@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/npm-update-tool-launcher.mjs

@@ -0,0 +1,287 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Literal original tool invocations enter a qualified worker before application code loads. */
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolve, sep } from "node:path";
+import { invokedAsScript } from "./invoked-as-script.mjs";
+import { lstatSync, realpathSync } from "node:fs";
+import { required, keys } from "./npm-update-contract.mjs";
+import { readJson, runProcess } from "./npm-update-process.mjs";
+import {
+  controllerRoute,
+  currentGraph,
+  controllerGraph,
+} from "./npm-update-orchestrator.mjs";
+import { executeWorker, binaryDigest } from "./npm-update-isolation.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { validateGhProfile } from "./npm-update-gh-dispatch.mjs";
+
+const TOOLS = new Set([
+  "node",
+  "npm",
+  "bun",
+  "ruby",
+  "bundle",
+  "shell",
+  "bash",
+  "gh",
+  "gitleaks",
+]);
+
+/** Loading flags introduce a second interpreter authority and require separate qualification. */
+export function literalArguments(args) {
+  required(
+    Array.isArray(args) &&
+      args.length <= 512 &&
+      args.every(
+        arg =>
+          typeof arg === "string" &&
+          !arg.includes("\0") &&
+          Buffer.byteLength(arg) <= 65_536
+      ) &&
+      Buffer.byteLength(JSON.stringify(args)) <= 262_144,
+    "invalid or unbounded tool argument"
+  );
+}
+
+/** npm's qualified CLI is launched by the qualified Node interpreter, never a host npm alias. */
+export function toolInvocation(runtime, tool, args) {
+  required(TOOLS.has(tool), "unsupported tool dispatch");
+  literalArguments(args);
+  if (tool === "node")
+    required(
+      !args.some(arg =>
+        /^(?:-r|--require|--import|--(?:experimental-)?loader)(?:=|$)/.test(arg)
+      ),
+      "unqualified interpreter loader route"
+    );
+  const selected = runtime.tools[tool];
+  required(
+    selected &&
+      typeof selected.path === "string" &&
+      selected.path.startsWith("/"),
+    "qualified tool is unavailable"
+  );
+  return tool === "npm"
+    ? { command: runtime.tools.node.path, args: [selected.path, ...args] }
+    : { command: selected.path, args: [...args] };
+}
+
+/** Caller-only private context is never mounted into candidate namespaces. */
+export function launcherContext(file) {
+  const value = readJson(file, 1_048_576);
+  keys(value, [
+    "version",
+    "root",
+    "cwd",
+    "runtime",
+    "boundary",
+    "graph",
+    "controller",
+    ...([2, 3].includes(value.version) ? ["routes"] : []),
+    ...(value.version === 3 ? ["provider"] : []),
+  ]);
+  required(
+    [1, 2, 3].includes(value.version) &&
+      typeof value.root === "string" &&
+      resolve(file) === resolve(value.root, "launcher.json") &&
+      typeof value.cwd === "string" &&
+      value.cwd.startsWith("/"),
+    "invalid controller launcher context"
+  );
+  if (value.version === 3 && value.provider !== null)
+    validateGhProfile(value.provider);
+  const root = lstatSync(value.root);
+  required(
+    root.isDirectory() &&
+      !root.isSymbolicLink() &&
+      realpathSync(value.root) === value.root &&
+      root.uid === process.getuid() &&
+      (root.mode & 0o077) === 0,
+    "launcher context parent is not private controller storage"
+  );
+  required(
+    value.graph &&
+      typeof value.graph === "object" &&
+      !Array.isArray(value.graph) &&
+      Object.keys(value.graph).length <= 128,
+    "unbounded trusted import graph"
+  );
+  controllerGraph(value.graph, value.routes);
+  return value;
+}
+
+/** The first trusted Node entry needs the same qualified instrumentation as nested entries. */
