totemlayer 0.1.6 → 0.1.12

package/bin/mission-infrastructure.mjs

@@ -0,0 +1,609 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { readdir, rename, rm, writeFile } from "node:fs/promises";
+import { join, extname } from "node:path";
+import { promisify } from "node:util";
+import {
+  assertMissionAgentSession,
+  ensurePrivateRuntimeDirectory,
+  readPrivateRuntimeJson,
+} from "./mission-agent-session.mjs";
+import { inspectLocalRepository } from "./repository.mjs";
+
+const execute = promisify(execFile);
+const sha = (value) => createHash("sha256").update(value).digest("hex");
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i;
+const SHA = /^[a-f0-9]{64}$/;
+const KINDS = new Set(["infrastructure_deploy", "infrastructure_verify"]);
+const LIMIT = 20 * 1024 * 1024;
+const MIME = {
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "text/javascript",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+};
+
+async function save(path, value) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function load(path, max = 2 * 1024 * 1024) {
+  return readPrivateRuntimeJson(path, max).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+}
+
+/** Read committed blobs directly: no checkout hooks, builds, dependency installs, or untracked secrets. */
+export async function packageStaticApp(repositoryRoot, commit, sourceDirectory, signal) {
+  if (
+    !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(commit) ||
+    !/^[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*$/.test(sourceDirectory)
+  )
+    throw new Error("Provide a pinned commit and a relative static app directory.");
+  const git = async (args, maxBuffer = LIMIT) =>
+    (
+      await execute("git", ["-C", repositoryRoot, ...args], {
+        encoding: "buffer",
+        maxBuffer,
+        timeout: 30_000,
+        signal,
+        env: { ...process.env, GIT_CONFIG_NOSYSTEM: "1", GIT_TERMINAL_PROMPT: "0" },
+      })
+    ).stdout;
+  const tree = await git(["ls-tree", "-rz", commit, "--", `${sourceDirectory}/`]);
+  const files = [];
+  let total = 0;
+  for (const entry of tree.toString("utf8").split("\0").filter(Boolean)) {
+    const match = /^(\d+) blob ([a-f0-9]+)\t(.+)$/.exec(entry);
+    if (!match || !["100644", "100755"].includes(match[1]))
+      throw new Error("Static apps cannot contain symbolic links or submodules.");
+    const path = match[3].slice(sourceDirectory.length + 1);
+    if (
+      !path ||
+      path
+        .split("/")
+        .some(
+          (part) =>
+            !part || part.startsWith(".") || /^(?:node_modules|credentials|secrets)$/i.test(part),
+        ) ||
+      /(?:\.pem|\.key|\.p12|\.pfx|\.map)$/i.test(path) ||
+      !MIME[extname(path).toLowerCase()]
+    )
+      throw new Error(`Unsupported or private static app file: ${path}`);
+    const bytes = await git(["cat-file", "blob", match[2]]);
+    total += bytes.length;
+    if (total > LIMIT || files.length >= 1000)
+      throw new Error("The local static bundle limit is 20 MiB and 1000 files.");
+    files.push({ path, sha256: sha(bytes), content: bytes.toString("base64") });
+  }
+  files.sort((a, b) => a.path.localeCompare(b.path, "en"));
+  const index = files.find((file) => file.path === "index.html");
+  if (!index) throw new Error("The static app directory needs a committed index.html.");
+  return {
+    commit,
+    sourceDirectory,
+    files,
+    indexSha256: index.sha256,
+    bundleSha256: sha(JSON.stringify(files.map(({ path, sha256 }) => ({ path, sha256 })))),
+  };
+}
+
+export async function checkStaticRelease(url, intent, signal) {
+  const parsed = new URL(url);
+  if (
+    parsed.protocol !== "http:" ||
+    parsed.hostname !== "127.0.0.1" ||
+    !parsed.port ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    parsed.pathname !== `/releases/${intent.bundleSha256}/`
+  )
+    throw new Error("Only the exact loopback release URL can be verified.");
+  const response = await fetch(url, {
+    redirect: "error",
+    signal: signal
+      ? AbortSignal.any([signal, AbortSignal.timeout(5000)])
+      : AbortSignal.timeout(5000),
+  });
+  if (response.status !== 200)
+    throw new Error(`Local app health check returned ${response.status}.`);
+  let size = 0;
+  const hash = createHash("sha256");
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > LIMIT) throw new Error("The local health response exceeds the bundle limit.");
+    hash.update(chunk);
