polygram 0.38.7 → 0.39.0

package/scripts/build-codex-hook-bundle.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+'use strict';
+
+// Builds the single self-contained Codex hook bundle from the checked-in
+// sources. The build is a pure function of those sources, so `--check` is the
+// drift gate: a bundle that no longer regenerates is never installed.
+
+const { createHash } = require('node:crypto');
+const { readFileSync, writeFileSync } = require('node:fs');
+
+const {
+  HOOK_BUNDLE_PATH,
+  HOOK_BUNDLE_SOURCES,
+  buildHookBundle,
+} = require('../lib/codex/hook-bundle');
+
+const USAGE = 'usage: build-codex-hook-bundle [--check] [--out <path>]';
+
+function parseArgs(argv) {
+  const options = { check: false, out: HOOK_BUNDLE_PATH };
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === '--check') {
+      options.check = true;
+    } else if (argument === '--out') {
+      index += 1;
+      options.out = argv[index];
+      if (typeof options.out !== 'string' || options.out.length === 0) {
+        throw new Error(USAGE);
+      }
+    } else {
+      throw new Error(`${USAGE}\nunknown argument ${argument}`);
+    }
+  }
+  return options;
+}
+
+function main(argv) {
+  const options = parseArgs(argv);
+  const bundle = buildHookBundle();
+  const sha256 = createHash('sha256').update(bundle).digest('hex');
+
+  if (options.check) {
+    let current = null;
+    try {
+      current = readFileSync(options.out, 'utf8');
+    } catch {
+      process.stderr.write(`missing bundle at ${options.out}\n`);
+      return 1;
+    }
+    if (current !== bundle) {
+      process.stderr.write(
+        `bundle at ${options.out} is not what the sources build; `
+          + 'rebuild it in the same change as the sources\n',
+      );
+      return 1;
+    }
+    process.stdout.write(`ok ${sha256}\n`);
+    return 0;
+  }
+
+  writeFileSync(options.out, bundle, { mode: 0o644 });
+  process.stdout.write(
+    `${options.out}\nsources ${HOOK_BUNDLE_SOURCES.join(' ')}\nsha256 ${sha256}\n`,
+  );
+  return 0;
+}
+
+try {
+  process.exitCode = main(process.argv.slice(2));
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+}

package/scripts/codex-hook-artifacts.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+'use strict';
+
+// Operator entry point for the protected Codex hook artifact tree. It is run
+// by the account that owns the tree — never by the service account, which must
+// not be able to write anything it executes. The closure it installs comes
+// from the shipped build output; there is no way to hand it a body.
+
+const {
+  attestHookArtifactVersion,
+  installHookArtifactVersion,
+  listHookArtifactVersions,
+  quarantineHookArtifactVersion,
+} = require('../lib/codex/hook-artifacts');
+
+const USAGE = [
+  'usage: polygram-codex-hook-artifacts <command> [options]',
+  '',
+  '  install    --artifact-root <dir> --version <v> --runtime-root <dir>',
+  '             --runtime-id <id> --runtime-sha256 <hex>',
+  '             --operator-uid <uid> --service-uid <uid>',
+  '  attest     --artifact-root <dir> --version <v> --runtime-root <dir>',
+  '             --runtime-id <id> --runtime-sha256 <hex>',
+  '             --operator-uid <uid> --service-uid <uid>',
+  '  list       --artifact-root <dir>',
+  '  quarantine --artifact-root <dir> --version <v> --runtime-root <dir>',
+  '             --runtime-id <id> --runtime-sha256 <hex>',
+  '             --operator-uid <uid> --service-uid <uid> --referenced <v1,v2>',
+].join('\n');
+
+const FLAGS = new Map([
+  ['--artifact-root', 'artifactRoot'],
+  ['--version', 'version'],
+  ['--runtime-root', 'runtimeRoot'],
+  ['--runtime-id', 'runtimeId'],
+  ['--runtime-sha256', 'runtimeSha256'],
+  ['--operator-uid', 'operatorUid'],
+  ['--service-uid', 'serviceUid'],
+  ['--referenced', 'referenced'],
+]);
+
+function parseArgs(argv) {
+  const [command, ...rest] = argv;
+  if (!['install', 'attest', 'list', 'quarantine'].includes(command)) {
+    throw new Error(USAGE);
+  }
+  const options = { command };
+  for (let index = 0; index < rest.length; index += 2) {
+    const name = FLAGS.get(rest[index]);
+    const value = rest[index + 1];
+    if (!name || typeof value !== 'string') {
+      throw new Error(`${USAGE}\n\nunknown or incomplete option ${rest[index]}`);
+    }
+    options[name] = value;
+  }
+  return options;
+}
+
+function uid(value, flag) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    throw new Error(`${flag} must be the numeric uid of that account`);
+  }
+  return parsed;
+}
+
+function accounts(options) {
+  return {
+    operatorUid: uid(options.operatorUid, '--operator-uid'),
+    serviceUid: uid(options.serviceUid, '--service-uid'),
+  };
+}
+
+function run(options) {
+  switch (options.command) {
+    case 'install':
+      if (typeof options.runtimeSha256 !== 'string') {
+        throw new Error(
+          'pass --runtime-sha256 with the expected digest of the protected '
+            + 'runtime binary',
+        );
+      }
+      return installHookArtifactVersion({
+        artifactRoot: options.artifactRoot,
+        version: options.version,
+        runtimeRoot: options.runtimeRoot,
+        runtimeId: options.runtimeId,
+        expectedRuntimeSha256: options.runtimeSha256,
+        ...accounts(options),
+      });
+    case 'attest':
+      return attestHookArtifactVersion({
+        artifactRoot: options.artifactRoot,
+        version: options.version,
+        runtimeRoot: options.runtimeRoot,
+        runtimeId: options.runtimeId,
+        runtimeSha256: options.runtimeSha256,
+        ...accounts(options),
+      });
+    case 'list':
+      return listHookArtifactVersions({ artifactRoot: options.artifactRoot });
+    case 'quarantine':
+      if (typeof options.referenced !== 'string') {
+        throw new Error(
+          'pass --referenced with every version still referenced by a live '
+            + "session, or --referenced '' when none is",
+        );
+      }
+      return quarantineHookArtifactVersion({
+        artifactRoot: options.artifactRoot,
+        version: options.version,
+        runtimeRoot: options.runtimeRoot,
+        runtimeId: options.runtimeId,
+        runtimeSha256: options.runtimeSha256,
+        referencedVersions: options.referenced
+          .split(',')
+          .map((entry) => entry.trim())
+          .filter(Boolean),
+        ...accounts(options),
+      });
+    default:
+      throw new Error(USAGE);
+  }
+}
+
+try {
+  const result = run(parseArgs(process.argv.slice(2)));
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+} catch (error) {
+  process.stderr.write(
+    `${error.code ? `${error.code}: ` : ''}${error.message}\n${
+      error.action ? `${error.action}\n` : ''
+    }`,
+  );
+  process.exitCode = 1;
+}