@runuai/host 0.9.138 → 0.9.140

package/lib/signin-box-credentials.ts

@@ -0,0 +1,465 @@
+/**
+ * ADR-136 sign-in box, the user and project credentials (host release 3b).
+ *
+ * The shared "Uai Cloud" row is where the cloud sends every workspace's
+ * GitHub connects, SSH key requests, MCP connection probes and project env
+ * writes for hostless tasks — the box is the writer for all of them. Same
+ * contract as engine accounts (lib/engine-accounts.ts, store-only accounts):
+ *
+ *  - GitHub tokens: the store first, a row with no ciphertext, the token in
+ *    a bounded in-memory cache only while the box needs it (the repo picker's
+ *    installation listing reads it back under a policy scoped to
+ *    `/uai/users/*\/github`). lib/github-tokens.ts.
+ *  - SSH keys: the keypair to the store first, only the public half stays
+ *    (tagged, so a replacement box lists it without a read). lib/ssh.ts.
+ *  - MCP connections: header / OAuth tokens to the store first, a row with
+ *    every secret column null; a half-finished OAuth flow lives in memory.
+ *    lib/mcp-connections.ts.
+ *  - Project env: no rows at all — set/delete/list are store calls
+ *    (put + org tag, delete, describe names).
+ *
+ * This module owns what cuts across them: the start-time purge of whatever a
+ * previous release left, the names-and-tags reconcile that rebuilds the
+ * metadata rows (reading a value only where the policy allows it — GitHub
+ * always, SSH and MCP only during the transitional window that lets the box
+ * tag legacy parameters once), and the project env passthrough.
+ */
+
+import { eq } from "drizzle-orm";
+
+import {
+  configuredCredentialStore,
+  credentialStorePrefix,
+  isParameterPathSegment,
+} from "./credential-store";
+import { getDb, schema } from "./db";
+import {
+  claimGithubCredentialGeneration,
+  deleteGithubTokenRowLocal,
+  GITHUB_TOKEN_TAGS,
+  githubTokenMetadataTags,
+  insertStoreHeldGithubTokenRow,
+  isStoreHeldGithubRow,
+} from "./github-tokens";
+import {
+  projectEnvParameterName,
+  projectEnvTags,
+  type StoredProjectEnv,
+} from "./host-env";
+import {
+  deleteMcpConnectionRowLocal,
+  MCP_CONNECTION_TAGS,
+  mcpConnectionMetadataTags,
+  upsertStoreHeldMcpConnectionRow,
+} from "./mcp-connections";
+import {
+  deleteSshKeyRowLocal,
+  insertStoreHeldSshKeyRow,
+  isStoreHeldSshRow,
+  SSH_KEY_TAGS,
+  sshKeyMetadataTags,
+} from "./ssh";
+import {
+  parseStoredGithubToken,
+  parseStoredMcpConnection,
+  parseStoredSshKey,
+  parseUserParameterName,
+} from "./user-credentials-store";
+
+function warn(line: string): void {
+  console.warn(`[signin-box] ${line}`);
+}
+
+function fromB64url(value: string | undefined): string | null {
+  if (!value) return null;
+  try {
+    return Buffer.from(value, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+
+function intTag(tags: Record<string, string>, key: string): number | null {
+  const raw = tags[key];
+  if (raw === undefined || raw === "") return null;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) ? n : null;
+}
+
+// ---------------------------------------------------------------------------
+// Project env: a store passthrough.
+// ---------------------------------------------------------------------------
+
+export async function setProjectEnvStoreOnly(
+  projectId: string,
+  key: string,
+  value: string,
+  orgId?: string,
+): Promise<void> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) throw new Error("this key cannot be stored (not a legal parameter name)");
+  const stored: StoredProjectEnv = {
+    v: 1,
+    kind: "project-env",
+    projectId,
+    key,
+    value,
+    updatedAt: Date.now(),
+    ...(orgId ? { orgId } : {}),
+  };
+  await store.put(name, JSON.stringify(stored));
+  // The tag is what lets a task machine's lease read the value (ADR-133);
+  // without it the value is stored but unreachable, so this failure is the
+  // caller's.
