@runuai/host 0.9.150 → 0.9.152

package/lib/git-clone-credentials.ts

@@ -0,0 +1,334 @@
+/**
+ * ADR-154 §6, §12: what task-up's host-side clone and fetches authenticate
+ * with, served by this process from memory for exactly as long as the
+ * operation holds the task owner's credentials (`holdTaskGitCredentials`).
+ *
+ * - GitHub over HTTPS: git's credential helper is a small script that asks
+ *   this process for github.com's token over a private socket, each time git
+ *   needs it. Nothing caches it: no `git credential-cache` daemon outlives
+ *   the clone.
+ * - SSH: an ssh-agent this process speaks itself, holding only the task
+ *   owner's ed25519 key (what the sign-in box mints), in memory. Only the
+ *   public key is written, so ssh can name the identity it wants.
+ *
+ * Everything lives in a 0700 directory under /tmp, whose path has no
+ * whitespace (git runs the helper through a shell). The service closes when
+ * the hold's signal aborts or the caller closes it: the sockets stop
+ * answering and the directory is removed. A process that dies takes its
+ * sockets with it, and what it leaves on disk holds no secret.
+ */
+
+import { createPrivateKey, createPublicKey, sign, type KeyObject } from "node:crypto";
+import { chmodSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { createServer, type Server, type Socket } from "node:net";
+import { join } from "node:path";
+
+import type { TaskGitCredentialHold } from "./credential-consumers/github";
+
+/** What task-up is told, all non-secret paths. */
+export interface CloneCredentialEnv {
+  /** The executable git runs as its credential helper (github.com only). */
+  UAI_GITHUB_CREDENTIAL_HELPER?: string;
+  /** The agent socket holding the owner's SSH key. */
+  UAI_TASK_SSH_AUTH_SOCK?: string;
+  /** The owner's public key: the identity ssh asks the agent for. */
+  UAI_TASK_SSH_PUBLIC_KEY?: string;
+}
+
+export interface CloneCredentialService {
+  env: CloneCredentialEnv;
+  /** Stop answering and remove the directory. Idempotent. */
+  close(): Promise<void>;
+}
+
+/** An SSH key the agent cannot hold: not an unencrypted ed25519 key, or one
+ *  whose public half does not match. */
+export class UnsupportedSshKey extends Error {
+  constructor(reason: string) {
+    super(`the SSH key cannot be used for the clone: ${reason}`);
+    this.name = "UnsupportedSshKey";
+  }
+}
+
+/**
+ * Serve `hold`'s credentials to task-up until the hold's signal aborts or
+ * `close()` is called. Rejects (serving nothing) when the hold is already
+ * aborted or its SSH key cannot be held.
+ */
+export async function serveCloneCredentials(
+  hold: Pick<TaskGitCredentialHold, "github" | "ssh" | "signal">,
+): Promise<CloneCredentialService> {
+  if (hold.signal.aborted) throw new Error("the task's credentials were taken before the clone");
+  const key = hold.ssh ? ed25519Identity(hold.ssh.privateKey, hold.ssh.publicKey) : null;
+  const directory = mkdtempSync(join("/tmp", "uai-clone-credentials-"));
+  chmodSync(directory, 0o700);
+  const servers: Server[] = [];
+  const sockets = new Set<Socket>();
+  /** Listens not yet settled: closing fails them, so a start can never wait
+   *  on a server closed under it. */
+  const starting = new Set<(error: Error) => void>();
+  let closing: Promise<void> | null = null;
+  const close = (): Promise<void> => {
+    closing ??= (async () => {
+      hold.signal.removeEventListener("abort", onAbort);
+      for (const fail of [...starting]) fail(new Error("the task's credentials were taken before the clone"));
+      for (const socket of sockets) socket.destroy();
+      await Promise.all(servers.map((server) => new Promise<void>((resolve) => server.close(() => resolve()))));
+      rmSync(directory, { recursive: true, force: true });
+    })();
+    return closing;
+  };
+  const onAbort = (): void => void close();
+  hold.signal.addEventListener("abort", onAbort);
+
+  const listen = async (path: string, handle: (socket: Socket) => void): Promise<void> => {
+    const server = createServer((socket) => {
+      if (closing) {
+        socket.destroy();
+        return;
+      }
+      sockets.add(socket);
+      socket.on("close", () => sockets.delete(socket));
+      socket.on("error", () => socket.destroy());
+      handle(socket);
+    });
+    servers.push(server);
+    await new Promise<void>((resolve, reject) => {
+      const fail = (error: Error): void => {
+        starting.delete(fail);
+        reject(error);
+      };
+      starting.add(fail);
+      server.once("error", fail);
