Commit da254e7

import { createHash } from "node:crypto"

export const PIN_VALIDATION_TTL_MS = REVALIDATE_MS

export const PIN_STALE_IF_ERROR_MS = 30 * 60 * 1000

let pinNow: () => number = () => Date.now()

export function __resetPinValidation(clock?: () => number): void {

pinNow = clock ?? (() => Date.now())

async function isTransientApiFailure(err: unknown): Promise<boolean> {

const { ForbiddenError, NotFoundError, NotConfiguredError, ConflictError, PreconditionFailedError, WorkspaceApiError } =

await import("./api-client")

// Definite answers about access or identity. Never transient.

if (

err instanceof ForbiddenError ||

err instanceof NotFoundError ||

err instanceof NotConfiguredError ||

err instanceof ConflictError ||

err instanceof PreconditionFailedError

) {

return false

}

if (err instanceof WorkspaceApiError) {

// No status = could not reach the host at all (DNS, refused, TLS, abort, timeout).

if (err.status === undefined) return true

// 408/429 are retry-shaped; 5xx is the server failing rather than the caller being refused.

return err.status === 408 || err.status === 429 || err.status >= 500

}

return false

const projectIdentifierCache = new Map<string, ReturnType<typeof resolveProjectIdentifier>>()

function cachedProjectIdentifier(directory: string): ReturnType<typeof resolveProjectIdentifier> {

const hit = projectIdentifierCache.get(directory)

if (hit) return hit

const ident = resolveProjectIdentifier(directory)

projectIdentifierCache.set(directory, ident)

return ident

// One credentials read, not two: `tenantKey()` resolves the same credentials internally, and

// calling both duplicated the work and — worse — gave two different failure paths the identical

// log line, so the message could not tell you which one refused.

//

// Scoped to the CREDENTIAL, not just the tenant. `tenantKey()` yields only `{tenant, apiUrl}`, so

// two accounts on one tenant shared a cache entry: switching credentials mid-process let the new

// principal inherit the previous one's successful authorization for the whole TTL, before it had

// demonstrated any visibility of its own. Only a short digest of the key is stored, never the key

// — same treatment as the memory index.

const creds = await AltimateApi.getCredentials().catch(() => null)

if (!creds?.altimateApiKey || !creds.altimateInstanceName || !creds.altimateUrl) {

const account = createHash("sha256").update(creds.altimateApiKey).digest("hex").slice(0, 16)

const cacheKey = `${creds.altimateInstanceName}|${creds.altimateUrl}|${account}|${pin.datamateId}`

// Seeded from the memo rather than the environment: past the TTL an offline fallback would

// otherwise report the stale name the extension started with, discarding the server-confirmed

// one. Inside the TTL this is already `memo.name`, so no second assignment is needed.

const cachedName = memo?.name ?? pin.datamateName

let datamateName = cachedName

if (!(memo && pinNow() - memo.at < PIN_VALIDATION_TTL_MS)) {

let transient = false

// Unreachable and unauthorized are different answers and must not collapse: only the former

// earns the stale grace below.

transient = await isTransientApiFailure(err)

log.warn("could not verify the pinned workspace", { err: String(err), transient })

pinValidation.set(cacheKey, { name: hit.name, at: pinNow() })

} else if (!memo || !transient || pinNow() - memo.at >= PIN_STALE_IF_ERROR_MS) {

// Nothing was ever established, OR the failure was a refusal rather than a network problem,

// OR the grace window has run out. A revoked credential must stop working, and an endpoint

// that fails forever must not grant an unbounded licence.

pinValidation.delete(cacheKey)

// Validated earlier and now genuinely unreachable, inside the grace window: keep serving it,

// which is what this module already does for a cached binding rather than tear a working setup

// down over a network blip.

const ident = cachedProjectIdentifier(directory)

// And the IDE extension's workspace pin, for the same reason. Inert while the serve marker

// above is stripped (``readPin`` checks it first), but a child that starts its own nested

// ``altimate-code serve`` would set that marker itself and then inherit a pin the session it

// came from was never given. Defence in depth — the pin should only ever come from the

// process the extension launched.

delete mergedEnv["ALTIMATE_PINNED_WORKSPACE_ID"]

delete mergedEnv["ALTIMATE_PINNED_WORKSPACE_NAME"]

delete mergedEnv["ALTIMATE_PINNED_WORKSPACE_ROOT"]

import { afterAll, describe, expect, test } from "bun:test"

import { mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs"

import os from "node:os"

describe("withinRoot — symlink containment", () => {

// The bypass this replaced a lexical fallback to fix. `realpathSync` fails on a path that does

// not exist yet, and the old code then compared the raw string, so a not-yet-created path under

// a symlinked ancestor passed the prefix test and let an outside tree be attributed to the

// pinned workspace. The directory arrives from the caller-supplied `x-opencode-directory`.

const sandbox = mkdtempSync(path.join(os.tmpdir(), "pin-symlink-"))

const root = path.join(sandbox, "root")

const outside = path.join(sandbox, "outside")

mkdirSync(root, { recursive: true })

mkdirSync(outside, { recursive: true })

symlinkSync(outside, path.join(root, "link"), "dir")

afterAll(() => rmSync(sandbox, { recursive: true, force: true }))

test("an EXISTING directory reached through a symlink out of the root is rejected", () => {

expect(withinRoot(path.join(root, "link"), root)).toBe(false)

})

test("a NOT-YET-EXISTING descendant under a symlinked ancestor is rejected", () => {

// The exact case the lexical fallback accepted.

expect(withinRoot(path.join(root, "link", "new"), root)).toBe(false)

})

test("a real descendant that does not exist yet is still accepted", () => {

// Fail-closed must not become fail-everything: `serve` legitimately resolves directories that

// have not been created yet.

expect(withinRoot(path.join(root, "pkg", "src"), root)).toBe(true)

})

test("a `..` escape is rejected", () => {

expect(withinRoot(path.join(root, "..", "outside"), root)).toBe(false)

})