@namewta/speculo 1.0.5 → 1.0.7

package/template/workflows/ops/common/tools/opslib/services.mjs

@@ -0,0 +1,76 @@
+/** Typed shared-service allocation contracts. No guessing unknown service products. */
+import { identifier, OpsError } from "./core.mjs";
+
+export function secret(ref, field) {
+  return "{{credential:" + ref + ":" + field + "}}";
+}
+
+export function allocationOperation(status, dep, a, p) {
+  const adapter = p.adapter;
+  const project = status.projects[dep.project_id];
+  if (project.service_type !== adapter) throw new OpsError("allocation adapter differs from registered provider service_type");
+  if (!p.admin_credential_ref || p.admin_credential_ref === a.credential_ref) {
+    throw new OpsError("application credential must differ from administrator credential");
+  }
+  if (!dep.credential_refs.includes(p.admin_credential_ref)) {
+    throw new OpsError("admin credential must be registered on the provider deployment");
+  }
+  if (!p.app_username || !/^[A-Za-z][A-Za-z0-9_-]{1,47}$/.test(p.app_username)) {
+    throw new OpsError("application username needs an explicit safe name");
+  }
+  const service = dep.service;
+  const common = {
+    kind: adapter + "-allocation",
+    provider_root: dep.root,
+    compose_name: dep.compose_name,
+    resource: a.resource_name,
+    app_username: p.app_username,
+    app_password: secret(a.credential_ref, "password"),
+    admin_username: secret(p.admin_credential_ref, "username"),
+    admin_password: secret(p.admin_credential_ref, "password"),
+    owner_project_id: a.owner_project_id,
+    environment: a.environment,
+    credential_ref: a.credential_ref,
+  };
+  if (adapter === "mysql" || adapter === "redis") {
+    if (dep.method !== "compose" || !service.compose_service) {
+      throw new OpsError("built-in MySQL/Redis allocator requires a managed Compose provider and explicit compose_service");
+    }
+    common.compose_service = identifier(service.compose_service);
+  }
+  if (adapter === "mysql") {
+    if (a.resource_kind !== "database" || !/^[a-z][a-z0-9_]{1,47}$/.test(a.resource_name)) {
+      throw new OpsError("MySQL requires a safe logical database name");
+    }
+    const privileges = p.privileges ?? ["SELECT", "INSERT", "UPDATE", "DELETE"];
+    const allowed = new Set(["SELECT", "INSERT", "UPDATE", "DELETE", "CREATE", "ALTER", "INDEX", "REFERENCES", "DROP", "CREATE TEMPORARY TABLES", "EXECUTE"]);
+    if (!privileges.length || privileges.some((x) => !allowed.has(x))) {
+      throw new OpsError("unsupported MySQL grants; administrative/global privileges are forbidden");
+    }
+    common.privileges = privileges;
+  } else if (adapter === "redis") {
+    if (a.resource_kind !== "redis-acl" || !/^[a-zA-Z][a-zA-Z0-9:_-]+$/.test(p.prefix ?? "")) {
+      throw new OpsError("Redis shared allocation requires an explicit key prefix and redis-acl resource");
+    }
+    if (service.acl_persistence !== "data/redis/acl/users.acl") {
+      throw new OpsError("Redis provider must persist ACLs at data/redis/acl/users.acl and configure aclfile");
+    }
+    if (!["provider-wide", "application-export", "unverified"].includes(a.recovery_scope)) {
+      throw new OpsError("Redis prefix/ACL is not proof of independently restorable data");
+    }
+    common.prefix = p.prefix;
+  } else if (adapter === "minio") {
+    if (a.resource_kind !== "bucket" || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(a.resource_name)) {
+      throw new OpsError("MinIO allocation needs a valid bucket name");
+    }
+    if (!service.endpoint) throw new OpsError("MinIO provider requires explicit administrative endpoint");
+    if (p.allow_secret_argv !== true) {
+      throw new OpsError("mc admin user add exposes the new password briefly to privileged local process inspection; explicitly review allow_secret_argv or use an existing verified allocation");
+    }
+    if (!p.client_path) throw new OpsError("MinIO needs a reviewed installed mc client_path");
+    Object.assign(common, { endpoint: service.endpoint, client_path: p.client_path, secret_argv_acknowledged: true });
+  } else {
+    throw new OpsError("unknown provider adapter: use a version-verified explicit existing-resource probe, not guessed commands");
+  }
+  return common;
+}

