Repository navigation
Conversation
|
The token handling in this PR needs one fix before merge: a worker can send the daemon's GitHub token to api.github.com paths outside the artifact route. I reviewed 8748f7d.
Not blocking, and you can take or leave these: the lookup in On simplicity, I think the shape is right: one resolver turns the artifact into the existing url source. Could The checks show no failures, and the PR body says |
8748f7d to
1b3bd41
Compare
Add `agent-device host`, the Host front-end from ADR 0021 §3. It runs as its own process, starts or reuses the local HTTP daemon, and serves it to remote verification workers through the daemon proxy. Workers authenticate with one persistent service credential. Host creates it on first start at <state dir>/host/service-credential.json (directory 0700, file 0600) and reuses it after every restart. A malformed or group/other-readable file stops startup with a typed reason, and so does a TLS file Host cannot read. Both checks run before any daemon starts. --tls-cert and --tls-key serve HTTPS. A wildcard bind advertises the machine's hostname, since workers cannot dial 0.0.0.0. The proxy command behaves as before. Its daemon startup and listen helpers move into a module both commands use. Closes callstack#3265
- Host checks that the TLS certificate and key load together, and that the key is mode 0600, before any daemon starts. A bind other than loopback without TLS is refused (host-tls-required), so the service token never travels in cleartext. - A new credential reaches disk only once Host is serving, so a start that fails earlier never hides the token from the next one. A credential another start wrote first is refused (host-credential-raced). - A credential that is a link or unreadable gets a typed reason, and platforms without POSIX ownership skip the mode check. - The advertised URL keeps the host name the operator bound to, and the worker command in the startup output names the real URL and token. - The proxy command keeps its original code. Host's daemon and listen helpers live in src/cli/host/local-daemon.ts. - The host help topic moves into its own module.
Add `host` to the reviewed device-claim policy set, give the --tls-cert/--tls-key flags their own Host bucket in the integration progress model, list `hostCommand` with the dynamically loaded CLI handlers in the fallow production exemptions, and waive the operator-facing `host` help topic from the help benchmark.
Host now owns identity and the public route policy (ADR 0021 §6): - The front-end drops every identity a client claims (tenant headers and body fields) and sends the credential's principal to the daemon as x-agent-device-principal on the daemon-token loopback request. - The daemon reads that header only after the daemon token matched and treats it as an attested tenant, so sessions are isolated under the principal and req.internal.hostPrincipal carries it to admission. With an auth hook configured the header is refused with a typed reason. - Administration routes, macos-app allocation, inputs naming a path on the Host machine and allowDownload are refused with 403 and a typed details.reason. The host-path inputs move out of the macos-app lease into one declaration both policies read. - Anonymous /health shows only ok, service and rpcProtocolVersion. The principal handoff is the contract proposed to the lease side on callstack#3264. Closes callstack#3266
- The proxy gains an optional admitRpc hook that runs on an authorized /rpc request with its params already parsed. Host uses it instead of re-reading the body and repeating the token check, so oversized and unauthorized requests get the proxy's own answers. Plain proxy sets no hook and behaves as before. - Path positionals come from each command's schema (`path`, `appOrPath`, `payloadOrJson`) instead of a hand-kept table, so trace, push and session save-script are covered. URLs no longer exempt a positional, an upload id exempts only install and reinstall, and only the exact temp locations the remote client writes are accepted. - Batch steps are checked one by one, and replay and test are refused (host-script-refused) because Host cannot check their nested actions. - launchConsole counts as a Host path, macos-app is matched the way the daemon normalizes it, and /admin/* is simply not served. - The daemon reads the principal header only on a request that holds the daemon token, so an unauthenticated caller learns nothing about an auth hook. - Host answers with an error response instead of rejecting.
… changes DaemonHealthPayload widens `service` with 'agent-device-host', and the auxiliary HTTP authorizer reads x-agent-device-principal after the daemon token check. Both are additive under ADR 0006: released peers send and parse the same bytes as before.
On Host, `--device "<type>"` names a device type Host allocates a fresh
device for (ADR 0021 §5), instead of a name resolved against inventory.
- The client asks the endpoint's health first, through the cache the RPC
transport already fills. On `service: agent-device-host` it skips the
inventory lookup and allocates with the type, platform and --os-version in
the device-selection fields lease.allocate already carries.
- A Host that does not advertise the `device-shape` feature fails with
host-shape-unsupported before any lease request (§8). Plain proxy is
unchanged.
- The daemon builds a strict { platform, deviceType, osVersion? } shape for
a lease_allocate that carries a Host principal, calls the new
HostShapeAllocator seam, and only then publishes the Host lease bound to
the returned device; an allocation it cannot publish is given back.
A UDID or serial, or a daemon with no allocator, is refused with a typed
reason.
