@moondeck/station 0.0.1 → 1.0.1

package/lib/ssh.ts

@@ -0,0 +1,401 @@
+/**
+ * Host-side per-user SSH key manager (ADR-029).
+ *
+ * Each user gets one ed25519 keypair, GENERATED ON THIS HOST. The private key
+ * lives encrypted at rest with the host master key (`host_ssh_keys` —
+ * ADR-015 secret-blindness, same shape as host_github_tokens). The cloud only
+ * ever sees the PUBLIC key, which the user pastes into GitHub themselves; there
+ * is no upload path. At task-up the private key is written into the task
+ * container so git-over-SSH works as the task creator.
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { eq } from "drizzle-orm";
+
+import { configuredCredentialStore, queueStoreWrite, userParameterName } from "./credential-store";
+import { getDb, schema } from "./db";
+import { env } from "./env";
+import { sealAesGcm, openAesGcm } from "./secrets";
+import { signInBoxMode } from "./signin-box";
+import { assertSafeHostTaskId } from "./task-identity";
+
+const withNewline = (s: string): string => (s.endsWith("\n") ? s : `${s}\n`);
+
+const EXEC_TIMEOUT_MS = 10_000;
+
+export interface GeneratedKey {
+  publicKey: string; // "ssh-ed25519 AAAA… <comment>"
+  privateKey: string; // OpenSSH private key PEM
+}
+
+/**
+ * Generate an ed25519 keypair via `ssh-keygen` (canonical OpenSSH formats that
+ * git + GitHub accept directly). Runs in a throwaway temp dir; nothing touches
+ * the operator's own ~/.ssh.
+ */
+export function generateEd25519(comment: string): GeneratedKey {
+  const dir = mkdtempSync(join(tmpdir(), "uai-ssh-"));
+  try {
+    const keyPath = join(dir, "id_ed25519");
+    const res = spawnSync(
+      "ssh-keygen",
+      ["-t", "ed25519", "-N", "", "-C", comment, "-f", keyPath],
+      { encoding: "utf8", timeout: EXEC_TIMEOUT_MS },
+    );
+    if (res.status !== 0) {
+      throw new Error(
+        `ssh-keygen failed: ${(res.stderr || res.error?.message || "").trim()}`,
+      );
+    }
+    return {
+      privateKey: readFileSync(keyPath, "utf8"),
+      publicKey: readFileSync(`${keyPath}.pub`, "utf8").trim(),
+    };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// --- key store --------------------------------------------------------------
+
+/** The user's public key, or null if they have no key on this host yet. */
+export function getPublicKey(userId: string): string | null {
+  const row = getDb()
+    .select({ publicKey: schema.sshKeys.publicKey })
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  return row?.publicKey ?? null;
+}
+
+export function hasKey(userId: string): boolean {
+  return getPublicKey(userId) !== null;
+}
+
+/**
+ * Ensure the user has a key on this host; generate + persist one if not.
+ * Idempotent — returns the (existing or freshly created) public key.
+ */
+export function ensureKeyForUser(userId: string): string {
+  const existing = getPublicKey(userId);
+  if (existing) return existing;
+
+  const { publicKey, privateKey } = generateEd25519(`uai-${userId}`);
+  const sealed = sealAesGcm(privateKey);
+  const now = Date.now();
+  getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId,
+      publicKey,
+      privateKeyCt: sealed.ct,
+      privateKeyNonce: sealed.nonce,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  mirrorSshKeyToStore(userId);
+  // Re-read in case a concurrent task-up won the insert race.
+  return getPublicKey(userId) ?? publicKey;
+}
+
+export function deleteKey(userId: string): void {
+  getDb().delete(schema.sshKeys).where(eq(schema.sshKeys.userId, userId)).run();
+  queueStoreWrite(`delete ssh key ${userId}`, (store) =>
+    store.delete(sshKeyParameterName(userId)),
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 2): `<prefix>/users/<userId>/ssh`.
