@ours.network/install 1.2.0-nightly.2 → 1.2.1-nightly.10

package/lib/build-transition.mjs

@@ -2,10 +2,16 @@ import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { validateInstallation } from './plan.mjs';
+import { info, ok, warn } from './ui.mjs';
 
 /** The caller holds the installation lock; installation.json owns retry state. */
 export async function serverBuildTransition(record, args, effects) {
   validateInstallation(record, record.root);
+  const stage = async (label, action) => {
+    effects.out?.(info(label));
+    try { const result = await action(); effects.out?.(ok(`${label} complete`)); return result; }
+    catch (error) { effects.out?.(warn(`Server ${args.operation} stopped during ${label.toLowerCase()}.`)); throw error; }
+  };
   const path = join(record.root, 'installation.json');
   const save = transition => {
     record = { ...record, buildTransition: transition };
@@ -14,9 +20,9 @@ export async function serverBuildTransition(record, args, effects) {
   };
   let transition = record.buildTransition;
   if (!transition) {
-    const candidate = await effects.prepareServerBuild(record, args);
+    const candidate = await stage('Prepare the updated runtime', () => effects.prepareServerBuild(record, args));
     try {
-      await effects.checkServerBuild(record, candidate, !!args.compatible, args.operation);
+      await stage('Verify package and stored-state compatibility', () => effects.checkServerBuild(record, candidate, !!args.compatible, args.operation));
       transition = { operation: args.operation, candidate, compatible: !!args.compatible,
         ...(args.sources ? { sourcePolicyHash: createHash('sha256').update(readFileSync(args.sources)).digest('hex') } : {}),
         runningServices: await effects.serverLifecycle(record, 'status'), phase: 'prepared' };
@@ -34,19 +40,19 @@ export async function serverBuildTransition(record, args, effects) {
   const { candidate, runningServices } = transition;
   // A failed readiness check can leave some new services running. Every retry
   // excludes those writers again and retains the original requested running set.
-  await effects.retireServerBuildRuntime(record);
+  await stage('Stop services before updating stored state', () => effects.retireServerBuildRuntime(record));
   if (transition.phase === 'prepared') {
-    await effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation);
+    await stage('Update stored state while retaining identities and credentials', () => effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation));
     transition = { ...transition, phase: 'state-updated' };
     save(transition);
   }
   if (transition.phase === 'state-updated') {
-    await effects.publishServerBuild(record, candidate);
+    await stage('Activate the prepared runtime', () => effects.publishServerBuild(record, candidate));
     transition = { ...transition, phase: 'runtime-activated' };
     save(transition);
   }
-  await effects.validateServerBuildState(record);
-  await effects.serverLifecycle(record, 'start', runningServices);
+  await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
+  await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
   delete completed.buildTransition;
   effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');