+  }
+  const observedIndexSha256 = hash.digest("hex");
+  if (observedIndexSha256 !== intent.indexSha256)
+    throw new Error("The deployed response does not match the approved bundle.");
+  return { healthStatus: 200, observedIndexSha256, checkedAt: new Date().toISOString() };
+}
+
+/** The connected agent owns this isolated origin; releases survive restart, availability follows its lifetime. */
+export async function createLocalStaticProvider({ directory, port = 0 }) {
+  await ensurePrivateRuntimeDirectory(directory);
+  const releases = join(directory, "releases");
+  const operations = join(directory, "operations");
+  const prepared = join(directory, "prepared");
+  await ensurePrivateRuntimeDirectory(prepared);
+  await ensurePrivateRuntimeDirectory(releases);
+  await ensurePrivateRuntimeDirectory(operations);
+  const saved = await load(join(directory, "server.json"));
+  const selectedPort = saved?.port ?? port;
+  if (!Number.isInteger(selectedPort) || selectedPort < 0 || selectedPort > 65535)
+    throw new Error("The saved preview port needs inspection.");
+  const server = createServer(async (request, response) => {
+    try {
+      if (!["GET", "HEAD"].includes(request.method)) {
+        response.writeHead(405).end();
+        return;
+      }
+      const path = new URL(request.url, "http://127.0.0.1").pathname;
+      const match = /^\/releases\/([a-f0-9]{64})\/(.*)$/.exec(path);
+      if (!match) {
+        response.writeHead(404).end();
+        return;
+      }
+      const bundle = await load(join(releases, `${match[1]}.json`), LIMIT * 2);
+      const filePath = decodeURIComponent(match[2] || "index.html");
+      const file = bundle?.files?.find((entry) => entry.path === filePath);
+      if (!file || !MIME[extname(filePath).toLowerCase()]) {
+        response.writeHead(404).end();
+        return;
+      }
+      const bytes = Buffer.from(file.content, "base64");
+      response.writeHead(200, {
+        "content-type": MIME[extname(filePath).toLowerCase()],
+        "content-length": bytes.length,
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+        "content-security-policy":
+          "sandbox allow-scripts; default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'none'; form-action 'none'; frame-ancestors 'none'",
+      });
+      response.end(request.method === "HEAD" ? undefined : bytes);
+    } catch {
+      response.writeHead(500).end();
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(selectedPort, "127.0.0.1", resolve);
+  });
+  const actualPort = server.address().port;
+  try {
+    await save(join(directory, "server.json"), { port: actualPort });
+  } catch (error) {
+    await new Promise((resolve) => server.close(resolve));
+    throw error;
+  }
+  return {
+    async prepare(bundle) {
+      await save(join(prepared, `${bundle.bundleSha256}.json`), bundle);
+    },
+    async preparedBundle(digest) {
+      if (!SHA.test(digest)) throw new Error("Invalid prepared bundle identity.");
+      const bundle = await load(join(prepared, `${digest}.json`), LIMIT * 2);
+      if (!bundle)
+        throw new Error("The authorized source bundle is missing; inspect the saved task.");
+      return bundle;
+    },
+    async deploy(operationId, bundle, signal) {
+      if (!UUID.test(operationId) || !SHA.test(bundle.bundleSha256))
+        throw new Error("Invalid local operation identity.");
+      const prior = await load(join(operations, `${operationId}.json`));
+      if (prior) {
+        if (prior.commit !== bundle.commit || prior.bundleSha256 !== bundle.bundleSha256)
+          throw new Error("This deployment operation already identifies another bundle.");
+        return prior;
+      }
+      await save(join(releases, `${bundle.bundleSha256}.json`), bundle);
+      const url = `http://127.0.0.1:${actualPort}/releases/${bundle.bundleSha256}/`;
+      const receipt = {
+        provider: "local-static",
+        operationId,
+        commit: bundle.commit,
+        sourceDirectory: bundle.sourceDirectory,
+        bundleSha256: bundle.bundleSha256,
+        indexSha256: bundle.indexSha256,
+        url,
+        ...(await checkStaticRelease(url, bundle, signal)),
+      };
+      await save(join(operations, `${operationId}.json`), receipt);
+      return receipt;
+    },
+    async reconcile(operationId) {
+      if (!UUID.test(operationId)) throw new Error("Invalid local operation identity.");
