@ouro.bot/cli 0.1.0-alpha.733 → 0.1.0-alpha.735

package/dist/heart/daemon/container-credential-bootstrap.js

@@ -0,0 +1,208 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultContainerCredentialBootstrapPath = getDefaultContainerCredentialBootstrapPath;
+exports.loadContainerCredentialBootstrap = loadContainerCredentialBootstrap;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const runtime_credentials_1 = require("../runtime-credentials");
+const runtime_1 = require("../../nerves/runtime");
+const machine_identity_1 = require("../machine-identity");
+const MAX_BOOTSTRAP_BYTES = 128 * 1024;
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseEnvelope(raw) {
+    const value = JSON.parse(raw);
+    if (!isRecord(value) || value.schemaVersion !== 1 || !Array.isArray(value.credentials)) {
+        throw new Error("container credential bootstrap envelope is invalid");
+    }
+    if (Object.keys(value).sort().join(",") !== "credentials,schemaVersion") {
+        throw new Error("container credential bootstrap has unsupported fields");
+    }
+    if (value.credentials.length === 0) {
+        throw new Error("container credential bootstrap must contain at least one credential");
+    }
+    return value;
+}
+function fsyncDirectory(directoryPath) {
+    const descriptor = fs.openSync(directoryPath, "r");
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function deleteDurably(filePath) {
+    fs.unlinkSync(filePath);
+    fsyncDirectory(path.dirname(filePath));
+}
+function assertSafeBootstrapFile(stat, label) {
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`container credential ${label} must be a regular file`);
+    }
+    if ((stat.mode & 0o077) !== 0)
+        throw new Error("container credential bootstrap must have mode 0600");
+    if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+        throw new Error("container credential bootstrap must be owned by the runtime user");
+    }
+    if (stat.size > MAX_BOOTSTRAP_BYTES)
+        throw new Error("container credential bootstrap is too large");
+}
+function getDefaultContainerCredentialBootstrapPath() {
+    return path.join(os.homedir(), ".ouro-cli", "container-credentials.json");
+}
+function optionalStat(filePath) {
+    try {
+        return fs.lstatSync(filePath);
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function loadContainerCredentialBootstrap(enabledAgents, options = {}) {
+    const filePath = options.path ?? getDefaultContainerCredentialBootstrapPath();
+    const consumingPath = `${filePath}.consuming`;
+    let sourceStat = optionalStat(filePath);
+    const claimedStat = optionalStat(consumingPath);
+    if (sourceStat && claimedStat) {
+        assertSafeBootstrapFile(sourceStat, "bootstrap");
+        assertSafeBootstrapFile(claimedStat, "consuming state");
+        const sourceBytes = fs.readFileSync(filePath);
+        const claimedBytes = fs.readFileSync(consumingPath);
+        if (!sourceBytes.equals(claimedBytes)) {
+            throw new Error("human-required: container credential source and claim differ; securely compare and quarantine them without printing their contents");
+        }
+        deleteDurably(filePath);
+        sourceStat = null;
+    }
+    if (claimedStat)
+        assertSafeBootstrapFile(claimedStat, "consuming state");
+    let stat;
+    if (sourceStat) {
+        if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
+            throw new Error("container credential bootstrap must be a regular file");
+        }
+        fs.renameSync(filePath, consumingPath);
+        fsyncDirectory(path.dirname(filePath));
+        stat = sourceStat;
+    }
+    else if (claimedStat) {
+        stat = claimedStat;
+    }
+    else {
+        return [];
+    }
+    assertSafeBootstrapFile(stat, claimedStat ? "consuming state" : "bootstrap");
+    const envelope = parseEnvelope(fs.readFileSync(consumingPath, "utf8"));
+    const allowed = new Set(enabledAgents);
+    const loaded = new Set();
+    for (const message of envelope.credentials) {
+        if (!isRecord(message) || typeof message.agentName !== "string" || !allowed.has(message.agentName)) {
+            throw new Error("container credential bootstrap agent is not enabled");
+        }
+        if (loaded.has(message.agentName))
+            throw new Error("container credential bootstrap contains a duplicate agent");
+        if (!(0, runtime_credentials_1.isRuntimeCredentialBootstrapMessage)(message))
