@kici-dev/agent 0.6.0 → 0.7.0

package/dist/config.d.ts

@@ -47,6 +47,10 @@ declare const configSchema: z.ZodObject<{
     sandboxHardened: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     sandboxReadonlyRootfs: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     sandboxUser: z.ZodOptional<z.ZodString>;
+    runnerUser: z.ZodOptional<z.ZodString>;
+    runnerDebugStdio: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    sandboxNetworkIsolation: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    allowInstallScripts: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     sandboxPidsLimit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxMemoryBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxNanoCpus: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -114,6 +118,10 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     sandboxHardened: boolean;
     sandboxReadonlyRootfs: boolean;
     sandboxUser?: string | undefined;
+    runnerUser?: string | undefined;
+    runnerDebugStdio: boolean;
+    sandboxNetworkIsolation: boolean;
+    allowInstallScripts: boolean;
     sandboxPidsLimit: number;
     sandboxMemoryBytes: number;
     sandboxNanoCpus: number;
@@ -135,47 +143,39 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     orphanCleanup: boolean;
     drainOnResetFailure: boolean;
 }>;
+export declare function loadConfig(): AppConfig;
 /**
- * Load and validate agent configuration from environment variables.
+ * Remove the agent's own credentials from `process.env` after boot.
+ *
+ * The runner child runs as the agent's user under the default bare-metal
+ * backend, so `/proc/<agent-pid>/environ` is readable from inside a job: a step
+ * could print the agent token, register a rogue agent with it, and receive every
+ * dispatch routed to this one. Stripping the variables closes that read on every
+ * platform, whatever backend is selected.
  *
- * Maps env vars with KICI_ prefix:
- * - KICI_ORCHESTRATOR_URL (required)
- * - KICI_AGENT_ID (optional, auto-generated from hostname-uuid8)
- * - KICI_LABELS (comma-separated, e.g. "linux,docker"). Labels with 'kici-' prefix are reserved.
- * - KICI_PROPERTIES (comma-separated key=value host-vars, e.g. "region=eu,cores=8,gpu=true"). Typed (bool/number/string), reported into the host roster.
- * - KICI_ROLES (comma-separated agent roles, e.g. "builder,init-runner". undefined=all, empty=execution-only)
- * - KICI_PORT (default: 8080)
- * - KICI_LOG_LEVEL (default: info)
- * - KICI_AGENT_TOKEN (optional, kat_ prefixed PSK for orchestrator authentication)
- * - KICI_GITHUB_TOKEN (optional)
- * - KICI_MAX_LOG_SIZE_BYTES (default: 10MB)
- * - KICI_DEFAULT_STEP_TIMEOUT_MS (default: 30 min)
- * - KICI_DOCKER_KEEP_FAILED (default: false)
- * - KICI_JOB_HEARTBEAT_INTERVAL_MS (default: 60000)
- * - KICI_BACKPRESSURE_MODE (default: pause, options: pause | drop)
- * - KICI_SANDBOX (default: false) — enable bubblewrap (bwrap) namespace isolation for bare-metal execution
- * - KICI_TRUSTED_ENV (default: false) — trusted fleet-agent profile: pass the ambient host env (minus the agent's own KiCI identity secrets) through to steps
- * - KICI_IN_PLACE (default: false) — in-place no-clone profile: for a file:// source, use the real repo path as workDir and skip the clone (the routed deploy:stg profile)
- * - KICI_SANDBOX_NETWORK (default: isolated, options: isolated | host) — sandbox network posture for BOTH backends: the bwrap network namespace (when sandbox=true) and the container job network. `host` shares the host network (container backend also binds host /etc/hosts read-only for name resolution); applies to the container backend under the default hardened posture (KICI_SANDBOX_HARDENED=true)
