@agenthippo-ai/agenthippo 1.110.11 → 1.110.20

package/out/pack/reconcile.js

@@ -1,217 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CURRENT_LINK = void 0;
-exports.safeJoin = safeJoin;
-exports.promoteCurrent = promoteCurrent;
-exports.reconcilePinnedPack = reconcilePinnedPack;
-exports.readDirAsFiles = readDirAsFiles;
-/**
- * Converge on the pinned pack version: fetch, VERIFY, then swap.
- *
- * Until now a version pin could only refuse — serve compared the pin to what it already ran and
- * denied sandbox creation on a mismatch. That is a stop, not a rollback, unless someone had
- * already deployed the pinned version out of band. This closes the loop.
- *
- * Three rules, each load-bearing:
- *
- * 1. **Fetching implies verifying, with no way to opt out.** A pack already on disk was put there
- *    by an operator, so requiring signatures for it is a policy choice. A pack pulled over the
- *    network and executed is precisely the case signatures exist for, so there is no flag here —
- *    an unsigned or unverifiable artifact is never promoted, whatever the lease says.
- *
- * 2. **Failure keeps serving the current version.** Same asymmetry as the lease itself: transport
- *    failure must not take a fleet down. A pin we cannot satisfy leaves the instance running what
- *    it already had and reporting that version, so the console shows "pinned to X, running Y"
- *    rather than an outage. Refusing instead would convert a bad tag or a GitHub blip into a
- *    fleet-wide stop.
- *
- * 3. **Promotion is a symlink swap, never an in-place edit.** Files are written to a staging
- *    directory, verified there, and only then does `current` point at them. A half-downloaded
- *    pack is therefore never reachable, and a sandbox that is mid-start keeps the directory it
- *    already opened. Version convergence stays sandbox lifecycle — no hot-swap machinery.
- */
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const signature_1 = require("./signature");
-exports.CURRENT_LINK = 'current';
-/**
- * Join a relative artifact path onto a root, refusing anything that escapes it.
- *
- * A downloaded archive is untrusted input: an entry called `../../etc/cron.d/x` would otherwise
- * write outside the staging directory before any signature had been checked. Verification happens
- * AFTER extraction, so extraction itself has to be safe on its own.
- *
- * REJECT, never sanitise. An earlier version stripped a leading `../` and carried on, which is
- * worse than it looks: the entry then lands somewhere it did not claim, and the signature — which
- * is computed over the extracted tree — would happily cover that rewritten layout. An artifact
- * that asks to escape is refused outright rather than quietly relocated.
- */
-function safeJoin(root, rel) {
-    if (path.isAbsolute(rel)) {
-        return undefined;
-    }
-    const abs = path.resolve(root, rel);
-    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
-    return abs.startsWith(rootWithSep) ? abs : undefined;
-}
-/** Point `<packsRoot>/current` at `target`, atomically enough that no reader sees it missing. */
-function promoteCurrent(packsRoot, target) {
-    const link = path.join(packsRoot, exports.CURRENT_LINK);
-    const tmp = `${link}.swap-${process.pid}-${Date.now()}`;
-    fs.symlinkSync(target, tmp);
-    // rename over an existing symlink is atomic; unlink-then-link would leave a window with no
-    // `current` at all, and a sandbox starting in that window would fail to find its pack.
-    fs.renameSync(tmp, link);
-    return link;
-}
-async function reconcilePinnedPack(input) {
-    const { pack, pinnedVersion, packsRoot, logger } = input;
-    const finalDir = path.join(packsRoot, pinnedVersion);
-    fs.mkdirSync(packsRoot, { recursive: true });
-    // Already materialised and still valid? Re-verify rather than trust the directory name: it is
-    // on local disk, which is exactly where something could have edited it since we wrote it.
-    if (fs.existsSync(finalDir)) {
-        const existing = verifyMaterialised(finalDir, pack, pinnedVersion, input.publicKeysByKid);
-        if (existing.ok) {
-            promoteCurrent(packsRoot, finalDir);
-            return { ok: true, packDir: finalDir, version: pinnedVersion, alreadyPresent: true };
-        }
-        logger?.warn(`[Pack] cached ${pack}@${pinnedVersion} failed verification (${existing.reason}); re-fetching`);
-        fs.rmSync(finalDir, { recursive: true, force: true });
-    }
-    let files;
-    try {
-        files = await input.download(pack, pinnedVersion);
-    }
-    catch (err) {
-        return { ok: false, reason: `fetch failed: ${err instanceof Error ? err.message : String(err)}` };
-    }
-    if (files.length === 0) {
-        return { ok: false, reason: `store returned no files for ${pack}@${pinnedVersion}` };
-    }
-    const staging = path.join(packsRoot, `.staging-${pinnedVersion}-${process.pid}-${Date.now()}`);
-    try {
-        fs.mkdirSync(staging, { recursive: true });
-        for (const file of files) {
-            const abs = safeJoin(staging, file.path);
-            // Refuse the whole artifact, not just the entry: a tarball trying to escape is not a
-            // packaging accident to route around.