package/lib/client-cli.mjs

@@ -0,0 +1,117 @@
+import { lstatSync, readFileSync, writeFileSync, realpathSync, unlinkSync, chmodSync, symlinkSync, renameSync, mkdirSync } from 'node:fs';
+import { join, resolve, isAbsolute, dirname } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { buildManagedCli } from './managed-cli.mjs';
+
+import { createRequire } from 'node:module';
+import { releaseBinding, verifyReleaseGraph } from '../assets/scripts/maintenance/release-graph.mjs';
+
+const marker = '// ours-managed-cli-v1 ';
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+function stat(path) {
+  try { return lstatSync(path); } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+function privateAcquisition(home, root) {
+  for (const path of [join(home, '.ours-client-install'), root]) {
+    const value = lstatSync(path);
+    if (!value.isDirectory() || value.uid !== process.getuid() || (value.mode & 0o077) || realpathSync(path) !== path) throw new Error('Unsafe private CLI directory');
+  }
+}
+/** Publish the native client, retaining a verified migration launcher for rollback. */
+export async function publishClientCli(effects, packagePath, { policy = {}, isolated = false } = {}) {
+  const prefix = (await effects.run('npm', ['prefix', '--global'])).stdout.trim();
+  if (!isAbsolute(prefix) || resolve(prefix) !== prefix) throw new Error('npm global prefix must be an absolute normalized path');
+  const entry = join(prefix, 'bin', 'ours');
+  const before = stat(entry);
+  let previous;
+  if (before) {
+    if (before.uid !== process.getuid()) throw new Error('Refusing to replace a CLI owned by another user');
+    if (before.isSymbolicLink()) {
+      const resolved = realpathSync(entry);
+      const privateBase = join(effects.home, '.ours-client-install') + '/';
+      if (resolved.startsWith(privateBase)) {
+        const packageRoot = dirname(dirname(resolved));
+        const acquisitionRoot = dirname(dirname(dirname(packageRoot)));
+        privateAcquisition(effects.home, acquisitionRoot);
+        const retained = JSON.parse(readFileSync(join(acquisitionRoot, 'sources.json')));
+        if (releaseBinding(retained)?.scope !== 'host-cli') throw new Error('Unrecognized private CLI entry');
+        verifyReleaseGraph(acquisitionRoot, retained);
+        const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json')));
+        if (pkg.name !== '@ours.network/cli' || resolve(packageRoot, pkg.bin?.ours ?? '') !== resolved) throw new Error('Unrecognized private CLI target');
+      } else {
+        const npmRoot = (await effects.run('npm', ['root', '--global'])).stdout.trim();
+        if (!isAbsolute(npmRoot)) throw new Error('Invalid npm global package root');
+        const root = realpathSync(join(npmRoot, '@ours.network/cli'));
+        const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        if (manifest.name !== '@ours.network/cli' || typeof manifest.bin?.ours !== 'string' || resolved !== realpathSync(resolve(root, manifest.bin.ours))) throw new Error('Refusing to replace an unrelated ours symlink');
+      }
+    } else {
+      if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o022)) throw new Error('Refusing to replace an unsafe CLI entry');
+      previous = readFileSync(entry);
+      const line = previous.toString().split('\n')[1];
+      if (!line?.startsWith(marker)) throw new Error('Refusing to replace an unknown ours executable');
+      const binding = JSON.parse(line.slice(marker.length));
+      if (binding.schema !== 1 || previous.toString() !== buildManagedCli(binding.recordPath, binding.installerPath)) throw new Error('Managed CLI launcher was modified; no replacement performed');
+      const backup = join(effects.home, '.ours-client', `previous-cli-${hash(previous)}.cjs`);
+      const backupDir = lstatSync(join(effects.home, '.ours-client'));
+      if (!backupDir.isDirectory() || backupDir.uid !== process.getuid() || (backupDir.mode & 0o7777) !== 0o700) throw new Error('Managed CLI backup requires a private owned directory');
+      const saved = stat(backup);
+      if (!saved) writeFileSync(backup, previous, { mode: 0o600, flag: 'wx' });
