orizu 0.4.1 → 0.5.0

package/src/egress-allowlist-cli.ts

@@ -0,0 +1,147 @@
+/**
+ * Per-team ADDITIVE egress allowlist CLI (ALI-1006 / G5):
+ *   orizu team egress-allowlist <team>                 # show extra domains
+ *   orizu team egress-allowlist <team> --add <domain>
+ *   orizu team egress-allowlist <team> --remove <domain>
+ *   orizu team egress-allowlist <team> --set a.com,b.com
+ *   orizu team egress-allowlist <team> --clear
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is code-owned and
+ * NOT shown/managed here — this surface only widens a team's egress with domains
+ * a customer workflow needs. Human ADMIN only: the server rejects agent bearers
+ * and non-admins (the definer RPC gates on is_team_admin). Pure command logic
+ * with an injected fetcher.
+ */
+
+import { authedFetch } from './http.js'
+
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>
+
+export interface EgressAllowlistCommandIo {
+  json: boolean
+  print: (line: string) => void
+  printErr?: (line: string) => void
+  fetcher?: CliFetcher
+}
+
+function fetcherFrom(io: EgressAllowlistCommandIo): CliFetcher {
+  return io.fetcher ?? authedFetch
+}
+
+function argValue(args: readonly string[], flag: string): string | null {
+  const index = args.indexOf(flag)
+  if (index === -1 || index + 1 >= args.length || args[index + 1].startsWith('--')) {
+    return null
+  }
+  return args[index + 1]
+}
+
+function firstPositional(args: readonly string[]): string | null {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]
+    if (arg.startsWith('--')) {
+      if (argValue(args, arg) !== null) i += 1
+      continue
+    }
+    return arg
+  }
+  return null
+}
+
+function printErr(io: EgressAllowlistCommandIo, message: string): void {
+  ;(io.printErr ?? io.print)(message)
+}
+
+async function responseMessage(response: Response): Promise<string> {
+  try {
+    const data = (await response.clone().json()) as Record<string, unknown>
+    const error = typeof data.error === 'string' ? data.error : null
+    return error || response.statusText || String(response.status)
+  } catch {
+    return response.statusText || String(response.status)
+  }
+}
+
+function splitDomains(value: string): string[] {
+  return value
+    .split(',')
+    .map(d => d.trim())
+    .filter(d => d.length > 0)
+}
+
+async function fetchCurrent(fetcher: CliFetcher, path: string): Promise<string[]> {
+  const response = await fetcher(path, { method: 'GET' })
+  if (!response.ok) {
+    throw new Error(`show failed (${response.status}): ${await responseMessage(response)}`)
+  }
+  const data = (await response.json()) as { extraDomains?: unknown }
+  return Array.isArray(data.extraDomains) ? data.extraDomains.filter((d): d is string => typeof d === 'string') : []
+}
+
+function emit(io: EgressAllowlistCommandIo, teamSlug: string, domains: string[]): void {
+  if (io.json) {
+    io.print(JSON.stringify({ teamSlug, extraDomains: domains }))
+    return
+  }
+  io.print(
+    domains.length === 0
+      ? `${teamSlug}: no additive egress domains (base allowlist only)`
+      : `${teamSlug} additive egress domains:\n  ${domains.join('\n  ')}`
+  )
+}
+
+export async function egressAllowlistCommand(args: string[], io: EgressAllowlistCommandIo): Promise<number> {
+  const teamSlug = firstPositional(args)
+  if (!teamSlug) {
+    printErr(io, 'Usage: orizu team egress-allowlist <team> [--add <domain>|--remove <domain>|--set a.com,b.com|--clear] [--json]')
+    return 1
+  }
+  const path = `/api/cli/teams/${encodeURIComponent(teamSlug)}/egress-allowlist`
+  const fetcher = fetcherFrom(io)
+
+  const setValue = argValue(args, '--set')
+  const addValue = argValue(args, '--add')
+  const removeValue = argValue(args, '--remove')
+  const clear = args.includes('--clear')
+  const isMutation = setValue !== null || addValue !== null || removeValue !== null || clear
+
+  try {
+    if (!isMutation) {
+      emit(io, teamSlug, await fetchCurrent(fetcher, path))
+      return 0
+    }
+
+    // Compute the next set. --set/--clear replace; --add/--remove mutate current.
