@moondeck/station 0.0.1 → 1.0.0

package/lib/host-env.ts

@@ -0,0 +1,424 @@
+/**
+ * Per-(project, key) environment variable store.
+ *
+ * Project/org members set KEY=VALUE pairs scoped to a (projectId, key) on this
+ * host; values are encrypted at rest with the host master key (same
+ * secret-blind pattern as host_ssh_keys / host_github_tokens — ADR-015). The
+ * cloud + UI only ever see KEY NAMES, never values (values are write-only). The
+ * same key name (e.g. DATABASE_URL) is independent per project, and a project's
+ * values are independent per host. At task-up each project on the task gets ITS
+ * (projectId, key) values injected into the task container env under the key
+ * name (see lib/agent.ts + scripts/agent/task-up.sh).
+ *
+ * `value_enc` is a single TEXT column carrying both halves of the AES-GCM
+ * sealed value as "<ct-base64>.<nonce-base64>".
+ */
+
+import { and, eq, isNotNull } from "drizzle-orm";
+
+import {
+  credentialStorePrefix,
+  isParameterPathSegment,
+  parameterName,
+  queueStoreWrite,
+  type CredentialStore,
+} from "./credential-store";
+import { isReservedTaskEnvName } from "../src/task-env-names";
+import { getDb, schema } from "./db";
+import { sealAesGcm, openAesGcm } from "./secrets";
+import { signInBoxMode } from "./signin-box";
+
+// Process-local epochs are enough for loader snapshots: every value mutation
+// also happens in this process, and a host restart rebuilds both the epoch map
+// and every task resolver. Keeping the counter per project lets a task ignore
+// unrelated projects without retaining decrypted values in a shared cache.
+const projectEnvRevisions = new Map<string, number>();
+
+// ADR-153: what a task's view decides moves with more than values: a
+// binding, and the store's gate opening or closing (a value write outside
+// the records closes it too). One process-local counter covers them all.
+let projectEnvAuthorityRevisionCount = 0;
+
+export function noteProjectEnvValueMutation(projectId: string): void {
+  projectEnvRevisions.set(
+    projectId,
+    (projectEnvRevisions.get(projectId) ?? 0) + 1,
+  );
+  // On an activated store, a value written outside its records (an old
+  // frame, the credential store) closes the gate by trigger, which every
+  // task's view depends on, not only this project's.
+  projectEnvAuthorityRevisionCount += 1;
+  emitProjectEnvChange();
+}
+
+const projectEnvChangeListeners = new Set<() => void>();
+
+/** Calls `listener` after any change to project env values, records,
+ *  bindings or the store's gate; returns its removal. A listener that throws
+ *  is skipped, never the change. */
+export function onProjectEnvChange(listener: () => void): () => void {
+  projectEnvChangeListeners.add(listener);
+  return () => {
+    projectEnvChangeListeners.delete(listener);
+  };
+}
+
+function emitProjectEnvChange(): void {
+  for (const listener of projectEnvChangeListeners) {
+    try {
+      listener();
+    } catch {
+      // A listener's failure is its own.
+    }
+  }
+}
+
+/** Current process-local value revision for one project's env. */
+export function projectEnvRevision(projectId: string): number {
+  return projectEnvRevisions.get(projectId) ?? 0;
+}
+
+
+export function noteProjectEnvAuthorityChange(): void {
+  projectEnvAuthorityRevisionCount += 1;
+  emitProjectEnvChange();
+}
+
+/** A task's project env changed outside this runner's store (ADR-154: the
+ *  cloud's task replica, or the composer starting or ending serving it):
+ *  whoever follows changes (the proxy's trust delivery) looks again. The
+ *  store's own revisions do not move; nothing caches a view of the cloud's. */
+export function noteProjectEnvViewChange(): void {
+  emitProjectEnvChange();
+}
+
+/** Current process-local revision of the store's records and gate. */
+export function projectEnvAuthorityRevision(): number {
+  return projectEnvAuthorityRevisionCount;
+}
+
+/** Pack a sealed value (ct + nonce) into the single TEXT column. */
+export function sealProjectEnvValueForStorage(value: string): string {
+  const sealed = sealAesGcm(value);
+  return `${sealed.ct.toString("base64")}.${sealed.nonce.toString("base64")}`;
+}
+
+/** Reverse {@link sealProjectEnvValueForStorage}; throws if malformed. */
+export function openProjectEnvValueFromStorage(valueEnc: string): string {
+  const dot = valueEnc.indexOf(".");
+  if (dot === -1) throw new Error("malformed value_enc");
+  const ct = Buffer.from(valueEnc.slice(0, dot), "base64");
+  const nonce = Buffer.from(valueEnc.slice(dot + 1), "base64");
+  return openAesGcm(ct, nonce);
+}
+
+/** Set (insert or overwrite) a project env var, encrypting the value at rest.
