@serfab/cadre-host 1.13.0 → 1.15.0

package/src/__tests__/orchestrator-claim-secret.test.ts

@@ -0,0 +1,111 @@
+/**
+ * HostProcessOrchestrator claim-secret test — the one piece of a hosted node's
+ * spawn that is secret.
+ *
+ * A node started waiting to be claimed takes its secret from `CADRE_CLAIM_SECRET`
+ * (`cadre-cli start`). The orchestrator must hand it to the child through the
+ * environment and nowhere else: not as an argument (the process list shows
+ * those) and not in `state.json` (which outlives the child and is readable by
+ * anything on the machine). A fake CLI records its environment and arguments to a
+ * file so both are observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+import { removeAllNodes } from './orchestrator-teardown.js';
+
+// Writes CADRE_CLAIM_SECRET (as seen in the child env) and the argv next to the
+// startup token, then behaves like a minimal long-lived node.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = { secret: process.env.CADRE_CLAIM_SECRET ?? null, args };
+  const seenPath = path.join(dir, 'spawn-seen.json');
+  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+const SECRET = 'claim-secret-' + 'x'.repeat(30);
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-claim-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+});
+
+afterEach(async () => {
+  try {
+    await removeAllNodes(orchestrators);
+  } finally {
+    await sleep(50);
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18500, end: 18999 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator claim secret', () => {
+  it('reaches the child as CADRE_CLAIM_SECRET only: not an argument, not state.json', async () => {
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'hn_claim',
+      partyId: 'unclaimed',
+      profile: 'storage',
+      claimSecret: SECRET,
+    });
+
+    const seen = JSON.parse(await waitForFile(join(rootDir, 'hn_claim', 'spawn-seen.json'))) as { secret: string | null; args: string[] };
+    expect(seen.secret).toBe(SECRET);
+    expect(seen.args.join(' ')).not.toContain(SECRET);
+    expect(readFileSync(join(rootDir, 'state.json'), 'utf8')).not.toContain(SECRET);
+
+    // No secret, no variable: `cadre-cli start` treats a set-but-empty value as unset,
+    // but the child must not even see the name.
+    await orch.createContainer({ containerId: 'hn_plain', partyId: 'p', profile: 'storage' });
+    const plain = JSON.parse(await waitForFile(join(rootDir, 'hn_plain', 'spawn-seen.json'))) as { secret: string | null };
+    expect(plain.secret).toBeNull();
+  });
+});

