zigmini 1.0.0-beta.2 → 1.1.0-beta.1

package/host/document-reader/HostSelector.swift

@@ -0,0 +1,192 @@
+import Foundation
+import Darwin
+import CryptoKit
+
+enum SelectorFailure: Error {
+    case access, changed, limit
+    var code: HelperFailureCode {
+        switch self {
+        case .access: return .hostAccessDenied
+        case .changed: return .fileChanged
+        case .limit: return .processingLimit
+        }
+    }
+}
+
+// Directory authority is a chain of descriptors, never a canonicalized pathname
+// checked now and reopened later. No parser framework is linked to this entrypoint.
+enum HostSelector {
+    private static func identity(_ value: stat) throws -> NativeIdentity {
+        NativeIdentity(device: String(value.st_dev), inode: String(value.st_ino),
+            size: Int(value.st_size),
+            mtimeNs: try NativeIdentity.nanoseconds(seconds: Int64(value.st_mtimespec.tv_sec), nanoseconds: value.st_mtimespec.tv_nsec),
+            ctimeNs: try NativeIdentity.nanoseconds(seconds: Int64(value.st_ctimespec.tv_sec), nanoseconds: value.st_ctimespec.tv_nsec),
+            nlink: Int(value.st_nlink))
+    }
+    private static func regular(_ value: stat) -> Bool {
+        value.st_mode & S_IFMT == S_IFREG && value.st_nlink == 1
+    }
+    private static func supported(_ name: String) -> Bool {
+        let suffix = (name as NSString).pathExtension.lowercased()
+        return ["html", "htm", "md", "markdown", "txt", "pdf"].contains(suffix)
+    }
+    private static func directory(_ parent: Int32, _ name: String) throws -> Int32 {
+        let fd = openat(parent, name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC)
+        guard fd >= 0 else { throw SelectorFailure.access }
+        var value = stat()
+        guard fstat(fd, &value) == 0, value.st_mode & S_IFMT == S_IFDIR else {
+            close(fd); throw SelectorFailure.access
+        }
+        return fd
+    }
+    private static func root(_ root: SelectorRoot) throws -> Int32 {
+        guard let record = getpwuid(getuid()), let homePointer = record.pointee.pw_dir else { throw SelectorFailure.access }
+        #if HOST_SELECTOR_TESTING
+        // Compiled out of the shipping selector. Only the owned fixture build can
+        // replace trusted roots or subscribe to deterministic syscall boundaries.
+        guard let fixtureHome = ProcessInfo.processInfo.environment["HOST_SELECTOR_TEST_HOME"],
+              let fixtureComputer = ProcessInfo.processInfo.environment["HOST_SELECTOR_TEST_COMPUTER"] else {
+            throw SelectorFailure.access
+        }
+        let home = fixtureHome, computer = fixtureComputer
+        _ = homePointer
+        #else
+        let home = String(cString: homePointer), computer = "/"
+        #endif
+        let path = root == .computer ? computer : home
+        var fd = open("/", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC)
+        guard fd >= 0, path.hasPrefix("/") else { if fd >= 0 { close(fd) }; throw SelectorFailure.access }
+        do {
+            for component in path.split(separator: "/") {
+                let next = try directory(fd, String(component)); close(fd); fd = next
+            }
+            if root == .downloads {
+                let next = try directory(fd, "Downloads"); close(fd); fd = next
+            }
+            return fd
+        } catch { close(fd); throw error }
+    }
+    private static func traverse(_ request: SelectorRequest, components: ArraySlice<String>) throws -> Int32 {
+        var fd = try root(request.root)
+        do {
+            for (index, component) in components.enumerated() {
+                try boundary("component.before:\(index)")
+                let next = try directory(fd, component); close(fd); fd = next
+            }
+            return fd
+        } catch { close(fd); throw error }
+    }
+    static func handle(_ request: SelectorRequest, emit: (HelperFrame) throws -> Void) throws {
+        try HelperCodec.validate(.selector(request))
+        switch request.operation {
+        case .list: try list(request, emit: emit)
+        case .snapshot: try snapshot(request, emit: emit)
+        }
+    }
+    private static func list(_ request: SelectorRequest, emit: (HelperFrame) throws -> Void) throws {
+        let fd = try traverse(request, components: request.segments[...])
+        guard let stream = fdopendir(fd) else { close(fd); throw SelectorFailure.access }
+        defer { closedir(stream) }
+        var entries: [NativeEntry] = []
+        let query = (request.query ?? "").lowercased()
+        // Keep at most the next page plus one lookahead, even for huge directories.
