73f2277 · db63a22 · 356edf8 · 6f769d9 · 79fb8f0 · 0d7a456
@@ -23,6 +23,7 @@
import { smoke } from "../src/release/smoke.ts";
import { webspec } from "../src/release/webspec.ts";
import { outsider } from "../src/release/outsider.ts";
import { PROBE_HEADER } from "../src/kernel/probe.ts";
export * from "../src/release/smoke.ts";
if (import.meta.main) {
@@ -41,7 +42,7 @@
if (import.meta.main) {
  const base = args[0];
  const seconds = wait === undefined ? 120 : Number(wait);
  if (!base || !Number.isFinite(seconds) || seconds < 0 || args.length > 1) {
    console.error("usage: bun scripts/smoke.ts <url> [--version <v>] [--wait <seconds>] [--outsider] [--standards]");
    console.error("usage: bun scripts/smoke.ts <url> [--version <v>] [--wait <seconds>] [--outsider] [--standards]  (--version needs FORGE_PROBE, the forge's probe)");
    process.exit(2);
  }
  if (withOutsider && !process.env["FORGE_TOKEN"]) {
@@ -56,7 +57,12 @@
if (import.meta.main) {
    console.log(`standards: ${findings.length} finding(s) over ${paths.length} path(s); report only`);
    process.exit(0);
  }
  const failures = await smoke(base, process.env["FORGE_TOKEN"] ?? "", { version, waitMs: seconds * 1000 });
  const failures = await smoke(base, process.env["FORGE_TOKEN"] ?? "", {
    version,
    waitMs: seconds * 1000,
    // The forge tells only its probe its version (`src/kernel/probe.ts`).
    ...(process.env["FORGE_PROBE"] ? { probe: { [PROBE_HEADER]: process.env["FORGE_PROBE"] } } : {}),
  });
  for (const f of failures)
    console.error(`FAIL ${f.url} agent=${f.agent} status=${f.status} content-type=${f.contentType || "-"} (${f.why})`);
  const unrefused = withOutsider
@@ -1,9 +1,17 @@
/**
 * How the forge is, as it answers anyone who asks: the version and commit
 * it runs, whether it is draining, and the platform's word on its rollout
 * (`kernel/guard.ts`). A monitor has no account, so there is nothing to
 * authorize. A site admin also gets the forge's own vitals alongside, and
 * `ok` is then both.
 * How the forge is, as it answers whoever asks. A monitor has no account,
 * so anyone may ask; what it is told depends on who it is (#2917):
 *
 * - a stranger learns whether the forge is well and whether it is draining,
 *   and nothing of the platform's incidents or rollout. It is also told the
 *   version and commit for one release more — a running forge's swap reads
 *   its successor's commit without a probe (`release/swap.ts` before #2917);
 *   once that forge is gone the stranger's answer is `ok` alone.
 * - anyone signed in, and the forge's own release machinery carrying the
 *   probe (`kernel/probe.ts`), get the whole answer: version, commit,
 *   rollout and the platform's incidents.
 * - a site admin gets the whole answer and the forge's vitals alongside,
 *   `ok` then being both.
 *
 * One answer for the API (`GET /api/v1/health`) and the MCP `health` tool.
 */
@@ -51,11 +59,23 @@
export function forgeVitals(app: App): Vitals {
  });
}
/**
 * What a stranger is told: no incident, no rollout, no platform words.
 * Version and commit stay for one release, while a running forge's swap
 * reads its successor's commit without the probe; #2962 removes them.
 */
export type StrangerHealth = Pick<ForgeHealth, "ok" | "version" | "commit" | "draining">;
export function readHealth(
  app: App,
  actor: User | undefined,
): ForgeHealth | (Vitals & ForgeHealth) {
  probe = false,
): StrangerHealth | ForgeHealth | (Vitals & ForgeHealth) {
      
        sentinelcrew
        25d ago
        outdated
      
      Low: version and commit still reach strangers for compatibility. That is reasonable for one release, but open the follow-up issue that reduces this to { ok, draining }.
    
  const forge = forgeHealth();
  if (actor === undefined && !probe) {
    const { ok, version, commit, draining } = forge;
    return { ok, version, commit, draining };
  }
  if (!actor?.isAdmin) return forge;
  const v = forgeVitals(app);
  return { ...v, ...forge, ok: forge.ok && v.ok };
@@ -118,6 +118,23 @@
export function mayReadLogOfRun(
  );
}
/**
 * A run as this actor may read it. Its cost and turns are the owner's own
 * facts (`canSeeOwnerFacts`), and so is the machinery under it: the agent
 * session a follow-up resumes and the node it ran on (#2917). A reader who
 * cannot write here gets what ran, why and how it ended, never those — on
 * every door, since every door reads runs through here.
 */
export function runForReader(
  app: App,
  actor: User | undefined,
  repo: Repo,
): (run: Run) => Run {
  return canSeeOwnerFacts(app.db, repo, actor)
    ? (run) => run
    : (run) => ({ ...run, costUsd: 0, turns: 0, sessionId: "", node: "" });
}
export function listRepoRuns(
  app: App,
  actor: User | undefined,
@@ -129,9 +146,9 @@
export function listRepoRuns(
  if (!mayReadRuns(app, actor, repo)) return ok([]);
  // A run on a sealed report, or its fix, is the report's (`core/sealed.ts`).
