@veris-ai/daytona 0.2.0 → 0.3.0

package/dist/trust.d.ts

@@ -4,10 +4,7 @@
 export declare const CA_CERT_PATH = "/usr/local/share/ca-certificates/veris-ca.crt";
 /** The distribution's own bundle, when it has one. */
 export declare const SYSTEM_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-/**
- * Our CA alone, world-readable, written before anything needs it.
- * NODE_EXTRA_CA_CERTS is additive by design and takes this.
- */
+/** Our CA alone, world-readable, written before anything needs it. */
 export declare const VERIS_CA_FILE = "/tmp/veris-ca.crt";
 /**
  * The public roots plus ours, concatenated by us.
@@ -28,10 +25,117 @@ export declare const VERIS_BUNDLE = "/tmp/veris-ca-bundle.crt";
  * certificate validation.
  *
  * Every var is path-valued and points at VERIS_BUNDLE (public roots + ours, so
- * passthrough hosts keep verifying), except NODE_EXTRA_CA_CERTS, which is
- * additive by design and takes the single cert.
+ * passthrough hosts keep verifying) — NODE_EXTRA_CA_CERTS included. That var is
+ * additive, but only to Node's BAKED-IN Mozilla roots, never to the system
+ * store — and on Daytona the leaf a client actually validates is signed by
+ * Daytona's proxy CA (its proxy terminates TLS; see installCa's comment), which
+ * lives in the system store and nowhere in Mozilla's roots. Point Node at the
+ * single Veris cert and it can verify neither that leaf nor a directly served
+ * gateway one behind it: UNABLE_TO_VERIFY_LEAF_SIGNATURE on every vendor call.
+ * The bundle carries the system store (Daytona's CA with it) plus ours, so it
+ * is the one file that works in both worlds.
  */
 export declare function vendoredTrustEnv(): Record<string, string>;
+/**
+ * The same variables as one POSIX `export` prelude, to prefix a command with.
+ *
+ * The map above is the right shape when you control the process's environment.
+ * A caller that does not — anything handing a command to a shell whose env it
+ * did not build — has nowhere to put a map, and the command inherits Daytona's
+ * overwritten SSL_CERT_FILE / REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE /
+ * NODE_EXTRA_CA_CERTS instead. Measured with the inherited value: `uv sync`
+ * dies with "invalid peer certificate: UnknownIssuer". Prefixing this makes
+ * the command's own shell put the Veris bundle back:
+ *
+ *   sandbox.process.executeCommand(`${trustPrelude()} ${yourCommand}`)
+ *
+ * Values are single-quoted, so the string stays one safe command line whatever
+ * the control plane served.
+ */
+export declare function trustPrelude(env?: Record<string, string>): string;
+/**
+ * CA bundles that SDKs ship INSIDE the code under test, as slash-anchored path
+ * suffixes.
+ *
+ * No trust variable reaches these. stripe-python passes
+ * `verify=stripe.ca_bundle_path` explicitly, so all eighteen variables above
+ * are irrelevant to it and the first Stripe call dies with "Could not verify
+ * Stripe's SSL certificate" — the gateway's forged leaf is signed by a CA that
+ * file has never heard of. Appending our CA to the file keeps the SDK on the
+ * code path that ships; the bundle merely holds one more root.
+ *
+ * The table is the veris CLI's (internal/bundlescan), for the reason it gives
+ * there: matched as a path SUFFIX because site-packages prefixes vary per
+ * image and the tail does not, and deliberately with no bare `cacert.pem`
+ * rule, because that filename also names test fixtures and client-auth
+ * material that must not quietly gain a root.
+ */
+export declare const BUNDLED_CA_FILES: readonly {
+    sdk: string;
+    suffix: string;
+}[];
+/** Where the patch script is written inside the sandbox, so anything that can
+ *  run a shell command — a test harness, an agent, a person over ssh — can
+ *  re-run it after installing dependencies without holding this SDK. */
+export declare const BUNDLED_CA_PATCH_SCRIPT = "/tmp/veris-patch-bundled-cas.sh";
+/**
+ * What the script prints per patched file, so the caller can report what
+ * happened rather than infer it from an exit code.
+ *
+ * A sentence rather than a machine marker, because both routes to this script
+ * are read by a person. `provision` tells a caller to run `sh
+ * /tmp/veris-patch-bundled-cas.sh` themselves, and whatever the script prints
+ * is what they see — a bare `__VERIS_PATCHED__ /path` reads as debug output
+ * that escaped. `patchBundledCas()` parses the paths back off this same
+ * constant, and cli.ts prints the same sentence for the SDK route, so the
+ * prose a human reads and the list a program gets cannot drift apart.
