@deployfoundation/foundation-deploy 0.1.0

package/agent-image/bin/git-credential-sky

@@ -0,0 +1,89 @@
+#!/bin/sh
+# git credential helper for the ambient GitHub path (github-broker.ts).
+#
+# git invokes `git-credential-sky get` for https://github.com operations
+# (wired via /etc/gitconfig with `useHttpPath = true`, so the `get` request
+# on stdin carries protocol/host/path). We answer ONLY for host=github.com
+# over https — anything else gets no output, so the token can never be
+# handed to a look-alike host. On a match we fetch a short-lived,
+# repo-scoped GitHub App installation token from the in-container loopback
+# broker and emit it in git's credential protocol, marked `ephemeral=1`
+# (never stored) with `password_expiry_utc` so git >=2.34 discards it the
+# moment it expires. When no broker is running (channel without the github
+# connector), emit nothing and exit 0 — git falls through to anonymous
+# access, so public clones still work.
+#
+# Broker contract: GET http://127.0.0.1:7791/git-credential[?repo=<path>] ->
+#   line 1: bare installation token
+#   line 2: UNIX-epoch expiry seconds
+#
+# The `path` git sends (useHttpPath = true) is forwarded as `repo=`, so the
+# broker mints a token scoped to THAT repository instead of every repo the
+# channel can reach. The broker reads only the first two path segments and
+# refuses a repo the channel was not granted (HTTP 403).
+
+# Overridable ONLY so this helper can be tested against a stub broker on an
+# ephemeral port; production always uses the loopback default.
+# No GitHub on this instance (capability off, or no App secret). Refuse loudly
+# rather than emitting nothing, which git would silently retry anonymously.
+if [ "${FOUNDATION_GITHUB_DISABLED:-}" = "1" ]; then
+  echo "GitHub is not connected on this instance." >&2
+  exit 1
+fi
+
+BROKER_URL="${FOUNDATION_GH_BROKER_URL:-http://127.0.0.1:7791/git-credential}"
+
+[ "$1" = "get" ] || exit 0
+
+# Parse the credential request (key=value lines, blank-line terminated).
+host=""
+protocol=""
+path=""
+while IFS= read -r line; do
+  [ -n "$line" ] || break
+  case "$line" in
+    host=*) host="${line#host=}" ;;
+    protocol=*) protocol="${line#protocol=}" ;;
+    path=*) path="${line#path=}" ;;
+  esac
+done
+[ "$host" = "github.com" ] || exit 0
+[ "$protocol" = "https" ] || exit 0
+
+# Only a plain repo path is forwarded — anything with characters that would
+# need URL-escaping is dropped, which costs breadth (a channel-wide token)
+# but never sends a malformed scope.
+query=""
+case "$path" in
+  '' | *[!A-Za-z0-9._/-]*) ;;
+  *) query="?repo=$path" ;;
+esac
+
+response="$(curl -fsS --max-time 25 --retry 2 --retry-connrefused "$BROKER_URL$query" 2>/dev/null)"
+rc=$?
+# rc=7 (connection refused) = no broker: silent anonymous fallthrough is
+# correct (public clones on connector-less channels). ANY other failure is
+# a broker that exists but misbehaved: fail LOUDLY (git reports the helper
+# error) instead of degrading to anonymous and a misleading 404.
+if [ $rc -eq 7 ]; then exit 0; fi
+if [ $rc -ne 0 ]; then
+  # curl exit 22 = an HTTP error from the broker; the one that is NOT
+  # transient is 403 ("repository not granted"), i.e. this repo is not in the
+  # channel's grants — ask a human to grant it rather than retrying.
+  echo "git-credential-sky: broker error (curl exit $rc) — transient unless this repo is not in the instance's GitHub App installation" >&2
+  exit 1
+fi
+token="$(printf '%s\n' "$response" | head -n 1)"
+expiry="$(printf '%s\n' "$response" | sed -n '2p')"
+if [ -z "$token" ]; then
+  echo "git-credential-sky: broker returned an empty token — transient; retry shortly" >&2
+  exit 1
+fi
+printf 'username=x-access-token\npassword=%s\nephemeral=1\n' "$token"
+# Expiry only when the broker sent a well-formed epoch (defense in depth —
+# a malformed line 2 must not corrupt the credential answer).
+case "$expiry" in
+  '' | *[!0-9]*) ;;
+  *) printf 'password_expiry_utc=%s\n' "$expiry" ;;
+esac
+exit 0