+        while true {
+            errno = 0
+            guard let pointer = readdir(stream) else {
+                guard errno == 0 else { throw SelectorFailure.access }
+                break
+            }
+            let name = withUnsafePointer(to: &pointer.pointee.d_name) {
+                $0.withMemoryRebound(to: CChar.self, capacity: Int(pointer.pointee.d_namlen) + 1) {
+                    String(validatingCString: $0)
+                }
+            }
+            guard let name, name != ".", name != ".." else { continue }
+            if request.showHidden != true && name.hasPrefix(".") { continue }
+            if !query.isEmpty && !name.lowercased().contains(query) { continue }
+            if let after = request.afterName, !after.utf8.lexicographicallyPrecedes(name.utf8) { continue }
+            var value = stat()
+            let available = fstatat(fd, name, &value, AT_SYMLINK_NOFOLLOW) == 0
+            if available && request.showHidden != true && value.st_flags & UInt32(UF_HIDDEN) != 0 { continue }
+            let row: NativeEntry
+            if available && value.st_mode & S_IFMT == S_IFDIR {
+                row = NativeEntry(name: name, kind: .directory, identity: nil, selectable: true, reason: nil)
+            } else if available && regular(value) && supported(name) && (1...HelperLimits.originalBytes).contains(Int(value.st_size)) {
+                row = NativeEntry(name: name, kind: .file, identity: try identity(value), selectable: true, reason: nil)
+            } else {
+                let reason = !available ? "host_access_denied" :
+                    value.st_mode & S_IFMT != S_IFREG ? "nonregular" :
+                    value.st_nlink != 1 ? "hardlink" : !supported(name) ? "unsupported" : "size_limit"
+                row = NativeEntry(name: name, kind: .disabled, identity: nil, selectable: false, reason: reason)
+            }
+            entries.append(row)
+            entries.sort { $0.name.utf8.lexicographicallyPrecedes($1.name.utf8) }
+            if entries.count > 51 { entries.removeLast() }
+        }
+        let more = entries.count > 50
+        if more { entries.removeLast() }
+        try emit(.listed(SelectorListed(requestId: request.requestId, entries: entries, nextName: more ? entries.last?.name : nil)))
+    }
+    private static func snapshot(_ request: SelectorRequest, emit: (HelperFrame) throws -> Void) throws {
+        guard let name = request.segments.last, supported(name), let expected = request.expectedIdentity else {
+            throw SelectorFailure.changed
+        }
+        let parent = try traverse(request, components: request.segments.dropLast())
+        defer { close(parent) }
+        try boundary("leaf.before")
+        // NONBLOCK prevents a swapped FIFO from blocking before fstat rejects it.
+        let fd = openat(parent, name, O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC)
+        guard fd >= 0 else { throw SelectorFailure.changed }
+        defer { close(fd) }
+        var value = stat()
+        guard fstat(fd, &value) == 0, regular(value) else { throw SelectorFailure.changed }
+        let before = try identity(value)
+        guard before == expected else { throw SelectorFailure.changed }
+        try boundary("copy.before")
+        var buffer = [UInt8](repeating: 0, count: 65_536)
+        var total = 0
+        var index = 0
+        var hash = SHA256()
+        while true {
+            let count = read(fd, &buffer, buffer.count)
+            guard count >= 0 else { throw SelectorFailure.access }
+            if count == 0 { break }
+            total += count
+            guard total <= HelperLimits.originalBytes else { throw SelectorFailure.limit }
+            guard total <= before.size else { throw SelectorFailure.changed }
+            let chunk = Data(buffer.prefix(count))
+            hash.update(data: chunk)
+            try emit(.chunk(SnapshotChunk(requestId: request.requestId, index: index, base64: chunk.base64EncodedString())))
+            try boundary("copy.chunk:\(index)")
+            index += 1
+        }
+        guard fstat(fd, &value) == 0, regular(value) else { throw SelectorFailure.changed }
+        let after = try identity(value)
+        guard before == after, total == before.size, total > 0 else { throw SelectorFailure.changed }
+        let digest = hash.finalize().map { String(format: "%02x", $0) }.joined()
+        try emit(.snapshotComplete(SnapshotComplete(requestId: request.requestId, before: before, after: after, bytes: total, sha256: digest)))
+    }
+    private static func boundary(_ stage: String) throws {
+        #if HOST_SELECTOR_TESTING
+        let env = ProcessInfo.processInfo.environment
+        guard env["HOST_SELECTOR_TEST_STAGE"] == stage, let path = env["HOST_SELECTOR_TEST_BARRIER"] else { return }
+        var address = sockaddr_un()
+        address.sun_family = sa_family_t(AF_UNIX)
+        address.sun_len = UInt8(MemoryLayout<sockaddr_un>.size)
+        let bytes = Array(path.utf8) + [0]
+        guard bytes.count <= MemoryLayout.size(ofValue: address.sun_path) else { throw SelectorFailure.limit }
+        withUnsafeMutableBytes(of: &address.sun_path) { destination in destination.copyBytes(from: bytes) }
+        let socketFD = socket(AF_UNIX, SOCK_STREAM, 0)
+        guard socketFD >= 0 else { throw SelectorFailure.access }
+        defer { close(socketFD) }
+        let connected = withUnsafePointer(to: &address) {
+            $0.withMemoryRebound(to: sockaddr.self, capacity: 1) { connect(socketFD, $0, socklen_t(MemoryLayout<sockaddr_un>.size)) }
+        }
+        guard connected == 0 else { throw SelectorFailure.access }
+        let message = Array((stage + "\n").utf8)
+        guard write(socketFD, message, message.count) == message.count else { throw SelectorFailure.access }
+        var ack = [UInt8](repeating: 0, count: 3)
+        guard read(socketFD, &ack, ack.count) > 0 else { throw SelectorFailure.access }
+        #endif
+    }
+}