@zaip-ai/cli 1.3.8 → 1.4.2

package/templates/.agents/tools/cloud-runner-dns.mjs

@@ -0,0 +1,28 @@
+const fields = ["name", "type", "content", "proxied", "ttl", "comment"];
+
+export function dnsInventory(scope) {
+  return new Set(
+    Array.isArray(scope.dns_records) ? scope.dns_records : Object.keys(scope.dns_records ?? {}),
+  );
+}
+
+export function dnsBody(record, fail) {
+  if (!record || typeof record !== "object") fail("invalid_contract");
+  const body = {};
+  for (const key of fields) if (record[key] !== undefined) body[key] = record[key];
+  if (
+    typeof body.name !== "string" ||
+    typeof body.type !== "string" ||
+    typeof body.content !== "string"
+  )
+    fail("invalid_contract");
+  return body;
+}
+
+export function sameDns(actual, expected) {
+  return fields.every((key) => expected[key] === undefined || actual[key] === expected[key]);
+}
+
+export function authHeaders(token) {
+  return { Authorization: `Bearer ${token}`, "Content-Type": "application/json" };
+}

package/templates/.agents/tools/cloud-runner-terraform.mjs

@@ -0,0 +1,212 @@
+/** Executes the contract-bound Terraform operations used by cloud-runner. */
+export async function runTerraform(args, contract, credentials, toolkit) {
+  const { deps, root, dirname, exact, fail, insideRoot, nonempty, requireString, result, sha256 } =
+    toolkit;
+  const scope = contract.terraform;
+  if (
+    !scope ||
+    !new Set(["terraform:plan", "terraform:apply", "terraform:import"]).has(args.operation) ||
+    !scope.allowed_operations?.includes(args.operation)
+  )
+    fail("operation_not_allowed");
+  exact(
+    args,
+    args.operation === "terraform:plan"
+      ? ["contract", "operation", "credentials-source", "terraform-directory"]
+      : args.operation === "terraform:apply"
+        ? [
+            "contract",
+            "operation",
+            "credentials-source",
+            "plan-path",
+            "plan-sha256",
+            "policy-result-sha256",
+          ]
+        : ["contract", "operation", "credentials-source", "resource-address", "resource-id"],
+  );
+  if (
+    !credentials.cloudflare ||
+    !credentials.hostinger ||
+    scope.working_directory !== "infra/terraform"
+  )
+    fail("credential_unavailable");
+  const cwd = insideRoot(scope.working_directory);
+  const env = terraformEnvironment(credentials.values, { nonempty, fail });
+  const binary = insideRoot(requireString(scope, "binary_path"));
+  if (sha256(await deps.readFile(binary)) !== scope.binary_sha256)
+    fail("terraform_binary_mismatch");
+  await toolkit.preflight(contract, credentials, deps);
+  const plan = toolkit.validPlan(scope.plan, contract.cloudflare.account_id);
+  await toolkit.verifyPolicyTargets(contract, deps);
+  await toolkit.verifyBackendSource(plan, cwd, deps);
+  const execOptions = { cwd, env, timeout: 900_000, maxOutput: 32_000_000 };
+  if (
+    (await deps.exec(binary, ["init", "-input=false", "-lockfile=readonly"], execOptions)).code !==
+    0
+  )
+    fail("terraform_init_failed");
+  await toolkit.verifyBackend(plan, cwd, deps);
+  if (args.operation === "terraform:plan")
+    return planTerraform(args, contract, plan, binary, execOptions, {
+      deps,
+      root,
+      dirname,
+      fail,
+      insideRoot,
+      result,
+      sha256,
+      receipt: toolkit.receipt,
+    });
+  if (args.operation === "terraform:apply")
+    return applyTerraform(args, contract, credentials, plan, binary, cwd, execOptions, toolkit);
+  exact(args, ["contract", "operation", "credentials-source", "resource-address", "resource-id"]);
+  if (scope.import_targets?.[args.resourceAddress] !== args.resourceId) fail("target_mismatch");
+  if (
+    (
+      await deps.exec(
+        binary,
+        ["import", "-input=false", args.resourceAddress, args.resourceId],
+        execOptions,
+      )
+    ).code !== 0
+  )
+    fail("remote_result_requires_reconciliation");
+  return result(args.operation, "terraform", [args.resourceAddress, args.resourceId]);
+}
+
+async function planTerraform(args, contract, plan, binary, execOptions, toolkit) {
+  const { deps, root, dirname, fail, insideRoot, result, sha256, receipt } = toolkit;
+  if (args.terraformDirectory !== "infra/terraform") fail("target_mismatch");
+  const planPath = insideRoot(plan.path),
