@moondeck/station 0.0.1 → 1.0.0

package/lib/command-db.ts

@@ -0,0 +1,310 @@
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+import Database from "better-sqlite3";
+
+import { env } from "./env";
+import type { HostTask } from "../db/schema";
+import type {
+  TaskCommandProject,
+  TaskCommandTask,
+  TaskDownInput,
+  TaskLaunchInput,
+} from "../src/protocol";
+
+export function createTaskUpCommandDb(input: TaskLaunchInput): string {
+  const dbPath = newCommandDbPath(input.task.id);
+  const db = openCommandDb(dbPath);
+  try {
+    seedMetadata(db, withRuntime(input.task, null), input.projects);
+  } finally {
+    db.close();
+  }
+  return dbPath;
+}
+
+export function createTaskDownCommandDb(
+  input: TaskDownInput,
+  runtime: HostTask | null,
+): string {
+  const dbPath = newCommandDbPath(input.taskId);
+  const db = openCommandDb(dbPath);
+  try {
+    seedMetadata(db, withRuntime(input.task, runtime), input.projects);
+  } finally {
+    db.close();
+  }
+  return dbPath;
+}
+
+/**
+ * Environment-provider teardown reconstructs from a durable task locator, not
+ * from the cloud command payload that originally provisioned it. The teardown
+ * script needs only the exact task identity/runtime row; it deliberately
+ * derives every destructive Docker/filesystem target from that identity.
+ */
+export function createTaskEnvironmentDownCommandDb(
+  taskId: string,
+  runtime: HostTask | null,
+): string {
+  const dbPath = newCommandDbPath(taskId);
+  const db = openCommandDb(dbPath);
+  try {
+    insertTask(db, runtimeTask(taskId, runtime));
+  } finally {
+    db.close();
+  }
+  return dbPath;
+}
+
+export function createTaskStatusCommandDb(
+  taskId: string,
+  runtime: HostTask | null,
+): string {
+  const dbPath = newCommandDbPath(taskId);
+  const db = openCommandDb(dbPath);
+  try {
+    insertTask(db, runtimeTask(taskId, runtime));
+  } finally {
+    db.close();
+  }
+  return dbPath;
+}
+
+export function removeCommandDb(path: string): void {
+  rmSync(path, { force: true });
+}
+
+function newCommandDbPath(taskId: string): string {
+  if (!existsSync(env.commandDbDir)) {
+    mkdirSync(env.commandDbDir, { recursive: true, mode: 0o700 });
+  }
+  const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  return join(env.commandDbDir, `${taskId}-${suffix}.sqlite`);
+}
+
+function openCommandDb(path: string): Database.Database {
+  const db = new Database(path);
+  db.pragma("journal_mode = WAL");
+  db.exec(schemaSql);
+  return db;
+}
+
+/**
+ * Seed the per-task command DB the bash scripts read (ADR-022 shape):
+ *   - one uai_users row for the owner,
+ *   - one uai_projects row per selected project,
+ *   - one uai_task_projects row per (task, project, position),
+ *   - one uai_tasks row for the task (+ mirrored runtime fields).
+ * Column names mirror the cloud Drizzle schema.
