@runuai/host 0.9.13 → 0.9.42

package/images/standard/container/uai-init

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 # uai-init — prepare a standard-image task container (ADR-022).
 #
 # Runs INSIDE the container (Linux, bash 5 — may use anything). Invoked by
@@ -9,31 +9,278 @@
 # per selected project. A 0-project (scratchpad) task has an empty /workspace.
 #
 # Responsibilities:
-#   1. For each /workspace/<slug>/ that carries a .tool-versions: `asdf
-#      install` (downloads cached on the host-wide /opt/asdf-data volume),
-#      then a dependency-install heuristic for the folder's stack.
+#   1. For each /workspace/<slug>/ project, run a dependency-install heuristic
+#      for the folder's stack. task-up has already materialized and verified
+#      its declared runtimes or the image's root defaults before this task
+#      container starts; this script never mutates the shared asdf volume.
 #   2. Launch code-server on 0.0.0.0:8080 (auth disabled — reached only via
 #      the authenticated tunnel), opening /workspace.
 #
-# Best-effort + idempotent: a failing folder logs and is skipped; it never
-# aborts the whole init. Re-running when things are already up is a no-op.
-# uai-init itself always exits 0 so task-up's `docker exec ... uai-init` step
-# succeeds as long as the container is reachable.
+# Best-effort + idempotent: an ordinary failing folder logs and is skipped.
+# Re-running when things are already up is a no-op. A host runtime-authority
+# violation exits 78 so task-up/recovery can quarantine the task instead of
+# starting agents against a runtime context that was never proved.
 
 set -uo pipefail
 
 WORKSPACE="${UAI_WORKSPACE:-/workspace}"
-ASDF_SH="${ASDF_DIR:-/opt/asdf}/asdf.sh"
+RUNTIME_PROJECTS="${UAI_RUNTIME_PROJECTS:-/run/uai/runtime-projects}"
+
+# Compose owns runtime/cache selection. Reassert it here for rolling recovery
+# and remove every inherited asdf/Corepack/npm authority variable before any
+# dependency command resolves a runtime. No command in this script installs or
+# reshims. Direct source-tree tests may prepend stubs; the packaged path never
+# honors those test-only seams. Bash does not import environment names that
+# contain `-`, but npm treats LOGS-DIR and LOGS_DIR as the same setting. Strip
+# every owned spelling with GNU/BSD env before continuing, then export only
+# Uai's exact canonical names. Unrelated registry/auth npm config survives.
+npm_sanitize_args=()
+while IFS= read -r -d '' environment_entry; do
+  environment_name=${environment_entry%%=*}
+  case "$environment_name" in
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss][_-][Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk])
+      npm_sanitize_args+=( -u "$environment_name" )
+      ;;
+  esac
+done < <(/usr/bin/env -0)
+if [ "${#npm_sanitize_args[@]}" -gt 0 ]; then
+  exec /usr/bin/env "${npm_sanitize_args[@]}" \
+    /bin/bash "${BASH_SOURCE[0]}" "$@"
+fi
+
+for runtime_var in $(compgen -A variable 2>/dev/null); do
+  case "$runtime_var" in
+    ASDF_* | COREPACK_* | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss]_[Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk])
+      unset "$runtime_var"
+      ;;
+  esac
+done
+unset LD_PRELOAD LD_AUDIT LD_LIBRARY_PATH NODE_OPTIONS NODE_PATH PS4 BASH_ENV ENV
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) export HOME=/home/node ;;
+esac
+export XDG_CONFIG_HOME="$HOME/.config"
+export XDG_DATA_HOME="$HOME/.local/share"
+export XDG_CACHE_HOME="$HOME/.cache"
+export ASDF_DIR=/opt/asdf
+export ASDF_DATA_DIR=/opt/asdf-data
+export ASDF_CONFIG_FILE=/dev/null
+export ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions
+export ASDF_NODEJS_VERSION=
+export ASDF_PYTHON_VERSION=
+export ASDF_GOLANG_VERSION=
+export ASDF_RUBY_VERSION=
+export ASDF_RUST_VERSION=
+export ASDF_SKIP_RESHIM=1
+export COREPACK_HOME=/opt/asdf-data/corepack
+export COREPACK_DEFAULT_TO_LATEST=0
+export COREPACK_ENV_FILE=0
+export COREPACK_NPM_REGISTRY=https://registry.npmjs.org
+export COREPACK_ENABLE_NETWORK=0
+export COREPACK_ENABLE_AUTO_PIN=0
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export COREPACK_ENABLE_PROJECT_SPEC=1
+export COREPACK_ENABLE_STRICT=1
+export COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0
+export COREPACK_INTEGRITY_CHECK=1
+export NPM_CONFIG_PREFIX="$HOME/.local/share/uai-npm"
+export npm_config_prefix="$NPM_CONFIG_PREFIX"
+export NPM_CONFIG_CACHE="$HOME/.cache/uai-npm"
+export npm_config_cache="$NPM_CONFIG_CACHE"
+export NPM_CONFIG_LOGS_DIR="$NPM_CONFIG_CACHE/_logs"
+export npm_config_logs_dir="$NPM_CONFIG_LOGS_DIR"
+export NPM_CONFIG_UMASK=0002
+export npm_config_umask=0002
+export NODE_OPTIONS=
+export NODE_PATH=
+export PATH="/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$NPM_CONFIG_PREFIX/bin"
+# Fixed here, not from the environment: the packaged path must not let a
+# forged mount table or lower path defeat the shared-cache backstop below.
+UAI_PROC_MOUNTS=/proc/mounts
+UAI_ASDF_LOWER_DIR=/run/uai/asdf-lower
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) ;;
+  *)
+    if [ -n "${UAI_INIT_TEST_ASDF_DATA_DIR:-}" ]; then
+      export ASDF_DATA_DIR="$UAI_INIT_TEST_ASDF_DATA_DIR"
+      export COREPACK_HOME="$ASDF_DATA_DIR/corepack"
+    fi
+    if [ -n "${UAI_INIT_TEST_PATH:-}" ]; then
+      export PATH="$UAI_INIT_TEST_PATH:$PATH"
+    fi
+    if [ -n "${UAI_INIT_TEST_PROC_MOUNTS:-}" ]; then
+      UAI_PROC_MOUNTS="$UAI_INIT_TEST_PROC_MOUNTS"
+    fi
+    if [ -n "${UAI_INIT_TEST_ASDF_LOWER_DIR:-}" ]; then
+      UAI_ASDF_LOWER_DIR="$UAI_INIT_TEST_ASDF_LOWER_DIR"
+    fi
+    ;;
+esac
+ASDF_SH="$ASDF_DIR/asdf.sh"
 
