@edgehero/pi-dispatch 1.10.2 → 2.0.0

package/src/prepare-github.mjs

@@ -40,6 +40,7 @@
  * github-host.mjs's 404-vs-other split: only the determinate class becomes policy.
  */
 
+import { GIT_SAFE_CONFIG } from "./git-hardening.mjs";
 import { execFile } from "node:child_process";
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -52,13 +53,12 @@ import { InfraRetry } from "./processor.mjs";
 const exec = promisify(execFile);
 
 // The -c flags that make a clone/checkout run no repo-supplied code, applied to EVERY git invocation
-// through `hardened()` below so they cannot be omitted at a call site. Matches materialize.mjs's bar
-// (hooksPath, fsmonitor, --no-pager) plus the clone-specific transport/credential locks.
+// through `hardened()` below so they cannot be omitted at a call site. The shared bar comes from
+// git-hardening.mjs; the clone-specific transport/credential locks are this file's own, and they sit
+// BETWEEN the shared pairs and `--no-pager`, which is why that module exports the pairs separately from
+// the finished read prefix -- composing here must not reorder this argv.
 const HARDEN_FLAGS = [
-	"-c",
-	"core.hooksPath=/dev/null",
-	"-c",
-	"core.fsmonitor=false",
+	...GIT_SAFE_CONFIG,
 	"-c",
 	"protocol.ext.allow=never",
 	"-c",

package/src/prepare-local.mjs

@@ -1,8 +1,11 @@
+import { GIT_READ_FLAGS } from "./git-hardening.mjs";
 import { execFile } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import * as realFs from "node:fs";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { materializePiDir } from "./materialize.mjs";
+import { InfraRetry } from "./processor.mjs";
+import { isDeterminateFsCode } from "./transient.mjs";
 
 const exec = promisify(execFile);
 
@@ -24,25 +27,17 @@ const exec = promisify(execFile);
  * default keeps a directly-constructed call (tests, older wiring) honest: a job with no derived
  * context is a manual run.
  */
-export async function prepareLocalWorkspace({ folder, task, jobDir, git = defaultGit, event = { source: "manual" } }) {
-	if (!existsSync(folder)) {
-		const error = new Error(`local folder does not exist: ${folder}`);
-		error.piDispatchConfig = true;
-		throw error;
-	}
-	if (!existsSync(join(folder, ".git"))) {
-		const error = new Error(`local folder is not a git repository (v1 requires one): ${folder}`);
-		error.piDispatchConfig = true;
-		throw error;
-	}
+export async function prepareLocalWorkspace({ folder, task, jobDir, git = defaultGit, event = { source: "manual" }, fs = realFs }) {
+	requirePath(fs, folder, `local folder does not exist: ${folder}`, "the local folder");
+	requirePath(fs, join(folder, ".git"), `local folder is not a git repository (v1 requires one): ${folder}`, "the local folder's .git");
 
 	const sha = (await git(folder, ["rev-parse", "HEAD"])).trim();
 
-	mkdirSync(jobDir, { recursive: true });
+	fs.mkdirSync(jobDir, { recursive: true });
 	// The outbox is the container's only signal channel back to the worker (INT-OUTBOX-CONTRACT). It is
 	// mounted /outbox:rw for local jobs only; the host reads it after the run to enqueue chained children.
 	const outboxDir = join(jobDir, "outbox");
-	mkdirSync(outboxDir, { recursive: true });
+	fs.mkdirSync(outboxDir, { recursive: true });
 	// Instructions from HEAD, via the symlink-safe git materialiser, into /job/pi (mounted :ro).
 	const pi = await materializePiDir({ gitDir: folder, sha, destDir: jobDir });
 	// A .pi/ over a materialiser cap (issue #60) refuses the job determinately, before prompt.md and
@@ -52,7 +47,7 @@ export async function prepareLocalWorkspace({ folder, task, jobDir, git = defaul
 	const written = pi.written;
 
 	// The task the operator asked for. Plain data below the instructions.
-	writeFileSync(join(jobDir, "prompt.md"), String(task ?? ""), { mode: 0o444 });
+	fs.writeFileSync(join(jobDir, "prompt.md"), String(task ?? ""), { mode: 0o444 });
 
