@runuai/host 0.9.1 → 0.9.2

package/lib/git-identity.ts

@@ -4,19 +4,25 @@
  * identity. Best-effort, mirrors the SSH setup: a failure logs but never aborts
  * task-up. Name falls back to the email when no display name is known.
  *
- * ensureTaskSshIdentity re-asserts the SSH push identity + its DEPENDENT git
- * config the same way gh tokens are re-asserted at channel ensure — the
- * one-shot copy at task-up proved fragile (live 2026-07-21: a recreated
- * container lost the key silently; a later repair restored the key WITHOUT
- * the config and pushes stayed on HTTPS → 403). Key and config are a unit.
+ * ensureTaskSshIdentity re-asserts the SSH signing identity and its dependent
+ * signing config the same way GitHub tokens are re-asserted at channel ensure.
+ * Git transport is separate: connected users push over HTTPS through gh; SSH
+ * is only the explicit no-connection fallback.
  */
 
-import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 
+import { eq } from "drizzle-orm";
+
+import { getDb, schema } from "./db";
 import { dockerCli } from "./docker-exec";
-import { env } from "./env";
-import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
+import {
+  deleteKey,
+  getPublicKey,
+  removeTaskIdentity,
+  writeTaskIdentity,
+} from "./ssh";
 
 const EXEC_TIMEOUT_MS = 10_000;
 
@@ -24,11 +30,11 @@ const EXEC_TIMEOUT_MS = 10_000;
  *  doesn't block the host event loop (this runs on every channel ensure). */
 export type DockerExec = (
   args: string[],
-) => Promise<{ status: number | null; stderr: string }>;
+) => Promise<{ status: number | null; stdout?: string; stderr: string }>;
 
 const defaultExec: DockerExec = async (args) => {
   const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
-  return { status: res.status, stderr: res.stderr };
+  return { status: res.status, stdout: res.stdout, stderr: res.stderr };
 };
 
 export async function setupTaskGitIdentity(
@@ -55,7 +61,7 @@ export async function setupTaskGitIdentity(
       "-u",
       "node",
       container,
-      "git",
+      "/usr/bin/git",
       "config",
       "--global",
       key,
@@ -72,18 +78,43 @@ export async function setupTaskGitIdentity(
   return true;
 }
 
-// The key's dependent git config, applied as one unit with the key itself:
-// SSH routing for every GitHub remote (mirrors are born with the project's
-// clone URL, usually https) + SSH commit/tag signing. Same statements as
-// uai-init's key-gated block — which silently self-skips when the key is
-// missing at ITS run time, hence re-applying here.
-const SSH_GIT_CONFIG =
-  'git config --global url."git@github.com:".insteadOf "https://github.com/"' +
-  ' && git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"' +
-  " && git config --global gpg.format ssh" +
-  " && git config --global user.signingkey /home/node/.ssh/id_ed25519.pub" +
-  " && git config --global commit.gpgsign true" +
-  " && git config --global tag.gpgsign true";
+// The key's dependent signing config, applied as one unit with the key itself.
+// Deliberately no URL rewrite: doing that here would override a connected
+// user's gh HTTPS credential and make SSH mandatory again.
+const SSH_SIGNING_CONFIG =
+  "/usr/bin/git config --global gpg.format ssh" +
+  " && /usr/bin/git config --global user.signingkey /home/node/.ssh/id_ed25519.pub" +
+  " && /usr/bin/git config --global commit.gpgsign true" +
+  " && /usr/bin/git config --global tag.gpgsign true";
+
+const SSH_TRANSPORT_CONFIG =
+  "/usr/bin/git config --global --unset-all 'url.https://github.com/.insteadOf' >/dev/null 2>&1 || true; " +
+  "/usr/bin/git config --global --replace-all 'url.git@github.com:.insteadOf' 'https://github.com/'; " +
+  '/usr/bin/git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"';
+
+/** Select SSH transport inside a disconnected task container. */
+export async function configureTaskSshTransport(
+  taskId: string,
+  exec: DockerExec = defaultExec,
+): Promise<boolean> {
+  const res = await exec([
+    "exec",
+    "-u",
+    "node",
+    `task-${taskId}-app-1`,
+    "/bin/sh",
+    "-c",
+    SSH_TRANSPORT_CONFIG,
+  ]);
+  if (res.status !== 0) {
+    console.warn(
+      `[ssh] task ${taskId}: SSH transport fallback setup failed: ${res.stderr.trim()}`,
+    );
+    return false;
+  }
+  console.log(`[ssh] task ${taskId}: SSH Git transport fallback selected`);
+  return true;
+}
 