 log() { echo "uai-init: $*"; }
 
+reject_writable_shared_runtime_cache() {
+  # The host proves the Docker mount metadata before invoking us. Keep an
+  # in-container backstop as well so a current initializer staged into a
+  # legacy/recovered container cannot become a shared-cache writer. This is a
+  # metadata/access check only: never create even a temporary shared file.
+  if [ ! -d "$ASDF_DATA_DIR" ]; then
+    log "error: shared runtime cache is missing; refusing dependency or editor startup"
+    return 1
+  fi
+  # ADR-108 (apple): /opt/asdf-data is an in-guest overlay — writable BY
+  # DESIGN, with every write landing in the task-private upper layer. That is
+  # safe exactly when the overlay is real (this mount table, not trust) and
+  # its lower is the read-only shared attachment; the shared volume then
+  # still cannot be written from this container. Any other writable shape
+  # remains the violation it always was.
+  # /usr/bin paths: present on both merged-usr Debian (in-container) and
+  # macOS (the direct source-tree test harness). Token-exact matching against
+  # comma-delimited mount options — substring matching accepted
+  # lowerdir=<lower>-evil — plus exactly ONE effective mount at the merged
+  # path (a later mount would shadow the proven one).
+  local overlay_lines="" any_lines="" overlay_opts=""
+  overlay_lines=$(/usr/bin/grep -c "^overlay ${ASDF_DATA_DIR} overlay " \
+    "$UAI_PROC_MOUNTS" 2>/dev/null) || overlay_lines=0
+  if [ "$overlay_lines" != "0" ]; then
+    if [ "$overlay_lines" != "1" ]; then
+      log "error: expected exactly one shared runtime cache overlay, found $overlay_lines; refusing dependency or editor startup"
+      return 1
+    fi
+    any_lines=$(/usr/bin/grep -c " ${ASDF_DATA_DIR} " "$UAI_PROC_MOUNTS" \
+      2>/dev/null) || any_lines=0
+    if [ "$any_lines" != "1" ]; then
+      log "error: unexpected extra mounts at the shared runtime cache; refusing dependency or editor startup"
+      return 1
+    fi
+    overlay_opts=$(/usr/bin/grep "^overlay ${ASDF_DATA_DIR} overlay " \
+      "$UAI_PROC_MOUNTS" | /usr/bin/cut -d" " -f4)
+    case ",$overlay_opts," in
+      *",lowerdir=${UAI_ASDF_LOWER_DIR},"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign lower; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    case ",$overlay_opts," in
+      *",upperdir=/var/lib/uai/asdf-upper,"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign upper; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    case ",$overlay_opts," in
+      *",workdir=/var/lib/uai/asdf-work,"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign workdir; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    if [ ! -d "$UAI_ASDF_LOWER_DIR" ]; then
+      log "error: shared runtime cache lower attachment is missing; refusing dependency or editor startup"
+      return 1
+    fi
+    if [ -w "$UAI_ASDF_LOWER_DIR" ]; then
+      log "error: shared runtime cache lower attachment is writable; refusing dependency or editor startup"
+      return 1
+    fi
+    return 0
+  fi
+  if [ -w "$ASDF_DATA_DIR" ]; then
+    log "error: shared runtime cache is writable in the task container; refusing dependency or editor startup"
+    return 1
+  fi
+}
+
+prepare_private_npm_authority() {
+  local path prefix_probe="" cache_probe="" logs_probe=""
+
+  # These directories live in the task container layer, never on the shared
+  # asdf volume. Reject redirects before mkdir, then prove both exact write
+  # targets. The task has not started any agents yet, so there is no concurrent
