feat: define P2 host workspace command contract

tools/thothctl/internal/safeio/files_unix.go

@@ -3,6 +3,7 @@
 package safeio
 
 import (
+	"io/fs"
 	"os"
 	"strings"
 
@@ -47,7 +48,18 @@ func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
 		return nil, ErrUnsafeFile
 	}
 	defer file.Close()
-	return readBoundedRegularFile(file, maximum)
+	var before, after unix.Stat_t
+	if err := unix.Fstat(int(file.Fd()), &before); err != nil || before.Nlink > 1 || before.Mode&unix.S_IFMT != unix.S_IFREG {
+		return nil, ErrUnsafeFile
+	}
+	contents, err := readBoundedRegularFile(file, maximum)
+	if err != nil {
+		return nil, ErrUnsafeFile
+	}
+	if err := unix.Fstat(int(file.Fd()), &after); err != nil || after.Nlink > 1 || after.Mode != before.Mode || after.Ino != before.Ino || after.Dev != before.Dev || after.Size != before.Size {
+		return nil, ErrUnsafeFile
+	}
+	return contents, nil
 }
 
 func closeUnixDescriptors(descriptors []int) {
@@ -55,3 +67,76 @@ func closeUnixDescriptors(descriptors []int) {
 		unix.Close(descriptor)
 	}
 }
+
+func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
+	if err := ValidateCanonicalPath(path); err != nil || len(contents) > 16<<20 || mode.Perm() == 0 || mode.Perm()&0o077 != 0 {
+		return ErrUnsafeFile
+	}
+	components := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
+	if len(components) == 0 || components[0] == "" {
+		return ErrUnsafeFile
+	}
+	dir, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer unix.Close(dir)
+	for _, component := range components[:len(components)-1] {
+		next, err := unix.Openat(dir, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+		if err != nil {
+			return ErrUnsafeFile
+		}
+		unix.Close(dir)
+		dir = next
+	}
+	fd, err := unix.Openat(dir, components[len(components)-1], unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, uint32(mode.Perm()))
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	f := os.NewFile(uintptr(fd), "thothctl-safeio-output")
+	if f == nil {
+		unix.Close(fd)
+		return ErrUnsafeFile
+	}
+	defer f.Close()
+	if err := f.Chmod(mode); err != nil {
+		return ErrUnsafeFile
+	}
+	if _, err := f.Write(contents); err != nil {
+		return ErrUnsafeFile
+	}
+	if err := f.Sync(); err != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func validateCanonicalOutputPath(path string) error {
+	if err := ValidateCanonicalPath(path); err != nil {
+		return err
+	}
+	components := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
+	if len(components) < 2 || components[0] == "" {
+		return ErrUnsafeFile
+	}
+	dir, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer unix.Close(dir)
+	for _, component := range components[:len(components)-1] {
+		next, err := unix.Openat(dir, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+		if err != nil {
+			return ErrUnsafeFile
+		}
+		unix.Close(dir)
+		dir = next
+	}
+	var st unix.Stat_t
+	if err := unix.Fstatat(dir, components[len(components)-1], &st, unix.AT_SYMLINK_NOFOLLOW); err == nil {
+		return ErrUnsafeFile
+	} else if err != unix.ENOENT {
+		return ErrUnsafeFile
+	}
+	return nil
+}