+  if (orgId) await store.tag(name, projectEnvTags(projectId, orgId));
+}
+
+export async function deleteProjectEnvStoreOnly(projectId: string, key: string): Promise<void> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) return;
+  await store.delete(name);
+}
+
+/** The project's KEY NAMES from the store — names only, never a value. */
+export async function listProjectEnvKeysStoreOnly(projectId: string): Promise<string[]> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  if (!isParameterPathSegment(projectId)) return [];
+  const base = `${credentialStorePrefix()}/projects/${projectId}/env`;
+  const names = await store.describeNames(base);
+  return names
+    .map((name) => name.slice(base.length + 1))
+    .filter((key) => key.length > 0 && !key.includes("/"))
+    .sort();
+}
+
+// ---------------------------------------------------------------------------
+// Start-time purge.
+// ---------------------------------------------------------------------------
+
+export interface PurgeLocalUserCredentialSecretsResult {
+  githubStripped: number;
+  sshStripped: number;
+  mcpStripped: number;
+  projectEnvRemoved: number;
+  /** Rows deleted outright: never mirrored, so the store has no copy and a
+   *  secret with no copy elsewhere still may not live here. */
+  unmirroredRemoved: number;
+}
+
+/**
+ * Nothing a previous release left on this machine may hold a credential.
+ * Rows keep their metadata and lose their material; rows the store never
+ * received are deleted; project env rows go entirely (the store is listed
+ * by name instead).
+ */
+export function purgeLocalUserCredentialSecrets(): PurgeLocalUserCredentialSecretsResult {
+  const result: PurgeLocalUserCredentialSecretsResult = {
+    githubStripped: 0,
+    sshStripped: 0,
+    mcpStripped: 0,
+    projectEnvRemoved: 0,
+    unmirroredRemoved: 0,
+  };
+  const db = getDb();
+  const empty = { ct: Buffer.alloc(0), nonce: Buffer.alloc(0) };
+
+  for (const row of db.select().from(schema.githubTokens).all()) {
+    if (!row.storeRef) {
+      deleteGithubTokenRowLocal(row.userId);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (isStoreHeldGithubRow(row)) continue;
+    db.update(schema.githubTokens)
+      .set({ refreshTokenCt: empty.ct, refreshTokenNonce: empty.nonce })
+      .where(eq(schema.githubTokens.userId, row.userId))
+      .run();
+    result.githubStripped++;
+  }
+  for (const row of db.select().from(schema.sshKeys).all()) {
+    if (!row.storeRef) {
+      deleteSshKeyRowLocal(row.userId);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (isStoreHeldSshRow(row)) continue;
+    db.update(schema.sshKeys)
+      .set({ privateKeyCt: empty.ct, privateKeyNonce: empty.nonce })
+      .where(eq(schema.sshKeys.userId, row.userId))
+      .run();
+    result.sshStripped++;
+  }
+  for (const row of db.select().from(schema.mcpConnections).all()) {
+    if (!row.storeRef) {
+      deleteMcpConnectionRowLocal(row.id);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (row.secretEnc === null && row.clientSecretEnc === null && row.pkceVerifierEnc === null) {
+      continue;
+    }
+    db.update(schema.mcpConnections)
+      .set({ secretEnc: null, clientSecretEnc: null, pkceVerifierEnc: null })
+      .where(eq(schema.mcpConnections.id, row.id))
+      .run();
+    result.mcpStripped++;
+  }
+  result.projectEnvRemoved = db.delete(schema.hostProjectEnv).run().changes;
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Start-time metadata reconcile: names + tags, a value only where allowed.