+ */
+function seedMetadata(
+  db: Database.Database,
+  task: CommandTaskRow,
+  projects: TaskCommandProject[],
+): void {
+  db.prepare(
+    `INSERT OR IGNORE INTO uai_users (id, clerk_user_id, email)
+     VALUES (@id, @clerk_user_id, @email)`,
+  ).run({
+    id: task.owner_user_id,
+    clerk_user_id: null,
+    email: "host-command@example.invalid",
+  });
+
+  const insertProject = db.prepare(
+    `INSERT INTO uai_projects (
+      id, owner_user_id, name, slug, repo_url, default_prompt,
+      preview_ports, env, tool_versions, extra
+    ) VALUES (
+      @id, @owner_user_id, @name, @slug, @repo_url, @default_prompt,
+      @preview_ports, @env, @tool_versions, @extra
+    )`,
+  );
+  const insertTaskProject = db.prepare(
+    `INSERT INTO uai_task_projects (task_id, project_id, position)
+     VALUES (@task_id, @project_id, @position)`,
+  );
+
+  for (const project of projects) {
+    insertProject.run({
+      id: project.id,
+      owner_user_id: project.ownerUserId,
+      name: project.name,
+      slug: project.slug,
+      repo_url: project.repoUrl,
+      default_prompt: project.defaultPrompt,
+      preview_ports: project.previewPorts,
+      env: project.env,
+      tool_versions: project.toolVersions ?? null,
+      extra: project.extra ?? null,
+    });
+    insertTaskProject.run({
+      task_id: task.id,
+      project_id: project.id,
+      position: project.position,
+    });
+  }
+
+  insertTask(db, task);
+}
+
+function insertTask(db: Database.Database, task: CommandTaskRow): void {
+  db.prepare(
+    `INSERT INTO uai_tasks (
+      id, owner_user_id, host_id, name, slug, branch, status,
+      global_context, reviewer_order, agents, pr_context,
+      worktree_path, compose_project, code_server_port, preview_ports,
+      preview_env, owner_org_id, shared_files, locked_at, started_at, ended_at
+    ) VALUES (
+      @id, @owner_user_id, @host_id, @name, @slug, @branch, @status,
+      @global_context, @reviewer_order, @agents, @pr_context,
+      @worktree_path, @compose_project, @code_server_port, @preview_ports,
+      @preview_env, @owner_org_id, @shared_files, @locked_at, @started_at, @ended_at
+    )`,
+  ).run(task);
+}
+
+/**
+ * The shape of a row inserted into `uai_tasks`. The leading columns mirror
+ * the cloud `tasks` schema; the trailing columns are host runtime fields the
+ * bash scripts write back during task-up / task-down.
+ */
+interface CommandTaskRow {
+  id: string;
+  owner_user_id: string;
+  host_id: string;
+  name: string;
+  slug: string;
+  branch: string;
+  status: string;
+  global_context: string | null;
+  reviewer_order: string | null;
+  agents: string;
+  pr_context: string | null;
+  worktree_path: string | null;
+  compose_project: string | null;
+  code_server_port: number | null;
+  preview_ports: string;
+  preview_env: string | null;
+  owner_org_id: string | null;
+  shared_files: string | null;
+  locked_at: number | null;
+  started_at: number | null;
+  ended_at: number | null;
+}
+
+function withRuntime(
+  task: TaskCommandTask,
+  runtime: HostTask | null,
+): CommandTaskRow {
+  return {
+    id: task.id,
+    owner_user_id: task.ownerUserId,
+    host_id: task.hostId,
+    name: task.name,
+    slug: task.slug,
+    branch: task.branch,
+    status: runtime?.statusMirror ?? task.status,
+    global_context: task.globalContext ?? null,
+    reviewer_order: task.reviewerOrder
+      ? JSON.stringify(task.reviewerOrder)
+      : null,
+    agents: JSON.stringify(task.agents ?? []),
+    pr_context: null,
+    worktree_path: runtime?.worktreePath ?? null,
+    compose_project: runtime?.composeProject ?? null,
+    code_server_port: runtime?.codeServerPort ?? null,
+    preview_ports: runtime?.previewPorts ?? "[]",
+    preview_env: task.previewEnv ? JSON.stringify(task.previewEnv) : null,
+    owner_org_id: task.ownerOrgId ?? null,
+    shared_files: task.sharedFiles ?? null,
+    locked_at: runtime?.lockedAt ?? null,
+    started_at: runtime?.startedAt ?? null,
+    ended_at: runtime?.endedAt ?? null,
+  };
+}
+
+function runtimeTask(taskId: string, runtime: HostTask | null): CommandTaskRow {
+  return {
+    id: taskId,
+    owner_user_id: "host-runtime",
+    host_id: "host-runtime",
+    name: taskId,
+    slug: taskId,
+    branch: `task/${taskId}`,
+    status: runtime?.statusMirror ?? "queued",
+    global_context: null,
+    reviewer_order: null,
+    agents: "[]",
