@botbuddy/cli 1.59.6 → 1.59.8

package/src/daemon/installer.mjs

@@ -0,0 +1,438 @@
+// BOT-2055: the Node CLI is only the privileged installer. The installed
+// workload is the exact verified Go payload and contains no Node dependency.
+import { lstat, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFile as execFileCallback, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { randomUUID } from "node:crypto";
+
+const execFile = promisify(execFileCallback);
+export const destinations = Object.freeze({
+  darwin: "/Library/LaunchDaemons/com.botbuddy.daemon.plist",
+  linux: "/etc/systemd/system/botbuddy-daemon.service",
+});
+const fail = (code) => { throw new Error(code); };
+const safeAbsolutePath = (value) => typeof value === "string" && /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/.test(value);
+const safeSshHost = (value) => typeof value === "string" && /^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9._-]+$/.test(value);
+const safeRelease = (release) => release && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(release.releaseVersion)
+  && /^(darwin-arm64|linux-x64)$/.test(release.target)
+  && /^[0-9a-f]{40}$/.test(release.sourceCommit)
+  && /^[0-9a-f]{64}$/.test(release.sha256)
+  && Buffer.isBuffer(release.payload);
+const sshOptions = Object.freeze(["-o", "BatchMode=yes", "-o", "ForwardAgent=no", "-o", "StrictHostKeyChecking=yes"]);
+
+export async function serviceUserUid(user, exec = execFile) {
+  if (typeof user !== "string" || !/^[a-z_][a-z0-9_-]*$/i.test(user)) fail("daemon_service_user_invalid");
+  let result;
+  try { result = await exec("id", ["-u", user]); } catch { fail("daemon_service_user_invalid"); }
+  const uid = Number.parseInt(String(result?.stdout ?? "").trim(), 10);
+  if (!Number.isSafeInteger(uid) || uid <= 0 || String(uid) !== String(result?.stdout ?? "").trim()) fail("daemon_service_user_invalid");
+  return uid;
+}
+
+export function installedBinaryPath(release) {
+  return `/opt/botbuddy/daemon/releases/${release.releaseVersion}/${release.target}/botbuddy-daemon`;
+}
+
+function checksumCommand(platform) {
+  return platform === "darwin" ? ["shasum", ["-a", "256"]] : ["sha256sum", []];
+}
+
+function checksumMatches(output, expected) {
+  return String(output ?? "").trim().split(/\s+/)[0] === expected;
+}
+
+function expectedBootoutAbsent(error) {
+  return /Boot-out failed:\s*3:|Could not find service/.test(String(error?.stderr ?? error?.message ?? ""));
+}
+
+export function assertSshHost(host) {
+  if (!safeSshHost(host)) fail("daemon_remote_host_invalid");
+  return host;
+}
+
+function remoteScript(host, args, script, { timeout = 30_000, maxOutput = 16 * 1024 } = {}) {
+  assertSshHost(host);
+  return new Promise((resolve, reject) => {
+    const child = spawn("ssh", [...sshOptions, host, ...args], { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let bounded = true;
+    let timedOut = false;
+    const timer = setTimeout(() => { timedOut = true; child.kill("SIGTERM"); }, timeout);
+    const append = (current, chunk) => {
+      const next = current + String(chunk);
+      if (next.length > maxOutput) { bounded = false; child.kill("SIGTERM"); return current; }
+      return next;
+    };
+    child.stdout.on("data", (chunk) => { stdout = append(stdout, chunk); });
+    child.stderr.on("data", (chunk) => { stderr = append(stderr, chunk); });
+    child.on("error", (error) => { clearTimeout(timer); reject(error); });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (timedOut) return reject(new Error("daemon_remote_command_timeout"));
+      if (!bounded) return reject(new Error("daemon_remote_command_output_exceeded"));
+      return code === 0 ? resolve({ stdout, stderr }) : reject(Object.assign(new Error("daemon_remote_command_failed"), { code }));
+    });
+    child.stdin.end(script);
+  });
+}
+
+const remotePrepareScript = String.raw`set -eu
+directory=$(mktemp -d /tmp/botbuddy-daemon.XXXXXX)
+chmod 0700 "$directory"
+printf '%s\n' "$directory"
+`;
+
+const remoteCleanupScript = String.raw`set -eu
+directory=$1
+case "$directory" in /tmp/botbuddy-daemon.[A-Za-z0-9]*) ;; *) exit 80 ;; esac
+rm -rf -- "$directory"
+`;
+
+async function remoteTemporaryDirectory(host, runScript = remoteScript) {
+  const result = await runScript(host, ["sh", "-s", "--"], remotePrepareScript);
+  const directory = String(result?.stdout ?? "").trim();
+  if (!/^\/tmp\/botbuddy-daemon\.[A-Za-z0-9]+$/.test(directory)) fail("daemon_remote_staging_invalid");
+  return directory;
+}
+
+// This is intentionally fixed shell, passed on stdin to ssh. Caller data is
+// positional-only and validated before transport; the target needs no Node/npm.