+      return load(join(operations, `${operationId}.json`));
+    },
+    async close() {
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    },
+  };
+}
+
+export async function runInfrastructureWorkerCycle({
+  client,
+  baseUrl,
+  missionId,
+  candidateWorkItem,
+  recoveryOnly,
+  repositoryRoot,
+  stateDirectory,
+  expectedAgentId,
+  _session,
+  infrastructureProvider,
+  signal,
+  emit = () => {},
+}) {
+  const kind = candidateWorkItem?.metadata?.kind;
+  if (!recoveryOnly && !KINDS.has(kind)) return false;
+  if (recoveryOnly && !infrastructureProvider) return false;
+  if (!_session || !infrastructureProvider)
+    throw new Error("Infrastructure work requires the connected agent service.");
+  assertMissionAgentSession(_session, baseUrl, expectedAgentId);
+  if (!UUID.test(missionId) || !UUID.test(expectedAgentId))
+    throw new Error("Invalid infrastructure task identity.");
+  const directory = join(stateDirectory, expectedAgentId, missionId);
+  await ensurePrivateRuntimeDirectory(join(stateDirectory, expectedAgentId));
+  await ensurePrivateRuntimeDirectory(directory);
+  let record;
+  let item = candidateWorkItem;
+  let path;
+  if (recoveryOnly) {
+    for (const file of await readdir(directory)) {
+      if (!UUID.test(file.slice(0, -5)) || !file.endsWith(".json")) continue;
+      const found = await load(join(directory, file));
+      if (KINDS.has(found?.kind) && found.state !== "done" && found.state !== "blocked") {
+        record = found;
+        path = join(directory, file);
+        break;
+      }
+    }
+    if (!record) return false;
+  } else {
+    path = join(directory, `${item.id}.json`);
+    record = await load(path);
+    if (record?.state === "done" || record?.state === "blocked") return true;
+  }
+  let launched =
+    !!record?.effectId && ["infra_dispatched", "result_settling", "ready"].includes(record.state);
+  let timer;
+  const controller = new AbortController();
+  const activeSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+  const persist = () => save(path, record);
+  try {
+    const identity = await client.agent({ signal: activeSignal });
+    if (identity.id !== expectedAgentId)
+      throw new Error("The infrastructure agent's identity changed.");
+    if (!record) {
+      record = {
+        kind,
+        state: "preparing",
+        workItemId: item.id,
+        claimKey: `infra-claim:${item.id}:${item.attempts ?? 0}`,
+      };
+      await persist();
+      const mission = await client.missions.get(missionId, { signal: activeSignal });
+      if (mission.infrastructure?.provider !== "local-static")
+        throw new Error("Unsupported infrastructure provider.");
+      const repository = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: repositoryRoot });
+      // Same canonical identity check as the coding worker's explicit repository binding.
+      if (!repository || repository.repository !== mission.repository?.url)
+        throw new Error("Bind the mission's repository before deploying its app.");
+      let source;
+      if (kind === "infrastructure_deploy") {
+        const review = mission.workItems.find(
+          (dependency) =>
+            item.dependsOnIds.includes(dependency.id) && dependency.metadata?.kind === "review",
+        );
+        const code = mission.workItems.find(
+          (dependency) =>
+            review?.dependsOnIds.includes(dependency.id) && dependency.metadata?.kind === "code",
+        );
+        if (
+          review?.result?.approved !== true ||
+          !code?.result?.headCommit ||
+          code.ownerMemberId === review.ownerMemberId
+        )
+          throw new Error("An approved independent review is required before deployment.");
+        source = {
+          commit: code.result.headCommit,
+          sourceDirectory: mission.infrastructure.sourceDirectory,
+        };
+      } else {
+        const deployment = mission.workItems.find(
+          (dependency) =>
+            item.dependsOnIds.includes(dependency.id) &&
+            dependency.metadata?.kind === "infrastructure_deploy",
+        );
+        if (!deployment?.result?.receipt)
+          throw new Error("The preceding deployment needs a receipt.");
+        source = { ...deployment.result.receipt, deploymentEffectId: deployment.result.effectId };
+      }
+      record.source = source;
+      record.repositoryResource = mission.repository.url;
