@crvouga/dev-fleet 0.1.0 → 0.2.0

package/src/t3-endpoint.ts

@@ -1,8 +1,15 @@
 import { discoverTailnet } from './tailscale';
 import type { Check, FleetNode, Runner } from './types';
 
+/** An origin no browser of the fleet uses: the private route must not let
+ * a page served from it read the worker's T3.
+ */
+export const FOREIGN_ORIGIN = 'https://origin-check.invalid';
+
 /** A fresh manager HTTPS request is transport evidence only. Never read
  * pairing material or treat HTTP health as an authenticated tool session.
+ * A second request, from a foreign origin, must not be granted cross-origin
+ * access.
  */
 export async function verifyT3Endpoint(
   node: FleetNode,
@@ -21,17 +28,66 @@ export async function verifyT3Endpoint(
     });
     await response.body?.cancel();
     if (response.status !== 200) return pending('T3_MANAGER_ENDPOINT_REJECTED');
-    return [
-      {
-        id: 't3:manager-endpoint',
-        status: 'pass',
-        summary:
-          'A fresh HTTPS request from the manager reached the enrolled private endpoint with valid TLS and HTTP 200. Pairing, server compatibility and tool execution remain unverified.',
-      },
-    ];
   } catch {
     return pending('T3_MANAGER_ENDPOINT_UNREACHABLE');
   }
+  return [
+    {
+      id: 't3:manager-endpoint',
+      status: 'pass',
+      summary:
+        'A fresh HTTPS request from the manager reached the enrolled private endpoint with valid TLS and HTTP 200. Pairing, server compatibility and tool execution remain unverified.',
+    },
+    await originCheck('https://' + peer.dns, request),
+  ];
+}
+
+/** Grants cross-origin reads: it echoes the foreign origin, or allows any
+ * origin together with credentials.
+ */
+function permissive(headers: Headers): boolean {
+  const allowed = headers.get('access-control-allow-origin')?.trim();
+  return (
+    allowed === FOREIGN_ORIGIN ||
+    (allowed === '*' &&
+      headers.get('access-control-allow-credentials')?.trim() === 'true')
+  );
+}
+
+async function originCheck(
+  url: string,
+  request: (url: string, options: RequestInit) => Promise<Response>
+): Promise<Check> {
+  const check = (status: Check['status'], summary: string): Check => ({
+    id: 't3:manager-origin',
+    status,
+    summary,
+    ...(status === 'pass'
+      ? {}
+      : {
+          remedy: {
+            action:
+              'The private T3 route must not grant cross-origin access to pages from other sites. Restore the stock T3 server and its private Serve route from source; never add a proxy that rewrites CORS headers.',
+          },
+        }),
+  });
+  try {
+    const response = await request(url, {
+      method: 'GET',
+      redirect: 'manual',
+      headers: { Origin: FOREIGN_ORIGIN },
+      signal: AbortSignal.timeout(10_000),
+    });
+    await response.body?.cancel();
+    return permissive(response.headers)
+      ? check('fail', 'T3_MANAGER_ORIGIN_UNRESTRICTED')
+      : check(
+          'pass',
+          'A request from a foreign origin was not granted cross-origin access to the private T3 route.'
+        );
+  } catch {
+    return check('warn', 'T3_MANAGER_ORIGIN_UNVERIFIED');
+  }
 }
 function pending(code: string): Check[] {
   return [

package/src/t3-linked-check.ts

@@ -22,7 +22,29 @@ export async function verifyT3Linked(
     )();
     check = await linkedOnce(node, run, now());
   }
-  return check;
+  return check.status === 'fail' ? explained(node, run, check) : check;
+}
+
+/** A worker enrolled with one T3 environment that now runs another lost
+ * its identity (a reset data directory, a reinstall): the old link cannot
+ * reach it, and a new pairing is the remedy, not a reconnect.
+ */
+async function explained(
+  node: FleetNode,
+  run: Runner,
+  check: Check
+): Promise<Check> {
+  if (!node.t3EnvironmentId) return check;
+  const observed = await observedIdentity(node, run).catch(() => undefined);
+  if (!observed || observed === node.t3EnvironmentId) return check;
+  return {
+    ...check,
+    summary: 'T3_ENVIRONMENT_IDENTITY_CHANGED',
+    remedy: {
+      action:
+        'This worker now runs a different T3 environment than the one enrolled in the roster, so the manager’s link cannot reach it. Find out why its T3 data was replaced before anything else; then pair the new environment through T3 Connections and enroll it again. Fleet never copies or rewrites a T3 identity.',
+    },
+  };
 }
 