+export const remoteInstallScript = String.raw`set -eu
+directory=$1
+platform=$2
+user=$3
+version=$4
+commit=$5
+runtime_target=$6
+digest=$7
+config=$8
+destination=$9
+shift 9
+binary=$1
+case "$directory" in /tmp/botbuddy-daemon.[A-Za-z0-9]*) ;; *) exit 80 ;; esac
+binary_stage=
+definition_stage=
+cleanup() {
+  test -z "$binary_stage" || sudo rm -f -- "$binary_stage" || true
+  test -z "$definition_stage" || sudo rm -f -- "$definition_stage" || true
+  rm -rf -- "$directory"
+}
+trap cleanup EXIT HUP INT TERM
+test "$(id -u "$user")" -gt 0
+test -f "$directory/botbuddy-daemon"
+test -f "$directory/definition"
+case "$platform" in
+  darwin) group=wheel; expected_destination=/Library/LaunchDaemons/com.botbuddy.daemon.plist ;;
+  linux) group=root; expected_destination=/etc/systemd/system/botbuddy-daemon.service ;;
+  *) exit 81 ;;
+esac
+test "$destination" = "$expected_destination"
+# The staging directory starts private to the SSH user. It is made traverse-
+# only so the distinct service user can execute the already-verified payload,
+# but cannot list or modify the staging contents.
+chmod 0711 "$directory"
+chmod 0755 "$directory/botbuddy-daemon"
+if [ "$platform" = darwin ]; then
+  actual=$(shasum -a 256 "$directory/botbuddy-daemon" | awk '{print $1}')
+else
+  actual=$(sha256sum "$directory/botbuddy-daemon" | awk '{print $1}')
+fi
+test "$actual" = "$digest"
+# Verify identity and configuration as the future non-root service user first.
+test "$(sudo -u "$user" "$directory/botbuddy-daemon" --version)" = "{\"version\":\"$version\",\"commit\":\"$commit\",\"target\":\"$runtime_target\"}"
+test "$(sudo -u "$user" "$directory/botbuddy-daemon" --check-config --config "$config")" = '{"valid":true}'
+binary_directory=$(dirname "$binary")
+service_directory=$(dirname "$destination")
+safe_ancestry() {
+  path=$1
+  old_ifs=$IFS
+  IFS=/
+  set -- $path
+  IFS=$old_ifs
+  current=
+  for segment in "$@"; do
+    test -n "$segment" || continue
+    current=$current/$segment
+    if sudo test -L "$current"; then exit 82; fi
+    if ! sudo test -e "$current"; then return 0; fi
+    sudo test -d "$current"
+    if [ "$platform" = darwin ]; then
+      owner=$(sudo stat -f '%u' "$current")
+      mode=$(sudo stat -f '%OLp' "$current")
+    else
+      owner=$(sudo stat -c '%u' "$current")
+      mode=$(sudo stat -c '%a' "$current")
+    fi
+    test "$owner" = 0
+    case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+  done
+}
+safe_ancestry "$binary_directory"
+safe_ancestry "$service_directory"
+if sudo test -e "$binary"; then
+  if [ "$platform" = darwin ]; then actual=$(sudo shasum -a 256 "$binary" | awk '{print $1}'); else actual=$(sudo sha256sum "$binary" | awk '{print $1}'); fi
+  test "$actual" = "$digest"
+else
+  sudo install -d -o root -g "$group" -m 0755 "$binary_directory"
+  binary_stage=$(sudo mktemp "$binary_directory/.botbuddy-daemon.XXXXXXXX")
+  sudo install -o root -g "$group" -m 0755 "$directory/botbuddy-daemon" "$binary_stage"
+  if [ "$platform" = darwin ]; then actual=$(sudo shasum -a 256 "$binary_stage" | awk '{print $1}'); else actual=$(sudo sha256sum "$binary_stage" | awk '{print $1}'); fi
+  test "$actual" = "$digest"