+    policyPath = insideRoot(plan.policy_json_path);
+  await deps.mkdir(dirname(planPath), { recursive: true });
+  for (const argv of [
+    ["fmt", "-check"],
+    ["validate"],
+    ["plan", "-input=false", "-out", planPath],
+    ["show", "-json", planPath],
+  ]) {
+    const response = await deps.exec(binary, argv, execOptions);
+    if (response.code !== 0) fail("terraform_failed");
+    if (argv[0] === "show") await deps.writeFile(policyPath, response.stdout ?? "");
+  }
+  const policy = await policyCheck(plan, root, deps);
+  if (policy.code !== 0) fail("terraform_policy_failed");
+  return {
+    ...result(args.operation, "terraform", plan.targets ?? []),
+    plan_sha256: sha256(await deps.readFile(planPath)),
+    policy_result_sha256: await receipt(contract, policy.stdout ?? "", deps),
+  };
+}
+
+async function applyTerraform(
+  args,
+  contract,
+  credentials,
+  plan,
+  binary,
+  cwd,
+  execOptions,
+  toolkit,
+) {
+  const {
+    deps,
+    root,
+    fail,
+    exact,
+    insideRoot,
+    result,
+    sha256,
+    receipt,
+    verifyBackend,
+    observeState,
+  } = toolkit;
+  exact(args, [
+    "contract",
+    "operation",
+    "credentials-source",
+    "plan-path",
+    "plan-sha256",
+    "policy-result-sha256",
+  ]);
+  const planPath = insideRoot(plan.path);
+  if (
+    args.planPath !== plan.path ||
+    args.planSha256 !== plan.sha256 ||
+    args.policyResultSha256 !== plan.policy_result_sha256 ||
+    sha256(await deps.readFile(planPath)) !== args.planSha256
+  )
+    fail("target_mismatch");
+  const show = await deps.exec(binary, ["show", "-json", planPath], execOptions);
+  if (show.code !== 0) fail("terraform_failed");
+  await deps.writeFile(insideRoot(plan.policy_json_path), show.stdout ?? "");
+  const policy = await policyCheck(plan, root, deps);
+  if (
+    policy.code !== 0 ||
+    (await receipt(contract, policy.stdout ?? "", deps)) !== args.policyResultSha256
+  )
+    fail("terraform_policy_failed");
+  if ((await deps.exec(binary, ["apply", "-input=false", planPath], execOptions)).code !== 0)
+    fail("remote_result_requires_reconciliation");
+  await verifyBackend(plan, cwd, deps);
+  const state = await deps.exec(binary, ["show", "-json"], execOptions);
+  if (state.code !== 0) fail("read_after_write_failed");
+  const observed = await observeState(JSON.parse(state.stdout), contract, credentials, deps);
+  if (observed.bindings.length) {
+    for (const binding of observed.bindings)
+      Object.assign(contract.hostinger.vps[binding.role], {
+        id: binding.id,
+        ssh_host: binding.ipv4,
+      });
+    delete contract.terraform.plan.sha256;
+    delete contract.terraform.plan.policy_result_sha256;
+    await deps.writeFile(insideRoot(args.contract), `${JSON.stringify(contract, null, 2)}\n`, {
+      mode: 0o600,
+    });
+  }
+  return {
+    ...result(args.operation, "terraform", observed.targets),
+    bindings: observed.bindings,
+    validation: "provider-read-after-write; application health requires separate checks",
+    plan_sha256: args.planSha256,
+    policy_result_sha256: args.policyResultSha256,
+  };
+}
+
+function terraformEnvironment(values, { nonempty, fail }) {
+  if (!nonempty(values.AWS_ACCESS_KEY_ID) || !nonempty(values.AWS_SECRET_ACCESS_KEY))
+    fail("backend_credential_unavailable");
+  const allowed = [
+    "CLOUDFLARE_API_TOKEN",
+    "HOSTINGER_API_TOKEN",
+    "TF_VAR_cloudflare_account_id",
+    "TF_VAR_cloudflare_zone_id",
+    "TF_VAR_cloudflare_zone_name",
+    "TF_VAR_edge_vps_ipv4",
+    "TF_VAR_application_vps_ipv4",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_REGION",
+  ];
+  return {
+    ...Object.fromEntries(
+      allowed.filter((key) => nonempty(values[key])).map((key) => [key, values[key]]),
+    ),
+    AWS_EC2_METADATA_DISABLED: "true",
+  };
+}
+
+function policyCheck(plan, root, deps) {
+  return deps.exec(
+    process.execPath,
+    [
+      ".agents/tools/cloud-terraform-plan-policy.mjs",
+      "--plan",
+      plan.policy_json_path,
+      "--contract",
+      plan.policy_contract_path,
+    ],
+    { cwd: root, env: {} },
+  );
+}

package/templates/.agents/tools/cloud-runner.integration.test.mjs

@@ -0,0 +1,239 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import {
