Publish quixos-protocol from 473886a58fdacf15f2c873b77da96faf3be7fa65

.quixos-subtree-source.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea.internal.quixos.org/quixos/quixos.git",
-  "sourceCommit": "806b0430d952b5a9aab5b2a63496c272aced8e50",
+  "sourceCommit": "473886a58fdacf15f2c873b77da96faf3be7fa65",
   "sourcePath": "quixos-protocol",
   "exportName": "quixos-protocol",
   "mirrorRemote": "https://repos.quixos.org/quixos-toolchain/quixos-protocol.git"

src/capability-language/authoring-converge.ts

@@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process";
 import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import { authoringContext } from "./authoring-context.js";
+import { managedResourcePath } from "./managed-source-path.js";
 import { snapshotCommit } from "./checked-build.js";
 import { profile } from "./profile.js";
 import {
@@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") {
   const context = await authoringContext(start);
   const graphFile = path.join(context.workbench, ".quixos/resource-graph.json");
   const graphBefore = await readFile(graphFile, "utf8");
+  const graph = JSON.parse(graphBefore);
+  // Discovery resolves outer guest aliases. Persist those same physical
+  // selections, without accepting symlinks within the managed workbench.
+  for (const resource of graph.resources)
+    resource.directory = await managedResourcePath(context.workbench, resource.directory);
   const blockers: AuthoringBlocker[] = [];
   const nodes = new Map<string, { directory: string; kind: string; source: GitSource; dependencies: string[] }>();
   const selected = new Map<string, string>();
@@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") {
   profile("capture-recheck", recheckStarted, { repositories: complete.size });
   // Persist successful selections even if another repository is still broken.
   // Recovery must not depend on all parents succeeding in the same invocation.
-  const graph = JSON.parse(graphBefore);
-  for (const resource of graph.resources)
-    resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory));
   const replacements = new Map<string, string>();
   for (const resource of graph.resources) {
     const source = complete.get(resource.directory);

src/capability-language/managed-source-path.ts

@@ -0,0 +1,19 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+
+/** Registration may name the workbench through its guest alias. Only that
+ * outer alias is permitted: resources and each checkout remain physical,
+ * directly contained directories. Persist the resulting root-relative path.
+ */
+export async function managedResourcePath(workbench: string, directory: string): Promise<string> {
+  const root = await realpath(workbench);
+  const selected = path.resolve(root, directory);
+  const name = path.basename(selected);
+  const resources = path.dirname(selected);
+  if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name))
+    throw new Error(`Repository is outside the managed workbench: ${directory}`);
+  const relative = `resources/${name}`;
+  if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative))
+    throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`);
+  return relative;
+}

src/capability-language/pin-upgrades.ts

@@ -22,6 +22,7 @@ import {
   type EvolutionReview,
 } from "../capability-model/index.js";
 import { withFileLock } from "./file-lock.js";
+import { managedResourcePath } from "./managed-source-path.js";
 const execFile = promisify(callback);
 type Source = { repository: string; commit: string };
 export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source };
@@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => {
   }
 };
 
-export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpec> => {
+export const discoverUpgradeSpec = async (workbenchPath: string): Promise<UpgradeSpec> => {
+  const workbench = await fs.realpath(workbenchPath);
   const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
   const root = await location(workbench, "root");
   const nodes: UpgradeNode[] = [
@@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise<UpgradeSpe
         commit: await command(root, "jj", ["--ignore-working-copy", "log", "--no-graph", "-r", "@", "-T", "commit_id"]),
       },
     },
-    ...graph.resources.map((entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
-      kind: entry.kind,
-      source: entry.source,
-      directory: path.relative(workbench, path.resolve(workbench, entry.directory)),
-    })),
+    ...(await Promise.all(
+      graph.resources.map(
+        async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({
+          kind: entry.kind,
+          source: entry.source,
+          directory: await managedResourcePath(workbench, entry.directory),
+        }),
+      ),
+    )),
   ];
   let baseline: string | undefined;
   try {
@@ -406,10 +412,7 @@ export const applyPinUpgrades = async (
           previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({
             kind: entry.kind,
             ...entry.source,
-            directory: await location(
-              plan.workbench,
-              path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)),
-            ),
+            directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)),
           })),
         );
         for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) {