+      else if (!saved.isFile() || saved.nlink !== 1 || saved.uid !== process.getuid() || (saved.mode & 0o7777) !== 0o600 || saved.size !== previous.length || !readFileSync(backup).equals(previous)) throw new Error('Managed CLI backup is unsafe or differs');
+      const current = lstatSync(entry);
+      if (current.dev !== before.dev || current.ino !== before.ino || !readFileSync(entry).equals(previous)) throw new Error('CLI changed during publication');
+      if (!isolated) unlinkSync(entry);
+      effects.out(`Previous managed CLI saved at ${backup}; server maintenance remains available through ours-install server.`);
+    }
+  }
+  if (isolated) {
+    const root = dirname(dirname(dirname(packagePath)));
+    if (!realpathSync(root).startsWith(join(effects.home, '.ours-client-install') + '/') || releaseBinding(policy)?.scope !== 'host-cli') throw new Error('Invalid private CLI acquisition');
+    privateAcquisition(effects.home, root);
+    verifyReleaseGraph(root, policy);
+    const selected = JSON.parse(readFileSync(join(packagePath, 'package.json')));
+    const target = realpathSync(resolve(packagePath, selected.bin.ours));
+    if (!target.startsWith(realpathSync(packagePath) + '/')) throw new Error('CLI entry escapes selected package');
+    const sdkEntry = realpathSync(createRequire(target).resolve('@ours.network/sdk'));
+    if (!sdkEntry.startsWith(root + '/')) throw new Error('Private CLI SDK escaped verified acquisition');
+    const sdk = JSON.parse(readFileSync(join(dirname(dirname(sdkEntry)), 'package.json')));
+    if (sdk.name !== '@ours.network/sdk' || sdk.version !== policy.release.packages['@ours.network/sdk'].version) throw new Error('Private CLI SDK differs from selection');
+    mkdirSync(dirname(entry), { recursive: true });
+    const binDir = lstatSync(dirname(entry));
+    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error('CLI bin directory must be owned and not writable by others');
+    const current = stat(entry);
+    if (before ? !current || current.dev !== before.dev || current.ino !== before.ino : current) throw new Error('CLI entry changed during publication');
+    const staged = entry + '.' + randomUUID();
+    try {
+      symlinkSync(target, staged);
+      renameSync(staged, entry);
+    } catch (error) {
+      if (stat(staged)) unlinkSync(staged);
+      if (previous && !stat(entry)) writeFileSync(entry, previous, { mode: before.mode & 0o777, flag: 'wx' });
+      throw error;
+    }
+    if (realpathSync(entry) !== target) throw new Error('Private CLI entry changed during publication');
+    verifyReleaseGraph(root, policy);
+    return entry;
+  }
+  try {
+    await effects.run('npm', ['install', '--global', '--install-links=false', '--offline', '--ignore-scripts', '--no-audit', '--no-fund', packagePath]);
+  } catch (error) {
+    if (previous && !stat(entry)) {
+      writeFileSync(entry, previous, { mode: before.mode & 0o777, flag: 'wx' });
+      chmodSync(entry, before.mode & 0o777);
+    }
+    throw error;
+  }
+  const published = stat(entry);
+  if (!published?.isSymbolicLink() || published.uid !== process.getuid()) throw new Error('CLI publication did not create the expected owned npm entry');
+  const npmRoot = (await effects.run('npm', ['root', '--global'])).stdout.trim();
+  if (!isAbsolute(npmRoot) || resolve(npmRoot) !== npmRoot) throw new Error('Invalid npm global package root');
+  const root = realpathSync(join(npmRoot, '@ours.network/cli'));
+  const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const selected = JSON.parse(readFileSync(join(packagePath, 'package.json'), 'utf8'));
+  const target = typeof manifest.bin?.ours === 'string' ? resolve(root, manifest.bin.ours) : '';
+  if (manifest.name !== '@ours.network/cli' || manifest.version !== selected.version || !target.startsWith(root + '/') || realpathSync(entry) !== realpathSync(target) || !stat(target)?.isFile()) throw new Error('Published CLI does not match the selected package');
+  if (!readFileSync(target).equals(readFileSync(resolve(packagePath, selected.bin.ours)))) throw new Error('Published CLI entry differs from the selected artifact');
+  return entry;
+}

