@ouro.bot/cli 0.1.0-alpha.733 → 0.1.0-alpha.734

package/dist/heart/daemon/sanctuary-acceptance-marker.js

@@ -0,0 +1,267 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.boundDirectoryEntryPath = boundDirectoryEntryPath;
+exports.secureRenameBoundInodeSync = secureRenameBoundInodeSync;
+exports.readSanctuaryAcceptanceMarker = readSanctuaryAcceptanceMarker;
+exports.writeSanctuaryAcceptanceMarker = writeSanctuaryAcceptanceMarker;
+exports.clearSanctuaryAcceptanceMarker = clearSanctuaryAcceptanceMarker;
+exports.quarantineSanctuaryAcceptanceMarker = quarantineSanctuaryAcceptanceMarker;
+exports.sanctuaryAcceptanceEventMeta = sanctuaryAcceptanceEventMeta;
+exports.publishSanctuaryAcceptanceGateStatus = publishSanctuaryAcceptanceGateStatus;
+exports.clearSanctuaryAcceptanceGateStatus = clearSanctuaryAcceptanceGateStatus;
+exports.runWithSanctuaryAcceptanceApproval = runWithSanctuaryAcceptanceApproval;
+exports.readSanctuaryAcceptanceApproval = readSanctuaryAcceptanceApproval;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_async_hooks_1 = require("node:async_hooks");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const identity_1 = require("../identity");
+const runtime_1 = require("../../nerves/runtime");
+const SHA256 = /^[0-9a-f]{64}$/u;
+const acceptanceApproval = new node_async_hooks_1.AsyncLocalStorage();
+const DEFAULT_GATE_STATUS_PATH = "/evidence/current-scenario-gate.json";
+const SAFE_RENAME_HELPER = path.resolve(__dirname, "../../../deploy/unraid/sanctuary-safe-rename.py");
+function requireBasename(name) {
+    if (name.length === 0 || name === "." || name === ".." || path.basename(name) !== name || name.includes("/") || name.includes("\0")) {
+        throw new Error("acceptance quarantine coordinates must be basenames");
+    }
+}
+function boundDirectoryEntryPath(directoryHandle, directoryPath, name) {
+    requireBasename(name);
+    return process.platform === "linux" ? `/proc/self/fd/${directoryHandle}/${name}` : path.join(directoryPath, name);
+}
+function secureRenameBoundInodeSync(sourceDirectoryHandle, sourceName, destinationDirectoryHandle, destinationName, expected) {
+    requireBasename(sourceName);
+    requireBasename(destinationName);
+    const result = (0, node_child_process_1.spawnSync)("/usr/bin/python3", [SAFE_RENAME_HELPER, sourceName, destinationName, String(expected.dev), String(expected.ino)], {
+        cwd: "/", encoding: "utf8", timeout: 5_000, maxBuffer: 16 * 1024,
+        env: { PATH: "/usr/bin:/bin" }, stdio: ["ignore", "ignore", "pipe", sourceDirectoryHandle, destinationDirectoryHandle],
+    });
+    if (result.error || result.status !== 0)
+        throw new Error("acceptance quarantine bound rename failed");
+}
+function markerPath(agentName, configuredAgentRoot) {
+    return path.join(configuredAgentRoot ?? (0, identity_1.getAgentRoot)(agentName), "state", "acceptance", "active-scenario.json");
+}
+function parseMarker(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("acceptance marker is corrupt");
+    const marker = value;
+    if (JSON.stringify(Object.keys(marker).sort()) !== JSON.stringify(["label", "scenarioHandleDigest", "schemaVersion", "startedAt"])) {
+        throw new Error("acceptance marker is corrupt");
+    }
+    if (marker.schemaVersion !== "sanctuary-acceptance-marker-v1"
+        || typeof marker.label !== "string" || marker.label.length === 0
+        || typeof marker.scenarioHandleDigest !== "string" || !SHA256.test(marker.scenarioHandleDigest)
+        || typeof marker.startedAt !== "string" || new Date(marker.startedAt).toISOString() !== marker.startedAt) {
+        throw new Error("acceptance marker is corrupt");
+    }
+    return marker;
+}
+function readSanctuaryAcceptanceMarker(agentName, configuredAgentRoot) {
+    if (agentName !== "sanctuary")
+        return null;
+    const filePath = markerPath(agentName, configuredAgentRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    return parseMarker(JSON.parse(raw));
+}
+function writeSanctuaryAcceptanceMarker(agentName, marker, configuredAgentRoot) {
+    if (agentName !== "sanctuary")
+        throw new Error("acceptance markers are restricted to Sanctuary");
+    const parsed = parseMarker(marker);
