@ouro.bot/cli 0.1.0-alpha.970 → 0.1.0-alpha.972

package/dist/heart/daemon/cli-parse.js

@@ -265,7 +265,7 @@ function usage() {
         "  ouro vault recover [--agent <name>] --from <json> [--from <json>] [--email <email>] [--server <url>] [--store <store>]",
         "  ouro vault unlock [--agent <name>] [--store auto|macos-keychain|windows-dpapi|linux-secret-service|plaintext-file]",
         "  ouro vault status [--agent <name>] [--store auto|macos-keychain|windows-dpapi|linux-secret-service|plaintext-file]",
-        "  ouro vault config set [--agent <name>] --key <path> [--value <value>] [--scope agent|machine]",
+        "  ouro vault config set [--agent <name>] --key <path> [--value <value> | --value-file <path>] [--scope agent|machine]",
         "  ouro vault config status [--agent <name>] [--scope agent|machine|all]",
         "  ouro vault item set [--agent <name>] --item <path> --secret-field <name> [--public-field <key=value>] [--note <text>]",
         "  ouro vault item status [--agent <name>] --item <path>",
@@ -1173,9 +1173,15 @@ function parseVaultConfigCommand(args) {
     const { agent, rest } = extractAgentFlag(args.slice(1));
     let key;
     let value;
+    let valueFile;
     let scope;
     for (let i = 0; i < rest.length; i += 1) {
         const token = rest[i];
+        if (token === "--value-file") {
+            valueFile = rest[i + 1] ?? "";
+            i += 1;
+            continue;
+        }
         if (token === "--key") {
             key = rest[i + 1];
             i += 1;
@@ -1201,7 +1207,7 @@ function parseVaultConfigCommand(args) {
         throw new Error("Usage: ouro vault config set [--agent <name>] --key <path> [--value <value>] OR ouro vault config status [--agent <name>]");
     }
     if (sub === "status") {
-        if (key || value) {
+        if (key || value || valueFile) {
             throw new Error("Usage: ouro vault config status [--agent <name>]");
         }
         return { kind: "vault.config.status", ...(agent ? { agent } : {}), ...(scope ? { scope } : {}) };
@@ -1209,9 +1215,13 @@ function parseVaultConfigCommand(args) {
     if (scope === "all")
         throw new Error("vault config --scope all is only valid for status");
     if (!key) {
-        throw new Error("Usage: ouro vault config set [--agent <name>] --key <path> [--value <value>]");
+        throw new Error("Usage: ouro vault config set [--agent <name>] --key <path> [--value <value> | --value-file <path>]");
     }
-    return { kind: "vault.config.set", ...(agent ? { agent } : {}), key, ...(value !== undefined ? { value } : {}), ...(scope ? { scope } : {}) };
+    if (value !== undefined && valueFile !== undefined)
+        throw new Error("vault config set takes --value or --value-file, not both");
+    if (valueFile !== undefined && !valueFile)
+        throw new Error("vault config set --value-file needs a path (use /dev/stdin to pipe the value)");
+    return { kind: "vault.config.set", ...(agent ? { agent } : {}), key, ...(value !== undefined ? { value } : {}), ...(valueFile !== undefined ? { valueFile } : {}), ...(scope ? { scope } : {}) };
 }
 function normalizeConnectTarget(value) {
     if (!value)

package/dist/heart/daemon/sanctuary-authority-epoch.js

@@ -81,9 +81,12 @@ function validate(value) {
         || typeof epoch.epochId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(epoch.epochId)
         || ![epoch.botId, epoch.ownerUserId, epoch.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id)) || epoch.ownerUserId !== epoch.ownerChatId
         || !Number.isSafeInteger(epoch.predecessorCursor) || epoch.predecessorCursor < 0
