@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/npm-update-worker-lifecycle.mjs

@@ -0,0 +1,256 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Parent registry and real daemon exit/removal own every worker lifecycle verdict. @module npm-updater */
+import { required, UpdaterError } from "./npm-update-contract.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { readBytes, runProcess } from "./npm-update-process.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import {
+  constants,
+  openSync,
+  closeSync,
+  readSync,
+  fstatSync,
+  lstatSync,
+  realpathSync,
+} from "node:fs";
+import { createHash } from "node:crypto";
+import {
+  registerNamespace,
+  assignNamespaceId,
+  namespaceRecords,
+  completeNamespace,
+} from "./npm-update-orchestrator.mjs";
+import { workerArguments } from "./npm-update-worker-policy.mjs";
+import { workerEnvironment } from "./npm-update-worker-environment.mjs";
+import { assertWorkerInspection } from "./npm-update-worker-inspection.mjs";
+
+/** Only the parent-qualified Docker executable can create or observe a candidate namespace. */
+export function dockerClient(boundary) {
+  const stat = lstatSync(boundary.docker);
+  required(
+    stat.isFile() &&
+      !stat.isSymbolicLink() &&
+      realpathSync(boundary.docker) === boundary.docker &&
+      /^[a-f0-9]{64}$/.test(boundary.dockerSha256) &&
+      binaryDigest(boundary.docker) === boundary.dockerSha256,
+    "Docker controller binary is unqualified"
+  );
+  const env = {
+    PATH: "/usr/bin:/bin",
+    HOME: process.env.HOME,
+    LANG: "C.UTF-8",
+  };
+  return (args, options = {}) =>
+    runProcess(boundary.docker, args, { env, maximum: 8_388_608, ...options });
+}
+
+/** Large native tools are hashed through a no-follow descriptor and a bounded streaming buffer. */
+export function binaryDigest(path) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    required(
+      stat.isFile() && stat.size > 0 && stat.size <= 150_000_000,
+      "controller binary exceeds bound"
+    );
+    const hash = createHash("sha256");
+    const buffer = Buffer.alloc(65_536);
+    let total = 0;
+    let count;
+    while ((count = readSync(fd, buffer, 0, buffer.length, null)) > 0) {
+      total += count;
+      required(total <= stat.size, "controller binary changed while hashing");
+      hash.update(buffer.subarray(0, count));
+    }
+    required(total === stat.size, "controller binary length changed");
+    return hash.digest("hex");
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Readback checks ownership before every lifecycle mutation; foreign IDs are never removed. */
+async function ownedInspection(docker, id, boundary) {
+  const result = await docker(["inspect", "--type", "container", id]);
+  const entries = JSON.parse(result.stdout.toString());
+  required(
+    Array.isArray(entries) &&
+      entries.length === 1 &&
+      entries[0].Id === id &&
+      entries[0].Image === boundary.image &&
+      entries[0].Config?.Labels?.["dev.lisa.npm.owner"] === boundary.nonce &&
+      (!boundary.name || entries[0].Name === `/${boundary.name}`),
+    "container ownership readback differs"
+  );
+  return entries[0];
+}
+
+/** Recovery never removes a foreign object or infers daemon absence from an inspect error. */
+async function reapRegistration(docker, entry) {
+  const { record } = entry;
+  let removedId = record.id;
+  const observed = await docker(
+    ["inspect", "--type", "container", record.id ?? record.name],
+    { allowed: [0, 1] }
+  );
+  if (observed.code === 0) {
+    const values = JSON.parse(observed.stdout.toString());
+    required(
+      Array.isArray(values) &&
+        values.length === 1 &&
+        /^[a-f0-9]{64}$/.test(values[0].Id),
+      "namespace recovery inspection differs"
+    );
+    const id = values[0].Id;
+    removedId = id;
+    required(
+      record.id === null || record.id === id,
+      "namespace recovery ID differs"
+    );
+    await ownedInspection(docker, id, { ...record, name: record.name });
+    if (record.id === null) assignNamespaceId(entry.file, id);
+    await docker(["rm", "--force", id]);
+  }
+  const absent = await docker([
+    "ps",
+    "--all",
+    "--quiet",
+    "--no-trunc",
+    "--filter",
+    `name=^/${record.name}$`,
