@zaip-ai/cli 6.2.0 → 7.5.0

package/templates/.agents/tools/cloud-onboarding.mjs

@@ -0,0 +1,196 @@
+import { lstat } from "node:fs/promises";
+import { resolve } from "node:path";
+import { recordArchitecture } from "./cloud-onboarding-architecture.mjs";
+import { configure } from "./cloud-onboarding-configure.mjs";
+import { bindExistingCredential, prepareCredential } from "./cloud-onboarding-credentials.mjs";
+import { fileServices } from "./cloud-onboarding-files.mjs";
+import {
+  binding,
+  CONTRACT,
+  fail,
+  hash,
+  inside,
+  OPERATIONS,
+  REQUEST,
+  safeError,
+  selected,
+  validateContract,
+} from "./cloud-onboarding-policy.mjs";
+import { discover, registerPublicKey } from "./cloud-onboarding-provider.mjs";
+import { sshRead, trustHost } from "./cloud-onboarding-ssh.mjs";
+import { prepareTerraform } from "./cloud-onboarding-terraform.mjs";
+import { assertRepositoryOperation, loadRepositoryPolicy } from "./repository-policy.mjs";
+
+function exact(args, keys) {
+  if (
+    Object.keys(args).length !== keys.length ||
+    keys.some((k) => typeof args[k] !== "string" || !args[k])
+  )
+    fail("invalid_arguments");
+}
+function noSecrets(value) {
+  if (
+    typeof value === "string" &&
+    /-----BEGIN [^-]*PRIVATE KEY|\b(?:Bearer\s+[A-Za-z0-9._-]+|sk-[A-Za-z0-9_-]{12,})/.test(value)
+  )
+    fail("secret_material_denied");
+  if (Array.isArray(value)) value.forEach(noSecrets);
+  else if (value && typeof value === "object") {
+    for (const [key, child] of Object.entries(value)) {
+      if (/(?:^|_)(token|password|passphrase|private_key|secret)(?:$|_)/i.test(key))
+        fail("secret_material_denied");
+      noSecrets(child);
+    }
+  }
+}
+export async function runOnboarding(args, injected = {}) {
+  const root = resolve(injected.root ?? resolve(import.meta.dirname, "../.."));
+  assertRepositoryOperation(await loadRepositoryPolicy(root), "infra");
+  if (["vps:host:configure", "vps:containers:configure"].includes(args.operation)) {
+    const configured = await lstat(resolve(root, ".agents/config/repository-policy.json")).then(
+      () => true,
+      (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      },
+    );
+    if (configured)
+      fail("repository_profile_requires_typed_remote_configuration_not_arbitrary_scripts");
+  }
+  const exec = injected.exec;
+  if (typeof exec !== "function") fail("process_executor_unavailable");
+  const files = injected.files ?? fileServices(root, exec, injected.fs);
+  const ctx = {
+    root,
+    exec,
+    files,
+    http: injected.http ?? fetch,
+    now: injected.now ?? (() => new Date().toISOString()),
+    interactiveKeygen: injected.interactiveKeygen,
+    diskEncryption: injected.diskEncryption,
+  };
+  try {
+    if (args.operation === "vps:capabilities") {
+      exact(args, ["operation"]);
+      let available = false;
+      try {
+        available = (await exec("ssh", ["-V"], { timeout: 5000, maxOutput: 1024 })).code === 0;
+      } catch {}
+      return {
+        operation: args.operation,
+        state: "observed",
+        ssh_client: available ? "available" : "unavailable",
+        agent: "requires_selected_identity",
+        provider_api: "not_checked",
+        connectors: "host_discovery_required",
+        authenticated_browser: "host_discovery_required",
+        disk_encryption: "unavailable",
+      };
+    }
+    if (args.operation === "vps:prepare") {
+      exact(args, ["operation", "request"]);
+      if (args.request !== REQUEST) fail("invalid_request_path");
+      const request = await files.json(inside(root, REQUEST));
+      noSecrets(request);
+      if (
+        Object.keys(request).some(
+          (k) =>
+            ![
+              "version",
+              "project_root",
+              "authorization",
+              "targets",
+              "architecture",
+              "expected_previous_hash",
+            ].includes(k),
+        )
+      )
+        fail("invalid_request");
+      if (request.version !== 1 || (request.project_root && resolve(request.project_root) !== root))
+        fail("project_binding_mismatch");
+      const contract = {
+        version: 1,
+        profile: "vps-onboarding",
+        project_root: root,
+        authorization: request.authorization,
+        targets: request.targets ?? [],
+        architecture: request.architecture ?? null,
+      };