-        || ![epoch.packageDigest, epoch.tokenDigest, epoch.previousTokenDigest, epoch.publicKeyDigest].every((value) => typeof value === "string" && DIGEST.test(value))
+        || ![epoch.packageDigest, epoch.tokenDigest, epoch.publicKeyDigest].every((value) => typeof value === "string" && DIGEST.test(value))
+        || (epoch.previousTokenDigest === null
+            ? epoch.revokedTokenStatus !== null || epoch.predecessorCursor !== 0
+            : typeof epoch.previousTokenDigest !== "string" || !DIGEST.test(epoch.previousTokenDigest) || epoch.revokedTokenStatus !== 401)
         || epoch.tokenDigest === epoch.previousTokenDigest || typeof epoch.tokenPath !== "string" || !path.isAbsolute(epoch.tokenPath)
-        || typeof epoch.publicKeyPem !== "string" || epoch.revokedTokenStatus !== 401
+        || typeof epoch.publicKeyPem !== "string"
         || typeof epoch.createdAt !== "string" || !Number.isFinite(Date.parse(epoch.createdAt)) || new Date(epoch.createdAt).toISOString() !== epoch.createdAt
         || (epoch.state === "prepared" ? epoch.terminalCursor !== null : !Number.isSafeInteger(epoch.terminalCursor) || epoch.terminalCursor < epoch.predecessorCursor))
         throw new Error("Sanctuary authority epoch is invalid");
@@ -154,19 +157,26 @@ async function prepareSanctuaryAuthorityEpoch(input, options) {
         || !Number.isSafeInteger(input.predecessorCursor) || input.predecessorCursor < 0 || !DIGEST.test(input.packageDigest))
         throw new Error("Sanctuary authority epoch input is invalid");
     const token = privateBytes(input.tokenPath, options).toString("utf8").trim();
-    const previousToken = privateBytes(input.previousTokenPath, options).toString("utf8").trim();
-    if (!TOKEN.test(token) || !TOKEN.test(previousToken) || token.split(":")[0] !== input.botId || previousToken.split(":")[0] !== input.botId || token === previousToken)
+    // A fresh install has no predecessor token to prove revoked, and therefore no cursor to carry.
+    const previousToken = input.previousTokenPath === null ? null : privateBytes(input.previousTokenPath, options).toString("utf8").trim();
+    if (previousToken === null && input.predecessorCursor !== 0)
+        throw new Error("Sanctuary authority epoch input is invalid");
+    if (!TOKEN.test(token) || token.split(":")[0] !== input.botId
+        || (previousToken !== null && (!TOKEN.test(previousToken) || previousToken.split(":")[0] !== input.botId || token === previousToken)))
         throw new Error("Sanctuary authority requires a fresh same-bot token");
-    const previous = await options.probe(previousToken);
-    if (previous.status !== 401 || previous.botId !== null)
-        throw new Error("Sanctuary previous Telegram token is not proven revoked");
+    if (previousToken !== null) {
+        const previous = await options.probe(previousToken);
+        if (previous.status !== 401 || previous.botId !== null)
+            throw new Error("Sanctuary previous Telegram token is not proven revoked");
+    }
     const current = await options.probe(token);
     if (current.status !== 200 || current.botId !== input.botId)
         throw new Error("Sanctuary new Telegram token identity is invalid");
     const epochPath = path.join(input.root, "epoch.json");
     const keyPath = path.join(input.root, "issuer.pem");
     const intentPath = path.join(input.root, "issuer-intent.json");
-    const inputDigest = sha(JSON.stringify({ ...input, tokenDigest: sha(token), previousTokenDigest: sha(previousToken) }));
+    const previousTokenDigest = previousToken === null ? null : sha(previousToken);
+    const inputDigest = sha(JSON.stringify({ ...input, tokenDigest: sha(token), previousTokenDigest }));