+    let next: string[]
+    if (setValue !== null) {
+      next = splitDomains(setValue)
+    } else if (clear) {
+      next = []
+    } else {
+      const current = await fetchCurrent(fetcher, path)
+      const set = new Set(current)
+      if (addValue) for (const d of splitDomains(addValue)) set.add(d)
+      if (removeValue) for (const d of splitDomains(removeValue)) set.delete(d)
+      next = [...set]
+    }
+
+    const response = await fetcher(path, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ domains: next }),
+    })
+    if (!response.ok) {
+      printErr(io, `egress-allowlist update failed (${response.status}): ${await responseMessage(response)}`)
+      return 1
+    }
+    const data = (await response.json()) as { extraDomains?: unknown }
+    const stored = Array.isArray(data.extraDomains)
+      ? data.extraDomains.filter((d): d is string => typeof d === 'string')
+      : next
+    emit(io, teamSlug, stored)
+    return 0
+  } catch (error) {
+    printErr(io, error instanceof Error ? error.message : String(error))
+    return 1
+  }
+}

package/src/egress-policy.ts

@@ -0,0 +1,188 @@
+/**
+ * G5 — sandbox egress policy builder (ALI-1006, per the hosted-agent threat
+ * model T1). Owns the ALLOWLIST CONTENT the `SandboxProvider` seam plumbs to the
+ * sandbox firewall at create (`packages/cli/src/vercel-sandbox-provider.ts` →
+ * Vercel `networkPolicy`). The Vercel adapter is a pass-through; this file is
+ * where "default-deny with a per-team allowlist (Orizu API, model providers, git
+ * host); blocked attempts logged" is actually decided.
+ *
+ * The policy is DEFAULT-DENY: the record form `{ allow: { host: rules } }` denies
+ * everything NOT explicitly listed, so the correctness invariant is simply that
+ * we NEVER emit a `"*"` allow entry (which would re-open the sandbox). The
+ * model-key credential broker (G3 / `buildModelKeyBrokerPolicy`) is COMPOSED onto
+ * the model host's rule here so brokering + allowlisting are ONE coherent policy,
+ * not two policies that could disagree.
+ *
+ * SNI matching (verified against @vercel/sandbox@1.10.2 `NetworkPolicy`): an
+ * allow entry matches the exact SNI host; a LEADING-wildcard entry (`*.orizu.ai`)
+ * matches any single-or-multi-label subdomain but NOT the apex — so a host that
+ * must serve BOTH apex and subdomains is listed twice (`orizu.ai` +
+ * `*.orizu.ai`). Domains are hostnames only — never a protocol, path, or port.
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is CODE-OWNED and
+ * non-negotiable: `buildEgressPolicy` always includes it and per-team config can
+ * only ADD to it, never remove a base host. See
+ * docs/requirements/hosted-customer-workbench/sandbox-egress-policy.md for the
+ * rationale per host and the honest statement of what Vercel enforces (firewall,
+ * SNI-level) vs. what we generate (blocked-attempt evidence via the canary).
+ */
+
+import type { SandboxEgressPolicy, SandboxEgressRule } from './sandbox-provider.js'
+
+/** Default model-provider endpoint (Anthropic) the broker injects a key for. */
+export const ANTHROPIC_API_HOST = 'api.anthropic.com'
+/** Anthropic authenticates with `x-api-key` (not a Bearer Authorization). */
+export const ANTHROPIC_API_KEY_HEADER = 'x-api-key'
+
+/** GitHub git-over-HTTPS SNIs. `git clone`/`git push` over the smart HTTP
+ *  protocol connect to `github.com`; `codeload.github.com` serves repository
+ *  archive/tarball fetches (release assets, `pip`/`go` github-archive installs).
+ *  Both are allowed so the agent's git work AND any archive fetch its workflow
+ *  triggers succeed — everything else on github's infra stays denied. */
+export const GIT_HOST_DOMAINS = ['github.com', 'codeload.github.com'] as const
+
+/** Default host the startup canary probes to PROVE the policy is live (a known
+ *  non-allowlisted host: reaching it means egress is NOT enforced). */
+export const DEFAULT_EGRESS_CANARY_HOST = 'example.com'
+
+/** Default Orizu control-plane base when none is configured. */
+const DEFAULT_ORIZU_BASE_URL = 'https://orizu.ai'
+
+/**
+ * Resolve the Orizu control-plane host from a base URL and CONSERVATIVELY
+ * wildcard its registrable base domain so the policy survives the API moving to
+ * a subdomain (e.g. `api.orizu.ai`) without re-opening egress. Returns the apex
+ * PLUS a leading-wildcard for its subdomains: `orizu.ai` + `*.orizu.ai`. A
+ * loopback/localhost base (rehearsal) yields just the bare host (no wildcard —
+ * there is nothing to broaden and the firewall does not enforce it anyway).