  return ok(
    queryRuns(app.db, repo.id, options).filter((r) =>
      mayViewId(app.db, repo, r.issueId, actor),
    ),
    queryRuns(app.db, repo.id, options)
      .filter((r) => mayViewId(app.db, repo, r.issueId, actor))
      .map(runForReader(app, actor, repo)),
  );
}
@@ -160,7 +177,7 @@
export function getRepoRun(
  const run = getRun(app.db, runId);
  if (!run || run.repoId !== repo.id) return err("not_found");
  if (!mayViewId(app.db, repo, run.issueId, actor)) return err("not_found");
  return ok(run);
  return ok(runForReader(app, actor, repo)(run));
}
export interface RunLogView {
@@ -28,6 +28,7 @@
import { failuresOf } from "./failures.ts";
import { keepForgeGate } from "./gate_last.ts";
import { checksFor } from "./service.ts";
import { landVerdict, type LandVerdict } from "./tiers.ts";
import { ownProbeHeaders } from "../kernel/probe.ts";
/**
 * The full gate, once, on a commit that is what main would become — one
@@ -165,7 +166,7 @@
async function swapIn(
      );
    return;
  }
  const swapped = await startRelease({ dir, sha, port, env: process.env,
  const swapped = await startRelease({ dir, sha, port, env: process.env, probe: ownProbeHeaders(app.config.dataDir),
    ...(app.config.swapBudgetMs === undefined ? {} : { budgetMs: app.config.swapBudgetMs }),
  });
  endSwap(swapped.ok);
@@ -59,6 +59,7 @@
import { resendVerification } from "../actions/verify.ts";
import { CAPPED_WORDS } from "../actions/mail.ts";
import { emailVerified } from "../core/verify.ts";
import { readHealth } from "../actions/health.ts";
import { isProbe } from "../kernel/probe.ts";
import { listChildren } from "../actions/spawn.ts";
import { forgeState, PARENT_HEADER } from "../spawn/clients.ts";
import { familyView } from "../spawn/family.ts";
@@ -287,6 +288,7 @@
import {
  checkOfCommit,
  getRepoRun,
  listRepoRuns,
  runForReader,
  runLog,
} from "../actions/runs.ts";
import {
@@ -4704,11 +4706,15 @@
export function apiRoutes(router: Router<Handler>): void {
  // ---- apps, runs, and the crew (docs/APPS.md) ----
  // How the forge is, and the platform's word on its rollout: anyone may
  // read it (a monitor has no account). A site admin also gets the forge's
  // own vitals alongside, `ok` being both.
  // How the forge is: anyone may ask (a monitor has no account), a stranger
  // is told little, the release machinery's probe and a site admin the
  // whole of it (`actions/health.ts`).
  router.add("GET", "/api/v1/health", (ctx) =>
    json(readHealth(ctx.app, ctx.auth.user)),
    json(
      readHealth(ctx.app, ctx.auth.user, isProbe(ctx.request, ctx.app.config.dataDir)),
      200,
      { "cache-control": "no-store", vary: "authorization, cookie, x-forge-probe" },
    ),
  );
  // Explore (#607): the rows /explore shows, for the same one line.
@@ -5347,14 +5353,6 @@
export function apiRoutes(router: Router<Handler>): void {
    return json({ url: link.value });
  });
  // A run's cost and turn count are the owner's own facts (`canSeeOwnerFacts`,
  // same predicate the studio page uses) — a viewer who can only read a
  // public repository gets every other field, never those two.
  const runForViewer = (ctx: Ctx, repo: Repo) =>
    canSeeOwnerFacts(ctx.app.db, repo, ctx.auth.user)
      ? (r: Run): Run => r
      : (r: Run): Run => ({ ...r, costUsd: 0, turns: 0 });
  // What the crew's runs here spent over a window (`core/usage.ts`):
  // tokens, cost, wall time and outcome, by subscription, agent and issue.
  // Spend is the owner's own fact, so a reader who cannot write gets 403.
@@ -5450,8 +5448,9 @@
export function apiRoutes(router: Router<Handler>): void {
      limit,
    });
    if (!runs.ok) return notFound();
    const forViewer = runForViewer(ctx, repo);
    return json(paged(runs.value.map(forViewer), limit, (r) => r.id));
    // Already as this reader may see them (`runForReader`): a stranger's
    // runs carry no cost, turns, agent session or node.
    return json(paged(runs.value, limit, (r) => r.id));
  });
  router.add("GET", "/api/v1/repos/:owner/:name/runs/:id", (ctx) => {
@@ -5461,7 +5460,7 @@
export function apiRoutes(router: Router<Handler>): void {
    if (!run.ok) return notFound();
    // The merged pulls a finished production deploy carries (`core/carried.ts`).
    return json({
      ...runForViewer(ctx, repo)(run.value),
      ...run.value,
      carries: carriedBy(ctx.app.db, run.value.id),
    });
  });
@@ -5489,9 +5488,7 @@
export function apiRoutes(router: Router<Handler>): void {
    // The cost and turn count are the owner's own facts, same as the studio
    // page beside this stream — a viewer who cannot write here never gets
    // them, whether the page renders or a fetch asks this stream directly.
    const ownerFacts = canSeeOwnerFacts(ctx.app.db, repo, ctx.auth.user);
    const forViewer = (r: Run): Run =>
      ownerFacts ? r : { ...r, costUsd: 0, turns: 0 };
    const forViewer = runForReader(ctx.app, ctx.auth.user, repo);
    // Every line carries its number, so a browser that reconnects — a
    // proxy in front of the forge cuts long responses — sends the last it
    // saw and hears only what followed, never the log again from the top.
@@ -183,7 +183,7 @@
import { COPIES_PER_DAY, makeItYours } from "../actions/make_it_yours.ts";
import { resourceMetadataUrl } from "./oauth.ts";
import { body, boundedBody, json } from "./respond.ts";
import type { Router } from "./router.ts";
import { mayReadRuns } from "../actions/runs.ts";
import { mayReadRuns, runForReader } from "../actions/runs.ts";
import { manifestFor } from "../actions/here.ts";
import { clientBucket } from "./peer.ts";
import { deleteBoard, listAllBoards, showBoard, writeBoard, type BoardError } from "../actions/boards.ts";
@@ -991,8 +991,11 @@
const TOOLS: readonly Tool[] = [
      return good([
        ...waiting,
        ...reviewWaits,
        ...runs.map((r) => {
          const repo = byId.get(r.repoId)!;
        ...runs.map((run) => {
          const repo = byId.get(run.repoId)!;
          // As this caller may read it (`runForReader`): cost and node are
          // the owner's facts.
          const r = runForReader(ctx.app, user, repo)(run);
          const issue =
            r.issueId === null
              ? undefined
@@ -1005,8 +1008,7 @@
const TOOLS: readonly Tool[] = [
            why: r.reason,
            state: r.state,
            since: r.startedAt ?? r.createdAt,
            // What a run costs is the owner's fact (`canSeeOwnerFacts`).
            costUsd: owned.has(r.repoId) ? r.costUsd : 0,
            costUsd: r.costUsd,
            ...(placementWords(r) === "" ? {} : { ran: placementWords(r) }),
          };
        }),
@@ -118,10 +118,28 @@
export function prefersHtml(request: Request, pathname: string): boolean {
const FLOOR_POLICY =
  "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
/**
 * The powers no page of the forge's uses, refused to it and to anything
 * framed in it: a script that ever slipped through still cannot ask for a
 * camera, a microphone, a location, a payment or a device (#2917).