+// A replacement Uai-operated host imports the SAME keypair, so the public key
+// the user pasted into GitHub keeps working. Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredSshKey {
+  v: 1;
+  kind: "ssh";
+  userId: string;
+  publicKey: string;
+  privateKey: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export function sshKeyParameterName(userId: string): string {
+  return userParameterName(userId, "ssh");
+}
+
+/** The row as it is mirrored (private key decrypted). Never logged. Null
+ *  for a store-held row (sign-in box): nothing here to mirror. */
+export function sshKeyStoreValue(userId: string): StoredSshKey | null {
+  const row = getDb()
+    .select()
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (!row || isStoreHeldSshRow(row)) return null;
+  return {
+    v: 1,
+    kind: "ssh",
+    userId,
+    publicKey: row.publicKey,
+    privateKey: openAesGcm(
+      Buffer.from(row.privateKeyCt as Uint8Array),
+      Buffer.from(row.privateKeyNonce as Uint8Array),
+    ),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function setSshKeyStoreRef(userId: string, storeRef: string): void {
+  getDb()
+    .update(schema.sshKeys)
+    .set({ storeRef })
+    .where(eq(schema.sshKeys.userId, userId))
+    .run();
+}
+
+export function listSshKeyStoreRows(): Array<{ userId: string; storeRef: string | null }> {
+  return getDb()
+    .select({ userId: schema.sshKeys.userId, storeRef: schema.sshKeys.storeRef })
+    .from(schema.sshKeys)
+    .all();
+}
+
+export function mirrorSshKeyToStore(userId: string): void {
+  // ADR-136 sign-in box: rows hold no material; the store was written first.
+  if (signInBoxMode()) return;
+  queueStoreWrite(`mirror ssh key ${userId}`, async (store) => {
+    const value = sshKeyStoreValue(userId);
+    if (!value) return;
+    const name = sshKeyParameterName(userId);
+    await store.put(name, JSON.stringify(value));
+    setSshKeyStoreRef(userId, name);
+  });
+}
+
+/** Reconcile import: a keypair this host lacks. Existing rows win. */
+export function importSshKeyFromStore(value: StoredSshKey, storeRef: string): boolean {
+  const sealed = sealAesGcm(value.privateKey);
+  const result = getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId: value.userId,
+      publicKey: value.publicKey,
+      privateKeyCt: sealed.ct,
+      privateKeyNonce: sealed.nonce,
+      createdAt: value.createdAt,
+      updatedAt: value.updatedAt,
+      storeRef,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  return result.changes > 0;
+}
+
+/** Decrypt + return the user's private key, or null if they have none (or
+ *  the row is store-held — the sign-in box never holds one). */
+export function privateKeyForUser(userId: string): string | null {
+  const row = getDb()
+    .select()
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (!row || isStoreHeldSshRow(row)) return null;
+  return openAesGcm(
+    Buffer.from(row.privateKeyCt as Uint8Array),
+    Buffer.from(row.privateKeyNonce as Uint8Array),
+  );
+}
+
+/** Decrypt + return BOTH halves of the user's key, or null if they have none. */
+export function keyPairForUser(
+  userId: string,
+): { privateKey: string; publicKey: string } | null {
+  const row = getDb()
+    .select()
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (!row || isStoreHeldSshRow(row)) return null;
+  return {
+    privateKey: openAesGcm(
+      Buffer.from(row.privateKeyCt as Uint8Array),
+      Buffer.from(row.privateKeyNonce as Uint8Array),
+    ),
+    publicKey: row.publicKey,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// ADR-136 sign-in box: a key row here holds NO private key (`private_key_ct`
+// empty — "store-held"); the keypair goes to the store first and only the
+// public half stays, which is all the box ever answers (`ssh.key.get`). The
+// public key also rides as a tag so a replacement box lists it without
+// reading the value.
+// ---------------------------------------------------------------------------
+
+export const SSH_KEY_TAGS = { publicKey: "uai_public_key", createdAt: "uai_created_at" } as const;
+
+export function isStoreHeldSshRow(row: { privateKeyCt: unknown }): boolean {
+  const ct = row.privateKeyCt;
+  if (ct === null || ct === undefined) return true;
+  if (ct instanceof Uint8Array) return ct.byteLength === 0;
+  return false;
+}
+
+export function sshKeyMetadataTags(value: { publicKey: string; createdAt: number }): Record<string, string> {
+  return {
+    [SSH_KEY_TAGS.publicKey]: value.publicKey,
+    [SSH_KEY_TAGS.createdAt]: String(value.createdAt),
+  };
+}
+
+/** A key row with no private half (sign-in box). Existing rows win. */
+export function insertStoreHeldSshKeyRow(args: {
+  userId: string;
+  publicKey: string;
+  createdAt: number;
+  updatedAt: number;
+  storeRef: string;
+}): boolean {
+  const result = getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId: args.userId,
+      publicKey: args.publicKey,
+      privateKeyCt: Buffer.alloc(0),
+      privateKeyNonce: Buffer.alloc(0),
+      createdAt: args.createdAt,
+      updatedAt: args.updatedAt,
+      storeRef: args.storeRef,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  return result.changes > 0;
+}
+
+/** Delete the row only (no store call). */
+export function deleteSshKeyRowLocal(userId: string): void {
+  getDb().delete(schema.sshKeys).where(eq(schema.sshKeys.userId, userId)).run();
+}
+
+/**
+ * `ensureKeyForUser` for the sign-in box: generate, write the keypair to the
+ * store FIRST (awaited — a refused put is the operation's failure and leaves
+ * nothing), tag the public key, then keep a store-held row. A row whose
+ * public key this box could not learn (a legacy parameter it may not read)
+ * is refused rather than silently regenerated over the user's real key.
+ */
+export async function ensureSshKeyStoreFirst(userId: string): Promise<string> {
+  const existing = getDb()
+    .select({ publicKey: schema.sshKeys.publicKey })
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (existing) {
+    if (existing.publicKey) return existing.publicKey;
+    throw new Error(
+      "this user's SSH key exists in the credential store but its public half is not tagged yet; re-run the sign-in box bootstrap with the transitional read",
+    );
+  }
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold the key");
+  const { publicKey, privateKey } = generateEd25519(`uai-${userId}`);
+  const now = Date.now();
+  const name = sshKeyParameterName(userId);
+  const value: StoredSshKey = {
+    v: 1,
+    kind: "ssh",
+    userId,
+    publicKey,
+    privateKey,
+    createdAt: now,
+    updatedAt: now,
+  };
+  await store.put(name, JSON.stringify(value));
+  try {
+    await store.tag(name, sshKeyMetadataTags(value));
+  } catch (err) {
+    console.warn(
+      `[ssh] user ${userId}: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a replacement box needs the transitional read to list this key`,
+    );
+  }
+  insertStoreHeldSshKeyRow({ userId, publicKey, createdAt: now, updatedAt: now, storeRef: name });
+  return getPublicKey(userId) ?? publicKey;
+}
+
+// --- per-task on-disk identity (optional SSH fallback + signing, ADR-029) -----
+//
+// task-up.sh uses the creator's key for host Git only when GitHub is not
+// connected, and installs it in the container for signing (plus that same
+// fallback). The cloud relays ssh.key.get/ensure/delete for the Account card
+// via the store functions above.
+
+function taskIdentityDir(taskId: string): string {
+  return resolve(env.dataDir, "identity", "tasks", taskId);
+}
+
+/**
+ * Materialize the task creator's keypair to a per-task on-disk identity that
+ * task-up.sh uses for the disconnected user's host-side SSH fallback and the
+ * container's optional signing/fallback identity (ADR-029). Connected users
+ * clone + push with their GitHub App user token over HTTPS instead.
+ * Returns the dir, or null when the creator has no key on this host. A task
+ * never borrows the host operator's identity: without a connected GitHub
+ * credential, SSH transport is available only through this owner's key. The
+ * decrypted key lives only on the trusted host (ADR-015) and is removed right
+ * after task-up — see {@link removeTaskIdentity}.
+ */
+export function writeTaskIdentity(
+  taskId: string,
+  userId: string | null | undefined,
+): string | null {
+  if (!userId) return null;
+  const pair = keyPairForUser(userId);
+  if (!pair) return null;
+  const dir = taskIdentityDir(taskId);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(resolve(dir, "id_ed25519"), withNewline(pair.privateKey), {
+    mode: 0o600,
+  });
+  writeFileSync(resolve(dir, "id_ed25519.pub"), withNewline(pair.publicKey), {
+    mode: 0o644,
+  });
+  return dir;
+}
+
+/** Remove a task's on-disk identity (idempotent; call after task-up). */
+export function removeTaskIdentity(taskId: string): void {
+  rmSync(taskIdentityDir(taskId), { recursive: true, force: true });
+}
+
+/** Orphan GC may acknowledge only after the materialized private key is
+ * positively absent. The caller first retires every task-scoped ensure, so no
+ * trusted host continuation can recreate this directory after the check. */
+export function removeTaskIdentityStrict(taskId: string): void {
+  assertSafeHostTaskId(taskId);
+  const dir = taskIdentityDir(taskId);
+  rmSync(dir, { recursive: true, force: true });
+  try {
+    lstatSync(dir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  throw new Error("task SSH identity remains after removal");
+}

package/lib/standard-image-cleanup.ts

@@ -0,0 +1,117 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, mkdirSync, openSync, readSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { CONTEXT_HASH_LABEL } from "./standard-image-pin";
+
+type Result = { code: number | null; stdout: string; stderr: string };
+export type DockerCommand = (command: string, args: string[], timeoutMs?: number) => Promise<Result>;
+const IMAGE_ID = /^sha256:[a-f0-9]{64}$/;
+const SWEEP_LIMIT = 16;
+const HISTORY_LIMIT = 128;
+const HISTORY_BYTES = 16 * 1024;
+
+/** Context labels are inherited by task images. Authority to delete comes
+ * from observing this exact id under the standard tag, never from a scan. */
+export class StandardImageCleanup {
+  private readonly observed = new Set<string>();
+  private loading: Promise<void> | undefined;
+  private statePath: string | undefined;
+
+  constructor(private readonly stateFile?: () => Promise<string>) {}
+
+  private async load(): Promise<void> {
+    if (!this.stateFile) return;
+    try {
+      this.statePath = await this.stateFile();
+      const fd = openSync(this.statePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > HISTORY_BYTES) return;
+        const bytes = Buffer.alloc(HISTORY_BYTES + 1);
+        const length = readSync(fd, bytes, 0, bytes.length, 0);
+        if (length > HISTORY_BYTES) return;
+        const value = JSON.parse(bytes.subarray(0, length).toString("utf8")) as { version?: unknown; ids?: unknown };
+        if (value?.version !== 1 || !Array.isArray(value.ids) || value.ids.length > HISTORY_LIMIT || !value.ids.every(id => typeof id === "string" && IMAGE_ID.test(id))) return;
+        for (const id of value.ids) this.observed.add(id as string);
+      } finally { closeSync(fd); }
+    } catch { /* Missing, corrupt or unreadable history authorizes nothing. */ }
+  }
+
+  private save(): void {
+    if (!this.statePath) return;
+    const temporary = `${this.statePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      mkdirSync(dirname(this.statePath), { recursive: true, mode: 0o700 });
+      writeFileSync(temporary, JSON.stringify({ version: 1, ids: [...this.observed] }), { flag: "wx", mode: 0o600 });
+      renameSync(temporary, this.statePath);
+    } catch {
+      // ENOSPC must not block a build or safe cleanup using in-memory proof.
+      console.warn("[host-agent] could not persist standard-image history");
+    } finally {
+      try { unlinkSync(temporary); } catch { /* Renamed or never created. */ }
+    }
+  }
+
+  async observe(run: DockerCommand, ref = "moondeck-standard:dev"): Promise<string | null> {
+    await (this.loading ??= this.load());
+    const result = await run("docker", ["image", "inspect", "--format", "{{json .}}", ref]);
+    if (result.code !== 0) return null;
+    try {
+      const image = JSON.parse(result.stdout) as { Id?: string; Config?: { Labels?: Record<string, string> } };
+      if (!IMAGE_ID.test(image.Id ?? "") || !/^[a-f0-9]{32}$/.test(image.Config?.Labels?.[CONTEXT_HASH_LABEL] ?? "")) return null;
+      if (ref === "moondeck-standard:dev") {
+        this.observed.delete(image.Id!);
+        this.observed.add(image.Id!);
+        if (this.observed.size > HISTORY_LIMIT) this.observed.delete(this.observed.values().next().value!);
+        this.save();
+      }
+      return image.Id!;
+    } catch { return null; }
+  }
+
+  async sweep(run: DockerCommand, previousId: string | null): Promise<void> {
+    const deadline = Date.now() + 30_000;
+    const boundedRun: DockerCommand = (command, args) => run(command, args, 5_000);
+    const currentId = await this.observe(boundedRun);
+    if (!currentId) return;
+    const history = await boundedRun("docker", ["image", "history", "--quiet", "--no-trunc", currentId]);
+    if (history.code !== 0) return;
+    const currentChain = new Set([currentId, ...history.stdout.trim().split(/\s+/)]);
+    const candidates = new Set([...(previousId ? [previousId] : []), ...this.observed]);
+    for (const id of [...candidates].filter(id => this.observed.has(id) && !currentChain.has(id)).slice(0, SWEEP_LIMIT)) {
+      if (Date.now() >= deadline) break;
+      // Round-robin retained/in-use ids so a busy prefix cannot starve later ids.
+      this.observed.delete(id);
+      this.observed.add(id);
+      const tags = await boundedRun("docker", ["image", "inspect", "--format", "{{json .RepoTags}}", id]);
+      if (tags.code !== 0) continue;
+      try { const parsed: unknown = JSON.parse(tags.stdout); if (parsed !== null && (!Array.isArray(parsed) || parsed.length !== 0)) continue; } catch { continue; }
+      const containers = await boundedRun("docker", ["ps", "--all", "--quiet", "--filter", `ancestor=${id}`]);
+      if (containers.code !== 0 || containers.stdout.trim()) continue;
+      // Normal Docker removal reclaims otherwise-unused untagged parents.
+      // Shared ancestors of the current image (or any other child/container)
+      // remain protected by the daemon. Never force or target a parent id.
+      const removed = await boundedRun("docker", ["image", "rm", id]);
+      if (removed.code === 0) {
+        this.observed.delete(id);
+        console.log("[host-agent] removed unused previous standard image", id);
+      }
+    }
+    this.save();
+  }
+}
+
+/** Per-process exponential retry, keyed by the desired content/configuration.
+ * A new host payload/engine configuration retries immediately. A restart also
+ * retries once; repeated failures back off 2h, 4h, …, 24h instead of hourly. */
+export class StandardImageBuildBackoff {
+  private state: { key: string; failures: number; retryAt: number; error: string } | null = null;
+  remaining(key: string, now = Date.now()): { delay: number; retryAt: number; error: string } | null {
+    return this.state?.key === key && this.state.retryAt > now ? { delay: this.state.retryAt - now, retryAt: this.state.retryAt, error: this.state.error } : null;
+  }
+  failed(key: string, error: string, now = Date.now()): void {
+    const failures = this.state?.key === key ? this.state.failures + 1 : 1;
+    this.state = { key, failures, retryAt: now + Math.min(24, 2 ** Math.min(failures, 5)) * 3_600_000, error };
+  }
+  clear(): void { this.state = null; }
+}