+ */
+export function orizuEgressDomains(baseUrl: string | undefined): string[] {
+  const raw = (baseUrl ?? process.env.ORIZU_BASE_URL ?? DEFAULT_ORIZU_BASE_URL).trim()
+  let host: string
+  try {
+    host = new URL(raw).hostname.toLowerCase()
+  } catch {
+    // Not a URL — treat the value as a bare host (strip any stray path/port).
+    host = raw.replace(/^[a-z]+:\/\//i, '').split('/')[0].split(':')[0].toLowerCase()
+  }
+  if (!host) return [DEFAULT_ORIZU_BASE_URL.replace('https://', '')]
+  // Loopback / single-label hosts: no base-domain to wildcard.
+  if (host === 'localhost' || host === '127.0.0.1' || !host.includes('.')) {
+    return [host]
+  }
+  const labels = host.split('.')
+  // Registrable base = last two labels (orizu.ai from api.orizu.ai). Good enough
+  // for our single first-party domain; a multi-part TLD would over-broaden, but
+  // the base host is always our own domain so this is a controlled input.
+  const baseDomain = labels.slice(-2).join('.')
+  const domains = new Set<string>([baseDomain, `*.${baseDomain}`])
+  // Also allow the exact configured host if it is a deeper subdomain than the
+  // wildcard's single-level match would guarantee (belt-and-braces).
+  domains.add(host)
+  return [...domains]
+}
+
+/**
+ * Normalize a per-team extra domain to a bare hostname (or leading-wildcard).
+ * Strips protocol/path/port, lowercases, and validates the SNI shape. Returns
+ * null for anything that is not a plausible hostname so a bad config entry is
+ * dropped rather than silently widening the policy in an unexpected way.
+ */
+export function normalizeEgressDomain(input: string): string | null {
+  let value = input.trim().toLowerCase()
+  if (!value) return null
+  value = value.replace(/^[a-z]+:\/\//i, '') // strip scheme
+  value = value.split('/')[0] // strip path
+  value = value.split(':')[0] // strip port
+  if (!value) return null
+  // A leading `*.` wildcard is allowed; validate the remainder as a hostname.
+  const hostPart = value.startsWith('*.') ? value.slice(2) : value
+  // Labels: alphanumeric + hyphen, dot-separated, at least one dot (reject bare
+  // single labels and anything with illegal characters, spaces, or `*` mid-host).
+  if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(hostPart)) {
+    return null
+  }
+  return value
+}
+
+export interface EgressModelKeyBroker {
+  /** The raw model API key. It lives ONLY in the policy the host sends to the
+   *  firewall control plane; it never enters the sandbox env/disk/run events. */
+  apiKey: string
+  /** Domain to inject the key for (default api.anthropic.com). */
+  host?: string
+  /** Header the endpoint authenticates with (default x-api-key). */
+  headerName?: string
+}
+
+export interface BuildEgressPolicyOptions {
+  /** Orizu control-plane base URL (default env ORIZU_BASE_URL / orizu.ai). */
+  orizuBaseUrl?: string
+  /** Additional model-provider hosts to allow WITHOUT a key transform. The broker
+   *  host (below) is added automatically; list only extra providers here. */
+  modelHosts?: readonly string[]
+  /** Compose the G3 model-key broker transform onto its host's allow rule, so
+   *  brokering and the allowlist are one policy. */
+  modelKeyBroker?: EgressModelKeyBroker
+  /** Per-team ADDITIVE domains (a customer's own API a workflow needs). Base
+   *  hosts can never be removed; these only widen. Invalid entries are dropped. */
+  extraDomains?: readonly string[]
+}
+
+/**
+ * Compute the ordered list of BASE (code-owned, non-removable) allow domains for
+ * an Orizu base URL: the Orizu control-plane host(s), the model provider host,
+ * and the git host(s). Exported so tests and the policy doc assert the exact set.