+  ]);
+  required(
+    absent.stdout.toString().trim() === "",
+    "registered owned namespace still exists"
+  );
+  if (removedId) {
+    const byId = await docker([
+      "ps",
+      "--all",
+      "--quiet",
+      "--no-trunc",
+      "--filter",
+      `id=${removedId}`,
+    ]);
+    required(
+      byId.stdout.toString().trim() === "",
+      "registered owned namespace ID still exists"
+    );
+  }
+  required(
+    record.id !== null || observed.code === 0,
+    "unconfirmed namespace creation remains registered"
+  );
+  completeNamespace(entry.file, true);
+}
+
+/** The guest deadline never expands the existing outer process budget. */
+export function workerCaptureBudget(deadlineMs) {
+  required(
+    Number.isSafeInteger(deadlineMs) &&
+      deadlineMs > 0 &&
+      deadlineMs <= 1_800_000,
+    "invalid worker capture deadline"
+  );
+  return Math.min(deadlineMs + 6000, 1_800_000);
+}
+
+/** Dead-caller recovery covers created-but-unstarted objects before any new execution/sealing. */
+export async function recoverWorkers(boundary) {
+  const docker = dockerClient(boundary);
+  const entries = namespaceRecords(boundary.root);
+  for (const entry of entries) {
+    let alive = true;
+    try {
+      process.kill(entry.record.callerPid, 0);
+    } catch (error) {
+      required(
+        error.code === "ESRCH",
+        "registered caller visibility is unavailable"
+      );
+      alive = false;
+    }
+    required(!alive, "registered namespace belongs to a live caller");
+    await reapRegistration(docker, entry);
+  }
+  required(
+    namespaceRecords(boundary.root).length === 0,
+    "owned namespace recovery remains outstanding"
+  );
+}
+
+/** Daemon exit and whole-namespace removal decide the result, never a writable guest receipt. */
+export async function executeWorker(boundary, invocation, { input, env } = {}) {
+  const args = workerArguments(
+    boundary,
+    invocation,
+    workerEnvironment(env, boundary)
+  );
+  required(
+    sha256(
+      `${canonicalJson(JSON.parse(readBytes(boundary.seccompPath, 1_048_576).toString()))}\n`
+    ) === boundary.seccompSha256,
+    "worker seccomp input bytes differ"
+  );
+  const docker = dockerClient(boundary);
+  const registration = registerNamespace(boundary);
+  args.splice(1, 0, "--name", registration.record.name);
+  try {
+    const created = await docker(args);
+    const id = created.stdout.toString().trim();
+    required(/^[a-f0-9]{64}$/.test(id), "Docker returned an invalid worker ID");
+    assignNamespaceId(registration.file, id);
+    const ownedBoundary = { ...boundary, name: registration.record.name };
+    assertWorkerInspection(
+      await ownedInspection(docker, id, ownedBoundary),
+      boundary,
+      invocation
+    );
+    const attached = await docker(["start", "--attach", "--interactive", id], {
+      input,
+      timeout: workerCaptureBudget(boundary.deadlineMs),
+      allowed: Array.from({ length: 256 }, (_, code) => code),
+    });
+    const waited = (await docker(["wait", id])).stdout.toString().trim();
+    required(
+      /^(?:0|[1-9]\d{0,2})$/.test(waited) && Number(waited) <= 255,
+      "Docker returned an invalid actual worker exit"
+    );
+    const inspected = await ownedInspection(docker, id, ownedBoundary);
+    if (
+      !(
+        inspected.State?.Running === false &&
+        inspected.State?.ExitCode === Number(waited) &&
+        attached.code === Number(waited) &&
+        !inspected.State?.OOMKilled &&
+        !inspected.State?.Error
+      )
+    )
+      throw Object.assign(
+        new UpdaterError(
+          "worker actual status/attach differs or worker was killed"
+        ),
+        {
+          workerDiagnostic: {
+            attach: attached.code,
+            wait: Number(waited),
+            state: inspected.State,
+            stderr: attached.stderr.toString(),
+          },
+        }
+      );
+    return {
+      code: Number(waited),
+      stdout: attached.stdout,
+      stderr: attached.stderr,
+    };
+  } finally {
+    const active = namespaceRecords(boundary.root).find(
+      entry => entry.file === registration.file
+    );
+    required(active, "owned namespace registration disappeared");
