;
+    }
+};
+const present = (path) => {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * A path exactly as git reads it from a gitfile or commondir (setup.c read_gitfile_gently /
+ * get_common_dir_noenv): raw bytes with ONLY trailing CR/LF stripped — never trimmed, so a leading or trailing
+ * space stays a path component git follows — relative to `base` unless it starts with "/", then a PHYSICAL
+ * realpath (symlinks resolved before `..`, as git's strbuf_realpath and realpath(3) do; fs.realpathSync
+ * normalizes `..` lexically first). Throws when the path does not resolve.
+ */
+const resolveAsGit = (base, bytes) => {
+    let end = bytes.length;
+    while (end && (bytes[end - 1] === 0x0a || bytes[end - 1] === 0x0d))
+        end--;
+    const named = bytes.subarray(0, end);
+    return realpathSync.native(named[0] === 0x2f ? named : Buffer.concat([Buffer.from(`${base}/`), named]), { encoding: "buffer" });
+};
+function authorityOf(dotGit) {
+    let directory;
+    try {
+        directory = statSync(dotGit).isDirectory();
+    }
+    catch (e) {
+        throw new GitTrustRefusal(dotGit, `unreadable checkout metadata (${String(e)})`);
+    }
+    if (directory) {
+        const gitdir = realpathSync.native(dotGit);
+        return { gitdir, common: gitdir, linked: false };
+    }
+    // git accepts a gitfile only when its first bytes are exactly "gitdir: " and the rest names the path
+    let named;
+    try {
+        const bytes = readFileSync(dotGit);
+        if (bytes.subarray(0, 8).toString("latin1") === "gitdir: ")
+            named = bytes.subarray(8);
+    }
+    catch { /* refused below */ }
+    if (!named || !/[^\r\n]/.test(named.toString("latin1")))
+        throw new GitTrustRefusal(dotGit, "not a readable gitfile");
+    let gitdir;
+    try {
+        gitdir = resolveAsGit(dirname(dotGit), named).toString();
+    }
+    catch {
+        throw new GitTrustRefusal(dotGit, `names a missing gitdir ${named.toString().trimEnd()}`);
+    }
+    // Supported linked layout: <common>/worktrees/<name>, where <common> is itself an ordinary git directory.
+    // The layout decides, never commondir's presence: a seat can delete its own commondir (and plant standalone
+    // repository metadata beside it), which must not turn its writable gitdir into its own trusted common dir.
+    const common = basename(dirname(gitdir)) === "worktrees" ? dirname(dirname(gitdir)) : undefined;
+    if (common !== undefined && present(join(common, "HEAD")) && !present(join(common, "commondir")))
+        return { gitdir, common, linked: true };
+    // Outside that layout, a gitdir without commondir is an ordinary separate git directory (submodule, --separate-git-dir).
+    if (!present(join(gitdir, "commondir")))
+        return { gitdir, common: gitdir, linked: false };
+    if (common === undefined)
+        throw new GitTrustRefusal(dotGit, `names ${gitdir}, outside a supported <common>/worktrees/<name> layout`);
+    throw new GitTrustRefusal(common, "the linked worktree's common directory is not an ordinary git directory");
+}
+/**
+ * The canonical, independently expected common git directory for the checkout enclosing `cwd` — never what
+ * a mutable commondir says. Throws GitTrustRefusal naming the authority path when it cannot be established.