 */
const PERMISSIONS_POLICY =
  "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), hid=(), bluetooth=()";
/**
 * Once a browser has reached the forge over https, it never again asks over
 * plain http, for a year. Sent from the forge itself rather than left to an
 * edge that may not (#2917); a browser ignores it on an http answer, so a
 * forge on localhost is not pinned to a scheme it cannot serve. Subdomains
 * are not named: an app's host is not the forge's to promise.
 */
const HSTS = "max-age=31536000";
/**
 * The security floor every response the forge writes leaves with: never
 * sniffed into another type, never a referrer sent off-site, and — unless
 * the body is a document that wrote its own policy — inert.
 * sniffed into another type, never a referrer sent off-site, no powers a
 * page does not use, https once https, and — unless the body is a document
 * that wrote its own policy — inert.
 *
 * A responder that already set one of these keeps its value: `page()` has a
 * nonce'd policy that must survive, and a fragment has a sandboxed one. The
@@ -136,6 +154,10 @@
export function securityFloor(response: Response): Response {
      headers.set("x-content-type-options", "nosniff");
    if (!headers.has("referrer-policy"))
      headers.set("referrer-policy", "same-origin");
    if (!headers.has("permissions-policy"))
      headers.set("permissions-policy", PERMISSIONS_POLICY);
    if (!headers.has("strict-transport-security"))
      headers.set("strict-transport-security", HSTS);
    // What left decides, not what was asked for: an HTML body writes the
    // only policy that can name its own nonce, and `default-src 'none'`
    // over a page would strip it of its stylesheet.
@@ -462,6 +462,8 @@
import { methodOf, noteUsage, roleOf, surfaceOf, takeUsage } from "./usage_tag.t
import { oauthRoutes } from "./oauth.ts";
import { flushAccess, recordAccess } from "./access_log.ts";
import { carryPeer, clientAddress, notePeer, type ProxyTrust } from "./peer.ts";
import { isProbe } from "../kernel/probe.ts";
import { takeStrangerRead } from "./stranger_reads.ts";
import { parseCidrs } from "../kernel/cidr.ts";
import {
  reportAcceptSubmit,
@@ -2328,8 +2330,10 @@
async function answerGet(
    const dbStart = performance.now();
    const live = liveResponse(() => app.db.query("select 1").get(), app.log);
    noteDbTime(request, performance.now() - dbStart);
    // A smoke test learns which release answered, old pod or new.
    live.headers.set("X-Forge-Version", running().version);
    // The release proof learns which release answered, old pod or new; a
    // stranger is told only that one did (#2917).
    if (isProbe(request, app.config.dataDir))
      live.headers.set("X-Forge-Version", running().version);
    return live;
  }
  if (url.pathname === "/readyz") {
@@ -2398,6 +2402,20 @@
async function answerGet(
  if (verdict !== undefined && !verdict.allowed) {
    return withRateHeaders(tooManyRequests(verdict), verdict);
  }
  // A stranger's API reads have no token to count them by: their source does.
  const stranger = isApiPath
    ? takeStrangerRead(app.db, request, credential !== undefined || auth.user !== undefined)
    : undefined;
  if (stranger !== undefined && !stranger.allowed) {
    return withRateHeaders(
      apiError(
        "rate_limited",
        429,
        `too many requests: ${stranger.limit} per minute from one source without a token — retry in ${stranger.retryAfter}s`,
      ),
      stranger,
    );
  }
  const themeCookie = cookieValue(request, "forge_theme") ?? "";
  if (!isApiPath) {
@@ -0,0 +1,42 @@
/**
 * API reads without a credential, throttled per source (#2917). The token
 * limiter counts a token's requests; a stranger has none, so a loop reading
 * `/api/v1/...` with no token was never counted at all. Each source — the
 * peer as `http/peer.ts` resolves it, an IPv6 client by its /64 — may read
 * `api.anonymous_per_source` times a sliding minute (`/admin/limits`); a
 * refused read is not counted, so the door reopens a window later.
 *
 * Only reads (GET, HEAD) under `/api/`, only without a session or token: a
 * person in a browser and anything holding a token are counted elsewhere or
 * not at all, `/healthz` and `/readyz` are never reached by this (a probe
 * must not be throttled into a restart), and a request whose source the
 * listener did not note (an in-process answer) is not one source's to count.
 * One limiter per forge database, so a test's forge never throttles another's.
 */
import type { Database } from "bun:sqlite";
import { limitsFromEnv, RateLimiter, type Verdict } from "../core/ratelimit.ts";
import { limitValue } from "../settings/limits.ts";
import { clientAddress, clientBucket } from "./peer.ts";
/** Each forge's limiter, or null when FORGE_RATE_LIMIT=0 turned every request limit off. */
const limiters = new WeakMap<Database, RateLimiter | null>();
/**
 * Count one read without a credential from `request`'s source; the verdict,
 * or undefined when this request is not one this limit counts.
 */
export function takeStrangerRead(db: Database, request: Request, credentialed: boolean): Verdict | undefined {
  if (credentialed) return undefined;
  if (request.method !== "GET" && request.method !== "HEAD") return undefined;
  if (clientAddress(request) === "unknown") return undefined;
  let limiter = limiters.get(db);
  if (limiter === undefined) {
    limiter = limitsFromEnv().enabled ? new RateLimiter() : null;
    limiters.set(db, limiter);
  }
  if (limiter === null) return undefined;
  // Read on every request, so a change on /admin/limits governs the next one.
  limiter.setLimits({ perMinute: limitValue(db, "api.anonymous_per_source"), adminPerMinute: 0, enabled: true });
  return limiter.take(`source:${clientBucket(request)}`, "ro");
      
        sentinelcrew
        25d ago
        
      
      Low: this re-reads the setting and calls setLimits on every anonymous API read. That is cheap, so it's fine. Just note that the bucket is only as good as the proxy-trust config; without it, every stranger behind the ingress shares one key.
    
}
@@ -0,0 +1,68 @@
/**
 * The probe: how the forge's own release machinery asks a forge what it
 * runs without being an admin or a stranger (#2917). A stranger asking
 * `/api/v1/health` or `/healthz` learns that the forge is up; the release
 * that swaps in its successor, the launcher that boots an image, and the
 * proof that reads the public URL need its version and commit too.