package/lib/docker-conversion-runtime.mjs

@@ -22,6 +22,7 @@ export async function prepareDockerConversionRuntime(record, effects, assets) {
     fs.writeFileSync(join(context, 'Dockerfile'), `# syntax=docker/dockerfile:1
 FROM ${record.project}:runtime AS runtime
 COPY --chmod=644 runtime/ /opt/ours/docker/
+COPY --chmod=644 maintenance/release-graph.mjs /opt/ours/maintenance/release-graph.mjs
 FROM runtime AS maintenance
 USER 0:0
 COPY --chmod=644 maintenance/ /opt/ours/docker/

package/lib/docker-runtime-repair.mjs

@@ -0,0 +1,125 @@
+/** Qualify cached images before reuse; repair only the known root-owned 0600 policy. */
+import { lstatSync, readFileSync, writeFileSync, mkdtempSync, rmSync, realpathSync, openSync, closeSync, fstatSync, fchmodSync, constants } from 'node:fs';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { atomicWriteConfig } from './config.mjs';
+
+const policyPath = '/opt/ours/sources.json';
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+const fail = message => { throw new Error(`Docker runtime verification refused: ${message}`); };
+const imageId = value => /^sha256:[0-9a-f]{64}$/.test(value ?? '');
+
+export function refreshDockerPolicyCopy(record) {
+  if (record.workDir !== join(record.root, 'runtime')) fail('Unsafe retained Dockerfile: runtime directory differs from installation record');
+  for (const directory of [record.root, record.workDir]) {
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || realpathSync(directory) !== directory) fail('Unsafe retained Dockerfile: installation directory is linked or not canonical');
+    if (stat.uid !== process.getuid()) fail('Unsafe retained Dockerfile: installation directory belongs to another user');
+    if (stat.mode & 0o7077) fail('Unsafe retained Dockerfile: installation directory must be owner-private (0700)');
+  }
+  const path = join(record.workDir, 'Dockerfile');
+  let fd;
+  try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
+  catch (error) { fail(`Unsafe retained Dockerfile: cannot open a regular unlinked file (${error.code})`); }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile()) fail('Unsafe retained Dockerfile: expected a regular file');
+    if (stat.nlink !== 1) fail('Unsafe retained Dockerfile: hard links are not supported');
+    if (stat.uid !== process.getuid()) fail(`Unsafe retained Dockerfile: file owner ${stat.uid} differs from current user ${process.getuid()}`);
+    if (stat.mode & 0o7000) fail('Unsafe retained Dockerfile: special permission bits are not supported');
+    // Asset copies can retain 0664 under umask 002. Private canonical ancestors
+    // exclude other users; normalize this owned inode without following links.
+    fchmodSync(fd, 0o600);
+    const text = readFileSync(fd, 'utf8');
+    const current = lstatSync(path);
+    if (current.dev !== stat.dev || current.ino !== stat.ino || current.nlink !== 1) fail('Unsafe retained Dockerfile: file changed during normalization');
+    const oldLine = /^COPY sources\.json \/opt\/ours\/sources\.json$/m;
+    if (oldLine.test(text)) atomicWriteConfig(path, text.replace(oldLine, 'COPY --chmod=644 sources.json /opt/ours/sources.json'));
+  } finally { closeSync(fd); }
+}
+
+const probeScript = `
+const fs = require('node:fs'), crypto = require('node:crypto');
+(async () => {
+  const path = '${policyPath}', s = fs.lstatSync(path);
+  if (!s.isFile() || s.nlink !== 1 || s.uid !== 0 || s.gid !== 0 || ![0o600, 0o644].includes(s.mode & 0o7777)) throw new Error('Unsupported policy ownership/type/mode');
+  let bytes;
+  try { bytes = fs.readFileSync(path); }
+  catch (error) { if (process.getuid() !== 0 && error.code === 'EACCES') { process.exitCode = 74; return; } throw error; }
+  const graph = await import('/opt/ours/maintenance/release-graph.mjs');
+  graph.verifyRuntimeRelease('/opt/ours');
+  const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+  const records = {};
+  for (const name of ['package.json', 'package-lock.json', 'dependency-tree.json', 'build-context.json']) {
+    const file = '/opt/ours/' + name, stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.nlink !== 1) throw new Error('Unsupported build record');
+    records[name] = hash(fs.readFileSync(file));
+  }
+  console.log(JSON.stringify({ uid: s.uid, gid: s.gid, regular: true, links: s.nlink, mode: s.mode & 0o7777, policyHash: hash(bytes), records }));
+})().catch(error => { console.error(error.message); process.exitCode = 1; });
+`;
+
+export async function qualifyDockerRuntime(record, effects) {
