msgctl 0.1.0a1__py3-none-any.whl

msg/extensions/rss.py

@@ -0,0 +1,67 @@
+"""Read-only RSS 2.0 projection over the same resource visibility checks."""
+from __future__ import annotations
+from email.utils import format_datetime
+from xml.etree import ElementTree as ET
+from msg.core.codec import canonical, digest, wire, decode, loads
+from msg.core.models import Resource, ResourceRef, HandlerOutput
+from msg.plugins.common import resolve, check_access
+from msg.plugins.discovery import visible, next_link
+from msg.plugins.schemas import obj, IDENTIFIER, STRING
+
+
+def register(app, op):
+    @op('discovery.feed', obj({'parent':IDENTIFIER, 'cursor':STRING,
+        'limit':{'type':'integer','minimum':1,'maximum':100}},()), effect='read')
+    async def feed(ctx, request, tx):
+        args = request.arguments
+        parent = await resolve(tx,args['parent']) if args.get('parent') else None
+        if parent:
+            await check_access(app,ctx,request,tx,parent,'list')
+        binding = digest({'parent':parent,'limit':args.get('limit',30)})
+        position = app.cursors.decode(args['cursor'],'rss',binding) if args.get('cursor') else None
+        parameters = []
+        conditions = []
+        if position is not None:
+            conditions.append(' AND (created_at,id)<(?,?)')
+            parameters.extend(position)
+        if parent:
+            conditions.append(' AND parent=?')
+            parameters.append(parent)
+        limit = args.get('limit',30)
+        items=[];more=False;last=position
+        for raw in tx.execute("SELECT body FROM resources WHERE type='post' AND state='active'"+
+                              ''.join(conditions)+' ORDER BY created_at DESC,id DESC',parameters):
+            resource = decode(Resource,loads(raw[0]))
+            if not await visible(app,ctx,request,tx,resource.id):
+                continue
+            if len(items)==limit:
+                more=True
+                break
+            revision = await tx.revision(ResourceRef(id=resource.id))
+            items.append({'id':resource.id,'revision':revision.id,'title':resource.name,
+                'url':app.settings.service_url+'/_id/'+resource.id,'created_at':wire(resource.created_at),
+                'digest':revision.manifest_digest})
+            last=[wire(resource.created_at),resource.id]
+        data={'title':'msg.lmm.best','home':app.settings.service_url,'items':items}
+        if more:
+            cursor=app.cursors.encode('rss',binding,last)
+            data.update(cursor=cursor,next=next_link(app,'discovery.feed',{**args,'cursor':cursor}),
+                        next_requires_auth=ctx.principal.subject is not None)
+        return HandlerOutput(data=data)
+
+
+def render_feed(data):
+    from msg.core.codec import parse_time
+    root=ET.Element('rss',{'version':'2.0'})
+    channel=ET.SubElement(root,'channel')
+    for key,value in {'title':data['title'],'link':data['home'],
+                      'description':'Agent communication resource references','generator':'msg'}.items():
+        ET.SubElement(channel,key).text=value
+    for item in data['items']:
+        node=ET.SubElement(channel,'item')
+        ET.SubElement(node,'title').text=item['title']
+        ET.SubElement(node,'link').text=item['url']
+        ET.SubElement(node,'guid',{'isPermaLink':'false'}).text=item['id']
+        ET.SubElement(node,'pubDate').text=format_datetime(parse_time(item['created_at']),usegmt=True)
+        ET.SubElement(node,'description').text='Revision '+item['revision']+'; '+item['digest']
+    return ET.tostring(root,encoding='utf-8',xml_declaration=True)

msg/extensions/ssh.py

@@ -0,0 +1,264 @@
+"""OpenSSH forced-command adapter. No PTY, forwarding, shell or root proxy.
+
+Only this OS-authenticated adapter constructs an SSH principal. A source field,
+IP address, token, or network request can never opt into SSH authentication.