 *
 * Each of those holds the data directory the forge answers from, so the
 * credential is derived from that directory's `secret.key` (HKDF, purpose
 * "probe") and sent as `X-Forge-Probe`. A process that can read the key
 * already owns the forge; nothing else can produce the value. It never
 * reuses the key that seals tokens or signs passports.
 */
import { hkdfSync, timingSafeEqual } from "node:crypto";
import { readFileSync } from "node:fs";
import { join } from "node:path";
import { loadKey } from "./secret.ts";
export const PROBE_HEADER = "x-forge-probe";
/** The probe a key derives. `release/launch.ts` repeats these lines: it imports nothing of the forge's. */
export function probeOfKey(key: Uint8Array): string {
  return Buffer.from(hkdfSync("sha256", key, "", "forge probe v1", 32)).toString("base64url");
}
const probes = new Map<string, { key: Buffer; probe: string }>();
/** The probe the forge answering from `dataDir` honours: its own key's. */
export function probeFor(dataDir: string): string {
  const key = loadKey(dataDir);
  const hit = probes.get(dataDir);
  // Keyed on the loaded key, as passports are: a rotation picks up a new probe.
  if (hit?.key.equals(key)) return hit.probe;
  const probe = probeOfKey(key);
  probes.set(dataDir, { key, probe });
  return probe;
}
/** The header the forge on `dataDir` sends when it probes itself (its public URL). */
export function ownProbeHeaders(dataDir: string): Record<string, string> {
  return { [PROBE_HEADER]: probeFor(dataDir) };
}
/**
 * The header a caller sends to be answered as a probe of the forge on
 * `dataDir`. Read fresh and never written: a caller polls a child that
 * creates its key as it boots, and two processes each creating one would
 * leave them disagreeing for good. No key yet is no header.
 */
export function probeHeaders(dataDir: string): Record<string, string> {
  let key: Buffer;
  try {
    key = readFileSync(join(dataDir, "secret.key"));
  } catch {
    return {};
  }
  return key.length === 32 ? { [PROBE_HEADER]: probeOfKey(key) } : {};
}
/** Whether `request` carries this forge's probe; a missing or wrong one is false. */
export function isProbe(request: Request, dataDir: string): boolean {
  const said = request.headers.get(PROBE_HEADER);
  if (said === null || said === "") return false;
  const want = Buffer.from(probeFor(dataDir));
  const got = Buffer.from(said);
  return got.length === want.length && timingSafeEqual(got, want);
}
@@ -27,6 +27,7 @@
import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync,
import { tmpdir } from "node:os";
import { join } from "node:path";
import { running } from "../kernel/version.ts";
import { probeHeaders } from "../kernel/probe.ts";
export const BOOT_BUDGET_MS = 120_000;
const POLL_MS = 250;
@@ -66,10 +67,11 @@
export function why(stderr: string): string {
  return line.replace(/[\u0000-\u001f\u007f]+/g, " ").slice(0, 300);
}
async function versionAt(port: number): Promise<string | undefined> {
async function versionAt(port: number, probe: Record<string, string>): Promise<string | undefined> {
  try {
    // The probe, so a forge that tells strangers only `ok` still says what it runs.
    const res = await fetch(`http://127.0.0.1:${port}/api/v1/health`, {
      headers: { connection: "close" },
      headers: { connection: "close", ...probe },
      signal: AbortSignal.timeout(2_000),
    });
    if (!res.ok) return undefined;
@@ -121,7 +123,7 @@
export async function bootProof(input: BootInput): Promise<BootProof> {
        const said = why(stderr);
        return { ok: false, line: `exited with ${child.exitCode} before it answered health${said ? `: ${said}` : ""}` };
      }
      const seen = await versionAt(port);
      const seen = await versionAt(port, probeHeaders(input.dataDir));
      if (seen === input.version) return { ok: true, ms: Math.round(performance.now() - started) };
      if (seen !== undefined) last = `health answered as ${seen}`;
      await Bun.sleep(POLL_MS);
@@ -24,6 +24,7 @@
import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
import { dirname, join } from "node:path";
import type { Subprocess } from "bun";
import { hkdfSync } from "node:crypto";
export const READY_GRACE_MS = 150_000;
const POLL_MS = 500;
@@ -122,10 +123,26 @@
export function rollbackNeed(dataDir: string): { sentence: string; since: string
  return { sentence: `Release ${r.from} did not become ready (${r.why}); rolled back to ${r.to}.`, since: r.at };
}
async function versionAt(port: number): Promise<string | undefined> {
/**
 * `kernel/probe.ts`'s `probeHeaders`, repeated: the launcher imports nothing
 * of the forge's, so a release can never break the thing that rolls it back.
 * The forge on `dataDir` tells its probe what it runs, a stranger only `ok`.