+// ---------------------------------------------------------------------------
+
+export interface ReconcileUserCredentialMetadataResult {
+  skipped: boolean;
+  imported: number;
+  removed: number;
+  /** Legacy parameters the box could read and has now tagged. */
+  tagged: number;
+  /** Parameters neither tagged nor readable — listed nowhere until an
+   *  operator runs the bootstrap with the transitional read once. */
+  unreadable: number;
+  errors: number;
+}
+
+export async function reconcileUserCredentialMetadataFromStore(): Promise<ReconcileUserCredentialMetadataResult> {
+  const result: ReconcileUserCredentialMetadataResult = {
+    skipped: false,
+    imported: 0,
+    removed: 0,
+    tagged: 0,
+    unreadable: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  let names: string[];
+  try {
+    names = await store.describeNames(`${prefix}/users`);
+  } catch (err) {
+    warn(`listing ${prefix}/users failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ...result, errors: 1 };
+  }
+  const db = getDb();
+  const github = new Map(db.select().from(schema.githubTokens).all().map((r) => [r.storeRef, r]));
+  const ssh = new Map(db.select().from(schema.sshKeys).all().map((r) => [r.storeRef, r]));
+  const mcp = new Map(db.select().from(schema.mcpConnections).all().map((r) => [r.storeRef, r]));
+  const seen = new Set<string>();
+
+  for (const name of names) {
+    const at = parseUserParameterName(name, prefix);
+    if (!at) continue;
+    seen.add(name);
+    const known =
+      at.kind === "github" ? github.has(name) : at.kind === "ssh" ? ssh.has(name) : mcp.has(name);
+    if (known) continue;
+    let tags: Record<string, string> = {};
+    try {
+      tags = await store.listTags(name);
+    } catch (err) {
+      result.errors++;
+      warn(`tags of ${name} unreadable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      if (at.kind === "github") {
+        await importGithubMetadata(store, name, at.userId, tags, result);
+      } else if (at.kind === "ssh") {
+        await importSshMetadata(store, name, at.userId, tags, result);
+      } else {
+        await importMcpMetadata(store, name, at.userId, at.id, tags, result);
+      }
+    } catch (err) {
+      result.errors++;
+      warn(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  for (const [ref, row] of github) {
+    if (ref && seen.has(ref)) continue;
+    deleteGithubTokenRowLocal(row.userId);
+    result.removed++;
+  }
+  for (const [ref, row] of ssh) {
+    if (ref && seen.has(ref)) continue;
+    deleteSshKeyRowLocal(row.userId);
+    result.removed++;
+  }
+  for (const [ref, row] of mcp) {
+    if (ref && seen.has(ref)) continue;
+    // A pending OAuth row this box created has no ref yet; keep it.
+    if (!ref && row.status === "pending") continue;
+    deleteMcpConnectionRowLocal(row.id);
+    result.removed++;
+  }
+  return result;
+}
+
+type Store = NonNullable<ReturnType<typeof configuredCredentialStore>>;
+
+/** Read a legacy (untagged) parameter where the policy allows it; null when
+ *  it does not (AccessDenied or absent) — never thrown. */
+async function readIfAllowed(store: Store, name: string): Promise<string | null> {
+  try {
+    return await store.get(name);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/AccessDenied/i.test(message)) return null;
+    throw err;
+  }
+}
+
+async function importGithubMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  let meta: {
+    installationId: number;
+    generation: number;
+    tokenKind: string;
+    expiresAt: number | null;
+    updatedAt: number;
+  } | null = null;
+  const installationId = intTag(tags, GITHUB_TOKEN_TAGS.installationId);
+  const generation = intTag(tags, GITHUB_TOKEN_TAGS.generation);
+  const tokenKind = tags[GITHUB_TOKEN_TAGS.tokenKind];
+  if (installationId !== null && generation !== null && tokenKind) {
+    meta = {
+      installationId,
+      generation,
+      tokenKind,
+      expiresAt: intTag(tags, GITHUB_TOKEN_TAGS.expiresAt),
+      updatedAt: intTag(tags, GITHUB_TOKEN_TAGS.updatedAt) ?? Date.now(),
+    };
+  } else {
+    // The box may read GitHub tokens (the repo picker needs them anyway):
+    // read once, tag, and keep only the metadata.