+      if (!Array.isArray(contract.targets)) fail("invalid_contract");
+      contract.bindings = Object.fromEntries(
+        contract.targets.map((t) => [t.name, binding(root, t)]),
+      );
+      validateContract(contract, root, true);
+      for (const target of contract.targets) {
+        if (
+          target.credential &&
+          ["external-key", "agent", "import"].includes(target.credential.mode)
+        ) {
+          await bindExistingCredential(target.credential, ctx);
+        }
+      }
+      contract.bindings = Object.fromEntries(
+        contract.targets.map((t) => [t.name, binding(root, t)]),
+      );
+      validateContract(contract, root);
+      const content = `${JSON.stringify(contract, null, 2)}\n`;
+      await files.lock("onboarding-contract", async () => {
+        const path = inside(root, CONTRACT);
+        let old;
+        try {
+          old = await files.readFile(path, "utf8");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        if (old === undefined || old === content) await files.exclusive(path, content);
+        else {
+          if (request.expected_previous_hash !== hash(old))
+            fail("contract_revision_requires_expected_hash");
+          await files.receipt(["contract-history", hash(old)], JSON.parse(old));
+          await files.replace(path, content, request.expected_previous_hash);
+        }
+      });
+      return {
+        operation: args.operation,
+        state: "prepared",
+        contract: CONTRACT,
+        contract_sha256: hash(content),
+        bindings: contract.bindings,
+        remote_operations_executed: false,
+      };
+    }
+    if (args.operation === "vps:architecture") exact(args, ["operation", "contract"]);
+    else exact(args, ["operation", "contract", "target", "binding"]);
+    if (!OPERATIONS.includes(args.operation) || args.contract !== CONTRACT)
+      fail("operation_not_allowed");
+    const contract = await files.json(inside(root, CONTRACT));
+    noSecrets(contract);
+    validateContract(contract, root);
+    ctx.authorization = contract.authorization.reference;
+    if (args.operation === "vps:architecture") {
+      if (contract.authorization.architecture !== true) fail("architecture_not_authorized");
+      return {
+        operation: args.operation,
+        ...(await files.lock("architecture", () => recordArchitecture(contract.architecture, ctx))),
+      };
+    }
+    const target = selected(contract, args, root);
+    return await files.lock([target.name, target.credential?.name], async () => {
+      let outcome;
+      if (args.operation === "vps:credential:prepare")
+        outcome = await prepareCredential(target, ctx);
+      else if (args.operation === "vps:ssh:trust") outcome = await trustHost(target, ctx);
+      else if (args.operation === "vps:discover") outcome = await discover(target, ctx);
+      else if (args.operation === "vps:public-key:register")
+        outcome = await registerPublicKey(target, ctx);
+      else if (args.operation === "vps:terraform:prepare")
+        outcome = await prepareTerraform(target, contract, ctx);
+      else if (args.operation.endsWith(":configure"))
+        outcome = await configure(target, args.operation, ctx);
+      else outcome = await sshRead(target, args.operation, ctx);
+      return { operation: args.operation, target: target.name, ...outcome };
+    });
+  } catch (error) {
+    fail(safeError(error));
+  }
+}

package/templates/.agents/tools/cloud-onboarding.ssh.integration.test.mjs

@@ -0,0 +1,391 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rm,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import test from "node:test";
+import { prepareCredential } from "./cloud-onboarding-credentials.mjs";
+import { fileServices } from "./cloud-onboarding-files.mjs";
+import { fingerprint } from "./cloud-onboarding-policy.mjs";
+import { registerPublicKey } from "./cloud-onboarding-provider.mjs";
+import { PROBES, sanitize, sshRead, trustHost } from "./cloud-onboarding-ssh.mjs";
+import {
+  agentFixture,
+  boundedFixture,
+  closeFixture,
+  listenFixture,
+  ownedListener,
+} from "./cloud-onboarding-test-fixtures.mjs";
+import { execute } from "./cloud-runner.mjs";
+
+const repository = resolve(import.meta.dirname, "../..");
+const dependency = resolve(
+  // biome-ignore lint/suspicious/noUndeclaredEnvVars: isolated qualification observes explicit host runtime/test inputs outside Turbo caching.
