clawdi 0.15.5 → 0.15.7

package/egress-addon/clawdi_egress_addon.py

@@ -7,9 +7,13 @@ secret JSON file generated by the CLI at runtime.
 
 from __future__ import annotations
 
+import asyncio
+import errno
+import hashlib
 import json
 import os
 import re
+import stat
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
@@ -74,10 +78,30 @@ class ClawdiEgressAddon:
         self.profiles: list[dict[str, Any]] = []
         self.secrets: dict[str, str] = {}
         self.profile_hosts: set[str] = set()
+        self.snapshot_path: Path | None = None
+        self.snapshot_ack: Path | None = None
+        self.snapshot_digest: str | None = None
+        self.snapshot_identity: tuple[int, ...] | None = None
+        self.snapshot_claimed = True
+        self.snapshot_task: asyncio.Task | None = None
 
     def load(self, loader: Any) -> None:  # pragma: no cover - mitmproxy integration glue.
         self.reload_from_environment(os.environ)
 
+    def running(self) -> None:  # pragma: no cover - native integration glue.
+        # ScriptLoader invokes RunningHook synchronously, including reloads.
+        if self.snapshot_path:
+            self.snapshot_task = asyncio.create_task(self.watch_snapshot())
+
+    async def watch_snapshot(self) -> None:
+        while True:
+            self.refresh_snapshot()
+            await asyncio.sleep(1)
+
+    def done(self) -> None:  # pragma: no cover - native integration glue.
+        if self.snapshot_task:
+            self.snapshot_task.cancel()
+
     def requestheaders(self, flow: Any) -> None:
         decision = self.apply_to_flow(flow)
         mark_flow_decision_applied(flow)
@@ -107,6 +131,16 @@ class ClawdiEgressAddon:
 
     def reload_from_environment(self, environ: dict[str, str | None]) -> None:
         config = merged_config(environ)
+        snapshot = first_nonempty(config.get("CLAWDI_EGRESS_SNAPSHOT_FILE"))
+        if snapshot:
+            ack = first_nonempty(config.get("CLAWDI_EGRESS_SNAPSHOT_ACK"))
+            if not ack:
+                raise ConfigError("egress snapshot acknowledgement path is required")
+            self.snapshot_claimed = False
+            self.snapshot_path = Path(snapshot)
+            self.snapshot_ack = Path(ack)
+            self.refresh_snapshot()
+            return
         bundle = first_nonempty(config.get("CLAWDI_EGRESS_PROFILE_BUNDLE"))
         if not bundle:
             raise ConfigError("CLAWDI_EGRESS_PROFILE_BUNDLE is required")
@@ -119,9 +153,17 @@ class ClawdiEgressAddon:
         self.profile_hosts = profile_host_set(self.profiles)
 
     def should_intercept_sni(self, server_name: str) -> bool:
+        if not self.snapshot_claimed:
+            return True
         return normalize_host(server_name) in self.profile_hosts
 
     def apply_to_flow(self, flow: Any) -> ProfileDecision:
+        if not self.snapshot_claimed:
+            flow.response = http.Response.make(
+                503, b"Managed egress is not configured.\n",
+                {"content-type": "text/plain; charset=utf-8"},
+            )
+            return ProfileDecision("deny")
         profile = first_matching_profile(flow, self.profiles, self.secrets)
         if profile is None:
             return ProfileDecision("allow")
@@ -143,6 +185,76 @@ class ClawdiEgressAddon:
             return ProfileDecision(kind, str(profile.get("id")), profile=profile)
         return ProfileDecision("allow", str(profile.get("id")), "unknown-kind", profile)
 