package/agent-image/security-overlay.yml

@@ -0,0 +1,176 @@
+# Foundation fail-hard security overlay (omp-ref §3.4).
+#
+# Loaded via PI_CONFIG_FILES: unlike global/project config (silently moved to
+# .broken-* on parse failure), OVERLAY FILES FAIL HARD — a corrupt copy halts
+# the container instead of silently degrading the security posture.
+#
+# Arrays in omp settings REPLACE — ship complete lists only here or in the
+# per-session project config, never split across layers.
+tools:
+  approvalMode: yolo
+  # Global timeout ceiling in seconds — caps every resolved bash/eval timeout
+  # (defaults included). NOTE: omp treats `timeout: 0` ("no deadline") as
+  # bypassing this ceiling and Foundation ships no tool_call hook to rewrite it; the
+  # 15-minute AgentCore invocation limit is the effective backstop.
+  maxTimeout: 600
+  approval:
+    ast_edit: deny
+    browser: deny
+    computer: deny
+    debug: deny
+    goal: deny
+    grep: deny
+    hub: deny
+    init_experiment: deny
+    inspect_image: deny
+    # `learn` is NOT denied here: omp already gates it on `memory.backend`
+    # being on (tools/index.ts), and that value is written per session from
+    # `config.memory.ompBackend` (default `off`). A deny here would make the
+    # opt-in impossible to exercise. Every OTHER omp memory tool stays denied
+    # below, because each needs a backend Foundation will not run.
+    log_experiment: deny
+    # omp's remaining memory tools. `recall`/`retain`/`reflect` need the
+    # `hindsight` (remote HTTP server) or `mnemopi` (SQLite + embeddings)
+    # backend, and `memory_edit` needs `mnemopi`. Foundation runs neither — SQLite on
+    # the NFS-like S3 Files mount is a corruption risk and there is no
+    # Hindsight server — so these are denied outright rather than left to the
+    # backend gate. See docs/memory-backends.md.
+    memory_edit: deny
+    recall: deny
+    reflect: deny
+    retain: deny
+    run_experiment: deny
+    # `task: deny` was REMOVED 2026-09-01 when subagents were enabled (see
+    # ts/agent/src/tools/exec.ts TOOL_ALLOWLIST). A deny here would have left
+    # the tool activated-but-dead: deny wins in every approval mode.
+    todo: deny
+    update_notes: deny
+    web_search: deny
+bash:
+  # Deny rules hold even in yolo mode and match compound-command segments
+  # (omp docs/tools/bash.md). Ambient git credentials (github-broker.ts)
+  # make force-pushes POSSIBLE — these rules make the destructive ones
+  # refuse locally; GitHub branch protection is the server-side backstop.
+  patterns:
+    - pattern: "git push*--force*"
+      action: deny
+    - pattern: "git push*-f *"
+      action: deny
+    - pattern: "git push*--delete*"
+      action: deny
+    # HackerOne #3556799 class (cited by claude-code-action's push wrapper):
+    # --receive-pack/--exec run arbitrary commands server-side, ext:: remotes
+    # run arbitrary commands locally, and URL-form remotes push the repo to
+    # hosts outside the credential helper's github.com scope.
+    - pattern: "git push*--receive-pack*"
+      action: deny
+    - pattern: "git push*--exec*"
+      action: deny
+    - pattern: "*ext::*"
+      action: deny
+    - pattern: "git push http*"
+      action: deny
+    - pattern: "git push git@*"
+      action: deny
+    - pattern: "git push ssh:*"
+      action: deny
+    # NOTE: colon-refspec deletes (`git push origin :branch`) are NOT denied —
+    # a glob on `:` would also break legitimate `push HEAD:refs/heads/x`.
+    # GitHub branch protection covers the remainder.
+    # Foundation additions: local branch/repo destruction and direct pushes to the default branch.
+    - pattern: "git branch -D*"
+      action: deny
+    - pattern: "git branch --delete --force*"
+      action: deny
+    - pattern: "gh repo delete*"
+      action: deny
+    - pattern: "git push*origin main*"
+      action: deny
