orizu 0.4.0 → 0.5.0

package/src/hosted-runtime-assets.ts

@@ -0,0 +1,272 @@
+/**
+ * In-sandbox runtime assets for the hosted bootstrap (ALI-925, per ADR-005).
+ *
+ * Ports the DESIGN — not the code — of OpenInspect's
+ * `sandbox_runtime/credentials/git_credential_helper.py` into a self-contained
+ * script asset that Orizu writes into the sandbox and registers as a git
+ * `credential.helper`. On every git op git spawns the script; the script mints a
+ * fresh, downscoped, audited token from Orizu's per-repo broker
+ * (`POST /api/cli/workspaces/{id}/repo-token`) and hands it to git, caching to a
+ * 0600 run-scoped file with an expiry-refresh buffer. It NEVER echoes the token
+ * and reads the bearer only from a run-scoped 0600 file (G3): the bearer is
+ * never baked into git config, the clone URL, or any long-lived file.
+ *
+ * Deliberately self-contained (no `orizu` package import) so it works even when
+ * the CLI-install step fails — the credential path must not depend on it. The
+ * script is emitted as CommonJS (`.cjs`) so it runs unchanged under both `node`
+ * (>=18, for global `fetch`) and `bun`, whichever the sandbox image ships.
+ *
+ * The boot context is split so no secret lands in a value git persists:
+ *   - `boot.json`  — non-secret config + the PATHS of the bearer/cache files;
+ *   - `<bearer>`   — the Orizu bearer, 0600, run-scoped, reaped at teardown;
+ *   - `<cache>`    — the minted repo token, 0600, written by the script itself.
+ * git config holds only `credential.helper = !<runtime> <script> <boot.json>`.
+ */
+
+export const HELPER_SCRIPT_BASENAME = 'orizu-git-credential-helper.cjs'
+export const BOOT_CONTEXT_BASENAME = 'boot.json'
+export const BEARER_BASENAME = 'bearer'
+export const REPO_CRED_CACHE_BASENAME = 'repo-cred.json'
+
+/** Refresh a cached token this long before its stated expiry (5 minutes). */
+export const DEFAULT_CACHE_REFRESH_BUFFER_MS = 5 * 60 * 1000
+
+/** Customer setup hook path, relative to the repo root (mirrors OpenInspect's
+ *  `.openinspect/setup.sh` — fresh-boot only, non-fatal, output captured). */
+export const SETUP_HOOK_RELATIVE_PATH = '.orizu/setup.sh'
+
+// -- Pre-baked runtime marker (ALI-1017) -------------------------------------
+
+/**
+ * Absolute path of the marker the pre-baked hosted-runtime image writes at build
+ * time (see packages/cli/hosted-runtime-image/Dockerfile). Its presence — plus
+ * the boot-context `prebaked` flag — tells the runtime the CLI + OpenCode are
+ * already on PATH, so the from-scratch install steps must be SKIPPED (they would
+ * otherwise fail under G5 default-deny egress).
+ */
+export const PREBAKED_MARKER_PATH = '/opt/orizu/prebaked.json'
+
+/**
+ * The schema of `/opt/orizu/prebaked.json`. Records the exact versions baked into
+ * the image so a run (and audit) can tell WHICH runtime it booted on. `builtFor`
+ * is a constant guard so a stray same-named file from another toolchain is not
+ * mistaken for our marker.
+ */
+export interface PrebakedMarker {
+  cliVersion: string
+  opencodeVersion: string
+  claudeSdkVersion: string
+  builtFor: 'vercel-sandbox'
+}
+
+/**
+ * Parse + validate a pre-baked marker file's contents. Returns the typed marker
+ * when the JSON is well-formed AND carries the expected `builtFor` guard with
+ * string version fields; returns null otherwise (missing file → caller passes an
+ * empty/whitespace string; malformed JSON; wrong shape). Never throws, so a
+ * belt-and-braces filesystem probe can call it on best-effort file reads.
+ */
+export function parsePrebakedMarker(raw: string): PrebakedMarker | null {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return null
+  }
+  if (!parsed || typeof parsed !== 'object') return null
+  const rec = parsed as Record<string, unknown>
+  if (rec.builtFor !== 'vercel-sandbox') return null
+  const { cliVersion, opencodeVersion, claudeSdkVersion } = rec
+  if (
+    typeof cliVersion !== 'string' ||
+    typeof opencodeVersion !== 'string' ||
+    typeof claudeSdkVersion !== 'string'
+  ) {
+    return null
+  }
+  return { cliVersion, opencodeVersion, claudeSdkVersion, builtFor: 'vercel-sandbox' }
+}
+
+/**
+ * The non-secret boot context the helper script reads. Paths are ABSOLUTE so
+ * the helper resolves them regardless of git's cwd at invocation time.