+"""
+from __future__ import annotations
+
+import asyncio
+from dataclasses import replace
+from datetime import timedelta
+import os
+from pathlib import Path
+import re
+import shlex
+import sys
+import time
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from msg.constants import ROOT_SUBJECT
+from msg.core.codec import canonical, decode, digest, wire
+from msg.core.errors import Failure, require
+from msg.core.packet import result_wire
+from msg.core.models import Credential, Principal, Signature, SignatureProof, CapabilityGrant, HandlerOutput, EffectJob, ResourceRef
+from msg.core.requests import request_for, payload_fields
+from msg.plugins.common import operation_id, check_access, new_id, resolve
+from msg.plugins.communication import event_id
+from msg.plugins.identity import controlled_owner, validate_ceiling
+from msg.plugins.schemas import obj, STRING, SIGNATURE, GRANTS, IDENTIFIER
+from msg.security.crypto import key_id, verify
+
+
+def public_key(line):
+    require(isinstance(line, str) and '\n' not in line and '\r' not in line, 'invalid_ssh_key')
+    fields = line.split()
+    require(len(fields) in {2, 3} and fields[0] == 'ssh-ed25519', 'unsupported_ssh_key')
+    normalized = ' '.join(fields[:2])
+    try:
+        key = serialization.load_ssh_public_key(normalized.encode('ascii'))
+        require(isinstance(key, Ed25519PublicKey), 'unsupported_ssh_key')
+        return normalized, key.public_bytes_raw()
+    except (ValueError, TypeError, UnicodeError) as exc:
+        raise Failure('invalid_ssh_key') from exc
+
+
+def parse_command(command):
+    require(isinstance(command, str) and 0 < len(command) <= 32768 and
+            not any(ord(c) < 32 or ord(c) == 127 for c in command), 'ssh_command_denied')
+    try:
+        args = shlex.split(command, posix=True)
+    except ValueError as exc:
+        raise Failure('ssh_command_denied') from exc
+    if len(args) == 2 and args[0] in {'git-upload-pack', 'git-receive-pack'}:
+        require(re.fullmatch(r'/[@&][a-z][a-z0-9-]{1,40}/[A-Za-z0-9][A-Za-z0-9_.-]{0,90}\.git', args[1]) is not None,
+                'ssh_command_denied')
+        return args[0], args[1]
+    if len(args) == 4 and args[:2] == ['msg', 'call']:
+        require(re.fullmatch(r'[a-z][a-z0-9_.]+', args[2]) is not None, 'ssh_command_denied')
+        return 'call', args[2], args[3]
+    if len(args) == 3 and args[:2] == ['msg', 'packet']:
+        require(re.fullmatch(r'[A-Za-z0-9_-]+', args[2]) is not None, 'ssh_command_denied')
+        return 'packet', args[2]
+    raise Failure('ssh_command_denied')
+
+
+def require_sshd_process():
+    """Check an actual root-owned sshd ancestor, not a client-supplied environment."""
+    require(sys.platform == 'linux' and os.geteuid() != 0, 'ssh_os_isolation_required')
+    pid = os.getppid()
+    for _ in range(6):
+        if pid <= 1:
+            break
+        directory = Path('/proc') / str(pid)
+        try:
+            name = (directory / 'comm').read_text().strip()
+            status = dict(line.split(':', 1) for line in (directory / 'status').read_text().splitlines() if ':' in line)
+            if name in {'sshd', 'sshd-session', 'sshd-auth'}:
+                # Linux may hide /proc/<root-pid>/exe from an unprivileged
+                # child. The root-owned process identity cannot be forged by
+                # the dedicated service account; arbitrary ancestor names can.
+                uids = [int(value) for value in status['Uid'].split()]
+                if directory.stat().st_uid == 0 and len(uids) == 4 and all(uid == 0 for uid in uids):
+                    return
+                # A root-owned executable proves nothing: an unprivileged
+                # Python/shell process can set its comm to "sshd". Continue to
+                # the privileged monitor/listener instead of trusting that
+                # process, including a user-launched OpenSSH daemon.