package/template/workflows/ops/common/tools/opslib/sources.mjs

@@ -0,0 +1,56 @@
+/** Explicit pinned Git acquisition into controller-owned immutable source snapshots. */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { identifier, now, OpsError, privateDir, withLock, writeJson } from "./core.mjs";
+import { load } from "./model.mjs";
+import { analyze } from "./cli.mjs";
+
+export function fetchSource(state, projectId, repo, commit, allowNetwork) {
+  load(state);
+  identifier(projectId);
+  let u;
+  try { u = new URL(repo); } catch { throw new OpsError("use an explicit credential-free HTTPS repository URL; authentication belongs in an approved Git helper"); }
+  if (!allowNetwork) throw new OpsError("source-fetch requires explicit --allow-network");
+  if (u.protocol !== "https:" || !u.hostname || u.username || u.password) {
+    throw new OpsError("use an explicit credential-free HTTPS repository URL; authentication belongs in an approved Git helper");
+  }
+  if (!/^[a-f0-9]{40}$/.test(commit)) throw new OpsError("Git source must be pinned by full 40-character commit SHA");
+  const dest = join(state, "sources", projectId, commit);
+  const hooks = join(state, "sources", ".empty-hooks");
+  privateDir(hooks);
+  return withLock(join(state, ".locks", "source"), { project_id: projectId, commit }, () => {
+    const env = {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null",
+      GIT_LFS_SKIP_SMUDGE: "1",
+    };
+    const git = ["git", "-c", "core.hooksPath=" + hooks];
+    const run = (argv, timeout) => {
+      const p = spawnSync(argv[0], argv.slice(1), { env, encoding: "utf8", timeout });
+      if (p.error) throw p.error;
+      if (p.status !== 0) throw new Error(p.stderr || "git failed");
+      return p;
+    };
+    if (!existsSync(dest)) {
+      privateDir(join(state, "sources", projectId));
+      run([...git, "clone", "--no-checkout", "--", repo, dest], 600000);
+      run([...git, "-C", dest, "checkout", "--detach", commit], 300000);
+    }
+    const actual = run([...git, "-C", dest, "rev-parse", "HEAD"], 30000).stdout.trim();
+    if (actual !== commit) throw new OpsError("source snapshot identity mismatch; do not overwrite existing checkout");
+    const result = {
+      project_id: projectId,
+      repository: repo,
+      commit,
+      path: dest,
+      at: now(),
+      analysis: analyze(dest),
+      submodules: "not initialized; each requires independent pinned review",
+    };
+    writeJson(join(state, "sources", projectId, commit + ".source.json"), result);
+    return result;
+  });
+}

