@event4u/agent-config 17.2.1 → 17.4.0

package/src/scripts/_lib/project_registry.ts

@@ -0,0 +1,227 @@
+/**
+ * The one user-global list of projects this machine has worked in (ADR-299).
+ *
+ * `runtime/projects/registry.json`, keyed by `<repo id>-<checkout>`
+ * (`code_graph/repo_identity`): two clones of one origin are one logical
+ * project but keep their own root, graph home and commit, so neither build
+ * overwrites the other's. A registry written before that, keyed by the bare
+ * repo id, still loads; the entry is re-keyed when its checkout next records.
+ * A project enters by use — a graph build or refresh, an advisories refresh, or
+ * an explicit `code-graph projects add` — never by a crawl. The file names
+ * client projects by absolute path, so nothing that leaves the machine may read
+ * it (step 6.3 enforces that).
+ *
+ * Writes are atomic (`write_atomic`), and read-modify-write goes through a
+ * short mkdir lock so two processes recording at once do not drop an entry.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { canonicalOrigin, projectsDir, remoteUrl, repoIdentity } from '../code_graph/repo_identity.js';
+import { git_common_dir } from './git_common_dir.js';
+import { write_atomic } from './fs_atomic.js';
+import type { EnvMap } from './user_global_paths.js';
+
+export const DEFAULT_BUDGET_MB = 2048;
+
+export interface ProjectEntry {
+    root: string;
+    /** The credential-free canonical origin, or null without a remote. */
+    remote: string | null;
+    fingerprint: string | null;
+    last_seen: string;
+    /** The graph home directory last used for this project. */
+    graph_home: string | null;
+    graph_commit: string | null;
+    languages: string[];
+    providers: string[];
+    pinned: boolean;
+    /** User-global graph homes of this project (main checkout and worktrees) → last query. */
+    homes: Record<string, string>;
+}
+
+export interface Registry {
+    schema: 1;
+    /** The estate index switch (council O1): off unless the owner turns it on. */
+    index: boolean;
+    budget_mb: number;
+    projects: Record<string, ProjectEntry>;
+}
+
+export interface RegistryOptions {
+    env?: EnvMap | null;
+    /** Overrides the projects directory (tests, advisories' injected machine dir). */
+    dir?: string;
+    now?: Date;
+}
+
+export function emptyRegistry(): Registry {
+    return { schema: 1, index: false, budget_mb: DEFAULT_BUDGET_MB, projects: {} };
+}
+
+export function registryDir(opts: RegistryOptions = {}): string {
+    return opts.dir ?? projectsDir(opts.env);
+}
+
+export function registryPath(env?: EnvMap | null, dir?: string): string {
+    return path.join(dir ?? projectsDir(env), 'registry.json');
+}
+
+function isEntry(v: unknown): v is ProjectEntry {
+    const e = v as Partial<ProjectEntry> | null;
+    return !!e && typeof e.root === 'string' && typeof e.last_seen === 'string';
+}
+
+/** A missing, corrupt or foreign file reads as empty, never as an error. */
+export function readRegistry(opts: RegistryOptions = {}): Registry {
+    let raw: unknown;
+    try {
+        raw = JSON.parse(fs.readFileSync(registryPath(opts.env, opts.dir), 'utf-8'));
+    } catch {
+        return emptyRegistry();
+    }
+    const r = raw as Partial<Registry> | null;
+    if (!r || typeof r !== 'object' || Array.isArray(r) || r.schema !== 1 || typeof r.projects !== 'object' || r.projects === null) {
+        return emptyRegistry();
+    }
+    const projects: Record<string, ProjectEntry> = {};
+    for (const [id, e] of Object.entries(r.projects)) {
+        if (!isEntry(e)) continue;
+        projects[id] = {
+            root: e.root,
+            remote: e.remote ?? null,
+            fingerprint: e.fingerprint ?? null,
+            last_seen: e.last_seen,
+            graph_home: e.graph_home ?? null,
+            graph_commit: e.graph_commit ?? null,
+            languages: Array.isArray(e.languages) ? e.languages : [],
+            providers: Array.isArray(e.providers) ? e.providers : [],
+            pinned: e.pinned === true,
+            homes: e.homes && typeof e.homes === 'object' ? e.homes : {},
+        };
+    }
+    return {
+        schema: 1,
+        index: r.index === true,
+        budget_mb: typeof r.budget_mb === 'number' && r.budget_mb > 0 ? r.budget_mb : DEFAULT_BUDGET_MB,
+        projects,
+    };
+}
+
+export function writeRegistry(reg: Registry, opts: RegistryOptions = {}): void {
+    write_atomic(registryPath(opts.env, opts.dir), `${JSON.stringify(reg, null, 2)}\n`);
+}
+
+const LOCK_WAIT_MS = 2_000;