src/execution-world/metadata.ts

@@ -1,6 +1,9 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 
+const admissionFailure = (code: string, kind: "file-bytes", measured: number, limit: number) =>
+  Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
+
 /** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
  * still required. Charge input, parse trees and derived indexes before reading
  * or parsing. Each live candidate retains its reservation until explicit close. */
@@ -116,8 +119,8 @@ export async function readCandidateMetadata(
   let releaseInput: (() => void) | undefined;
   try {
     const stat = await handle.stat();
-    if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > limit)
-      throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (!stat.isFile() || !Number.isSafeInteger(stat.size)) throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (stat.size > limit) throw admissionFailure("CANDIDATE_METADATA_FILE_LIMIT", "file-bytes", stat.size, limit);
     // Reserve the input buffer and UTF-16 decoding before allocating either.
     releaseInput = scope.reserve((stat.size + 1) * 3);
     const bytes = Buffer.alloc(stat.size + 1);

test/managed-source-path.test.ts

@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { managedResourcePath } from "../src/capability-language/managed-source-path.js";
+
+test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => {
+  const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-"));
+  t.after(() => fs.rm(scratch, { recursive: true, force: true }));
+  const root = path.join(scratch, "retained/workbench"),
+    alias = path.join(scratch, "guest"),
+    outside = path.join(scratch, "outside");
+  await fs.mkdir(path.join(root, "resources/Package"), { recursive: true });
+  await fs.mkdir(outside);
+  await fs.symlink(root, alias);
+  for (const registered of [
+    "resources/Package",
+    path.join(alias, "resources/Package"),
+    path.relative(root, path.join(alias, "resources/Package")),
+  ])
+    assert.equal(await managedResourcePath(alias, registered), "resources/Package");
+  await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias"));
+  await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/);
+  await fs.symlink(outside, path.join(root, "resources/Escape"));
+  await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/);
+  await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true });
+  await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/);
+  await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources"));
+  await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources"));
+  await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/);
+});

test/pin-upgrades.test.ts

@@ -176,6 +176,9 @@ for (const dependencyKind of ["interface", "build"] as const)
   test(`${dependencyKind} pin upgrades publish children before parent locks and resume without republishing completed nodes`, async (context) => {
     const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-test-"));
     context.after(() => fs.rm(workbench, { recursive: true, force: true }));
+    const alias = `${workbench}-guest-alias`;
+    await fs.symlink(workbench, alias);
+    context.after(() => fs.unlink(alias));
     const from = "a".repeat(40),
       to = "b".repeat(40),
       framework = "c".repeat(40);
@@ -244,7 +247,15 @@ for (const dependencyKind of ["interface", "build"] as const)
     await fs.mkdir(path.join(workbench, ".quixos"), { recursive: true });
     await fs.writeFile(
       path.join(workbench, ".quixos/resource-graph.json"),
-      JSON.stringify({ resources: [{ ...sources[1], source: { resolver: "git", ...sources[1].source } }] }),
+      JSON.stringify({
+        resources: [
+          {
+            ...sources[1],
+            directory: path.join(alias, sources[1].directory),
+            source: { resolver: "git", ...sources[1].source },
+          },
+        ],
+      }),
     );
     assert.deepEqual(
       plan.nodes.map((node) => node.directory),
@@ -275,6 +286,7 @@ for (const dependencyKind of ["interface", "build"] as const)
     assert.deepEqual(published, ["resources/Named", "root"]);
     const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
     assert.equal(graph.resources.length, 1);
+    assert.equal(graph.resources[0].directory, "resources/Named");
     assert.equal(graph.resources[0].source.commit, to);
     const next = await planPinUpgrades(workbench, {
       nodes: [sources[0], { ...sources[1], source: graph.resources[0].source }],