 */
export function probeHeaders(dataDir: string): Record<string, string> {
  let key: Buffer;
  try {
    key = readFileSync(join(dataDir, "secret.key"));
  } catch {
    return {};
  }
  if (key.length !== 32) return {};
  return { "x-forge-probe": Buffer.from(hkdfSync("sha256", key, "", "forge probe v1", 32)).toString("base64url") };
}
async function versionAt(port: number, probe: Record<string, string>): Promise<string | undefined> {
  try {
    const res = await fetch(`http://127.0.0.1:${port}/api/v1/health`, {
      headers: { connection: "close" },
      headers: { connection: "close", ...probe },
      signal: AbortSignal.timeout(2_000),
    });
    if (!res.ok) return undefined;
@@ -201,7 +218,7 @@
export async function launch(input: LaunchInput): Promise<Launched> {
      why = `it exited with ${release.exitCode ?? release.signalCode} before it was ready`;
      break;
    }
    if ((await versionAt(input.port)) === input.version) {
    if ((await versionAt(input.port, probeHeaders(input.dataDir))) === input.version) {
      try {
        keepGood(input.dataDir, input.tree, input.version, input.commit, now());
      } catch (error) {
@@ -12,6 +12,7 @@
import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import { smoke, type Failure } from "./smoke.ts";
import { UNSTAMPED } from "../kernel/version.ts";
import { ownProbeHeaders } from "../kernel/probe.ts";
/** How long the public URL has to answer as the new version. */
export const GIVE_UP_MS = 10 * 60_000;
@@ -92,7 +93,7 @@
export async function proveRelease(o: ProveOptions): Promise<Proof | undefined>
    const deadline = now() + (o.giveUpMs ?? GIVE_UP_MS);
    for (;;) {
      try {
        const res = await doFetch(health, { redirect: "manual", signal: AbortSignal.timeout(5_000) });
        const res = await doFetch(health, { redirect: "manual", headers: ownProbeHeaders(o.dataDir), signal: AbortSignal.timeout(5_000) });
        await res.body?.cancel();
        if (res.headers.get("x-forge-version") === o.version) break;
      } catch {
@@ -14,6 +14,7 @@
import { existsSync } from "node:fs";
import { join } from "node:path";
import { releaseDir } from "./checkout.ts";
import { startRelease, type SwapInput } from "./swap.ts";
import { ownProbeHeaders } from "../kernel/probe.ts";
export type Rollback = { ok: true; pid: number } | { ok: false; line: string };
@@ -59,5 +60,5 @@
export async function rollback(
  const live = liveSchema(dataDir);
  if (known < live)
    return { ok: false, line: `${sha} predates schema ${live}; rolling back would need a down-migration` };
  return startRelease({ ...swap, dir, sha });
  return startRelease({ ...swap, dir, sha, probe: ownProbeHeaders(dataDir) });
}
@@ -49,6 +49,8 @@
export function navigationBranch(source: string): string | null {
export interface Options {
  /** Wait for `/healthz` to report this `X-Forge-Version`. */
  version?: string | undefined;
  /** Sent with that wait: the forge tells only its probe its version (`kernel/probe.ts`). */
  probe?: Readonly<Record<string, string>>;
  /** Longest wait for it, in milliseconds. */
  waitMs?: number;
  /** Pause between polls, in milliseconds. */
@@ -80,14 +82,14 @@
export function isSignInRedirect(url: string, res: Response): boolean {
}
/** Polls `/healthz` until it reports `version`; null when it does, else a failure. */
async function waitForVersion(root: URL, version: string, waitMs: number, pollMs: number, fetch: typeof globalThis.fetch): Promise<Failure | null> {
async function waitForVersion(root: URL, version: string, waitMs: number, pollMs: number, fetch: typeof globalThis.fetch, probe: Readonly<Record<string, string>>): Promise<Failure | null> {
  const url = new URL("/healthz", root).href;
  const deadline = Date.now() + waitMs;
  let seen = "none";
  let status: number | string = "error";
  for (;;) {
    try {
      const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5_000) });
      const res = await fetch(url, { redirect: "manual", headers: probe, signal: AbortSignal.timeout(5_000) });
      await res.body?.cancel();
      status = res.status;
      seen = res.headers.get("x-forge-version") ?? "none";
@@ -109,7 +111,7 @@
export async function smoke(base: string, token = "", options: Options = {}): Pr
  const failures: Failure[] = [];
  const fetch = options.fetch ?? globalThis.fetch;
  if (options.version) {
    const late = await waitForVersion(root, options.version, options.waitMs ?? 120_000, options.pollMs ?? 1_000, fetch);
    const late = await waitForVersion(root, options.version, options.waitMs ?? 120_000, options.pollMs ?? 1_000, fetch, options.probe ?? {});
    if (late) return [late];
  }
@@ -32,6 +32,8 @@
export interface SwapInput {
  /** The environment the new forge starts with: the old one's, as it is. */
  env: Record<string, string | undefined>;
  budgetMs?: number;
  /** Sent with each health read (`kernel/probe.ts`), so the answer names its commit. */
  probe?: Readonly<Record<string, string>>;
}
/** Whether `body` is a health answer from `sha` that is well and not leaving. */
@@ -41,10 +43,10 @@
export function healthyAs(body: unknown, sha: string): boolean {
  return h.ok === true && h.draining !== true && h.commit === sha;
}
async function readHealth(port: number): Promise<unknown> {
async function readHealth(port: number, probe: Readonly<Record<string, string>>): Promise<unknown> {
  try {
    const res = await fetch(`http://127.0.0.1:${port}/api/v1/health`, {
      headers: { connection: "close" },
      headers: { connection: "close", ...probe },
      signal: AbortSignal.timeout(2_000),
    });
    return res.ok ? await res.json() : undefined;
@@ -77,7 +79,7 @@
export async function startRelease(input: SwapInput): Promise<Swapped> {
  while (Date.now() < deadline) {
    if (exited !== undefined)
      return { ok: false, line: `the new process exited with ${exited} before it was healthy` };
    if (healthyAs(await readHealth(input.port), input.sha)) {
    if (healthyAs(await readHealth(input.port, input.probe ?? {}), input.sha)) {
      proc.unref();
      return { ok: true, pid: proc.pid };
    }
@@ -35,7 +35,8 @@
export type LimitKey =
  | "signin.per_source"
  | "signin.per_forge"
  | "signup.per_source"
  | "signup.per_forge";
  | "signup.per_forge"
  | "api.anonymous_per_source";
export interface LimitDef {
  readonly label: string;
@@ -159,6 +160,14 @@
export const LIMITS: Record<LimitKey, LimitDef> = {
    max: 100_000,
    reason: "Spread across many sources, sign-ups still cost hashes and accounts, so the forge as a whole has a ceiling.",
  },
  "api.anonymous_per_source": {
    label: "API reads without a token per source a minute",
    unit: "reads",
    default: 300,
    min: 1,
    max: 100_000,
    reason: "A token's reads are counted by the token; a stranger's have no token to count, so one source reading without one has a ceiling of its own.",
  },
};
export const LIMIT_KEYS = Object.keys(LIMITS) as LimitKey[];
@@ -263,7 +263,9 @@
function runInput(ctx: Ctx, ref: string): CardInput | undefined {
      kind: "run",
      title: run.summary || "agent run",
      lines: [repoName, ...(thread ? [thread] : [])],
      stat: `${who ?? "agent"} · ${outcome(run)} · $${run.costUsd.toFixed(2)}`,
      // The card is drawn for anyone a link is pasted to, so it says no
      // cost: that is the owner's fact (`runForReader`, #2917).
      stat: `${who ?? "agent"} · ${outcome(run)}`,
    };
  }
  return {
@@ -178,7 +178,10 @@
describe("checks placed", () => {
      const run = await settled(await push("exit 0 # page"));
      expect(run.placement).toBe("job");
      const page = await (await globalThis.fetch(`${servers.url}/alice/lib/runs/${run.id}`)).text();
      expect(page).toContain("Ran as a cluster job on n7.");
      // A stranger reads that it was a cluster job, never on which node (#2917).
      expect(page).toContain("Ran as a cluster job.");
      expect(page).not.toContain("job on n7");
      expect(String(placementLine(run))).toContain("Ran as a cluster job on n7.");
      expect(runRows([run], new Map())[0]!.meta).toContain("ran as a cluster job on n7");
      expect(runPayload(run)).toMatchObject({ placement: "job", node: "n7" });
      const plain = { ...run, placement: "process", node: "" };
@@ -0,0 +1,34 @@
/**
 * The probe (`kernel/probe.ts`, #2917): what the release machinery sends to
 * be told what a forge runs. A caller reads the key and never writes it, and
 * the launcher's copy of the derivation is the forge's own.