+            throw new Error("container credential bootstrap message is invalid");
+        loaded.add(message.agentName);
+    }
+    const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId;
+    const migration = options.machineIdMigration;
+    let messages = envelope.credentials;
+    if (migration) {
+        const { sourceMachineId, targetMachineId } = migration;
+        if (!sourceMachineId
+            || !targetMachineId
+            || sourceMachineId !== sourceMachineId.trim()
+            || targetMachineId !== targetMachineId.trim()
+            || sourceMachineId === targetMachineId) {
+            throw new Error("container credential bootstrap machineId migration is invalid");
+        }
+        if (machineId !== targetMachineId) {
+            throw new Error("container credential bootstrap machineId migration target does not match this machine");
+        }
+        for (const message of messages) {
+            if (!isRecord(message) || message.machineId !== sourceMachineId) {
+                throw new Error("container credential bootstrap machineId migration source does not match");
+            }
+        }
+        messages = messages.map((message) => ({ ...message, machineId: targetMachineId }));
+    }
+    else {
+        for (const message of messages) {
+            if (isRecord(message) && typeof message.machineId === "string" && message.machineId !== machineId) {
+                throw new Error("container credential bootstrap machineId does not match this machine");
+            }
+        }
+    }
+    const persist = options.persist ?? ((message) => (0, runtime_credentials_1.persistRuntimeCredentialBootstrapMessage)(message, {
+        machineId,
+    }));
+    try {
+        for (const message of messages) {
+            if (!await persist(message))
+                throw new Error("invalid bootstrap message");
+        }
+    }
+    catch {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "config/identity",
+            event: "config.container_credentials_persist_error",
+            message: "container credential bootstrap persistence failed; recoverable claim retained",
+            meta: { agents: [...loaded].sort(), count: loaded.size, claimedPath: consumingPath },
+        });
+        throw new Error("container credential bootstrap persistence failed; recoverable claim retained for reconciliation");
+    }
+    if (options.apply) {
+        for (const message of messages) {
+            if (!options.apply(message))
+                throw new Error("container credential bootstrap message is invalid");
+        }
+    }
+    deleteDurably(consumingPath);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.container_credentials_loaded",
+        message: "loaded container credential bootstrap",
+        meta: { agents: [...loaded].sort(), count: loaded.size },
+    });
+    return [...loaded].sort();
+}

package/dist/heart/daemon/container-healthcheck.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runContainerHealthcheck = runContainerHealthcheck;
+exports.runContainerHealthcheckMain = runContainerHealthcheckMain;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const runtime_1 = require("../../nerves/runtime");
+const container_runtime_1 = require("./container-runtime");
+function fail(reason) {
+    (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.container_healthcheck_error", message: "container healthcheck failed", meta: { reason } });
+    process.exitCode = 1;
+    throw new Error(reason);
+}
+function runContainerHealthcheck(options = {}) {
+    const argv = options.argv ?? process.argv;
+    const now = options.now ?? Date.now;
+    const index = argv.indexOf("--agent");
+    const agent = index >= 0 ? argv[index + 1] : undefined;
+    if (!agent)
+        fail("missing agent");
+    const healthPath = path.join(os.homedir(), ".ouro-cli", "daemon-health.json");
+    let stat;
+    let health;
+    try {
+        stat = fs.statSync(healthPath);
+        health = JSON.parse(fs.readFileSync(healthPath, "utf8"));
+    }
+    catch {
+        fail("health state unavailable");
+    }
+    const checkedAt = now();
+    if (checkedAt - stat.mtimeMs > 90_000 || stat.mtimeMs > checkedAt + 1_000)
+        fail("health state stale");
+    if (health.pid !== 1 || !fs.existsSync("/proc/1"))
+        fail("daemon is not PID 1");
+    if (health.status !== "healthy" && health.status !== "partial")