 	// The trigger context, /job/event.json (INT-CONTAINER-JOB-INPUTS): one file per concern, 0o444 like
 	// the prompt, written unconditionally so every local run carries its origin. `folder` is the BASENAME
@@ -66,14 +61,53 @@ export async function prepareLocalWorkspace({ folder, task, jobDir, git = defaul
 		sha,
 		...(event.source === "cron" ? { scheduledFor: event.scheduledFor ?? null, previousRunAt: event.previousRunAt ?? null } : {}),
 	};
-	writeFileSync(join(jobDir, "event.json"), JSON.stringify(eventBody, null, 2), { mode: 0o444 });
+	fs.writeFileSync(join(jobDir, "event.json"), JSON.stringify(eventBody, null, 2), { mode: 0o444 });
 
 	// The folder itself is /workspace (rw). No clone: local jobs edit in place.
 	return { workspace: folder, jobDir, outboxDir, sha, materialised: written };
 }
 
+/**
+ * Assert that something exists at `path`, distinguishing absence from a filesystem that is momentarily
+ * unable to answer (issue #316).
+ *
+ * `existsSync` was the wrong instrument and it was the only one here for a year: it returns FALSE for
+ * every stat error, not only `ENOENT`. So `EACCES` on a parent directory, `EIO` on a failing disk, and a
+ * hung or not-yet-mounted autofs/NFS path after a host reboot all reported "your folder does not exist".
+ * #310 turned that into a refund, a never-retried delivery and a public comment telling the issue author
+ * the operator's deployment is misconfigured, on a deployment that was correct a second earlier and is
+ * correct again a second later.
+ *
+ * `statSync` FOLLOWS symlinks and accepts a file as readily as a directory, both of which this needs:
+ * `.git` is a FILE in a worktree and in a submodule, and a symlinked project folder is ordinary.
+ */
+function requirePath(fs, path, absentMessage, what) {
+	try {
+		fs.statSync(path);
+	} catch (error) {
+		if (isDeterminateFsCode(error?.code)) {
+			const refusal = new Error(absentMessage);
+			refusal.piDispatchConfig = true;
+			throw refusal;
+		}
+		// Not absent, just unreachable right now. Throw the retryable class so the queue tries again
+		// instead of spending the delivery on a verdict that is wrong by the time it is posted.
+		// BASENAME, not the path (issue #289): an InfraRetry survives retries and its message becomes the
+		// queue's failedReason and the job_failed line -- a full host path there carries an OS account
+		// name, which is buildRecord's own reason for reducing folders to basenames. The config refusals
+		// above keep their full paths: they surface on CLI stderr and through the #310 classifier's fixed
+		// sentence, where the path is the repair.
+		throw new InfraRetry(`could not read ${what} (${error?.code ?? error?.message ?? "unknown"}): ${basename(path)}`);
+	}
+}
+
 async function defaultGit(gitDir, args) {
-	const { stdout } = await exec("git", ["-c", "core.hooksPath=/dev/null", "--no-pager", "-C", gitDir, ...args], {
+	// This was the one copy of seven missing `core.fsmonitor=false`, which is why the flags are imported
+	// now rather than restated (issue #286's sweep). Nothing was exploitable -- the only command below is
+	// `rev-parse HEAD`, which does not refresh the index -- but a local-folder job's agent can write
+	// `.git/config` inside /workspace, so the moment this grows a second command that touches the index,
+	// an attacker-controlled fsmonitor hook runs on the worker HOST, outside any container.
+	const { stdout } = await exec("git", [...GIT_READ_FLAGS, "-C", gitDir, ...args], {
 		encoding: "utf8",
 		maxBuffer: 16 * 1024 * 1024,
 	});

