diff --git a/fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java b/fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java index ceaf80b..1a43c2f 100644 --- a/fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java +++ b/fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java @@ -7,6 +7,8 @@ import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.io.UncheckedIOException; +import java.net.URI; +import java.net.URISyntaxException; import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; @@ -20,6 +22,7 @@ import java.util.Optional; import java.util.Set; import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicLong; +import java.util.function.Consumer; import java.util.stream.Collectors; /** @@ -64,6 +67,10 @@ public final class GitWorktrees implements Worktrees { /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */ private static final String NEUTRAL_AUTOENV_CONFIG = ""; + /** A credential helper command which reads only an environment variable at Git call time. */ + private static final String ENVIRONMENT_CREDENTIAL_HELPER = "!f() { if [ \"$1\" = get ]; then " + + "printf 'username=%s\\npassword=%s\\n\\n' git \"$WORKER_GITEA_TOKEN\"; fi; }; f"; + /** * A tracked project config that is hostile in a provisioned worktree, and what to replace it * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for @@ -81,6 +88,7 @@ public final class GitWorktrees implements Worktrees { ); private final String configuredRoot; + private final Consumer afterWorktreeAdded; private final SecureRandom random = new SecureRandom(); private final AtomicLong seq = new AtomicLong(); @@ -91,7 +99,13 @@ public final class GitWorktrees implements Worktrees { /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */ public GitWorktrees(String configuredRoot) { + this(configuredRoot, _ -> {}); + } + + /** Test seam for changing a real worktree between its creation and its security check. */ + GitWorktrees(String configuredRoot, Consumer afterWorktreeAdded) { this.configuredRoot = configuredRoot; + this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded; } @Override @@ -107,11 +121,71 @@ public final class GitWorktrees implements Worktrees { } String wt = path.toAbsolutePath().toString(); log.info("adding worktree branch={} path={} base={}", branch, wt, base); + removeUserInfoFromHttpsOrigin(repoRoot); exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base); + afterWorktreeAdded.accept(wt); + requireCredentialFreeHttpsOrigin(wt); + configureEnvironmentCredentialHelper(repoRoot, wt); isolateToolSurface(wt); return wt; } + /** + * A linked worktree shares its primary checkout's git config. Remove HTTPS user info before + * adding one, so a credential accidentally embedded in that config cannot reach the member. + */ + private void removeUserInfoFromHttpsOrigin(String repoRoot) { + if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) { + return; + } + String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim(); + URI uri; + try { + uri = new URI(origin); + } catch (URISyntaxException e) { + throw new WorktreeException("origin URL is invalid; cannot provision a safe worktree", e); + } + if (!"https".equalsIgnoreCase(uri.getScheme()) || uri.getUserInfo() == null) { + return; + } + int schemeEnd = origin.indexOf("://") + 3; + int userInfoEnd = origin.indexOf('@', schemeEnd); + if (userInfoEnd < schemeEnd) { + throw new WorktreeException("origin URL has invalid HTTPS user info; cannot provision safely"); + } + String cleanOrigin = origin.substring(0, schemeEnd) + origin.substring(userInfoEnd + 1); + exec("git", "-C", repoRoot, "remote", "set-url", "origin", cleanOrigin); + log.info("removed HTTPS user info from forge origin before provisioning worktree"); + } + + /** Refuse the worktree if Git still resolves any HTTPS origin URL with embedded credentials. */ + private void requireCredentialFreeHttpsOrigin(String worktreePath) { + if (exitCode("git", "-C", worktreePath, "remote", "get-url", "--all", "origin") != 0) { + return; + } + String origins = exec("git", "-C", worktreePath, "remote", "get-url", "--all", "origin"); + for (String origin : origins.split("\\R")) { + try { + URI uri = new URI(origin); + if ("https".equalsIgnoreCase(uri.getScheme()) && uri.getUserInfo() != null) { + throw new WorktreeException("worktree origin contains HTTPS user info; refusing provision"); + } + } catch (URISyntaxException e) { + throw new WorktreeException("worktree origin URL is invalid; refusing provision", e); + } + } + } + + /** Configure a per-worktree helper that supplies a token from the member environment at call time. */ + private void configureEnvironmentCredentialHelper(String repoRoot, String worktreePath) { + exec("git", "-C", repoRoot, "config", "extensions.worktreeConfig", "true"); + // An empty helper resets values inherited from the system or global config. Without it Git + // asks the next helper after this one, which can expose an operator-level credential. + exec("git", "-C", worktreePath, "config", "--worktree", "--replace-all", "credential.helper", ""); + exec("git", "-C", worktreePath, "config", "--worktree", "--add", "credential.helper", + ENVIRONMENT_CREDENTIAL_HELPER); + } + /** * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config diff --git