+ *  `orgId` is the project's org when the cloud sent it (see `noteProjectOrg`). */
+export function setProjectEnvVar(
+  projectId: string,
+  key: string,
+  value: string,
+  orgId?: string,
+): void {
+  const now = Date.now();
+  getDb()
+    .insert(schema.hostProjectEnv)
+    .values({
+      projectId,
+      key,
+      valueEnc: sealProjectEnvValueForStorage(value),
+      updatedAt: now,
+      ...(orgId ? { orgId } : {}),
+    })
+    .onConflictDoUpdate({
+      target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key],
+      set: { valueEnc: sealProjectEnvValueForStorage(value), updatedAt: now, ...(orgId ? { orgId } : {}) },
+    })
+    .run();
+  noteProjectEnvValueMutation(projectId);
+  if (orgId) noteProjectOrg(projectId, orgId, { except: key });
+  mirrorProjectEnvToStore(projectId, key);
+}
+
+/**
+ * The cloud told us which org owns `projectId` (an env.var.set/list frame
+ * carrying `orgId`). Every row of that project mirrored before the org was
+ * known gets the org and is re-tagged in the store, so a task machine's
+ * tag-scoped lease can read it (ADR-133). Returns the rows updated.
+ */
+export function noteProjectOrg(
+  projectId: string,
+  orgId: string,
+  opts: { except?: string } = {},
+): number {
+  const rows = getDb()
+    .select({ key: schema.hostProjectEnv.key, orgId: schema.hostProjectEnv.orgId, storeRef: schema.hostProjectEnv.storeRef })
+    .from(schema.hostProjectEnv)
+    .where(eq(schema.hostProjectEnv.projectId, projectId))
+    .all()
+    .filter((row) => row.key !== opts.except && row.orgId !== orgId);
+  for (const row of rows) {
+    getDb()
+      .update(schema.hostProjectEnv)
+      .set({ orgId })
+      .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, row.key)))
+      .run();
+    if (row.storeRef) {
+      const name = row.storeRef;
+      queueStoreWrite(`tag project env ${projectId}/${row.key}`, async (store) => {
+        await tagProjectEnvParameter(store, name, projectId, orgId);
+      });
+    }
+  }
+  return rows.length;
+}
+
+/** The org recorded for a project, or null while the cloud has not said. */
+export function projectEnvOrgId(projectId: string): string | null {
+  const row = getDb()
+    .select({ orgId: schema.hostProjectEnv.orgId })
+    .from(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), isNotNull(schema.hostProjectEnv.orgId)))
+    .get();
+  return row?.orgId ?? null;
+}
+
+/** The tags a project env parameter carries: the lease policy's `org`, plus
+ *  `project` for operators reading the store. */
+export function projectEnvTags(projectId: string, orgId: string): Record<string, string> {
+  return { org: orgId, project: projectId };
+}
+
+const tagWarned = new Set<string>();
+/**
+ * Tag a mirrored parameter for the task-machine lease. Best-effort: the
+ * value is already in the store, and a host whose policy predates
+ * `ssm:AddTagsToResource` (host-agent/scripts/credential-store/
+ * bootstrap-aws.sh) must keep mirroring; it warns once per parameter and a
+ * later set/list retries.