 /**
  * Copy the SSH identity at `keyPath` into the task container and apply its
@@ -98,17 +129,17 @@ export async function injectSshIdentity(
 ): Promise<boolean> {
   const container = `task-${taskId}-app-1`;
   const steps: ReadonlyArray<readonly [string, string[]]> = [
-    ["mkdir ~/.ssh", ["exec", "-u", "root", container, "mkdir", "-p", "/home/node/.ssh"]],
+    ["mkdir ~/.ssh", ["exec", "-u", "root", container, "/bin/mkdir", "-p", "/home/node/.ssh"]],
     ["copy key", ["cp", keyPath, `${container}:/home/node/.ssh/id_ed25519`]],
     ["copy pubkey", ["cp", `${keyPath}.pub`, `${container}:/home/node/.ssh/id_ed25519.pub`]],
     [
       "own + chmod",
       [
-        "exec", "-u", "root", container, "sh", "-c",
-        "chown -R node:node /home/node/.ssh && chmod 700 /home/node/.ssh && chmod 600 /home/node/.ssh/id_ed25519",
+        "exec", "-u", "root", container, "/bin/sh", "-c",
+        "/bin/chown -R node:node /home/node/.ssh && /bin/chmod 700 /home/node/.ssh && /bin/chmod 600 /home/node/.ssh/id_ed25519",
       ],
     ],
-    ["ssh routing + signing config", ["exec", "-u", "node", container, "sh", "-c", SSH_GIT_CONFIG]],
+    ["SSH signing config", ["exec", "-u", "node", container, "/bin/sh", "-c", SSH_SIGNING_CONFIG]],
   ];
   for (const [label, args] of steps) {
     const res = await exec(args);
@@ -119,7 +150,7 @@ export async function injectSshIdentity(
       return false;
     }
   }
-  console.log(`[ssh] task ${taskId}: push identity + git SSH config asserted`);
+  console.log(`[ssh] task ${taskId}: signing identity + git signing config asserted`);
   return true;
 }
 
@@ -130,11 +161,33 @@ export async function injectSshIdentity(
 // UNREADABLE by node inside the container ("Load key: Permission denied",
 // live 2026-07-21). Serialize, and skip entirely when the key is already
 // good, so the steady state does zero docker work.
-const sshEnsureInFlight = new Set<string>();
+interface SshEnsureInFlight {
+  fingerprint: string;
+  promise: Promise<boolean>;
+}
 
-/** True when node can already read a correctly-owned key in the container. */
+const sshEnsureInFlight = new Map<string, SshEnsureInFlight>();
+
+function sshPublicKeyFingerprint(publicKey: string): string | null {
+  const [, encoded] = publicKey.trim().split(/\s+/, 3);
+  if (!encoded) return null;
+  try {
+    const material = Buffer.from(encoded, "base64");
+    if (material.length === 0) return null;
+    return createHash("sha256")
+      .update(material)
+      .digest("base64")
+      .replace(/=+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+/** True only when the readable container key is the current DB-authoritative
+ * key for this owner. A copied key is not authority after ssh.key.delete. */
 async function sshKeyHealthy(
   taskId: string,
+  expectedPublicKey: string,
   exec: DockerExec,
 ): Promise<boolean> {
   const res = await exec([
@@ -142,16 +195,27 @@ async function sshKeyHealthy(
     "-u",
     "node",
     `task-${taskId}-app-1`,
-    "test",
-    "-r",
-    "/home/node/.ssh/id_ed25519",
+    "/bin/sh",
+    "-c",
+    "test -r /home/node/.ssh/id_ed25519 && /bin/cat /home/node/.ssh/id_ed25519.pub",
   ]);
-  return res.status === 0;
+  const expectedFingerprint = sshPublicKeyFingerprint(expectedPublicKey);
+  const actualFingerprint = sshPublicKeyFingerprint(res.stdout ?? "");
+  return (
+    res.status === 0 &&
+    expectedFingerprint !== null &&
+    actualFingerprint === expectedFingerprint
+  );
+}
+
+interface EnsureTaskSshIdentityDeps {
+  publicKeyForUser?: (userId: string) => string | null;
+  writeIdentity?: typeof writeTaskIdentity;
 }
 
