@crvouga/dev-fleet 0.0.0-stage → 0.2.0

package/src/config.ts

@@ -0,0 +1,186 @@
+import { readFile } from 'node:fs/promises';
+import type { Capability, FleetConfig, FleetNode } from './types';
+import { FleetUsageError } from './errors';
+
+export const CAPABILITIES: Capability[] = [
+  'github',
+  'vault',
+  't3',
+  'vscode',
+  'toolchain',
+  'codex',
+  'claude',
+  'services',
+  'workstation',
+  'worker',
+];
+export const DEFAULT_CONFIG = '.fleet.local.json';
+
+export function record(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function fields(value: Record<string, unknown>, allowed: string[]): void {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) {
+    throw new FleetUsageError(
+      'Unknown configuration field. Run fleet-nodes --schema.'
+    );
+  }
+}
+
+function absolutePath(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.startsWith('/') &&
+    value.length <= 4096 &&
+    !/[\x00-\x1f\x7f]/.test(value)
+  );
+}
+
+function parseNode(value: unknown): FleetNode {
+  if (!record(value)) throw new FleetUsageError('Each node must be an object.');
+  fields(value, [
+    'id',
+    'ssh',
+    'workspace',
+    'runtime',
+    'required',
+    'tailscaleId',
+    't3EnvironmentId',
+    'bootstrapViaSsh',
+  ]);
+  if (
+    value['t3EnvironmentId'] !== undefined &&
+    (typeof value['t3EnvironmentId'] !== 'string' ||
+      !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(
+        value['t3EnvironmentId']
+      ))
+  )
+    throw new FleetUsageError('Invalid enrolled T3 environment identity.');
+  const names = nodeNames(value);
+  if (!absolutePath(value['workspace']))
+    throw new FleetUsageError('workspace must be an absolute POSIX path.');
+  if (value['runtime'] !== undefined && !absolutePath(value['runtime'])) {
+    throw new FleetUsageError(
+      'runtime must be an absolute POSIX path to Node or Bun.'
+    );
+  }
+  return {
+    ...names,
+    ...enrollmentOptions(value),
+    ...(typeof value['t3EnvironmentId'] === 'string'
+      ? { t3EnvironmentId: value['t3EnvironmentId'] }
+      : {}),
+    workspace: value['workspace'],
+    ...(typeof value['runtime'] === 'string'
+      ? { runtime: value['runtime'] }
+      : {}),
+    required: requiredCapabilities(value['required']),
+  };
+}
+
+function enrollmentOptions(
+  value: Record<string, unknown>
+): Pick<FleetNode, 'tailscaleId' | 'bootstrapViaSsh'> {
+  if (
+    value['bootstrapViaSsh'] !== undefined &&
+    typeof value['bootstrapViaSsh'] !== 'boolean'
+  )
+    throw new FleetUsageError(
+      'bootstrapViaSsh must explicitly authorize an existing trusted SSH bootstrap route.'
+    );
+  if (
+    value['tailscaleId'] !== undefined &&
+    (typeof value['tailscaleId'] !== 'string' ||
+      !/^[a-zA-Z0-9:_-]{1,128}$/.test(value['tailscaleId']))
+  )
+    throw new FleetUsageError(
+      'tailscaleId must be the explicitly enrolled stable Tailscale device ID.'
+    );
+  return {
+    ...(value['bootstrapViaSsh'] === true ? { bootstrapViaSsh: true } : {}),
+    ...(typeof value['tailscaleId'] === 'string'
+      ? { tailscaleId: value['tailscaleId'] }
+      : {}),
+  };
+}
+
+function nodeNames(
+  value: Record<string, unknown>
+): Pick<FleetNode, 'id' | 'ssh'> {
+  if (
+    typeof value['id'] !== 'string' ||
+    !/^[a-z][a-z0-9-]{0,62}$/.test(value['id'])
+  ) {
+    throw new FleetUsageError(
+      'Node IDs must be lowercase names (1–63 characters).'
+    );
+  }
+  if (
+    typeof value['ssh'] !== 'string' ||
+    !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value['ssh'])
+  ) {
+    throw new FleetUsageError(
+      'ssh must be a plain SSH alias or hostname, not options or user@host.'
+    );
+  }
+  return { id: value['id'], ssh: value['ssh'] };
+}
+
+function requiredCapabilities(value: unknown): Capability[] {
+  const required =
+    value === undefined ? ['github', 'vault', 't3', 'toolchain'] : value;
+  if (
+    !Array.isArray(required) ||
+    required.some((item) => !CAPABILITIES.includes(item as Capability))
+  ) {
+    throw new FleetUsageError(
+      'required must contain only capability names from fleet-nodes --schema.'