+    def refresh_snapshot(self) -> None:
+        if not self.snapshot_path:
+            return
+        identity = None
+        try:
+            node = self.snapshot_path.lstat()
+            identity = (node.st_ino, node.st_mtime_ns, node.st_ctime_ns, node.st_size, node.st_mode)
+            if identity == self.snapshot_identity:
+                return
+            fd = os.open(self.snapshot_path, os.O_RDONLY | os.O_NOFOLLOW)
+            with os.fdopen(fd, "rb") as source:
+                node = os.fstat(source.fileno())
+                if (not stat.S_ISREG(node.st_mode) or node.st_uid != 0
+                        or node.st_mode & 0o027 or node.st_size > 8 * 1024 * 1024):
+                    raise ConfigError("egress snapshot authority is invalid")
+                content = source.read(8 * 1024 * 1024 + 1)
+            if len(content) > 8 * 1024 * 1024:
+                raise ConfigError("egress snapshot is too large")
+            digest = hashlib.sha256(content).hexdigest()
+            raw = json.loads(content)
+            if (not isinstance(raw, dict)
+                    or set(raw) != {"schemaVersion", "claimed", "profiles", "secrets"}
+                    or raw["schemaVersion"] != "clawdi.egressSnapshot.v1"
+                    or not isinstance(raw["claimed"], bool)
+                    or not isinstance(raw["secrets"], dict)
+                    or not all(isinstance(k, str) and isinstance(v, str)
+                               for k, v in raw["secrets"].items())):
+                raise ConfigError("egress snapshot is invalid")
+            profiles = parse_profiles(raw["profiles"])
+            secrets = raw["secrets"]
+            validate_profile_secrets(profiles, secrets)
+            if not raw["claimed"] and (secrets or raw["profiles"] != {
+                    "schemaVersion": SCHEMA_VERSION, "profiles": []}):
+                raise ConfigError("anonymous egress snapshot contains policy or credentials")
+            self.profiles, self.secrets = profiles, secrets
+            self.profile_hosts = profile_host_set(profiles)
+            self.snapshot_claimed = raw["claimed"]
+            # Publish only after all policy and credential checks succeed.
+            if self.snapshot_ack:
+                pending = self.snapshot_ack.with_name(f"ack.{os.getpid()}.tmp")
+                fd = os.open(pending, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+                with os.fdopen(fd, "w") as target:
+                    target.write(digest + "\n")
+                pending.replace(self.snapshot_ack)
+            self.snapshot_digest = digest
+            self.snapshot_identity = identity
+        except OSError as error:
+            if error.errno != errno.ELOOP:
+                # Atomic replacement and temporary I/O failure do not revoke a valid policy.
+                ctx.log.warn("clawdi egress snapshot read/ack deferred")
+                return
+            self.invalidate_snapshot(identity)
+        except (ConfigError, ValueError, TypeError):
+            self.invalidate_snapshot(identity)
+
+    def invalidate_snapshot(self, identity: tuple[int, ...] | None) -> None:
+        ctx.log.error("clawdi egress snapshot unhealthy: invalid replacement")
+        # A definitively invalid replacement must never use stale credentials.
+        self.snapshot_identity = identity
+        self.profiles, self.secrets, self.profile_hosts = [], {}, set()
+        self.snapshot_claimed = False
+        self.snapshot_digest = None
+        if self.snapshot_ack:
+            try:
+                self.snapshot_ack.unlink(missing_ok=True)
+            except OSError:
+                pass
+        # Engine exit makes the sidecar fail and exposes unhealthy manager state.
+        ctx.master.shutdown()
+
 
 def merged_config(environ: dict[str, str | None]) -> dict[str, str]:
     config: dict[str, str] = {}
@@ -184,7 +296,11 @@ def load_profiles(path: Path) -> list[dict[str, Any]]:
         raw = json.loads(path.read_text(encoding="utf-8"))
     except FileNotFoundError as exc:
         raise ConfigError(f"egress profile bundle is missing: {path}") from exc
-    if raw.get("schemaVersion") != SCHEMA_VERSION:
+    return parse_profiles(raw)
+
+
+def parse_profiles(raw: Any) -> list[dict[str, Any]]:
+    if not isinstance(raw, dict) or raw.get("schemaVersion") != SCHEMA_VERSION:
         raise ConfigError(f"egress profile bundle must use {SCHEMA_VERSION}")
     profiles = raw.get("profiles")
     if not isinstance(profiles, list):

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "clawdi",
-	"version": "0.15.5",
+	"version": "0.15.7",
 	"description": "The best home for all your AI agents. Run them in the cloud or connect your own—with their context and tools in one place.",
 	"license": "MIT",
 	"type": "module",