+        fail("daemon status is not ready");
+    const agents = health.agents;
+    const managed = agents?.[agent];
+    if (!managed || managed.status !== "running" || typeof managed.pid !== "number" || managed.pid <= 0 || !fs.existsSync(`/proc/${managed.pid}`))
+        fail("managed agent is not running");
+    let processArguments = "";
+    try {
+        processArguments = (0, node_child_process_1.execFileSync)("ps", ["-eo", "args="], { encoding: "utf8", timeout: 2_000 });
+    }
+    catch {
+        fail("managed process inventory is unavailable");
+    }
+    if (!(0, container_runtime_1.hasManagedTelegramProcess)(processArguments, agent))
+        fail("managed Telegram sense is not running exactly once");
+    if (!(0, container_runtime_1.hasManagedSupercronicProcess)(processArguments, agent))
+        fail("managed Supercronic scheduler is not running exactly once");
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.container_healthcheck_end", message: "container healthcheck passed", meta: { agent } });
+}
+function runContainerHealthcheckMain(isMain, runner) {
+    if (isMain)
+        runner();
+}
+runContainerHealthcheckMain(require.main === module, runContainerHealthcheck);

package/dist/heart/daemon/container-runtime.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasManagedTelegramProcess = hasManagedTelegramProcess;
+exports.hasManagedSupercronicProcess = hasManagedSupercronicProcess;
+exports.readContainerRuntimePolicy = readContainerRuntimePolicy;
+const fs = __importStar(require("node:fs"));
+const runtime_1 = require("../../nerves/runtime");
+function hasManagedTelegramProcess(processArguments, agent) {
+    const wanted = agent.trim();
+    if (!wanted)
+        return false;
+    const matches = processArguments.split("\n").filter((line) => {
+        const fields = line.trim().split(/\s+/u);
+        const entryIndex = fields.findIndex((field) => field === "/opt/ouro/dist/senses/telegram-entry.js");
+        const agentIndex = fields.findIndex((field) => field === "--agent");
+        return entryIndex >= 0 && agentIndex >= 0 && fields[agentIndex + 1] === wanted;
+    });
+    return matches.length === 1;
+}
+function hasManagedSupercronicProcess(processArguments, agent) {
+    const expected = [
+        "/usr/local/bin/supercronic",
+        "-split-logs",
+        "-inotify",
+        `/home/ouro/.ouro-cli/scheduler/${agent}.crontab`,
+    ];
+    const matches = processArguments.split("\n").filter((line) => {
+        const fields = line.trim().split(/\s+/u);
+        return fields.length === expected.length && fields.every((field, index) => field === expected[index]);
+    });
+    return matches.length === 1;
+}
+function readContainerRuntimePolicy(options = {}) {
+    const filePath = options.path ?? "/opt/ouro/container-runtime.json";
+    const readFile = options.readFile ?? ((target) => fs.readFileSync(target, "utf8"));
+    let raw;
+    try {
+        raw = readFile(filePath);
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    const value = JSON.parse(raw);
+    if (value.scheduler !== "supercronic" || value.updates !== "disabled" || Object.keys(value).sort().join(",") !== "scheduler,updates") {
+        throw new Error("container runtime policy is invalid");
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.container_runtime_policy_loaded", message: "container runtime policy loaded", meta: { scheduler: value.scheduler, updates: value.updates } });
+    return { scheduler: "supercronic", updates: "disabled" };
+}

package/dist/heart/daemon/container-spec-auditor-main.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runContainerSpecAuditorCli = runContainerSpecAuditorCli;
+exports.runContainerSpecAuditorMain = runContainerSpecAuditorMain;
+const fs = __importStar(require("node:fs"));
+const runtime_1 = require("../../nerves/runtime");
+const container_spec_auditor_1 = require("./container-spec-auditor");
+function parseModeArguments(args, flags) {
+    if (args.length !== flags.length * 2)
+        return null;
+    const allowed = new Set(flags);
+    const parsed = {};
+    for (let index = 0; index < args.length; index += 2) {
+        const flag = args[index];
+        const value = args[index + 1];
+        if (!allowed.has(flag) || Object.prototype.hasOwnProperty.call(parsed, flag) || !value)
+            return null;
+        parsed[flag] = value;
+    }
+    return parsed;
+}
+function parseSingleInspect(raw) {
+    try {