- * - KICI_SANDBOX_HARDENED (default: true) — hardened-by-default job containers (CapDrop ALL, no-new-privileges, cgroup caps, tmpfs /tmp); set false to roll back to the legacy unhardened posture
- * - KICI_SANDBOX_READONLY_ROOTFS (default: false) — opt-in read-only container rootfs (/tmp stays a writable tmpfs)
- * - KICI_SANDBOX_USER (optional) — container user override (uid, uid:gid, or name); honors the image user when unset
- * - KICI_SANDBOX_PIDS_LIMIT (default: 512) — max PIDs in the job container cgroup
- * - KICI_SANDBOX_MEMORY_BYTES (default: 2 GiB) — memory cap in bytes for the job container cgroup
- * - KICI_SANDBOX_NANO_CPUS (default: 2 CPUs) — CPU cap in nano-CPUs for the job container cgroup
- * - KICI_SCALER_MANAGED (set to "1" by the orchestrator's auto-scaler — agent self-shuts down on idle)
- * - KICI_SCALER_CLAIM_CODE (optional single-use claim code the agent exchanges for its own ephemeral credentials before registering; ignored when KICI_AGENT_TOKEN is set)
- * - KICI_SCALER_IDLE_TIMEOUT (ms, default 5000) — how long a scaler-managed agent waits before shutdown after going idle
- * - KICI_SCALER_PENDING_DISPATCH_TIMEOUT (ms, default 60000) — extended idle window when register.ack signals a queued bound job
- * - KICI_EXECUTION_MODE (optional, options: container | bare-metal | firecracker) — override the runner's mode-pick logic
- * - KICI_CONCURRENCY_WAIT_TIMEOUT_MS (default: 3_600_000) — workflow-runner timeout when long-polling for a slot-release follow-up `concurrency.ack`
- * - KICI_AGENT_BETWEEN_JOBS_RESET_COMMAND (optional) — host-reset command run between jobs on a reused agent (fail-open)
- * - KICI_AGENT_BETWEEN_JOBS_RESET_TIMEOUT_MS (default: 60000) — reset command timeout
- * - KICI_AGENT_BETWEEN_JOBS_RESET_RUN_ON (default: always, options: always | on-failure) — when the reset command runs
- * - KICI_AGENT_ORPHAN_CLEANUP (default: true) — reap a finished job's leaked process tree (bare-metal); false = only signal the runner child
- * - KICI_AGENT_DRAIN_ON_RESET_FAILURE (default: false) — drain the agent after repeated consecutive reset failures
+ * This is defence in depth, not isolation — a same-uid `ptrace` or
+ * `/proc/<pid>/mem` read still reaches the value the config object holds. The
+ * boundary is `KICI_RUNNER_USER` (a dedicated uid) or the container backend.
+ *
+ * Safe because each variable has exactly one reader: `loadConfig()`, which has
+ * one caller and runs before this. Returns the names actually removed.
  */
-export declare function loadConfig(): AppConfig;
+export declare function scrubCredentialEnv(): string[];
+/**
+ * Describe the runner-isolation posture when it offers no boundary between a
+ * job's step code and the agent process, or `undefined` when one is in place.
+ *
+ * The exposed posture is the default bare-metal one: `KICI_SANDBOX=false` (a
+ * plain `fork()`, no namespaces), no `KICI_RUNNER_USER`, and no container
+ * backend. The child then runs as the agent's own user, so the env allowlist
+ * that keeps the agent's credentials out of the child is not a credential
+ * boundary — anything running as that uid can still reach the agent process.
+ *
+ * Reported as one startup warning naming both remedies, rather than refused:
+ * bwrap is Linux-only and the container backend imposes a container runtime, so
+ * neither can be a default without breaking existing installs.
+ */
+export declare function describeExposedPosture(config: Pick<AppConfig, 'sandbox' | 'runnerUser' | 'executionMode' | 'jobImageAgent'>): string | undefined;
 /**
  * Connection/identity options for the orchestrator WebSocket client, derived
  * purely from config.