+ */
+export interface HostedBootContext {
+  apiBaseUrl: string
+  workspaceId: string
+  sessionId: string
+  runId: string
+  sessionBranch: string
+  repoFullName: string
+  /** VCS host the helper will serve credentials for (default github.com). */
+  host: string
+  /** Absolute path to the 0600 file holding the Orizu bearer. */
+  bearerFile: string
+  /** Absolute path to the 0600 minted-token cache the script maintains. */
+  cacheFile: string
+  /**
+   * Broker purpose vocabulary, INJECTABLE so a later slice can flip the whole
+   * script from write/read to session_write/session_read without editing it. The
+   * helper POSTs `primary` first and falls back to `fallback` ONLY on a 403
+   * (unauthorized-for-primary). A 400 is treated as vocabulary drift and fails
+   * loudly — it means the broker does not recognise the requested purpose.
+   */
+  tokenPurposes: { primary: string; fallback: string }
+  /**
+   * Hosts (lowercased) for which the helper may serve credentials over plain
+   * HTTP instead of HTTPS. Production leaves this UNSET → https-only. The
+   * local-sim rehearsal sets it to the loopback git server's host so the
+   * clone-through-helper path can be proven without TLS. Secure by default.
+   */
+  insecureHttpHosts?: readonly string[]
+  /** Refresh buffer in ms (overridable so tests can force a refresh). */
+  cacheBufferMs: number
+}
+
+export function serializeBootContext(ctx: HostedBootContext): string {
+  return `${JSON.stringify(ctx, null, 2)}\n`
+}
+
+/**
+ * The git credential-helper script, as a self-contained CommonJS source string.
+ * Implements the `get` action (mint/emit); `store`/`erase` are no-ops because
+ * the broker owns credential truth and the script never persists what git hands
+ * back. Diagnostics go to stderr only — stdout is reserved for git's protocol.
+ *
+ * NOTE: this is a rendered ARTIFACT, exercised end-to-end as a subprocess in
+ * `test/cli/hosted-credential-helper.test.ts`; that subprocess test is the
+ * source of truth for its behavior.
+ */
+export function renderCredentialHelperScript(): string {
+  return `'use strict'
+// Orizu in-sandbox git credential helper (ALI-925). Self-contained CommonJS.
+// Usage (git invokes it): node ${HELPER_SCRIPT_BASENAME} <boot.json> <get|store|erase>
+const fs = require('node:fs')
+
+function log(message) {
+  try { process.stderr.write('[orizu-cred] ' + message + '\\n') } catch (_) { /* ignore */ }
+}
+
+function readStdin() {
+  try { return fs.readFileSync(0, 'utf8') } catch (_) { return '' }
+}
+
+function parseProtocolInput(text) {
+  const out = {}
+  for (const raw of text.split('\\n')) {
+    const line = raw.replace(/\\r$/, '')
+    if (!line) continue
+    const eq = line.indexOf('=')
+    if (eq <= 0) continue
+    out[line.slice(0, eq)] = line.slice(eq + 1)
+  }
+  return out
+}
+
+function readCache(file, nowMs, bufferMs) {
+  let parsed
+  try { parsed = JSON.parse(fs.readFileSync(file, 'utf8')) } catch (_) { return null }
+  if (!parsed || typeof parsed !== 'object') return null
+  if (!parsed.username || !parsed.password) return null
+  if (typeof parsed.expiresAtMs !== 'number') return null
+  if (parsed.expiresAtMs - nowMs <= bufferMs) return null
+  return parsed
+}
+
+function writeCache(file, cred) {
+  try {
+    const fd = fs.openSync(file, 'w', 0o600)
+    try { fs.writeSync(fd, JSON.stringify(cred)) } finally { fs.closeSync(fd) }
+  } catch (e) { log('cache write failed: ' + (e && e.message)) }
+}
+
+async function requestToken(url, bearer, purpose, sessionId) {
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + bearer },
+    body: JSON.stringify({ purpose: purpose, sessionId: sessionId }),
+  })
+  if (res.ok) {
+    const data = await res.json()
+    if (!data || !data.token) throw new Error('broker returned no token')
+    const parsedExpiry = Date.parse(data.expiresAt)
+    const expiresAtMs = Number.isFinite(parsedExpiry) ? parsedExpiry : Date.now() + 60 * 60 * 1000
+    return { cred: { username: 'x-access-token', password: String(data.token), expiresAtMs: expiresAtMs }, status: res.status }
+  }
+  return { cred: null, status: res.status }
+}
+
+async function mint(ctx) {
+  const bearer = fs.readFileSync(ctx.bearerFile, 'utf8').trim()
+  if (!bearer) throw new Error('empty bearer file')
+  const base = String(ctx.apiBaseUrl || '').replace(/\\/$/, '')
+  const url = base + '/api/cli/workspaces/' + encodeURIComponent(ctx.workspaceId) + '/repo-token'
+  const purposes = ctx.tokenPurposes || {}
+  const primary = String(purposes.primary || 'write')
+  const fallback = String(purposes.fallback || 'read')
+
+  // Try the primary purpose first. A 403 means "unauthorized for this purpose"
+  // (e.g. a read-only caller asking to write) — the ONLY legitimate fallback
+  // trigger. A 400 means the broker does not recognise the purpose at all
+  // (vocabulary drift): fail loudly rather than silently downgrade.