+function controllerInvocation(context, tool, args, env) {
+  if (tool !== "node") return { args, env };
+  const file = resolve(context.root, "launcher.json");
+  required(
+    canonicalJson(launcherContext(file)) === canonicalJson(context),
+    "controller context bytes differ"
+  );
+  const adapter = fileURLToPath(
+    new URL("./npm-update-execution-adapter.mjs", import.meta.url)
+  );
+  required(
+    Object.hasOwn(context.graph, adapter),
+    "trusted graph is missing the execution adapter"
+  );
+  required(
+    !env.NODE_OPTIONS && !env.NODE_PATH,
+    "unqualified controller environment loader"
+  );
+  return {
+    args: ["--import", pathToFileURL(adapter).href, ...args],
+    env: { ...env, LISA_NPM_DISPATCH_CONTEXT: file },
+  };
+}
+
+/** Caller constraints narrow execution only; copied exit statuses cannot change after dispatch starts. */
+function executionContract(value) {
+  if (value === undefined)
+    return {
+      allowed: Array.from({ length: 256 }, (_, code) => code),
+      timeout: 1_800_000,
+      maximum: 8_388_608,
+    };
+  required(
+    value && typeof value === "object" && !Array.isArray(value),
+    "invalid execution contract object"
+  );
+  keys(value, [
+    "allowed",
+    "timeout",
+    "maximum",
+    ...(value.signal !== undefined ? ["signal"] : []),
+  ]);
+  required(
+    value.signal === undefined || value.signal instanceof AbortSignal,
+    "invalid controller cancellation signal"
+  );
+  const allowed = Array.isArray(value.allowed) ? [...value.allowed] : [];
+  required(
+    allowed.length > 0 &&
+      allowed.length <= 256 &&
+      new Set(allowed).size === allowed.length &&
+      allowed.every(
+        code => Number.isSafeInteger(code) && code >= 0 && code <= 255
+      ),
+    "invalid execution contract exit statuses"
+  );
+  required(
+    Number.isSafeInteger(value.timeout) &&
+      value.timeout > 0 &&
+      value.timeout <= 1_800_000 &&
+      Number.isSafeInteger(value.maximum) &&
+      value.maximum > 0 &&
+      value.maximum <= 8_388_608,
+    "invalid execution contract deadline or output bound"
+  );
+  return {
+    allowed,
+    timeout: value.timeout,
+    maximum: value.maximum,
+    ...(value.signal !== undefined ? { signal: value.signal } : {}),
+  };
+}
+
+/**
+ * Full argv/stdin cross only the chosen boundary; worker output is captured privately by the caller.
+ * @param {{allowed: number[], timeout: number, maximum: number}} [execution] Optional controller-only constraints.
+ */
+export async function dispatchTool(
+  context,
+  tool,
+  args,
+  input,
+  env,
+  cwd = context.cwd,
+  execution = undefined
+) {
+  const contract = executionContract(execution);
+  const actualCwd = realpathSync(cwd);
+  const workspace = realpathSync(context.cwd);
+  required(
+    actualCwd === workspace || actualCwd.startsWith(`${workspace}${sep}`),
+    "tool working directory escapes its qualified workspace"
+  );
+  const invocation = toolInvocation(context.runtime, tool, args);
+  const route = controllerRoute(
+    tool,
+    args,
+    context.graph,
+    currentGraph(controllerGraph(context.graph, context.routes)),
+    actualCwd,
+    context.routes,
+    env
+  );
+  if (route === "controller") {
+    const identity = context.controller[tool];
+    keys(identity, ["path", "version", "sha256"]);
+    required(
+      typeof identity.path === "string" &&
+        identity.path.startsWith("/") &&
+        typeof identity.sha256 === "string" &&
+        /^[a-f0-9]{64}$/.test(identity.sha256) &&
+        binaryDigest(identity.path) === identity.sha256,
+      "qualified controller interpreter is unavailable or changed"