 */
import { afterAll, expect, test } from "bun:test";
import { existsSync, mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { probeHeaders as launcherProbe } from "../src/release/launch.ts";
import { isProbe, PROBE_HEADER, probeFor, probeHeaders } from "../src/kernel/probe.ts";
const root = mkdtempSync(join(tmpdir(), "forge-probe-"));
afterAll(() => rmSync(root, { recursive: true, force: true }));
test("a caller with no key yet sends nothing, and leaves no key behind", () => {
  const data = join(root, "fresh");
  expect(probeHeaders(data)).toEqual({});
  expect(launcherProbe(data)).toEqual({});
  expect(existsSync(join(data, "secret.key"))).toBe(false);
});
test("the caller's probe, the launcher's and the forge's are one value", () => {
  const data = join(root, "keyed");
  const forge = probeFor(data);
  expect(probeHeaders(data)).toEqual({ [PROBE_HEADER]: forge });
  expect(launcherProbe(data)).toEqual({ [PROBE_HEADER]: forge });
  const asked = (value?: string) =>
    new Request("http://forge/healthz", value === undefined ? {} : { headers: { [PROBE_HEADER]: value } });
  expect(isProbe(asked(forge), data)).toBe(true);
  for (const wrong of [undefined, "", forge.slice(1), `${forge}x`, probeFor(join(root, "other"))])
    expect(isProbe(asked(wrong), data)).toBe(false);
});
@@ -7,6 +7,7 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { ownProbeHeaders } from "../src/kernel/probe.ts";
import { running } from "../src/kernel/version.ts";
import {
  forgeHealth,
@@ -84,7 +85,9 @@
afterAll(async () => {
});
test("/api/v1/health answers anyone, from the mounted ConfigMap", async () => {
  let res = await fetch(servers.url + "/api/v1/health");
  // The probe is told the platform's word; a stranger only whether all is well.
  const probe = { headers: ownProbeHeaders(app.config.dataDir) };
  let res = await fetch(servers.url + "/api/v1/health", probe);
  expect(res.status).toBe(200);
  let body = (await res.json()) as any;
  expect(body.ok).toBe(true);
@@ -99,9 +102,18 @@
test("/api/v1/health answers anyone, from the mounted ConfigMap", async () => {
  mkdirSync(guardDir, { recursive: true });
  writeFileSync(join(guardDir, "status.json"), status({ stuck: "quota refused <b>" }));
  writeFileSync(join(guardDir, "checkedAt"), new Date().toISOString());
  res = await fetch(servers.url + "/api/v1/health");
  res = await fetch(servers.url + "/api/v1/health", probe);
  body = await res.json();
  expect(body.rollout).toEqual({ state: "blocked", reason: "quota refused <b>" });
  expect(body.ok).toBe(false);
  expect(body.incidents).toEqual([{ key: "stuck", message: "quota refused <b>" }]);
  // A stranger, and one who guesses at the probe, hear it is not well and never why.
  for (const headers of [{}, { "x-forge-probe": "guess" }]) {
    const told = (await (await fetch(servers.url + "/api/v1/health", { headers })).json()) as any;
    expect(told.ok).toBe(false);
    expect(told.rollout).toBeUndefined();
    expect(told.incidents).toBeUndefined();
    expect(JSON.stringify(told)).not.toContain("quota");
  }
});
@@ -13,6 +13,7 @@
import {
  startDraining,
} from "../src/http/health.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { ownProbeHeaders } from "../src/kernel/probe.ts";
import { running } from "../src/kernel/version.ts";
import type { Log, LogFields } from "../src/kernel/log.ts";
@@ -103,9 +104,16 @@
describe("the served paths", () => {
    await rm(dataDir, { recursive: true, force: true });
  });
  test("/healthz names the running version and keeps the security headers", async () => {
    const res = await fetch(`${servers.url}/healthz`);
  test("/healthz names the running version to the probe alone and keeps the security headers", async () => {
    const res = await fetch(`${servers.url}/healthz`, { headers: ownProbeHeaders(dataDir) });
    expect(res.headers.get("x-forge-version")).toBe(running().version);
    // A stranger, or a guess at the probe, hears `ok` and nothing of the release (#2917).
    for (const headers of [{}, { "x-forge-probe": "guess" }]) {
      const told = await fetch(`${servers.url}/healthz`, { headers });
      expect(told.status).toBe(200);
      expect(await told.text()).toBe("ok");
      expect(told.headers.get("x-forge-version")).toBeNull();
    }
    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
    expect(res.headers.get("content-security-policy")).toBeTruthy();
  });
@@ -273,7 +273,7 @@
describe("og cards", () => {
      }
    });
    test("an agent run names its agent, thread, cost and outcome", async () => {
    test("an agent run names its agent, thread and outcome, never its cost", async () => {
      const repo = getRepo(app.db, "alice", "shown")!;
      const alice = getUserByName(app.db, "alice")!;
      const issue = getIssue(app.db, repo.id, 1)!;
@@ -288,10 +288,10 @@
describe("og cards", () => {
      const body = await (await get(`/og/run/alice~shown~${r.id}.svg`)).text();
      expect(body).toContain("alice");
      expect(body).toContain("#1 A public issue &lt;b&gt;");
      expect(body).toContain("$1.23");
      expect(body).not.toContain("$1.23");
      expect(body).toContain("landed a pull");
      app.db.query("UPDATE run SET summary = 'declined: too big', state = 'ok' WHERE id = ?1").run(r.id);
      expect(await (await get(`/og/run/alice~shown~${r.id}.svg`)).text()).toContain("declined ·");
      expect(await (await get(`/og/run/alice~shown~${r.id}.svg`)).text()).toContain("alice · declined");
      app.db.query("UPDATE run SET state = 'failed', summary = 'boom' WHERE id = ?1").run(r.id);
      expect(await (await get(`/og/run/alice~shown~${r.id}.svg`)).text()).toContain("failed");
      app.db.query("UPDATE run SET state = 'running' WHERE id = ?1").run(r.id);
@@ -0,0 +1,186 @@
/**
 * What a stranger may read of a repository's runs (#2917). A public
 * repository's runs answer anyone with what ran, why and how it ended —
 * never the agent session a follow-up resumes, the node a check ran on, or
 * what it cost; its writers read all of it. A private repository's runs are
 * a 404 to anyone it is not shared with, the same 404 as no repository.