+            pid = int(status['PPid'].strip())
+        except (OSError, ValueError, KeyError):
+            break
+    raise Failure('ssh_os_isolation_required')
+
+
+async def ssh_principal(app, credential_id, tx):
+    require(tx.setting('active_root_certificate',app.certificates.root_certificate.resource_id)==
+            app.certificates.root_certificate.resource_id,'service_restart_required')
+    credential = await tx.credential(credential_id)
+    require(credential.kind == 'ssh_key', 'wrong_credential_kind')
+    subject = await tx.subject(credential.subject_id)
+    require(subject.resource_id != ROOT_SUBJECT and not subject.local_only, 'local_only')
+    now = app.clock()
+    require(credential.revoked_at is None, 'credential_revoked')
+    require(credential.not_before <= now and (credential.expires_at is None or now < credential.expires_at),
+            'credential_expired')
+    require(credential.ceiling, 'credential_ceiling')
+    certificates = tuple(tx.setting('ssh_certificates:' + credential_id, []))
+    principal = Principal(actor=subject.resource_id, subject=subject.resource_id, credential_id=credential.id,
+                          method='ssh', certificates=certificates, ceiling=credential.ceiling)
+    await app.authorizer.grants(principal, tx)
+    return principal
+
+
+class SSHAuthenticator:
+    """Bound to the credential OpenSSH has already authenticated, never wire data."""
+    def __init__(self, app, credential_id):
+        self.app, self.credential_id = app, credential_id
+
+    async def authenticate(self, request, session, *, entry):
+        require(entry == 'network', 'entry_not_allowed')
+        principal = await ssh_principal(self.app, self.credential_id, session)
+        spec = self.app.registry.operation(request.operation, request.contract_version)
+        require('network' in spec.entries, 'entry_not_allowed')
+        require(request.protocol_version == 1 and request.target_service == self.app.settings.service_url, 'wrong_service')
+        require(request.payload_digest == digest(payload_fields(request)), 'payload_digest_mismatch')
+        require(request.expires_at is not None and self.app.clock() < request.expires_at and
+                (request.expires_at - self.app.clock()).total_seconds() <= 300, 'request_expired')
+        require(request.subject in {None, principal.subject}, 'ssh_subject_mismatch')
+        require(any(f'{spec.name}@{spec.version}' in g.operations for g in principal.ceiling), 'credential_ceiling')
+        if request.proof is not None:
+            require(isinstance(request.proof, SignatureProof), 'ssh_signed_packet_required')
+            require(request.proof.signature.key_id == self.credential_id, 'ssh_signature_key_mismatch')
+            credential = await session.credential(self.credential_id)
+            from msg.core.requests import signing_bytes
+            verify(credential.verifier, signing_bytes(request), request.proof.signature, purpose='request')
+            # Bind the portable signature to the same SSH key. This preserves
+            # channel revocation for delayed jobs, rather than losing it by
+            # substituting another application key after the handshake.
+            for id in request.proof.certificates:
+                cert = await self.app.certificates.validate(id, session)
+                require(cert.key_id == credential.id and cert.subject_id == principal.subject,
+                        'certificate_subject_mismatch')
+            return replace(principal, method='signature', certificates=request.proof.certificates)
+        require(not spec.require_signature, 'signature_required')
+        # A successful SSH handshake is not a portable digitally signed ACK.
