|
| 1 | +import { spawn, spawnSync } from "node:child_process"; |
| 2 | +import crypto from "node:crypto"; |
| 3 | +import fs from "node:fs/promises"; |
| 4 | +import path from "node:path"; |
| 5 | + |
| 6 | +export const DIR_FETCH_HARD_MAX_BYTES = 16 * 1024 * 1024; |
| 7 | +export const DIR_FETCH_DEFAULT_MAX_BYTES = 8 * 1024 * 1024; |
| 8 | + |
| 9 | +export type DirFetchParams = { |
| 10 | + path?: unknown; |
| 11 | + maxBytes?: unknown; |
| 12 | + includeDotfiles?: unknown; |
| 13 | +}; |
| 14 | + |
| 15 | +export type DirFetchOk = { |
| 16 | + ok: true; |
| 17 | + path: string; |
| 18 | + tarBase64: string; |
| 19 | + tarBytes: number; |
| 20 | + sha256: string; |
| 21 | + fileCount: number; |
| 22 | +}; |
| 23 | + |
| 24 | +export type DirFetchErrCode = |
| 25 | + | "INVALID_PATH" |
| 26 | + | "NOT_FOUND" |
| 27 | + | "IS_FILE" |
| 28 | + | "TREE_TOO_LARGE" |
| 29 | + | "READ_ERROR"; |
| 30 | + |
| 31 | +export type DirFetchErr = { |
| 32 | + ok: false; |
| 33 | + code: DirFetchErrCode; |
| 34 | + message: string; |
| 35 | + canonicalPath?: string; |
| 36 | +}; |
| 37 | + |
| 38 | +export type DirFetchResult = DirFetchOk | DirFetchErr; |
| 39 | + |
| 40 | +function clampMaxBytes(input: unknown): number { |
| 41 | + if (typeof input !== "number" || !Number.isFinite(input) || input <= 0) { |
| 42 | + return DIR_FETCH_DEFAULT_MAX_BYTES; |
| 43 | + } |
| 44 | + return Math.min(Math.floor(input), DIR_FETCH_HARD_MAX_BYTES); |
| 45 | +} |
| 46 | + |
| 47 | +function classifyFsError(err: unknown): DirFetchErrCode { |
| 48 | + const code = (err as { code?: string } | null)?.code; |
| 49 | + if (code === "ENOENT") { |
| 50 | + return "NOT_FOUND"; |
| 51 | + } |
| 52 | + return "READ_ERROR"; |
| 53 | +} |
| 54 | + |
| 55 | +async function preflightDu(dirPath: string, maxBytes: number): Promise<boolean> { |
| 56 | + // du -sk gives size in 1KB blocks (512-byte blocks on macOS with -k) |
| 57 | + // We use maxBytes * 4 as the rough heuristic ceiling (generous, gzip compresses) |
| 58 | + const heuristicKb = Math.ceil((maxBytes * 4) / 1024); |
| 59 | + return new Promise((resolve) => { |
| 60 | + const du = spawn("du", ["-sk", dirPath], { stdio: ["ignore", "pipe", "ignore"] }); |
| 61 | + let output = ""; |
| 62 | + du.stdout.on("data", (chunk: Buffer) => { |
| 63 | + output += chunk.toString(); |
| 64 | + }); |
| 65 | + du.on("close", (code) => { |
| 66 | + if (code !== 0) { |
| 67 | + // du failed; be permissive and let tar catch the overflow |
| 68 | + resolve(true); |
| 69 | + return; |
| 70 | + } |
| 71 | + const match = /^(\d+)/.exec(output.trim()); |
| 72 | + if (!match) { |
| 73 | + resolve(true); |
| 74 | + return; |
| 75 | + } |
| 76 | + const sizeKb = parseInt(match[1], 10); |
| 77 | + resolve(sizeKb <= heuristicKb); |
| 78 | + }); |
| 79 | + du.on("error", () => { |
| 80 | + // du not available; skip preflight |
| 81 | + resolve(true); |
| 82 | + }); |
| 83 | + }); |
| 84 | +} |
| 85 | + |
| 86 | +function countTarEntries(tarBuffer: Buffer): number { |
| 87 | + const result = spawnSync("tar", ["-tzf", "-"], { |
| 88 | + input: tarBuffer, |
| 89 | + maxBuffer: 32 * 1024 * 1024, |
| 90 | + timeout: 10000, |
| 91 | + }); |