+    pr_context: null,
+    worktree_path: runtime?.worktreePath ?? null,
+    compose_project: runtime?.composeProject ?? null,
+    code_server_port: runtime?.codeServerPort ?? null,
+    preview_ports: runtime?.previewPorts ?? "[]",
+    preview_env: null,
+    owner_org_id: null,
+    shared_files: null,
+    locked_at: runtime?.lockedAt ?? null,
+    started_at: runtime?.startedAt ?? null,
+    ended_at: runtime?.endedAt ?? null,
+  };
+}
+
+const schemaSql = `
+CREATE TABLE IF NOT EXISTS uai_users (
+  id text PRIMARY KEY,
+  clerk_user_id text UNIQUE,
+  email text NOT NULL
+);
+CREATE TABLE IF NOT EXISTS uai_projects (
+  id text PRIMARY KEY,
+  owner_user_id text NOT NULL,
+  name text NOT NULL,
+  slug text NOT NULL,
+  repo_url text NOT NULL,
+  default_prompt text NOT NULL DEFAULT '',
+  preview_ports text NOT NULL DEFAULT '[]',
+  env text NOT NULL DEFAULT '[]',
+  tool_versions text,
+  extra text
+);
+CREATE TABLE IF NOT EXISTS uai_task_projects (
+  task_id text NOT NULL,
+  project_id text NOT NULL,
+  position integer NOT NULL DEFAULT 0,
+  PRIMARY KEY (task_id, project_id)
+);
+CREATE TABLE IF NOT EXISTS uai_tasks (
+  id text PRIMARY KEY,
+  owner_user_id text NOT NULL,
+  host_id text NOT NULL,
+  name text NOT NULL,
+  slug text NOT NULL,
+  branch text NOT NULL,
+  status text NOT NULL DEFAULT 'queued',
+  global_context text,
+  reviewer_order text,
+  agents text NOT NULL DEFAULT '[]',
+  pr_context text,
+  worktree_path text,
+  compose_project text,
+  code_server_port integer,
+  preview_ports text NOT NULL DEFAULT '[]',
+  preview_env text,
+  owner_org_id text,
+  shared_files text,
+  pr_url text,
+  locked_at integer,
+  started_at integer,
+  ended_at integer,
+  updated_at integer NOT NULL DEFAULT (unixepoch() * 1000)
+);
+CREATE TABLE IF NOT EXISTS uai_task_events (
+  id text PRIMARY KEY,
+  task_id text NOT NULL,
+  ts integer NOT NULL DEFAULT (unixepoch() * 1000),
+  kind text NOT NULL,
+  payload text NOT NULL DEFAULT '{}'
+);
+`;

package/lib/compose-network-recovery.ts

@@ -0,0 +1,283 @@
+/**
+ * Bounded recovery for Docker's local-network address pool.
+ *
+ * Compose allocates one bridge network per local task. A task that fails after
+ * creating its network can remain resumable in `error`, and Docker retains the
+ * empty network. Enough such networks eventually make every later task fail
+ * with "all predefined address pools have been fully subnetted".
+ *
+ * This sweep is deliberately narrower than `docker network prune`:
+ *
+ * - the exact task/project identity must be present in trusted host state;
+ * - the task must not be starting or running;
+ * - Docker must independently report no attached container; and
+ * - deletion happens inside that task's lifecycle slot, so Resume/Stop cannot
+ *   interleave with the proof. The slot is taken only if it is free at once:
+ *   the sweep never waits on a task's lifecycle.
+ *
+ * Any unreadable or malformed observation means "do nothing", never
+ * permission to delete.
+ */
+
+import type { HostTask } from "../db/schema";
+import { dockerCli, type DockerResult } from "./docker-exec";
+import { getHostTask } from "./runtime-state";
+import { isSafeHostTaskId } from "./task-identity";
+import { isTerminal } from "./task-status";
+import { parseTaskEnvironmentLocator } from "./task-environment/types";
+
+const COMPOSE_PROJECT_LABEL = "com.docker.compose.project";
+const NETWORK_LIST_FORMAT =
+  `{{.ID}}\t{{.Name}}\t{{.Label "${COMPOSE_PROJECT_LABEL}"}}`;
+const MAX_NETWORK_LIST_BYTES = 2 * 1024 * 1024;
+const MAX_NETWORK_INSPECT_BYTES = 1024 * 1024;
+const DOCKER_TIMEOUT_MS = 10_000;
+
+interface ComposeNetworkCandidate {
+  id: string;
+  name: string;
+  composeProject: string;
+  taskId: string;
+}
+
+export interface ComposeNetworkLifecycle {
+  /** Runs `operation` in the task's lifecycle slot only if that slot is free
+   *  at once (the orchestrator's `tryRunTaskLifecycle`); never waits. */
+  tryRunTaskLifecycle<T>(
+    taskId: string,
+    operation: () => Promise<T>,
+  ): Promise<{ ran: true; value: T } | { ran: false }>;
+}
+
+export interface ComposeNetworkRecoveryDeps {
+  docker(args: string[], options?: {
+    timeoutMs?: number;
+    maxOutputBytes?: number;
+  }): Promise<DockerResult>;
+  task(taskId: string): HostTask | null;
+}
+
+export interface ComposeNetworkRecoveryResult {
+  inventory: "complete" | "unavailable" | "invalid";