-            if (!abs) {
-                fs.rmSync(staging, { recursive: true, force: true });
-                return { ok: false, reason: `refusing artifact: entry escapes the pack root (${file.path})` };
-            }
-            // A downloaded artifact never legitimately carries a symlink, and materialising one as a
-            // regular file would make the tree hash differently from the list that was verified.
-            if (file.link) {
-                fs.rmSync(staging, { recursive: true, force: true });
-                return { ok: false, reason: `refusing artifact: symlink entries are not accepted from the store (${file.path})` };
-            }
-            fs.mkdirSync(path.dirname(abs), { recursive: true });
-            fs.writeFileSync(abs, file.content);
-        }
-        const verdict = verifyFetchedArtifact(files, pack, pinnedVersion, input.publicKeysByKid);
-        if (!verdict.ok) {
-            fs.rmSync(staging, { recursive: true, force: true });
-            return { ok: false, reason: verdict.reason };
-        }
-        fs.renameSync(staging, finalDir);
-        promoteCurrent(packsRoot, finalDir);
-        logger?.info(`[Pack] converged to ${pack}@${pinnedVersion} (signature verified)`);
-        return { ok: true, packDir: finalDir, version: pinnedVersion, alreadyPresent: false };
-    }
-    catch (err) {
-        fs.rmSync(staging, { recursive: true, force: true });
-        return { ok: false, reason: `staging failed: ${err instanceof Error ? err.message : String(err)}` };
-    }
-}
-/**
- * Read a materialised tree back as a file list, exactly as the digest sees it.
- *
- * Must agree with `computePackDigest`'s walk entry for entry, or a pack signed on disk cannot be
- * re-verified from its own directory. Two things make it agree: `isDigestExcluded` (the same
- * predicate, rather than a second list that drifts) and symlinks carried as `link: true` with
- * their target string, instead of being dropped on the floor as they were before — a dropped
- * symlink is a file the signature covers and this path does not, i.e. a digest mismatch on every
- * pack that contains one.
- *
- * Exported so the parity test can drive the real function rather than a copy of it.
- */
-function readDirAsFiles(dir) {
-    const files = [];
-    const walk = (d, prefix) => {
-        for (const name of fs.readdirSync(d)) {
-            const rel = prefix ? `${prefix}/${name}` : name;
-            // Skipping excluded subtrees here is a performance choice only — the digest would drop
-            // them anyway. Not descending into node_modules is the difference between a fast verify
-            // and a slow one. `pack.sig` is deliberately NOT skipped: it is excluded from the digest
-            // but it is the file this path reads the signature OUT of.
-            if (signature_1.DIGEST_EXCLUDED_SEGMENTS.has(name)) {
-                continue;
-            }
-            const abs = path.join(d, name);
-            const st = fs.lstatSync(abs);
-            if (st.isSymbolicLink()) {
-                files.push({ path: rel, content: Buffer.from(fs.readlinkSync(abs)), link: true });
-            }
-            else if (st.isDirectory()) {
-                walk(abs, rel);
-            }
-            else if (st.isFile()) {
-                files.push({ path: rel, content: fs.readFileSync(abs) });
-            }
-        }
-    };
-    walk(dir, '');
-    return files;
-}
-function verifyFetchedArtifact(files, pack, version, keys) {
-    if (Object.keys(keys).length === 0) {
-        return { ok: false, reason: 'no trusted signing keys configured' };
-    }
-    const sigFile = files.find((f) => f.path.replace(/\\/g, '/') === signature_1.PACK_SIGNATURE_FILE);
-    if (!sigFile) {
-        return { ok: false, reason: `${pack}@${version} is not signed` };
-    }
-    const token = sigFile.content.toString('utf8').trim();
-    const res = (0, signature_1.verifyPackFromFiles)(token, keys, pack, version, files);
-    return res.ok ? { ok: true } : { ok: false, reason: res.reason };
-}
-function verifyMaterialised(dir, pack, version, keys) {
-    return verifyFetchedArtifact(readDirAsFiles(dir), pack, version, keys);
-}