 * Every door says the same: the API, the run page, MCP `now` and the
 * terminal's run rows all read through `runForReader`.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { listRepoRuns } from "../src/actions/runs.ts";
import { createApp as insertApp } from "../src/core/apps.ts";
import { getRepo, type Repo } from "../src/core/repos.ts";
import { claimRun, createRun, finishRun, noteRunProgress } from "../src/core/runs.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { forgeHttp, type ForgeHttp } from "../src/http/server.ts";
import { runRows } from "../src/tui/screens/runlist.ts";
import { appendRunLog } from "../src/runs/log.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const SESSION = "S3SSION-4f2a";
const NODE = "node-7b-pool";
let dataDir: string;
let app: App;
let http: ForgeHttp;
const token: Record<string, string> = {};
const runs: Record<string, string> = {};
const users: Record<string, User> = {};
let open: Repo;
const ok = <T>(r: { ok: true; value: T } | { ok: false; error: unknown }): T => {
  if (!r.ok) throw new Error(JSON.stringify(r.error));
  return r.value;
};
async function get(path: string, who?: string) {
  const res = await http.handle(
    new Request(`http://forge.test${path}`, {
      headers: who === undefined ? {} : { authorization: `Bearer ${token[who]}` },
    }),
  );
  return { status: res.status, text: await res.text() };
}
const user = async (username: string, adminIfFirst = false): Promise<User> =>
  ok(
    await createUser(app.db, {
      origin: "seed",
      trusted: true,
      username,
      email: `${username}@forge.local`,
      password: "a-good-passphrase",
      adminIfFirst,
    }),
  );
beforeAll(async () => {
  dataDir = await mkdtemp(join(tmpdir(), "forge-runs-stranger-"));
  app = createApp({ dataDir, port: 0 });
  http = forgeHttp(app);
  const alice = await user("alice", true);
  const mallory = await user("mallory");
  users.alice = alice;
  users.mallory = mallory;
  token.alice = createToken(app.db, alice.id, "t", "ro").token;
  token.mallory = createToken(app.db, mallory.id, "t", "ro").token;
  for (const [name, visibility] of [["open", "public"], ["closed", "private"]] as const) {
    const repo = ok(await createRepo(app, alice, { name, visibility }));
    ok(
      await commitToBranch(app, alice, repo, {
        message: "Start",
        files: [{ path: "README.md", content: `# ${name}\n` }],
      }),
    );
    const run = createRun(app.db, { repoId: repo.id, kind: "agent", actorId: alice.id, reason: "assigned" });
    claimRun(app.db, run.id);
    noteRunProgress(app.db, run.id, { sessionId: SESSION, costUsd: 1.25, placement: "job", node: NODE });
    appendRunLog(dataDir, run.id, "a line of the transcript");
    finishRun(app.db, run.id, { state: "ok", summary: `${name} done`, sessionId: SESSION, costUsd: 1.25, turns: 9 });
    runs[name] = run.id;
  }
  // The public repository is an app with a run under way, so MCP `now`
  // (which lists apps' live runs) has one to answer about.
  open = getRepo(app.db, "alice", "open")!;
  ok(insertApp(app.db, { repoId: open.id, slug: "open", access: "public" }));
  const live = createRun(app.db, { repoId: open.id, kind: "agent", actorId: alice.id, reason: "assigned" });
  claimRun(app.db, live.id);
  noteRunProgress(app.db, live.id, { sessionId: SESSION, costUsd: 0.5, placement: "job", node: NODE });
  runs.live = live.id;
}, 60_000);
async function now(who: string): Promise<Record<string, unknown>[]> {
  const res = await http.handle(
    new Request("http://forge.test/mcp", {
      method: "POST",
      headers: { "content-type": "application/json", authorization: `Bearer ${token[who]}` },
      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "now", arguments: {} } }),
    }),
  );
  expect(res.status).toBe(200);
  const answer = (await res.json()) as { result: { content: { text: string }[] } };
  return JSON.parse(answer.result.content[0]!.text) as Record<string, unknown>[];
}
afterAll(async () => {
  app?.close();
  await rm(dataDir, { recursive: true, force: true });
});
describe("runs a stranger reads", () => {
  test("a public repository's runs say what ran, never its session, node or cost", async () => {
    for (const who of [undefined, "mallory"]) {
      for (const path of ["/api/v1/repos/alice/open/runs", `/api/v1/repos/alice/open/runs/${runs.open}`]) {
        const res = await get(path, who);
        expect(res.status).toBe(200);
        expect(res.text).toContain("open done");
        expect(res.text).not.toContain(SESSION);
        expect(res.text).not.toContain(NODE);
        const body = JSON.parse(res.text) as { items?: Record<string, unknown>[] } & Record<string, unknown>;
        const run = body.items?.[0] ?? body;
        expect([run["costUsd"], run["turns"], run["sessionId"], run["node"]]).toEqual([0, 0, "", ""]);
      }
    }
  });
  test("its owner reads all of it", async () => {
    const res = await get(`/api/v1/repos/alice/open/runs/${runs.open}`, "alice");
    const run = JSON.parse(res.text) as Record<string, unknown>;
    expect([run["costUsd"], run["turns"], run["sessionId"], run["node"]]).toEqual([1.25, 9, SESSION, NODE]);
  });
  test("a private repository's runs are a 404 to a stranger, and the same 404 as no repository", async () => {
    const missing = await get("/api/v1/repos/alice/nothing-here/runs");
    expect(missing.status).toBe(404);
    for (const who of [undefined, "mallory"]) {
      for (const path of [
        "/api/v1/repos/alice/closed/runs",
        `/api/v1/repos/alice/closed/runs/${runs.closed}`,
        `/api/v1/repos/alice/closed/runs/${runs.closed}/log`,
      ]) {
        const res = await get(path, who);
        expect(res.status).toBe(404);
        expect(res.text).toBe(missing.text);
      }
    }
    expect((await get("/api/v1/repos/alice/closed/runs", "alice")).status).toBe(200);
  });
  test("the run page shows a stranger no node", async () => {
    const res = await get(`/alice/open/runs/${runs.open}`);
    expect(res.status).toBe(200);
    expect(res.text).toContain("open done");
    expect(res.text).not.toContain(NODE);
  });
  test("MCP now tells a stranger no node or cost, and the owner both", async () => {
    const theirs = (await now("mallory")).find((r) => r["run"] === runs.live);
    expect(theirs).toBeDefined();
    expect(JSON.stringify(theirs)).not.toContain(NODE);
    expect(theirs!["costUsd"]).toBe(0);
    const own = (await now("alice")).find((r) => r["run"] === runs.live);
    expect(own!["ran"]).toBe(`ran as a cluster job on ${NODE}`);
    expect(own!["costUsd"]).toBe(0.5);
  });
  test("the terminal's run rows show a stranger no node or cost, and the owner both", () => {
    const meta = (who: User | undefined) =>
      runRows(ok(listRepoRuns(app, who, open)), new Map()).map((row) => row.meta).join("\n");
    for (const who of [undefined, users.mallory]) {
      const rows = meta(who);
      expect(rows).not.toContain(NODE);
      expect(rows).not.toContain("$");
    }
    expect(meta(users.alice)).toContain(NODE);
    expect(meta(users.alice)).toContain("$1.25");
  });
});
@@ -0,0 +1,66 @@
/**
 * API reads without a credential are counted per source (#2917,
 * `http/stranger_reads.ts`): past the limit a stranger is told 429 and when
 * to come back; a token, the liveness probe and the pages are not counted
 * by it.