     return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
         const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
         let existing = false;
@@ -186,7 +196,7 @@ async function prepareSanctuaryAuthorityEpoch(input, options) {
                 if (epoch[key] !== input[key])
                     throw new Error("Sanctuary authority epoch input changed");
             }
-            if (epoch.previousTokenDigest !== sha(previousToken))
+            if (epoch.previousTokenDigest !== previousTokenDigest)
                 throw new Error("Sanctuary authority predecessor token changed");
             if (fs.existsSync(intentPath)) {
                 const intent = JSON.parse(privateBytes(intentPath, options).toString("utf8"));
@@ -218,8 +228,8 @@ async function prepareSanctuaryAuthorityEpoch(input, options) {
         }
         const epoch = validate({
             schemaVersion: 1, state: "prepared", epochId: input.epochId, botId: input.botId, ownerUserId: input.ownerUserId, ownerChatId: input.ownerChatId,
-            predecessorCursor: input.predecessorCursor, packageDigest: input.packageDigest, tokenPath: input.tokenPath, tokenDigest: sha(token), previousTokenDigest: sha(previousToken),
-            ...issuer(input.root, options), revokedTokenStatus: 401, createdAt: intent.createdAt, terminalCursor: null,
+            predecessorCursor: input.predecessorCursor, packageDigest: input.packageDigest, tokenPath: input.tokenPath, tokenDigest: sha(token), previousTokenDigest,
+            ...issuer(input.root, options), revokedTokenStatus: previousTokenDigest === null ? null : 401, createdAt: intent.createdAt, terminalCursor: null,
         });
         (0, session_transaction_1.writeSessionTransaction)(epochPath, epoch, { lease, expectedRevision: transaction.revision });
         fs.unlinkSync(intentPath);

package/dist/heart/daemon/sanctuary-authority-root-lifecycle.js

@@ -103,7 +103,10 @@ const EPOCH_RECORDS = ["migration.json", "stage.json", "configured.json"];
 const digest = (value) => `sha256:${(0, node_crypto_1.createHash)("sha256").update(value).digest("hex")}`;
 function validateRequest(value) {
     const request = value;
-    if (!request || typeof request !== "object" || Object.keys(request).sort().join(",") !== "botId,epochId,nodeDigest,ownerChatId,ownerUserId,packageDigest,prlimitDigest,schemaVersion,setsidDigest,shellDigest"
+    const keys = "botId,epochId,nodeDigest,ownerChatId,ownerUserId,packageDigest,prlimitDigest,schemaVersion,setsidDigest,shellDigest";
+    if (!request || typeof request !== "object"
+        || Object.keys(request).filter((key) => key !== "predecessorContract").sort().join(",") !== keys
+        || (Object.hasOwn(request, "predecessorContract") && request.predecessorContract !== "none")
         || request.schemaVersion !== 1 || !/^[A-Za-z0-9_-]{1,128}$/u.test(request.epochId)
         || ![request.botId, request.ownerUserId, request.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id))
         || request.ownerUserId !== request.ownerChatId
@@ -128,17 +131,20 @@ class SanctuaryAuthorityRootLifecycle {
         this.#socketGid = options.socketGroupId ?? 10001;
         if (process.getuid() !== this.#uid || process.getgid() !== this.#gid)
             throw new Error("Sanctuary root lifecycle requires root");
-        if (!DIGEST.test(transaction.targetImageId) || !DIGEST.test(transaction.rollbackImageId) || transaction.targetImageId === transaction.rollbackImageId)
-            throw new Error("Sanctuary root lifecycle image identity is invalid");
-        this.#transaction = { targetImageId: transaction.targetImageId, rollbackImageId: transaction.rollbackImageId };