+        require(spec.name != 'discussion.ack', 'ack_signature_or_token_required')
+        return principal
+
+
+def register(app, op):
+    @op('identity.ssh_key_add', obj({'public_key': STRING, 'proof': SIGNATURE, 'ceiling': GRANTS},
+                                  ('public_key', 'proof', 'ceiling')), signature=True)
+    async def add(ctx, request, tx):
+        subject = await controlled_owner(app, ctx, request, tx)
+        require(subject.kind == 'registered', 'registered_identity_required')
+        line, public = public_key(request.arguments['public_key'])
+        verify(public, canonical({'subject_id': subject.resource_id, 'public_key': line}),
+               decode(Signature, request.arguments['proof']), purpose='ssh-key-add')
+        grants = tuple(decode(CapabilityGrant, g) for g in request.arguments['ceiling'])
+        require(grants, 'credential_ceiling')
+        await validate_ceiling(app, ctx, tx, grants)
+        id = key_id(public)
+        require(tx.one('SELECT id FROM credentials WHERE id=?', (id,)) is None, 'credential_already_registered')
+        await tx.save_credential(Credential(id=id, subject_id=subject.resource_id, kind='ssh_key', verifier=public,
+            ceiling=grants, not_before=ctx.now, expires_at=None, revoked_at=None), subject.auth_version)
+        tx.set_setting('ssh_public:' + id, line)
+        return HandlerOutput(data={'key_id': id, 'subject_id': subject.resource_id})
+
+    @op('identity.ssh_key_revoke', obj({'key_id': IDENTIFIER}, ('key_id',)), signature=True)
+    async def revoke(ctx, request, tx):
+        subject = await controlled_owner(app, ctx, request, tx)
+        key = await tx.credential(request.arguments['key_id'])
+        require(key.kind == 'ssh_key' and key.subject_id == subject.resource_id, 'credential_subject_mismatch')
+        await tx.save_credential(replace(key, revoked_at=ctx.now), subject.auth_version)
+        return HandlerOutput(data={'key_id': key.id, 'revoked': True})
+
+    @op('identity.ssh_certificates', obj({'key_id': IDENTIFIER, 'certificates': {'type':'array','items':IDENTIFIER,'uniqueItems':True}},
+                                        ('key_id','certificates')), signature=True)
+    async def certificates(ctx, request, tx):
+        subject = await controlled_owner(app, ctx, request, tx)
+        key = await tx.credential(request.arguments['key_id'])
+        require(key.kind == 'ssh_key' and key.subject_id == subject.resource_id, 'credential_subject_mismatch')
+        for id in request.arguments['certificates']:
+            cert = await app.certificates.validate(id, tx)
+            require(cert.key_id == key.id and cert.subject_id == subject.resource_id, 'certificate_subject_mismatch')
+        tx.set_setting('ssh_certificates:' + key.id, request.arguments['certificates'])
+        return HandlerOutput(data={'key_id':key.id, 'certificates':request.arguments['certificates']})
+
+    @op('git.receive', obj({'id':IDENTIFIER}, ('id',)), effect='external')
+    async def receive(ctx, request, tx):
+        require(ctx.principal.method == 'ssh', 'ssh_transport_required')
+        rid = await resolve(tx, request.arguments['id'])
+        require((await tx.resource(rid)).type == 'repo', 'not_a_repository')
+        await check_access(app, ctx, request, tx, rid, 'write')
+        id, eid = new_id('job'), event_id(request, ctx.principal.subject)
+        job = EffectJob(id=id, event_id=eid, kind='git.receive', dedupe_key='git-receive:' + eid,
+            principal=ctx.principal, operation='git.receive', arguments={'id':rid, 'request_id':request.request_id},
+            state='running', attempts=1, next_attempt_at=ctx.now, lease_until=ctx.now+timedelta(seconds=600))
+        await tx.enqueue(job)
+        return HandlerOutput(resources=(ResourceRef(id=rid),), data={'job_id':id})
+
+
+async def authorized_key(config_dir, key_type, key_body):
+    from msg.application import Application
+    from msg.config import load_settings
+    line, public = public_key(key_type + ' ' + key_body)
+    app = Application(load_settings(config_dir))
+    await app.load()
+    try:
+        async with app.metadata.transaction(write=False) as tx:
+            principal = await ssh_principal(app, key_id(public), tx)
+            require(tx.setting('ssh_public:' + principal.credential_id) == line, 'invalid_ssh_key')
+        command = shlex.join([sys.executable, '-m', 'msg.daemon', '--config-dir', str(Path(config_dir).resolve()),
+                              'ssh-session', '--credential', principal.credential_id])
+        escaped = command.replace('\\', '\\\\').replace('"', '\\"')
+        return f'restrict,command="{escaped}" {line}'
+    finally:
+        await app.close()
+
+
+async def forced_session(config_dir, credential_id):
+    require_sshd_process()
+    from msg.application import Application
+    from msg.config import load_settings
+    from msg.daemon import network_runtime
+    app = Application(load_settings(config_dir))
+    network_runtime(app.settings)