+ */
+export function trustedCommonDir(cwd) {
+    const dotGit = dotGitOf(cwd);
+    if (!dotGit)
+        throw new GitTrustRefusal(cwd, "no checkout encloses this directory");
+    return authorityOf(dotGit).common;
+}
+/** One key of the trusted common config. Read failures and unparseable values never become clean authority. */
+function trustedConfig(common, key, type) {
+    const config = join(common, "config");
+    if (!present(config))
+        throw new GitTrustRefusal(config, "the trusted common config is missing");
+    try {
+        return execFileSync("git", ["config", "--file", config, ...(type ? [`--type=${type}`] : []), "--get", key], {
+            cwd: "/", encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000,
+        }).trim();
+    }
+    catch (error) {
+        const e = error;
+        if (e.status === 1 && !e.stderr?.trim())
+            return undefined; // the key is absent
+        throw new GitTrustRefusal(config, `cannot read ${key} (${(e.stderr ?? String(error)).trim().split("\n")[0]})`);
+    }
+}
+const worktreeConfigEnabled = (common) => trustedConfig(common, "extensions.worktreeConfig", "bool") === "true";
+/** commondir's identity: ctime moves on every write, rename, unlink/recreate or restore, and no caller can set it. */
+const stampOf = (path) => {
+    try {
+        const s = lstatSync(path, { bigint: true });
+        return `${s.dev}:${s.ino}:${s.ctimeNs}`;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isSymlink = (path) => { try {
+    return lstatSync(path).isSymbolicLink();
+}
+catch {
+    return false;
+} };
+/** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
+function checkedAuthority(cwd) {
+    const dotGit = dotGitOf(cwd);
+    if (!dotGit)
+        return undefined;
+    const { gitdir, common, linked } = authorityOf(dotGit);
+    const commondir = join(gitdir, "commondir");
+    // stamped BEFORE its bytes are read, so any change after this read moves the stamp
+    const stamp = linked ? stampOf(commondir) : undefined;
+    if (linked && !present(commondir))
+        throw new GitTrustRefusal(commondir, `is missing, so git would treat the seat-writable gitdir as its own repository; expected ${common}`);
+    // git writes commondir as a regular file; through a symlink the bytes git reads could be rewritten and restored
+    // without moving the link's own stamp, so that layout is refused rather than trusted
+    if (linked && isSymlink(commondir))
+        throw new GitTrustRefusal(commondir, "is a symbolic link, so its target could change without moving its stamp");
+    if (present(commondir)) {
+        // read as git reads it (resolveAsGit), never trimmed or lexically normalized: either would let a seat-written
+        // path that names the real common directory to us lead git somewhere else
+        let actual;
+        try {
+            actual = resolveAsGit(gitdir, readFileSync(commondir));
+        }
+        catch {
+            throw new GitTrustRefusal(commondir, `names no readable directory; expected ${common}`);
+        }
+        if (!actual.equals(Buffer.from(common)))
+            throw new GitTrustRefusal(commondir, `resolves to ${actual.toString()}, not the expected common directory ${common}`);
+    }
+    const worktreeConfig = join(gitdir, "config.worktree");
+    if (linked && present(worktreeConfig) && worktreeConfigEnabled(common)) {
+        throw new GitTrustRefusal(worktreeConfig, `extensions.worktreeConfig is enabled in ${join(common, "config")}, so git would read this seat-writable file`);
+    }
+    return { gitdir, common, linked, worktree: dirname(dotGit), stamp };
+}
+/**
+ * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
+ * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
+ * would follow resolves anywhere but the expected common directory, or when the trusted common config enables
+ * extensions.worktreeConfig and the linked gitdir holds a config.worktree.
+ */
+export function assertGitTrust(cwd) {
+    checkedAuthority(cwd);
+}
+function storePin(store, env) {
+    if (!present(join(store, "HEAD")) || present(join(store, "commondir")))
+        throw new GitTrustRefusal(store, "is not an ordinary git directory");
+    const child = { ...env, GIT_DIR: store };
+    for (const k of ["GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_REFERENCE_BACKEND", "GIT_REF_STORAGE_FORMAT", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"])
+        delete child[k];
+    return { env: child, store, recheck: () => { }, release: () => { }, unview: (text) => text };
+}
+/**
+ * v2.6.8 T2: the ref store an own-git child in a linked checkout is pinned to — a private directory of this attempt
+ * whose `refs`, `packed-refs`, `logs`, `worktrees` and `HEAD` are links into the TRUSTED common directory, beside a
+ * `HEAD.lock` nothing removes. git decides "linked" from the gitdir's commondir FILE alone: while it is present the
+ * child reads this checkout's own HEAD from <view>/worktrees/<id> (its trusted gitdir) and shared refs from the trusted
+ * store; when a seat REMOVES it before the child starts, git treats the view as the repository, so no HEAD-relative
+ * write (commit, merge, cherry-pick, reset, checkout, update-ref HEAD) can take the view's HEAD lock and nothing lands
+ * on the main checkout's branch — the recheck then refuses the result. That lock also refuses a write of the MAIN
+ * worktree's HEAD from a linked checkout's own git. Only the files format can be viewed this way: any other
+ * `extensions.refStorage` is refused by name, never run unpinned.