+    );
+    const original = controllerInvocation(context, tool, args, env);
+    return runProcess(identity.path, original.args, {
+      cwd: actualCwd,
+      env: original.env,
+      input,
+      ...contract,
+    });
+  }
+  required(
+    execution === undefined,
+    "scoped execution contract is unsupported on worker routes"
+  );
+  required(
+    context.boundary.workspace === workspace,
+    "unmatched candidate workspace mapping"
+  );
+  return executeWorker({ ...context.boundary, cwd: actualCwd }, invocation, {
+    input,
+    env,
+  });
+}
+
+/** No diagnostic or container plumbing status substitutes for the actual dispatched tool exit. */
+async function main() {
+  const args = process.argv.slice(2);
+  required(
+    args.length >= 5 &&
+      args[0] === "--context" &&
+      args[2] === "--tool" &&
+      args[4] === "--",
+    "usage: launcher --context FILE --tool TOOL -- ARGV"
+  );
+  const context = launcherContext(args[1]);
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    required(size <= 4_194_304, "tool stdin exceeds bound");
+    chunks.push(chunk);
+  }
+  const result = await dispatchTool(
+    context,
+    args[3],
+    args.slice(5),
+    Buffer.concat(chunks),
+    process.env,
+    process.cwd()
+  );
+  process.stdout.write(result.stdout);
+  process.stderr.write(result.stderr);
+  process.exitCode = result.code;
+}
+
+if (invokedAsScript(import.meta.url))
+  main().catch(error => {
+    process.stderr.write(`npm tool dispatch: ${error.message}\n`);
+    process.exitCode = 1;
+  });

package/all/copy-overwrite/scripts/lib/npm-update-worker-environment.mjs

@@ -0,0 +1,161 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Closed guest environment carries only fixed runtime and narrowly scoped workload data. @module npm-updater */
+import { required } from "./npm-update-contract.mjs";
+
+const RUBY_INSTALL = "ruby-install";
+const PROVIDER_TRANSPORT = new Set([
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "ALL_PROXY",
+  "all_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "CURL_CA_BUNDLE",
+  "SSLKEYLOGFILE",
+  "GH_DEBUG",
+  "GH_HTTP_UNIX_SOCKET",
+  "GH_CONFIG_DIR",
+  "GH_FORCE_TTY",
+  "GIT_SSL_CAINFO",
+  "GIT_PROXY_COMMAND",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+]);
+
+/** Both credentialed and token-free callers reject the same native transport overrides. */
+export function isProviderTransport(name) {
+  return PROVIDER_TRANSPORT.has(name) || name.startsWith("DYLD_");
+}
+
+const ENVIRONMENT = new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "TZ",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "NODE_VERSION",
+  "NPM_CONFIG_USERCONFIG",
+  "NPM_CONFIG_GLOBALCONFIG",
+  "NPM_CONFIG_CACHE",
+  "NPM_CONFIG_REGISTRY",
+  "NPM_CONFIG_IGNORE_SCRIPTS",
+  "NPM_CONFIG_AUDIT",
+  "NPM_CONFIG_FUND",
+  "NPM_CONFIG_UPDATE_NOTIFIER",
+  "GIT_TERMINAL_PROMPT",
+  "RAILS_ENV",
+  "DATABASE_USER",
+  "DATABASE_PASSWORD",
+  "DATABASE_NAME",
+  "DATABASE_PORT",
+  "PRIMARY_DB_HOST",
+  "DATABASE_REPLICA_HOST",
+  "HOSTNAME",
+  "RUBY_VERSION",
+  "RUBY_DOWNLOAD_URL",
+  "RUBY_DOWNLOAD_SHA256",
+  "GEM_HOME",
+  "BUNDLE_SILENCE_ROOT_WARNING",
+  "BUNDLE_APP_CONFIG",
+  "BUNDLE_PATH",
+  "BUNDLE_FROZEN",
+]);
+
+/** Installer identity is confined to an isolated dependency-only namespace. */
+export function isInstallerRole(role) {
+  return role === "install" || role === RUBY_INSTALL;
+}
+
+/** Candidate inspection rejects provider credentials and controller identity channels. */
+export function inspectedEnvironment(values) {
+  required(
+    Array.isArray(values) && values.length <= ENVIRONMENT.size,
+    "worker environment is unbounded"
+  );
