Function _writeWorkspaceIdToFs

src/gep/paths.js:369–419

(file, id)

// (or generate one if `id` is null). Returns the id that ended up on
// disk, or null on any unrecoverable error. EEXIST races re-read.
function _writeWorkspaceIdToFs(file, id) {
  const dir = path.dirname(file);
  try {
    // Refuse to write if `.evolver` is a symlink. mkdirSync({recursive:true})
    // happily traverses an existing symlinked directory and the subsequent
    // open() lands the secret file in the attacker-controlled target —
    // O_NOFOLLOW only guards the FINAL path component, not intermediate
    // directories. The pre-refactor monolithic getWorkspaceId() returned
    // null on a symlinked dir before reaching the write; preserve that
    // here (Bugbot PR #121 round-1 HIGH; original guard PR #109 round-2 HIGH).
    const dirStat = fs.lstatSync(dir, { throwIfNoEntry: false });
    if (dirStat && dirStat.isSymbolicLink()) return null;
    fs.mkdirSync(dir, { recursive: true });
    const payload = id || require('crypto').randomBytes(16).toString('hex');
    // Atomic create-and-fail-if-exists so we never overwrite an
    // attacker-pre-placed file (TOCTOU between lstat and writeFileSync
    // could otherwise race a symlink in). O_NOFOLLOW also refuses to
    // follow a symlink that appears between the lstat and open. Both
    // flags exist on Linux/macOS; on Windows O_NOFOLLOW is silently
    // ignored, but Windows has no symlink-by-default risk.
    // NOTE(windows): mode 0o600 passed to openSync is silently ignored on
    // Windows. The workspace-id file will NOT be restricted to owner-read-only.
    // Only Windows user-profile directory ACLs provide isolation. To get
    // proper per-user encryption on Windows, install @napi-rs/keyring — the
    // keychain path above will store the id in Credential Manager (DPAPI)
    // instead of this plaintext file.
    const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
      (fs.constants.O_NOFOLLOW || 0);
    let fd;
    try {
      fd = fs.openSync(file, flags, 0o600);
    } catch (e) {
      if (e && e.code === 'EEXIST') {
        // Another process beat us — re-read with the same symlink guards.
        return _readWorkspaceIdFromFs(file);
      }
      // ELOOP / EMLINK from O_NOFOLLOW hitting a symlink — refuse.
      return null;
    }
    try {
      fs.writeSync(fd, payload + '\n', 0, 'utf8');
    } finally {
      fs.closeSync(fd);
    }
    // Best-effort chmod: silently ignored on Windows (no equivalent ACL API).
    try { fs.chmodSync(file, 0o600); } catch { /* best-effort; no-op on Windows */ }
    return payload;
  } catch {
    return null;
  }
}

function getWorkspaceId() {
  if (process.env.EVOLVER_WORKSPACE_ID) return String(process.env.EVOLVER_WORKSPACE_ID);