a/fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java b/fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java index 3b40911..abb8069 100644 --- a/fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java +++ b/fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java @@ -55,12 +55,21 @@ class GitWorktreesTest { } private static void git(Path cwd, String... args) throws Exception { + gitOutput(cwd, args); + } + + private static String gitOutput(Path cwd, String... args) throws Exception { List cmd = new java.util.ArrayList<>(List.of("git")); cmd.addAll(List.of(args)); - Process p = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true).start(); + ProcessBuilder pb = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true); + pb.environment().put("GIT_CONFIG_GLOBAL", "/dev/null"); + pb.environment().put("GIT_CONFIG_SYSTEM", "/dev/null"); + pb.environment().put("GIT_TERMINAL_PROMPT", "0"); + Process p = pb.start(); String out = new String(p.getInputStream().readAllBytes()); assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: " + String.join(" ", cmd)); assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out); + return out; } /** Pending changes to {@code file} in {@code cwd}, empty when git considers it unmodified. */ @@ -205,6 +214,79 @@ class GitWorktreesTest { "expected an explicitly empty server map, got:\n" + body); } + /** + * The worktree command shares the primary checkout's config, so this checks the URL git actually + * reads after {@link GitWorktrees#add}, rather than checking only a URL formatting helper. + */ + @Test + void aProvisionedWorktreeUsesACleanHttpsOrigin(@TempDir Path tmp) throws Exception { + Path repo = initRepo(tmp.resolve("repo")); + git(repo, "remote", "add", "origin", "https://synthetic-test-token@git.ltms.dev/akb/kb.git"); + + String wt = new GitWorktrees(tmp.resolve("wts").toString()) + .add(repo.toString(), "fleetd-157-safe-origin", "HEAD"); + + Path worktree = Path.of(wt); + String origin = gitOutput(worktree, "config", "--get", "remote.origin.url").trim(); + assertEquals("https://git.ltms.dev/akb/kb.git", origin); + assertFalse(origin.contains("synthetic-test-token"), "provisioned worktree kept user info"); + assertFalse(gitOutput(worktree, "remote", "-v").contains("synthetic-test-token"), + "git remote -v exposed user info"); + assertFalse(gitOutput(worktree, "config", "--list").contains("synthetic-test-token"), + "git config --list exposed user info"); + String helper = gitOutput(worktree, "config", "--worktree", "--get", "credential.helper"); + assertTrue(helper.contains("WORKER_GITEA_TOKEN"), "credential helper does not read the member environment"); + assertFalse(helper.contains("synthetic-test-token"), "credential helper stored user info"); + } + + @Test + void worktreeCredentialHelperCompletesWithoutUsingAnInheritedHelper(@TempDir Path tmp) throws Exception { + Path repo = initRepo(tmp.resolve("repo")); + git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git"); + String wt = new GitWorktrees(tmp.resolve("wts").toString()) + .add(repo.toString(), "fleetd-157-helper", "HEAD"); + Path globalConfig = tmp.resolve("global.gitconfig"); + Files.writeString(globalConfig, """ + [credential] + helper = !f() { printf 'username=%s\\npassword=%s\\n\\n' operator operator-secret; }; f + """); + + ProcessBuilder pb = new ProcessBuilder("git", "credential", "fill") + .directory(Path.of(wt).toFile()).redirectErrorStream(true); + pb.environment().put("GIT_CONFIG_GLOBAL", globalConfig.toString()); + pb.environment().put("GIT_CONFIG_SYSTEM", "/dev/null"); + pb.environment().put("GIT_TERMINAL_PROMPT", "0"); + pb.environment().put("WORKER_GITEA_TOKEN", "synthetic-worker-value"); + Process p = pb.start(); + p.getOutputStream().write("protocol=https\nhost=git.ltms.dev\n\n".getBytes(StandardCharsets.UTF_8)); + p.getOutputStream().close(); + String credential = new String(p.getInputStream().readAllBytes(), StandardCharsets.UTF_8); + assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git credential fill timed out"); + assertEquals(0, p.exitValue(), "git credential fill failed"); + assertTrue(credential.contains("username=git"), "helper did not return its fixed username"); + assertTrue(credential.contains("password=synthetic-worker-value"), + "helper did not return the worker token as the password"); + assertFalse(credential.contains("operator-secret"), "Git used the inherited global helper"); + } + + @Test + void provisioningRefusesAWorktreeWhoseOriginStillHasHttpsUserInfo(@TempDir Path tmp) throws Exception { + Path repo = initRepo(tmp.resolve("repo")); + git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git"); + GitWorktrees worktrees = new GitWorktrees(tmp.resolve("wts").toString(), worktreePath -> { + try { + git(Path.of(worktreePath), "remote", "set-url", "origin", + "https://synthetic-test-token@git.ltms.dev/akb/kb.git"); + } catch (Exception e) { + throw new RuntimeException(e); + } + }); + + WorktreeException error = assertThrows(WorktreeException.class, + () -> worktrees.add(repo.toString(), "fleetd-157-refuse-origin", "HEAD")); + assertEquals("worktree origin contains HTTPS user info; refusing provision", error.getMessage()); + } + /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */ @Test void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {