runcloud 0.2.189 → 0.2.191

package/dist/commands/dogfood.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { promisify } from 'node:util';
-import { ApiClient, friendlyApiError } from '../api.js';
+import { ApiClient, ApiError, friendlyApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
 const execFileAsync = promisify(execFile);
 export const DOGFOOD_SECRET_GROUP = 'newly-dogfood';
@@ -171,26 +171,57 @@ async function projectOrgId(client, projectId) {
 }
 export async function pushDogfoodCreds(client, projectId, entries) {
     const orgId = await projectOrgId(client, projectId);
-    await client.put(`/orgs/${encodeURIComponent(orgId)}/secret-groups/${DOGFOOD_SECRET_GROUP}`, {
-        entries,
-        exposeToSandbox: true,
-        force: true,
-    });
+    const path = `/orgs/${encodeURIComponent(orgId)}/secret-groups/${DOGFOOD_SECRET_GROUP}`;
+    if (Object.keys(entries).length === 0) {
+        try {
+            await client.delete(path);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError && err.status === 404))
+                throw err;
+        }
+        return;
+    }
+    await client.put(path, { entries, exposeToSandbox: true, force: true });
+}
+export async function fetchServerCredentials(client) {
+    try {
+        const status = await client.get('/dogfood');
+        const provided = status?.serverCredentials;
+        return { github: provided?.github === true, gcp: provided?.gcp === true };
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404)
+            return { github: false, gcp: false };
+        throw err;
+    }
+}
+export function credentialsToSupply(server, opts) {
+    return { github: Boolean(opts.githubTokenFile) || !server.github, gcp: opts.gcp && !server.gcp };
 }
 async function credsOnce(opts) {
     const { client, apiUrl } = api();
     const projectId = projectIdFrom(opts.project, apiUrl);
+    const supply = credentialsToSupply(await fetchServerCredentials(client), opts);
+    if (!supply.github && !supply.gcp) {
+        await pushDogfoodCreds(client, projectId, {});
+        console.log(`${apiUrl} mints the sessions' GitHub and GCP tokens itself; cleared any stored ones.`);
+        return false;
+    }
     const entries = {};
-    const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
-    entries.GH_TOKEN = github.token;
-    if (github.source === 'gh-cli') {
-        console.log('GitHub: using your gh CLI token (all of its scopes). A fine-grained token is safer: --github-token-file.');
+    if (supply.github) {
+        const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+        entries.GH_TOKEN = github.token;
+        if (github.source === 'gh-cli') {
+            console.log('GitHub: using your gh CLI token (all of its scopes). A fine-grained token is safer: --github-token-file.');
+        }
     }
-    if (opts.gcp)
+    if (supply.gcp)
         entries.GOOGLE_OAUTH_ACCESS_TOKEN = await mintDogfoodGcpToken();
     await pushDogfoodCreds(client, projectId, entries);
     console.log(`${new Date().toISOString()} credentials pushed to project ${projectId}: ${Object.keys(entries).join(', ')}` +
-        (opts.gcp ? ' (GCP token valid ~1h)' : ''));
+        (supply.gcp ? ' (GCP token valid ~1h)' : ''));
+    return supply.gcp;
 }
 export function dogfoodSessionBody(opts) {
     const body = {
@@ -341,25 +372,40 @@ export function registerDogfood(program) {
         .action((opts) => run(async () => {
         const { client, apiUrl } = api();
         console.log(`control plane: ${apiUrl}`);
-        console.log('1/4 GCP: minting a dogfood-agent token by impersonation...');
-        const gcpToken = await mintDogfoodGcpToken();
-        console.log('    ok');
-        console.log('2/4 SOPS: dev must decrypt, prod must be refused...');
-        const root = await repoRoot();
-        if (root) {
-            const result = await verifySopsBoundary(root, gcpToken);
-            console.log(result.detail.replace(/^/gm, '    '));
-            if (!result.prodRefused)
-                throw new Error('the dogfood token can decrypt prod — stop and report this');
-            if (!result.dev)
-                throw new Error('the dogfood token cannot decrypt dev; see the error above');
+        const supply = credentialsToSupply(await fetchServerCredentials(client), { githubTokenFile: opts.githubTokenFile, gcp: true });
+        const entries = {};
+        if (supply.gcp) {
+            console.log('1/4 GCP: minting a dogfood-agent token by impersonation...');
+            const gcpToken = await mintDogfoodGcpToken();
+            entries.GOOGLE_OAUTH_ACCESS_TOKEN = gcpToken;
+            console.log('    ok');
+            console.log('2/4 SOPS: dev must decrypt, prod must be refused...');
+            const root = await repoRoot();
+            if (root) {
+                const result = await verifySopsBoundary(root, gcpToken);
+                console.log(result.detail.replace(/^/gm, '    '));
+                if (!result.prodRefused)
+                    throw new Error('the dogfood token can decrypt prod — stop and report this');
+                if (!result.dev)
+                    throw new Error('the dogfood token cannot decrypt dev; see the error above');
+            }
+            else {
+                console.log('    skipped: run setup from a monorepo checkout to verify (needs secrets/*.yaml and sops >= 3.10)');
+            }
         }
         else {
-            console.log('    skipped: run setup from a monorepo checkout to verify (needs secrets/*.yaml and sops >= 3.10)');
+            console.log("1/4 GCP: the control plane mints the dogfood agent's token itself (dev sops key only)");
+            console.log("2/4 SOPS: nothing to prove from here; the agent account's IAM is the boundary");
+        }
+        if (supply.github) {
+            console.log('3/4 GitHub: reading a token...');
+            const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+            entries.GH_TOKEN = github.token;
+            console.log(`    ok (${github.source})`);
+        }
+        else {
+            console.log('3/4 GitHub: the control plane gives sessions a Newly GitHub App token (the dogfood repo only)');
         }
-        console.log('3/4 GitHub: reading a token...');
-        const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
-        console.log(`    ok (${github.source})`);
         console.log('4/4 Project...');
         let projectId = opts.project ?? (readState()?.apiUrl === apiUrl ? readState()?.projectId : undefined);
         if (!projectId) {
@@ -377,10 +423,17 @@ export function registerDogfood(program) {
             console.log(`    using ${projectId}`);
         }
         writeState({ projectId, apiUrl });
-        await pushDogfoodCreds(client, projectId, { GH_TOKEN: github.token, GOOGLE_OAUTH_ACCESS_TOKEN: gcpToken });
-        console.log('    credentials stored as the project\'s "newly-dogfood" secret group (dogfood sessions only)');
-        console.log('\nNext: `newly dogfood creds --watch` in a spare terminal (keeps the GCP token fresh),');
-        console.log('then `newly dogfood start "<what to do>"`.');
+        await pushDogfoodCreds(client, projectId, entries);
+        console.log(Object.keys(entries).length > 0
+            ? '    credentials stored as the project\'s "newly-dogfood" secret group (dogfood sessions only)'
+            : '    no credentials stored: the control plane supplies them (any earlier ones were removed)');
+        if (supply.gcp) {
+            console.log('\nNext: `newly dogfood creds --watch` in a spare terminal (keeps the GCP token fresh),');
+            console.log('then `newly dogfood start "<what to do>"`.');
+        }
+        else {
+            console.log('\nNext: `newly dogfood start "<what to do>"`.');
+        }
     }));
     dogfood
         .command('creds')
@@ -390,8 +443,8 @@ export function registerDogfood(program) {
         .option('--no-gcp', 'do not mint a GCP token (sessions then cannot use sops)')
         .option('--watch', `keep refreshing every ${CREDS_REFRESH_MS / 60_000} minutes`, false)
         .action((opts) => run(async () => {
-        await credsOnce(opts);
-        if (!opts.watch)
+        const mintedGcp = await credsOnce(opts);
+        if (!opts.watch || !mintedGcp)
             return;
         for (;;) {
             await new Promise((resolve) => setTimeout(resolve, CREDS_REFRESH_MS));