+ */
+export async function tagProjectEnvParameter(
+  store: Pick<CredentialStore, "tag">,
+  name: string,
+  projectId: string,
+  orgId: string,
+): Promise<boolean> {
+  try {
+    await store.tag(name, projectEnvTags(projectId, orgId));
+    tagWarned.delete(name);
+    return true;
+  } catch (err) {
+    if (!tagWarned.has(name)) {
+      tagWarned.add(name);
+      console.warn(
+        `[project-env] credential store: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a task machine cannot read it until it carries org=${orgId}; re-run bootstrap-aws.sh for ssm:AddTagsToResource`,
+      );
+    }
+    return false;
+  }
+}
+
+/** Remove a project env var (idempotent). */
+export function deleteProjectEnvVar(projectId: string, key: string): void {
+  const result = getDb()
+    .delete(schema.hostProjectEnv)
+    .where(
+      and(
+        eq(schema.hostProjectEnv.projectId, projectId),
+        eq(schema.hostProjectEnv.key, key),
+      ),
+    )
+    .run();
+  if (result.changes > 0) {
+    noteProjectEnvValueMutation(projectId);
+    mirrorProjectEnvDeletionToStore(projectId, key);
+  }
+}
+
+/** Queue only the credential-store side of a committed local deletion. */
+export function mirrorProjectEnvDeletionToStore(
+  projectId: string,
+  key: string,
+): void {
+  const name = projectEnvParameterName(projectId, key);
+  if (name) {
+    queueStoreWrite(`delete project env ${projectId}/${key}`, (store) =>
+      store.delete(name),
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 3): `<prefix>/projects/<projectId>/env/<KEY>`.
+// The set/delete frames carry no org, and a project id is org-bound in the
+// cloud, so the project is the owner segment. Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredProjectEnv {
+  v: 1;
+  kind: "project-env";
+  projectId: string;
+  key: string;
+  value: string;
+  updatedAt: number;
+  /** The project's org once the cloud has said (ADR-133 tag scope); a
+   *  replacement host inherits it with the value. */
+  orgId?: string;
+}
+
+/** Null when the project id or key cannot be a parameter path segment (a
+ *  key with a character SSM refuses is kept local and logged once). */
+export function projectEnvParameterName(projectId: string, key: string): string | null {
+  if (!isParameterPathSegment(projectId) || !isParameterPathSegment(key)) return null;
+  return parameterName(credentialStorePrefix(), "projects", projectId, "env", key);
+}
+
+/** The row as it is mirrored (value decrypted). Never logged. */
+export function projectEnvStoreValue(projectId: string, key: string): StoredProjectEnv | null {
+  const row = getDb()
+    .select()
+    .from(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .get();
+  if (!row) return null;
+  return {
+    v: 1,
+    kind: "project-env",
+    projectId,
+    key,
+    value: openProjectEnvValueFromStorage(row.valueEnc),
+    updatedAt: row.updatedAt,
+    ...(row.orgId ? { orgId: row.orgId } : {}),
+  };
+}
+
+export function setProjectEnvStoreRef(projectId: string, key: string, storeRef: string): void {
+  getDb()
+    .update(schema.hostProjectEnv)
+    .set({ storeRef })
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .run();
+}
+
+export function listProjectEnvStoreRows(): Array<{ projectId: string; key: string; storeRef: string | null }> {
+  return getDb()
+    .select({
+      projectId: schema.hostProjectEnv.projectId,
+      key: schema.hostProjectEnv.key,
+      storeRef: schema.hostProjectEnv.storeRef,
+    })
+    .from(schema.hostProjectEnv)
+    .all();
+}
+
+export function mirrorProjectEnvToStore(projectId: string, key: string): void {
+  // ADR-136 sign-in box: no local rows; env.var.* is a store passthrough
+  // (lib/signin-box-credentials.ts).