+  copyFile,
+  link,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { pathToFileURL } from "node:url";
+
+test("real filesystem, local HTTP providers and stateful child CLI complete plan/apply without real accounts", async (t) => {
+  const temporaryRoot = await realpath(tmpdir());
+  const workspace = await mkdtemp(join(temporaryRoot, "zaip-cloud-e2e-"));
+  t.after(async () => {
+    assert.equal(dirname(await realpath(workspace)), temporaryRoot);
+    assert.ok(basename(workspace).startsWith("zaip-cloud-e2e-"));
+    await rm(workspace, { recursive: true, force: true });
+  });
+  const put = async (name, content) => {
+    const path = join(workspace, name);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, typeof content === "string" ? content : JSON.stringify(content));
+  };
+  await put(".agents/tools/.keep", "");
+  await copyFile(
+    resolve(import.meta.dirname, "cloud-runner.mjs"),
+    join(workspace, ".agents/tools/cloud-runner.mjs"),
+  );
+  await copyFile(
+    resolve(import.meta.dirname, "cloud-terraform-plan-policy.mjs"),
+    join(workspace, ".agents/tools/cloud-terraform-plan-policy.mjs"),
+  );
+  await put("scripts/.keep", "");
+  await copyFile(
+    resolve(import.meta.dirname, "../../scripts/validate-cloud-terraform-plan.mjs"),
+    join(workspace, "scripts/validate-cloud-terraform-plan.mjs"),
+  );
+  await mkdir(join(workspace, ".local"), { recursive: true });
+  const binary = join(
+    workspace,
+    ".local",
+    process.platform === "win32" ? "terraform.exe" : "terraform",
+  );
+  try {
+    await link(process.execPath, binary);
+  } catch {
+    await copyFile(process.execPath, binary);
+  }
+  const hash = createHash("sha256")
+    .update(await readFile(binary))
+    .digest("hex");
+  const config = {
+    bucket: "approved-state",
+    key: "test/state",
+    region: "us-east-1",
+    encrypt: true,
+    use_lockfile: true,
+  };
+  const policy = {
+    cloudflare: {
+      account_id: "cf",
+      zone_id: "zone",
+      zone_name: "example.com",
+      edge_ipv4: "198.51.100.7",
+      dns_records: {},
+    },
+    hostinger: {
+      edge: {
+        id: "101",
+        plan: "sku",
+        data_center_id: 1,
+        template_id: 2,
+        hostname: "edge",
+        ssh_key_ids: [],
+      },
+      application: {
+        id: "102",
+        plan: "sku",
+        data_center_id: 1,
+        template_id: 2,
+        hostname: "app",
+        ssh_key_ids: [],
+        ipv4: "198.51.100.8",
+      },
+    },
+  };
+  const contract = {
+    version: 1,
+    profile: "autonomous-cloud",
+    authorization: { standing: true, reference: "TASK-TEST" },
+    cloudflare: { account_id: "cf", zone_id: "zone", zone_name: "example.com", dns_records: [] },
+    hostinger: {
+      account_id: "hs",
+      vps: {
+        edge: { id: "101", ssh_host: "198.51.100.7" },
+        application: { id: "102", ssh_host: "198.51.100.8" },
+      },
+    },
+    terraform: {
+      binary_path: ".local/" + basename(binary),
+      binary_sha256: hash,
+      working_directory: "infra/terraform",
+      allowed_operations: ["terraform:plan", "terraform:apply"],
+      plan: {
+        backend: { type: "s3", config },
+        path: ".local/cloud/plans/approved.tfplan",
+        policy_json_path: ".local/cloud/plans/approved.json",
+        policy_contract_path: ".agents/config/policy.json",
+      },
+    },
+  };
+  const contractPath = ".agents/config/autonomous-cloud-contract.json";
+  await put(contractPath, contract);
+  await put(".agents/config/policy.json", policy);
+  await put(
+    ".env",
+    "CLOUDFLARE_API_TOKEN=fake-cf\nHOSTINGER_API_TOKEN=fake-hs\nAWS_ACCESS_KEY_ID=fake-state-key\nAWS_SECRET_ACCESS_KEY=fake-state-secret\nUNRELATED_SECRET=never-forward\n",
+  );
+  await put("infra/terraform/backend.tf.json", { terraform: { backend: { s3: config } } });
+  await put("infra/terraform/.terraform.lock.hcl", "fixture-provider-lock");
+  const values = ["edge", "application"].map((role) => ({
+    address: `hostinger_vps.${role}[0]`,
+    type: "hostinger_vps",
+    mode: "managed",
+    values: { ...policy.hostinger[role], ipv4_address: contract.hostinger.vps[role].ssh_host },
+  }));
+  for (const resource of values) delete resource.values.ipv4;
+  await put("infra/terraform/expected-plan.json", {