+    - pattern: "git push*origin master*"
+      action: deny
+    - pattern: "git push*HEAD:main*"
+      action: deny
+    - pattern: "git push*HEAD:master*"
+      action: deny
+    # Ambient AWS (aws-broker.ts). BELT AND BRACES ONLY: the real guard is
+    # IAM — every profile fetches credentials for a role carrying AWS's
+    # ReadOnlyAccess and nothing else, so a mutation is refused by the API
+    # whatever gets typed here. These patterns make the refusal LOCAL and
+    # legible instead of an AccessDenied the model has to interpret, and they
+    # cover the verbs whose blast radius is worst if IAM is ever loosened.
+    - pattern: "aws *delete*"
+      action: deny
+    - pattern: "aws *put*"
+      action: deny
+    - pattern: "aws *create*"
+      action: deny
+    - pattern: "aws *update*"
+      action: deny
+    - pattern: "aws *terminate*"
+      action: deny
+    - pattern: "aws *modify*"
+      action: deny
+    - pattern: "aws *attach*"
+      action: deny
+    - pattern: "aws *detach*"
+      action: deny
+    - pattern: "aws *run-instances*"
+      action: deny
+    # `start-query` and `stop-query` (Logs Insights) are how the log tools
+    # would be driven from bash, so the start/stop verbs are NOT denied
+    # wholesale. `aws logs put-*` is already covered by the `put` rule above.
+    - pattern: "aws *start-instances*"
+      action: deny
+    - pattern: "aws *stop-instances*"
+      action: deny
+# omp's native auto-learn: after a substantial turn the agent may distill what
+# it did into `<agentDir>/managed-skills/<name>/SKILL.md` — a path symlinked to
+# the persistent mount, so a learned skill survives the microVM. `autoContinue`
+# is off: learning must never extend a turn the human is waiting on. `learn`
+# (the other omp learning tool) is available only when an instance sets
+# `memory.ompBackend: local`, which is off by default.
+autolearn:
+  enabled: true
+  minToolCalls: 6
+  autoContinue: false
+task:
+  # Recursion ceiling (omp's own default, pinned explicitly). The child's TOOL
+  # LIST is NOT here — it comes from the materialized
+  # `<workspace>/.omp/agents/task.md` definition; this file carries the bounds
+  # that must survive a project-config write failure.
+  maxRecursionDepth: 2
+  isolation:
+    # Isolated subagents are OFF. An isolated child is the one child type omp
+    # constructs with BOTH extension preload lists cleared
+    # (task/isolation-runner.ts), so it would rebuild its tool set from ambient
+    # discovery. With mode "none" the `isolated` parameter is not offered on the
+    # task schema and any request for it throws at preflight, so such a child
+    # cannot exist.
+    mode: none
+# omp's default. `per-call` was pinned by the TS rewrite for "isolation
+# between calls" the microVM already provides, while omp's eval tool text
+# promises state persistence — see the matching setting in exec.ts.
+python:
+  kernelMode: session
+# The two capabilities that would otherwise AUTO-WIDEN an explicit tool list
+# with a tool this file denies — at the top level and in every subagent.
+astEdit:
+  # omp's default is TRUE, and it pushes the denied `ast_edit` into any explicit
+  # tool list containing `edit`. Off, not just denied.
+  enabled: false
+web_search:
+  enabled: false
+magicKeywords:
+  enabled: true
+  ultrathink: true
+  # Keep OMP's other built-in prompt modes off; this change is only for
+  # ultrathink. OMP 18.1.14 has no ultracode magic keyword or hook.
+  orchestrate: false
+  workflow: false
+# NOTE: `memory.backend` is deliberately ABSENT from this fail-hard overlay.
+# It is written per session into `<workspace>/.omp/config.yml` from
+# `config.memory.ompBackend`, so an instance can opt in without an image build.
+# This fails safe: omp's own schema default is `off`, so a project-config write
+# that never lands leaves omp's memory subsystem off.
+mcp:
+  enableProjectConfig: false