+  if (!/^ours-[a-z0-9-]+$/.test(record.project ?? '')) fail('unexpected installation project');
+  const uid = record.uid ?? 1000, gid = record.gid ?? 1000;
+  if (![uid, gid].every(n => Number.isInteger(n) && n > 0)) fail('non-root runtime UID/GID required');
+  const tag = `${record.project}:runtime`;
+  const inspect = async target => {
+    const { stdout } = await effects.run('docker', ['image', 'inspect', target], { timeout: 60000 });
+    const [value] = JSON.parse(stdout);
+    if (!imageId(value?.Id) || !Array.isArray(value.RootFS?.Layers) || value.Config?.Labels?.['network.ours.build-context'] !== '1') fail('image lacks recognized build metadata');
+    return value;
+  };
+  const probe = async (id, user) => {
+    const name = `ours-runtime-probe-${randomUUID()}`;
+    try {
+      const result = await effects.run('docker', ['run', '--rm', '--name', name, '--read-only', '--network', 'none', '--cap-drop', 'ALL',
+        '--security-opt', 'no-new-privileges:true', '--pids-limit', '64', '--memory', '256m', '--user', user, '--entrypoint', 'node', id, '-e', probeScript],
+      { allowCodes: [1, 74], timeout: 60000 });
+      return { code: result.code, report: result.code === 0 ? JSON.parse(result.stdout) : null };
+    } catch (error) {
+      // A killed Docker client can leave its own bounded probe container behind.
+      try { await effects.run('docker', ['rm', '-f', name], { allowCodes: [1], timeout: 10000 }); } catch {}
+      throw error;
+    }
+  };
+  const policy = readFileSync(record.sourcesPath), expectedHash = digest(policy);
+  const check = (report, mode) => {
+    if (!report || report.mode !== mode || report.uid !== 0 || report.gid !== 0 || !report.regular || report.links !== 1 || report.policyHash !== expectedHash) fail('image policy differs from retained selection or expected permissions');
+  };
+  const original = await inspect(tag);
+  const ordinary = await probe(original.Id, `${uid}:${gid}`);
+  if (ordinary.code === 0) { check(ordinary.report, 0o644); return; }
+  if (ordinary.code !== 74) fail('cached image is unusable; automatic repair only supports the known source-policy permission defect');
+  const privileged = await probe(original.Id, '0:0');
+  if (privileged.code !== 0) fail('original release graph could not be verified');
+  check(privileged.report, 0o600);
+  effects.out?.('Repairing cached Docker image permissions; keeping the selected packages and stored data.');
+  const directory = mkdtempSync(join(record.root, '.image-permissions-'));
+  const name = `ours-permission-repair-${randomUUID()}`, baseTag = `${name}:base`, candidateTag = `${name}:candidate`;
+  try {
+    // Unique local alias transports the immutable ID into BuildKit. The resulting
+    // layer ancestry and complete execution config are checked before publication.
+    await effects.run('docker', ['image', 'tag', original.Id, baseTag]);
+    if ((await inspect(baseTag)).Id !== original.Id) fail('repair base image changed');
+    writeFileSync(join(directory, 'sources.json'), policy, { mode: 0o600, flag: 'wx' });
+    writeFileSync(join(directory, 'Dockerfile'), `FROM ${baseTag}\nCOPY --chmod=644 sources.json ${policyPath}\n`, { mode: 0o600, flag: 'wx' });
+    await effects.run('docker', ['build', '--network=none', '--pull=false', '--tag', candidateTag, directory], { stream: true, timeout: 120000 });
+    const candidate = await inspect(candidateTag);
+    if (!isDeepStrictEqual(candidate.Config, original.Config) || !isDeepStrictEqual(candidate.RootFS.Layers.slice(0, original.RootFS.Layers.length), original.RootFS.Layers)
+        || candidate.RootFS.Layers.length !== original.RootFS.Layers.length + 1) fail('repair changed image execution settings or ancestry');
+    const verified = await probe(candidate.Id, `${uid}:${gid}`);
+    if (verified.code !== 0) fail('repaired image did not pass runtime verification');
+    check(verified.report, 0o644);
+    if (!isDeepStrictEqual(verified.report.records, privileged.report.records)) fail('repair changed build provenance');
+    if ((await inspect(tag)).Id !== original.Id) fail('selected image changed during repair; retry setup');
+    await effects.run('docker', ['image', 'tag', candidate.Id, tag]);
+    effects.out?.('Cached Docker image repaired and verified; continuing setup.');
+  } finally {
+    for (const temporary of [candidateTag, baseTag]) {
+      try { await effects.run('docker', ['image', 'rm', temporary], { allowCodes: [1], timeout: 10000 }); } catch {}
+    }
+    rmSync(directory, { recursive: true, force: true });
+  }
+}