+  const names = values.map(value => {
+    required(
+      typeof value === "string" && value.includes("="),
+      "invalid worker environment value"
+    );
+    return value.slice(0, value.indexOf("="));
+  });
+  required(
+    names.every(name => ENVIRONMENT.has(name)) &&
+      new Set(names).size === names.length,
+    "worker contains ambient or duplicated authority environment"
+  );
+}
+
+/** Sealed and installer Ruby projections use the same fixed frozen dependency path. */
+export function assertRubyEnvironment(environment, boundary) {
+  const ruby =
+    boundary.role === RUBY_INSTALL ||
+    boundary.mounts?.some(
+      mount =>
+        mount.source === `${boundary.root}/ruby-dependencies` &&
+        mount.target === `${boundary.workspace}/vendor/bundle` &&
+        mount.readOnly === true
+    );
+  if (ruby)
+    required(
+      environment.BUNDLE_PATH === `${boundary.workspace}/vendor/bundle` &&
+        environment.BUNDLE_FROZEN === "true" &&
+        environment.BUNDLE_APP_CONFIG === "/home/candidate/bundle",
+      "Ruby dependency environment requires its fixed path and frozen config"
+    );
+}
+
+/** Private runtime settings never inherit Actions, controller, issuer or registry channels. */
+export function workerEnvironment(source, boundary) {
+  const value = {
+    PATH: "/opt/node/bin:/usr/local/bin:/usr/bin:/bin",
+    HOME: "/home/candidate",
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    TZ: "UTC",
+    TMPDIR: "/tmp",
+    NPM_CONFIG_USERCONFIG: "/home/candidate/npmrc",
+    NPM_CONFIG_GLOBALCONFIG: "/home/candidate/global-npmrc",
+    NPM_CONFIG_CACHE: "/home/candidate/npm-cache",
+    NPM_CONFIG_REGISTRY: "https://registry.npmjs.org/",
+    NPM_CONFIG_AUDIT: "false",
+    NPM_CONFIG_FUND: "false",
+    NPM_CONFIG_UPDATE_NOTIFIER: "false",
+    GIT_TERMINAL_PROMPT: "0",
+  };
+  if (!isInstallerRole(boundary?.role)) {
+    for (const name of [
+      "RAILS_ENV",
+      "DATABASE_USER",
+      "DATABASE_PASSWORD",
+      "DATABASE_NAME",
+      "DATABASE_PORT",
+      "PRIMARY_DB_HOST",
+      "DATABASE_REPLICA_HOST",
+    ])
+      if (typeof source?.[name] === "string") value[name] = source[name];
+  }
+  if (
+    boundary?.role === RUBY_INSTALL ||
+    boundary?.mounts?.some(
+      mount =>
+        mount.source === `${boundary.root}/ruby-dependencies` &&
+        mount.target === `${boundary.workspace}/vendor/bundle` &&
+        mount.readOnly === true
+    )
+  ) {
+    value.BUNDLE_PATH = `${boundary.workspace}/vendor/bundle`;
+    value.BUNDLE_FROZEN = "true";
+    value.BUNDLE_APP_CONFIG = "/home/candidate/bundle";
+  }
+  return value;
+}

package/all/copy-overwrite/scripts/lib/npm-update-worker-inspection.mjs

@@ -0,0 +1,142 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Effective daemon observations must match all parent-selected namespace controls. @module npm-updater */
+import { required } from "./npm-update-contract.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { workerScratch } from "./npm-update-worker-policy.mjs";
+import {
+  inspectedEnvironment,
+  isInstallerRole,
+  assertRubyEnvironment,
+} from "./npm-update-worker-environment.mjs";
+
+/** Daemon inspection records the effective profile JSON rather than its caller filename. */
+function inspectedSecurity(host, expected) {
+  required(
+    Array.isArray(host.SecurityOpt) &&
+      host.SecurityOpt.length === 2 &&
+      host.SecurityOpt[0] === "no-new-privileges" &&
+      host.SecurityOpt[1].startsWith("seccomp="),
+    "worker security options differ"
+  );
+  const profile = JSON.parse(host.SecurityOpt[1].slice(8));
+  required(
+    sha256(`${canonicalJson(profile)}\n`) === expected.seccompSha256,