+  sudo mv -n "$binary_stage" "$binary"
+  binary_stage=
+  if [ "$platform" = darwin ]; then actual=$(sudo shasum -a 256 "$binary" | awk '{print $1}'); else actual=$(sudo sha256sum "$binary" | awk '{print $1}'); fi
+  test "$actual" = "$digest"
+fi
+sudo install -d -o root -g "$group" -m 0755 "$service_directory"
+definition_stage=$(sudo mktemp "$service_directory/.botbuddy-daemon.XXXXXXXX")
+sudo install -o root -g "$group" -m 0644 "$directory/definition" "$definition_stage"
+sudo mv -f "$definition_stage" "$destination"
+definition_stage=
+case "$platform" in
+  darwin)
+    if ! bootout=$(sudo launchctl bootout system/com.botbuddy.daemon 2>&1); then
+      case "$bootout" in *"Boot-out failed: 3:"*|*"Could not find service"*) ;; *) printf '%s\n' "$bootout" >&2; exit 83 ;; esac
+    fi
+    sudo launchctl bootstrap system "$destination"
+    ;;
+  linux)
+    sudo systemctl daemon-reload
+    sudo systemctl enable botbuddy-daemon.service
+    sudo systemctl restart botbuddy-daemon.service
+    ;;
+esac
+printf '%s\n' '{"outcome":"installed"}'
+`;
+
+// Bootstrap must establish the selected Go executable before it asks that
+// executable to create or inspect target identity. This phase deliberately
+// excludes profile/config validation, service definitions, and activation: the
+// existing remote installer owns those post-enrollment checks.
+export const remoteStageReleaseScript = String.raw`set -eu
+directory=$1
+platform=$2
+user=$3
+version=$4
+commit=$5
+runtime_target=$6
+digest=$7
+binary=$8
+case "$directory" in /tmp/botbuddy-daemon.[A-Za-z0-9]*) ;; *) exit 80 ;; esac
+binary_stage=
+cleanup() {
+  test -z "$binary_stage" || sudo -n rm -f -- "$binary_stage" || true
+  rm -rf -- "$directory"
+}
+trap cleanup EXIT HUP INT TERM
+test "$(id -u "$user")" -gt 0
+test -f "$directory/botbuddy-daemon"
+case "$platform" in
+  darwin) group=wheel ;;
+  linux) group=root ;;
+  *) exit 81 ;;
+esac
+binary_directory=$(dirname "$binary")
+safe_ancestry() {
+  path=$1
+  old_ifs=$IFS
+  IFS=/
+  set -- $path
+  IFS=$old_ifs
+  current=
+  for segment in "$@"; do
+    test -n "$segment" || continue
+    current=$current/$segment
+    if sudo -n test -L "$current"; then exit 82; fi
+    if ! sudo -n test -e "$current"; then return 0; fi
+    sudo -n test -d "$current"
+    if [ "$platform" = darwin ]; then owner=$(sudo -n stat -f '%u' "$current"); else owner=$(sudo -n stat -c '%u' "$current"); fi
+    test "$owner" = 0
+    if [ "$platform" = darwin ]; then mode=$(sudo -n stat -f '%OLp' "$current"); else mode=$(sudo -n stat -c '%a' "$current"); fi
+    case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+  done
+}
+verify_binary() {
+  sudo -n test -f "$binary"
+  sudo -n test ! -L "$binary"
+  if [ "$platform" = darwin ]; then owner=$(sudo -n stat -f '%u' "$binary"); else owner=$(sudo -n stat -c '%u' "$binary"); fi
+  test "$owner" = 0
+  if [ "$platform" = darwin ]; then mode=$(sudo -n stat -f '%OLp' "$binary"); else mode=$(sudo -n stat -c '%a' "$binary"); fi
+  case "$mode" in 755|100755) ;; *) exit 82 ;; esac
+  if [ "$platform" = darwin ]; then actual=$(sudo -n shasum -a 256 "$binary" | awk '{print $1}'); else actual=$(sudo -n sha256sum "$binary" | awk '{print $1}'); fi
