From 31d155fd88789a09c05bc526e145c9f5ce94555b Mon Sep 17 00:00:00 2001 From: Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065 <01f26965-84fa-4a79-8069-725682c13065@agents.gitea.internal.quixos.org> Date: Sat, 31 Oct 2026 14:06:28 +0000 Subject: [PATCH] Keep managed source paths canonical across outer workbench aliases (#713) --- src/capability-language/authoring-converge.ts | 9 ++++-- .../managed-source-path.ts | 19 +++++++++++ src/capability-language/pin-upgrades.ts | 23 +++++++------ test/managed-source-path.test.ts | 32 +++++++++++++++++++ test/pin-upgrades.test.ts | 20 ++++++++++++ 5 files changed, 90 insertions(+), 13 deletions(-) create mode 100644 src/capability-language/managed-source-path.ts create mode 100644 test/managed-source-path.test.ts diff --git a/src/capability-language/authoring-converge.ts b/src/capability-language/authoring-converge.ts index cba7d94..8ec4107 100644 --- a/src/capability-language/authoring-converge.ts +++ b/src/capability-language/authoring-converge.ts @@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process"; import { promisify } from "node:util"; import { randomUUID } from "node:crypto"; import { authoringContext } from "./authoring-context.js"; +import { managedResourcePath } from "./managed-source-path.js"; import { snapshotCommit } from "./checked-build.js"; import { profile } from "./profile.js"; import { @@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") { const context = await authoringContext(start); const graphFile = path.join(context.workbench, ".quixos/resource-graph.json"); const graphBefore = await readFile(graphFile, "utf8"); + const graph = JSON.parse(graphBefore); + // Discovery resolves outer guest aliases. Persist those same physical + // selections, without accepting symlinks within the managed workbench. + for (const resource of graph.resources) + resource.directory = await managedResourcePath(context.workbench, resource.directory); const blockers: AuthoringBlocker[] = []; const nodes = new Map(); const selected = new Map(); @@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") { profile("capture-recheck", recheckStarted, { repositories: complete.size }); // Persist successful selections even if another repository is still broken. // Recovery must not depend on all parents succeeding in the same invocation. - const graph = JSON.parse(graphBefore); - for (const resource of graph.resources) - resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory)); const replacements = new Map(); for (const resource of graph.resources) { const source = complete.get(resource.directory); diff --git a/src/capability-language/managed-source-path.ts b/src/capability-language/managed-source-path.ts new file mode 100644 index 0000000..4cc39a0 --- /dev/null +++ b/src/capability-language/managed-source-path.ts @@ -0,0 +1,19 @@ +import { realpath } from "node:fs/promises"; +import path from "node:path"; + +/** Registration may name the workbench through its guest alias. Only that + * outer alias is permitted: resources and each checkout remain physical, + * directly contained directories. Persist the resulting root-relative path. + */ +export async function managedResourcePath(workbench: string, directory: string): Promise { + const root = await realpath(workbench); + const selected = path.resolve(root, directory); + const name = path.basename(selected); + const resources = path.dirname(selected); + if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) + throw new Error(`Repository is outside the managed workbench: ${directory}`); + const relative = `resources/${name}`; + if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative)) + throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`); + return relative; +} diff --git a/src/capability-language/pin-upgrades.ts b/src/capability-language/pin-upgrades.ts index 6dcc60b..b737964 100644 --- a/src/capability-language/pin-upgrades.ts +++ b/src/capability-language/pin-upgrades.ts @@ -22,6 +22,7 @@ import { type EvolutionReview, } from "../capability-model/index.js"; import { withFileLock } from "./file-lock.js"; +import { managedResourcePath } from "./managed-source-path.js"; const execFile = promisify(callback); type Source = { repository: string; commit: string }; export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source }; @@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => { } }; -export const discoverUpgradeSpec = async (workbench: string): Promise => { +export const discoverUpgradeSpec = async (workbenchPath: string): Promise => { + const workbench = await fs.realpath(workbenchPath); const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8")); const root = await location(workbench, "root"); const nodes: UpgradeNode[] = [ @@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise ({ - kind: entry.kind, - source: entry.source, - directory: path.relative(workbench, path.resolve(workbench, entry.directory)), - })), + ...(await Promise.all( + graph.resources.map( + async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({ + kind: entry.kind, + source: entry.source, + directory: await managedResourcePath(workbench, entry.directory), + }), + ), + )), ]; let baseline: string | undefined; try { @@ -406,10 +412,7 @@ export const applyPinUpgrades = async ( previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({ kind: entry.kind, ...entry.source, - directory: await location( - plan.workbench, - path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)), - ), + directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)), })), ); for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) { diff --git a/test/managed-source-path.test.ts b/test/managed-source-path.test.ts new file mode 100644 index 0000000..b6a7230 --- /dev/null +++ b/test/managed-source-path.test.ts @@ -0,0 +1,32 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; +import { managedResourcePath } from "../src/capability-language/managed-source-path.js"; + +test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => { + const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-")); + t.after(() => fs.rm(scratch, { recursive: true, force: true })); + const root = path.join(scratch, "retained/workbench"), + alias = path.join(scratch, "guest"), + outside = path.join(scratch, "outside"); + await fs.mkdir(path.join(root, "resources/Package"), { recursive: true }); + await fs.mkdir(outside); + await fs.symlink(root, alias); + for (const registered of [ + "resources/Package", + path.join(alias, "resources/Package"), + path.relative(root, path.join(alias, "resources/Package")), + ]) + assert.equal(await managedResourcePath(alias, registered), "resources/Package"); + await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias")); + await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/); + await fs.symlink(outside, path.join(root, "resources/Escape")); + await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/); + await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true }); + await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/); + await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources")); + await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources")); + await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/); +}); diff --git a/test/pin-upgrades.test.ts b/test/pin-upgrades.test.ts index 0508a2b..0970491 100644 --- a/test/pin-upgrades.test.ts +++ b/test/pin-upgrades.test.ts @@ -156,6 +156,26 @@ test( ); assert.equal(graph.resources[0].directory, "resources/Named"); assert.equal(graph.directResources[0].directory, "resources/Named"); + const alias = `${workbench}-guest-alias`; + await fs.symlink(workbench, alias); + context.after(() => fs.unlink(alias)); + const graphFile = path.join(workbench, ".quixos/resource-graph.json"); + await fs.writeFile( + graphFile, + JSON.stringify({ + ...graph, + resources: graph.resources.map((entry: { directory: string }) => ({ + ...entry, + directory: path.join(alias, entry.directory), + })), + }), + ); + assert.equal((await discoverUpgradeSpec(alias)).nodes[1]!.directory, "resources/Named"); + const aliasPlan = await planPinUpgrades(alias, { ...(await discoverUpgradeSpec(alias)), bootstrap: true }); + await applyPinUpgrades(aliasPlan); + const refreshed = JSON.parse(await fs.readFile(graphFile, "utf8")); + assert.equal(refreshed.resources[0].directory, "resources/Named"); + assert.equal(refreshed.directResources[0].directory, "resources/Named"); // A retained workbench can move without keeping its original absolute path // alive. Recovery journals remain bound to their original writer/root. const relocated = `${workbench}-relocated`;