 /**
- * Ensure the task container has a node-readable SSH push identity + git
- * config. Idempotent and race-free: skips the copy when the key is already
+ * Ensure the task container has a node-readable SSH signing identity + git
+ * signing config. Idempotent and race-free: skips the copy when the key is already
  * healthy (the common case), and never runs two injects for one task at
  * once. Only (re)materializes + copies the key when it is missing or
  * unreadable. Safe to call on every channel ensure.
@@ -160,49 +224,264 @@ export async function ensureTaskSshIdentity(
   taskId: string,
   ownerUserId: string | null | undefined,
   exec: DockerExec = defaultExec,
+  deps: EnsureTaskSshIdentityDeps = {},
 ): Promise<boolean> {
-  if (sshEnsureInFlight.has(taskId)) return true; // another ensure owns it
-  sshEnsureInFlight.add(taskId);
+  const publicKeyForUser = deps.publicKeyForUser ?? getPublicKey;
+  const expectedPublicKey = ownerUserId
+    ? publicKeyForUser(ownerUserId)
+    : null;
+  // Consult authority before joining an older in-flight ensure. A deleted key
+  // must turn fallback off immediately even if its prior copy is still readable.
+  if (!ownerUserId || !expectedPublicKey) return false;
+  const expectedFingerprint = sshPublicKeyFingerprint(expectedPublicKey);
+  if (!expectedFingerprint) return false;
+  const existing = sshEnsureInFlight.get(taskId);
+  if (existing) {
+    const result = await existing.promise;
+    if (existing.fingerprint !== expectedFingerprint) {
+      // An older key finished copying while authority rotated. Replace its map
+      // entry and run once more for the current key; never bless A as B.
+      if (sshEnsureInFlight.get(taskId) === existing) {
+        sshEnsureInFlight.delete(taskId);
+      }
+      return ensureTaskSshIdentity(taskId, ownerUserId, exec, deps);
+    }
+    return (
+      result &&
+      sshPublicKeyFingerprint(publicKeyForUser(ownerUserId) ?? "") ===
+        sshPublicKeyFingerprint(expectedPublicKey)
+    );
+  }
+  const pending = ensureTaskSshIdentityOnce(
+    taskId,
+    ownerUserId,
+    expectedPublicKey,
+    exec,
+    deps.writeIdentity ?? writeTaskIdentity,
+  );
+  const entry = { fingerprint: expectedFingerprint, promise: pending };
+  sshEnsureInFlight.set(taskId, entry);
   try {
-    // Fast path: key already good → re-assert only the (cheap, idempotent)
-    // git config and skip the docker cp churn that causes the ownership race.
-    if (await sshKeyHealthy(taskId, exec)) {
-      await exec([
+    const result = await pending;
+    return (
+      result &&
+      sshPublicKeyFingerprint(publicKeyForUser(ownerUserId) ?? "") ===
+        sshPublicKeyFingerprint(expectedPublicKey)
+    );
+  } finally {
+    if (sshEnsureInFlight.get(taskId) === entry) {
+      sshEnsureInFlight.delete(taskId);
+    }
+  }
+}
+
+async function ensureTaskSshIdentityOnce(
+  taskId: string,
+  ownerUserId: string,
+  expectedPublicKey: string,
+  exec: DockerExec,
+  writeIdentity: typeof writeTaskIdentity,
+): Promise<boolean> {
+  // Fast path: the DB-authoritative key is already good → re-assert only the
+  // cheap signing config and skip docker cp churn.
+  if (await sshKeyHealthy(taskId, expectedPublicKey, exec)) {
+    const configured = await exec([
         "exec",
         "-u",
         "node",
         `task-${taskId}-app-1`,
-        "sh",
+        "/bin/sh",
         "-c",
-        SSH_GIT_CONFIG,
+        SSH_SIGNING_CONFIG,
       ]);
-      return true;
-    }
+    return configured.status === 0;
+  }
 