+ */
+function refStoreView(common) {
+    const view = realpathSync(mkdtempSync(join(tmpdir(), "tickmarkr-refs-")));
+    const release = () => rmSync(view, { recursive: true, force: true }); // unlinks the links, never their targets
+    try {
+        for (const name of ["refs", "packed-refs", "logs", "worktrees", "HEAD"])
+            symlinkSync(join(common, name), join(view, name));
+        writeFileSync(join(view, "HEAD.lock"), "");
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+    return { uri: `files://${view}`, release, unview: (text) => text.split(view).join(common) };
+}
+function assertFilesRefStore(common) {
+    const format = trustedConfig(common, "extensions.refStorage") ?? "files";
+    if (format !== "files") {
+        throw new GitTrustRefusal(join(common, "config"), `extensions.refStorage is ${format}; tickmarkr's own git can pin only the files ref store, so it is refused instead of running unpinned`);
+    }
+}
+/** A detached auto gc or maintenance would outlive its child and read refs through a view already released. */
+const NO_BACKGROUND_GIT = "'gc.auto=0' 'maintenance.auto=false'";
+const PROBE_REF = "refs/tickmarkr/ref-pin-probe", PROBE_TARGET = "refs/tickmarkr/ref-pin-honoured";
+/**
+ * Whether, before the child spawns, the git its PATH resolves honours GIT_REFERENCE_BACKEND (git >= 2.54): a fresh
+ * probe repository whose own refs lack PROBE_REF, pinned to a fresh store that holds it as a symbolic ref. A git that
+ * ignores the pin reads the probe repository's own refs. Nothing is cached: each attempt probes again.
+ */
+function refStorePinHonoured(env) {
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-ref-pin-"));
+    try {
+        const repo = join(dir, "repo"), store = join(dir, "store");
+        for (const d of [join(repo, "objects"), join(repo, "refs"), join(store, "refs", "tickmarkr")])
+            mkdirSync(d, { recursive: true });
+        for (const head of [join(repo, "HEAD"), join(store, "HEAD")])
+            writeFileSync(head, "ref: refs/heads/main\n");
+        writeFileSync(join(store, PROBE_REF), `ref: ${PROBE_TARGET}\n`);
+        const probe = { ...env, GIT_DIR: repo, GIT_REFERENCE_BACKEND: `files://${store}` };
+        for (const k of ["GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"])
+            delete probe[k];
+        let read = "";
+        try {
+            read = execFileSync("git", ["symbolic-ref", PROBE_REF], { cwd: dir, env: probe, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000 }).trim();
+        }
+        catch { /* refused below */ }
+        return read === PROBE_TARGET;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+let warnedRefStorePin = false;
+/** Said once per process: the fallback below is a weaker guard, and the operator should know why and what lifts it. */
+function warnRefStorePinUnavailable() {
+    if (warnedRefStorePin)
+        return;
+    warnedRefStorePin = true;
+    console.error("tickmarkr: the git on this PATH does not honour GIT_REFERENCE_BACKEND (needs git 2.54 or newer), so tickmarkr's own git in linked checkouts runs without its ref-store pin — path pins and the post-exit commondir recheck only, the 2.6.7 guard; upgrade git for the full pin");
+}
+/**
+ * v2.6.8 T2 (P3): the same uncached check, returning the child of tickmarkr's OWN git in a linked checkout — `env`
+ * (the caller's) with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set to the canonical gitdir, trusted common directory
+ * and worktree root derived above, AND the ref store: GIT_REFERENCE_BACKEND names this attempt's private view of the
+ * trusted store (refStoreView), since git's ref store otherwise resolves shared refs through the gitdir's commondir
+ * FILE even under GIT_COMMON_DIR. So a commondir rewritten after this check (by a live worker or a surviving
+ * descendant) is followed for neither config, hooks, info/, objects nor refs: HEAD, branches, status and diffs read
+ * the real repository and every ref write lands in the trusted store, whatever an inherited GIT_CONFIG_* or ref backend
+ * says; a commondir REMOVED after it cannot move the main checkout's branch. Before such a child spawns, the git it
+ * would run must prove it honours that pin (refStorePinHonoured); one that cannot (git < 2.54) runs without it, below.
+ * Nothing here reads the command, and no caller leaves any pin. `recheck` (after the child exits) fails closed on ANY change to commondir since the check: the result
+ * of that child is never returned. An ordinary checkout or a non-repository gets no pin.
+ * NAMED RESIDUAL: git still reads $GIT_DIR/config.worktree when the trusted common config already enables
+ * extensions.worktreeConfig, so a config.worktree planted AFTER this check is not closed.
+ */
+export function ownGitPin(cwd, env, capability = {}) {
+    if ("store" in capability)
+        return storePin(capability.store, env);
+    const { createsWorktree } = capability;
+    const authority = checkedAuthority(cwd);
+    if (!authority?.linked)
+        return undefined;
+    const { gitdir, common, worktree, stamp } = authority;
+    const child = { ...env, GIT_DIR: gitdir, GIT_COMMON_DIR: common, GIT_WORK_TREE: worktree,
+        GIT_CONFIG_PARAMETERS: `${env.GIT_CONFIG_PARAMETERS?.trim() ?? ""} ${NO_BACKGROUND_GIT}`.trim() };
+    // GIT_REF_STORAGE_FORMAT only chooses a NEW repository's format; an inherited one is never a store this child follows
+    delete child.GIT_REF_STORAGE_FORMAT;
+    assertFilesRefStore(common);
+    const commondir = join(gitdir, "commondir");
+    const recheck = () => {
+        if (stampOf(commondir) !== stamp) {
+            throw new GitTrustRefusal(commondir, "changed while tickmarkr's own git ran in this checkout, so that result is refused");
+        }
+    };
+    // D-1484: a git older than 2.54 cannot take the ref-store pin. Refusing it would refuse tickmarkr's own git in every
+    // linked checkout on most installed gits, and a hostile git binary ignores every pin anyway; so it runs with the
+    // path pins and the post-exit recheck (the 2.6.7 guard). NAMED RESIDUAL there: refs still resolve through the
+    // commondir file, so a rewrite between check and exit can reach the hostile store before the recheck refuses.