+    const filePath = markerPath(agentName, configuredAgentRoot);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const temporary = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(parsed)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    fs.renameSync(temporary, filePath);
+    fs.chmodSync(filePath, 0o600);
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_marker_written", message: "Sanctuary acceptance marker published", meta: { label: parsed.label, scenarioHandleDigest: parsed.scenarioHandleDigest } });
+}
+function clearSanctuaryAcceptanceMarker(agentName, scenarioHandleDigest, configuredAgentRoot) {
+    if (!SHA256.test(scenarioHandleDigest))
+        throw new Error("scenario handle digest is invalid");
+    const current = readSanctuaryAcceptanceMarker(agentName, configuredAgentRoot);
+    if (!current)
+        return;
+    if (current.scenarioHandleDigest !== scenarioHandleDigest)
+        throw new Error("acceptance marker ownership mismatch");
+    fs.unlinkSync(markerPath(agentName, configuredAgentRoot));
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_marker_cleared", message: "Sanctuary acceptance marker cleared", meta: { scenarioHandleDigest } });
+}
+function quarantineSanctuaryAcceptanceMarker(agentName, configuredAgentRoot) {
+    if (agentName !== "sanctuary")
+        throw new Error("acceptance markers are restricted to Sanctuary");
+    const filePath = markerPath(agentName, configuredAgentRoot);
+    const sourceParent = path.dirname(filePath);
+    const quarantineRoot = path.join(sourceParent, "quarantine");
+    let markerPathMetadata;
+    try {
+        markerPathMetadata = fs.lstatSync(filePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const sourceParentHandle = fs.openSync(sourceParent, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+    let markerHandle = null;
+    let quarantineHandle = null;
+    const rejectedPath = path.join(sourceParent, `.quarantine-rejected-${(0, node_crypto_1.randomUUID)()}`);
+    const quarantinePath = path.join(quarantineRoot, `active-scenario-${(0, node_crypto_1.randomUUID)()}.json`);
+    try {
+        const sourceParentMetadata = fs.fstatSync(sourceParentHandle);
+        const sourceParentPathMetadata = fs.lstatSync(sourceParent);
+        if (!sourceParentMetadata.isDirectory() || !sourceParentPathMetadata.isDirectory()
+            || sourceParentMetadata.dev !== sourceParentPathMetadata.dev || sourceParentMetadata.ino !== sourceParentPathMetadata.ino)
+            throw new Error("acceptance marker parent changed during quarantine");
+        const boundMarkerPath = boundDirectoryEntryPath(sourceParentHandle, sourceParent, path.basename(filePath));
+        const boundQuarantineRoot = boundDirectoryEntryPath(sourceParentHandle, sourceParent, path.basename(quarantineRoot));
+        const boundRejectedPath = boundDirectoryEntryPath(sourceParentHandle, sourceParent, path.basename(rejectedPath));
+        if (markerPathMetadata.isFile())
+            markerHandle = fs.openSync(boundMarkerPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        if (markerHandle !== null) {
+            const markerMetadata = fs.fstatSync(markerHandle);
+            markerPathMetadata = fs.lstatSync(boundMarkerPath);
+            if (!markerMetadata.isFile() || !markerPathMetadata.isFile() || markerMetadata.dev !== markerPathMetadata.dev || markerMetadata.ino !== markerPathMetadata.ino)
+                throw new Error("acceptance marker changed during quarantine");
+        }
+        let quarantineExists = false;
+        let rejectedMetadata = null;
+        try {
+            const existing = fs.lstatSync(boundQuarantineRoot);
+            if (!existing.isDirectory()) {
+                secureRenameBoundInodeSync(sourceParentHandle, path.basename(quarantineRoot), sourceParentHandle, path.basename(rejectedPath), existing);
+                const rejected = fs.lstatSync(boundRejectedPath);
+                if (rejected.dev !== existing.dev || rejected.ino !== existing.ino)
+                    throw new Error("acceptance marker quarantine rejection changed during move");
+                rejectedMetadata = rejected;
+            }
+            else
+                quarantineExists = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (!quarantineExists)
+            fs.mkdirSync(boundQuarantineRoot, { mode: 0o700 });