-    let keyPath: string | null = null;
-    let perTask = false;
-    const dir = writeTaskIdentity(taskId, ownerUserId);
-    if (dir) {
-      keyPath = resolve(dir, "id_ed25519");
-      perTask = true;
-    } else {
-      const operatorKey = resolve(env.dataDir, "identity", "id_ed25519");
-      if (existsSync(operatorKey)) keyPath = operatorKey;
-    }
-    if (!keyPath) {
-      console.log(
-        `[ssh] task ${taskId}: no SSH identity for owner or operator — git pushes stay on HTTPS`,
-      );
-      return false;
-    }
-    try {
-      return await injectSshIdentity(taskId, keyPath, exec);
-    } finally {
-      // Host hygiene (same as task-up): the materialized private key never
-      // outlives the injection.
-      if (perTask) removeTaskIdentity(taskId);
-    }
+  const dir = writeIdentity(taskId, ownerUserId);
+  if (!dir) {
+    console.log(`[ssh] task ${taskId}: no SSH signing identity for its owner`);
+    return false;
+  }
+  const keyPath = resolve(dir, "id_ed25519");
+  try {
+    return await injectSshIdentity(taskId, keyPath, exec);
   } finally {
-    sshEnsureInFlight.delete(taskId);
+    // Host hygiene (same as task-up): the materialized private key never
+    // outlives the injection.
+    removeTaskIdentity(taskId);
+  }
+}
+
+const REMOVE_MANAGED_SSH_IDENTITY = [
+  "set -eu",
+  "/usr/bin/rm -f -- /home/node/.ssh/id_ed25519 /home/node/.ssh/id_ed25519.pub",
+  "/usr/bin/git config --global --unset-all user.signingkey >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all commit.gpgsign >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all tag.gpgsign >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all gpg.format >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all 'url.git@github.com:.insteadOf' >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --replace-all 'url.https://github.com/.insteadOf' 'git@github.com:'",
+  "/usr/bin/git config --global --add 'url.https://github.com/.insteadOf' 'ssh://git@github.com/'",
+  "test ! -e /home/node/.ssh/id_ed25519",
+  "test ! -e /home/node/.ssh/id_ed25519.pub",
+  "test -z \"$(/usr/bin/git config --global --get-all user.signingkey 2>/dev/null || true)\"",
+].join("; ");
+
+const SANITIZED_SSH_EXEC_ENV = [
+  "-e",
+  "HOME=/home/node",
+  "-e",
+  "PATH=/usr/bin:/bin",
+  "-e",
+  "XDG_CONFIG_HOME=",
+  "-e",
+  "LD_PRELOAD=",
+  "-e",
+  "LD_LIBRARY_PATH=",
+  "-e",
+  "GIT_CONFIG=",
+  "-e",
+  "GIT_CONFIG_GLOBAL=",
+  "-e",
+  "GIT_CONFIG_SYSTEM=",
+  "-e",
+  "GIT_CONFIG_NOSYSTEM=",
+  "-e",
+  "GIT_CONFIG_COUNT=0",
+  "-e",
+  "GIT_EXEC_PATH=",
+  "-e",
+  "GIT_SSH=",
+  "-e",
+  "GIT_SSH_COMMAND=",
+] as const;
+
+async function checkedSshDocker(
+  exec: DockerExec,
+  args: string[],
+  label: string,
+): Promise<{ status: number | null; stdout?: string; stderr: string }> {
+  const result = await exec(args);
+  if (result.status !== 0) {
+    throw new Error(
+      `${label} failed: ${result.stderr.trim() || `exit ${result.status}`}`,
+    );
+  }
+  return result;
+}
+
+/** Remove a copied SSH key and every config entry that depends on it. A
+ * non-running container is disposable and is removed without executing its
