@edgehero/pi-dispatch 2.0.0 → 3.0.0

package/src/run-container.mjs

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { readFileSync, rmSync } from "node:fs";
 import { DOCKER_NEVER_STARTED_EXITS } from "./backends.mjs";
 import { CONTAINER_HOME } from "./container-spec.mjs";
@@ -61,14 +62,24 @@ export function makeRunContainer({
 	// `log` names a teardown the gate refused, which leaves the job's network for the boot reaper.
 	teardownRuntime = null,
 	log = () => {},
+	// Issue #545: the per-job exit-line key, 32 random bytes as hex. A seam so a test can name the key it verifies with.
+	mintExitKey = () => randomBytes(32).toString("hex"),
 }) {
 	// async so a synchronous throw (e.g. buildContainerEnv on an unconfigured provider) surfaces as
 	// a rejection, uniformly awaitable by the processor and by tests.
 	// `relabel` (issue #355) is the processor's, off the same job-user answer as `user`: true where the daemon confines
 	// containers with SELinux, so the worker's own per-job mounts carry `:Z`. Defaults off, so a caller that predates it
 	// builds exactly the argv it always did.
-	return async function runContainer({ job, token, prepared, secrets = {}, name, signal, user = null, home = null, relabel = false }) {
+	// `modelEndpoints` (issue #503) is the pickup's endpoint snapshot, the one the free credential gate decided on, so a
+	// keyless provider's PI_DISPATCH_KEYLESS is written from the same declaration and never from a second read.
+	// `exitAuth` (issue #545) is the processor's, off the image preflight: true when the job image declares `exitAuth`, so
+	// its runner reads a key from stdin and signs its exit line with it. Defaults off, so a caller that predates it, and
+	// every image that does not declare it, runs exactly as before and is read exactly as before.
+	return async function runContainer({ job, token, prepared, secrets = {}, name, signal, user = null, home = null, relabel = false, modelEndpoints = null, exitAuth = false }) {
 		if (signal?.aborted) return { code: 137, aborted: true, turns: null, tokens: null, session: null, usage: null, context: null, exitReason: null }; // killed before it could start
+		// Minted per attempt, held in this closure and the sink's, and handed to the container on its stdin only: never in
+		// the argv (a host `ps` shows it), never in the env (the container's /proc/1/environ shows it), never logged.
+		const exitKey = exitAuth === true ? mintExitKey() : null;
 		// Issue #341. `user` and `home` travel as a PAIR: a uid with no passwd entry in the image gets `HOME=/` from
 		// Docker and `HOME=/workspace` from Podman (measured), so a `--user` without this HOME is refused here rather
 		// than started. The builder does not insist, because `doctor --live`'s probes run `--user` with no environment.
@@ -87,6 +98,7 @@ export function makeRunContainer({
 			model: job.model,
 			maxTurns: job.maxTurns,
 			maxTokens: job.maxTokens, // optional per-job token budget (issue #25); undefined => runner meter only
+			maxCostMicros: job.maxCostMicros ?? null, // issue #501: effectiveJobOf's min of trigger and deployment; null => no cap
 			jobId: name,
 			githubToken: token ?? undefined,
 			// Which forge minted it, so the token lands in that forge's own variable names and no other.
@@ -121,12 +133,17 @@ export function makeRunContainer({
 			// non-empty validated array; the guard is the same defensive shape `flow` above wears, so a
 			// hand-built job with junk in the field emits no variable rather than an empty one.
 			excludeTools: Array.isArray(job.excludeTools) && job.excludeTools.length > 0 ? job.excludeTools : undefined,
+			// Issue #502: the effective allowed-model list, off `job` like excludeTools. index.mjs `effectiveJobOf` folds
+			// the deployment's PI_ALLOWED_MODELS in under the trigger's own, so `job.models` is already the one list.
+			allowedModels: Array.isArray(job.models) && job.models.length > 0 ? job.models : null,
 			authFromPi, // source the provider key from pi's auth.json when the env has none
 			// REQ-TRIGGER-SECRETS: this trigger's resolved secrets, fetched by the processor BEFORE anything
 			// spent. Off the call bag rather than off `job` or the closure: it is neither a per-job fact the
 			// record may carry nor a deployment setting, it is a live credential, and `token` is its precedent.
 			secrets,
 			home: user !== null ? home : null, // issue #341: HOME only beside --user, assigned after the forward loops
+			modelEndpoints, // issue #503: the keyless branch of the credential, from the gate's own snapshot
+			exitAuth: exitKey !== null, // issue #545: PI_EXIT_AUTH=stdin, only when a key is actually handed over below
 		});
 