+      server.listen(path, () => {
+        starting.delete(fail);
+        resolve();
+      });
+    });
+    if (closing) throw new Error("the task's credentials were taken before the clone");
+    chmodSync(path, 0o600);
+  };
+
+  const env: CloneCredentialEnv = {};
+  try {
+    if (hold.github) {
+      const token = hold.github.token;
+      const socketPath = join(directory, "github.sock");
+      await listen(socketPath, (socket) => answerGithub(socket, token));
+      const node = join(directory, "node");
+      symlinkSync(process.execPath, node);
+      const helper = join(directory, "git-credential-uai");
+      writeFileSync(helper, helperScript(node, socketPath), { mode: 0o700 });
+      env.UAI_GITHUB_CREDENTIAL_HELPER = helper;
+    }
+    if (key) {
+      const socketPath = join(directory, "ssh-agent.sock");
+      await listen(socketPath, (socket) => answerAgent(socket, key));
+      const publicKey = join(directory, "id_ed25519.pub");
+      writeFileSync(publicKey, `${key.publicLine}\n`, { mode: 0o600 });
+      env.UAI_TASK_SSH_AUTH_SOCK = socketPath;
+      env.UAI_TASK_SSH_PUBLIC_KEY = publicKey;
+    }
+  } catch (error) {
+    await close();
+    throw error;
+  }
+  if (hold.signal.aborted) {
+    await close();
+    throw new Error("the task's credentials were taken before the clone");
+  }
+  return { env, close };
+}
+
+// ---------------------------------------------------------------------------
+// GitHub: the credential helper and what it asks
+// ---------------------------------------------------------------------------
+
+/** The helper git runs: only `get`, only https://github.com; it asks this
+ *  process and prints what it answers (nothing once the service closed). */
+function helperScript(node: string, socketPath: string): string {
+  return `#!${node}
+"use strict";
+if (process.argv[2] !== "get") process.exit(0);
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  const fields = {};
+  for (const line of input.split("\\n")) {
+    const at = line.indexOf("=");
+    if (at > 0) fields[line.slice(0, at)] = line.slice(at + 1);
+  }
+  if (fields.protocol !== "https" || fields.host !== "github.com") process.exit(0);
+  const socket = require("node:net").connect(${JSON.stringify(socketPath)});
+  let answer = "";
+  socket.setEncoding("utf8");
+  socket.on("data", (chunk) => { answer += chunk; });
+  socket.on("end", () => { process.stdout.write(answer); });
+  socket.on("error", () => process.exit(0));
+  socket.end("protocol=https\\nhost=github.com\\n");
+});
+`;
+}
+
+function answerGithub(socket: Socket, token: string): void {
+  let request = "";
+  socket.setEncoding("utf8");
+  socket.on("data", (chunk: string) => {
+    request += chunk;
+    if (request.length > 1024) socket.destroy();
+  });
+  socket.on("end", () => {
+    const fields = new Set(request.split("\n"));
+    if (fields.has("protocol=https") && fields.has("host=github.com")) {
+      socket.end(`username=x-access-token\npassword=${token}\n`);
+    } else {
+      socket.end();
+    }
+  });
+}
+
+// ---------------------------------------------------------------------------
+// SSH: an agent holding one ed25519 key (draft-miller-ssh-agent)
+// ---------------------------------------------------------------------------
+
+const SSH_AGENT_FAILURE = 5;
+const SSH_AGENTC_REQUEST_IDENTITIES = 11;
+const SSH_AGENT_IDENTITIES_ANSWER = 12;
+const SSH_AGENTC_SIGN_REQUEST = 13;
+const SSH_AGENT_SIGN_RESPONSE = 14;
+/** A message larger than any request this agent answers. */
+const MAX_AGENT_MESSAGE = 256 * 1024;
+/** PKCS#8 for an ed25519 private key, up to its 32-byte seed (RFC 8410). */
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+
+interface Ed25519Identity {
+  blob: Buffer;
+  comment: string;
+  publicLine: string;
+  privateKey: KeyObject;
+}
+
+function sshString(bytes: Buffer): Buffer {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(bytes.length);
+  return Buffer.concat([length, bytes]);
+}
+
+/** Reads SSH wire fields in order; throws on anything short or malformed. */
+class Reader {
+  #offset = 0;
+  constructor(private readonly bytes: Buffer) {}
+  uint32(): number {
+    if (this.#offset + 4 > this.bytes.length) throw new UnsupportedSshKey("a truncated field");
+    const value = this.bytes.readUInt32BE(this.#offset);
+    this.#offset += 4;
+    return value;
+  }
+  string(): Buffer {
+    const length = this.uint32();
+    if (this.#offset + length > this.bytes.length) throw new UnsupportedSshKey("a truncated field");