+        quarantineHandle = fs.openSync(boundQuarantineRoot, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+        const quarantineMetadata = fs.fstatSync(quarantineHandle);
+        const quarantinePathMetadata = fs.lstatSync(boundQuarantineRoot);
+        if (!quarantineMetadata.isDirectory() || !quarantinePathMetadata.isDirectory()
+            || quarantineMetadata.dev !== quarantinePathMetadata.dev || quarantineMetadata.ino !== quarantinePathMetadata.ino)
+            throw new Error("acceptance marker quarantine root changed");
+        fs.fchmodSync(quarantineHandle, 0o700);
+        if (rejectedMetadata) {
+            secureRenameBoundInodeSync(sourceParentHandle, path.basename(rejectedPath), quarantineHandle, path.basename(rejectedPath).slice(1), rejectedMetadata);
+        }
+        const finalMarkerPathMetadata = fs.lstatSync(boundMarkerPath);
+        if (finalMarkerPathMetadata.dev !== markerPathMetadata.dev || finalMarkerPathMetadata.ino !== markerPathMetadata.ino)
+            throw new Error("acceptance marker changed before quarantine move");
+        secureRenameBoundInodeSync(sourceParentHandle, path.basename(filePath), quarantineHandle, path.basename(quarantinePath), markerPathMetadata);
+        const movedMarkerMetadata = fs.lstatSync(boundDirectoryEntryPath(quarantineHandle, quarantineRoot, path.basename(quarantinePath)));
+        if (movedMarkerMetadata.dev !== markerPathMetadata.dev || movedMarkerMetadata.ino !== markerPathMetadata.ino)
+            throw new Error("acceptance marker changed during quarantine move");
+        if (markerHandle !== null)
+            fs.fsyncSync(markerHandle);
+        fs.fsyncSync(sourceParentHandle);
+        fs.fsyncSync(quarantineHandle);
+    }
+    finally {
+        if (quarantineHandle !== null)
+            fs.closeSync(quarantineHandle);
+        if (markerHandle !== null)
+            fs.closeSync(markerHandle);
+        fs.closeSync(sourceParentHandle);
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_marker_quarantined", message: "Sanctuary acceptance marker was quarantined", meta: { quarantinePath } });
+    return quarantinePath;
+}
+function sanctuaryAcceptanceEventMeta(agentName) {
+    const marker = readSanctuaryAcceptanceMarker(agentName);
+    return marker ? { scenarioHandleDigest: marker.scenarioHandleDigest } : {};
+}
+function parseGateStatus(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("acceptance gate status is invalid");
+    const status = value;
+    if (JSON.stringify(Object.keys(status).sort()) !== JSON.stringify(["gate", "label", "phase", "startedAt"]))
+        throw new Error("acceptance gate status is invalid");
+    if (typeof status.label !== "string" || status.label.length === 0
+        || typeof status.gate !== "string" || status.gate.length === 0
+        || (status.phase !== "waiting" && status.phase !== "complete")
+        || typeof status.startedAt !== "string" || new Date(status.startedAt).toISOString() !== status.startedAt) {
+        throw new Error("acceptance gate status is invalid");
+    }
+    return status;
+}
+function publishSanctuaryAcceptanceGateStatus(status, filePath = DEFAULT_GATE_STATUS_PATH) {
+    const parsed = parseGateStatus(status);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o755 });
+    const temporary = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(parsed)}\n`, { encoding: "utf8", mode: 0o644, flag: "wx" });
+    fs.renameSync(temporary, filePath);
+    fs.chmodSync(filePath, 0o644);
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_gate_status_written", message: "Sanctuary acceptance gate status published", meta: { label: parsed.label, gate: parsed.gate, phase: parsed.phase } });
+}
+function clearSanctuaryAcceptanceGateStatus(filePath = DEFAULT_GATE_STATUS_PATH) {
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_gate_status_cleared", message: "Sanctuary acceptance gate status cleared", meta: { path: filePath } });
+}
+function runWithSanctuaryAcceptanceApproval(value, operation) {
+    if (!value.approvalId || !SHA256.test(value.argumentDigest))
+        throw new Error("acceptance approval context is invalid");
+    return acceptanceApproval.run({ ...value }, operation);
+}
+function readSanctuaryAcceptanceApproval() {
+    const value = acceptanceApproval.getStore();
+    return value ? { ...value } : null;
+}