+ * credential-bearing filesystem; Compose recreates it on Resume. */
+export async function removeTaskSshIdentityFromContainer(
+  taskId: string,
+  exec: DockerExec = defaultExec,
+): Promise<void> {
+  const container = `task-${taskId}-app-1`;
+  const inspectArgs = [
+    "ps",
+    "--all",
+    "--filter",
+    `name=^/${container}$`,
+    "--format",
+    "{{.State}}",
+  ];
+  const listed = await checkedSshDocker(
+    exec,
+    inspectArgs,
+    `inspect ${container}`,
+  );
+  const states = (listed.stdout ?? "")
+    .split(/\r?\n/)
+    .map((state) => state.trim())
+    .filter(Boolean);
+  if (states.length === 0) return;
+  if (states.length !== 1) {
+    throw new Error(`inspect ${container} returned ${states.length} containers`);
+  }
+  if (states[0] !== "running") {
+    await checkedSshDocker(
+      exec,
+      ["rm", "--force", container],
+      `remove SSH credential-bearing ${container}`,
+    );
+    const remaining = await checkedSshDocker(
+      exec,
+      inspectArgs,
+      `verify removal of ${container}`,
+    );
+    if ((remaining.stdout ?? "").trim()) {
+      throw new Error(`remove ${container} was not verified`);
+    }
+    return;
   }
+
+  await checkedSshDocker(
+    exec,
+    [
+      "exec",
+      "-u",
+      "node",
+      ...SANITIZED_SSH_EXEC_ENV,
+      container,
+      "/usr/bin/env",
+      "-i",
+      "HOME=/home/node",
+      "PATH=/usr/bin:/bin",
+      "/bin/sh",
+      "-c",
+      REMOVE_MANAGED_SSH_IDENTITY,
+    ],
+    `remove managed SSH identity from ${container}`,
+  );
+}
+
+function sshCredentialTaskIdsForUser(userId: string): string[] {
+  return getDb()
+    .select({
+      taskId: schema.hostTasks.taskId,
+      endedAt: schema.hostTasks.endedAt,
+      composeProject: schema.hostTasks.composeProject,
+      statusMirror: schema.hostTasks.statusMirror,
+    })
+    .from(schema.hostTasks)
+    .where(eq(schema.hostTasks.ownerUserId, userId))
+    .all()
+    .filter(
+      (task) =>
+        task.endedAt == null ||
+        task.composeProject != null ||
+        task.statusMirror === "error",
+    )
+    .map((task) => task.taskId);
+}
+
+export interface DeleteUserSshIdentityDeps {
+  deleteStored?: (userId: string) => void;
+  taskIds?: (userId: string) => string[];
+  removeFromContainer?: (taskId: string) => Promise<void>;
+}
+
+/** Delete authority first, then drain any older ensure and remove all copied
+ * material before acknowledging ssh.key.delete. */
+export async function deleteUserSshIdentity(
+  userId: string,
+  deps: DeleteUserSshIdentityDeps = {},
+): Promise<void> {
+  (deps.deleteStored ?? deleteKey)(userId);
+  const taskIds = (deps.taskIds ?? sshCredentialTaskIdsForUser)(userId);
+  const removeFromContainer =
+    deps.removeFromContainer ?? removeTaskSshIdentityFromContainer;
+  const settled = await Promise.allSettled(
+    taskIds.map(async (taskId) => {
+      await sshEnsureInFlight.get(taskId)?.promise.catch(() => {});
+      removeTaskIdentity(taskId);
+      await removeFromContainer(taskId);
+    }),
+  );
+  const failed = settled.find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  if (failed) throw failed.reason;
 }