create-quorum-router 0.1.5 → 0.1.8

package/templates/basic/src/supabase.ts

@@ -0,0 +1,462 @@
+import { z } from "zod";
+import {
+  GeneratedRouterConfigSchema,
+  type SupabaseAuditMode,
+} from "./schema.ts";
+
+const CONFIG_PATH = "router.config.json";
+const AUDIT_RPC_PATH = "/rest/v1/rpc/insert_workflow_access_audit_batch";
+const DEFAULT_TIMEOUT_MS = 5_000;
+const MAX_TIMEOUT_MS = 30_000;
+
+const FORBIDDEN_SUPABASE_ENV_KEYS = new Set([
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "QUORUM_ROUTER_SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_SERVICE_KEY",
+  "QUORUM_ROUTER_SUPABASE_SERVICE_KEY",
+  "SUPABASE_ADMIN_KEY",
+  "QUORUM_ROUTER_SUPABASE_ADMIN_KEY",
+]);
+
+export type SupabaseStatusKind =
+  | "disabled"
+  | "configured"
+  | "partial"
+  | "forbidden-credential";
+
+export type SupabaseStatus = {
+  kind: SupabaseStatusKind;
+  mode: SupabaseAuditMode;
+  ok: boolean;
+  configuredFields: number;
+  requiredFields: number;
+  forbiddenEnvKeys: string[];
+  detail: string;
+};
+
+export type SupabaseAuditRecord = {
+  workflow_id: string;
+  route?: string;
+  decision: "allow" | "error";
+  metadata: {
+    command: string;
+    mode: string;
+    auth_mode: string;
+    provider_selection_honored: boolean;
+    fallback_used: boolean;
+    schema_valid: boolean;
+  };
+};
+
+export type RouteAuditSource = {
+  run_id: string;
+  command: string;
+  mode: string;
+  auth_mode: string;
+  selected_provider?: string;
+  selected_model?: string;
+  provider_selection_honored: boolean;
+  fallback_used: boolean;
+  schema_valid: boolean;
+};
+
+export type AuditRequestOptions = {
+  fetchFn?: typeof fetch;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  configPath?: string;
+  allowInsecureLocalhostForTest?: boolean;
+};
+
+type RuntimeCredentials = {
+  url?: string;
+  anonKey?: string;
+  sessionJwt?: string;
+};
+
+function envValue(...names: string[]): string | undefined {
+  for (const name of names) {
+    const value = Deno.env.get(name)?.trim();
+    if (value) return value;
+  }
+  return undefined;
+}
+
+function runtimeCredentials(): RuntimeCredentials {
+  return {
+    url: envValue("QUORUM_ROUTER_SUPABASE_URL", "SUPABASE_URL"),
+    anonKey: envValue(
+      "QUORUM_ROUTER_SUPABASE_ANON_KEY",
+      "SUPABASE_ANON_KEY",
+    ),
+    sessionJwt: envValue(
+      "QUORUM_ROUTER_SUPABASE_SESSION_JWT",
+      "SUPABASE_SESSION_JWT",
+    ),
+  };
+}
+
+export function forbiddenSupabaseEnvKeys(): string[] {
+  return Object.keys(Deno.env.toObject()).filter((key) =>
+    FORBIDDEN_SUPABASE_ENV_KEYS.has(key.toUpperCase()) ||
+    /SUPABASE.*(SERVICE.*ROLE|SERVICE.*KEY|ADMIN.*KEY|JWT.*SECRET)/i.test(key)
+  ).sort();
+}
+
+function decodeJwtPayload(value: string): Record<string, unknown> | undefined {
+  const payload = value.split(".")[1];
+  if (!payload) return undefined;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/")
+      .padEnd(Math.ceil(payload.length / 4) * 4, "=");
+    const parsed = JSON.parse(atob(normalized));
+    return parsed && typeof parsed === "object"
+      ? parsed as Record<string, unknown>
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function isPrivilegedCredential(value: string): boolean {
+  if (/^sb_secret_/i.test(value) || /service[_-]?role/i.test(value)) {
+    return true;
+  }
+  const role = decodeJwtPayload(value)?.role;
+  return typeof role === "string" &&
+    /^(service_role|supabase_admin)$/i.test(role);
+}
+
+function assertRuntimeCredentialBoundary(credentials: RuntimeCredentials) {
+  const forbiddenKeys = forbiddenSupabaseEnvKeys();
+  if (forbiddenKeys.length > 0) {
+    throw new Error(