+  if (signInBoxMode()) return;
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) return;
+  queueStoreWrite(`mirror project env ${projectId}/${key}`, async (store) => {
+    const value = projectEnvStoreValue(projectId, key);
+    if (!value) return;
+    await store.put(name, JSON.stringify(value));
+    setProjectEnvStoreRef(projectId, key, name);
+    if (value.orgId) await tagProjectEnvParameter(store, name, projectId, value.orgId);
+  });
+}
+
+/** Reconcile import: a value this host lacks. Existing rows win. */
+export function importProjectEnvFromStore(value: StoredProjectEnv, storeRef: string): boolean {
+  const result = getDb()
+    .insert(schema.hostProjectEnv)
+    .values({
+      projectId: value.projectId,
+      key: value.key,
+      valueEnc: sealProjectEnvValueForStorage(value.value),
+      updatedAt: value.updatedAt,
+      storeRef,
+      ...(value.orgId ? { orgId: value.orgId } : {}),
+    })
+    .onConflictDoNothing({ target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key] })
+    .run();
+  if (result.changes > 0) noteProjectEnvValueMutation(value.projectId);
+  return result.changes > 0;
+}
+
+/** Reconcile: the row's parameter vanished elsewhere; drop the row only. */
+export function deleteProjectEnvLocal(projectId: string, key: string): void {
+  const result = getDb()
+    .delete(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .run();
+  if (result.changes > 0) noteProjectEnvValueMutation(projectId);
+}
+
+/** Sorted list of a project's env var KEY NAMES (never the values). */
+export function listProjectEnvKeys(projectId: string): string[] {
+  return getDb()
+    .select({ key: schema.hostProjectEnv.key })
+    .from(schema.hostProjectEnv)
+    .where(eq(schema.hostProjectEnv.projectId, projectId))
+    .all()
+    .map((row) => row.key)
+    .sort();
+}
+
+/**
+ * Decrypt + return a project's env vars as KEY→VALUE. Used at task-up injection
+ * (lib/agent.ts) — the decrypted values live only on the trusted host (ADR-015)
+ * and go straight into the task container's child env, never logged. Resilient:
+ * a single value that fails to decrypt is logged + skipped rather than aborting
+ * the whole task launch.
+ */
+export function getDecryptedForProject(projectId: string): Record<string, string> {
+  const rows = getDb()
+    .select({
+      key: schema.hostProjectEnv.key,
+      valueEnc: schema.hostProjectEnv.valueEnc,
+    })
+    .from(schema.hostProjectEnv)
+    .where(eq(schema.hostProjectEnv.projectId, projectId))
+    .all();
+  const out: Record<string, string> = {};
+  for (const row of rows) {
+    try {
+      out[row.key] = openProjectEnvValueFromStorage(row.valueEnc);
+    } catch (err) {
+      console.warn(
+        `[host-env] skipping ${projectId}/${row.key}: decrypt failed (${
+          err instanceof Error ? err.message : String(err)
+        })`,
+      );
+    }
+  }
+  return out;
+}
+
+/**
+ * Names a project may declare but a task must never receive from project env —
+ * the same list task-up.sh's `is_reserved_task_env_name` enforces for
+ * container tasks: git/gh plumbing, loader and shell hooks, toolchain config,
+ * the host's own `UAI_*` namespace, engine credentials, and the browser path.
+ */
+export { isReservedTaskEnvName } from "../src/task-env-names";
+
+/**
+ * Rollout-only project env for an ADR-121 machine task whose persisted mode
+ * is still `baked`: every project's decrypted values, lead project winning a
+ * key collision, minus the reserved names above. Loader tasks must use the
+ * declaration-pinned gateway instead. Live 2026-09-09: a machine task on Uai
+ * Cloud had the Infisical identity in the store and the host, and the agent
+ * never saw it, because only the compose path injected project env.
+ */
+export function projectEnvForTask(projectIds: readonly string[]): Record<string, string> {
+  const merged: Record<string, string> = {};
+  for (const projectId of [...projectIds].reverse()) {
+    Object.assign(merged, getDecryptedForProject(projectId));
+  }
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(merged)) {
+    if (!isReservedTaskEnvName(key)) out[key] = value;
+  }
+  return out;
+}