+    );
+  }
+  if (new Set(required).size !== required.length)
+    throw new FleetUsageError('required capabilities must be unique.');
+  return required as Capability[];
+}
+
+export function parseConfig(value: unknown): FleetConfig {
+  if (!record(value))
+    throw new FleetUsageError('Fleet configuration must be an object.');
+  fields(value, ['$schema', 'version', 'nodes']);
+  if (value['$schema'] !== undefined && typeof value['$schema'] !== 'string')
+    throw new FleetUsageError('$schema must be a string.');
+  if (value['version'] !== 1 || !Array.isArray(value['nodes'])) {
+    throw new FleetUsageError('Expected version 1 and a nodes array.');
+  }
+  if (value['nodes'].length < 1 || value['nodes'].length > 64) {
+    throw new FleetUsageError('Configure between 1 and 64 developer nodes.');
+  }
+  const nodes = value['nodes'].map(parseNode);
+  if (new Set(nodes.map((node) => node.id)).size !== nodes.length) {
+    throw new FleetUsageError('Node IDs must be unique.');
+  }
+  return { version: 1, nodes };
+}
+
+export async function loadConfig(path: string): Promise<FleetConfig> {
+  let value: unknown;
+  try {
+    value = JSON.parse(await readFile(path, 'utf8'));
+  } catch {
+    throw new FleetUsageError(
+      'Cannot read fleet config. Run devfleet fleet-node-add or use --config PATH.'
+    );
+  }
+  return parseConfig(value);
+}
+
+export function selectNodes(config: FleetConfig, ids: string[]): FleetNode[] {
+  if (ids.some((id) => !config.nodes.some((node) => node.id === id))) {
+    throw new FleetUsageError(
+      'Unknown node selection. Run fleet-nodes --json.'
+    );
+  }
+  return ids.length === 0
+    ? config.nodes
+    : config.nodes.filter((node) => ids.includes(node.id));
+}

package/src/configure.ts

@@ -0,0 +1,255 @@
+import { join } from 'node:path';
+import { mkdir, writeFile, rename, readFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { record } from './config';
+import type { Check, Runner } from './types';
+
+export type ConfigurationRequest = {
+  revision: string;
+  tool: string;
+  profile: string;
+  node: string;
+};
+
+export function validConfiguration(
+  value: unknown
+): value is ConfigurationRequest {
+  return (
+    record(value) &&
+    typeof value['revision'] === 'string' &&
+    /^[a-f0-9]{40}$/.test(value['revision']) &&
+    ['codex', 'claude', 'opencode', 'gemini', 'grok', 'antigravity'].includes(
+      String(value['tool'])
+    ) &&
+    ['direct', 'proxy'].includes(String(value['profile'])) &&
+    typeof value['node'] === 'string' &&
+    /^[a-z0-9][a-z0-9-]{0,62}$/.test(value['node'])
+  );
+}
+
+/** A pinned deployment worktree leaves the developer's branch and dirty files intact. */
+export async function configureWorkspace(
+  root: string,
+  request: ConfigurationRequest,
+  run: Runner,
+  options: { additionalTools: string[]; bootstrappedDeployment: boolean } = {
+    additionalTools: [],
+    bootstrappedDeployment: false,
+  }
+): Promise<Check[]> {
+  if (
+    options.additionalTools.some(
+      (tool) => !validConfiguration({ ...request, tool })
+    )
+  )
+    return failure('Invalid additional profile.');
+  if (!validConfiguration(request))
+    return failure('Invalid reviewed revision or configuration selection.');
+  const directory = deploymentDirectory(
+    root,
+    request.revision,
+    options.bootstrappedDeployment
+  );
+  const head = await run(
+    ['git', 'rev-parse', '--verify', `${request.revision}^{commit}`],
+    { cwd: root }
+  );
+  if (!head.ok || head.stdout.trim() !== request.revision)
+    return failure(
+      'Reviewed commit is unavailable locally. Fetch it explicitly and retry.'
+    );
+  const prepared = await prepareRevision(
+    root,
+    directory,
+    request.revision,
+    run
+  );
+  if (prepared.length) return prepared;
+  if (!options.bootstrappedDeployment) {
+    const setup = await setupRevision(directory, run);
+    if (setup.length) return setup;
+  }
+  const checks: Check[] = [];
+  for (const tool of [request.tool, ...options.additionalTools]) {
+    checks.push(
+      ...(await applyProfile(root, directory, { ...request, tool }, run))
+    );
+  }
+  return checks;
+}
+async function setupRevision(directory: string, run: Runner): Promise<Check[]> {
+  const setup = await run(
+    [
+      'mise',
+      'exec',
+      '--locked',
+      'bun',
+      '--',
+      'bun',
+      'bootstrap/setup.ts',
+      '--non-interactive',
+    ],
+    { cwd: directory, timeoutMs: 1_200_000 }
+  );
+  if (!setup.ok)
+    return failure(
+      'Existing setup owner failed. Partial tool/dependency installation is possible; no configuration receipt was advanced.'