+const LOCK_STALE_MS = 30_000;
+
+function sleep(ms: number): void {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Read, change and write under the registry lock; the change sees the latest file. */
+export function updateRegistry<T>(fn: (reg: Registry) => T, opts: RegistryOptions = {}): T {
+    const lock = path.join(registryDir(opts), 'registry.lock');
+    fs.mkdirSync(path.dirname(lock), { recursive: true });
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            fs.mkdirSync(lock);
+            break;
+        } catch (e) {
+            if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e;
+            try {
+                if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) fs.rmSync(lock, { recursive: true, force: true });
+            } catch {
+                /* released meanwhile */
+            }
+            if (Date.now() > deadline) throw new Error(`project registry is locked: ${lock}`);
+            sleep(25);
+        }
+    }
+    try {
+        const reg = readRegistry(opts);
+        const out = fn(reg);
+        writeRegistry(reg, opts);
+        return out;
+    } finally {
+        fs.rmSync(lock, { recursive: true, force: true });
+    }
+}
+
+/** The main checkout of a worktree, else the root itself. */
+export function mainRoot(root: string): string {
+    let real: string;
+    try {
+        real = fs.realpathSync(root);
+    } catch {
+        real = path.resolve(root);
+    }
+    const common = git_common_dir(real);
+    return common !== null && path.basename(common) === '.git' ? path.dirname(common) : real;
+}
+
+export type ProjectFields = Partial<Pick<ProjectEntry, 'fingerprint' | 'graph_home' | 'graph_commit' | 'languages' | 'providers' | 'pinned'>> & {
+    /** A user-global graph home that just served or rebuilt this project. */
+    usedHome?: string;
+};
+
+/** The logical project an entry key belongs to: the repo id, for a new or a bare legacy key. */
+export function repoIdOf(key: string): string {
+    return key.split('-')[0] as string;
+}
+
+/** Record `root` (by use, never by a crawl) and return its entry key, `<repo id>-<checkout>`. */
+export function recordProject(root: string, fields: ProjectFields = {}, opts: RegistryOptions = {}): string {
+    const dir = registryDir(opts);
+    const ident = repoIdentity(root, opts.env, dir);
+    const id = `${ident.repoId}-${ident.checkout}`;
+    const main = mainRoot(root);
+    const origin = remoteUrl(main);
+    const now = (opts.now ?? new Date()).toISOString();
+    updateRegistry((reg) => {
+        const legacy = reg.projects[ident.repoId];
+        const adopt = reg.projects[id] === undefined && legacy !== undefined && legacy.root === main;
+        const prev = reg.projects[id] ?? (adopt ? legacy : undefined);
+        if (adopt) delete reg.projects[ident.repoId];
+        const { usedHome, ...rest } = fields;
+        const next: ProjectEntry = {
+            root: main,
+            remote: origin === null ? null : canonicalOrigin(origin, main),
+            fingerprint: prev?.fingerprint ?? null,
+            graph_home: prev?.graph_home ?? null,
+            graph_commit: prev?.graph_commit ?? null,
+            languages: prev?.languages ?? [],
+            providers: prev?.providers ?? [],
+            pinned: prev?.pinned ?? false,
+            homes: { ...(prev?.homes ?? {}) },
+            ...Object.fromEntries(Object.entries(rest).filter(([, v]) => v !== undefined)),
+            last_seen: now,
+        };
+        if (usedHome !== undefined) next.homes[usedHome] = now;
+        reg.projects[id] = next;
+    }, { ...opts, dir });
+    return id;
+}
+
+/**
+ * The entries a reference names: an entry key, a repo id (every checkout of
+ * it), a registered name (the root's basename) or a path. A name two projects
+ * share returns both, so the caller can refuse to guess.
+ */
+export function findProjects(reg: Registry, ref: string): Array<[string, ProjectEntry]> {
+    const all = Object.entries(reg.projects);
+    const byKey = all.filter(([id]) => id === ref);
+    if (byKey.length) return byKey;
+    const byId = all.filter(([id]) => repoIdOf(id) === ref);
+    if (byId.length) return byId;
+    let real: string | null = null;
+    try {
+        real = fs.realpathSync(path.resolve(ref));
+    } catch {
+        real = path.resolve(ref);
+    }
+    const byPath = all.filter(([, e]) => e.root === real || e.root === ref);
+    if (byPath.length) return byPath;
+    return all.filter(([, e]) => path.basename(e.root) === ref);
+}