+ */
+export function baseEgressDomains(opts: { orizuBaseUrl?: string; modelHost?: string; modelHosts?: readonly string[] } = {}): string[] {
+  const domains = new Set<string>()
+  for (const d of orizuEgressDomains(opts.orizuBaseUrl)) domains.add(d)
+  domains.add(opts.modelHost ?? ANTHROPIC_API_HOST)
+  for (const d of opts.modelHosts ?? []) {
+    const n = normalizeEgressDomain(d)
+    if (n) domains.add(n)
+  }
+  for (const d of GIT_HOST_DOMAINS) domains.add(d)
+  return [...domains]
+}
+
+/**
+ * Build a DEFAULT-DENY Vercel network policy whose allowlist is exactly the base
+ * hosts (Orizu API + model provider + git) plus any valid per-team extra domains,
+ * with the model-key broker transform COMPOSED onto the model host's rule.
+ *
+ * Correctness invariants (unit-tested):
+ *   - record form → default-deny (no `"*"` key is EVER emitted);
+ *   - every base host is present;
+ *   - the broker transform sits on the model host's rule (one coherent policy);
+ *   - base hosts survive regardless of `extraDomains` (cannot be removed).
+ */
+export function buildEgressPolicy(opts: BuildEgressPolicyOptions = {}): SandboxEgressPolicy {
+  const brokerHost = opts.modelKeyBroker?.host ?? ANTHROPIC_API_HOST
+  const base = baseEgressDomains({
+    orizuBaseUrl: opts.orizuBaseUrl,
+    modelHost: brokerHost,
+    modelHosts: opts.modelHosts,
+  })
+
+  const allow: Record<string, SandboxEgressRule[]> = {}
+  for (const domain of base) allow[domain] = []
+
+  // Additive per-team domains: normalized + de-duped; NEVER able to unset a base
+  // host (base was inserted first; a repeat just re-sets the same empty rule).
+  for (const raw of opts.extraDomains ?? []) {
+    const domain = normalizeEgressDomain(raw)
+    if (domain) allow[domain] = allow[domain] ?? []
+  }
+
+  // Compose the broker transform onto the model host's rule (G3 + G5 as one
+  // policy). The raw key stays host-side in this object; it is never written into
+  // the sandbox — OpenCode is given a non-secret dummy key and the proxy overrides
+  // the real header on matching egress.
+  if (opts.modelKeyBroker) {
+    const headerName = opts.modelKeyBroker.headerName ?? ANTHROPIC_API_KEY_HEADER
+    allow[brokerHost] = [{ transform: [{ headers: { [headerName]: opts.modelKeyBroker.apiKey } }] }]
+  }
+
+  return { allow }
+}

package/src/git-credential.ts

@@ -0,0 +1,155 @@
+/**
+ * Git credential helper (ALI-971 / WS-D).
+ *
+ * Implements git's credential-helper protocol on stdin/stdout so teammates can
+ * `git pull`/`git push` the hosted workbench repo with NO GitHub identity: git
+ * asks this helper for a credential, we broker a short-lived, downscoped
+ * installation token from Orizu and hand it back as `x-access-token:<token>`.
+ * The token is never written to disk (60-min TTL is the backstop).
+ *
+ * Protocol: git runs `orizu git-credential <op>` where op is get|store|erase
+ * and feeds `key=value` lines on stdin terminated by a blank line. Only `get`
+ * does work; `store`/`erase` are no-ops. For `get` we respond only when the
+ * host is github.com AND the cwd resolves to an attached Orizu workspace —
+ * otherwise we stay silent so git falls through to its normal handling.
+ *
+ * Purpose selection: git does not tell us read-vs-write intent, so we mint
+ * `write` first (the common push case for curators) and fall back to `read` on
+ * a 403 (plain members). Pure logic + injected fetcher/io: index.ts stays thin.