+    );
+  return [];
+}
+
+async function applyProfile(
+  root: string,
+  directory: string,
+  request: ConfigurationRequest,
+  run: Runner
+): Promise<Check[]> {
+  const applied = await applyOwner(directory, request, run);
+  if (!applied.ok)
+    return failure(
+      'Agent profile configuration failed. Inspect preview on this node; no rollout receipt was advanced.'
+    );
+  const receipt = decodeReceipt(applied.stdout, request.revision);
+  if (!receipt)
+    return failure(
+      'The agent profile owner returned an invalid receipt; rollout remains unverified.'
+    );
+  await recordConfiguration(root, request, receipt);
+  return [
+    {
+      id: 'configuration:apply',
+      status: 'pass',
+      summary: `agent profile applied at revision ${request.revision}; configuration fingerprint ${receipt}. Authentication and T3 end-to-end remain separate gates.`,
+    },
+  ];
+}
+
+export function decodeReceipt(output: string, revision: string): string | null {
+  try {
+    const data: unknown = JSON.parse(output);
+    return record(data) &&
+      data['ok'] === true &&
+      data['revision'] === revision &&
+      typeof data['fingerprint'] === 'string' &&
+      /^[a-f0-9]{64}$/.test(data['fingerprint'])
+      ? data['fingerprint']
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function failure(summary: string): Check[] {
+  return [{ id: 'configuration:apply', status: 'fail', summary }];
+}
+
+async function prepareRevision(
+  root: string,
+  directory: string,
+  revision: string,
+  run: Runner
+): Promise<Check[]> {
+  if (root === directory) return verifyRevision(directory, revision, run);
+  await mkdir(join(root, 'node_modules', '.fleet-revisions'), {
+    recursive: true,
+  });
+  let deployed = await run(['git', 'rev-parse', 'HEAD'], { cwd: directory });
+  if (!deployed.ok) {
+    const created = await run(
+      ['git', 'worktree', 'add', '--detach', directory, revision],
+      { cwd: root, timeoutMs: 30_000 }
+    );
+    if (!created.ok)
+      return failure(
+        'Cannot create pinned deployment worktree. Existing data was preserved.'
+      );
+    deployed = await run(['git', 'rev-parse', 'HEAD'], { cwd: directory });
+  }
+  return verifyRevision(directory, revision, run);
+}
+async function verifyRevision(
+  directory: string,
+  revision: string,
+  run: Runner
+): Promise<Check[]> {
+  const deployed = await run(['git', 'rev-parse', 'HEAD'], { cwd: directory });
+  const clean = await run(['git', 'status', '--porcelain'], { cwd: directory });
+  if (
+    !deployed.ok ||
+    deployed.stdout.trim() !== revision ||
+    !clean.ok ||
+    clean.stdout.trim()
+  )
+    return failure(
+      'Pinned deployment checkout differs or is dirty. Inspect it; fleet never resets it.'
+    );
+  const top = await run(['git', 'rev-parse', '--show-toplevel'], {
+    cwd: directory,
+  });
+  if (!top.ok || top.stdout.trim() !== directory)
+    return failure('Deployment path is not its own Git worktree.');
+  return [];
+}
+
+async function recordConfiguration(
+  root: string,
+  request: ConfigurationRequest,
+  receipt: string
+): Promise<void> {
+  const receipts = join(root, 'node_modules', '.fleet-configuration');
+  await mkdir(receipts, { recursive: true, mode: 0o700 });
+  const path = join(
+    receipts,
+    `${request.node}-${request.tool}-${request.profile}.json`
+  );
+  const contents =
+    JSON.stringify({ version: 1, ...request, fingerprint: receipt }) + '\n';
+  try {
+    if ((await readFile(path, 'utf8')) === contents) return;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  const temp = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temp, contents, { flag: 'wx', mode: 0o600 });
+  await rename(temp, path);
+}
+
+async function applyOwner(
+  directory: string,
+  request: ConfigurationRequest,
+  run: Runner
+) {
+  return run(
+    [
+      'mise',
+      'exec',
+      '--locked',
+      'bun',
+      '--',
+      'bun',
+      'src/agents/cli.ts',
+      '--json',
+      '--yes',
+      '--non-interactive',
+      'agents',
+      'apply',
+      '--node',
+      request.node,
+      '--tool',
+      request.tool,
+      '--profile',
+      request.profile,
+    ],
+    { cwd: directory, timeoutMs: 120_000 }
+  );
+}
+
+function deploymentDirectory(
+  root: string,
+  revision: string,
+  bootstrapped: boolean
+): string {
+  return bootstrapped
+    ? root
+    : join(root, 'node_modules', '.fleet-revisions', revision);
+}