| 92 | + if (result.status !== 0 || !result.stdout) { |
| 93 | + return 0; |
| 94 | + } |
| 95 | + const lines = (result.stdout as Buffer) |
| 96 | + .toString("utf-8") |
| 97 | + .split("\n") |
| 98 | + .filter((l) => l.trim().length > 0 && l !== "./"); |
| 99 | + return lines.length; |
| 100 | +} |
| 101 | + |
| 102 | +export async function handleDirFetch(params: DirFetchParams): Promise<DirFetchResult> { |
| 103 | + const requestedPath = params.path; |
| 104 | + if (typeof requestedPath !== "string" || requestedPath.length === 0) { |
| 105 | + return { ok: false, code: "INVALID_PATH", message: "path required" }; |
| 106 | + } |
| 107 | + if (requestedPath.includes("\0")) { |
| 108 | + return { ok: false, code: "INVALID_PATH", message: "path contains NUL byte" }; |
| 109 | + } |
| 110 | + if (!path.isAbsolute(requestedPath)) { |
| 111 | + return { ok: false, code: "INVALID_PATH", message: "path must be absolute" }; |
| 112 | + } |
| 113 | + |
| 114 | + const maxBytes = clampMaxBytes(params.maxBytes); |
| 115 | + const includeDotfiles = params.includeDotfiles === true; |
| 116 | + |
| 117 | + let canonical: string; |
| 118 | + try { |
| 119 | + canonical = await fs.realpath(requestedPath); |
| 120 | + } catch (err) { |
| 121 | + const code = classifyFsError(err); |
| 122 | + return { |
| 123 | + ok: false, |
| 124 | + code, |
| 125 | + message: code === "NOT_FOUND" ? "directory not found" : `realpath failed: ${String(err)}`, |
| 126 | + }; |
| 127 | + } |
| 128 | + |
| 129 | + let stats: Awaited<ReturnType<typeof fs.stat>>; |
| 130 | + try { |
| 131 | + stats = await fs.stat(canonical); |
| 132 | + } catch (err) { |
| 133 | + const code = classifyFsError(err); |
| 134 | + return { ok: false, code, message: `stat failed: ${String(err)}`, canonicalPath: canonical }; |
| 135 | + } |
| 136 | + |
| 137 | + if (!stats.isDirectory()) { |
| 138 | + return { |
| 139 | + ok: false, |
| 140 | + code: "IS_FILE", |
| 141 | + message: "path is not a directory", |
| 142 | + canonicalPath: canonical, |
| 143 | + }; |
| 144 | + } |
| 145 | + |
| 146 | + // Preflight size check using du |
| 147 | + const withinBudget = await preflightDu(canonical, maxBytes); |
| 148 | + if (!withinBudget) { |
| 149 | + return { |
| 150 | + ok: false, |
| 151 | + code: "TREE_TOO_LARGE", |
| 152 | + message: `directory tree exceeds estimated size limit (${maxBytes} bytes raw)`, |
| 153 | + canonicalPath: canonical, |
| 154 | + }; |
| 155 | + } |
| 156 | + |
| 157 | + // Build tar args. Shell out to /usr/bin/tar for portability. |
| 158 | + // -cz: create + gzip |
| 159 | + // -C <dir>: change to directory so paths in archive are relative |
| 160 | + // .: include everything from that directory |
| 161 | + // v1: includeDotfiles is accepted in the API but not enforced. BSD tar's |
| 162 | + // --exclude pattern matching is unreliable for dotfiles (every plausible |
| 163 | + // pattern except "*/.*" collapses the archive on macOS). Reliable filtering |
| 164 | + // requires a `find ! -name '.*' | tar -T -` pipeline; deferred to v2. |
| 165 | + // For now we always archive everything in the directory. |
| 166 | + void includeDotfiles; |
| 167 | + const tarArgs: string[] = ["-czf", "-", "-C", canonical, "."]; |