+  test "$actual" = "$digest"
+  test "$(sudo -n -u "$user" -- "$binary" --version)" = "{\"version\":\"$version\",\"commit\":\"$commit\",\"target\":\"$runtime_target\"}"
+}
+safe_ancestry "$binary_directory"
+if sudo -n test -e "$binary"; then
+  verify_binary
+else
+  sudo -n install -d -o root -g "$group" -m 0755 "$binary_directory"
+  binary_stage=$(sudo -n mktemp "$binary_directory/.botbuddy-daemon.XXXXXXXX")
+  sudo -n install -o root -g "$group" -m 0755 "$directory/botbuddy-daemon" "$binary_stage"
+  if [ "$platform" = darwin ]; then actual=$(sudo -n shasum -a 256 "$binary_stage" | awk '{print $1}'); else actual=$(sudo -n sha256sum "$binary_stage" | awk '{print $1}'); fi
+  test "$actual" = "$digest"
+  sudo -n mv -n "$binary_stage" "$binary"
+  binary_stage=
+  verify_binary
+fi
+printf '%s\n' '{"outcome":"staged"}'
+`;
+
+export async function stageRemoteDaemonRelease({
+  platform, host, user, release,
+  exec = execFile, runScript = remoteScript, makeTemp = mkdtemp, write = writeFile, remove = rm,
+} = {}) {
+  if (!destinations[platform] || !safeSshHost(host) || typeof user !== "string" || !/^[a-z_][a-z0-9_-]*$/i.test(user) || !safeRelease(release)) {
+    fail("daemon_remote_stage_invalid");
+  }
+  const runtimeTarget = release.target === "linux-x64" ? "linux-amd64" : release.target;
+  const localDirectory = await makeTemp(join(tmpdir(), "botbuddy-daemon-"));
+  const snapshot = join(localDirectory, "botbuddy-daemon");
+  let remoteDirectory;
+  let remoteCleaned = false;
+  try {
+    await write(snapshot, release.payload, { mode: 0o500 });
+    remoteDirectory = await remoteTemporaryDirectory(host, runScript);
+    await exec("scp", ["-q", ...sshOptions, "--", snapshot, `${host}:${remoteDirectory}/`], { timeout: 30_000, maxBuffer: 16 * 1024 });
+    const result = await runScript(host, ["sh", "-s", "--", remoteDirectory, platform, user, release.releaseVersion, release.sourceCommit, runtimeTarget, release.sha256, installedBinaryPath(release)], remoteStageReleaseScript);
+    if (String(result?.stdout ?? "").trim() !== '{"outcome":"staged"}') fail("daemon_remote_stage_unreadable");
+    remoteCleaned = true;
+    return { outcome: "staged", binary: installedBinaryPath(release), service_user: user, host };
+  } finally {
+    if (remoteDirectory && !remoteCleaned) await runScript(host, ["sh", "-s", "--", remoteDirectory], remoteCleanupScript, { timeout: 15_000 }).catch(() => {});
+    await remove(localDirectory, { recursive: true, force: true });
+  }
+}
+
+export async function installRemoteService({
+  platform, host, user, definition, release, config,
+  exec = execFile, runScript = remoteScript, makeTemp = mkdtemp, write = writeFile, remove = rm,
+} = {}) {
+  if (!destinations[platform] || !safeSshHost(host) || typeof definition !== "string" || !definition.length || !safeRelease(release) || !safeAbsolutePath(config)) fail("daemon_remote_install_invalid");
+  const runtimeTarget = release.target === "linux-x64" ? "linux-amd64" : release.target;
+  const localDirectory = await makeTemp(join(tmpdir(), "botbuddy-daemon-"));
+  const snapshot = join(localDirectory, "botbuddy-daemon");
+  const definitionFile = join(localDirectory, "definition");