+    await app.load()
+    try:
+        command = parse_command(os.environ.get('SSH_ORIGINAL_COMMAND', ''))
+        auth = SSHAuthenticator(app, credential_id)
+        executor = app.new_executor(auth)
+        async with app.metadata.transaction(write=False) as tx:
+            principal = await ssh_principal(app, credential_id, tx)
+        if command[0] in {'call','packet'}:
+            from msg.core.codec import loads
+            from msg.transports.packet import path_packet
+            if command[0] == 'packet':
+                packet = path_packet(command[1], 'j', app.settings.server.limits.max_request_bytes)
+            else:
+                packet = request_for(command[1], loads(command[2]), app.settings.service_url, subject=principal.subject,
+                    expires_at=app.clock()+timedelta(seconds=120), source='manual')
+            result = await executor.execute(packet)
+            print(canonical(result_wire(result)).decode())
+            return 0 if result.status in {'ok','accepted'} else 1
+        from msg.extensions.repositories import NativeGitStore
+        store = NativeGitStore(app)
+        operation = 'git.refs' if command[0]=='git-upload-pack' else 'git.receive'
+        packet = request_for(operation, {'id':command[1]}, app.settings.service_url, subject=principal.subject,
+                             expires_at=app.clock()+timedelta(seconds=120))
+        result = await executor.execute(packet)
+        require(result.status in {'ok','accepted'}, result.error.code if result.error else 'permission_denied')
+        rid = result.data['resource_id'] if operation=='git.refs' else result.resources[0].id
+        if operation=='git.receive':
+            from msg.extensions.ssh_git import receive_pack
+            return await receive_pack(app, result.data['job_id'])
+        process = await asyncio.create_subprocess_exec('git','--git-dir',str(store.path(rid)),
+            '-c','core.hooksPath=/dev/null','upload-pack','--strict',str(store.path(rid)),env=store.env)
+        try:
+            return await asyncio.wait_for(process.wait(),600)
+        finally:
+            if process.returncode is None:process.kill();await process.wait()
+    finally:
+        await app.close()

msg/extensions/ssh_git.py

@@ -0,0 +1,300 @@
+"""Bridge Git's reference transaction to a current-authority metadata transaction.
+
+Pack upload happens without holding a PostgreSQL write transaction. The
+reference hook reauthorizes at ref preparation. Git and PostgreSQL are not one
+atomic storage engine: a lost commit acknowledgement is recorded as uncertain.
+"""
+from __future__ import annotations
+
+import asyncio
+from dataclasses import replace
+import hashlib
+import hmac
+import os
+from pathlib import Path
+import secrets
+import shlex
+import sys
+import tempfile
+
+from msg.core.codec import b64, canonical, loads, wire
+from msg.core.errors import Failure, require
+from msg.extensions.repositories import (NativeGitStore, MAX_GIT_PACK_BYTES, MAX_GIT_UPLOAD_SECONDS,
+    require_git_repository_capacity)
+from msg.plugins.common import check_access
+from msg.storage.git import durable_write
+from msg.workers.effects import current_principal, worker_context, effect_request
+
+
+class ReferenceGuard:
+    def __init__(self, app, job):
+        self.app, self.job = app, job
+        self.queue = asyncio.Queue()
+        self.changed = False
+        self.uncertain = False
+        self.failures = []
+
+    async def authorize(self, tx):
+        current = await tx.job(self.job.id)
+        require(current.state == 'running' and current.attempts == self.job.attempts, 'job_lease_lost')
+        principal = await current_principal(self.app, self.job.principal, tx)
+        context, request = worker_context(self.app, self.job, principal), effect_request(self.app, self.job, principal)
+        await check_access(self.app, context, request, tx, self.job.arguments['id'], 'write')
+        require(tx.setting('runtime_config', {}).get('accept_writes', True), 'writes_paused')
+        return principal
+
+    @staticmethod
+    def validate_changes(text):
+        require(isinstance(text, str) and len(text.encode()) <= 65536, 'git_ref_batch_too_large')
+        rows = []
+        import re
+        for line in text.splitlines():
+            fields = line.split(' ')
+            require(len(fields) == 3, 'invalid_git_change')
+            old, new, ref = fields
+            require(re.fullmatch(r'[0-9a-f]{40}', old) is not None and re.fullmatch(r'[0-9a-f]{40}', new) is not None,
+                    'invalid_git_change')
+            require(ref == 'HEAD' or re.fullmatch(r'refs/(heads|tags)/[^\s]+', ref) is not None, 'invalid_git_ref')
+            rows.append({'ref':ref, 'old':old, 'new':new})
+        require(0 < len(rows) <= 128 and len({r['ref'] for r in rows}) == len(rows), 'invalid_git_change')
+        return rows
+
+    async def run(self):
+        """One task owns both halves of each PostgreSQL transaction."""