+      `Supabase audit forbidden-credential: runtime env keys present: ${
+        forbiddenKeys.join(", ")
+      }; values hidden`,
+    );
+  }
+  if (
+    (credentials.anonKey && isPrivilegedCredential(credentials.anonKey)) ||
+    (credentials.sessionJwt && isPrivilegedCredential(credentials.sessionJwt))
+  ) {
+    throw new Error(
+      "Supabase audit forbidden-credential: service-role/admin credential detected; value hidden",
+    );
+  }
+}
+
+export async function loadSupabaseAuditMode(
+  path = CONFIG_PATH,
+): Promise<SupabaseAuditMode> {
+  let text: string;
+  try {
+    text = await Deno.readTextFile(path);
+  } catch (error) {
+    if (error instanceof Deno.errors.NotFound) return "disabled";
+    throw new Error(`Supabase feature config unreadable: ${path}`);
+  }
+
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new Error(`Supabase feature config invalid JSON: ${path}`);
+  }
+  const parsed = GeneratedRouterConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `Supabase feature config invalid: ${
+        parsed.error.issues.map((issue) => issue.path.join(".") || "config")
+          .join(", ")
+      }`,
+    );
+  }
+  return parsed.data.features?.supabase?.audit.mode ?? "disabled";
+}
+
+export async function getSupabaseStatus(
+  configPath = CONFIG_PATH,
+): Promise<SupabaseStatus> {
+  const mode = await loadSupabaseAuditMode(configPath);
+  const credentials = runtimeCredentials();
+  const forbiddenEnvKeys = forbiddenSupabaseEnvKeys();
+  if (
+    forbiddenEnvKeys.length > 0 ||
+    (credentials.anonKey && isPrivilegedCredential(credentials.anonKey)) ||
+    (credentials.sessionJwt && isPrivilegedCredential(credentials.sessionJwt))
+  ) {
+    return {
+      kind: "forbidden-credential",
+      mode,
+      ok: false,
+      configuredFields: Object.values(credentials).filter(Boolean).length,
+      requiredFields: 3,
+      forbiddenEnvKeys,
+      detail: "service-role/admin runtime credential rejected; values hidden",
+    };
+  }
+
+  const configuredFields = Object.values(credentials).filter(Boolean).length;
+  if (configuredFields > 0 && configuredFields < 3) {
+    return {
+      kind: "partial",
+      mode,
+      ok: false,
+      configuredFields,
+      requiredFields: 3,
+      forbiddenEnvKeys: [],
+      detail:
+        "URL, publishable/anon key, and user session JWT must be set together; values hidden",
+    };
+  }
+  if (mode === "disabled") {
+    return {
+      kind: "disabled",
+      mode,
+      ok: true,
+      configuredFields,
+      requiredFields: 3,
+      forbiddenEnvKeys: [],
+      detail: configuredFields === 3
+        ? "credentials present but audit is disabled; values hidden"
+        : "Supabase audit is disabled and no credentials are required",
+    };
+  }
+  if (configuredFields === 3) {
+    return {
+      kind: "configured",
+      mode,
+      ok: true,
+      configuredFields,
+      requiredFields: 3,
+      forbiddenEnvKeys: [],
+      detail:
+        "runtime URL, publishable/anon key, and user session JWT are configured; values hidden",
+    };
+  }
+  return {
+    kind: "partial",
+    mode,
+    ok: false,
+    configuredFields,
+    requiredFields: 3,
+    forbiddenEnvKeys: [],
+    detail:
+      "audit mode requires URL, publishable/anon key, and user session JWT; values hidden",
+  };
+}
+
+export async function runSupabaseStatus(): Promise<void> {
+  const status = await getSupabaseStatus();
+  console.log("QuorumRouter Supabase audit status");
+  console.log(`state: ${status.kind}`);
+  console.log(`audit_mode: ${status.mode}`);
+  console.log(
+    `runtime_credentials: ${status.configuredFields}/${status.requiredFields} configured; values hidden`,