+  process.env.ZAIP_SSH2_TEST_MODULE ??
+    join(repository, ".local/vps-ssh-test-server/node_modules/ssh2"),
+);
+const require = createRequire(import.meta.url);
+let ssh2;
+try {
+  ssh2 = require(dependency);
+} catch {}
+test("fixture cancels a timed-out bind even when it starts late", async () => {
+  const listener = ownedListener(() => {});
+  const listen = listener.server.listen.bind(listener.server);
+  let delayedBind;
+  listener.server.listen = (...args) => {
+    delayedBind = () => listen(...args);
+    return listener.server;
+  };
+  await assert.rejects(
+    listenFixture(listener, { port: 0, host: "127.0.0.1" }, 10),
+    /fixture listen exceeded 10ms/,
+  );
+  assert.equal(listener.controller.signal.aborted, true);
+  await boundedFixture(
+    "late bind cancellation",
+    () =>
+      new Promise((done) => {
+        listener.server.once("close", done);
+        delayedBind();
+      }),
+  );
+  assert.equal(listener.server.listening, false);
+  assert.equal(listener.sockets.size, 0);
+});
+
+async function setup(t, { network = true } = {}) {
+  const directory = join(repository, ".local/vps-onboarding-tests");
+  await mkdir(directory, { recursive: true });
+  const sandbox = await mkdtemp(join(directory, "real SSH with spaces "));
+  let server, agent;
+  t.after(async () => {
+    t.diagnostic("closing owned SSH and agent fixture sockets");
+    const closed = await Promise.allSettled([
+      closeFixture(server, "SSH close"),
+      closeFixture(agent, "agent close"),
+    ]);
+    const failures = closed.filter((result) => result.status === "rejected");
+    if (failures.length)
+      throw new AggregateError(
+        failures.map((result) => result.reason),
+        "fixture cleanup failed",
+      );
+    assert.equal(dirname(sandbox), directory);
+    await rm(sandbox, { recursive: true, force: true });
+  });
+  const root = join(sandbox, "consumer with spaces");
+  await mkdir(root);
+  await execute("git", ["init", "--quiet", root]);
+  const initializedOwners = new Set();
+  const fixtureExec = async (...args) => {
+    const started = performance.now();
+    const securePath = args[2]?.env?.ZAIP_SECURE_PATH;
+    let initializesOwner = false;
+    if (
+      process.platform === "win32" &&
+      args[0] === "powershell.exe" &&
+      args[2]?.env?.ZAIP_SECURE_DIR !== undefined &&
+      !initializedOwners.has(securePath)
+    ) {
+      // Elevated hosted Windows creates fixtures owned by Administrators. Set the
+      // current owner only on this test's newly created physical files/directories;
+      // the unmodified product command must still verify that exact owner and ACL.
+      const offset = relative(sandbox, securePath);
+      assert.ok(offset && !offset.startsWith("..") && !isAbsolute(offset));
+      assert.equal(await realpath(securePath), securePath);
+      const info = await lstat(securePath);
+      assert.ok(
+        !info.isSymbolicLink() && (info.isDirectory() || (info.isFile() && info.nlink === 1)),
+      );
+      assert.deepEqual(args[1].slice(0, 3), ["-NoProfile", "-NonInteractive", "-Command"]);
+      const prepareOwner =
+        "$ErrorActionPreference='Stop';$p=$env:ZAIP_SECURE_PATH;$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$a=Get-Acl -LiteralPath $p;$old=$a.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($old -ne $sid.Value){if($old -ne 'S-1-5-32-544'){exit 4};$a.SetOwner($sid);Set-Acl -LiteralPath $p -AclObject $a};if((Get-Acl -LiteralPath $p).GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value){exit 5};";
+      // One process, followed by the original product script unchanged. Every
+      // product owner/ACE check and exit code still executes in powershell.exe.