package/template/workflows/ops/common/tools/opslib/transport.mjs

@@ -0,0 +1,127 @@
+/** Strict host-key SSH and subprocess local transport. No passwords in argv. */
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { canonical, digest, noSymlinks, OpsError, redact, UnknownResult } from "./core.mjs";
+import { fingerprint } from "./agent.mjs";
+
+const AGENT = join(dirname(fileURLToPath(import.meta.url)), "agent.mjs");
+
+export const transportHooks = { spawnSync };
+
+function shlexQuote(s) {
+  if (s === "") return "''";
+  if (/[^\w@%+=:,./-]/.test(s)) return "'" + s.replaceAll("'", "'\"'\"'") + "'";
+  return s;
+}
+function shlexJoin(args) {
+  return args.map(shlexQuote).join(" ");
+}
+
+export function hostTransportDigest(host) {
+  const c = host.connection;
+  let kh = null;
+  if (host.transport === "ssh") {
+    const p = c.known_hosts;
+    noSymlinks(p, { allowMissing: false });
+    kh = digest(readFileSync(p));
+  }
+  return digest({ host, known_hosts_digest: kh });
+}
+
+function injectRequest(source, request) {
+  const b64 = Buffer.from(canonical(request)).toString("base64");
+  const assign = `globalThis.OPS_REQUEST = JSON.parse(Buffer.from(${JSON.stringify(b64)}, "base64").toString("utf8"));`;
+  const lines = source.split(/\r?\n/);
+  let lastImport = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*import\s/.test(lines[i])) lastImport = i;
+  }
+  lines.splice(lastImport + 1, 0, assign);
+  return lines.join("\n");
+}
+
+export function call(host, request, { timeout = 1800 } = {}) {
+  request = { identity: host.identity, ...request };
+  const content = injectRequest(readFileSync(AGENT, "utf8"), request);
+  if (host.transport === "local") {
+    const argv = [process.execPath, "--input-type=module"];
+    let p;
+    try {
+      p = transportHooks.spawnSync(argv[0], argv.slice(1), {
+        input: content,
+        encoding: "utf8",
+        timeout: timeout * 1000,
+        maxBuffer: 64 * 1024 * 1024,
+        windowsHide: true,
+      });
+    } catch (e) {
+      if (["step", "lock", "unlock"].includes(request.action)) throw new UnknownResult("target transport interrupted; inspect receipts before retry");
+      throw new OpsError("target read unavailable: " + e);
+    }
+    return decode(p, request);
+  }
+  const c = host.connection;
+  const kh = resolve(c.known_hosts);
+  noSymlinks(kh, { allowMissing: false });
+  const argv = ["ssh", "-T", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=yes", "-o", `UserKnownHostsFile=${kh}`,
+    "-o", "ConnectTimeout=15", "-o", "ServerAliveInterval=15", "-o", "ServerAliveCountMax=3", "-p", String(c.port ?? 22)];
+  if (c.identity_file) argv.push("-i", c.identity_file, "-o", "IdentitiesOnly=yes");
+  let remote = [c.node, "--input-type=module"];
+  if (c.sudo) remote = ["sudo", "-n", "--", ...remote];
+  let remoteCommand;
+  if ((c.shell ?? "posix") === "powershell") {
+    if (c.sudo) throw new OpsError("sudo not valid for PowerShell transport");
+    const inner = "& " + remote.map((x) => "'" + x.replaceAll("'", "''") + "'").join(" ");
+    const ps = Buffer.from(inner, "utf16le").toString("base64");
+    remoteCommand = "powershell -NoProfile -NonInteractive -EncodedCommand " + ps;
+  } else {
+    remoteCommand = shlexJoin(remote);
+  }
+  argv.push("--", c.username + "@" + c.hostname, remoteCommand);
+  let p;
+  try {
+    p = transportHooks.spawnSync(argv[0], argv.slice(1), {
+      input: content,
+      encoding: "buffer",
+      timeout: timeout * 1000,
+      maxBuffer: 64 * 1024 * 1024,
+      windowsHide: true,
+    });
+  } catch (e) {
+    if (["step", "lock", "unlock"].includes(request.action)) throw new UnknownResult("target transport interrupted; inspect receipts before retry");
+    throw new OpsError("target read unavailable: " + e);
+  }
+  return decode(p, request);
+}
+
+function decode(p, request) {
+  if (p.error && (p.error.code === "ETIMEDOUT" || p.signal === "SIGTERM")) {
+    if (["step", "lock", "unlock"].includes(request.action)) throw new UnknownResult("target transport interrupted; inspect receipts before retry");
+    throw new OpsError("target read unavailable: " + p.error);
+  }
+  const stdout = Buffer.isBuffer(p.stdout) ? p.stdout.toString("utf8") : (p.stdout || "");
+  const stderr = Buffer.isBuffer(p.stderr) ? p.stderr.toString("utf8") : (p.stderr || "");
+  if (p.status !== 0) {
+    const text = redact(stderr, request.secrets || []).slice(-2000);
+    if (["step", "lock", "unlock"].includes(request.action)) throw new UnknownResult("target transport failed: " + text);
+    throw new OpsError("target read failed: " + text);
+  }
+  let value;
+  try { value = JSON.parse(stdout); }
+  catch { throw new UnknownResult("invalid target response; stdout noise or interrupted operation"); }
+  if (!value.ok) throw new OpsError("target blocked: " + (value.error || "unknown"));
+  return value.result;
+}
+
+export function probeLocal() {
+  const host = {
+    host_id: "probe-local",
+    platform: process.platform === "win32" ? "windows" : "linux",
+    transport: "local",
+    connection: {},
+    identity: fingerprint(),
+  };
+  return call(host, { action: "probe" }, { timeout: 120 });
+}