+  const first = await requestToken(url, bearer, primary, ctx.sessionId)
+  if (first.cred) return first.cred
+  if (first.status === 400) {
+    throw new Error('broker rejected purpose "' + primary + '" as unknown (400) — vocabulary drift')
+  }
+  if (first.status !== 403) throw new Error('broker responded ' + first.status)
+
+  const second = await requestToken(url, bearer, fallback, ctx.sessionId)
+  if (second.cred) return second.cred
+  if (second.status === 400) {
+    throw new Error('broker rejected fallback purpose "' + fallback + '" as unknown (400) — vocabulary drift')
+  }
+  throw new Error('broker denied purposes "' + primary + '"/"' + fallback + '" (last status ' + second.status + ')')
+}
+
+async function main() {
+  const contextPath = process.argv[2]
+  const action = process.argv[3] || 'get'
+  // store/erase: nothing to persist — drain stdin so git sees no SIGPIPE.
+  if (action !== 'get') { readStdin(); return 0 }
+  if (!contextPath) { log('missing boot context path'); return 1 }
+
+  let ctx
+  try { ctx = JSON.parse(fs.readFileSync(contextPath, 'utf8')) } catch (e) {
+    log('unreadable boot context: ' + (e && e.message)); return 1
+  }
+  const input = parseProtocolInput(readStdin())
+
+  // Scope: https only (except explicitly allow-listed loopback hosts, used by the
+  // local-sim rehearsal), on the configured host. Empty response (exit 0) lets
+  // git fall through cleanly without emitting a token to the wrong remote.
+  const protocol = String(input.protocol || '').toLowerCase()
+  const host = String(input.host || '').toLowerCase()
+  const insecureHosts = Array.isArray(ctx.insecureHttpHosts)
+    ? ctx.insecureHttpHosts.map(function (h) { return String(h).toLowerCase() })
+    : []
+  const httpAllowed = protocol === 'http' && insecureHosts.indexOf(host) !== -1
+  if (protocol && protocol !== 'https' && !httpAllowed) { log('refusing non-https protocol'); return 0 }
+  const expectedHost = String(ctx.host || 'github.com').toLowerCase()
+  if (host && host !== expectedHost) { log('refusing host ' + host); return 0 }
+
+  const bufferMs = typeof ctx.cacheBufferMs === 'number' ? ctx.cacheBufferMs : ${DEFAULT_CACHE_REFRESH_BUFFER_MS}
+  let cred = readCache(ctx.cacheFile, Date.now(), bufferMs)
+  if (!cred) {
+    try { cred = await mint(ctx) } catch (e) { log('mint failed: ' + (e && e.message)); return 1 }
+    writeCache(ctx.cacheFile, cred)
+  }
+
+  for (const key of Object.keys(input)) {
+    if (key === 'username' || key === 'password') continue
+    process.stdout.write(key + '=' + input[key] + '\\n')
+  }
+  process.stdout.write('username=' + cred.username + '\\n')
+  process.stdout.write('password=' + cred.password + '\\n')
+  process.stdout.write('\\n')
+  return 0
+}
+
+main().then(code => process.exit(code)).catch(e => { log('fatal: ' + (e && e.message)); process.exit(1) })
+`
+}