+        manager = tx = None
+        preparing = prepared = None
+        while True:
+            message, answer = await self.queue.get()
+            try:
+                state = message['state']
+                if state == 'stop':
+                    if manager is not None:
+                        self.uncertain = True
+                        await manager.__aexit__(Failure, Failure('external_uncertain'), None)
+                    answer.set_result({'ok':True})
+                    return
+                changes = self.validate_changes(message['changes'])
+                if state == 'preparing':
+                    require(manager is None, 'git_transaction_already_prepared')
+                    # Git 2.54+ invokes this phase before taking ref locks.
+                    # Preflight current authority without holding a PostgreSQL write
+                    # transaction, then re-check inside the prepared phase.
+                    async with self.app.metadata.transaction(write=False) as preflight:
+                        await self.authorize(preflight)
+                    preparing = changes
+                elif state == 'prepared':
+                    require(manager is None, 'git_transaction_already_prepared')
+                    require(preparing is None or changes == preparing, 'git_transaction_mismatch')
+                    manager = self.app.metadata.transaction(write=True)
+                    tx = await manager.__aenter__()
+                    try:
+                        await self.authorize(tx)
+                    except BaseException:
+                        await manager.__aexit__(*sys.exc_info())
+                        manager = tx = None
+                        raise
+                    prepared = changes
+                elif state in {'committed', 'aborted'}:
+                    require(manager is not None and changes == prepared, 'git_transaction_mismatch')
+                    active = manager
+                    manager = None
+                    if state == 'aborted':
+                        await active.__aexit__(Failure, Failure('git_transaction_aborted'), None)
+                    else:
+                        self.changed = True
+                        try:
+                            resource = await tx.resource(self.job.arguments['id'])
+                            await tx.replace(replace(resource, generation=resource.generation + 1,
+                                modified_at=self.app.clock(), modified_by=self.job.principal.actor), resource.generation)
+                            history = tx.setting('git_receive:' + self.job.id, [])
+                            history.append({'time':wire(self.app.clock()), 'refs':changes})
+                            tx.set_setting('git_receive:' + self.job.id, history)
+                            from msg.core.models import Event, AuditEvent, ResourceRef
+                            from msg.core.codec import digest
+                            from msg.plugins.common import new_id
+                            event = Event(id=new_id('event'), type='git.refs_committed', time=self.app.clock(),
+                                request_id=self.job.arguments['request_id'], actor=self.job.principal.actor,
+                                subject=self.job.principal.subject, resources=(), data={'job_id':self.job.id, 'refs':changes})
+                            await tx.append_event(event)
+                            await tx.append_audit(AuditEvent(event=event,
+                                authority=tuple(ResourceRef(id=c) for c in self.job.principal.certificates),
+                                before_digest=digest(resource), after_digest=digest(changes),
+                                previous_digest=None, entry_digest='', result='refs_committed'))
+                            await active.__aexit__(None, None, None)
+                        except BaseException:
+                            self.uncertain = True
+                            if not tx.closed:
+                                await active.__aexit__(*sys.exc_info())
+                            raise
+                    tx = preparing = prepared = None
+                else:
+                    raise Failure('invalid_git_hook_state')
+                answer.set_result({'ok':True})
+            except BaseException as exc:
+                code = exc.code if isinstance(exc, Failure) else 'git_guard_failed'
+                self.failures.append(code)
+                if not answer.done():
+                    answer.set_result({'ok':False, 'code':code})
+
+    async def message(self, value):
+        answer = asyncio.get_running_loop().create_future()
+        await self.queue.put((value, answer))
+        return await asyncio.shield(answer)
+
+
+def hook_program(socket_path, secret):
+    """Generated from trusted code, not from a repository or user command."""