+  candidates: number;
+  removed: number;
+  /** Candidates left alone because their task's lifecycle slot was busy. */
+  busy: number;
+}
+
+const defaultDeps: ComposeNetworkRecoveryDeps = {
+  docker: dockerCli,
+  task: getHostTask,
+};
+
+function parseCandidate(
+  line: string,
+): ComposeNetworkCandidate | "unrelated" | null {
+  const fields = line.split("\t");
+  if (fields.length !== 3) return null;
+  const [id, name, composeProject] = fields as [string, string, string];
+  if (!/^[a-f0-9]{12,64}$/.test(id)) return null;
+  if (!composeProject.startsWith("task-")) return "unrelated";
+  const taskId = composeProject.slice("task-".length);
+  if (!isSafeHostTaskId(taskId) || taskId !== taskId.toLowerCase()) return null;
+  if (name !== `${composeProject}_default`) return null;
+  return { id, name, composeProject, taskId };
+}
+
+function parseCandidates(stdout: string): ComposeNetworkCandidate[] | null {
+  const candidates: ComposeNetworkCandidate[] = [];
+  const ids = new Set<string>();
+  for (const line of stdout.split(/\r?\n/)) {
+    if (line.length === 0) continue;
+    const candidate = parseCandidate(line);
+    if (candidate === "unrelated") continue;
+    if (candidate === null || ids.has(candidate.id)) return null;
+    ids.add(candidate.id);
+    candidates.push(candidate);
+  }
+  return candidates;
+}
+
+function taskOwnsReclaimableNetwork(
+  task: HostTask | null,
+  candidate: ComposeNetworkCandidate,
+): boolean {
+  if (
+    task === null ||
+    task.taskId !== candidate.taskId ||
+    (task.environmentProvider !== null &&
+      task.environmentProvider !== "docker-compose") ||
+    (task.statusMirror !== "error" &&
+      task.statusMirror !== "stopped" &&
+      !(typeof task.statusMirror === "string" && isTerminal(task.statusMirror)))
+  ) {
+    return false;
+  }
+  if (task.composeProject === candidate.composeProject) return true;
+  if (!task.environmentLocator) return false;
+  try {
+    const locator = parseTaskEnvironmentLocator(task.environmentLocator);
+    if (
+      locator.schemaVersion !== 1 ||
+      locator.provider !== "docker-compose" ||
+      !locator.value ||
+      typeof locator.value !== "object" ||
+      Array.isArray(locator.value)
+    ) {
+      return false;
+    }
+    const value = locator.value as Record<string, unknown>;
+    return (
+      value.schemaVersion === 2 &&
+      value.taskId === candidate.taskId &&
+      value.composeProject === candidate.composeProject &&
+      value.containerName === `${candidate.composeProject}-app-1`
+    );
+  } catch {
+    return false;
+  }
+}
+
+function inspectedEmptyNetwork(
+  stdout: string,
+  candidate: ComposeNetworkCandidate,
+): { fullId: string } | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed) || parsed.length !== 1) return null;
+  const network = parsed[0];
+  if (!network || typeof network !== "object" || Array.isArray(network)) {
+    return null;
+  }
+  const record = network as Record<string, unknown>;
+  const labels = record.Labels;
+  const containers = record.Containers;
+  if (
+    typeof record.Id !== "string" ||
+    !/^[a-f0-9]{64}$/.test(record.Id) ||
+    !record.Id.startsWith(candidate.id) ||
+    record.Name !== candidate.name ||
+    record.Driver !== "bridge" ||
+    record.Scope !== "local" ||
+    !labels ||
+    typeof labels !== "object" ||
+    Array.isArray(labels) ||
+    (labels as Record<string, unknown>)[COMPOSE_PROJECT_LABEL] !==
+      candidate.composeProject ||
+    !containers ||
+    typeof containers !== "object" ||
+    Array.isArray(containers) ||
+    Object.keys(containers).length !== 0
+  ) {
+    return null;
+  }
+  return { fullId: record.Id };
+}
+
+async function reclaimCandidate(
+  candidate: ComposeNetworkCandidate,
+  deps: ComposeNetworkRecoveryDeps,
+): Promise<boolean> {
+  if (!taskOwnsReclaimableNetwork(deps.task(candidate.taskId), candidate)) {
+    return false;
+  }
+  const inspected = await deps.docker(
+    ["network", "inspect", candidate.id],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+    },
+  );
+  if (inspected.status !== 0 || inspected.outputTruncated) return false;
+  const empty = inspectedEmptyNetwork(inspected.stdout, candidate);
+  if (empty === null) return false;
+
+  // `.Containers` is the network's own endpoint inventory. Independently ask
+  // Docker's all-container inventory as a second positive emptiness proof.
