orca/src/shared/git-discard-path-safety.ts

import { lstat, realpath } from 'node:fs/promises'
import * as path from 'node:path'
import { forEachWithConcurrency } from './map-with-concurrency'

const DISCARD_PATH_VALIDATION_CONCURRENCY = 16

function isENOENT(error: unknown): boolean {
  return (
    error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === 'ENOENT'
  )
}

function isInsideOrEqual(rootPath: string, candidatePath: string): boolean {
  const relativePath = path.relative(rootPath, candidatePath)
  return (
    relativePath === '' ||
    (relativePath !== '..' &&
      !relativePath.startsWith(`..${path.sep}`) &&
      !path.isAbsolute(relativePath))
  )
}

async function assertRealPathInsideWorktree(
  realWorktreePath: string,
  candidatePath: string,
  originalFilePath: string
): Promise<void> {
  const realCandidatePath = path.resolve(await realpath(candidatePath))
  if (!isInsideOrEqual(realWorktreePath, realCandidatePath)) {
    throw new Error(`Path "${originalFilePath}" resolves outside the worktree`)
  }
}

async function assertNearestExistingParentInsideWorktree(
  realWorktreePath: string,
  candidatePath: string,
  originalFilePath: string
): Promise<void> {
  let parentPath = path.dirname(candidatePath)
  while (parentPath !== path.dirname(parentPath)) {
    try {
      await assertRealPathInsideWorktree(realWorktreePath, parentPath, originalFilePath)
      return
    } catch (error) {
      if (!isENOENT(error)) {
        throw error
      }
      parentPath = path.dirname(parentPath)
    }
  }

  throw new Error(`Path "${originalFilePath}" resolves outside the worktree`)
}

function assertTargetIsWorktreeChild(
  resolvedWorktreePath: string,
  resolvedTarget: string,
  originalFilePath: string
): void {
  const relativeTarget = path.relative(resolvedWorktreePath, resolvedTarget)
  // Never force-remove the worktree root, including empty/self-referential discard paths.
  if (
    relativeTarget === '' ||
    relativeTarget === '.' ||
    relativeTarget === '..' ||
    relativeTarget.startsWith(`..${path.sep}`) ||
    path.isAbsolute(relativeTarget)
  ) {
    throw new Error(`Path "${originalFilePath}" resolves outside the worktree`)
  }
}

async function validateUntrackedDiscardTarget(
  worktreePath: string,
  filePath: string
): Promise<string> {
  const resolvedWorktreePath = path.resolve(worktreePath)
  const resolvedTarget = path.resolve(worktreePath, filePath)
  assertTargetIsWorktreeChild(resolvedWorktreePath, resolvedTarget, filePath)

  const realWorktreePath = path.resolve(await realpath(worktreePath))

  try {
    const targetStats = await lstat(resolvedTarget)
    // Remove symlink leaves themselves; symlink parents must not redirect recursive deletion outside the worktree.
    const pathToValidate = targetStats.isSymbolicLink()
      ? path.dirname(resolvedTarget)
      : resolvedTarget
    await assertRealPathInsideWorktree(realWorktreePath, pathToValidate, filePath)
  } catch (error) {
    if (!isENOENT(error)) {
      throw error
    }
    await assertNearestExistingParentInsideWorktree(realWorktreePath, resolvedTarget, filePath)
  }

  return resolvedTarget
}

export async function removeSafeUntrackedDiscardTarget(
  worktreePath: string,
  filePath: string,
  removePath: (filePath: string) => Promise<void>
): Promise<void> {
  await validateUntrackedDiscardTarget(worktreePath, filePath)
  await removePath(filePath)
}

export async function removeSafeUntrackedDiscardTargets(
  worktreePath: string,
  filePaths: readonly string[],
  removePaths: (filePaths: readonly string[]) => Promise<void>,
  beforeRemove?: () => Promise<void>
): Promise<void> {
  await forEachWithConcurrency(filePaths, DISCARD_PATH_VALIDATION_CONCURRENCY, async (filePath) => {
    await validateUntrackedDiscardTarget(worktreePath, filePath)
  })

  // Validate all untracked paths before tracked mutations, then recheck before Git-bounded cleanup.
  await beforeRemove?.()

  await forEachWithConcurrency(filePaths, DISCARD_PATH_VALIDATION_CONCURRENCY, async (filePath) => {
    await validateUntrackedDiscardTarget(worktreePath, filePath)
  })
  await removePaths(filePaths)
}