+      args[1] = [...args[1].slice(0, 3), prepareOwner + args[1][3]];
+      initializesOwner = true;
+    }
+    const outcome = await execute(...args);
+    t.diagnostic(
+      `fixture ${args[0]} completed in ${Math.round(performance.now() - started)}ms; code=${outcome.code}`,
+    );
+    if (args[0] === "powershell.exe" && outcome.code !== 0)
+      assert.fail(
+        `fixture ACL command ${outcome.code} (timeout=${outcome.timedOut}, overflow=${outcome.overflow}): ${sanitize(outcome.stderr, 1500).replaceAll(sandbox, "[sandbox]")}`,
+      );
+    if (initializesOwner) initializedOwners.add(securePath);
+    return outcome;
+  };
+  const files = fileServices(root, fixtureExec);
+  const host = join(sandbox, "host-key"),
+    user = join(sandbox, "selected-user-key"),
+    other = join(sandbox, "other-user-key");
+  for (const path of network ? [host, user, other] : [user]) {
+    const generated = await execute(
+      "ssh-keygen",
+      ["-t", "ed25519", "-N", "ephemeral-fixture-passphrase", "-f", path],
+      { timeout: 15000 },
+    );
+    assert.equal(
+      generated.code,
+      0,
+      JSON.stringify({
+        stdout: generated.stdout,
+        stderr: generated.stderr,
+        timedOut: generated.timedOut,
+        overflow: generated.overflow,
+      }).replaceAll("ephemeral-fixture-passphrase", "[redacted]"),
+    );
+    await files.protect(path);
+  }
+  const userPublic = await readFile(`${user}.pub`, "utf8");
+  const ctx = {
+    root,
+    files,
+    exec: execute,
+    now: () => new Date().toISOString(),
+    authorization: "ephemeral-test-only",
+    diskEncryption: async () => ({
+      state: "unavailable",
+      reason: "not_measured_in_protocol_fixture",
+    }),
+  };
+  if (!network)
+    return {
+      ctx,
+      user,
+      userPublic,
+      target: {
+        name: "loopback",
+        purpose: "local-credential-test",
+        allowed_operations: [],
+        ssh: {
+          host: "127.0.0.1",
+          user: "operator",
+          port: 2222,
+          host_fingerprint: fingerprint(userPublic),
+        },
+      },
+    };
+  const hostPublic = await readFile(`${host}.pub`, "utf8");
+  const parsed = ssh2.utils.parseKey(await readFile(user), "ephemeral-fixture-passphrase");
+  const otherParsed = ssh2.utils.parseKey(await readFile(other), "ephemeral-fixture-passphrase");
+  assert.ok(!(parsed instanceof Error));
+  const offered = [],
+    commands = [];
+  const protocol = new ssh2.Server(
+    { hostKeys: [{ key: await readFile(host), passphrase: "ephemeral-fixture-passphrase" }] },
+    (client) => {
+      client.on("error", () => {});
+      client.on("authentication", (auth) => {
+        if (auth.method !== "publickey") return auth.reject();
+        offered.push(auth.key.data.toString("base64"));
+        if (
+          auth.username === "operator" &&
+          auth.key.data.equals(parsed.getPublicSSH()) &&
+          (!auth.signature || parsed.verify(auth.blob, auth.signature, auth.hashAlgo))
+        )
+          auth.accept();
+        else auth.reject();
+      });
+      client.on("ready", () =>
+        client.on("session", (accept) => {
+          const session = accept();
+          session.on("exec", (acceptExec, rejectExec, info) => {
+            commands.push(info.command);
+            if (!["true", "sh -s"].includes(info.command)) return rejectExec();
+            const stream = acceptExec();
+            stream.on("error", () => {});
+            if (info.command === "true") {
+              stream.exit(0);
+              stream.end();
