@crvouga/dev-fleet 0.5.0 → 0.6.0

package/src/secrets.ts

@@ -12,10 +12,13 @@ export const SECRET_NAMES = [
   'monitoring-tunnel-token',
   'proxy-tunnel-token',
 ] as const;
-/** Secrets only a feature the fleet declares needs: a Vault location may
- * leave them out, and they are then unavailable.
+/** Secrets a fleet may leave undeclared. A Vault fleet that names no location
+ * for the GitHub token keeps it where dev-fleet always read it (see
+ * `vaultLocation`); the others are needed only by a feature the fleet
+ * declares, and are otherwise unavailable.
  */
 export const OPTIONAL_SECRET_NAMES = [
+  'github-token',
   // The off-machine storage of the monitoring hub's backups
   // (services.monitoring.backups).
   'monitoring-backup-access-key',
@@ -52,16 +55,53 @@ export type SecretCommand = (
 ) => Promise<string | null>;
 
 /** One read of one secret for this node. Null when it is not available; the
- * value is never logged, printed or placed in argv.
+ * value is never logged, printed or placed in argv. `node` names a node's own
+ * copy of a secret that is kept once per node (`secretVariant`).
  */
-export type SecretsProvider = (name: SecretName) => Promise<string | null>;
+export type SecretsProvider = (
+  name: SecretName,
+  node?: string
+) => Promise<string | null>;
 
 const present = (value: string | null | undefined): string | null =>
   value?.trim() ? value.trim() : null;
 
 /** `proxy-client-key` is read from `DEVFLEET_SECRET_PROXY_CLIENT_KEY`. */
-export const envName = (name: SecretName): string =>
-  `DEVFLEET_SECRET_${name.toUpperCase().replaceAll('-', '_')}`;
+export const envName = (name: SecretName, node?: string): string =>
+  `DEVFLEET_SECRET_${secretVariant(name, node).toUpperCase().replaceAll('-', '_')}`;
+
+/** The name of a node's own copy of a secret: `github-token` of `worker-one`
+ * is `github-token-worker-one` (`DEVFLEET_SECRET_GITHUB_TOKEN_WORKER_ONE`, the
+ * file or sops key `github-token-worker-one`, the Vault field `FIELD_WORKER_ONE`).
+ */
+export const secretVariant = (name: SecretName, node?: string): string =>
+  node ? `${name}-${node}` : name;
+
+/** Where a Vault fleet keeps a secret. The GitHub token was always read from
+ * the field `GITHUB_TOKEN` beside the proxy client key; a fleet that names no
+ * location of its own keeps it there.
+ */
+export function vaultLocation(
+  config: Extract<SecretsConfig, { provider: 'vault' }>,
+  name: SecretName,
+  node?: string
+): VaultLocation | null {
+  const location =
+    config.locations[name as keyof typeof config.locations] ??
+    (name === 'github-token'
+      ? {
+          path: config.locations['proxy-client-key'].path,
+          field: 'GITHUB_TOKEN',
+        }
+      : null);
+  if (!location) return null;
+  return node
+    ? {
+        path: location.path,
+        field: `${location.field}_${node.toUpperCase().replaceAll('-', '_')}`,
+      }
+    : location;
+}
 
 export function secretsProvider(
   config: SecretsConfig,
@@ -74,29 +114,34 @@ export function secretsProvider(
   const env = options.env ?? process.env;
   const run = options.run ?? execute;
   if (config.provider === 'env')
-    return async (name) => present(env[envName(name)]);
+    return async (name, node) => present(env[envName(name, node)]);
   if (config.provider === 'file') {
     // One private file per secret, named after it.
     const directory =
       config.directory ??
       join(options.home ?? homedir(), '.config/dev-fleet/secrets');
-    return async (name) =>
-      present(await readFile(join(directory, name), 'utf8').catch(() => null));
+    return async (name, node) =>
+      present(
+        await readFile(
+          join(directory, secretVariant(name, node)),
+          'utf8'
+        ).catch(() => null)
+      );
   }
   if (config.provider === 'sops')
     // An age- (or KMS-) encrypted document with one top-level key per secret.
-    return async (name) =>
+    return async (name, node) =>
       present(
         await run([
           'sops',
           '--decrypt',
           '--extract',
-          `["${name}"]`,
+          `["${secretVariant(name, node)}"]`,
           config.file,
         ])
       );
-  return async (name) => {
-    const location = config.locations[name];
+  return async (name, node) => {
+    const location = vaultLocation(config, name, node);
     if (!location) return null;
     return present(
       await run([

package/src/service-auth.ts

@@ -1,4 +1,5 @@
 import { record } from './config';
+import { copilotCheck } from './github/copilot';
 import type { Check, CommandResult, Runner } from './types';
 