+    if (!refStorePinHonoured(child)) {
+        delete child.GIT_REFERENCE_BACKEND;
+        warnRefStorePinUnavailable();
+        return { env: child, store: common, release: () => { }, unview: (text) => text, recheck };
+    }
+    const view = createsWorktree === "detached" ? { uri: `files://${common}`, release: () => { }, unview: (text) => text } : refStoreView(common);
+    child.GIT_REFERENCE_BACKEND = view.uri;
+    return { env: child, store: common, release: view.release, unview: view.unview, recheck };
+}
+/** The inert hooks directory every protected git child receives (no hook can exist beneath it). */
+export const INERT_HOOKS_PATH = "/dev/null";
+const FORCED_GIT_CONFIG = `'core.fsmonitor=false' 'core.hooksPath=${INERT_HOOKS_PATH}'`;
+/**
+ * A copy of `env` whose git children run with core.fsmonitor=false and an inert core.hooksPath, despite repo
+ * config and inherited GIT_CONFIG_COUNT/GIT_CONFIG_PARAMETERS: git applies GIT_CONFIG_PARAMETERS after
+ * GIT_CONFIG_COUNT and the last value wins, so the forced pair is appended last. Every other value survives.
+ * Named keys only — this does not neutralize arbitrary executable drivers. v2.6.8 T2: only tickmarkr's OWN git
+ * children (shGit/shGitOk) receive it; payload shells (gate commands, suites) keep the operator's git config.
+ */
+export function protectedGitEnv(env) {
+    const prior = env.GIT_CONFIG_PARAMETERS?.trim();
+    return { ...env, GIT_CONFIG_PARAMETERS: prior ? `${prior} ${FORCED_GIT_CONFIG}` : FORCED_GIT_CONFIG };
+}

package/dist/run/git.d.ts

@@ -1,6 +1,7 @@
 import type { CommandReceiptAttribution, ShellReceipt } from "./protocol.js";
 import { spawn } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
+import { type OwnGitCapability } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
@@ -168,12 +169,32 @@ export interface ShellOptions {
     /** Called once per invocation (1-based), including each pre-spawn retry. */
     receiptAttribution?: (invocation: number) => CommandReceiptAttribution;
 }
-/** Shared command seam, including invocation-bound manifested runners. */
+/** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
+ * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
+ * or the command text. tickmarkr's own git goes through shGit/shGitOk. */
 export declare function shell(cmd: string, cwd: string, timeoutMs: number, login?: boolean, options?: ShellOptions): Promise<ShResult>;
+/**
+ * v2.6.8 T2: what an OWN-GIT caller declares at its call site — never inferred from the command text. Every own-git
+ * child in a linked checkout keeps the path pin and the ref-store pin; `createsWorktree` is the worktree capability the
+ * branch-creating call sites declare, and addDetachedWorktree is the detached one (see OwnGitCapability and ownGitPin).
+ */
+export type OwnGitOptions = OwnGitCapability;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options?: ShellOptions): Promise<ShResult>;
-export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
-export declare function shGitOk(cmd: string, cwd: string): Promise<string>;
+export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
+/**
+ * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
+ * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
+ * and checks out nothing, and no own-git step ever runs unpinned instead: the commit-ish is resolved to an object id in
+ * `cwd`'s checkout (HEAD and branch names read the trusted store), the checkout is added `--no-checkout --detach` at
+ * that id (its ref store pinned to the trusted common directory, see DetachedAddCapability), and then — pinned to the
+ * NEW checkout's own authority — its HEAD is written as that id, git's `refs/heads/.invalid` stub ref is deleted and the
+ * checkout is populated.
+ * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
+ * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
+ */
+export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number): Promise<ShResult>;
 export declare function npmDependencyManifestChanged(cwd: string, baselineRef: string): Promise<boolean>;
 export declare function npmDependencyInstallCommand(cwd: string): string;
 export declare function gitHead(cwd: string): Promise<string>;