+  );
+  if (status.forbiddenEnvKeys.length > 0) {
+    console.log(`forbidden_env_keys: ${status.forbiddenEnvKeys.join(", ")}`);
+  }
+  console.log(`detail: ${status.detail}`);
+  console.log("network_request_sent: false");
+  if (!status.ok) Deno.exitCode = 1;
+}
+
+export function toSupabaseAuditRecord(
+  source: RouteAuditSource,
+): SupabaseAuditRecord {
+  const route = source.selected_provider && source.selected_model
+    ? `${source.selected_provider}/${source.selected_model}`
+    : source.selected_provider;
+  return {
+    workflow_id: source.run_id,
+    route,
+    decision: source.schema_valid ? "allow" : "error",
+    metadata: {
+      command: source.command,
+      mode: source.mode,
+      auth_mode: source.auth_mode,
+      provider_selection_honored: source.provider_selection_honored,
+      fallback_used: source.fallback_used,
+      schema_valid: source.schema_valid,
+    },
+  };
+}
+
+function auditEndpoint(
+  rawUrl: string,
+  allowInsecureLocalhostForTest = false,
+): string {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error("Supabase audit invalid project URL; value hidden");
+  }
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]" ||
+    url.hostname === "localhost";
+  const allowedProtocol = url.protocol === "https:" ||
+    (allowInsecureLocalhostForTest && loopback && url.protocol === "http:");
+  if (!allowedProtocol || url.username || url.password) {
+    throw new Error(
+      "Supabase audit invalid project URL; HTTPS required; value hidden",
+    );
+  }
+  return new URL(AUDIT_RPC_PATH, url).toString();
+}
+
+function boundedTimeout(value: number | undefined): number {
+  if (!Number.isFinite(value) || (value ?? 0) <= 0) return DEFAULT_TIMEOUT_MS;
+  return Math.min(Math.floor(value!), MAX_TIMEOUT_MS);
+}
+
+function httpFailure(status: number): Error {
+  if (status === 401 || status === 403) {
+    return new Error(`Supabase audit auth failure (HTTP ${status})`);
+  }
+  if (status === 429) {
+    return new Error("Supabase audit rate limited (HTTP 429)");
+  }
+  if (status >= 500) {
+    return new Error(`Supabase audit server failure (HTTP ${status})`);
+  }
+  return new Error(`Supabase audit RPC rejected request (HTTP ${status})`);
+}
+
+export async function sendSupabaseAuditRecord(
+  record: SupabaseAuditRecord,
+  credentials: Required<RuntimeCredentials>,
+  options: AuditRequestOptions = {},
+): Promise<void> {
+  assertRuntimeCredentialBoundary(credentials);
+  const endpoint = auditEndpoint(
+    credentials.url,
+    options.allowInsecureLocalhostForTest,
+  );
+  if (options.signal?.aborted) {
+    throw new Error("Supabase audit request aborted");
+  }
+  const controller = new AbortController();
+  let timedOut = false;
+  const abort = () => controller.abort(options.signal?.reason);
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, boundedTimeout(options.timeoutMs));
+
+  try {
+    const response = await (options.fetchFn ?? fetch)(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "prefer": "return=minimal",
+        "authorization": `Bearer ${credentials.sessionJwt}`,
+        "apikey": credentials.anonKey,
+      },
+      body: JSON.stringify({ records: [record] }),
+      signal: controller.signal,
+      redirect: "error",
+    });
+    if (!response.ok) throw httpFailure(response.status);
+  } catch (error) {
+    if (timedOut) throw new Error("Supabase audit request timed out");
+    if (controller.signal.aborted) {
+      throw new Error("Supabase audit request aborted");
+    }
+    if (error instanceof Error && error.message.startsWith("Supabase audit")) {
+      throw error;
+    }
+    throw new Error("Supabase audit network failure");
