@task-handoff/node-agent 0.0.15 → 0.0.17

package/docker/entrypoint.sh

@@ -1,6 +1,48 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+load_private_config() {
+  local config_path="/run/task-handoff/instance-private-config.json"
+  if [ ! -f "${config_path}" ]; then
+    echo "Managed instance private configuration is missing." >&2
+    exit 78
+  fi
+  while IFS=$'\t' read -r key encoded; do
+    if [[ ! "${key}" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+      echo "Managed instance private configuration contains an invalid environment key." >&2
+      exit 78
+    fi
+    local value
+    value="$(printf '%s' "${encoded}" | base64 --decode)"
+    export "${key}=${value}"
+  done < <(node -e '
+    const fs = require("node:fs");
+    const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    if (value.version !== 1 || typeof value.instanceCredential !== "string" || !value.instanceCredential || !value.environment || typeof value.environment !== "object" || Array.isArray(value.environment)) process.exit(78);
+    const environment = { ...value.environment, TASK_HANDOFF_REGISTRATION_TOKEN: value.instanceCredential, TASK_HANDOFF_PRIVATE_CONFIG_LOADED: "1" };
+    for (const [key, item] of Object.entries(environment)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof item !== "string") process.exit(78);
+      process.stdout.write(`${key}\t${Buffer.from(item).toString("base64")}\n`);
+    }
+  ' "${config_path}")
+  if [ "${TASK_HANDOFF_PRIVATE_CONFIG_LOADED:-}" != "1" ]; then
+    echo "Managed instance private configuration is invalid." >&2
+    exit 78
+  fi
+}
+
+if [ "$(id -u)" = "0" ] && [ "${TASK_HANDOFF_PRIVILEGE_DROPPED:-0}" != "1" ]; then
+  load_private_config
+  mkdir -p /data /home/agent
+  chown agent:agent /data /home/agent
+  if [ "${TASK_HANDOFF_WORKSPACE_MODE:-}" = "git-clone" ]; then
+    mkdir -p "${TASK_HANDOFF_WORKSPACE:-/workspace}"
+    chown agent:agent "${TASK_HANDOFF_WORKSPACE:-/workspace}"
+  fi
+  export TASK_HANDOFF_PRIVILEGE_DROPPED=1
+  exec sudo --preserve-env -u agent -- "$0" "$@"
+fi
+
 mkdir -p \
   "${TASK_HANDOFF_DATA_DIR:-/data/task-handoff}" \
   "${TASK_HANDOFF_APP_CATALOG_DIR:-/data/task-handoff/app-catalog}" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@task-handoff/node-agent",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Prebuilt TaskHandoff node agent runtime.",
   "license": "Apache-2.0",
   "type": "commonjs",

package/runtime-artifacts/{controlled-instance-runtime-0.0.15-linux-universal.manifest.json → controlled-instance-runtime-0.0.17-linux-universal.manifest.json}

@@ -1,10 +1,10 @@
 {
   "packageName": "@task-handoff/controlled-instance",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "platform": "linux",
   "arch": "universal",
   "formatVersion": 1,
   "launcherAbi": 1,
   "entrypoint": "dist/controlled-instance-cli.js",
-  "sha256": "e9674c034ad56f05b3f0c2326ecfd2a4bed76ca5eb5f6c5e3df7119761b58d2b"
+  "sha256": "b224f916d32ea03a1911d6f559e959a36e3a090a11077c341ebe3e5a268473f3"
 }

package/runtime-artifacts/controlled-instance-runtime-0.0.17-linux-universal.tar.gz.sha256

@@ -0,0 +1 @@
+1d676a10fd0fd77d43fbf220b2d4bd82873bdfa81068e2253cab5a71f478474e  controlled-instance-runtime-0.0.17-linux-universal.tar.gz

package/runtime-artifacts/controlled-instance-runtime-0.0.15-linux-universal.tar.gz.sha256

@@ -1 +0,0 @@
-af3d2ffb993c7e188d1eb6fafb00a49b6861879afc6c25cee0a46f5ea76ef1d2  controlled-instance-runtime-0.0.15-linux-universal.tar.gz