+    "worker effective kernel policy bytes differ"
+  );
+  required(
+    host.PidsLimit === 512 &&
+      host.Memory === 4_294_967_296 &&
+      host.NanoCpus === 4_000_000_000,
+    "worker resource limits differ"
+  );
+  required(
+    [host.GroupAdd, host.ExtraHosts, host.Links, host.VolumesFrom].every(
+      value => !value?.length
+    ),
+    "worker has supplementary or linked authority"
+  );
+  required(
+    Array.isArray(host.ReadonlyPaths) &&
+      [
+        "/proc/bus",
+        "/proc/fs",
+        "/proc/irq",
+        "/proc/sys",
+        "/proc/sysrq-trigger",
+      ].every(path => host.ReadonlyPaths.includes(path)),
+    "worker proc policy is not read-only"
+  );
+  required(
+    canonicalJson(host.Tmpfs) === canonicalJson(workerScratch(expected)),
+    "worker scratch mounts differ"
+  );
+}
+
+/** Every observed bind belongs to the exact parent-selected projection. */
+function inspectedMounts(inspected, expected) {
+  required(
+    Array.isArray(inspected.Mounts) &&
+      inspected.Mounts.length === expected.mounts.length,
+    "worker has missing or extra mounts"
+  );
+  for (const mount of expected.mounts) {
+    const matches = inspected.Mounts.filter(
+      actual => actual.Destination === mount.target
+    );
+    required(
+      matches.length === 1 &&
+        matches[0].Type === "bind" &&
+        matches[0].Source === mount.source &&
+        matches[0].RW === !mount.readOnly,
+      "worker input/control mount differs"
+    );
+  }
+}
+
+/** An actual inspected namespace must match every parent-selected mount and kernel flag. */
+export function assertWorkerInspection(inspected, expected, invocation) {
+  const user = isInstallerRole(expected.role)
+    ? `${expected.uid}:${expected.gid}`
+    : "2001:2001";
+  required(
+    /^[a-f0-9]{64}$/.test(inspected.Id) &&
+      inspected.Image === expected.image &&
+      inspected.Config?.User === user &&
+      inspected.Config?.Labels?.["dev.lisa.npm.owner"] === expected.nonce,
+    "worker ownership/image/user differs"
+  );
+  const host = inspected.HostConfig;
+  required(
+    host &&
+      host.ReadonlyRootfs === true &&
+      host.Privileged === false &&
+      host.PidMode === "" &&
+      host.IpcMode === "private" &&
+      canonicalJson(host.CapDrop) === '["ALL"]' &&
+      !host.CapAdd?.length,
+    "worker namespace or capabilities differ"
+  );
+  inspectedSecurity(host, expected);
+  required(
+    canonicalJson(inspected.Config.Entrypoint) ===
+      canonicalJson([expected.supervisor.path]) &&
+      inspected.Config.Cmd?.[0] === String(expected.deadlineMs) &&
+      inspected.Config.Cmd?.[1] === "--",
+    "worker protected supervisor invocation differs"
+  );
+  if (invocation)
+    required(
+      canonicalJson(inspected.Config.Cmd.slice(2)) ===
+        canonicalJson([invocation.command, ...invocation.args]),
+      "worker original argv differs"
+    );
+  required(
+    host.NetworkMode === expected.network &&
+      expected.network !== "host" &&
+      !host.Binds?.length &&
+      !host.Devices?.length &&
+      !host.DeviceRequests?.length,
+    "worker has foreign network/device/bind authority"
+  );
+  inspectedEnvironment(inspected.Config.Env);
+  assertRubyEnvironment(
+    Object.fromEntries(
+      inspected.Config.Env.map(value => [
+        value.slice(0, value.indexOf("=")),
+        value.slice(value.indexOf("=") + 1),
+      ])
+    ),
+    expected
+  );
+  if (isInstallerRole(expected.role))
+    required(
+      inspected.Config.Env.every(
+        value => !/^(?:GH_TOKEN|GITHUB_|DATABASE_)/.test(value)
+      ),
+      "installer contains provider or application credentials"
+    );
+  inspectedMounts(inspected, expected);
+}