+  let remoteDirectory;
+  let remoteCleaned = false;
+  try {
+    await write(snapshot, release.payload, { mode: 0o500 });
+    await write(definitionFile, definition, { mode: 0o600 });
+    remoteDirectory = await remoteTemporaryDirectory(host, runScript);
+    await exec("scp", ["-q", ...sshOptions, "--", snapshot, definitionFile, `${host}:${remoteDirectory}/`], { timeout: 30_000, maxBuffer: 16 * 1024 });
+    const result = await runScript(host, ["sh", "-s", "--", remoteDirectory, platform, user, release.releaseVersion, release.sourceCommit, runtimeTarget, release.sha256, config, destinations[platform], installedBinaryPath(release)], remoteInstallScript);
+    if (String(result?.stdout ?? "").trim() !== '{"outcome":"installed"}') fail("daemon_remote_install_unreadable");
+    remoteCleaned = true;
+    return { outcome: "installed", destination: destinations[platform], binary: installedBinaryPath(release), service_user: user, host };
+  } finally {
+    if (remoteDirectory && !remoteCleaned) await runScript(host, ["sh", "-s", "--", remoteDirectory], remoteCleanupScript, { timeout: 15_000 }).catch(() => {});
+    await remove(localDirectory, { recursive: true, force: true });
+  }
+}
+
+async function safeRootAncestry(path, inspect = lstat) {
+  const segments = path.split("/").filter(Boolean);
+  let current = "";
+  for (const segment of segments) {
+    current += `/${segment}`;
+    const stat = await inspect(current).catch((error) => error?.code === "ENOENT" ? null : Promise.reject(error));
+    if (!stat) return;
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 0 || (stat.mode & 0o022) !== 0) fail("daemon_install_unsafe_destination");
+  }
+}
+
+export async function installService({
+  platform, user, definition, release, config,
+  exec = execFile, makeTemp = mkdtemp, write = writeFile, remove = rm, random = randomUUID, inspect = lstat,
+} = {}) {
+  if (!destinations[platform] || typeof definition !== "string" || !definition.length || !safeRelease(release) || !safeAbsolutePath(config)) fail("daemon_install_invalid");
+  await serviceUserUid(user, exec);
+  const destination = destinations[platform];
+  const binary = installedBinaryPath(release);
+  const binaryDirectory = binary.slice(0, binary.lastIndexOf("/"));
+  const serviceDirectory = destination.slice(0, destination.lastIndexOf("/"));
+  // Never let sudo create through an attacker-controlled pre-existing path.
+  await safeRootAncestry(binaryDirectory, inspect);
+  await safeRootAncestry(serviceDirectory, inspect);
+  const tempDirectory = await makeTemp(join(tmpdir(), "botbuddy-daemon-"));
+  const snapshot = join(tempDirectory, "botbuddy-daemon");
+  const definitionFile = join(tempDirectory, platform === "darwin" ? "daemon.plist" : "daemon.service");
+  const binaryStage = join(binaryDirectory, `.botbuddy-daemon.${release.sha256}.${random()}`);
+  const definitionStage = join(serviceDirectory, `.${destination.slice(destination.lastIndexOf("/") + 1)}.${random()}`);
+  let binaryStaged = false;
+  let definitionStaged = false;
+  try {
+    // `payload` was read and hash-checked by validateDaemonRelease. Snapshot it
+    // before sudo so a source pathname cannot be replaced during installation.