         this.#directory(ROOT);
         this.#request = validateRequest(JSON.parse(this.#private(`${ROOT}/request.json`)));
+        const rollbackValid = transaction.rollbackImageId === null ? this.#fresh() : DIGEST.test(transaction.rollbackImageId);
+        if (!DIGEST.test(transaction.targetImageId) || !rollbackValid || transaction.targetImageId === transaction.rollbackImageId)
+            throw new Error("Sanctuary root lifecycle image identity is invalid");
+        this.#transaction = { targetImageId: transaction.targetImageId, rollbackImageId: transaction.rollbackImageId };
         (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_root_lifecycle_loaded", message: "Sanctuary root lifecycle identity loaded", meta: { epochId: this.#request.epochId, targetImageId: transaction.targetImageId } });
     }
     plan() {
         const { epochId, botId, ownerUserId, ownerChatId, packageDigest } = this.#request;
-        return { schemaVersion: 1, epochId, botId, ownerUserId, ownerChatId, packageDigest, publicKeyDigest: null, predecessorContract: "canonical-pre-gateway", targetContract: "canonical-gateway" };
+        return { schemaVersion: 1, epochId, botId, ownerUserId, ownerChatId, packageDigest, publicKeyDigest: null, predecessorContract: this.#fresh() ? "none" : "canonical-pre-gateway", targetContract: "canonical-gateway" };
     }
+    /** Whether this is a fresh install, which hands over nothing from a predecessor. */
+    #fresh() { return this.#request.predecessorContract === "none"; }
     async boot() {
         if (!fs.existsSync(this.#p(`${ROOT}/activation.json`)))
             return false;
@@ -212,9 +218,15 @@ class SanctuaryAuthorityRootLifecycle {
             "rollback:reconcile-executions": { read: () => this.#retiredProcess(), apply: () => this.#retireProcess() },
             "rollback:stop-gateway": { read: () => this.#retiredProcess() && this.#pid() === null, apply: () => this.#stopGateway() },
             "rollback:end-epoch": { read: () => this.#epoch().state === "retired", apply: () => this.#endEpoch() },
-            "rollback:restore-token-cursor": { read: () => this.#restoredToken(), apply: () => this.#restoreToken() },
-            "rollback:restore-resident": { read: () => this.#rollback().State.Running, apply: () => this.#restoreResident() },
-            "rollback:verify-rollback": { read: () => this.#rollbackVerified(), apply: () => this.#verifyRollback() },
+            "rollback:restore-token-cursor": this.#fresh()
+                ? { read: () => this.#epoch().state === "retired", apply: () => this.#requireStopped() }
+                : { read: () => this.#restoredToken(), apply: () => this.#restoreToken() },
+            "rollback:restore-resident": this.#fresh()
+                ? { read: () => this.#residentAbsent(), apply: () => this.#removeResident() }
+                : { read: () => this.#rollback().State.Running, apply: () => this.#restoreResident() },
+            "rollback:verify-rollback": this.#fresh()
+                ? { read: () => fs.existsSync(this.#p(`${this.#epochRoot()}/rollback.json`)) && this.#freshRollbackClean(), apply: () => this.#verifyFreshRollback() }
+                : { read: () => this.#rollbackVerified(), apply: () => this.#verifyRollback() },
         };
         const effect = effects[step];
         if (!effect)
@@ -248,6 +260,13 @@ class SanctuaryAuthorityRootLifecycle {
             this.#migration();
             return;
         }
+        if (this.#fresh()) {
+            // A fresh install starts from nothing: an installed authority here means this is not one.