+        const value = JSON.parse(raw);
+        if (!Array.isArray(value) || value.length !== 1)
+            return null;
+        const item = value[0];
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            return null;
+        return item;
+    }
+    catch {
+        return null;
+    }
+}
+function runContainerSpecAuditorCli(args, deps = {}) {
+    const readFile = deps.readFile ?? ((filePath) => fs.readFileSync(filePath, "utf8"));
+    const write = deps.write ?? ((text) => process.stdout.write(text));
+    const staged = parseModeArguments(args, ["--template", "--runtime-policy", "--expected-image"]);
+    const effective = parseModeArguments(args, ["--inspect", "--image-inspect", "--expected-image"]);
+    if (!staged && !effective) {
+        write(JSON.stringify({ ok: false, error: "usage: staged --template <path> --runtime-policy <path> --expected-image <id>; effective --inspect <path> --image-inspect <path> --expected-image <id>" }) + "\n");
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.container_spec_auditor_cli_error",
+            message: "container spec auditor arguments were invalid",
+            meta: { argumentCount: args.length },
+        });
+        return 2;
+    }
+    if (effective) {
+        let containerText;
+        let imageText;
+        try {
+            containerText = readFile(effective["--inspect"]);
+            imageText = readFile(effective["--image-inspect"]);
+        }
+        catch (error) {
+            write(JSON.stringify({ ok: false, error: "effective audit inputs are unreadable" }) + "\n");
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.container_spec_auditor_cli_error",
+                message: "container spec auditor could not read effective inputs",
+                meta: { reason: error instanceof Error ? error.message : String(error) },
+            });
+            return 2;
+        }
+        const containerInspect = parseSingleInspect(containerText);
+        const imageInspect = parseSingleInspect(imageText);
+        const imageConfig = imageInspect?.Config;
+        const expectedEnvironment = imageConfig && typeof imageConfig === "object" && !Array.isArray(imageConfig)
+            ? imageConfig.Env
+            : null;
+        if (!containerInspect || !imageInspect || !Array.isArray(expectedEnvironment) || !expectedEnvironment.every((entry) => typeof entry === "string")) {
+            write(JSON.stringify({ ok: false, error: "effective audit inputs must each contain exactly one canonical inspect record" }) + "\n");
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.container_spec_auditor_cli_error",
+                message: "container spec auditor effective inputs were invalid",
+                meta: { containerValid: !!containerInspect, imageValid: !!imageInspect },
+            });
+            return 2;
+        }
+        const result = (0, container_spec_auditor_1.auditSanctuaryContainerSpec)(containerInspect, {
+            expectedImage: effective["--expected-image"],
+            expectedEnvironment,
+        });
+        if (imageInspect.Id !== effective["--expected-image"]) {
+            result.ok = false;
+            result.violations.unshift("reviewed image inspect identity does not match the expected local image ID");
+        }
+        write(JSON.stringify(result) + "\n");
+        return result.ok ? 0 : 1;
+    }
+    let templateXml;
+    let runtimePolicyText;
+    try {
+        templateXml = readFile(staged["--template"]);
+        runtimePolicyText = readFile(staged["--runtime-policy"]);
+    }
+    catch (error) {
+        write(JSON.stringify({ ok: false, error: "staged audit inputs are unreadable" }) + "\n");
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.container_spec_auditor_cli_error",
+            message: "container spec auditor could not read staged files",
+            meta: { reason: error instanceof Error ? error.message : String(error) },
+        });
+        return 2;
+    }
+    const result = (0, container_spec_auditor_1.auditSanctuaryStagedFiles)({ templateXml, runtimePolicyText, expectedImage: staged["--expected-image"] });
+    write(JSON.stringify(result) + "\n");
+    return result.ok ? 0 : 1;
+}
+function runContainerSpecAuditorMain(isMain, args, runner) {
+    if (isMain)
+        process.exitCode = runner(args);
+}
+runContainerSpecAuditorMain(require.main === module, process.argv.slice(2), runContainerSpecAuditorCli);