@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/pack/reconcile.js

@@ -0,0 +1,217 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURRENT_LINK = void 0;
+exports.safeJoin = safeJoin;
+exports.promoteCurrent = promoteCurrent;
+exports.reconcilePinnedPack = reconcilePinnedPack;
+exports.readDirAsFiles = readDirAsFiles;
+/**
+ * Converge on the pinned pack version: fetch, VERIFY, then swap.
+ *
+ * Until now a version pin could only refuse — serve compared the pin to what it already ran and
+ * denied sandbox creation on a mismatch. That is a stop, not a rollback, unless someone had
+ * already deployed the pinned version out of band. This closes the loop.
+ *
+ * Three rules, each load-bearing:
+ *
+ * 1. **Fetching implies verifying, with no way to opt out.** A pack already on disk was put there
+ *    by an operator, so requiring signatures for it is a policy choice. A pack pulled over the
+ *    network and executed is precisely the case signatures exist for, so there is no flag here —
+ *    an unsigned or unverifiable artifact is never promoted, whatever the lease says.
+ *
+ * 2. **Failure keeps serving the current version.** Same asymmetry as the lease itself: transport
+ *    failure must not take a fleet down. A pin we cannot satisfy leaves the instance running what
+ *    it already had and reporting that version, so the console shows "pinned to X, running Y"
+ *    rather than an outage. Refusing instead would convert a bad tag or a GitHub blip into a
+ *    fleet-wide stop.
+ *
+ * 3. **Promotion is a symlink swap, never an in-place edit.** Files are written to a staging
+ *    directory, verified there, and only then does `current` point at them. A half-downloaded
+ *    pack is therefore never reachable, and a sandbox that is mid-start keeps the directory it
+ *    already opened. Version convergence stays sandbox lifecycle — no hot-swap machinery.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const signature_1 = require("./signature");
+exports.CURRENT_LINK = 'current';
+/**
+ * Join a relative artifact path onto a root, refusing anything that escapes it.
+ *
+ * A downloaded archive is untrusted input: an entry called `../../etc/cron.d/x` would otherwise
+ * write outside the staging directory before any signature had been checked. Verification happens
+ * AFTER extraction, so extraction itself has to be safe on its own.
+ *
+ * REJECT, never sanitise. An earlier version stripped a leading `../` and carried on, which is
+ * worse than it looks: the entry then lands somewhere it did not claim, and the signature — which
+ * is computed over the extracted tree — would happily cover that rewritten layout. An artifact
+ * that asks to escape is refused outright rather than quietly relocated.
+ */
+function safeJoin(root, rel) {
+    if (path.isAbsolute(rel)) {
+        return undefined;
+    }
+    const abs = path.resolve(root, rel);
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    return abs.startsWith(rootWithSep) ? abs : undefined;
+}
+/** Point `<packsRoot>/current` at `target`, atomically enough that no reader sees it missing. */
+function promoteCurrent(packsRoot, target) {
+    const link = path.join(packsRoot, exports.CURRENT_LINK);
+    const tmp = `${link}.swap-${process.pid}-${Date.now()}`;
+    fs.symlinkSync(target, tmp);
+    // rename over an existing symlink is atomic; unlink-then-link would leave a window with no
+    // `current` at all, and a sandbox starting in that window would fail to find its pack.
+    fs.renameSync(tmp, link);
+    return link;
+}
+async function reconcilePinnedPack(input) {
+    const { pack, pinnedVersion, packsRoot, logger } = input;
+    const finalDir = path.join(packsRoot, pinnedVersion);
+    fs.mkdirSync(packsRoot, { recursive: true });
+    // Already materialised and still valid? Re-verify rather than trust the directory name: it is
+    // on local disk, which is exactly where something could have edited it since we wrote it.
+    if (fs.existsSync(finalDir)) {
+        const existing = verifyMaterialised(finalDir, pack, pinnedVersion, input.publicKeysByKid);
+        if (existing.ok) {
+            promoteCurrent(packsRoot, finalDir);
+            return { ok: true, packDir: finalDir, version: pinnedVersion, alreadyPresent: true };
+        }
+        logger?.warn(`[Pack] cached ${pack}@${pinnedVersion} failed verification (${existing.reason}); re-fetching`);
+        fs.rmSync(finalDir, { recursive: true, force: true });
+    }
+    let files;
+    try {
+        files = await input.download(pack, pinnedVersion);
+    }
+    catch (err) {
+        return { ok: false, reason: `fetch failed: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    if (files.length === 0) {
+        return { ok: false, reason: `store returned no files for ${pack}@${pinnedVersion}` };
+    }
+    const staging = path.join(packsRoot, `.staging-${pinnedVersion}-${process.pid}-${Date.now()}`);
+    try {
+        fs.mkdirSync(staging, { recursive: true });
+        for (const file of files) {
+            const abs = safeJoin(staging, file.path);
+            // Refuse the whole artifact, not just the entry: a tarball trying to escape is not a
+            // packaging accident to route around.