+  const attached = await deps.docker(
+    ["ps", "-aq", "--filter", `network=${empty.fullId}`],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+    },
+  );
+  if (
+    attached.status !== 0 ||
+    attached.outputTruncated ||
+    attached.stdout.trim().length !== 0
+  ) {
+    return false;
+  }
+
+  const removed = await deps.docker(["network", "rm", empty.fullId], {
+    timeoutMs: DOCKER_TIMEOUT_MS,
+    maxOutputBytes: MAX_NETWORK_INSPECT_BYTES,
+  });
+  return removed.status === 0 && !removed.outputTruncated;
+}
+
+/**
+ * Remove only positively-owned, empty task networks. This is best-effort host
+ * hygiene: an unavailable inventory never blocks a task that may still fit in
+ * Docker's pool, and it never authorizes deletion.
+ */
+export async function reclaimUnusedUaiComposeNetworks(
+  lifecycle: ComposeNetworkLifecycle,
+  deps: ComposeNetworkRecoveryDeps = defaultDeps,
+): Promise<ComposeNetworkRecoveryResult> {
+  const listed = await deps.docker(
+    [
+      "network",
+      "ls",
+      "--filter",
+      `label=${COMPOSE_PROJECT_LABEL}`,
+      "--format",
+      NETWORK_LIST_FORMAT,
+    ],
+    {
+      timeoutMs: DOCKER_TIMEOUT_MS,
+      maxOutputBytes: MAX_NETWORK_LIST_BYTES,
+    },
+  );
+  if (listed.status !== 0 || listed.outputTruncated) {
+    return { inventory: "unavailable", candidates: 0, removed: 0, busy: 0 };
+  }
+  const candidates = parseCandidates(listed.stdout);
+  if (candidates === null) {
+    return { inventory: "invalid", candidates: 0, removed: 0, busy: 0 };
+  }
+
+  let removed = 0;
+  let busy = 0;
+  for (const candidate of candidates) {
+    // Avoid taking a live start's slot merely to rediscover in-slot that it
+    // is not reclaimable. This observation grants no authority; the complete
+    // ownership/status check is repeated after the lifecycle slot is held.
+    if (!taskOwnsReclaimableNetwork(deps.task(candidate.taskId), candidate)) {
+      continue;
+    }
+    // Never wait for the candidate's slot. A Resume marks its task `starting`
+    // only partway into its own slot, so the row can still read `error` while
+    // that slot is held, and waiting for it meant waiting out the whole
+    // start; a stuck operation on any stopped task would hold every later
+    // start here. A busy task's network is left for a later start's sweep.
+    const attempt = await lifecycle.tryRunTaskLifecycle(
+      candidate.taskId,
+      // The trusted row and Docker evidence are deliberately read only after
+      // entering the candidate task's lifecycle slot.
+      () => reclaimCandidate(candidate, deps),
+    );
+    if (!attempt.ran) busy += 1;
+    else if (attempt.value) removed += 1;
+  }
+  return {
+    inventory: "complete",
+    candidates: candidates.length,
+    removed,
+    busy,
+  };
+}

package/lib/connection-secret-redaction.ts

@@ -0,0 +1,25 @@
+/** Exact, session-scoped defense for diagnostics that reach host telemetry. */
+const active = new Map<string, number>();
+
+export function registerConnectionSecret(key: string): () => void {
+  if (!key) return () => {};
+  active.set(key, (active.get(key) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    const remaining = (active.get(key) ?? 1) - 1;
+    if (remaining) active.set(key, remaining);
+    else active.delete(key);
+  };
+}
+
+export function redactActiveConnectionSecrets(text: string): string {
+  // Empty replacement cannot itself contain another active secret.
+  let previous: string;
+  do {
+    previous = text;
+    for (const key of active.keys()) text = text.split(key).join("");
+  } while (text !== previous);
+  return text;
+}