+    const raw = await readIfAllowed(store, name);
+    if (raw === null) {
+      result.unreadable++;
+      warn(`${name}: no tags and not readable — the user shows as disconnected on this box`);
+      return;
+    }
+    const value = parseStoredGithubToken(raw);
+    if (value.userId !== userId) throw new Error("payload names another user");
+    meta = {
+      installationId: value.installationId,
+      generation: value.generation,
+      tokenKind: value.tokenKind,
+      expiresAt: value.expiresAt,
+      updatedAt: value.updatedAt,
+    };
+    try {
+      await store.tag(name, githubTokenMetadataTags(meta));
+      result.tagged++;
+    } catch (err) {
+      warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  // The same fence an import claims on any host: a generation this box has
+  // already moved past (a later clear) is not resurrected.
+  if (!claimGithubCredentialGeneration(userId, meta.generation, "set")) return;
+  insertStoreHeldGithubTokenRow(userId, {
+    installationId: meta.installationId,
+    generation: meta.generation,
+    refreshTokenExpiresAt: meta.expiresAt,
+    kind: meta.tokenKind,
+    updatedAt: meta.updatedAt,
+    storeRef: name,
+  });
+  result.imported++;
+}
+
+async function importSshMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  let publicKey = tags[SSH_KEY_TAGS.publicKey] ?? "";
+  let createdAt = intTag(tags, SSH_KEY_TAGS.createdAt);
+  if (!publicKey) {
+    const raw = await readIfAllowed(store, name);
+    if (raw === null) {
+      result.unreadable++;
+      warn(`${name}: no public-key tag and not readable — kept as a row with an unknown public key`);
+      insertStoreHeldSshKeyRow({ userId, publicKey: "", createdAt: Date.now(), updatedAt: Date.now(), storeRef: name });
+      return;
+    }
+    const value = parseStoredSshKey(raw);
+    if (value.userId !== userId) throw new Error("payload names another user");
+    publicKey = value.publicKey;
+    createdAt = value.createdAt;
+    try {
+      await store.tag(name, sshKeyMetadataTags({ publicKey, createdAt }));
+      result.tagged++;
+    } catch (err) {
+      warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const now = Date.now();
+  if (insertStoreHeldSshKeyRow({ userId, publicKey, createdAt: createdAt ?? now, updatedAt: now, storeRef: name })) {
+    result.imported++;
+  }
+}
+
+async function importMcpMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  id: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  const url = fromB64url(tags[MCP_CONNECTION_TAGS.urlB64]);
+  const authKind = tags[MCP_CONNECTION_TAGS.authKind];
+  const status = tags[MCP_CONNECTION_TAGS.status];
+  if (url && authKind && status) {
+    upsertStoreHeldMcpConnectionRow(
+      {
+        id,
+        userId,
+        url,
+        authKind,
+        tokenEndpoint: null,
+        redirectUri: null,
+        clientId: null,
+        status,
+        scopes: fromB64url(tags[MCP_CONNECTION_TAGS.scopesB64]) || null,
+        updatedAt: intTag(tags, MCP_CONNECTION_TAGS.updatedAt) ?? Date.now(),
+      },
+      name,
+    );
+    result.imported++;
+    return;
+  }
+  const raw = await readIfAllowed(store, name);
+  if (raw === null) {
+    result.unreadable++;
+    warn(`${name}: no tags and not readable — not listed on this box`);
+    return;
+  }
+  const value = parseStoredMcpConnection(raw);
+  if (value.userId !== userId || value.id !== id) {
+    throw new Error("payload does not describe the connection its path names");
+  }
+  try {
+    await store.tag(name, mcpConnectionMetadataTags(value));
+    result.tagged++;
+  } catch (err) {
+    warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  upsertStoreHeldMcpConnectionRow(value, name);
+  result.imported++;
+}

package/lib/signin-box.ts

@@ -0,0 +1,114 @@
+/**
+ * ADR-136 sign-in box: the small always-on machine behind the "Uai Cloud"
+ * runner row (docs/shared-host-retirement.md). Selected by
+ * `uai-host run --signin-box` (env `UAI_SIGNIN_BOX=1`), which cli.ts sets
+ * before main.ts loads. Same package as every runner, one flag.
