@wardby/cli 0.2.1 → 0.3.0

package/dist/providers/coding-proxy/registry/plan.js

@@ -0,0 +1,304 @@
+/**
+ * Lockfile verification ("approve a plan"): the registry core's check of a
+ * lockfile a run submits to `POST /registry/<ecosystem>/-/plan`. Nothing the
+ * lockfile claims is trusted:
+ *
+ * - every entry's integrity must equal the registry's own for that exact
+ *   version (a per-version fact read from the registry, stored forever);
+ * - edges come from the registry too: a parent version's declared
+ *   dependencies, resolved to lockfile entries by the client's own rule
+ *   (npm: nearest ancestor node_modules), and kept only when the entry is
+ *   the declared package at a version inside the declared range;
+ * - reachability starts at the projects' dependencies that are allowlist
+ *   roots (at a version inside the root's range) and follows only verified
+ *   edges, through versions old enough and without a HIGH/CRITICAL advisory.
+ *
+ * A refused entry refuses itself and whatever is reachable only through it;
+ * everything else is approved, as exact name@version pairs. The work is
+ * bounded: facts are fetched only for entries reached (so a lockfile of
+ * unrelated packages costs nothing upstream), with bounded concurrency and a
+ * deadline.
+ */
+import { matchRoot } from "../../../coding/registry/allowlist.js";
+import { RegistryError, } from "../../../coding/registry/types.js";
+import { versionKey } from "./audit.js";
+export const DEFAULT_PLAN_MAX_ENTRIES = 5000;
+export const DEFAULT_PLAN_TIMEOUT_MS = 120_000;
+/** Per-version documents fetched at once (each is a few KB). */
+export const DEFAULT_PLAN_FACT_CONCURRENCY = 16;
+/** Full package documents streamed at once for publish times (each may be
+ *  tens of MB, never held). */
+export const DEFAULT_PLAN_TIME_CONCURRENCY = 8;
+/** Largest (decompressed) package document streamed for publish times. */
+export const DEFAULT_PLAN_MAX_DOCUMENT_BYTES = 256 * 1024 * 1024;
+/** Runs `task` over `items`, at most `concurrency` at once. */
+async function eachLimited(items, concurrency, task) {
+    let cursor = 0;
+    const worker = async () => {
+        while (cursor < items.length)
+            await task(items[cursor++]);
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, worker));
+}
+/** A failed registry read is retried once before the entry is refused. */
+async function withRetry(signal, read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw error;
+        return read();
+    }
+}
+export async function verifyLockfilePlan(input) {
+    const { adapter, support, lockfile, signal } = input;
+    const refusals = new Map();
+    for (const entry of lockfile.entries) {
+        if (entry.kind === "unsupported")
+            refusals.set(entry, {
+                code: "wardby_lockfile_entry_unsupported",
+                reason: entry.unsupportedReason ?? "cannot be verified against the registry",
+            });
+    }
+    // Starting points: what the projects themselves declare, when it is an
+    // allowlist root at a version inside the root's range.
+    const starts = new Set();
+    for (const project of lockfile.projects) {
+        for (const dependency of project.dependencies) {
+            const entry = lockfile.resolve(project.path, dependency.key);
+            if (!entry || entry.kind !== "registry" || entry.name !== dependency.name)
+                continue;
+            const root = matchRoot(input.roots, adapter.normalizeName(entry.name));
+            if (!root)
+                continue;
+            if (root.range && !safeSatisfies(adapter, entry.version, root.range))
+                continue;
+            starts.add(entry);
+        }
+    }
+    // Breadth first over verified edges, fetching facts one layer at a time
+    // (only for entries actually reached).
+    const outcomes = new Map();
+    const edges = new Map();
+    const candidates = new Set();
+    const visited = new Set(starts);
+    let layer = [...starts];
+    while (layer.length > 0) {
+        signal.throwIfAborted();
+        await loadFacts(input, layer, outcomes);
+        const next = [];
+        for (const entry of layer) {
+            const outcome = outcomes.get(versionKey(entry.name, entry.version));
+            if ("refusal" in outcome) {
+                refusals.set(entry, outcome.refusal);
+                continue;
+            }
+            const { fact } = outcome;
+            if (entry.integrity === null || entry.integrity.trim() !== fact.integrity) {
+                refusals.set(entry, {
+                    code: "wardby_lockfile_integrity_mismatch",
+                    reason: `the lockfile's integrity is not the registry's for ${entry.name}@${entry.version}`,
+                });
+                continue;
+            }
+            if (fact.publishedAt.getTime() > input.cutoff.getTime()) {
+                refusals.set(entry, {
+                    code: "wardby_version_filtered",
+                    reason: `published ${fact.publishedAt.toISOString()}, newer than the release-age limit`,
+                    intrinsic: true,
+                    publishedAt: fact.publishedAt,
+                });
+                continue;
+            }
+            candidates.add(entry);
+            const children = [];
+            for (const dependency of fact.dependencies) {
+                const child = lockfile.resolve(entry.path, dependency.key);
+                if (!child || child.kind !== "registry" || child.name !== dependency.name)
+                    continue;
+                if (!support.edgeSatisfies(child.version, dependency.range))
+                    continue;
+                children.push(child);
+                if (!visited.has(child)) {
+                    visited.add(child);
+                    next.push(child);
+                }
+            }
+            edges.set(entry, children);
+        }
+        layer = next;
+    }
+    // One advisory lookup for every candidate version.