 async function linkedOnce(

package/src/toolchain-checks.ts

@@ -41,6 +41,29 @@ export async function toolchainChecks(
   }
 }
 
+/** Checks of the doctor that are not a tool version, with their own words. */
+const OWN: Record<string, { pass: string; fail: string; action: string }> = {
+  'global-mise-config': {
+    pass: 'The global mise configuration is the one fleet-sync publishes.',
+    fail: 'The global mise configuration is missing, was replaced by another project or tool, or is not the one this revision publishes.',
+    action:
+      'Run devfleet fleet-sync from the project that holds fleet.json. On a fleet machine the global mise configuration belongs to dev-fleet: a project pins its own tools in a project mise.toml and never publishes a global one.',
+  },
+};
+
+/** A doctor check with its own words, or null for a tool version. */
+function ownCheck(id: string, status: Check['status']): Check | null {
+  if (!Object.hasOwn(OWN, id)) return null;
+  const own = OWN[id]!;
+  const ok = status === 'pass';
+  return {
+    id: `tool:${id}`,
+    status,
+    summary: ok ? own.pass : own.fail,
+    ...(!ok ? { remedy: { action: own.action } } : {}),
+  };
+}
+
 function toolCheck(value: unknown): Check | null {
   if (
     !record(value) ||
@@ -49,6 +72,8 @@ function toolCheck(value: unknown): Check | null {
     !['pass', 'fail', 'warn', 'skip'].includes(String(value['status']))
   )
     return null;
+  const own = ownCheck(value['id'], value['status'] as Check['status']);
+  if (own) return own;
   const ok = value['status'] === 'pass';
   const version =
     typeof value['detail'] === 'string' &&

package/src/types.ts

@@ -80,6 +80,10 @@ export interface CommandOptions {
   input?: string;
   timeoutMs?: number;
   env?: NodeJS.ProcessEnv;
+  /** Run with `env` alone instead of on top of this process's environment:
+   * for a launch that must see only what a service would.
+   */
+  isolatedEnv?: boolean;
 }
 
 export interface CommandResult {

package/src/worker-access-checks.ts

@@ -1,5 +1,6 @@
 import type { Check, Runner } from './types';
-import { fleet, secretVia } from './fleet-config';
+import { fleet } from './fleet-config';
+import { secretsProvider } from './secrets';
 import { registry } from './agents/registry';
 import { resolveVaultConfig, usesVault } from './vault-config';
 import { record } from './config';
@@ -26,7 +27,29 @@ export async function workerAccessChecks(run: Runner): Promise<Check[]> {
     ...(usesVault() ? [await vaultRenewalCheck(run)] : []),
   ];
 }
+/** Vault refuses a read the token's policy does not allow with a 403. */
+const PERMISSION_DENIED = /permission denied|Code: 403/i;
+
 async function proxyAuthentication(run: Runner): Promise<Check> {
+  // Read through the declared provider, remembering only whether Vault said
+  // the policy forbids it: never what it printed.
+  let denied = false;
+  const secret = secretsProvider(fleet.secrets, {
+    run: async (argv) => {
+      const result = await run(argv, { timeoutMs: 20_000 });
+      if (!result.ok && PERMISSION_DENIED.test(result.stderr)) denied = true;
+      return result.ok ? result.stdout : null;
+    },
+  });
+  const forbidden: Check = {
+    id: 'worker:proxy-authentication',
+    status: 'fail',
+    summary: 'VAULT_POLICY_PERMISSION_REQUIRED',
+    remedy: {
+      action:
+        'This worker’s Vault identity was refused the proxy client key by its policy. Grant that identity read access to the declared location in the Vault policy you manage. fleet-sync seeds no secret, writes no policy and adds no secret store.',
+    },
+  };
   const unavailable: Check = {
     id: 'worker:proxy-authentication',
     status: 'fail',
@@ -37,7 +60,8 @@ async function proxyAuthentication(run: Runner): Promise<Check> {
     },
   };
   try {
-    const key = (await secretVia(run)('proxy-client-key')) ?? '';
+    const key = (await secret('proxy-client-key')) ?? '';
+    if (denied) return forbidden;
     if (!/^[\x21-\x7e]{16,4096}$/.test(key)) return unavailable;
     const result = await run(
       [
@@ -103,13 +127,42 @@ async function vaultRenewalCheck(run: Runner): Promise<Check> {
       token['ttl'] <= 1200
     )
       return unavailable;
+    if (!(await lastRenewalSucceeded(run)))
+      return {
+        ...unavailable,
+        summary: 'VAULT_RENEWAL_FAILING',
+        remedy: {
+          action:
+            'The identity is renewable, but the last run of the renewal job failed. Inspect it on this worker with: journalctl --user -u personal-worker-auth.service. Its token expires unless a renewal succeeds; no credentials are copied between machines.',
+        },
+      };
     return {
       ...unavailable,
       status: 'pass',
       summary:
-        'This worker has a renewable periodic Vault identity with sufficient lifetime for the renewal timer.',
+        'This worker has a renewable periodic Vault identity with sufficient lifetime for the renewal timer, and its last renewal succeeded.',
     };
   } catch {
     return unavailable;
   }
 }
+
+/** An active timer is not evidence that renewal works: the result of the
+ * job's last run is. A job that has not run yet has nothing to say.
+ */
+async function lastRenewalSucceeded(run: Runner): Promise<boolean> {
+  const shown = await run([
+    'systemctl',
+    '--user',
+    'show',
+    'personal-worker-auth.service',
+    '--property=Result,ExecMainStatus',
+  ]);
+  if (!shown.ok) return true;
+  const result = /^Result=(.*)$/m.exec(shown.stdout)?.[1];
+  const status = /^ExecMainStatus=(.*)$/m.exec(shown.stdout)?.[1];
+  return (
+    (result === undefined || result === 'success') &&
+    (status === undefined || status === '0')
+  );
+}