 		// `-net` on this container's own name (egress.mjs). null when no policy is armed, and docker-run's
@@ -168,6 +185,9 @@ export function makeRunContainer({
 			// Both facts, the kind the preparers branch on AND containment in this job's own directory, so a kind added later
 			// that works on a folder in place fails closed rather than relabelling it.
 			workspaceOwned: job?.kind !== "local" && insideDir(prepared.jobDir, prepared.workspace),
+			// Issue #545: `-i`, so the container's stdin is the pipe the key is written to. Absent otherwise, and the argv is
+			// byte-identical to one built before the signed exit line.
+			...(exitKey !== null ? { extraFlags: ["-i"] } : {}),
 		});
 
 		// REQ-EGRESS-ALLOWLIST. This job's own --internal network, created here rather than at boot because
@@ -184,10 +204,17 @@ export function makeRunContainer({
 
 		// Host-side per-job log sink, teed off `onOutput`. `name` is `pi-job-<jobId>`; the sink
 		// sanitizes internally. No container mount, no env var -- the sink lives on this side only.
-		const sink = openJobLog(name);
+		const sink = openJobLog(name, { exitKey });
 
 		const run = new Promise((resolve, reject) => {
-			const child = spawnFn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+			const child = spawnFn(bin, args, { stdio: [exitKey !== null ? "pipe" : "ignore", "pipe", "pipe"] });
+			if (exitKey !== null) {
+				// Written and closed at once: the runner drains stdin to EOF before anything else runs, so the key is out of
+				// the pipe before any tool exists. A CLI that died first makes this EPIPE, which is the run failing, reported
+				// by `error` or `close` below; the listener only keeps the write's own error from crashing the worker.
+				child.stdin?.on("error", () => {});
+				child.stdin?.end(`${exitKey}\n`);
+			}
 			// A throwing sink.write is swallowed so a misbehaving sink cannot break the tee or hang the run.
 			const tee = (chunk) => {
 				onOutput(chunk);
@@ -216,12 +243,19 @@ export function makeRunContainer({
 				// RUNNER_POLICY_REASONS set and to a line that itself said code 2. The processor still decides
 				// the retry class from `code` alone; this only picks the label inside exit 2.
 				let exitReason = null;
+				// Issue #501 (PR #542's review, round 3): the LAST exit line's own `code`, which the dollar settlement
+				// compares with the container's real exit code before it trusts that line's cost.
+				let exitLineCode = null;
+				// Issue #507: the cost guard's rule on a `cost-cap` line, already filtered by parseExitWhy to COST_CAP_WHYS.
+				let exitWhy = null;
+				// Issue #545: null (no key issued), "verified" or "unverified" (a key, and no exit line carried it).
+				let exitAuthResult = null;
 				try {
 					// `context = null` is a DEFAULT rather than a plain destructure: an injected sink that
 					// predates the field returns no such key, and `undefined` would then reach the record's
 					// shape where every other absence is spelled `null`.
 					// `exitReason` defaults the same way, for the same reason.
-					({ turns, tokens, session, usage, context = null, exitReason = null } = await sink.close());
+					({ turns, tokens, session, usage, context = null, exitReason = null, exitLineCode = null, exitWhy = null, exitAuth: exitAuthResult = null } = await sink.close());
 				} catch {
 					turns = null;
 					tokens = null;
@@ -229,8 +263,28 @@ export function makeRunContainer({
 					usage = null;
 					context = null;
 					exitReason = null;
+					exitLineCode = null;
+					exitWhy = null;
+					// The sink could not say, and a key was issued: nothing it returned was verified.
+					exitAuthResult = exitKey !== null ? "unverified" : null;
+				}
+				// A sink that predates the field returned none; with a key issued, that is still nothing verified.
+				if (exitKey !== null && exitAuthResult !== "verified") {
+					exitAuthResult = "unverified";
+					turns = null;
+					tokens = null;
+					session = null;
+					usage = null;
+					context = null;
+					exitReason = null;
+					exitLineCode = null;
+					exitWhy = null;
 				}
-				resolve(aborted ? { code: code ?? 137, aborted: true, turns, tokens, session, usage, context, exitReason } : { code: code ?? 1, aborted: false, turns, tokens, session, usage, context, exitReason });
+				// Spread only when a key was issued, so a run without one resolves the very object it always did.
+				const auth = exitKey !== null ? { exitAuth: exitAuthResult } : {};
+				// `exitWhy` only when the line named one, so every other run resolves the object it always did.
+				const why = exitWhy !== null ? { exitWhy } : {};
+				resolve(aborted ? { code: code ?? 137, aborted: true, turns, tokens, session, usage, context, exitReason, exitLineCode, ...why, ...auth } : { code: code ?? 1, aborted: false, turns, tokens, session, usage, context, exitReason, exitLineCode, ...why, ...auth });
 			});
 		});