+            if (fs.existsSync(this.#p(`${ROOT}/active.json`)) || fs.existsSync(this.#p(`${ROOT}/activation.json`)))
+                throw new Error("Sanctuary fresh install found an installed authority");
+            this.#write(`${this.#epochRoot()}/migration.json`, JSON.stringify({ ...this.plan(), ...this.#transaction, predecessorCursor: 0 }));
+            return;
+        }
         if (fs.existsSync(this.#p(`${ROOT}/active.json`))) {
             const previous = JSON.parse(this.#private(`${ROOT}/active.json`));
             const epoch = (0, sanctuary_authority_epoch_1.readSanctuaryAuthorityEpoch)(previous.epochRoot, { expectedUid: this.#uid, expectedGid: this.#gid });
@@ -430,7 +449,7 @@ class SanctuaryAuthorityRootLifecycle {
         this.#write(`${this.#epochRoot()}/current-token`, token);
         await (0, sanctuary_authority_epoch_1.prepareSanctuaryAuthorityEpoch)({
             root: this.#p(this.#epochRoot()), epochId: this.#request.epochId, tokenPath: this.#p(`${this.#epochRoot()}/current-token`),
-            previousTokenPath: this.#p(`${this.#epochRoot()}/previous-token`), botId: this.#request.botId,
+            previousTokenPath: this.#fresh() ? null : this.#p(`${this.#epochRoot()}/previous-token`), botId: this.#request.botId,
             ownerUserId: this.#request.ownerUserId, ownerChatId: this.#request.ownerChatId,
             predecessorCursor: this.#migration().predecessorCursor, packageDigest: this.#request.packageDigest,
         }, {
@@ -781,6 +800,29 @@ class SanctuaryAuthorityRootLifecycle {
             this.#docker(["start", "ouro-butler"]);
         await this.#wait(() => this.#rollback().State.Health?.Status === "healthy" && this.#rollback().State.Running);
     }
+    // A fresh install rolls back to nothing: its token stays in root custody for a retry,
+    // and the resident it created is removed rather than restored.
+    #residentAbsent() {
+        return !this.#containers().some((container) => container.Name === "/ouro-butler");
+    }
+    #removeResident() {
+        this.#assertNoForeignPoller();
+        if (this.#epoch().state !== "retired" || this.#pid() !== null)
+            throw new Error("Sanctuary epoch must retire before the fresh resident is removed");
+        const resident = this.#containers().find((container) => container.Name === "/ouro-butler");
+        if (resident && resident.Image !== this.#transaction.targetImageId)
+            throw new Error("Sanctuary resident image changed");
+        if (resident)
+            this.#docker(["rm", "--force", "ouro-butler"]);
+    }
+    #freshRollbackClean() {
+        return this.#epoch().state === "retired" && this.#pid() === null && this.#residentAbsent();
+    }
+    #verifyFreshRollback() {
+        if (!this.#freshRollbackClean())
+            throw new Error("Sanctuary rollback readback failed");
+        this.#write(`${this.#epochRoot()}/rollback.json`, JSON.stringify({ epochId: this.#request.epochId, state: "retired" }));
+    }
     #rollbackVerified() {
         return fs.existsSync(this.#p(`${this.#epochRoot()}/rollback.json`)) && this.#restoredToken() && this.#pid() === null && this.#rollback().State.Running && this.#rollback().State.Health?.Status === "healthy";
     }
@@ -889,7 +931,7 @@ class SanctuaryAuthorityRootLifecycle {
             || !journal.completed.every((step) => exports.SANCTUARY_UPGRADE_STEPS.includes(step))
             || (journal.rollingBack !== undefined && journal.rollingBack !== true)
             || !sides.every((side) => side && DIGEST.test(side.imageId) && DIGEST.test(side.packageDigest) && IMAGE_REFERENCE.test(side.imageReference))
-            || !DIGEST.test(journal.from.rollbackImageId))
+            || !(journal.from.rollbackImageId === null ? this.#fresh() : DIGEST.test(journal.from.rollbackImageId)))
             throw new Error("Sanctuary upgrade journal is invalid");
         return journal;
     }
@@ -901,7 +943,7 @@ class SanctuaryAuthorityRootLifecycle {
         if (this.#docker(["image", "inspect", "--format", "{{.Id}}", input.imageReference]).trim() !== input.targetImageId)
             throw new Error("Sanctuary upgrade image identity does not match its reference");
         const request = validateRequest(JSON.parse(this.#private(INCOMING_REQUEST)));
-        if (["epochId", "botId", "ownerUserId", "ownerChatId"].some((key) => request[key] !== this.#request[key]))
+        if (["epochId", "botId", "ownerUserId", "ownerChatId", "predecessorContract"].some((key) => request[key] !== this.#request[key]))
             throw new Error("Sanctuary upgrade would change the authority identity");
         if (request.packageDigest === this.#request.packageDigest)
             throw new Error("Sanctuary upgrade package is already installed");