The seam is the lease side's to implement (callstack#3269). Nothing configures it in
production yet; the tests drive it through the scripted allocator fake.
Closes callstack#3267
…ot allocate - After a by-type allocation, the command addresses the device the lease bound (its UDID or serial) instead of a name another simulator may share. - On a Host, every lease-allocating command is checked before any lease request. A missing --device, a UDID or serial, a missing token (host-unauthenticated) and a different type on a session that already holds one (host-shape-mismatch) are typed refusals. The platform comes from the connection when --platform is absent. - The daemon validates the lease scope before it provisions anything, gives an allocation back when the requester has left, and keeps the original error if giving it back fails. --os-version must be a string. - The daemon advertises device-shape exactly when it has an allocator, and the Host service name is one shared constant. - The proxy lease device selection moves into its own module, loaded on demand, so connection-runtime.ts stays under 1,000 lines.
List DaemonHealthFeature, DAEMON_HOST_DEVICE_SHAPE_FEATURE and DAEMON_HOST_SERVICE in the wire manifest, and acknowledge the additive `features` field on the health payload, its builder and the client's health parser under ADR 0006.
The daemon now resolves github-actions-artifact install sources itself instead of refusing them (ADR 0021 §6). It looks the artifact up through the GitHub REST API (by id, by run and name, or the newest with that name), authorized with AGENT_DEVICE_GITHUB_TOKEN from its own environment; a request never carries a GitHub token. The archive URL then goes through the existing approved downloader, which drops Authorization at the cross-origin storage redirect. Missing token, missing artifact and expired artifact are refused with typed reasons (github-token-missing, github-artifact-not-found, github-artifact-expired). URL and artifact sources reach the daemon through Host unchanged; Host paths stay refused by the route policy. Closes callstack#3268
…an run - A name alone now picks the newest live artifact from the repository's own runs, so a fork pull request's upload can never stand in for it. - Owner and repository names are checked at every entry point, and the token goes only to an archive URL under the named repository on the GitHub API. AGENT_DEVICE_GITHUB_REPOSITORIES limits which repositories the daemon token reads. - The lookup reuses the downloader's approved request path and byte limit, has its own timeout, follows GitHub API redirects, and gives 401, 403/429, other statuses and non-JSON bodies typed reasons. - The handler looks the artifact up only after its local checks pass, instead of spending API calls on requests that could never install. - The daemon publishes a fingerprint of its token, and a client holding a token refuses to reuse a daemon started without it or with another. - The token variable is declared once, in src/daemon-github-token.ts, and the GitHub source parsing moves out of http-server.ts.
…ion-kit Add the ./github-actions-artifact-source entry to the provision-kit exports map and its R11 package-boundary pin.
1b3bd41 to
7b3f7ea
Compare
|
Thanks for the update. At 7b3f7ea the earlier findings are fixed, and one new problem remains in the archive URL check. CI is green (1 check, 0 not passing), and no conflicts are known. The archive check in Not blocking, and you can take or leave these: Is any new seam needed here? I think not, since the delta reuses the downloader's approved hop and the single resolver still feeds the existing url source. I did not run tests, and I did not trace whether the download diagnostics could log the url-source headers that now carry the daemon token. The live run went through the proxy, not Host, with a lowercase repository name, so it does not exercise the case mismatch. Only the stub-daemon test covers the Host hop. Before merge, the archive prefix comparison needs to be case-insensitive, with the canonical-casing test added. |
This branch has not been deployed
2 participants
Stacked on #3273. Please review only the top three commits.
Summary
Verification builds install through Host, private GitHub Actions artifacts included (ADR 0021 §6).
The daemon resolves
github-actions-artifactsources by id, by run and name, or by name alone, which picks the newest live artifact from the repository's own runs, never a fork pull request.The token stays on the daemon:
AGENT_DEVICE_GITHUB_TOKEN, never from a request.AGENT_DEVICE_GITHUB_REPOSITORIESlimits which repositories it reads.The lookup runs after the install's local checks, with its own timeout. GitHub source parsing moves out of
http-server.ts.Closes #3268. 24 files, 786 gross lines vs #3273.
Validation
Tested commit
7b3f7eaab:pnpm check:affected --run: all pass except a flakyaffected-selectortest (ENOTEMPTY on temp cleanup; unchanged from main). The 17 checks after it pass when run separately.Tests cover fork filtering,
..names, a foreign archive URL, the token dropped at the redirect, and each typed refusal.Live iOS run on iPhone 17 Pro (iOS 26.2) through
proxy, since Host can't allocate before Host lease side: allocator contract trim, Simlock adapter, coordinator/journal, renewal, recovery #3269:Installed in 63 s;
open,snapshot -i,closeanddisconnectpassed. No state dir or daemon log contains the token.