+    const withheld = await input.audit([...new Map([...candidates].map((entry) => [versionKey(entry.name, entry.version), entry])).values()].map(({ name, version }) => ({ name, version })), signal);
+    for (const entry of candidates) {
+        const ids = withheld.get(versionKey(entry.name, entry.version));
+        if (ids && ids.length > 0) {
+            candidates.delete(entry);
+            refusals.set(entry, {
+                code: "wardby_version_filtered",
+                reason: `withheld by advisory ${ids.join(", ")} (high severity or malware)`,
+                intrinsic: true,
+            });
+        }
+    }
+    // Reachability again, now only through entries that passed every check:
+    // a refused entry refuses whatever is reachable only through it.
+    const approvedEntries = new Set();
+    const queue = [...starts].filter((entry) => candidates.has(entry));
+    for (const entry of queue)
+        approvedEntries.add(entry);
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        for (const child of edges.get(entry) ?? []) {
+            if (!candidates.has(child) || approvedEntries.has(child))
+                continue;
+            approvedEntries.add(child);
+            queue.push(child);
+        }
+    }
+    const approved = new Map();
+    for (const entry of approvedEntries) {
+        const outcome = outcomes.get(versionKey(entry.name, entry.version));
+        if (outcome && "fact" in outcome)
+            approved.set(versionKey(entry.name, entry.version), {
+                name: entry.name,
+                version: entry.version,
+                integrity: outcome.fact.integrity,
+            });
+    }
+    const refused = new Map();
+    for (const entry of lockfile.entries) {
+        if (entry.kind === "bundled")
+            continue;
+        const key = versionKey(entry.name, entry.version);
+        if (approved.has(key) || refused.has(key))
+            continue;
+        const refusal = refusals.get(entry) ?? {
+            code: "wardby_package_not_allowed",
+            reason: "not reachable from this agent's allowlist through dependencies the registry confirms",
+        };
+        refused.set(key, { name: entry.name, version: entry.version, ...refusal });
+    }
+    // An entry refused at one place in the tree but approved at another (the
+    // same name@version) is approved: approvals are per exact version.
+    return { approved: [...approved.values()], refused: [...refused.values()] };
+}
+function safeSatisfies(adapter, version, range) {
+    try {
+        return adapter.satisfies(version, range);
+    }
+    catch {
+        return false;
+    }
+}
+/** Facts for every entry of `layer` not already known: stored facts first,
+ *  then the registry (per-version documents, then publish times streamed
+ *  once per package), storing each complete fact for reuse. */
+async function loadFacts(input, layer, outcomes) {
+    const { support, signal } = input;
+    const wanted = [
+        ...new Map(layer
+            .filter((entry) => !outcomes.has(versionKey(entry.name, entry.version)))
+            .map((entry) => [versionKey(entry.name, entry.version), { name: entry.name, version: entry.version }])).values(),
+    ];
+    if (wanted.length === 0)
+        return;
+    for (const fact of await input.facts.getVersionFacts(wanted)) {
+        // A stored fact whose download host is not (or no longer) allowed is
+        // refused below like a fresh one would be.
+        outcomes.set(versionKey(fact.name, fact.version), checkedFact(input, fact));
+    }
+    const missing = wanted.filter(({ name, version }) => !outcomes.has(versionKey(name, version)));
+    if (missing.length === 0)
+        return;
+    const fresh = new Map();
+    await eachLimited(missing, input.factConcurrency ?? DEFAULT_PLAN_FACT_CONCURRENCY, async ({ name, version }) => {
+        const key = versionKey(name, version);
+        try {
+            const fact = await withRetry(signal, () => support.fetchVersionFact(name, version, input.upstream, signal));
+            if (!fact) {
+                outcomes.set(key, {
+                    refusal: {
+                        code: "wardby_package_not_found",
+                        reason: `the registry has no ${name}@${version}`,
+                        intrinsic: true,
+                    },
+                });
+                return;
+            }
+            fresh.set(key, fact);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw error;
+            outcomes.set(key, { refusal: upstreamRefusal(error) });
+        }
+    });
+    signal.throwIfAborted();
+    const byName = new Map();
+    for (const fact of fresh.values())
+        byName.set(fact.name, [...(byName.get(fact.name) ?? []), fact.version]);
+    const complete = [];
+    await eachLimited([...byName.entries()], input.timeConcurrency ?? DEFAULT_PLAN_TIME_CONCURRENCY, async ([name, versions]) => {
+        let times;
+        try {
+            times = await withRetry(signal, () => support.fetchPublishTimes(name, versions, input.streamUpstream, {
+                signal,
+                maxBytes: input.maxDocumentBytes ?? DEFAULT_PLAN_MAX_DOCUMENT_BYTES,
+            }));
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw error;
+            for (const version of versions)
+                outcomes.set(versionKey(name, version), { refusal: upstreamRefusal(error) });
+            return;
+        }
+        for (const version of versions) {
+            const key = versionKey(name, version);
+            const publishedAt = times.get(version);
+            if (!publishedAt) {
+                // Unknown publish time counts as too new; not stored, so a later
+                // plan reads it again.