+      record.state = "claiming";
+      await persist();
+    }
+    if (record.state === "claiming") {
+      const claim = await client.missions.claim(missionId, record.workItemId, {
+        signal: activeSignal,
+        idempotencyKey: record.claimKey,
+      });
+      record.leaseToken = claim.leaseToken;
+      record.state = "infra_source";
+      await persist();
+    }
+    if (record.state !== "ready")
+      await client.missions.renew(missionId, record.workItemId, record.leaseToken, {
+        signal: activeSignal,
+      });
+    timer =
+      record.state === "ready"
+        ? undefined
+        : setInterval(() => {
+            client.missions
+              .renew(missionId, record.workItemId, record.leaseToken, { signal: activeSignal })
+              .catch((error) => controller.abort(error));
+          }, 10_000);
+    emit({ type: "work_started", missionId, workItemId: record.workItemId, stage: record.kind });
+    const action = record.kind === "infrastructure_deploy" ? "app.deploy" : "app.verify";
+    if (record.state === "infra_source") {
+      const effect = await client.missions.reserveEffect(
+        missionId,
+        {
+          workItemId: record.workItemId,
+          leaseToken: record.leaseToken,
+          action: "repository.read",
+          resource: record.repositoryResource,
+          estimatedCostCents: 0,
+        },
+        {
+          signal: activeSignal,
+          idempotencyKey: `infra-source:${record.workItemId}:${record.claimKey}`,
+        },
+      );
+      record.readEffectId = effect.id;
+      record.state = "infra_source_dispatched";
+      await persist();
+      const launch = await client.missions.dispatchEffect(missionId, effect.id, record.leaseToken, {
+        signal: activeSignal,
+      });
+      if (launch.launchPermitted !== true) throw new Error("The source read was not permitted.");
+      activeSignal.throwIfAborted();
+      const bundle = await packageStaticApp(
+        repositoryRoot,
+        record.source.commit,
+        record.source.sourceDirectory,
+        activeSignal,
+      );
+      if (
+        record.kind === "infrastructure_verify" &&
+        (bundle.bundleSha256 !== record.source.bundleSha256 ||
+          bundle.indexSha256 !== record.source.indexSha256)
+      )
+        throw new Error("The verification checkout does not match the deployed bundle.");
+      await infrastructureProvider.prepare(bundle);
+      record.parameters = {
+        commit: bundle.commit,
+        sourceDirectory: bundle.sourceDirectory,
+        bundleSha256: bundle.bundleSha256,
+        indexSha256: bundle.indexSha256,
+        ...(record.source.deploymentEffectId
+          ? { deploymentEffectId: record.source.deploymentEffectId }
+          : {}),
+      };
+      if (record.source.url) record.deploymentUrl = record.source.url;
+      record.state = "infra_source_settling";
+      await persist();
+    } else if (record.state === "infra_source_dispatched") {
+      // Source inspection has no external mutation. An interrupted read is reported failed; do not repeat it on a stale permission.
+      await client.missions.settleEffect(
+        missionId,
+        record.readEffectId,
+        { state: "failed", actualCostCents: 0 },
+        { signal: activeSignal },
+      );
+      record.state = "blocked";
+      throw new Error(
+        "The authorized source read was interrupted. Inspect it before assigning a retry.",
+      );
+    }
+    if (record.state === "infra_source_settling") {
+      await client.missions.settleEffect(
+        missionId,
+        record.readEffectId,
+        { state: "succeeded", actualCostCents: 0 },
+        { signal: activeSignal },
+      );
+      record.state = "infra_reserved";
+      await persist();
+    }
+    if (record.state === "infra_reserved") {
+      const effect = await client.missions.reserveEffect(
+        missionId,
+        {
+          workItemId: record.workItemId,
+          leaseToken: record.leaseToken,
+          action,
+          resource: `totem:mission:${missionId}:app`,
+          parameters: record.parameters,
+          estimatedCostCents: 0,
+        },
+        { signal: activeSignal, idempotencyKey: `infra:${record.workItemId}:${record.claimKey}` },
+      );
+      record.effectId = effect.id;
+      // Save intent before the dispatch request; a lost dispatch response is never relaunched.