+  # task process that can race these checks.
+  for path in \
+    "$HOME/.local" \
+    "$HOME/.local/share" \
+    "$NPM_CONFIG_PREFIX" \
+    "$HOME/.cache" \
+    "$NPM_CONFIG_CACHE" \
+    "$NPM_CONFIG_LOGS_DIR"
+  do
+    if [ -L "$path" ] || { [ -e "$path" ] && [ ! -d "$path" ]; }; then
+      log "error: private npm authority path is unsafe: $path"
+      return 1
+    fi
+  done
+
+  if ! /bin/mkdir -p -- \
+    "$NPM_CONFIG_PREFIX/bin" "$NPM_CONFIG_CACHE" "$NPM_CONFIG_LOGS_DIR"; then
+    log "error: could not prepare the private npm prefix/cache"
+    return 1
+  fi
+  for path in \
+    "$NPM_CONFIG_PREFIX" \
+    "$NPM_CONFIG_PREFIX/bin" \
+    "$NPM_CONFIG_CACHE" \
+    "$NPM_CONFIG_LOGS_DIR"
+  do
+    if [ -L "$path" ] || [ ! -d "$path" ]; then
+      log "error: private npm authority path changed during preparation: $path"
+      return 1
+    fi
+  done
+
+  prefix_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_PREFIX/.uai-write-probe.XXXXXX") || {
+      log "error: private npm prefix is not writable"
+      return 1
+    }
+  cache_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_CACHE/.uai-write-probe.XXXXXX") || {
+      /bin/rm -f -- "$prefix_probe"
+      log "error: private npm cache is not writable"
+      return 1
+    }
+  logs_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_LOGS_DIR/.uai-write-probe.XXXXXX") || {
+      /bin/rm -f -- "$prefix_probe" "$cache_probe"
+      log "error: private npm logs directory is not writable"
+      return 1
+    }
+  /bin/rm -f -- "$prefix_probe" "$cache_probe" "$logs_probe"
+}
+
+reject_workspace_runtime_shadow() {
+  local shadow="$WORKSPACE/.tool-versions"
+  # The root is never a selected project. Any entry here changes asdf lookup
+  # for no-manifest projects without being part of the pre-start proof. Check
+  # metadata only so a FIFO/socket/device cannot block initialization.
+  if [ -L "$shadow" ] || [ -e "$shadow" ]; then
+    log "error: workspace-root .tool-versions appeared after runtime proof; refusing dependency or editor startup"
+    return 1
+  fi
+}
+
+# Fail before sourcing asdf or executing any project input if this is an old
+# writable task mount, or if task-private npm state redirects somewhere else.
+reject_writable_shared_runtime_cache || exit 78
+prepare_private_npm_authority || exit 78
+
 # Make asdf + its shims available to this non-interactive shell. A bare
 # `docker exec` sources no profile, so source asdf explicitly here.
 if [ -f "$ASDF_SH" ]; then
   # shellcheck disable=SC1090
   . "$ASDF_SH"
 else
-  log "warning: asdf not found at $ASDF_SH; runtime install will be skipped"
+  log "warning: asdf not found at $ASDF_SH; dependency runtime resolution may fail"
 fi
 
 # ---------------------------------------------------------------------------
@@ -98,7 +345,7 @@ if [ ! -f "$cc_settings" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 1. Per-folder runtime + dependency install.
+# 1. Per-folder dependency install (runtimes are already materialized).
 # ---------------------------------------------------------------------------
 
 install_node_deps() {
@@ -117,10 +364,6 @@ install_node_deps() {
     fi
   fi
 
-  # corepack ships with Node and resolves pnpm/yarn per the packageManager
-  # field; harmless no-op when already enabled.
-  corepack enable >/dev/null 2>&1 || true
-
   case "$pm" in
     pnpm) log "pnpm install"; pnpm install ;;
     yarn) log "yarn install"; yarn install ;;
@@ -148,20 +391,14 @@ install_python_deps() {
   fi
 }
 