+                outcomes.set(key, {
+                    refusal: { code: "wardby_version_filtered", reason: "the registry records no publish time for it" },
+                });
+                continue;
+            }
+            const fact = { ...fresh.get(key), publishedAt };
+            complete.push(fact);
+            outcomes.set(key, checkedFact(input, fact));
+        }
+    });
+    signal.throwIfAborted();
+    await input.facts.putVersionFacts(complete);
+}
+/** A fact is usable only when the registry gave an integrity to check
+ *  downloads against and a download on this adapter's own upstream hosts. */
+function checkedFact(input, fact) {
+    if (fact.integrity === "")
+        return {
+            refusal: {
+                code: "wardby_registry_integrity_missing",
+                reason: "the registry publishes no integrity to check it against",
+                intrinsic: true,
+            },
+        };
+    if (!input.hostAllowed(fact.downloadUrl))
+        return {
+            refusal: {
+                code: "wardby_upstream_host_not_allowed",
+                reason: `hosted outside the ${input.adapter.id} registry's upstreams`,
+                intrinsic: true,
+            },
+        };
+    return { fact };
+}
+function upstreamRefusal(error) {
+    if (error instanceof RegistryError && error.code === "wardby_metadata_too_large")
+        return { code: "wardby_metadata_too_large", reason: error.message };
+    if (error instanceof RegistryError && error.code === "wardby_package_not_found")
+        return { code: "wardby_package_not_found", reason: error.message };
+    return { code: "wardby_upstream_error", reason: "the registry could not be read for it; try again" };
+}

package/dist/providers/coding-proxy/registry/prisma-store.d.ts

@@ -0,0 +1,34 @@
+import type { PrismaClient } from "#prisma";
+import type { ApprovedVersion, PlanRefusedVersion, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
+export declare class PrismaRegistryStore implements RegistryStore {
+    private readonly db;
+    constructor(db: PrismaClient);
+    findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
+    isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
+    addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    recordFetch(record: RegistryFetchRecord): Promise<void>;
+    usage(runId: string): Promise<{
+        files: number;
+        bytes: number;
+    }>;
+    refusalCount(runId: string): Promise<number>;
+    listFetches(runId: string): Promise<(RegistryFetchRecord & {
+        createdAt: Date;
+    })[]>;
+    getVersionFacts(ecosystem: string, versions: readonly {
+        name: string;
+        version: string;
+    }[]): Promise<StoredVersionFact[]>;
+    putVersionFacts(ecosystem: string, facts: readonly StoredVersionFact[]): Promise<void>;
+    approveVersions(runId: string, ecosystem: string, versions: readonly ApprovedVersion[]): Promise<void>;
+    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<{
+        integrity: string;
+        downloadUrl: string;
+    } | null>;
+    refusePlanVersions(runId: string, ecosystem: string, versions: readonly PlanRefusedVersion[]): Promise<void>;
+    findPlanRefusal(runId: string, ecosystem: string, name: string, version: string): Promise<{
+        code: string;
+        reason: string;
+        publishedAt: Date | null;
+    } | null>;
+}

package/dist/providers/coding-proxy/registry/prisma-store.js

@@ -0,0 +1,151 @@
+/** Versions looked up per query, so a 5000-entry lockfile is a handful of
+ *  bounded queries rather than one enormous OR. */
+const FACT_QUERY_CHUNK = 500;
+export class PrismaRegistryStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async findRunByRegistryTokenHash(hash, now) {
+        const session = await this.db.codingProxySession.findUnique({
+            where: { registryTokenHash: hash },
+            select: {
+                runId: true,
+                status: true,
+                deadlineAt: true,
+                run: { select: { packageAllowlist: true, packagePolicy: true } },
+            },
+        });
+        if (!session || session.status !== "active" || session.deadlineAt <= now)
+            return null;
+        return {
+            runId: session.runId,
+            deadlineAt: session.deadlineAt,
+            allowlist: (session.run.packageAllowlist ?? {}),
+            policy: session.run.packagePolicy,
+        };
+    }
+    async isAllowedDependency(runId, ecosystem, name) {
+        const row = await this.db.registryAllowance.findUnique({
+            where: { runId_ecosystem_name: { runId, ecosystem, name } },
+            select: { runId: true },
+        });
+        return row !== null;
+    }