+            if (!abs) {
+                fs.rmSync(staging, { recursive: true, force: true });
+                return { ok: false, reason: `refusing artifact: entry escapes the pack root (${file.path})` };
+            }
+            // A downloaded artifact never legitimately carries a symlink, and materialising one as a
+            // regular file would make the tree hash differently from the list that was verified.
+            if (file.link) {
+                fs.rmSync(staging, { recursive: true, force: true });
+                return { ok: false, reason: `refusing artifact: symlink entries are not accepted from the store (${file.path})` };
+            }
+            fs.mkdirSync(path.dirname(abs), { recursive: true });
+            fs.writeFileSync(abs, file.content);
+        }
+        const verdict = verifyFetchedArtifact(files, pack, pinnedVersion, input.publicKeysByKid);
+        if (!verdict.ok) {
+            fs.rmSync(staging, { recursive: true, force: true });
+            return { ok: false, reason: verdict.reason };
+        }
+        fs.renameSync(staging, finalDir);
+        promoteCurrent(packsRoot, finalDir);
+        logger?.info(`[Pack] converged to ${pack}@${pinnedVersion} (signature verified)`);
+        return { ok: true, packDir: finalDir, version: pinnedVersion, alreadyPresent: false };
+    }
+    catch (err) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        return { ok: false, reason: `staging failed: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
+/**
+ * Read a materialised tree back as a file list, exactly as the digest sees it.
+ *
+ * Must agree with `computePackDigest`'s walk entry for entry, or a pack signed on disk cannot be
+ * re-verified from its own directory. Two things make it agree: `isDigestExcluded` (the same
+ * predicate, rather than a second list that drifts) and symlinks carried as `link: true` with
+ * their target string, instead of being dropped on the floor as they were before — a dropped
+ * symlink is a file the signature covers and this path does not, i.e. a digest mismatch on every
+ * pack that contains one.
+ *
+ * Exported so the parity test can drive the real function rather than a copy of it.
+ */
+function readDirAsFiles(dir) {
+    const files = [];
+    const walk = (d, prefix) => {
+        for (const name of fs.readdirSync(d)) {
+            const rel = prefix ? `${prefix}/${name}` : name;
+            // Skipping excluded subtrees here is a performance choice only — the digest would drop
+            // them anyway. Not descending into node_modules is the difference between a fast verify
+            // and a slow one. `pack.sig` is deliberately NOT skipped: it is excluded from the digest
+            // but it is the file this path reads the signature OUT of.
+            if (signature_1.DIGEST_EXCLUDED_SEGMENTS.has(name)) {
+                continue;
+            }
+            const abs = path.join(d, name);
+            const st = fs.lstatSync(abs);
+            if (st.isSymbolicLink()) {
+                files.push({ path: rel, content: Buffer.from(fs.readlinkSync(abs)), link: true });
+            }
+            else if (st.isDirectory()) {
+                walk(abs, rel);
+            }
+            else if (st.isFile()) {
+                files.push({ path: rel, content: fs.readFileSync(abs) });
+            }
+        }
+    };
+    walk(dir, '');
+    return files;
+}
+function verifyFetchedArtifact(files, pack, version, keys) {
+    if (Object.keys(keys).length === 0) {
+        return { ok: false, reason: 'no trusted signing keys configured' };
+    }
+    const sigFile = files.find((f) => f.path.replace(/\\/g, '/') === signature_1.PACK_SIGNATURE_FILE);
+    if (!sigFile) {
+        return { ok: false, reason: `${pack}@${version} is not signed` };
+    }
+    const token = sigFile.content.toString('utf8').trim();
+    const res = (0, signature_1.verifyPackFromFiles)(token, keys, pack, version, files);
+    return res.ok ? { ok: true } : { ok: false, reason: res.reason };
+}
+function verifyMaterialised(dir, pack, version, keys) {
+    return verifyFetchedArtifact(readDirAsFiles(dir), pack, version, keys);
+}