-install_folder() {
+install_folder_deps() {
   local dir="$1" name
   name=$(basename "$dir")
 
-  # Enter the folder; asdf auto-resolves the nearest .tool-versions here.
+  # Enter the folder; asdf auto-resolves either its already-materialized local
+  # declarations or the already-proven root image defaults.
   cd "$dir" || { log "cannot cd into $name — skipping"; return; }
 
-  # Runtime install. asdf reads the in-scope .tool-versions and downloads any
-  # missing versions (cached on the /opt/asdf-data volume).
-  if command -v asdf >/dev/null 2>&1; then
-    log "asdf install ($name)"
-    asdf install || log "asdf install failed in $name — continuing"
-  fi
-
   # Dependency-install heuristic. Run every matcher that applies (a polyglot
   # folder may have more than one); each is independently best-effort.
   if [ -f package.json ]; then
@@ -180,23 +417,43 @@ install_folder() {
   fi
 }
 
-if [ -d "$WORKSPACE" ]; then
-  shopt -s nullglob
-  for folder in "$WORKSPACE"/*/; do
-    [ -d "$folder" ] || continue
-    if [ -f "${folder}.tool-versions" ]; then
-      # Run in a subshell so a `cd` (or a failing command under the relaxed
-      # error mode) in one folder never leaks into the next.
-      ( install_folder "$folder" )
-    else
-      log "no .tool-versions in $(basename "$folder") — skipping per-folder install"
+reject_workspace_runtime_shadow || exit 78
+
+if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
+   && [ ! -L "$RUNTIME_PROJECTS" ]; then
+  seen_runtime_projects="|"
+  while IFS= read -r project_slug || [ -n "$project_slug" ]; do
+    if [[ ! "$project_slug" =~ ^[a-z0-9-]{1,64}$ ]]; then
+      log "warning: unsafe runtime-project allowlist entry — skipping"
+      continue
     fi
-  done
-  shopt -u nullglob
-else
+    case "$seen_runtime_projects" in
+      *"|$project_slug|"*)
+        log "warning: duplicate runtime-project entry $project_slug — skipping"
+        continue
+        ;;
+    esac
+    seen_runtime_projects="${seen_runtime_projects}${project_slug}|"
+    folder="$WORKSPACE/$project_slug"
+    git_marker="$folder/.git"
+    if [ -L "$folder" ] || [ ! -d "$folder" ] || [ -L "$git_marker" ] \
+       || { [ ! -f "$git_marker" ] && [ ! -d "$git_marker" ]; }; then
+      log "warning: allowlisted project $project_slug is not a safe Git worktree — skipping"
+      continue
+    fi
+    reject_workspace_runtime_shadow || exit 78
+    # Run in a subshell so a `cd` (or a failing command under the relaxed
+    # error mode) in one folder never leaks into the next.
+    ( install_folder_deps "$folder" )
+  done < "$RUNTIME_PROJECTS"
+elif [ ! -d "$WORKSPACE" ]; then
   log "workspace $WORKSPACE missing — scratchpad/no-project task, skipping installs"
+else
+  log "warning: trusted runtime-project allowlist missing or unsafe — skipping installs"
 fi
 
+reject_workspace_runtime_shadow || exit 78
+
 # ---------------------------------------------------------------------------
 # 2. code-server — the Editor pane. Bound to 0.0.0.0:8080, auth disabled
 #    (reached only through the authenticated tunnel / editor proxy). Opens
@@ -263,7 +520,20 @@ if pgrep -f 'code-server.*--bind-addr' >/dev/null 2>&1; then
   log "code-server already running"
 else
   log "launching code-server on 0.0.0.0:8080"
-  nohup code-server \
+  # Compose deliberately replaces the image PATH with Uai's runtime authority
+  # path, which excludes task-writable home bins. code-server is an image-owned
+  # standalone install, so invoke its exact baked path instead of relying on
+  # PATH. A source-tree test invocation may resolve its isolated stub, but the
+  # two production destinations never consult PATH for this executable.
+  code_server_bin=/home/node/.local/bin/code-server
+  case "${BASH_SOURCE[0]}" in
+    /usr/local/bin/uai-init | /uai-init-current) ;;
+    *)
+      test_code_server_bin=$(command -v code-server 2>/dev/null || true)
+      [ -z "$test_code_server_bin" ] || code_server_bin="$test_code_server_bin"
+      ;;
+  esac
+  nohup "$code_server_bin" \
     --user-data-dir "$cs_data_dir" \
     --disable-workspace-trust \
     --auth none \