package/src/scripts/_lib/provenance_verify.ts

@@ -1,31 +1,12 @@
 /**
- * Tie a published version's provenance attestation to THIS package's OIDC
- * publish workflow.
+ * Which workflow, in which repository, a legitimate release of this package is
+ * built by — and the check that a SIGNED provenance payload names them.
  *
- * The gate this replaces read `dist.attestations.provenance.predicateType` out
- * of the packument and accepted anything starting with the SLSA provenance
- * URL. That is a presence check wearing a verification's clothes: any workflow
- * in any repository with `id-token: write` produces a document that passes it,
- * so an attacker who can publish from their own CI already satisfies it. The
- * step that opened this file (`road-to-an-update-that-installs-itself-only-when-it-is-safe`
- * 2.1) named exactly that gap — *"does not verify the attestation's signature
- * or tie it to `publish-npm.yml`"* — and this module closes the second half.
- *
- * **The first half is only partly closed here, and the distinction is
- * load-bearing.** `provenance_matches_publish` parses an UNSIGNED reading of
- * the DSSE payload. `verify_attestation_signature` below checks the envelope's
- * signature against the certificate the bundle carries, and requires the
- * payload it verified to name the same workflow — but checks no trust root
- * (see its own note). The registry-key half is `npm audit signatures`, which
- * verifies against npm's own trusted keys and is run by the caller as a
- * separate step; these functions are only meaningful WITH it, and the caller
- * says so where it composes them.
- *
- * Why not verify the signature in-process: it needs a sigstore/cosign
- * verification path, which is a dependency this package does not carry and
- * which the hook and pack byte budgets would both have to absorb. Shelling out
- * to the npm client — already a hard dependency of an upgrade — buys the same
- * property for nothing.
+ * Signatures, trust roots and the tie to the tarball are verified in
+ * `sigstore_provenance.ts`; this module only reads a payload that has already
+ * been verified there. It used to carry a certificate-bound signature check of
+ * its own, which checked no issuer and so passed a self-signed certificate
+ * carrying the expected SAN; that check is gone rather than kept as a fallback.
  */
 
 /**
@@ -44,65 +25,16 @@ function asRecord(v: unknown): Record<string, unknown> | null {
     return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : null;
 }
 