package/src/worker-host-checks.ts

@@ -62,6 +62,11 @@ export async function workerHostChecks(
         'Exact declarative Ubuntu package version.'
       )
     ),
+    check(
+      'package:tailscale',
+      audit.packages['tailscale'] === policy.tailscale.version,
+      'Exact declarative Tailscale version.'
+    ),
   ];
   for (const name of policy.alwaysOnServices) {
     const unit = await run([

package/src/workstation-checks.ts

@@ -22,7 +22,7 @@ export async function workstationChecks(
           summary: 'The devfleet launcher is missing.',
           remedy: {
             action:
-              'Run fleet-sync from the manager, or sh bootstrap/install-launcher.sh in the dev-fleet checkout on this computer.',
+              'Run fleet-sync from the manager: it links the launcher to the checkout of the revision it applies.',
           },
         },
   ];

package/src/index.ts

@@ -1,6 +0,0 @@
-export { parseConfig, loadConfig, selectNodes } from './config';
-export { doctor } from './manager';
-export { probe } from './probe';
-export { makeReport, reportExitCode, renderReport } from './report';
-export { syncPlan, syncWorkspace } from './sync';
-export type * from './types';

package/src/test-fixtures.ts

@@ -1,36 +0,0 @@
-import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { CommandResult, Runner, FleetNode } from './types';
-
-export const HEAD = 'a'.repeat(40);
-export const NODE: FleetNode = {
-  id: 'dev-one',
-  ssh: 'dev-one',
-  workspace: '/home/dev/workspace',
-  required: [],
-};
-export const success = (stdout = ''): CommandResult => ({
-  ok: true,
-  stdout,
-  stderr: '',
-  reason: 'exit',
-});
-export const failure = (stderr = ''): CommandResult => ({
-  ok: false,
-  stdout: '',
-  stderr,
-  reason: 'exit',
-});
-export const gitRunner: Runner = async (command) =>
-  success(command.includes('rev-parse') ? HEAD : '');
-
-export async function workspace(): Promise<string> {
-  const root = await mkdtemp(join(tmpdir(), "fleet test's "));
-  for (const file of ['package.json', 'bun.lock', 'mise.toml', 'mise.lock'])
-    await writeFile(join(root, file), '{}');
-  await mkdir(join(root, 'packages/example'), { recursive: true });
-  await writeFile(join(root, 'packages/example/package.json'), '{}');
-  await mkdir(join(root, '.mise/locks'), { recursive: true });
-  return root;
-}