 interface Service {
@@ -48,8 +49,6 @@ export async function codingAuth(
 export const PROXY_ROUTED: Record<string, string> = {
   gemini:
     'gemini signs in through the CLI proxy and has no T3 launcher; provider:gemini:inference proves its route from this node.',
-  copilot:
-    'copilot is not routed through the CLI proxy and dev-fleet does not manage its GitHub sign-in; no provider account is checked.',
   opencode:
     'opencode signs in through the CLI proxy; agent:muse:session and the per-account agent:opencode sessions prove it from this node.',
 };
@@ -101,6 +100,7 @@ export async function serviceAuth(run: Runner): Promise<Check[]> {
   ];
   const checks: Check[] = [];
   for (const service of services) checks.push(await serviceCheck(service, run));
+  checks.push(await copilotCheck(run));
   for (const [id, reason] of Object.entries(PROXY_ROUTED))
     checks.push({
       id: `auth:${id}`,

package/src/worker-access-checks.ts

@@ -4,29 +4,79 @@ import { secretsProvider } from './secrets';
 import { registry } from './agents/registry';
 import { resolveVaultConfig, usesVault } from './vault-config';
 import { record } from './config';
+import { githubCredential } from './github/credential';
+import { hostId } from './topology';
+import { hostname } from 'node:os';
+import { githubSignInState } from './github/sync';
 
 /** Inject every subprocess; never put credentials in argv, reports, or logs. */
-export async function workerAccessChecks(run: Runner): Promise<Check[]> {
-  const policy = fleet.worker!;
-  const github = await run(['gh', 'api', 'user', '--jq', '.login']);
+export async function workerAccessChecks(
+  run: Runner,
+  nodeId?: string
+): Promise<Check[]> {
   return [
-    {
-      id: 'worker:github-principal',
-      status:
-        github.ok && github.stdout.trim() === policy.githubLogin
-          ? 'pass'
-          : 'fail',
-      summary:
-        'Worker GitHub authentication must match the declared common account.',
-      remedy: {
-        action:
-          'Authenticate this worker with the declared GitHub account. Credentials stay on their original machines.',
-      },
-    },
+    await githubSync(run, nodeId),
     await proxyAuthentication(run),
     ...(usesVault() ? [await vaultRenewalCheck(run)] : []),
   ];
 }
+
+const GITHUB_REMEDIES: Record<string, string> = {
+  GITHUB_TOKEN_MISSING:
+    'The secrets provider holds no GitHub token for this worker. Store it under github-token (github-token-<node> with github.credential "per-node"); the next sign-in job or fleet-sync signs the worker in.',
+  GITHUB_TOKEN_REJECTED:
+    'GitHub refuses the stored token: it was revoked or has expired. Store a new one under github-token; nothing about the secret store itself needs fixing.',
+  GITHUB_LOGIN_MISMATCH:
+    'The stored token belongs to another account than worker.githubLogin. Store the fleet login’s token, or correct worker.githubLogin in the fleet configuration.',
+  GITHUB_UNREACHABLE:
+    'GitHub did not answer from this worker. Check its network and DNS; the worker keeps the sign-in it has.',
+  GITHUB_SIGN_IN_FAILED:
+    'The stored token is valid but this worker has not adopted it. Inspect the job with: journalctl --user -u personal-worker-github.service, or run fleet-sync.',
+};
+
+/** GitHub sign-in is measured on its own, so a GitHub fault is never reported
+ * as a fault of the secret store's renewal, and the code names the system to
+ * fix.
+ */
+async function githubSync(run: Runner, nodeId?: string): Promise<Check> {
+  const login = fleet.worker?.githubLogin;
+  if (!login)
+    return {
+      id: 'worker:github-sync',
+      status: 'fail',
+      summary: 'GITHUB_LOGIN_UNDECLARED',
+      remedy: {
+        action: 'Declare the fleet GitHub login as worker.githubLogin.',
+      },
+    };
+  const code = await githubSignInState({
+    run,
+    login,
+    token: githubCredential(fleet, nodeId ?? hostId(hostname()), secrets(run)),
+  });
+  return code === 'GITHUB_OK'
+    ? {
+        id: 'worker:github-sync',
+        status: 'pass',
+        summary:
+          'Worker GitHub authentication matches the declared common account.',
+      }
+    : {
+        id: 'worker:github-sync',
+        status: 'fail',
+        summary: code,
+        remedy: { action: GITHUB_REMEDIES[code]! },
+      };
+}
+
+const secrets = (run: Runner) =>
+  secretsProvider(fleet.secrets, {
+    run: async (argv) => {
+      const result = await run(argv, { timeoutMs: 20_000 });
+      return result.ok ? result.stdout : null;
+    },
+  });
+
 /** Vault refuses a read the token's policy does not allow with a 403. */
 const PERMISSION_DENIED = /permission denied|Code: 403/i;
 

package/src/worker-readiness.ts

@@ -16,7 +16,7 @@ export async function workerReadiness(
   root = process.cwd()
 ): Promise<Check[]> {
   const host = await workerHostChecks(userInfo().username, run);
-  const access = await workerAccessChecks(run);
+  const access = await workerAccessChecks(run, nodeId);
   const revision = await run(['git', 'rev-parse', 'HEAD']);
   const singleton = await run(
     [