-/** Decode the DSSE payload of the first attestation; `null` when unreadable. */
-function decode_payload(doc: unknown): Record<string, unknown> | null {
-    const list = asRecord(doc)?.['attestations'];
-    if (!Array.isArray(list) || list.length === 0) return null;
-    for (const entry of list) {
-        const payload = asRecord(asRecord(asRecord(entry)?.['bundle'])?.['dsseEnvelope'])?.['payload'];
-        if (typeof payload !== 'string' || payload === '') continue;
-        try {
-            const parsed: unknown = JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
-            const rec = asRecord(parsed);
-            if (rec !== null) return rec;
-        } catch {
-            // A payload that is not base64 JSON is not evidence of anything.
-            // Keep looking: npm may serve several attestations and only one of
-            // them has to be the provenance statement.
-        }
-    }
-    return null;
-}
-
-function external_workflow(doc: unknown): Record<string, unknown> | null {
-    const payload = decode_payload(doc);
-    if (payload === null) return null;
-    const predicate = asRecord(payload['predicate']);
-    const external = asRecord(asRecord(predicate?.['buildDefinition'])?.['externalParameters']);
-    return asRecord(external?.['workflow']);
-}
-
-/**
- * The workflow path named by the attestation, or `null` when the document
- * carries none that can be read.
- */
-export function attestation_workflow_ref(doc: unknown): string | null {
-    const path_value = external_workflow(doc)?.['path'];
-    return typeof path_value === 'string' && path_value !== '' ? path_value : null;
-}
-
-/** The repository named by the attestation, or `null`. */
-export function attestation_repository(doc: unknown): string | null {
-    const repo = external_workflow(doc)?.['repository'];
-    return typeof repo === 'string' && repo !== '' ? repo : null;
-}
-
 /**
- * Does this attestation say the tarball was built by this package's publish
- * workflow, in this package's repository?
+ * Does this provenance payload say the tarball was built by this package's
+ * publish workflow, in this package's repository?
  *
- * Both halves are required and both reject on absence: a document that names
- * no workflow is not a document that names the right one. Repository is
- * compared with the trailing `.git` and any trailing slash removed, because
- * the same remote is written both ways and neither spelling is an attacker
- * signal.
+ * Both halves are required and both reject on absence: a payload that names no
+ * workflow is not one that names the right one. Repository is compared with
+ * the trailing `.git` and any trailing slash removed, because the same remote
+ * is written both ways and neither spelling is an attacker signal.
  */
-export function provenance_matches_publish(doc: unknown): boolean {
-    return payload_names_publish(decode_payload(doc));
-}
-
-/** The workflow and repository check, over one already-decoded payload. */
-function payload_names_publish(payload: Record<string, unknown> | null): boolean {
+export function payload_names_publish(payload: Record<string, unknown> | null): boolean {
     const predicate = asRecord(payload?.['predicate']);
     const workflow = asRecord(asRecord(asRecord(predicate?.['buildDefinition'])?.['externalParameters'])?.['workflow']);
     if (workflow?.['path'] !== EXPECTED_WORKFLOW_REF) return false;
@@ -110,163 +42,3 @@ function payload_names_publish(payload: Record<string, unknown> | null): boolean
     if (typeof repo !== 'string' || repo === '') return false;
     return repo.replace(/\.git$/, '').replace(/\/$/, '') === EXPECTED_REPOSITORY;
 }
-
-/**
- * Does the certificate's SAN carry the workflow identity as a whole URI entry?
- * Anchored: the entry is the expected workflow followed by `@<ref>`, never a
- * SAN that merely contains the string.
- */
-function san_names_workflow(san: string): boolean {
-    return san.split(/,\s*/).some((e) => e.startsWith(`URI:${SAN_WORKFLOW_MARKER}@`));
-}
-
-// --- the signature half -------------------------------------------------------
-
-/**
- * What the clauses below do and do not establish.
- *
- * The header above says the signature half is not closed here. It is now
- * HALF-closed, and the half that is missing is stated first so nothing below
- * reads as more than it is.
- *
- * **Closed:** the DSSE envelope's signature is verified against the public key
- * of the certificate the bundle itself carries, over the DSSE
- * pre-authentication encoding — so a payload edited after signing is caught,
- * and a bundle whose signature does not belong to its own certificate is
- * caught. And the certificate's own SAN is required to name the expected
- * workflow, so a bundle whose PAYLOAD claims `publish-npm.yml` while its
- * certificate was issued to some other identity is caught. Before this, both
- * were a base64 decode and a string compare.
- *
- * **Not closed, and this is the residue:** there is no trust root. Nothing
- * here checks that the certificate was issued by Fulcio, and nothing checks a
- * Rekor inclusion proof. An attacker who can serve a registry response can mint
- * a self-signed certificate carrying the expected SAN, sign their own payload
- * with it, and pass every check in this file. Closing that needs a sigstore
- * verification path with pinned roots — a dependency decision, not a line in
- * this function, and it is registered as the `dsse-trust-root` blocker on
- * `road-to-an-update-that-installs-itself-only-when-it-is-safe`.
- *
- * So the honest statement of what the provenance gate is worth today: it
- * defeats a partial compromise — a mis-scoped workflow, an edited payload, a
- * bundle reused from another build — and it does not defeat a forged bundle
- * from someone who already controls what the install reads.
- */
-
-/** Why the signature does not verify, or `null` when it does. */