package/src/__tests__/orchestrator-env-scrub.test.ts

@@ -1,163 +1,160 @@
-/**
- * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
- * not leak `CADRE_*` config-override vars into spawned children.
- *
- * `launchChild` used to build each child's environment as
- * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
- * var set on the manager (not just the ones the orchestrator deliberately
- * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
- * `CADRE_*` var as a config override that beats the per-child config file, a
- * `CADRE_PARTY_ID` set on the manager could silently pull every child into
- * that party.
- *
- * A fake CLI records the vars under test from its environment to a file so
- * the scrub is observable without a real cadre node.
- *
- * The same record carries `CADRE_LISTEN_ADDRS`, one of the vars the orchestrator
- * deliberately SETS: a child must be handed a WebSocket listener beside its TCP one,
- * on the ports its handle holds, or a phone cannot reach it.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-import { removeAllNodes } from './orchestrator-teardown.js';
-
-// Writes the vars under test (as seen in the child env) next to the startup token.
-const FAKE_CLI = `
-import fs from 'node:fs';
-import path from 'node:path';
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-const tokenPath = get('--startup-token-file');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-if (tokenPath) {
-  const dir = path.dirname(tokenPath);
-  const record = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
-    CADRE_LISTEN_ADDRS: process.env.CADRE_LISTEN_ADDRS ?? null,
-    DEBUG: process.env.DEBUG ?? null,
-  };
-  // Write then rename: the test polls for the file's existence, and must never read it half-written.
-  const seenPath = path.join(dir, 'env-seen.json');
-  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
-  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
-}
-process.on('SIGTERM', () => process.exit(0));
-setInterval(() => {}, 1 << 30);
-`;
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-let savedEnv: Record<string, string | undefined>;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
-  scriptPath = join(tmpRoot, 'fake-cli.mjs');
-  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
-  savedEnv = {
-    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
-    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
-    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
-    DEBUG: process.env.DEBUG,
-  };
-});
-
-afterEach(async () => {
-  try {
-    await removeAllNodes(orchestrators);
-  } finally {
-    await sleep(50);
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-    for (const [key, value] of Object.entries(savedEnv)) {
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-  }
-});
-
-function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18000, end: 18499 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (existsSync(path)) return readFileSync(path, 'utf8');
-    await sleep(50);
-  }
-  throw new Error(`file never appeared: ${path}`);
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-describe('HostProcessOrchestrator child env scrub', () => {
-  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
-    process.env.CADRE_PARTY_ID = 'conflicting-party';
-    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
-    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
-    // command — so it only stays scrubbed if the scrub is prefix-wide.
-    process.env.CADRE_ADMIN_PORT = '19999';
-    process.env.DEBUG = 'some:value';
-
-    const rootDir = join(tmpRoot, 'a');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'child-1',
-      partyId: 'party-1',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-    await orch.createContainer({
-      containerId: 'child-2',
-      partyId: 'party-2',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
-    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
-
-    for (const seen of [seen1, seen2]) {
-      expect(seen.CADRE_PARTY_ID).toBeNull();
-      expect(seen.CADRE_STORAGE_PATH).toBeNull();
-      expect(seen.CADRE_ADMIN_PORT).toBeNull();
-      expect(seen.DEBUG).toBe('some:value');
-    }
-  });
-
-  it('hands each child a TCP and a WebSocket listen address on its own ports', async () => {
-    const rootDir = join(tmpRoot, 'b');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'child-1',
-      partyId: 'party-1',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const seen = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
-    const ports = orch.getNode('child-1')!.ports;
-    expect(seen.CADRE_LISTEN_ADDRS).toBe(`/ip4/0.0.0.0/tcp/${ports.p2p},/ip4/0.0.0.0/tcp/${ports.ws}/ws`);
-  });
-});
+/**
+ * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
+ * not leak `CADRE_*` config-override vars into spawned children.
+ *
+ * `launchChild` used to build each child's environment as
+ * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
+ * var set on the manager (not just the ones the orchestrator deliberately
+ * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
+ * `CADRE_*` var as a config override that beats the per-child config file, a
+ * `CADRE_PARTY_ID` set on the manager could silently pull every child into
+ * that party.
+ *
+ * A fake CLI records the vars under test from its environment to a file so
+ * the scrub is observable without a real cadre node.
+ *
+ * The same record carries `CADRE_LISTEN_ADDRS`, one of the vars the orchestrator
+ * deliberately SETS: a child must be handed a WebSocket listener beside its TCP one,
+ * on the ports its handle holds, or a phone cannot reach it.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+import { removeAllNodes } from './orchestrator-teardown.js';
+
+// Writes the vars under test (as seen in the child env) next to the startup token.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
+    CADRE_LISTEN_ADDRS: process.env.CADRE_LISTEN_ADDRS ?? null,
+    DEBUG: process.env.DEBUG ?? null,
+  };
+  // Write then rename: the test polls for the file's existence, and must never read it half-written.
+  const seenPath = path.join(dir, 'env-seen.json');
+  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+let savedEnv: Record<string, string | undefined>;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+  savedEnv = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
+    DEBUG: process.env.DEBUG,
+  };
+});
+
+afterEach(async () => {
+  try {
+    await removeAllNodes(orchestrators);
+  } finally {
+    await sleep(50);
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18000, end: 18499 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator child env scrub', () => {
+  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
+    process.env.CADRE_PARTY_ID = 'conflicting-party';
+    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
+    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
+    // command — so it only stays scrubbed if the scrub is prefix-wide.
+    process.env.CADRE_ADMIN_PORT = '19999';
+    process.env.DEBUG = 'some:value';
+
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      profile: 'storage',
+    });
+    await orch.createContainer({
+      containerId: 'child-2',
+      partyId: 'party-2',
+      profile: 'storage',
+    });
+
+    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
+
+    for (const seen of [seen1, seen2]) {
+      expect(seen.CADRE_PARTY_ID).toBeNull();
+      expect(seen.CADRE_STORAGE_PATH).toBeNull();
+      expect(seen.CADRE_ADMIN_PORT).toBeNull();
+      expect(seen.DEBUG).toBe('some:value');
+    }
+  });
+
+  it('hands each child a TCP and a WebSocket listen address on its own ports', async () => {
+    const rootDir = join(tmpRoot, 'b');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      profile: 'storage',
+    });
+
+    const seen = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const ports = orch.getNode('child-1')!.ports;
+    expect(seen.CADRE_LISTEN_ADDRS).toBe(`/ip4/0.0.0.0/tcp/${ports.p2p},/ip4/0.0.0.0/tcp/${ports.ws}/ws`);
+  });
+});