+    await reapRegistration(docker, active);
+  }
+}

package/all/copy-overwrite/scripts/lib/npm-update-worker-policy.mjs

@@ -0,0 +1,266 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Closed worker roles, scratch and literal command data grant no controller authority. @module npm-updater */
+import { required, keys } from "./npm-update-contract.mjs";
+import { dirname, resolve } from "node:path";
+
+import {
+  inspectedEnvironment,
+  isInstallerRole,
+  assertRubyEnvironment,
+} from "./npm-update-worker-environment.mjs";
+export {
+  inspectedEnvironment,
+  isInstallerRole,
+  workerEnvironment,
+} from "./npm-update-worker-environment.mjs";
+
+export function workerScratch(boundary) {
+  const uid = boundary.uid ?? 2001;
+  const gid = boundary.gid ?? 2001;
+  return {
+    "/tmp": "rw,nosuid,nodev,size=536870912,mode=1777",
+    "/home/candidate": `rw,nosuid,nodev,size=536870912,uid=${uid},gid=${gid},mode=700`,
+    [`${boundary.workspace}/tmp`]: `rw,nosuid,nodev,size=536870912,uid=${uid},gid=${gid},mode=700`,
+  };
+}
+
+/** Only the fixed qualified protected parent accepts a bounded original deadline. */
+function supervisorIdentity(boundary) {
+  keys(boundary.supervisor, ["path", "version", "sha256"]);
+  required(
+    boundary.supervisor.path === "/usr/local/bin/lisa-npm-supervisor" &&
+      boundary.supervisor.version === "lisa-npm-supervisor 1" &&
+      /^[a-f0-9]{64}$/.test(boundary.supervisor.sha256) &&
+      /^[a-f0-9]{64}$/.test(boundary.seccompSha256) &&
+      Number.isSafeInteger(boundary.deadlineMs) &&
+      boundary.deadlineMs >= 1 &&
+      boundary.deadlineMs <= 1_800_000,
+    "unqualified supervisor or bounded deadline"
+  );
+}
+
+/** Closed inputs are validated before any Docker argument is constructed. */
+function validateBoundary(boundary, invocation) {
+  keys(boundary, [
+    "role",
+    "uid",
+    "gid",
+    "root",
+    "docker",
+    "dockerSha256",
+    "nonce",
+    "platform",
+    "image",
+    "network",
+    "seccompPath",
+    "seccompSha256",
+    "mounts",
+    "workspace",
+    "cwd",
+    "deadlineMs",
+    "supervisor",
+  ]);
+  supervisorIdentity(boundary);
+  required(
+    [
+      boundary.root,
+      boundary.workspace,
+      boundary.cwd,
+      boundary.seccompPath,
+    ].every(
+      path =>
+        typeof path === "string" &&
+        path.startsWith("/") &&
+        !/[\n\0,:]/.test(path) &&
+        !path.split("/").includes("..")
+    ) &&
+      (boundary.cwd === boundary.workspace ||
+        boundary.cwd.startsWith(`${boundary.workspace}/`)),
+    "invalid worker boundary path"
+  );
+  required(
+    (boundary.role === "gate" || isInstallerRole(boundary.role)) &&
+      [boundary.uid, boundary.gid].every(
+        value => Number.isSafeInteger(value) && value > 0 && value <= 65_535
+      ) &&
+      (isInstallerRole(boundary.role) ||
+        (boundary.uid === 2001 && boundary.gid === 2001)),
+    "invalid worker role or identity"
+  );
+  required(
+    typeof boundary.nonce === "string" &&
+      /^[a-f0-9]{48}$/.test(boundary.nonce) &&
+      /^sha256:[a-f0-9]{64}$/.test(boundary.image) &&
+      ["linux/arm64", "linux/amd64"].includes(boundary.platform),
+    "unqualified worker identity"
+  );
+  required(
+    boundary.network === "none" ||
+      boundary.network === `lisa-npm-${boundary.nonce}`,
+    "foreign worker network"
+  );
+  invocationIdentity(invocation);
+}
+
+/** A native entrypoint remains literal bounded data, never a Docker option. */
+function invocationIdentity(invocation) {
+  required(
+    typeof invocation.command === "string" &&
+      /^\/(?:[a-zA-Z0-9_.-]+\/)*[a-zA-Z0-9_.-]+$/.test(invocation.command) &&
+      Array.isArray(invocation.args),
+    "invalid real-tool entrypoint"
+  );
+  required(
+    invocation.args.length <= 512 &&
+      invocation.args.every(
+        value =>
+          typeof value === "string" &&
+          !value.includes("\0") &&
+          Buffer.byteLength(value) <= 65_536
+      ) &&
+      Buffer.byteLength(JSON.stringify(invocation.args)) <= 262_144,
+    "invalid or unbounded real-tool argument"
+  );
+}
+
+/** Fixed kernel options cannot be supplied by a candidate as flags. */
+function createArguments(boundary) {
+  return [
+    "create",
+    "--interactive",