package/src/prepare.mjs

@@ -1,6 +1,8 @@
-import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { join } from "node:path";
+import { resolveBackendName } from "./backend-registry.mjs";
+import { ensureJobsDir } from "./config.mjs";
 import { resolveJobImage } from "./image-preflight.mjs";
 import { retainJobDir } from "./sandbox-store.mjs";
 import { prepareGithubWorkspace } from "./prepare-github.mjs";
@@ -42,6 +44,10 @@ export const TRIGGER_SKILLS_SUBDIR = "trigger-skills";
 export function makePrepareWorkspace({
 	jobsDir,
 	forgeFor,
+	// #277. The deployment's default venue, for the sandbox stamp: a retained directory records the venue the
+	// job resolved to through the SAME function the registry dispatches on, so the venue that ran and the
+	// venue a sandbox later checks are one answer. Null (a DI seam) stamps no venue, and the sandbox refuses.
+	defaultBackend = null,
 	// REQ-RESURRECTABLE-SANDBOX. The DEPLOYMENT default image, resolved per job against the trigger's own
 	// `run.image` through the SAME function the pre-spend preflight and run-container use -- so the tag that
 	// was checked, the tag that ran and the tag a sandbox later re-opens are one answer by construction
@@ -60,9 +66,14 @@ export function makePrepareWorkspace({
 	// an unwired dispatcher behaves exactly as it did: a job with no `run.skillsDir` never calls it.
 	injectSkills = copySkillTree,
 	log = () => {},
+	// Issue #464: creates the jobs dir and refuses one another account owns (config.mjs). Asked again before every job,
+	// not only here: a temp cleaner (systemd-tmpfiles ages /tmp) can remove an idle jobs dir, and a name under the temp
+	// dir that is gone is one any account can create next.
+	ensureDir = (dir) => ensureJobsDir(dir),
 }) {
-	mkdirSync(jobsDir, { recursive: true });
-	return async function prepareWorkspace(job, token, { queueJobId, piVersion = null } = {}) {
+	ensureDir(jobsDir);
+	return async function prepareWorkspace(job, token, { queueJobId, piVersion = null, jobUser = null, podmanStore = null } = {}) {
+		ensureDir(jobsDir);
 		const jobDir = mkdtempSync(join(jobsDir, "job-"));
 		// The trigger's injected skills (REQ-PER-TRIGGER-SKILLS, issue #60), COPIED here rather than
 		// mounted, and copied ONCE for every job kind because this is where local and forge converge.
@@ -85,9 +96,19 @@ export function makePrepareWorkspace({
 			log("trigger_skills_injected", { dirs: injected.dirs, files: injected.files, bytes: injected.bytes });
 		}
 		// What `cleanup` needs to retain this run's directory, stamped here because this is the only place
-		// that holds all three at once. Applied to the RESULT rather than mutated in, so a preparer's
+		// that holds all of it at once. Applied to the RESULT rather than mutated in, so a preparer's
 		// `{ outcome: "policy" }` refusal -- which carries no jobDir -- is passed through untouched.
-		const sandbox = { jobId: queueJobId ?? null, kind: job.kind ?? null, image: resolveJobImage(job, jobImage) };
+		const sandbox = {
+			jobId: queueJobId ?? null,
+			kind: job.kind ?? null,
+			image: resolveJobImage(job, jobImage),
+			backend: resolveBackendName(job, defaultBackend),
+			// Issue #341: WHO the job ran as, so a re-opened sandbox runs as the uid that owns these files. Only when the
+			// processor decided it; a direct call stamps nothing, and the sandbox then decides from its own facts.
+			...(jobUser ? { jobUser: { user: jobUser.user ?? null, home: jobUser.home ?? null } } : {}),
+			// Issue #429: the podman store the run's container lived in, for a podman run only.
+			...(typeof podmanStore === "string" && podmanStore !== "" ? { podmanStore } : {}),
+		};
 		if (job.kind === "local") {
 			// Harness text above, operator DATA below: the fixed pointer line names /job/event.json so a
 			// flow can discover the trigger context (mirroring the github prompt, which names the same
@@ -223,7 +244,7 @@ export function makeCleanup({ sandboxDir, retentionHours = 0, log = () => {} } =
 			await cleanup(prepared);
 			return;
 		}
-		retainJobDir(prepared, { sandboxDir, log });
+		retainJobDir(prepared, { sandboxDir, retentionHours, log });
 	};
 }