-export type SignatureVerdict = string | null;
-
-/** The SAN extension OID the Fulcio leaf carries the workflow identity in. */
-const SAN_WORKFLOW_MARKER = `${EXPECTED_REPOSITORY}/${EXPECTED_WORKFLOW_REF}`;
-
-/**
- * The DSSE pre-authentication encoding — the exact bytes a DSSE signature is
- * taken over.
- *
- * `DSSEv1 SP len(payloadType) SP payloadType SP len(payload) SP payload`, with
- * both lengths in BYTES rather than characters. Built as a Buffer throughout
- * because the payload is arbitrary bytes and a string round-trip would mangle
- * any that are not valid UTF-8.
- */
-export function dssePae(payloadType: string, payload: Buffer): Buffer {
-    const type = Buffer.from(payloadType, 'utf8');
-    return Buffer.concat([
-        Buffer.from(`DSSEv1 ${String(type.length)} `, 'utf8'),
-        type,
-        Buffer.from(` ${String(payload.length)} `, 'utf8'),
-        payload,
-    ]);
-}
-
-interface Envelope {
-    readonly payloadType: string;
-    readonly payload: Buffer;
-    readonly sig: Buffer;
-    readonly certDer: Buffer;
-}
-
-function readEnvelope(entry: unknown): Envelope | null {
-    const bundle = asRecord(asRecord(entry)?.['bundle']);
-    const dsse = asRecord(bundle?.['dsseEnvelope']);
-    if (dsse === null) return null;
-    const payloadB64 = dsse['payload'];
-    const payloadType = dsse['payloadType'];
-    const sigs = dsse['signatures'];
-    if (typeof payloadB64 !== 'string' || typeof payloadType !== 'string' || !Array.isArray(sigs) || sigs.length === 0) return null;
-    const sigB64 = asRecord(sigs[0])?.['sig'];
-    if (typeof sigB64 !== 'string' || sigB64 === '') return null;
-
-    const material = asRecord(bundle?.['verificationMaterial']);
-    // Both shapes sigstore has used: a single certificate, and a chain.
-    const single = asRecord(material?.['certificate'])?.['rawBytes'];
-    const chain = asRecord(material?.['x509CertificateChain'])?.['certificates'];
-    const first = Array.isArray(chain) ? asRecord(chain[0])?.['rawBytes'] : undefined;
-    const certB64 = typeof single === 'string' ? single : typeof first === 'string' ? first : null;
-    if (certB64 === null || certB64 === '') return null;
-
-    return {
-        payloadType,
-        payload: Buffer.from(payloadB64, 'base64'),
-        sig: Buffer.from(sigB64, 'base64'),
-        certDer: Buffer.from(certB64, 'base64'),
-    };
-}
-
-/**
- * Verify the first readable attestation's DSSE signature against its own
- * certificate, and require that certificate to name this package's workflow.
- *
- * Returns a reason on every failure rather than a boolean, because the caller
- * prints it: a refusal a user cannot act on is a refusal they route around.
- * `crypto` is imported lazily so a caller that never verifies a signature does
- * not pay for the module — this runs on an install path, never in a hook.
- */
-export async function verify_attestation_signature(doc: unknown): Promise<SignatureVerdict> {
-    const list = asRecord(doc)?.['attestations'];
-    if (!Array.isArray(list) || list.length === 0) return 'the attestation bundle carries no attestations';
-    const crypto = await import('node:crypto');
-
-    let lastReason = 'no attestation carried a readable DSSE envelope';
-    for (const entry of list) {
-        const env = readEnvelope(entry);
-        if (env === null) continue;
-        let cert: InstanceType<typeof crypto.X509Certificate>;
-        try {
-            cert = new crypto.X509Certificate(env.certDer);
-        } catch {
-            lastReason = 'the signing certificate could not be parsed';
-            continue;
-        }
-        // The certificate's own identity, not the payload's claim about it.
-        const san = cert.subjectAltName ?? '';
-        if (!san_names_workflow(san)) {
-            lastReason = `the signing certificate names ${san === '' ? 'no identity' : san}, not ${SAN_WORKFLOW_MARKER}`;
-            continue;
-        }
-        let ok = false;
-        try {
-            ok = crypto.verify(null, dssePae(env.payloadType, env.payload), cert.publicKey, env.sig);
-        } catch {
-            ok = false;
-        }
-        if (!ok) {
-            lastReason = 'the DSSE signature does not verify against the certificate in the bundle';
-            continue;
-        }
-        // The payload this signature covers must itself name the workflow:
-        // otherwise a valid signature on one entry vouches for a claim made in
-        // another, which is all the unsigned check reads.
-        let verified: Record<string, unknown> | null = null;
-        try {
-            verified = asRecord(JSON.parse(env.payload.toString('utf8')));
-        } catch {
-            verified = null;
-        }
-        if (!payload_names_publish(verified)) {
-            lastReason = 'the signed payload does not name this package\'s publish workflow';
-            continue;
-        }
-        return null;
-    }
-    return lastReason;
-}

package/src/scripts/_lib/release_settings_surface.ts

@@ -33,7 +33,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { zodToJsonSchema } from 'zod-to-json-schema';
+import { toJsonSchema7 } from '../../shared/zodJsonSchema.js';
 
 import { settingsSchema } from '../../server/schemas/settings.js';
 import { computeSurfaceDelta, flattenSurface, type SettingsSurface, type SurfaceEntry } from '../../shared/settingsSurface.js';
@@ -50,11 +50,7 @@ import { RENAMED_KEYS, SETTINGS_REMOVAL_RULE } from './settings_renamed_keys.js'
  * "keep a preview fast" rule was written about.
  */
 function _jsonSchema(): Parameters<typeof flattenSurface>[0] {
-    return zodToJsonSchema(settingsSchema, {
-        name: 'AgentSettings',
-        $refStrategy: 'none',
-        target: 'jsonSchema7',
-    }) as Parameters<typeof flattenSurface>[0];
+    return toJsonSchema7(settingsSchema, 'AgentSettings') as Parameters<typeof flattenSurface>[0];
 }
 
 /** The one committed copy of the last release's surface. */