package/dist/commands/run-cloud-fleet-release-control.js

@@ -0,0 +1,24 @@
+import { readFileSync, statSync } from 'node:fs';
+const path = '/run-cloud/admin/fleet-release-control';
+export function releaseControlRequest(file) {
+    const stat = statSync(file);
+    if (!stat.isFile() || stat.size > 512 * 1024)
+        throw new Error('Use a JSON request file smaller than 512 KiB');
+    const value = JSON.parse(readFileSync(file, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value) || typeof value.reason !== 'string' || !value.reason.trim()
+        || !Number.isSafeInteger(value.expectedRevision) || Number(value.expectedRevision) < 0
+        || !['bootstrap', 'enroll', 'announce', 'override', 'pause', 'resume', 'rollback', 'defer'].includes(String(value.action))) {
+        throw new Error('Request needs action, reason and expectedRevision from the current release-control status');
+    }
+    return value;
+}
+export function registerFleetReleaseControlCommands(fleet, client, action) {
+    const release = fleet.command('release-control').description('Audited fleet targets and coordinated health-gated serve-sim rollouts');
+    release.command('status').description('Read targets, rollout stages, gate values and audit history').action(() => action(async () => {
+        console.log(JSON.stringify(await client().get(path, { signal: AbortSignal.timeout(30000) }), null, 2));
+    }));
+    release.command('apply <request.json>').description('Apply an audited target or rollout request; pause stops new grants while existing holders finish safely')
+        .action((file) => action(async () => {
+        console.log(JSON.stringify(await client().post(path, releaseControlRequest(file), { signal: AbortSignal.timeout(30000) }), null, 2));
+    }));
+}

package/dist/commands/run-cloud-fleet.js

@@ -5,6 +5,7 @@ import { ApiClient, ApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
 import { surveyFleet, surveyText } from './run-cloud-fleet-survey.js';
 import { listReleaseChannels, promoteReleaseChannel, releaseText } from './run-cloud-fleet-releases.js';
+import { registerFleetReleaseControlCommands } from './run-cloud-fleet-release-control.js';
 const ROOT = '/run-cloud/admin/simulators';
 const RANGES = ['1h', '6h', '24h', '7d', '30d', '90d', '1y', '2y'];
 export const ACCESSIBILITY_CODES = ['accessibility_device_unavailable', 'accessibility_capture_failed'];
@@ -303,6 +304,7 @@ function printReport(report, json) {
 }
 export function registerRunCloudFleet(program) {
     const fleet = program.command('fleet').description('Admin fleet telemetry, diagnosis, events, failure evidence and serve-sim release channels');
+    registerFleetReleaseControlCommands(fleet, credentialsClient, action);
     fleet.command('survey [hostId]').description('Survey all fleet signals in seconds; authenticated admin reads, no local services')
         .option('--json', 'Structured metrics, diagnosis, observations and coverage')
         .option('--range <range>', 'Alert/input-lag window: 1h, 6h, 24h, 7d', '24h')

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.189';
+export const CLI_VERSION = '0.2.191';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.189",
+  "version": "0.2.191",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [