@moondeck/station 0.0.1 → 1.0.1

package/scripts/agent/task-down.sh

@@ -0,0 +1,291 @@
+#!/usr/bin/env bash
+# task-down <taskId> — tear the task stack down. Idempotent (ADR-022).
+#
+# 1. docker compose down -v --rmi local --remove-orphans.
+# 2. rm -rf the whole task dir — workspace + task-private Git repositories.
+#    Host caches under projects/<id>/host-cache.git persist.
+# 3. Persist final state: status=killed (unless already error/shipped).
+#
+# Destruction needs explicit terminal intent: the runner sets
+# UAI_TASK_DOWN_TERMINAL=1 only on the cloud taskDown path (a task close or
+# orphan GC). Without it the script refuses before touching Docker or disk —
+# a stray caller (recovery, a credential-cleanup fallback, an operator
+# running the script by hand) must never delete a live task's worktree
+# (2026-10-20: a cleanup fallback did, while Docker was briefly gone).
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=_common.sh
+. "$SCRIPT_DIR/_common.sh"
+# The station's standard image (task-up.sh STANDARD_IMAGE): local whenever a
+# Docker task has run here, and only ever run with --pull never.
+TASK_CLEANUP_IMAGE="moondeck-standard:dev"
+
+[ "$#" -eq 1 ] || emit_err "BAD_ARGS" "usage: task-down <taskId>" "args"
+
+task_id="$1"
+# Make the ASCII security grammar independent of the operator's collation.
+export LC_ALL=C
+if [ "${#task_id}" -gt 128 ] ||
+   [[ ! "$task_id" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
+  emit_err "BAD_ARGS" "invalid task id" "task identity validation"
+fi
+# Before UAI_TASK_ID is set: a refusal must not mark the live task errored.
+if [ "${UAI_TASK_DOWN_TERMINAL:-}" != "1" ]; then
+  emit_err "BAD_ARGS" \
+    "task-down requires terminal intent (UAI_TASK_DOWN_TERMINAL=1, set only by the cloud taskDown); refusing to destroy task $task_id" \
+    "terminal intent"
+fi
+UAI_TASK_ID="$task_id"
+setup_err_trap
+validate_task_runtime_selection
+
+step "TASK_NOT_FOUND" "read task row"
+# Teardown must never depend on bookkeeping: a broken/missing command
+# snapshot (seen live 2026-07-21 cleaning up after a failed task-up —
+# db_get_task errored, the trap reported TASK_NOT_FOUND, and the container
+# survived) still tears the stack down by convention-derived names.
+task_json=$(db_get_task "$task_id" 2>/dev/null) || task_json="[]"
+row_count=$(jq 'length' <<<"$task_json" 2>/dev/null) || row_count=0
+if [ "$row_count" -lt 1 ]; then
+  log "task row unavailable — tearing down by derived names"
+else
+  UAI_RETRY_STATUS=$(jq -r '.[0].status // ""' <<<"$task_json")
+fi
+# Persisted runtime paths are recovery hints, never deletion authority. A
+# corrupt row must not aim compose/rm outside this exact task identity.
+compose_project=$(compose_project_for_task "$task_id")
+task_dir="$UAI_WORKSPACE_ROOT/tasks/$task_id"
+
+# -----------------------------------------------------------------------------
+# 1. Compose stack.
+# -----------------------------------------------------------------------------
+
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  step "COMPOSE_DOWN_FAILED" "remove task container"
+  app_container=$(apple_app_container_for_task "$task_id")
+  derived_image="moondeck-task-${task_id}"
+  # Ownership proof before destruction (review 2026-08-18 rounds 5+6): every
+  # container Uai creates carries io.moondeck.task=<id>. Destruction requires the
+  # inspect response to prove EXACT identity — exactly one record, whose
+  # top-level id is the requested name, carrying the exact label — the same
+  # response-confusion discipline recovery applies. A container merely
+  # OCCUPYING the reserved name, or a confused/multi-record answer, is not
+  # authority to delete anything.
+  if existing_json=$(crt inspect "$app_container" 2>/dev/null); then
+    existing_ok=$(printf '%s' "$existing_json" \
+      | jq -r --arg name "$app_container" --arg tid "$task_id" '
+          if (type == "array" and length == 1
+              and (.[0] | type == "object")
+              and .[0].id == $name
+              and ((.[0].configuration.labels["io.moondeck.task"] // "") == $tid))
+          then "ok" else "mismatch" end' 2>/dev/null) \
+      || existing_ok="mismatch"
+    if [ "$existing_ok" != "ok" ]; then
+      emit_err "COMPOSE_DOWN_FAILED" \
+        "A container named $app_container exists but could not be proven as this task's own (exact identity + ownership label); Moondeck will not delete a container it cannot prove it owns. Remove or rename it, then retry." \
+        "remove task container"
+    fi
+    crt stop --time 10 "$app_container" >/dev/null 2>&1 || true
+    crt delete --force "$app_container" >/dev/null 2>&1 || true
+  fi
+  # A derived image is task-private; removing it mirrors `down --rmi local`.
+  crt image delete "$derived_image" >/dev/null 2>&1 || true
+  # Destruction is not best-effort: prove the container is gone before the
+  # writable Git data below is deleted or success is reported. A CLI failure
+  # that does not name this container as not-found proves nothing — the
+  # workspace and its Git data must survive until absence is confirmed. The
+  # Apple runtime has no per-task networks or sidecars; its one per-task
+  # volume (the ADR-118 store) is removed under the same ownership proof
+  # below.
+  if crt inspect "$app_container" >/dev/null 2>&1; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "task runtime resources remain after teardown" \
+      "container verification after cleanup"
+  fi
+  if ! apple_container_proven_absent "$app_container"; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify task container removal; refusing to delete the task workspace" \
+      "container verification after cleanup"
+  fi
+  # ADR-118: the task's store volume. Deleting only after the container is
+  # proven absent releases the attachment; the same exact-identity +
+  # ownership-label discipline gates destruction, and absence must be proven
+  # before success is reported — a leaked volume defeats the orphan GC that
+  # keys on this exact name. A pre-ADR-118 task simply has no such volume
+  # and passes straight through the absence proof.
+  step "COMPOSE_DOWN_FAILED" "remove task store volume"
+  store_volume=$(apple_store_volume_for_task "$task_id")
+  if store_volume_json=$(crt volume inspect "$store_volume" 2>/dev/null); then
+    store_volume_ok=$(printf '%s' "$store_volume_json" \
+      | jq -r --arg name "$store_volume" --arg tid "$task_id" '
+          if (type == "array" and length == 1
+              and (.[0] | type == "object")
+              and .[0].id == $name
+              and ((.[0].configuration.labels["io.moondeck.task"] // "") == $tid))
+          then "ok" else "mismatch" end' 2>/dev/null) \
+      || store_volume_ok="mismatch"
+    if [ "$store_volume_ok" != "ok" ]; then
+      emit_err "COMPOSE_DOWN_FAILED" \
+        "A volume named $store_volume exists but could not be proven as this task's own (exact identity + ownership label); Moondeck will not delete a volume it cannot prove it owns. Remove or rename it, then retry." \
+        "remove task store volume"
+    fi
+    crt volume delete "$store_volume" >/dev/null 2>&1 || true
+  fi
+  if ! apple_volume_proven_absent "$store_volume"; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify task store volume removal; refusing to delete the task workspace" \
+      "store volume verification after cleanup"
+  fi
+else
+  uai_require_compose_plugin
+  step "COMPOSE_DOWN_FAILED" "docker compose down -v --rmi local"
+  if [ ! -L "$task_dir" ] && [ -f "$task_dir/.uai/docker-compose.yml" ]; then
+    docker compose -p "$compose_project" -f "$task_dir/.uai/docker-compose.yml" \
+      down -v --rmi local --remove-orphans >/dev/null 2>&1 || true
+  else
+    # Fallback: tear down by project name only.
+    docker compose -p "$compose_project" down -v --rmi local --remove-orphans >/dev/null 2>&1 || true
+  fi
+  # `compose down` is intentionally best-effort because an already-absent
+  # stack can make a config-less fallback fail. Destruction itself is not
+  # best-effort: before deleting the worktree or reporting success, prove that
+  # no task-owned container/network/volume remains under exact labels.
+  preview_containers=""
+  if ! preview_containers=$(docker ps -aq \
+    --filter "label=io.moondeck.preview-sidecar.task=$task_id"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify preview teardown for task $task_id" \
+      "docker ps after preview teardown"
+  fi
+  if [ -n "$preview_containers" ]; then
+    # Docker ids contain no whitespace; intentional splitting passes each exact
+    # id as its own argv entry.
+    # shellcheck disable=SC2086
+    docker rm -f $preview_containers >/dev/null 2>&1 || \
+      emit_err "COMPOSE_DOWN_FAILED" "could not remove task preview sidecars" "docker rm previews"
+  fi
+
+  remaining_containers=""
+  if ! remaining_containers=$(docker ps -aq \
+    --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify teardown for compose project $compose_project" \
+      "docker ps after compose down"
+  fi
+  if [ -n "$remaining_containers" ]; then
+    # shellcheck disable=SC2086
+    docker rm -f $remaining_containers >/dev/null 2>&1 || \
+      emit_err "COMPOSE_DOWN_FAILED" "could not remove compose containers" "docker rm after compose down"
+  fi
+
+  remaining_networks=""
+  if ! remaining_networks=$(docker network ls -q \
+    --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify compose networks for $compose_project" \
+      "docker network ls after compose down"
+  fi
+  if [ -n "$remaining_networks" ]; then
+    # shellcheck disable=SC2086
+    docker network rm $remaining_networks >/dev/null 2>&1 || \
+      emit_err "COMPOSE_DOWN_FAILED" "could not remove compose networks" "docker network rm"
+  fi
+
+  remaining_volumes=""
+  if ! remaining_volumes=$(docker volume ls -q \
+    --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify compose volumes for $compose_project" \
+      "docker volume ls after compose down"
+  fi
+  if [ -n "$remaining_volumes" ]; then
+    # shellcheck disable=SC2086
+    docker volume rm $remaining_volumes >/dev/null 2>&1 || \
+      emit_err "COMPOSE_DOWN_FAILED" "could not remove compose volumes" "docker volume rm"
+  fi
+
+  # Re-query every exact label. A successful remove command is not itself proof,
+  # and a failed query is unknown rather than empty.
+  verified_previews=""
+  verified_containers=""
+  verified_networks=""
+  verified_volumes=""
+  if ! verified_previews=$(docker ps -aq --filter "label=io.moondeck.preview-sidecar.task=$task_id") ||
+     ! verified_containers=$(docker ps -aq --filter "label=com.docker.compose.project=$compose_project") ||
+     ! verified_networks=$(docker network ls -q --filter "label=com.docker.compose.project=$compose_project") ||
+     ! verified_volumes=$(docker volume ls -q --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify task runtime cleanup" \
+      "docker label verification after cleanup"
+  fi
+  if [ -n "$verified_previews" ] || [ -n "$verified_containers" ] ||
+     [ -n "$verified_networks" ] || [ -n "$verified_volumes" ]; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "task runtime resources remain after teardown" \
+      "docker label verification after cleanup"
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+# 2. Remove the entire task directory (workspace + task-private Git data).
+# No host Git command reads a repository that the just-removed container could
+# have modified. Legacy shared-mirror worktree metadata may remain stale, but
+# that retired `repo.git` path is never trusted by task-up again.
+# -----------------------------------------------------------------------------
+
+if [ -e "$task_dir" ] || [ -L "$task_dir" ]; then
+  step "WORKTREE_REMOVE_FAILED" "rm -rf task dir"
+  if ! rm -rf "$task_dir" 2>/dev/null \
+     && [ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+     && [ ! -L "$task_dir" ] && [ -d "$task_dir" ]; then
+    # On Linux the task's container writes its files as node (1000) into the
+    # bind-mounted workspace, in directories without group write. A host user
+    # that is not uid 1000 (an OrbStack VM's 501, say) then can't remove them:
+    # "Permission denied", and the task stayed `stopped` (2026-11-01
+    # rehearsal). Remove what is left as root in a throwaway container that
+    # sees only this task directory: no network, every capability dropped but
+    # the two that deleting another user's files needs, and `find -delete`,
+    # which never follows a link out of the mount. The image runs by the ID
+    # its tag names right now, so the tag can't be swapped between the look
+    # and the run; without a well-formed ID nothing runs, and the absence
+    # check below reports the leftover.
+    step "WORKTREE_REMOVE_FAILED" "remove the task container's files"
+    cleanup_image_id="$(docker image inspect --format '{{.Id}}' "$TASK_CLEANUP_IMAGE" 2>/dev/null || true)"
+    if printf '%s\n' "$cleanup_image_id" | grep -Eqx 'sha256:[0-9a-f]{64}'; then
+      docker run --rm --pull never --network none --user 0:0 \
+        --cap-drop ALL --cap-add DAC_OVERRIDE --cap-add FOWNER \
+        --security-opt no-new-privileges --entrypoint /usr/bin/find \
+        -v "$task_dir:/task" "$cleanup_image_id" /task -mindepth 1 -delete \
+        >/dev/null 2>&1 || true
+    fi
+    rm -rf "$task_dir" 2>/dev/null || true
+  fi
+fi
+[ ! -e "$task_dir" ] && [ ! -L "$task_dir" ] || \
+  emit_err "WORKTREE_REMOVE_FAILED" "task directory remains after teardown" "task dir verification"
+
+# -----------------------------------------------------------------------------
+# 3. Persist final state.
+# -----------------------------------------------------------------------------
+
+current_status=$(jq -r '.[0].status // ""' <<<"$task_json")
+if [ "$current_status" != "shipped" ] && [ "$current_status" != "error" ]; then
+  new_status="killed"
+else
+  new_status="$current_status"
+fi
+
+step "DB_UPDATE_FAILED" "persist final state"
+db_update_task "$task_id" \
+  "status='$new_status'" \
+  "code_server_port=NULL" \
+  "preview_ports='[]'" \
+  "compose_project=NULL" \
+  "worktree_path=NULL" \
+  "locked_at=NULL" \
+  "ended_at=(unixepoch()*1000)"
+
+emit_event "$task_id" "status_changed" "$(jq -nc --arg f "$current_status" --arg t "$new_status" '{from:$f,to:$t}')"
+
+emit_ok "$(jq -nc --arg s "$new_status" '{status:$s}')"

package/scripts/agent/task-status.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# task-status <taskId> — introspect the actual runtime state.
+#
+# Returns the truth from docker / git / process listings rather than
+# trusting the Task row. Used by POST /api/tasks/:id/reconcile to detect
+# drift after a manual `docker compose down` or similar.
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=_common.sh
+. "$SCRIPT_DIR/_common.sh"
+
+[ "$#" -eq 1 ] || emit_err "BAD_ARGS" "usage: task-status <taskId>" "args"
+
+task_id="$1"
+UAI_TASK_ID="$task_id"
+setup_err_trap
+
+step "TASK_NOT_FOUND" "read task row"
+validate_task_runtime_selection
+
+task_json=$(db_get_task "$task_id")
+[ "$(jq 'length' <<<"$task_json")" -ge 1 ] \
+  || emit_err "TASK_NOT_FOUND" "no such task: $task_id" "read task row"
+
+compose_project=$(jq -r '.[0].compose_project // ""' <<<"$task_json")
+worktree_path=$(jq -r '.[0].worktree_path // ""' <<<"$task_json")
+
+# Containers running under this task, JSON array of names.
+step "DOCKER_PS_FAILED" "docker ps"
+containers_json="[]"
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # Absence (inspect exit 1) is a definitive "not running" answer, never an
+  # unknown-state error; only a live "running" state lists the container.
+  apple_app=$(apple_app_container_for_task "$task_id")
+  apple_state=$(crt inspect "$apple_app" 2>/dev/null \
+    | jq -r '.[0].status.state // empty' 2>/dev/null) || apple_state=""
+  if [ "$apple_state" = "running" ]; then
+    containers_json=$(jq -nc --arg n "$apple_app" '[$n]')
+  fi
+elif [ -n "$compose_project" ]; then
+  if ! raw=$(docker ps --filter "label=com.docker.compose.project=$compose_project" --format '{{.Names}}'); then
+    jq -nc \
+      --arg m "docker ps did not answer; runtime state is unknown" \
+      '{ok:false,error:{code:"DOCKER_PS_FAILED",message:$m,step:"docker ps"}}' >&2
+    exit 1
+  fi
+  if [ -n "$raw" ]; then
+    containers_json=$(printf '%s\n' "$raw" | jq -R . | jq -sc .)
+  fi
+fi
+
+# Compose running iff at least one container is up.
+if [ "$containers_json" = "[]" ]; then
+  compose_running="false"
+else
+  compose_running="true"
+fi
+
+# Worktree present iff the directory exists.
+worktree_present="false"
+if [ -n "$worktree_path" ] && [ -d "$worktree_path" ]; then
+  worktree_present="true"
+fi
+
+emit_ok "$(jq -nc \
+  --argjson cr "$compose_running" \
+  --argjson cs "$containers_json" \
+  --argjson wp "$worktree_present" \
+  '{composeRunning:$cr,containers:$cs,worktreePresent:$wp}')"