+    return ('#!' + sys.executable + '\n' +
+        'import json,socket,sys\n'
+        'data=sys.stdin.buffer.read(65537)\n'
+        'if len(data)>65536: sys.exit(1)\n'
+        's=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM);s.settimeout(45)\n' +
+        's.connect(' + repr(str(socket_path)) + ')\n' +
+        's.sendall((json.dumps({"secret":' + repr(secret) + ',"state":sys.argv[1],"changes":data.decode("ascii")})+"\\n").encode())\n'
+        'r=s.makefile("rb").readline(8193)\n'
+        'sys.exit(0 if r and len(r)<=8192 and json.loads(r).get("ok") else 1)\n').encode()
+
+
+async def relay_bounded_stdin(process, stream, *, limit, timeout):
+    """Copy stream to process stdin, rejecting once limit bytes have been seen."""
+    loop=asyncio.get_running_loop()
+    total=0
+    async def pump():
+        nonlocal total
+        while True:
+            chunk=await loop.run_in_executor(None, stream.read, 65536)
+            if not chunk:
+                break
+            total+=len(chunk)
+            require(total<=limit,'request_too_large')
+            process.stdin.write(chunk)
+            await process.stdin.drain()
+        process.stdin.close()
+    await asyncio.wait_for(pump(), timeout)
+    return await asyncio.wait_for(process.wait(), timeout)
+
+
+async def guarded_command(app, job, command_factory, *, stdin=None, stdout=None, stderr=None, timeout=600,
+                          input_data=None,input_file=None,capture_output=False,output_limit=None,cache_result_key=None,
+                          stdin_byte_limit=None,stdin_stream=None):
+    """Run a fixed Git command with a private reference-transaction hook.
+
+    command_factory is installed adapter code, never a value accepted from wire.
+    Tests exercise this bridge with real update-ref; the SSH adapter uses receive-pack.
+    """
+    store = NativeGitStore(app)
+    require(input_data is None or input_file is None,'ambiguous_git_input')
+    require(stdin_byte_limit is None or (input_data is None and input_file is None),'ambiguous_git_input')
+    app.settings.server.staging_dir.mkdir(parents=True, exist_ok=True)
+    # Unix socket path has a small OS limit; the random private directory is not
+    # an account directory and contains no application credentials.
+    with tempfile.TemporaryDirectory(prefix='msg-git-') as temporary:
+        directory = Path(temporary)
+        socket_path = directory/'guard.sock'
+        secret = secrets.token_hex(32)
+        guard = ReferenceGuard(app, job)
+        task = asyncio.create_task(guard.run())
+        async def connection(reader, writer):
+            try:
+                raw = await asyncio.wait_for(reader.readline(), 45)
+                require(len(raw) <= 70000, 'git_hook_message_too_large')
+                value = loads(raw)
+                require(hmac.compare_digest(value.get('secret',''), secret), 'git_hook_authentication_failed')
+                result = await guard.message(value)
+                writer.write(canonical(result) + b'\n')
+                await writer.drain()
+            except Exception:
+                writer.write(b'{"ok":false}\n')
+                try:await writer.drain()
+                except (BrokenPipeError, ConnectionError):pass
+            finally:
+                writer.close()
+                await writer.wait_closed()
+        server = await asyncio.start_unix_server(connection, str(socket_path), limit=70001)
+        durable_write(directory/'reference-transaction', hook_program(socket_path, secret), mode=0o700)
+        env = dict(store.env)
+        command = ['git','--git-dir',str(store.path(job.arguments['id'])),'-c','core.fsync=all',
+            '-c','core.hooksPath='+str(directory),'-c','receive.fsckObjects=true',
+            '-c','receive.denyNonFastForwards=true',*command_factory(store)]
+        process = None
+        code = None
+        output = b''
+        try:
+            process = await asyncio.create_subprocess_exec(*command,
+                stdin=asyncio.subprocess.PIPE if input_data is not None or input_file is not None or stdin_byte_limit is not None else stdin,
+                stdout=asyncio.subprocess.PIPE if capture_output else stdout,
+                stderr=asyncio.subprocess.DEVNULL if capture_output else stderr,
+                env=env,start_new_session=True)