+    async addAllowances(runId, ecosystem, names) {
+        if (names.length === 0)
+            return;
+        await this.db.registryAllowance.createMany({
+            data: [...new Set(names)].map((name) => ({ runId, ecosystem, name })),
+            skipDuplicates: true,
+        });
+    }
+    async recordFetch(record) {
+        await this.db.registryFetch.create({ data: record });
+    }
+    async usage(runId) {
+        const totals = await this.db.registryFetch.aggregate({
+            where: { runId, outcome: "served" },
+            _count: { _all: true },
+            _sum: { sizeBytes: true },
+        });
+        return { files: totals._count._all, bytes: totals._sum.sizeBytes ?? 0 };
+    }
+    async refusalCount(runId) {
+        return this.db.registryFetch.count({ where: { runId, outcome: "refused" } });
+    }
+    async listFetches(runId) {
+        const rows = await this.db.registryFetch.findMany({ where: { runId }, orderBy: { createdAt: "asc" } });
+        return rows.map((row) => ({
+            runId: row.runId,
+            ecosystem: row.ecosystem,
+            name: row.name,
+            version: row.version ?? undefined,
+            filename: row.filename ?? undefined,
+            integrity: row.integrity ?? undefined,
+            sizeBytes: row.sizeBytes ?? undefined,
+            outcome: row.outcome,
+            reason: row.reason ?? undefined,
+            createdAt: row.createdAt,
+        }));
+    }
+    async getVersionFacts(ecosystem, versions) {
+        const facts = [];
+        for (let start = 0; start < versions.length; start += FACT_QUERY_CHUNK) {
+            const chunk = versions.slice(start, start + FACT_QUERY_CHUNK);
+            const rows = await this.db.registryVersionFact.findMany({
+                where: { OR: chunk.map(({ name, version }) => ({ ecosystem, name, version })) },
+            });
+            for (const row of rows) {
+                facts.push({
+                    name: row.name,
+                    version: row.version,
+                    publishedAt: row.publishedAt,
+                    integrity: row.integrity,
+                    downloadUrl: row.downloadUrl,
+                    dependencies: row.dependencies,
+                });
+            }
+        }
+        return facts;
+    }
+    async putVersionFacts(ecosystem, facts) {
+        if (facts.length === 0)
+            return;
+        await this.db.registryVersionFact.createMany({
+            data: facts.map((fact) => ({
+                ecosystem,
+                name: fact.name,
+                version: fact.version,
+                publishedAt: fact.publishedAt,
+                integrity: fact.integrity,
+                downloadUrl: fact.downloadUrl,
+                dependencies: fact.dependencies.map(({ key, name, range }) => ({ key, name, range })),
+            })),
+            skipDuplicates: true,
+        });
+    }
+    async approveVersions(runId, ecosystem, versions) {
+        if (versions.length === 0)
+            return;
+        await this.db.registryApprovedVersion.createMany({
+            data: versions.map(({ name, version, integrity }) => ({ runId, ecosystem, name, version, integrity })),
+            skipDuplicates: true,
+        });
+    }
+    async findApprovedVersion(runId, ecosystem, name, version) {
+        const approval = await this.db.registryApprovedVersion.findUnique({
+            where: { runId_ecosystem_name_version: { runId, ecosystem, name, version } },
+            select: { integrity: true },
+        });
+        if (!approval)
+            return null;
+        const fact = await this.db.registryVersionFact.findUnique({
+            where: { ecosystem_name_version: { ecosystem, name, version } },
+            select: { downloadUrl: true },
+        });
+        return fact ? { integrity: approval.integrity, downloadUrl: fact.downloadUrl } : null;
+    }
+    async refusePlanVersions(runId, ecosystem, versions) {
+        if (versions.length === 0)
+            return;
+        await this.db.registryPlanRefusal.createMany({
+            data: versions.map(({ name, version, code, reason, publishedAt }) => ({
+                runId,
+                ecosystem,
+                name,
+                version,
+                code,
+                reason,
+                publishedAt: publishedAt ?? null,
+            })),
+            skipDuplicates: true,
+        });
+    }
+    async findPlanRefusal(runId, ecosystem, name, version) {
+        return this.db.registryPlanRefusal.findUnique({
+            where: { runId_ecosystem_name_version: { runId, ecosystem, name, version } },
+            select: { code: true, reason: true, publishedAt: true },
+        });
+    }
+}