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+
+export async function preflightRequiredSupabaseAudit(
+  options: AuditRequestOptions = {},
+): Promise<void> {
+  const mode = await loadSupabaseAuditMode(options.configPath);
+  if (mode !== "required") return;
+  const credentials = runtimeCredentials();
+  assertRuntimeCredentialBoundary(credentials);
+  const missing = Object.entries(credentials).filter(([, value]) => !value).map(
+    ([key]) => key,
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `Required Supabase audit incomplete runtime configuration: missing ${
+        missing.join(", ")
+      }; provider invocation blocked`,
+    );
+  }
+  auditEndpoint(
+    credentials.url!,
+    options.allowInsecureLocalhostForTest,
+  );
+  const claims = decodeJwtPayload(credentials.sessionJwt!);
+  if (
+    claims?.role !== "authenticated" ||
+    typeof claims.sub !== "string" || claims.sub.length === 0
+  ) {
+    throw new Error(
+      "Required Supabase audit needs an authenticated user session JWT; provider invocation blocked",
+    );
+  }
+}
+
+export async function auditRouteOutcome(
+  source: RouteAuditSource,
+  options: AuditRequestOptions = {},
+): Promise<void> {
+  const credentials = runtimeCredentials();
+  assertRuntimeCredentialBoundary(credentials);
+  const mode = await loadSupabaseAuditMode(options.configPath);
+  if (mode === "disabled") return;
+
+  const missing = Object.entries(credentials).filter(([, value]) => !value)
+    .map(([key]) => key);
+  try {
+    if (missing.length > 0) {
+      throw new Error(
+        `Supabase audit incomplete runtime configuration: missing ${
+          missing.join(", ")
+        }; values hidden`,
+      );
+    }
+    await sendSupabaseAuditRecord(
+      toSupabaseAuditRecord(source),
+      credentials as Required<RuntimeCredentials>,
+      options,
+    );
+  } catch (error) {
+    const message = error instanceof Error
+      ? error.message
+      : "Supabase audit failed";
+    if (mode === "optional") {
+      console.warn(`WARNING: optional ${message}; route result preserved`);
+      return;
+    }
+    throw new Error(`Required ${message}; route result withheld`);
+  }
+}
+
+export const SupabaseAuditPayloadSchema = z.object({
+  records: z.array(
+    z.object({
+      workflow_id: z.string().min(1),
+      route: z.string().optional(),
+      decision: z.enum(["allow", "error"]),
+      metadata: z.object({
+        command: z.string(),
+        mode: z.string(),
+        auth_mode: z.string(),
+        provider_selection_honored: z.boolean(),
+        fallback_used: z.boolean(),
+        schema_valid: z.boolean(),
+      }).strict(),
+    }).strict(),
+  ).length(1),
+}).strict();

package/templates/basic/src/trace.ts

@@ -1,6 +1,7 @@
 import type {
   AgentChatTurn,
   AuthMode,
+  CostAwareTrace,
   DogfoodTrace,
   PromptContextTrace,
   ProviderResult,
@@ -74,6 +75,7 @@ export async function buildTrace(args: {
   requestedModel?: string;
   providerSelectionHonored?: boolean;
   fallbackUsed?: boolean;
+  costAware?: CostAwareTrace;
   agentChatTurns?: AgentChatTurn[];
 }): Promise<DogfoodTrace> {
   const responseSummary = args.results?.map((r) =>
@@ -93,6 +95,7 @@ export async function buildTrace(args: {
     selected_model: args.selected?.model ?? args.results?.[0]?.model,
     provider_selection_honored: args.providerSelectionHonored ?? true,
     fallback_used: args.fallbackUsed ?? false,
+    cost_aware: args.costAware,
     prompt_hash: args.prompt ? await promptHash(args.prompt) : undefined,
     prompt_summary: args.prompt ? summarize(args.prompt, 160) : undefined,
     prompt_context: args.promptContext,