+      record.state = "infra_dispatched";
+      await persist();
+      launched = true;
+      const launch = await client.missions.dispatchEffect(missionId, effect.id, record.leaseToken, {
+        signal: activeSignal,
+      });
+      if (launch.launchPermitted !== true)
+        throw new Error("The infrastructure launch was not permitted.");
+      activeSignal.throwIfAborted();
+      record.receipt =
+        action === "app.deploy"
+          ? await infrastructureProvider.deploy(
+              effect.id,
+              await infrastructureProvider.preparedBundle(record.parameters.bundleSha256),
+              activeSignal,
+            )
+          : {
+              ...record.parameters,
+              provider: "local-static",
+              operationId: effect.id,
+              url: record.deploymentUrl,
+              ...(await checkStaticRelease(record.deploymentUrl, record.parameters, activeSignal)),
+            };
+      record.state = "result_settling";
+      await persist();
+    } else if (record.state === "infra_dispatched") {
+      record.receipt =
+        action === "app.deploy" ? await infrastructureProvider.reconcile(record.effectId) : null;
+      if (!record.receipt) {
+        record.state = "blocked";
+        throw new Error(
+          "The operation's outcome is unknown; reconcile it before trying another deployment.",
+        );
+      }
+      record.state = "result_settling";
+      await persist();
+    }
+    if (record.state === "result_settling") {
+      await client.missions.settleEffect(
+        missionId,
+        record.effectId,
+        {
+          state: "succeeded",
+          actualCostCents: 0,
+          receipt: record.receipt,
+        },
+        { signal: activeSignal },
+      );
+      record.state = "ready";
+      await persist();
+    }
+    const summary = `${action === "app.deploy" ? "Published" : "Verified"} the reviewed static app locally. The preview is available while its deployment agent is connected.`;
+    await client.missions.complete(
+      missionId,
+      record.workItemId,
+      {
+        leaseToken: record.leaseToken,
+        artifact: {
+          kind: "infrastructure",
+          title: action === "app.deploy" ? "Local app deployment" : "Local app verification",
+          summary,
+          uri: record.receipt.url,
+          contentText: JSON.stringify({ summary, receipt: record.receipt }),
+          metadata: { receipt: record.receipt },
+        },
+      },
+      { signal: activeSignal, idempotencyKey: `infra-complete:${record.effectId}` },
+    );
+    record.state = "done";
+    await persist();
+    emit({ type: "work_completed", missionId, workItemId: record.workItemId, stage: record.kind });
+  } catch (error) {
+    const transient =
+      (error instanceof TypeError && /network|fetch/i.test(error.message)) ||
+      [408, 425, 429, 500, 502, 503, 504].includes(error.status) ||
+      ["NETWORK_ERROR", "TIMEOUT", "ECONNRESET", "ECONNREFUSED", "ETIMEDOUT"].includes(error.code);
+    if (record?.state === "preparing" && (transient || signal?.aborted)) {
+      await rm(path, { force: true });
+      record = null;
+    }
+    if (record) {
+      if (record.state === "infra_source_dispatched" && !signal?.aborted && !transient) {
+        await client.missions
+          .settleEffect(
+            missionId,
+            record.readEffectId,
+            { state: "failed", actualCostCents: 0 },
+            { signal },
+          )
+          .catch(() => {});
+        record.state = "blocked";
+      }
+      if (launched && record.state === "infra_dispatched") {
+        await client.missions
+          .settleEffect(missionId, record.effectId, { state: "uncertain" }, { signal })
+          .catch(() => {});
+      }
+      // Keep recoverable results, including a lost completion response. Never relaunch a saved operation.
+      if (
+        ![
+          "claiming",
+          "infra_source",
+          "infra_source_dispatched",
+          "infra_source_settling",
+          "infra_reserved",
+          "infra_dispatched",
+          "result_settling",
+          "ready",
+        ].includes(record.state)
+      )
+        record.state = "blocked";
+      record.error = error.message;
+      await persist();
+      if (
+        !signal?.aborted &&
+        !transient &&
+        !record.blockerRecorded &&
+        client.missions.events?.post
+      ) {
+        await client.missions.events
+          .post(
+            missionId,
+            {
+              version: 1,
+              type: "blocker",
+              workItemId: record.workItemId,
+              payload: {
+                summary: "Infrastructure task needs attention.",
+                helpNeeded: error.message.slice(0, 4000),
+              },
+            },
+            {
+              idempotencyKey: `infra-blocker:${record.workItemId}:${record.effectId ?? record.claimKey}`,
+              signal,
+            },
+          )
+          .then(async () => {
+            record.blockerRecorded = true;
+            await persist();
+          })
+          .catch(() => {});
+      }
+    }
+    emit({
+      type: "needs_attention",
+      missionId,
+      workItemId: record?.workItemId ?? item?.id,
+      message: error.message,
+    });
+    if (signal?.aborted || transient || [401, 403, 409].includes(error.status)) throw error;
+    return true;
+  } finally {
+    clearInterval(timer);
+  }
+  return true;
+}