+    "--platform",
+    boundary.platform,
+    "--read-only",
+    "--user",
+    `${boundary.uid}:${boundary.gid}`,
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--security-opt",
+    `seccomp=${boundary.seccompPath}`,
+    "--pids-limit",
+    "512",
+    "--memory",
+    "4g",
+    "--cpus",
+    "4",
+    "--ipc",
+    "private",
+    "--network",
+    boundary.network,
+    "--label",
+    `dev.lisa.npm.owner=${boundary.nonce}`,
+    "--workdir",
+    boundary.cwd,
+  ];
+}
+
+/** Installation owns exactly one dependency-only write mount. */
+function sourceProjection(boundary, mount) {
+  const source = mount.source;
+  required(
+    typeof source === "string" &&
+      resolve(source) === source &&
+      !/(?:^|\/)\.git(?:\/|$)|docker\.sock/.test(source),
+    "worker source mount is Git, socket or aliased projection"
+  );
+  const projections = [
+    boundary.workspace,
+    `${boundary.root}/source`,
+    `${dirname(boundary.root)}/source`,
+    `${dirname(boundary.root)}/workspace`,
+  ];
+  const sourceInput =
+    mount.readOnly &&
+    mount.target === boundary.workspace &&
+    projections.includes(source);
+  const dependency =
+    (source === `${boundary.root}/dependencies` &&
+      mount.target === `${boundary.workspace}/node_modules`) ||
+    (source === `${boundary.root}/ruby-dependencies` &&
+      mount.target === `${boundary.workspace}/vendor/bundle`);
+  required(
+    sourceInput || dependency,
+    "worker source mount exposes undeclared control or ancestor projection"
+  );
+  required(
+    source !== "/" &&
+      source !== boundary.root &&
+      !boundary.root.startsWith(`${source}/`),
+    "worker source mount exposes controller ancestor"
+  );
+}
+
+/** Every namespace binds only its fixed source and separate dependency cohorts. */
+function mountArguments(boundary, args) {
+  required(
+    Array.isArray(boundary.mounts) &&
+      boundary.mounts.length > 0 &&
+      boundary.mounts.length <= 8,
+    "invalid worker mounts"
+  );
+  for (const mount of boundary.mounts) {
+    keys(mount, ["source", "target", "readOnly"]);
+    sourceProjection(boundary, mount);
+    const dependencyWrite =
+      (boundary.role === "install" &&
+        mount.source === `${boundary.root}/dependencies` &&
+        mount.target === `${boundary.workspace}/node_modules`) ||
+      (boundary.role === "ruby-install" &&
+        mount.source === `${boundary.root}/ruby-dependencies` &&
+        mount.target === `${boundary.workspace}/vendor/bundle`);
+    required(
+      typeof mount.readOnly === "boolean" &&
+        (mount.readOnly || dependencyWrite) &&
+        [mount.source, mount.target].every(
+          path =>
+            typeof path === "string" &&
+            path.startsWith("/") &&
+            !/[\n\0,]/.test(path)
+        ) &&
+        !/docker\.sock|\/\.git(?:\/|$)/.test(mount.target) &&
+        !mount.target.startsWith(boundary.root) &&
+        mount.source !== boundary.root,
+      "worker mount exposes writable/control authority"
+    );
+    args.push(
+      "--mount",
+      `type=bind,src=${mount.source},dst=${mount.target}${mount.readOnly ? ",readonly" : ""}`
+    );
+  }
+}
+
+/** Parent-qualified literal command data follows the fixed protected entrypoint. */
+export function workerArguments(boundary, invocation, environment) {
+  validateBoundary(boundary, invocation);
+  const args = createArguments(boundary);
+  mountArguments(boundary, args);
+  for (const [path, policy] of Object.entries(workerScratch(boundary)))
+    args.push("--tmpfs", `${path}:${policy}`);
+  inspectedEnvironment(
+    Object.entries(environment).map(([name, value]) => `${name}=${value}`)
+  );
+  if (isInstallerRole(boundary.role))
+    required(
+      !Object.keys(environment).some(name =>
+        /^(?:GH_TOKEN|GITHUB_|DATABASE_)/.test(name)
+      ),
+      "installer contains provider or application credentials"
+    );
+  assertRubyEnvironment(environment, boundary);
+  for (const [name, value] of Object.entries(environment))
+    args.push("--env", `${name}=${value}`);
+  return [
+    ...args,
+    "--entrypoint",
+    boundary.supervisor.path,
+    boundary.image,
+    String(boundary.deadlineMs),
+    "--",
+    invocation.command,
+    ...invocation.args,
+  ];
+}