| 168 | + |
| 169 | + // Capture tar output with a hard byte cap and a wall-clock timeout. |
| 170 | + // SIGTERM if the byte cap is exceeded; SIGKILL if the timeout fires |
| 171 | + // (covers tar hanging on a slow filesystem or symlink loop). |
| 172 | + const TAR_HARD_TIMEOUT_MS = 60_000; |
| 173 | + const tarBuffer = await new Promise<Buffer | "TOO_LARGE" | "TIMEOUT" | "ERROR">((resolve) => { |
| 174 | + const tarBin = process.platform !== "win32" ? "/usr/bin/tar" : "tar"; |
| 175 | + const child = spawn(tarBin, tarArgs, { |
| 176 | + stdio: ["ignore", "pipe", "pipe"], |
| 177 | + }); |
| 178 | + |
| 179 | + const chunks: Buffer[] = []; |
| 180 | + let totalBytes = 0; |
| 181 | + let aborted = false; |
| 182 | + |
| 183 | + const watchdog = setTimeout(() => { |
| 184 | + if (aborted) return; |
| 185 | + aborted = true; |
| 186 | + try { |
| 187 | + child.kill("SIGKILL"); |
| 188 | + } catch { |
| 189 | + /* already gone */ |
| 190 | + } |
| 191 | + resolve("TIMEOUT"); |
| 192 | + }, TAR_HARD_TIMEOUT_MS); |
| 193 | + |
| 194 | + child.stdout.on("data", (chunk: Buffer) => { |
| 195 | + if (aborted) return; |
| 196 | + totalBytes += chunk.byteLength; |
| 197 | + if (totalBytes > maxBytes) { |
| 198 | + aborted = true; |
| 199 | + clearTimeout(watchdog); |
| 200 | + child.kill("SIGTERM"); |
| 201 | + resolve("TOO_LARGE"); |
| 202 | + return; |
| 203 | + } |
| 204 | + chunks.push(chunk); |
| 205 | + }); |
| 206 | + |
| 207 | + child.on("close", (code) => { |
| 208 | + clearTimeout(watchdog); |
| 209 | + if (aborted) return; |
| 210 | + if (code !== 0) { |
| 211 | + resolve("ERROR"); |
| 212 | + return; |
| 213 | + } |
| 214 | + resolve(Buffer.concat(chunks)); |
| 215 | + }); |
| 216 | + |
| 217 | + child.on("error", () => { |
| 218 | + clearTimeout(watchdog); |
| 219 | + if (!aborted) { |
| 220 | + resolve("ERROR"); |
| 221 | + } |
| 222 | + }); |
| 223 | + }); |
| 224 | + |
| 225 | + if (tarBuffer === "TOO_LARGE") { |
| 226 | + return { |
| 227 | + ok: false, |
| 228 | + code: "TREE_TOO_LARGE", |
| 229 | + message: `tarball exceeded ${maxBytes} byte limit mid-stream`, |
| 230 | + canonicalPath: canonical, |
| 231 | + }; |
| 232 | + } |
| 233 | + if (tarBuffer === "TIMEOUT") { |
| 234 | + return { |
| 235 | + ok: false, |
| 236 | + code: "READ_ERROR", |
| 237 | + message: "tar command exceeded 60s wall-clock timeout (slow filesystem or symlink loop?)", |
| 238 | + canonicalPath: canonical, |
| 239 | + }; |
| 240 | + } |
| 241 | + if (tarBuffer === "ERROR") { |
| 242 | + return { |
| 243 | + ok: false, |
| 244 | + code: "READ_ERROR", |
| 245 | + message: "tar command failed", |
| 246 | + canonicalPath: canonical, |
| 247 | + }; |
| 248 | + } |
| 249 | + |
| 250 | + const sha256 = crypto.createHash("sha256").update(tarBuffer).digest("hex"); |
| 251 | + const tarBase64 = tarBuffer.toString("base64"); |
| 252 | + const tarBytes = tarBuffer.byteLength; |
| 253 | + const fileCount = countTarEntries(tarBuffer); |
| 254 | + |
| 255 | + return { |
| 256 | + ok: true, |
| 257 | + path: canonical, |
| 258 | + tarBase64, |
| 259 | + tarBytes, |
| 260 | + sha256, |
| 261 | + fileCount, |
| 262 | + }; |
| 263 | +} |
0 commit comments