package/templates/basic/src/wrapper_client.ts

@@ -3,18 +3,21 @@ import { redact, summarize } from "./redact.ts";
 
 export function buildWrapperArgs(
   entry: ModelInventoryEntry,
-  prompt: string,
   outPath: string,
+  promptPath?: string,
 ): string[] {
   const args = (entry.args_template ?? []).map((arg) =>
-    arg === "__PROMPT__"
-      ? prompt
-      : arg === "__CWD__"
+    arg === "__CWD__"
       ? Deno.cwd()
       : arg === "__OUT__"
       ? outPath
+      : arg === "__PROMPT_FILE__"
+      ? promptPath ?? ""
       : arg
   );
+  if (args.includes("__PROMPT__") || args.includes("__PROMPT_FILE__")) {
+    throw new Error("QuorumRouter blocked: unresolved prompt placeholder");
+  }
   if (entry.command === "grok" && entry.invocation_model) {
     if (entry.invocation_model === "grok-build") {
       const withoutPlanMode: string[] = [];
@@ -166,28 +169,57 @@ export async function callWrapper(
       `QuorumRouter blocked: ${entry.provider} has no command`,
     );
   }
-  await Deno.mkdir("out", {
-    recursive: true,
+  await Deno.mkdir("out", { recursive: true, mode: 0o700 });
+  const outPath = await Deno.makeTempFile({
+    dir: "out",
+    prefix: "quorum-router-output-",
+    suffix: ".txt",
   });
-  const outPath = `out/tmp-${crypto.randomUUID()}.txt`;
+  await Deno.chmod(outPath, 0o600);
+  const absoluteOutPath = await Deno.realPath(outPath);
+  const promptPath = entry.prompt_transport === "file"
+    ? await Deno.makeTempFile({
+      dir: "out",
+      prefix: "quorum-router-prompt-",
+      suffix: ".txt",
+    })
+    : undefined;
+  if (promptPath) {
+    await Deno.chmod(promptPath, 0o600);
+    await Deno.writeTextFile(promptPath, prompt);
+  }
+  const absolutePromptPath = promptPath
+    ? await Deno.realPath(promptPath)
+    : undefined;
   try {
-    const runWrapper = () =>
-      new Deno.Command(entry.command!, {
-        args: buildWrapperArgs(entry, prompt, outPath),
+    const runWrapper = async () => {
+      const child = new Deno.Command(entry.command!, {
+        args: buildWrapperArgs(
+          entry,
+          absoluteOutPath,
+          absolutePromptPath,
+        ),
         cwd: Deno.env.get("TMPDIR") || "/tmp",
         clearEnv: true,
         env: safeWrapperEnv(),
-        stdin: "null",
+        stdin: entry.prompt_transport === "stdin" ? "piped" : "null",
         stdout: "piped",
         stderr: "piped",
       }).spawn();
-    let output = await outputWithTimeout(runWrapper(), 120_000);
+      if (entry.prompt_transport === "stdin") {
+        const writer = child.stdin.getWriter();
+        await writer.write(new TextEncoder().encode(prompt));
+        await writer.close();
+      }
+      return child;
+    };
+    let output = await outputWithTimeout(await runWrapper(), 120_000);
     if (
       output.code === 141 && output.stdout.length === 0 &&
       output.stderr.length === 0
     ) {
       await new Promise((resolve) => setTimeout(resolve, 500));
-      output = await outputWithTimeout(runWrapper(), 120_000);
+      output = await outputWithTimeout(await runWrapper(), 120_000);
     }
     const stdout = new TextDecoder().decode(output.stdout);
     const stderr = new TextDecoder().decode(output.stderr);
@@ -220,5 +252,6 @@ export async function callWrapper(
     };
   } finally {
     await Deno.remove(outPath).catch(() => undefined);
+    if (promptPath) await Deno.remove(promptPath).catch(() => undefined);
   }
 }

package/templates/basic/supabase/migrations/20260701130000_workflow_access_audit.sql

@@ -0,0 +1,125 @@
+create extension if not exists pgcrypto with schema extensions;
+
+create table if not exists public.workflow_access_audit (