+ */
+export declare const BUNDLED_CA_PATCHED_MARKER = "the Veris CA was appended to ";
+/**
+ * The script that finds those bundles and appends the Veris CA to each.
+ *
+ * Meant to run AFTER dependencies are installed, and to be re-run: the bundles
+ * do not exist at create time, and an agent installs more of them mid-session,
+ * so there is no create-time moment that covers either. Idempotent by
+ * construction — a file already carrying our certificate is skipped, matched
+ * on a line of its base64 body rather than on the BEGIN line every certificate
+ * shares.
+ *
+ * Appending in place, where the CLI over-mounts a patched copy: a Daytona
+ * sandbox offers no bind mounts and the container is disposable, so editing
+ * the file is the equivalent move. Unwritable files are skipped rather than
+ * sudo'd — a root-owned bundle in the system Python is rarely the one the
+ * application's virtualenv reads, and silently rewriting system trust is a
+ * larger act than this warrants.
+ */
+export declare function bundledCaPatchScript(): string;
+/**
+ * Node is the one runtime the trust variables above cannot reach.
+ *
+ * Daytona overwrites NODE_EXTRA_CA_CERTS and SSL_CERT_FILE inside the sandbox
+ * with its own CA file — right for clients that go through its proxy, which
+ * terminates TLS with that CA. Node is not such a client: it ignores
+ * HTTPS_PROXY, is forwarded to the gateway end to end, and the leaf it
+ * validates is signed by the Veris CA, which Daytona's file lacks. Seen live:
+ * plain `node` failed against a vendor host with UNABLE_TO_VERIFY_LEAF_SIGNATURE.
+ */
+/**
+ * Node's trust flag. NODE_EXTRA_CA_CERTS is Daytona's, and Node's baked-in
+ * Mozilla roots know neither CA — so switch Node to OpenSSL's store:
+ * --use-openssl-ca loads SSL_CERT_FILE (Daytona's file) AND the system
+ * certificate directory, where CA_INSTALL_CMD puts our CA and the distribution
+ * keeps the public roots. Injected as NODE_OPTIONS, which Daytona leaves alone.
+ *
+ * Verified live on Daytona's default image (uid 1001, passwordless sudo,
+ * update-ca-certificates present): 200 from plain `node` with the flag and
+ * our CA in /etc/ssl/certs; UNABLE_TO_VERIFY_LEAF_SIGNATURE without the flag.
+ * So this leans on the store install succeeding. There is no second route:
+ * Daytona's CA file is on a read-only mount, so appending our CA to it — the
+ * obvious alternative — fails for root too.
+ */
+export declare const NODE_TRUST_FLAG = "--use-openssl-ca";
+/** NODE_OPTIONS with the trust flag appended to whatever the caller set. */
+export declare function nodeOptionsWithTrust(existing?: string): string;
 /**
  * The store-based install, for stacks that read a trust store rather than an
  * env var — a Java client honours no CA variable at all. Rebuilds the system

package/dist/veris-api.d.ts

@@ -1,3 +1,5 @@
+import type { ReceiptBaseline } from './run-receipt';
+import type { ControlOptions, ControlResource } from './service-control';
 import type { Sandbox } from '@daytona/sdk';
 import type { ControlPlane, ServiceInfo } from './control-plane';
 import type { Receipt, ReceiptEntry } from './receipt';
@@ -13,6 +15,13 @@ export interface VerisContext {
     canaryHost: string;
     /** Whether this twin is owned (delete removes it) or attached (caller owns it). */
     ownsTwin: boolean;
+    /** Newest request id per service when this run began, so a receipt counts
+     *  what the run caused rather than what an attached twin already held. Set by
+     *  create(); a sandbox rehydrated by get() has none and reads the log from
+     *  the start, as the receipt always did. Not persisted in a label on
+     *  purpose — the sandbox can rewrite its own labels, and a watermark it
+     *  chose would let it hide its own traffic from the receipt. */
+    watermarks?: Record<string, number>;
 }
 /** Narrow assertTouched to specific requests. All fields AND together. */
 export interface TouchMatcher {
@@ -23,17 +32,32 @@ export interface TouchMatcher {
     minRequests?: number;
 }
 export interface VerisApi {
+    /** Whether provider teardown owns this twin. */
+    readonly ownsTwin: boolean;
     /** The Veris twin's sandbox id — NOT the Daytona sandbox id. */
     readonly sandboxId: string;
+    /** The Veris environment the twin was deployed from. Every control-plane
+     *  route that acts on a twin is scoped to it, so a caller that wants to talk
+     *  to the twin itself needs it and has nowhere else to read it from. */
+    readonly environmentId: string;
     readonly mode: 'gateway';
     services(): Promise<ServiceInfo[]>;