+              return;
+            }
+            let input = "";
+            stream.on("data", (data) => (input += data.toString()));
+            stream.on("end", () => {
+              assert.ok(!/printenv|environ|sudo/.test(input));
+              stream.write(
+                Object.keys(PROBES)
+                  .map((name) => `\nZAIP_BEGIN_${name}\nsynthetic-${name}\nZAIP_END_${name}_0\n`)
+                  .join(""),
+              );
+              stream.exit(0);
+              stream.end();
+            });
+          });
+        }),
+      );
+    },
+  );
+  server = ownedListener((socket) => protocol.injectSocket(socket));
+  await listenFixture(server, { port: 0, host: "127.0.0.1" });
+  const endpoint =
+    process.platform === "win32"
+      ? `\\\\.\\pipe\\zaip-fixture-${randomUUID()}`
+      : join(sandbox, "agent.sock");
+  agent = agentFixture([otherParsed, parsed]);
+  await listenFixture(agent, { path: endpoint });
+  t.diagnostic("ephemeral SSH and selected agent ready");
+  const target = {
+    name: "loopback",
+    purpose: "local-ssh-test",
+    allowed_operations: [],
+    ssh: {
+      host: "127.0.0.1",
+      user: "operator",
+      port: server.server.address().port,
+      host_fingerprint: fingerprint(hostPublic),
+      host_public_key: hostPublic.trim().split(/\s+/).slice(0, 2).join(" "),
+      trust: { source: "previously-verified", reference: "ephemeral-host-generated-in-test" },
+    },
+    credential: {
+      name: "selected",
+      mode: "agent",
+      path: `${user}.pub`,
+      public_fingerprint: fingerprint(userPublic),
+      agent_endpoint: endpoint,
+    },
+  };
+  const changePresentedHostKey = async () => {
+    t.diagnostic("rotating ephemeral host identity");
+    const port = server.server.address().port;
+    await closeFixture(server, "host rotation close");
+    const replacement = new ssh2.Server(
+      { hostKeys: [{ key: await readFile(other), passphrase: "ephemeral-fixture-passphrase" }] },
+      (client) => client.on("error", () => {}),
+    );
+    server = ownedListener((socket) => replacement.injectSocket(socket));
+    await listenFixture(server, { port, host: "127.0.0.1" });
+  };
+  return { ctx, target, user, userPublic, offered, parsed, commands, changePresentedHostKey };
+}
+test("VPS-17,20,24,25,27 real OpenSSH loopback, protected selected agent identity and paths with spaces; synthetic inventory responses", {
+  skip: !ssh2 && "pinned local ssh2 test dependency unavailable",
+}, async (t) => {
+  const f = await setup(t);
+  await trustHost(f.target, f.ctx);
+  assert.equal((await sshRead(f.target, "vps:ssh:test", f.ctx)).state, "verified");
+  const inventory = await sshRead(f.target, "vps:ssh:inventory", f.ctx);
+  assert.ok(
+    Object.values(inventory.fields).every((field) => field.value?.startsWith("synthetic-")),
+  );
+  assert.ok(
+    f.offered.length > 0 &&
+      f.offered.every((key) => key === f.parsed.getPublicSSH().toString("base64")),
+    "no alternative agent identity may be attempted",
+  );
+  const agentCredential = f.target.credential,
+    executedBefore = f.commands.length;
+  f.target.credential = {
+    name: "protected-without-agent",
+    mode: "external-key",
+    path: f.user,
+    public_fingerprint: fingerprint(f.userPublic),
+  };
+  await assert.rejects(
+    sshRead(f.target, "vps:ssh:test", f.ctx),
+    /ssh_authentication_or_host_verification_failed/,
+  );
+  assert.equal(
+    f.commands.length,
+    executedBefore,
+    "protected key without its agent must not execute a command or try another identity",