+ *
+ * The box has exactly one job — run engine sign-ins and connects for
+ * workspaces and write the result into the credential store — and holds no
+ * credential at rest: captures go to the store first and only a metadata row
+ * stays (lib/engine-accounts.ts, store-only accounts), nothing is imported
+ * from the store at start, the default engine slots are scrubbed on every
+ * start, and its store identity is write-only. Everything else a runner does
+ * is refused here: task commands and tunnels get a definite non-retryable
+ * answer, the local UI and the pickup/broker loops never start.
+ */
+
+import { existsSync, readdirSync, rmSync, type Dirent } from "node:fs";
+import { join } from "node:path";
+
+import { removeEnvValuesAtomic } from "./env-file";
+
+export function signInBoxMode(): boolean {
+  return process.env.UAI_SIGNIN_BOX === "1";
+}
+
+export const SIGN_IN_BOX_TASK_REFUSAL =
+  "This runner is the Uai Cloud sign-in box; tasks run on their own machines.";
+
+/** Host commands the box still serves: its own managed lifecycle and the
+ *  account management the engines pane drives. Every task-shaped command
+ *  (taskUp, channels, files, previews, attachments) is refused. */
+const ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+  "hostUpdate",
+  "hostRestart",
+  "engineAccountRemove",
+  "engineAccountRename",
+  "engineAccountReorder",
+  "engineDisconnect",
+]);
+
+export function signInBoxAllowsCommand(command: string): boolean {
+  return ALLOWED_COMMANDS.has(command);
+}
+
+/** The env keys the adapters read as the host's OWN engine credential
+ *  (lib/engines.ts `detect`). None may survive on the box. */
+export const ENGINE_CREDENTIAL_ENV_KEYS = [
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "XAI_API_KEY",
+  "CURSOR_API_KEY",
+] as const;
+
+/** Default-slot credential files under the owner's home (engine-accounts
+ *  KINDS `defaultHostDir`), and the isolated per-account dirs
+ *  (`extraHostDir`) — swept as strays in case no row references them. */
+const DEFAULT_SLOT_FILES: readonly (readonly string[])[] = [
+  [".codex", "auth.json"],
+  [".grok", "auth.json"],
+  [".local", "share", "opencode", "auth.json"],
+];
+const ACCOUNT_DIR_PREFIXES: readonly { parent: readonly string[]; prefix: string }[] = [
+  { parent: [], prefix: ".codex-acct-" },
+  { parent: [], prefix: ".grok-acct-" },
+  { parent: [".local", "share"], prefix: "opencode-acct-" },
+];
+
+export interface PurgeDefaultEngineSlotsResult {
+  files: string[];
+  dirs: string[];
+  envKeys: string[];
+}
+
+/**
+ * Remove every host-level engine credential from this machine: the default
+ * slot files, stray isolated account dirs, and the credential keys in
+ * `.env.local` plus the live process env. Idempotent; a fresh box removes
+ * nothing.
+ */
+export function purgeDefaultEngineSlots(opts: {
+  ownerHome: string;
+  envFile: string;
+  procEnv?: NodeJS.ProcessEnv;
+}): PurgeDefaultEngineSlotsResult {
+  const files: string[] = [];
+  const dirs: string[] = [];
+  for (const parts of DEFAULT_SLOT_FILES) {
+    const file = join(opts.ownerHome, ...parts);
+    if (!existsSync(file)) continue;
+    rmSync(file, { force: true });
+    files.push(file);
+  }
+  for (const { parent, prefix } of ACCOUNT_DIR_PREFIXES) {
+    const dir = join(opts.ownerHome, ...parent);
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
+      const path = join(dir, entry.name);
+      rmSync(path, { recursive: true, force: true });
+      dirs.push(path);
+    }
+  }
+  const envKeys = removeEnvValuesAtomic(opts.envFile, ENGINE_CREDENTIAL_ENV_KEYS);
+  const procEnv = opts.procEnv ?? process.env;
+  for (const key of ENGINE_CREDENTIAL_ENV_KEYS) delete procEnv[key];
+  return { files, dirs, envKeys };
+}