     /** The service's own manual: what it models and how its data is shaped. */
     manual(service: string): Promise<string>;
+    receiptBaseline(): Promise<ReceiptBaseline>;
+    receiptSince(baseline: ReceiptBaseline, service?: string): Promise<Receipt>;
+    control(service: string, resource: ControlResource, options?: ControlOptions): Promise<unknown>;
     receipt(): Promise<Receipt>;
     receipt(service: string): Promise<ReceiptEntry>;
     assertTouched(service: string, match?: TouchMatcher): Promise<void>;
     getDataPlaneEnv(): Promise<Record<string, string>>;
     getTrustEnv(): Record<string, string>;
+    /** The same trust variables as a shell `export` prelude, for a caller that
+     *  can only prefix a command line. */
+    trustPrelude(): string;
+    /** Append the Veris CA to the CA bundles SDKs ship with them. Run it after
+     *  installing dependencies; returns the files it changed. */
+    patchBundledCas(): Promise<string[]>;
     deliverTo(port: number, opts?: DeliverToOpts): Promise<string>;
     deliverTo(url: string | null, opts?: DeliverToOpts): Promise<string | null>;
 }
@@ -45,7 +69,9 @@ export interface DeliverToOpts {
 export declare class VerisApiImpl implements VerisApi {
     private readonly ctx;
     constructor(ctx: VerisContext);
+    get ownsTwin(): boolean;
     get sandboxId(): string;
+    get environmentId(): string;
     get mode(): 'gateway';
     services(): Promise<ServiceInfo[]>;
     /** Resolve a service by name. A typo and a service that exists but saw
@@ -60,10 +86,42 @@ export declare class VerisApiImpl implements VerisApi {
      * ride around it — named rather than rounded off.
      */
     private leaks;
+    /** Where this service's log was when the run began. 0 reads all of it. */
+    private watermark;
+    private verifyIntegrity;
+    receiptBaseline(): Promise<ReceiptBaseline>;
+    receiptSince(baseline: ReceiptBaseline, service?: string): Promise<Receipt>;
+    control(service: string, resource: ControlResource, options?: ControlOptions): Promise<unknown>;
     assertTouched(service: string, match?: TouchMatcher): Promise<void>;
     getDataPlaneEnv(): Promise<Record<string, string>>;
     /** The CA trust vars injected at create, for callers building their own env. */
     getTrustEnv(): Record<string, string>;
+    /**
+     * The same variables as a shell prelude, for a caller that has no env map to
+     * fill — anything running a command through a session or a shell it did not
+     * build the environment for. Daytona resets SSL_CERT_FILE,
+     * REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and NODE_EXTRA_CA_CERTS to its own CA
+     * file inside the sandbox, and that file cannot verify the gateway's leaf, so
+     * a command that inherits them fails on certificate validation:
+     * `uv sync` dies with "invalid peer certificate: UnknownIssuer".
+     *
+     *   sbx.process.executeCommand(`${sbx.veris.trustPrelude()} uv sync`)
+     */
+    trustPrelude(): string;
+    /**
+     * Append the Veris CA to the CA bundles the code under test's own SDKs ship.
+     *
+     * The variables above reach every client that reads one. stripe-python does
+     * not: it passes `verify=stripe.ca_bundle_path`, so the first Stripe call
+     * fails with "Could not verify Stripe's SSL certificate" in a sandbox where
+     * curl, Node and `requests` all succeed. This patches the file itself, which
+     * is the Daytona-shaped version of the veris CLI's --patch-bundled-cas.
+     *
+     * Call it AFTER installing dependencies — the bundles arrive with them, so
+     * there is nothing to patch at create time. Safe to call again; it returns
+     * only the files it actually changed.
+     */
+    patchBundledCas(): Promise<string[]>;
     /**
      * Point every mocked vendor's callbacks/webhooks at this sandbox.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veris-ai/daytona",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Veris twin interception for Daytona: a drop-in @daytona/sdk whose sandboxes come up with a Veris twin already answering their vendor API calls. Unmodified code, real hostnames, receipts.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -13,6 +13,9 @@
       "require": "./dist/index.cjs"
     }
   },
+  "bin": {
+    "veris-daytona": "./dist/cli.js"
+  },
   "sideEffects": false,
   "files": [
     "dist",
@@ -28,6 +31,9 @@
     "prepublishOnly": "npm run build",
     "dev": "tsup --watch"
   },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
   "peerDependencies": {
     "@daytona/sdk": ">=0.204.1 <1"
   },