+  );
+  f.target.credential = agentCredential;
+  const known = join(f.ctx.root, ".agents/private/state/ssh/loopback/known_hosts");
+  const before = await readFile(known, "utf8");
+  const offeredBefore = f.offered.length;
+  await f.changePresentedHostKey();
+  await assert.rejects(
+    sshRead(f.target, "vps:ssh:test", f.ctx),
+    /ssh_authentication_or_host_verification_failed/,
+  );
+  assert.equal(
+    f.offered.length,
+    offeredBefore,
+    "changed server identity must fail before user authentication",
+  );
+  assert.equal(await readFile(known, "utf8"), before);
+});
+test("VPS-18,20 real protected import preserves original and passphrase; Windows ACL and junction boundaries", {
+  skip: !ssh2 && "pinned local ssh2 test dependency unavailable",
+}, async (t) => {
+  const f = await setup(t, { network: false });
+  f.target.credential = {
+    name: "imported",
+    mode: "import",
+    path: f.user,
+    public_fingerprint: fingerprint(f.userPublic),
+    import_authorized: true,
+  };
+  const before = await readFile(f.user);
+  await prepareCredential(f.target, f.ctx);
+  const imported = join(f.ctx.root, ".agents/private/state/ssh/imported/identity");
+  assert.deepEqual(await readFile(imported), before);
+  assert.deepEqual(await readFile(f.user), before);
+  assert.equal(
+    (
+      await execute("ssh-keygen", ["-y", "-P", "ephemeral-fixture-passphrase", "-f", imported], {
+        timeout: 5000,
+      })
+    ).code,
+    0,
+  );
+  await f.ctx.files.verifyPermissions(imported);
+  const alias = join(f.ctx.root, ".agents/private/state/ssh/junction-alias");
+  await symlink(dirname(imported), alias, process.platform === "win32" ? "junction" : "dir");
+  await assert.rejects(f.ctx.files.checked(join(alias, "identity")), /linked_path_denied/);
+  const generatedTarget = {
+    ...f.target,
+    credential: {
+      name: "generated",
+      mode: "generate",
+      unprotected: true,
+      unprotected_acceptance: true,
+    },
+  };
+  const generated = await prepareCredential(generatedTarget, f.ctx);
+  assert.match(generated.public_key, /^ssh-ed25519 /);
+  const generatedPath = join(f.ctx.root, ".agents/private/state/ssh/generated/identity");
+  const generatedBytes = await readFile(generatedPath);
+  await prepareCredential(generatedTarget, f.ctx);
+  assert.deepEqual(await readFile(generatedPath), generatedBytes);
+  generatedTarget.ssh = { ...generatedTarget.ssh, user: "root" };
+  generatedTarget.provider = {
+    name: "hostinger",
+    account_reference: "fictional-fixture-account",
+    credential_source: "root",
+    vps_id: "7",
+    selector: { kind: "id", value: "7" },
+    public_key_registration_authorized: true,
+  };
+  await writeFile(join(f.ctx.root, ".env"), "HOSTINGER_API_TOKEN=fictional-provider-fixture\n");
+  let publicKeys = [],
+    posts = 0;
+  f.ctx.http = async (url, options) => {
+    if (url.endsWith("/ssh-keys") && options.method === "POST") {
+      publicKeys = JSON.parse(options.body).keys;
+      posts++;
+    }
+    const body = url.endsWith("/ssh-keys")
+      ? publicKeys.map((key) => ({ key }))
+      : url.endsWith("/virtual-machines")
+        ? [{ id: 7, hostname: "loopback", ipv4: ["127.0.0.1"] }]
+        : { id: 7, hostname: "loopback", ipv4: ["127.0.0.1"] };
+    return { ok: true, status: 200, text: async () => JSON.stringify(body) };
+  };
+  assert.equal((await registerPublicKey(generatedTarget, f.ctx)).state, "verified");
+  assert.equal(posts, 1);
+  assert.deepEqual(publicKeys, [generated.public_key]);
+});