+    const value = this.bytes.subarray(this.#offset, this.#offset + length);
+    this.#offset += length;
+    return value;
+  }
+}
+
+/** The one ed25519 identity in an unencrypted openssh-key-v1 private key,
+ *  checked against its public line. */
+export function ed25519Identity(privateKeyPem: string, publicLine: string): Ed25519Identity {
+  const pem = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]+?)-----END OPENSSH PRIVATE KEY-----/.exec(privateKeyPem);
+  if (!pem) throw new UnsupportedSshKey("not an OpenSSH private key");
+  const body = Buffer.from(pem[1]!.replace(/\s+/g, ""), "base64");
+  const magic = Buffer.from("openssh-key-v1\0");
+  if (!body.subarray(0, magic.length).equals(magic)) throw new UnsupportedSshKey("not an OpenSSH private key");
+  const outer = new Reader(body.subarray(magic.length));
+  const cipher = outer.string().toString();
+  const kdf = outer.string().toString();
+  outer.string();
+  if (cipher !== "none" || kdf !== "none") throw new UnsupportedSshKey("an encrypted key");
+  if (outer.uint32() !== 1) throw new UnsupportedSshKey("more than one key");
+  const blob = Buffer.from(outer.string());
+  const secret = new Reader(outer.string());
+  if (secret.uint32() !== secret.uint32()) throw new UnsupportedSshKey("a corrupt key");
+  if (secret.string().toString() !== "ssh-ed25519") throw new UnsupportedSshKey("not an ed25519 key");
+  const pub = secret.string();
+  const pair = secret.string();
+  const comment = secret.string().toString();
+  if (pub.length !== 32 || pair.length !== 64 || !pair.subarray(32).equals(pub)) {
+    throw new UnsupportedSshKey("a corrupt ed25519 key");
+  }
+  if (!blob.equals(Buffer.concat([sshString(Buffer.from("ssh-ed25519")), sshString(pub)]))) {
+    throw new UnsupportedSshKey("a corrupt ed25519 key");
+  }
+  const [type, encoded] = publicLine.trim().split(/\s+/);
+  if (type !== "ssh-ed25519" || !encoded || !Buffer.from(encoded, "base64").equals(blob)) {
+    throw new UnsupportedSshKey("its public key does not match");
+  }
+  const privateKey = createPrivateKey({
+    key: Buffer.concat([PKCS8_ED25519_PREFIX, pair.subarray(0, 32)]),
+    format: "der",
+    type: "pkcs8",
+  });
+  // The seed's own public key: the one the agent advertises must be the one
+  // it signs with.
+  const derived = Buffer.from(createPublicKey(privateKey).export({ format: "jwk" }).x ?? "", "base64url");
+  if (!derived.equals(pub)) throw new UnsupportedSshKey("a corrupt ed25519 key");
+  return { blob, comment, publicLine: `ssh-ed25519 ${encoded}`, privateKey };
+}
+
+function agentMessage(type: number, payload: Buffer = Buffer.alloc(0)): Buffer {
+  const header = Buffer.alloc(5);
+  header.writeUInt32BE(payload.length + 1);
+  header.writeUInt8(type, 4);
+  return Buffer.concat([header, payload]);
+}
+
+/** The agent's answer to one request: its identity, a signature by it, or
+ *  failure for everything else (adding, removing, locking, extensions). */
+export function agentAnswer(request: Buffer, key: Ed25519Identity): Buffer {
+  const type = request.readUInt8(0);
+  if (type === SSH_AGENTC_REQUEST_IDENTITIES) {
+    const count = Buffer.alloc(4);
+    count.writeUInt32BE(1);
+    return agentMessage(
+      SSH_AGENT_IDENTITIES_ANSWER,
+      Buffer.concat([count, sshString(key.blob), sshString(Buffer.from(key.comment))]),
+    );
+  }
+  if (type === SSH_AGENTC_SIGN_REQUEST) {
+    try {
+      const reader = new Reader(request.subarray(1));
+      const blob = reader.string();
+      const data = reader.string();
+      reader.uint32();
+      if (!blob.equals(key.blob)) return agentMessage(SSH_AGENT_FAILURE);
+      const signature = sign(null, data, key.privateKey);
+      return agentMessage(
+        SSH_AGENT_SIGN_RESPONSE,
+        sshString(Buffer.concat([sshString(Buffer.from("ssh-ed25519")), sshString(signature)])),
+      );
+    } catch {
+      return agentMessage(SSH_AGENT_FAILURE);
+    }
+  }
+  return agentMessage(SSH_AGENT_FAILURE);
+}
+
+function answerAgent(socket: Socket, key: Ed25519Identity): void {
+  let pending = Buffer.alloc(0);
+  socket.on("data", (chunk: Buffer) => {
+    pending = Buffer.concat([pending, chunk]);
+    while (pending.length >= 4) {
+      const length = pending.readUInt32BE(0);
+      if (length === 0 || length > MAX_AGENT_MESSAGE) {
+        socket.destroy();
+        return;
+      }
+      if (pending.length < 4 + length) return;
+      const request = pending.subarray(4, 4 + length);
+      pending = pending.subarray(4 + length);
+      socket.write(agentAnswer(request, key));
+    }
+  });
+}