+    await write(snapshot, release.payload, { mode: 0o500 });
+    await write(definitionFile, definition, { mode: 0o600 });
+    const [checksumCommandName, checksumArgs] = checksumCommand(platform);
+    let existing = false;
+    try { await exec("sudo", ["test", "-e", binary]); existing = true; }
+    catch (error) { if (error?.code !== 1) throw error; }
+    if (existing) {
+      const result = await exec("sudo", [checksumCommandName, ...checksumArgs, binary]);
+      if (!checksumMatches(result.stdout, release.sha256)) fail("daemon_install_existing_payload_mismatch");
+    }
+    const group = platform === "darwin" ? "wheel" : "root";
+    if (!existing) {
+      await exec("sudo", ["install", "-d", "-o", "root", "-g", group, "-m", "0755", binaryDirectory]);
+      await exec("sudo", ["install", "-o", "root", "-g", group, "-m", "0755", snapshot, binaryStage]);
+      binaryStaged = true;
+      const checksumResult = await exec("sudo", [checksumCommandName, ...checksumArgs, binaryStage]);
+      if (!checksumMatches(checksumResult.stdout, release.sha256)) fail("daemon_install_digest_invalid");
+      await exec("sudo", ["mv", "-n", binaryStage, binary]);
+      binaryStaged = false;
+      const finalResult = await exec("sudo", [checksumCommandName, ...checksumArgs, binary]);
+      if (!checksumMatches(finalResult.stdout, release.sha256)) fail("daemon_install_existing_payload_mismatch");
+    }
+    await exec("sudo", ["install", "-o", "root", "-g", group, "-m", "0644", definitionFile, definitionStage]);
+    definitionStaged = true;
+    await exec("sudo", ["mv", "-f", definitionStage, destination]);
+    definitionStaged = false;
+    if (platform === "darwin") {
+      try { await exec("sudo", ["launchctl", "bootout", "system/com.botbuddy.daemon"]); }
+      catch (error) { if (!expectedBootoutAbsent(error)) throw error; }
+      await exec("sudo", ["launchctl", "bootstrap", "system", destination]);
+    } else {
+      await exec("sudo", ["systemctl", "daemon-reload"]);
+      await exec("sudo", ["systemctl", "enable", "botbuddy-daemon.service"]);
+      await exec("sudo", ["systemctl", "restart", "botbuddy-daemon.service"]);
+    }
+    return { outcome: "installed", destination, binary, service_user: user };
+  } finally {
+    if (binaryStaged) await exec("sudo", ["rm", "-f", binaryStage]).catch(() => {});
+    if (definitionStaged) await exec("sudo", ["rm", "-f", definitionStage]).catch(() => {});
+    await remove(tempDirectory, { recursive: true, force: true });
+  }
+}
+
+export async function serviceStatus({ platform, host, exec = execFile } = {}) {
+  if (!destinations[platform]) fail("daemon_status_invalid");
+  if (host !== undefined) assertSshHost(host);
+  try {
+    const command = platform === "darwin" ? "launchctl" : "systemctl";
+    const args = platform === "darwin"
+      ? ["print", "system/com.botbuddy.daemon"]
+      : ["show", "--property=LoadState", "--property=ActiveState", "botbuddy-daemon.service"];
+    const result = host ? await exec("ssh", [...sshOptions, host, command, ...args]) : await exec(command, args);
+    const output = String(result?.stdout ?? "");
+    if (platform === "darwin") {
+      const state = /^\s*state\s*=\s*(.+?)\s*$/m.exec(output)?.[1];
+      if (!state) fail("daemon_status_unreadable");
+      return { outcome: "status", platform, loaded: true, active: state === "running" };
+    }
+    const load = /^LoadState=(.+)$/m.exec(output)?.[1];
+    const active = /^ActiveState=(.+)$/m.exec(output)?.[1];
+    if (!load || !active) fail("daemon_status_unreadable");
+    if (load === "not-found") return { outcome: "status", platform, loaded: false, active: false };
+    if (load !== "loaded") fail("daemon_status_unexpected_load_state");
+    return { outcome: "status", platform, loaded: true, active: active === "active" };
+  } catch (error) {
+    if (platform === "darwin" && /Could not find service/.test(String(error?.stderr ?? error?.message ?? ""))) return { outcome: "status", platform, loaded: false, active: false };
+    throw error;
+  }
+}