+ */
+
+import { existsSync } from 'fs'
+import { dirname, join } from 'path'
+
+import { authedFetch } from './http.js'
+import { readJsonManifest } from './workspace.js'
+
+export type GitCredentialFetcher = (path: string, init?: RequestInit) => Promise<Response>
+
+export interface GitCredentialIo {
+  stdin: string
+  cwd: string
+  print: (line: string) => void
+  printErr: (line: string) => void
+  fetcher?: GitCredentialFetcher
+  /** Explicit workspace id (tests / clone-time). Overrides env + cwd lookup. */
+  workspaceId?: string
+}
+
+const GITHUB_HOST = 'github.com'
+
+export function parseCredentialInput(stdin: string): Record<string, string> {
+  const map: Record<string, string> = {}
+  for (const rawLine of stdin.split('\n')) {
+    const line = rawLine.replace(/\r$/, '')
+    if (!line) continue
+    const eq = line.indexOf('=')
+    if (eq <= 0) continue
+    map[line.slice(0, eq)] = line.slice(eq + 1)
+  }
+  return map
+}
+
+/**
+ * Walk up from `cwd` to the workspace root (the dir holding orizu.team.json) and
+ * return its bound workspace id, or null if this is not an attached workspace.
+ */
+export function resolveAttachedWorkspaceId(cwd: string): string | null {
+  let dir = cwd
+  for (;;) {
+    const manifestPath = join(dir, 'orizu.team.json')
+    if (existsSync(manifestPath)) {
+      const manifest = readJsonManifest(manifestPath)
+      const canonical = manifest?.canonical
+      const serviceId =
+        canonical && typeof canonical === 'object' && !Array.isArray(canonical)
+          ? (canonical as Record<string, unknown>).serviceId
+          : null
+      if (typeof serviceId === 'string' && serviceId) return serviceId
+      const setup = manifest?.setup
+      const attached =
+        setup && typeof setup === 'object' && !Array.isArray(setup)
+          ? (setup as Record<string, unknown>).attachedWorkspaceId
+          : null
+      return typeof attached === 'string' && attached ? attached : null
+    }
+    const parent = dirname(dir)
+    if (parent === dir) return null
+    dir = parent
+  }
+}
+
+/**
+ * Resolve the workspace id, preferring an explicit override, then the
+ * `ORIZU_WORKSPACE_ID` env var (set during `git clone` so the helper works
+ * before the working tree — and thus orizu.team.json — exists), then the cwd
+ * manifest walk for steady-state pull/push.
+ */
+export function resolveWorkspaceId(io: GitCredentialIo): string | null {
+  if (io.workspaceId) return io.workspaceId
+  const fromEnv = process.env.ORIZU_WORKSPACE_ID?.trim()
+  if (fromEnv) return fromEnv
+  return resolveAttachedWorkspaceId(io.cwd)
+}
+
+async function mintToken(
+  fetcher: GitCredentialFetcher,
+  workspaceId: string,
+  purpose: 'read' | 'write'
+): Promise<{ ok: true; token: string } | { ok: false; status: number; error: string }> {
+  const response = await fetcher(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ purpose }),
+  })
+  if (response.ok) {
+    const data = (await response.json()) as { token?: string }
+    if (data.token) return { ok: true, token: data.token }
+    return { ok: false, status: response.status, error: 'Broker returned no token' }
+  }
+  let error = `status ${response.status}`
+  try {
+    const body = (await response.json()) as { error?: string }
+    if (body.error) error = body.error
+  } catch {
+    // Non-JSON body; keep the status-based message.
+  }
+  return { ok: false, status: response.status, error }
+}
+
+export async function runGitCredential(op: string, io: GitCredentialIo): Promise<number> {
+  // store/erase are no-ops: we never persist a credential to disk.
+  if (op !== 'get') return 0
+
+  const input = parseCredentialInput(io.stdin)
+
+  // Only broker for github.com; anything else is git's own business.
+  if (input.host && input.host !== GITHUB_HOST) return 0
+
+  const workspaceId = resolveWorkspaceId(io)
+  if (!workspaceId) {
+    // Unattached directory: stay silent so git falls through cleanly.
+    return 0
+  }
+
+  const fetcher = io.fetcher ?? authedFetch
+
+  // Mint write first (curators/pushers), fall back to read on 403 (members).
+  let minted = await mintToken(fetcher, workspaceId, 'write')
+  if (!minted.ok && minted.status === 403) {
+    minted = await mintToken(fetcher, workspaceId, 'read')
+  }
+
+  if (!minted.ok) {
+    io.printErr(
+      `orizu git-credential: could not broker a token for this workspace (${minted.error}). ` +
+        'Ensure you are logged in (`orizu login`) and a team admin/curator has provisioned the repo.'
+    )
+    return 0
+  }
+
+  io.print('username=x-access-token')
+  io.print(`password=${minted.token}`)
+  io.print('')
+  return 0
+}