+    resource_changes: values.map((resource) => ({
+      address: resource.address,
+      type: resource.type,
+      change: { actions: ["no-op"], before: resource.values, after: resource.values },
+    })),
+  });
+  await put("infra/terraform/expected-state.json", {
+    values: { root_module: { resources: values } },
+  });
+  await put(
+    "infra/terraform/fake.cjs",
+    `const fs=require('node:fs');const assert=require('node:assert/strict');module.exports=(op)=>{
+    assert.equal(process.env.UNRELATED_SECRET,undefined);assert.equal(process.env.AWS_EC2_METADATA_DISABLED,'true');
+    let state=fs.existsSync('.fake-state.json')?JSON.parse(fs.readFileSync('.fake-state.json')):{};
+    if(op==='init'){state.initialized=true;fs.mkdirSync('.terraform',{recursive:true});const b=JSON.parse(fs.readFileSync('backend.tf.json')).terraform.backend.s3;fs.writeFileSync('.terraform/terraform.tfstate',JSON.stringify({backend:{type:'s3',config:b}}));}
+    else {assert.ok(state.initialized);if(op==='plan'){state.planned=true;fs.writeFileSync(process.argv[process.argv.indexOf('-out')+1],'reviewed-plan');}
+    if(op==='show'){assert.ok(state.planned);const saved=process.argv.length>3;if(!saved)assert.ok(state.applied);process.stdout.write(fs.readFileSync(saved?'expected-plan.json':'expected-state.json'));}
+    if(op==='apply'){assert.ok(state.planned);assert.equal(fs.readFileSync(process.argv.at(-1),'utf8'),'reviewed-plan');state.applied=true;}}
+    state.calls=[...(state.calls||[]),op];fs.writeFileSync('.fake-state.json',JSON.stringify(state));};`,
+  );
+  for (const op of ["init", "fmt", "validate", "plan", "show", "apply"])
+    await put(`infra/terraform/${op}`, `require('./fake.cjs')('${op}');`);
+  const requests = [];
+  const server = createServer((req, res) => {
+    requests.push(req.url);
+    res.setHeader("Content-Type", "application/json");
+    if (req.method !== "GET") {
+      res.statusCode = 405;
+      return res.end("{}");
+    }
+    if (req.url === "/client/v4/zones/zone")
+      return res.end(
+        JSON.stringify({
+          success: true,
+          result: { id: "zone", name: "example.com", account: { id: "cf" } },
+        }),
+      );
+    const id = /virtual-machines\/(101|102)$/.exec(req.url)?.[1];
+    if (id)
+      return res.end(
+        JSON.stringify({
+          id: Number(id),
+          ipv4: [{ address: id === "101" ? "198.51.100.7" : "198.51.100.8" }],
+        }),
+      );
+    res.statusCode = 404;
+    res.end("{}");
+  });
+  await new Promise((done) => server.listen(0, "127.0.0.1", done));
+  t.after(() => new Promise((done) => server.close(done)));
+  const endpoint = `http://127.0.0.1:${server.address().port}`;
+  const deps = { http: (url, options) => fetch(endpoint + new URL(url).pathname, options) };
+  const { run } = await import(
+    pathToFileURL(join(workspace, ".agents/tools/cloud-runner.mjs")).href
+  );
+  const planned = await run(
+    {
+      contract: contractPath,
+      operation: "terraform:plan",
+      credentialsSource: "root",
+      terraformDirectory: "infra/terraform",
+    },
+    deps,
+  );
+  Object.assign(contract.terraform.plan, {
+    sha256: planned.plan_sha256,
+    policy_result_sha256: planned.policy_result_sha256,
+  });
+  await put(contractPath, contract);
+  const args = {
+    contract: contractPath,
+    operation: "terraform:apply",
+    credentialsSource: "root",
+    planPath: contract.terraform.plan.path,
+    planSha256: planned.plan_sha256,
+    policyResultSha256: planned.policy_result_sha256,
+  };
+  const result = await run(args, deps);
+  assert.deepEqual(result.targets, ["101", "102"]);
+  const recorded = JSON.parse(
+    await readFile(join(workspace, "infra/terraform/.fake-state.json"), "utf8"),
+  );
+  assert.deepEqual(recorded.calls, [
+    "init",
+    "fmt",
+    "validate",
+    "plan",
+    "show",
+    "init",
+    "show",
+    "apply",
+    "show",
+  ]);
+  assert.equal(requests.length, 8);
+  await put(contract.terraform.plan.path, "tampered");
+  await assert.rejects(run(args, deps), /target_mismatch/);
+  assert.equal(
+    JSON.parse(
+      await readFile(join(workspace, "infra/terraform/.fake-state.json"), "utf8"),
+    ).calls.filter((op) => op === "apply").length,
+    1,
+  );
+});