+  id uuid primary key default extensions.gen_random_uuid(),
+  org_id text not null,
+  actor_id uuid not null,
+  actor_type text not null default 'ai_assistant'
+    check (actor_type in ('ai_assistant', 'user', 'system')),
+  event_type text not null check (length(event_type) > 0),
+  workflow_id text,
+  route text,
+  decision text not null check (decision in ('allow', 'deny', 'error')),
+  reason text,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now()
+);
+
+alter table public.workflow_access_audit enable row level security;
+
+revoke all privileges on table public.workflow_access_audit from public;
+revoke all privileges on table public.workflow_access_audit from anon;
+revoke all privileges on table public.workflow_access_audit from authenticated;
+
+create or replace function public.prevent_workflow_access_audit_mutation()
+returns trigger
+language plpgsql
+set search_path = public, pg_temp
+as $$
+begin
+  raise exception 'workflow_access_audit is append-only';
+end;
+$$;
+
+revoke all privileges on function public.prevent_workflow_access_audit_mutation()
+  from public;
+
+drop trigger if exists workflow_access_audit_no_update_delete
+  on public.workflow_access_audit;
+create trigger workflow_access_audit_no_update_delete
+before update or delete on public.workflow_access_audit
+for each row
+execute function public.prevent_workflow_access_audit_mutation();
+
+create or replace function public.insert_workflow_access_audit_batch(records jsonb)
+returns void
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  rec jsonb;
+  claim_org_id text;
+  claim_actor_id uuid;
+  event_type text;
+  decision text;
+begin
+  claim_actor_id := auth.uid();
+  if claim_actor_id is null then
+    raise exception 'missing authenticated user'
+      using errcode = '28000';
+  end if;
+
+  claim_org_id := nullif(auth.jwt() ->> 'org_id', '');
+  if claim_org_id is null then
+    raise exception 'missing org_id claim'
+      using errcode = '28000';
+  end if;
+
+  if records is null or jsonb_typeof(records) <> 'array' then
+    raise exception 'records must be a JSON array'
+      using errcode = '22023';
+  end if;
+
+  for rec in select value from jsonb_array_elements(records) as entry(value) loop
+    event_type := nullif(rec ->> 'event_type', '');
+    decision := nullif(rec ->> 'decision', '');
+
+    if event_type is null then
+      raise exception 'audit event_type is required'
+        using errcode = '22023';
+    end if;
+
+    if decision is null then
+      raise exception 'audit decision is required'
+        using errcode = '22023';
+    end if;
+
+    insert into public.workflow_access_audit (
+      org_id,
+      actor_id,
+      actor_type,
+      event_type,
+      workflow_id,
+      route,
+      decision,
+      reason,
+      metadata,
+      created_at
+    ) values (
+      claim_org_id,
+      claim_actor_id,
+      coalesce(nullif(rec ->> 'actor_type', ''), 'ai_assistant'),
+      event_type,
+      nullif(rec ->> 'workflow_id', ''),
+      nullif(rec ->> 'route', ''),
+      decision,
+      nullif(rec ->> 'reason', ''),
+      case
+        when jsonb_typeof(rec -> 'metadata') = 'object' then rec -> 'metadata'
+        else '{}'::jsonb
+      end,
+      now()
+    );
+  end loop;
+end;
+$$;
+
+revoke all privileges on function public.insert_workflow_access_audit_batch(jsonb)
+  from public;
+revoke all privileges on function public.insert_workflow_access_audit_batch(jsonb)
+  from anon;
+revoke all privileges on function public.insert_workflow_access_audit_batch(jsonb)
+  from authenticated;
+grant execute on function public.insert_workflow_access_audit_batch(jsonb)
+  to authenticated;