package/cdk.json

@@ -0,0 +1,6 @@
+{
+  "app": "bun run bin/app.ts",
+  "context": {
+    "@aws-cdk/core:validateAgainstDefaultRules": true
+  }
+}

package/dist/bin/app.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env bun
+import {
+  FoundationAgent,
+  FoundationApi,
+  FoundationCi,
+  FoundationData,
+  FoundationNetwork,
+  FoundationPipeline,
+  NewsletterStack
+} from "../chunk-4aye5cee.js";
+import {
+  adminsFor,
+  instanceNames,
+  loadInstanceFile
+} from "../chunk-9ddxyvq2.js";
+
+// bin/app.ts
+import { execFileSync } from "node:child_process";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+import * as cdk from "aws-cdk-lib";
+var app = new cdk.App;
+var instanceFilePath = app.node.tryGetContext("instanceFile");
+if (instanceFilePath === undefined || instanceFilePath === "")
+  throw new Error("-c instanceFile=<path> is required: the path to the deployment's instance YAML");
+var { instance, configPath } = loadInstanceFile(instanceFilePath);
+var names = instanceNames(instance);
+var env = {
+  account: process.env.CDK_DEFAULT_ACCOUNT,
+  region: process.env.CDK_DEFAULT_REGION ?? instance.aws.region
+};
+var admins = app.node.tryGetContext("admins") ?? adminsFor(configPath);
+var alarmEmail = app.node.tryGetContext("alarmEmail");
+var pipelineInstanceFile = app.node.tryGetContext("pipelineInstanceFile") ?? repoRelativePath(instanceFilePath);
+var network = new FoundationNetwork(app, names.network, { env, instance, configPath });
+var data = new FoundationData(app, names.data, { env, instance });
+var agent = new FoundationAgent(app, names.agent, {
+  env,
+  instance,
+  vpc: network.vpc,
+  egressSubnets: network.egressSubnets,
+  agentSecurityGroup: network.agentSecurityGroup,
+  mountTargetSecurityGroup: network.mountTargetSecurityGroup,
+  fileSystemId: data.fileSystem.getAtt("FileSystemId").toString(),
+  dataKey: data.dataKey,
+  bucket: data.bucket,
+  documentBucket: data.documentBucket,
+  table: data.table,
+  itemsTable: data.itemsTable,
+  ...data.crmTable === undefined ? {} : { crmTable: data.crmTable },
+  ...data.upworkApprovalTable === undefined ? {} : { upworkApprovalTable: data.upworkApprovalTable },
+  secrets: data.secrets
+});
+new FoundationCi(app, names.ci, { env, instance, bucket: data.bucket, dataKey: data.dataKey });
+if (instance.deploy.via === "codepipeline")
+  new FoundationPipeline(app, names.pipeline, {
+    env,
+    instance,
+    bucket: data.bucket,
+    dataKey: data.dataKey,
+    instanceFilePath: pipelineInstanceFile,
+    ...alarmEmail === undefined ? {} : { alarmEmail }
+  });
+var api = new FoundationApi(app, names.api, {
+  env,
+  instance,
+  configPath,
+  dataKey: data.dataKey,
+  table: data.table,
+  itemsTable: data.itemsTable,
+  ...data.crmTable === undefined ? {} : { crmTable: data.crmTable },
+  ...data.upworkApprovalTable === undefined ? {} : { upworkApprovalTable: data.upworkApprovalTable },
+  secrets: {
+    signing: data.secrets.signing,
+    slackApp: data.secrets.slackApp,
+    googleCalendar: data.secrets.googleCalendar,
+    googleOauth: data.secrets.googleOauth,
+    googleDrive: data.secrets.googleDrive,
+    googleEmail: data.secrets.googleEmail,
+    ...data.secrets.otterApi === undefined ? {} : { otterApi: data.secrets.otterApi },
+    ...data.secrets.knockOauthClient === undefined ? {} : { knockOauthClient: data.secrets.knockOauthClient },
+    ...data.secrets.knockCredential === undefined ? {} : { knockCredential: data.secrets.knockCredential },
+    ...data.secrets.upwork === undefined ? {} : { upwork: data.secrets.upwork }
+  },
+  agentRuntimeArn: agent.agentRuntimeArn,
+  admins,
+  alarmEmail
+});
+api.addStackDependency(agent);
+if (instance.newsletter.enabled)
+  new NewsletterStack(app, names.newsletter, {
+    env,
+    instance,
+    ...alarmEmail === undefined ? {} : { alarmEmail }
+  });
+cdk.Tags.of(app).add("project", instance.naming.secretPrefix);
+app.synth();
+function repoRelativePath(filePath) {
+  const absolute = resolve(filePath);
+  try {
+    const top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: dirname(absolute),
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    const rel = relative(top, absolute);
+    if (rel !== "" && !rel.startsWith(".."))
+      return rel.split(sep).join("/");
+  } catch {}
+  return basename(absolute);
+}
+export {
+  env
+};