+            if input_data is not None or input_file is not None:
+                async def exchange():
+                    async def feed():
+                        try:
+                            if input_file is None:
+                                process.stdin.write(input_data)
+                                await process.stdin.drain()
+                            else:
+                                with open(input_file,'rb') as source:
+                                    while chunk:=source.read(65536):
+                                        process.stdin.write(chunk)
+                                        await process.stdin.drain()
+                        except (BrokenPipeError,ConnectionResetError):
+                            pass
+                        finally:
+                            process.stdin.close()
+                    sender=asyncio.create_task(feed())
+                    try:
+                        chunks=[]
+                        size=0
+                        while chunk:=await process.stdout.read(65536):
+                            size+=len(chunk)
+                            require(output_limit is None or size<=output_limit,'response_too_large')
+                            chunks.append(chunk)
+                        await sender
+                        await process.wait()
+                        return b''.join(chunks)
+                    finally:
+                        if not sender.done():sender.cancel()
+                        await asyncio.gather(sender,return_exceptions=True)
+                output=await asyncio.wait_for(exchange(),timeout)
+                code=process.returncode
+            else:
+                if stdin_byte_limit is not None:
+                    code = await relay_bounded_stdin(process, sys.stdin.buffer if stdin_stream is None else stdin_stream,
+                                                     limit=stdin_byte_limit, timeout=timeout)
+                else:
+                    code = await asyncio.wait_for(process.wait(), timeout)
+        finally:
+            if process is not None and process.returncode is None:
+                import signal
+                os.killpg(process.pid, signal.SIGKILL)
+                await process.wait()
+                guard.uncertain = True
+            await guard.message({'state':'stop'})
+            await task
+            server.close()
+            await server.wait_closed()
+            async with app.metadata.transaction(write=True) as tx:
+                current = await tx.job(job.id)
+                if current.state == 'running':
+                    # Git ref transactions may have partially succeeded without
+                    # --atomic. Audit the actual committed refs, never invent rollback.
+                    uncertain=guard.uncertain or (guard.changed and (code != 0 or bool(guard.failures)))
+                    state = 'uncertain' if uncertain else 'done' if code == 0 and not guard.failures else 'failed'
+                    if state=='done' and cache_result_key is not None:
+                        require(capture_output,'git_result_cache_requires_output')
+                        tx.set_setting(cache_result_key,b64(output))
+                    await tx.save_job(replace(current, state=state, lease_until=None))
+                    tx.set_setting('job_status:'+job.id, {'code':'external_uncertain' if uncertain else
+                        guard.failures[0] if guard.failures else 'ok' if state=='done' else 'git_operation_failed',
+                        'refs_changed':guard.changed})
+        result=code if code is not None and not guard.uncertain and not guard.failures else 1
+        return (result,output,guard.changed) if capture_output else result
+
+
+async def receive_pack(app, job_id, *, stdin_stream=None):
+    async with app.metadata.transaction(write=False) as tx:
+        job = await tx.job(job_id)
+        require(job.kind == 'git.receive' and job.state == 'running', 'invalid_git_session')
+    require_git_repository_capacity(NativeGitStore(app).path(job.arguments['id']))
+    return await guarded_command(app, job, lambda store:['receive-pack',str(store.path(job.arguments['id']))],
+        timeout=MAX_GIT_UPLOAD_SECONDS, stdin_byte_limit=MAX_GIT_PACK_BYTES, stdin_stream=stdin_stream)