firedrill-run 2.2.5 → 3.0.0

package/dist/cli/src/native/drill-cleanup.js

@@ -0,0 +1,115 @@
+/** Recover only retained signed process-close facts; never launch or stop a target. */
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open, rename } from 'node:fs/promises';
+import { join } from 'node:path';
+import { api } from '../auth.js';
+import { privateDirectory } from '../credentials.js';
+import { CliError } from '../http.js';
+import { withHistoricalRunCleanup } from '../runner-identity.js';
+import { selectedWorkspace } from '../world-access.js';
+import { identifier } from '../world-contracts.js';
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const fail = () => {
+    throw new CliError('native_drill_cleanup_unconfirmed', 'The original cleanup evidence is unavailable or changed. Preserve its journal. No target was started or stopped.');
+};
+async function load(path) {
+    let file;
+    try {
+        file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    try {
+        const info = await file.stat();
+        if (!info.isFile() || info.size > 65536 || info.mode & 0o077 || process.getuid && info.uid !== process.getuid())
+            return fail();
+        return object(JSON.parse(await file.readFile('utf8'))) ?? fail();
+    }
+    finally {
+        await file.close();
+    }
+}
+async function save(path, value) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    const file = await open(temporary, 'wx', 0o600);
+    try {
+        await file.writeFile(JSON.stringify(value));
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    await rename(temporary, path);
+}
+export async function drillCleanupCommand(deviceKey, assignmentId, options, emit) {
+    deviceKey = identifier(deviceKey);
+    assignmentId = identifier(assignmentId);
+    const scope = await selectedWorkspace({ workspace: options.workspace, interactive: !options.json && !!process.stdin.isTTY,
+        openBrowser: options.openBrowser, signal: options.signal });
+    await withHistoricalRunCleanup(scope, deviceKey, options.signal, async (identity) => {
+        const path = `/api/workspaces/${scope.workspace}/native-executors/${identity.deviceId}/assignments/${assignmentId}/cleanup`;
+        const auth = { actor: scope.owner, workspace: scope.workspace, signal: identity.signal };
+        const journalPath = join(await privateDirectory(), `native-drill-cleanup-${scope.owner}-${scope.workspace}-${deviceKey}-${assignmentId}.json`);
+        let retained = await load(journalPath);
+        if (retained && (retained.schema !== 'firedrill.drill-cleanup-intent.v1' || retained.workspace_id !== scope.workspace
+            || retained.actor_id !== scope.owner || retained.device_key !== deviceKey || retained.device_id !== identity.deviceId
+            || retained.assignment_id !== assignmentId))
+            return fail();
+        const challenge = object(await api(path, auth));
+        if (!challenge || challenge.assignment_id !== assignmentId || challenge.execution_authorized !== false
+            || typeof challenge.cleanup_id !== 'string' || !UUID.test(challenge.cleanup_id)
+            || typeof challenge.attempt_id !== 'string' || !UUID.test(challenge.attempt_id)
+            || !Number.isSafeInteger(challenge.report_sequence))
+            return fail();
+        if (!retained) {
+            if (challenge.report_received)
+                throw new CliError('native_cleanup_reported', 'Cleanup was already reported. Nothing further was sent.');
+            const evidence = object(await api(path + '/evidence', auth));
+            if (!evidence || evidence.schema !== 'firedrill.native-cleanup-evidence.v1' || evidence.execution_authorized !== false
+                || evidence.cloud_cleanup_complete !== false || evidence.process_provenance !== 'retained_signed_device_close'
+                || JSON.stringify(evidence.challenge) !== JSON.stringify(challenge) || !Array.isArray(evidence.processes)
+                || evidence.processes.length > 128 || typeof evidence.close_artifact_id !== 'string' || !UUID.test(evidence.close_artifact_id)
+                || typeof evidence.close_sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(evidence.close_sha256))
+                return fail();
+            const processes = evidence.processes;
+            if (processes.some(value => !object(value) || !['owned_group_reaped', 'transport_detached', 'not_started'].includes(String(object(value)?.close_kind))))
+                return fail();
+            emit('native_drill_cleanup_review', { assignment_id: assignmentId, cleanup_id: challenge.cleanup_id,
+                close_artifact_id: evidence.close_artifact_id, processes: processes.length, execution_authorized: false }, 'Verified the original signed process-close facts. This reports cleanup only, not successful execution or cloud settlement.');
+            if (!options.approve)
+                return;
+            const payload = { schema: 'firedrill.native-execution-cleanup.v1', request_key: randomUUID(),
+                sequence: Number(challenge.report_sequence) + 1, outcome: 'cleanup_reported', processes };
+            for (const field of ['cleanup_id', 'assignment_id', 'attempt_id', 'execution_epoch', 'state_generation', 'observation_sequence', 'last_action_id'])
+                payload[field] = challenge[field];
+            const document = await identity.sign(payload);
+            retained = { schema: 'firedrill.drill-cleanup-intent.v1', workspace_id: scope.workspace, actor_id: scope.owner,
+                device_key: deviceKey, device_id: identity.deviceId, assignment_id: assignmentId,
+                close_artifact_id: evidence.close_artifact_id, close_sha256: evidence.close_sha256, document };
+            await save(journalPath, retained);
+        }
+        const document = object(retained.document), payload = object(document?.payload);
+        if (!document || typeof document.signature !== 'string' || !payload
+            || payload.schema !== 'firedrill.native-execution-cleanup.v1' || payload.assignment_id !== assignmentId
+            || payload.cleanup_id !== challenge.cleanup_id || payload.attempt_id !== challenge.attempt_id
+            || ['execution_epoch', 'state_generation', 'observation_sequence', 'last_action_id'].some(key => payload[key] !== challenge[key]))
+            return fail();
+        if (!options.approve) {
+            emit('native_drill_cleanup_pending', { assignment_id: assignmentId, request_key: payload.request_key }, 'An original cleanup request is retained. Use --approve-change to reconcile that same request.');
+            return;
+        }
+        const receipt = object(await api(path, { ...auth, method: 'POST', body: document }));
+        if (!receipt || receipt.cleanup_id !== challenge.cleanup_id || receipt.assignment_id !== assignmentId
+            || receipt.request_key !== payload.request_key || receipt.sequence !== payload.sequence
+            || receipt.outcome !== payload.outcome || receipt.execution_authorized !== false
+            || receipt.cloud_cleanup_complete !== false || receipt.process_provenance !== 'customer_device')
+            return fail();
+        await save(journalPath, { ...retained, receipt });
+        emit('native_drill_cleanup_reported', receipt, 'Original process cleanup reported. Cloud cleanup and accounting remain separate. No target was run.');
+    }, 'drill');
+}