 */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { setLimit } from "../src/settings/limits.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const LIMIT = 4;
let dataDir: string;
let app: App;
let servers: Servers;
let token = "";
beforeAll(async () => {
  dataDir = await mkdtemp(join(tmpdir(), "forge-stranger-reads-"));
  app = createApp({ dataDir, port: 0 });
  servers = await serve(app);
  const made = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "alice",
    email: "[email protected]",
    password: "a-good-passphrase",
    adminIfFirst: true,
  });
  if (!made.ok) throw new Error(String(made.error));
  token = createToken(app.db, made.value.id, "t", "ro").token;
  const set = setLimit(app.db, "api.anonymous_per_source", LIMIT, made.value.id);
  if (!set.ok) throw new Error(set.error.message);
});
afterAll(async () => {
  servers.stop();
  app.close();
  await rm(dataDir, { recursive: true, force: true });
});
test("a stranger's API reads past the limit are refused with a wait; a token's and the probe's are not", async () => {
  const read = (headers: Record<string, string> = {}) =>
    fetch(`${servers.url}/api/v1/health`, { headers });
  for (let i = 0; i < LIMIT; i++) expect((await read()).status).toBe(200);
  const refused = await read();
  expect(refused.status).toBe(429);
  expect(((await refused.json()) as { error: string }).error).toBe("rate_limited");
  expect(Number(refused.headers.get("retry-after"))).toBeGreaterThan(0);
  expect(refused.headers.get("x-content-type-options")).toBe("nosniff");
  // A wrong token is still a stranger.
  expect((await read({ authorization: "Bearer not-a-token" })).status).toBe(429);
  // Counted elsewhere, or never: a token, liveness, readiness and a page.
  expect((await read({ authorization: `Bearer ${token}` })).status).toBe(200);
  expect((await fetch(`${servers.url}/healthz`)).status).toBe(200);
  expect((await fetch(`${servers.url}/readyz`)).status).toBe(200);
  expect((await fetch(`${servers.url}/explore`)).status).not.toBe(429);
});
@@ -6,6 +6,8 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createRun } from "../src/core/runs.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser } from "../src/core/users.ts";
import { vitals } from "../src/kernel/vitals.ts";
import { fetchInternal } from "../src/git/hook-address.ts";
import { serve, type Servers } from "../src/http/server.ts";
@@ -51,9 +53,17 @@
beforeAll(async () => {
  app = createApp({ dataDir, port: 0, disk: roomy });
  servers = await serve(app);
  await seedAdmin(app, { username: "alice", email: "[email protected]", password: "a-good-passphrase" });
  await post("/api/v1/users", { username: "bob", email: "[email protected]", password: "a-good-passphrase" });
  admin = await mint("alice", "ro");
  plain = await mint("bob", "admin");
  // Bob signs in and is no admin: his token, made directly, is a reader's.
  const bob = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "bob",
    email: "[email protected]",
    password: "a-good-passphrase",
  });
  if (!bob.ok) throw new Error(bob.error);
  plain = createToken(app.db, bob.value.id, "plain", "ro").token;
  repoId = (
    app.db.query("SELECT id FROM repo").get() as { id: string } | null
  )?.id ?? "";
@@ -88,14 +98,18 @@
test("a site admin with a read-only token gets the shape; others get the short o
  expect(v.disk.totalBytes).toBeGreaterThan(0);
  expect(v.memory.rssBytes).toBeGreaterThan(0);
  expect(v.apps).toEqual({ serving: 0, asleep: 0, previews: 0 });
  // Everyone else gets the platform's short shape, never the numbers.
  for (const token of [plain, undefined]) {
    const res = await health(token);
    expect(res.status).toBe(200);
    const short = (await res.json()) as Record<string, unknown>;
    expect(short["disk"]).toBeUndefined();
    expect(short["rollout"]).toBeDefined();
  }
  // A signed-in reader who is not an admin gets the platform's short shape,
  // never the numbers.
  expect(plain).not.toBe("");
  const res2 = await health(plain);
  expect(res2.status).toBe(200);
  const short = (await res2.json()) as Record<string, unknown>;
  expect(short["disk"]).toBeUndefined();
  expect(short["memory"]).toBeUndefined();
  expect(short["rollout"]).toBeDefined();
  // A stranger is told whether it is well, and no more (#2917).
  const stranger = (await (await health()).json()) as Record<string, unknown>;
  expect(Object.keys(stranger).sort()).toEqual(["commit", "draining", "ok", "version"]);
  expect((await fetch(servers.url + "/healthz")).status).toBe(200);
});
@@ -794,7 +794,8 @@
const FLOOR_POLICY =
  "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
/**
 * The floor, on one response: never sniffed, never a referrer off-site, and
 * The floor, on one response: never sniffed, never a referrer off-site, no
 * powers a page does not use, https once https, and
 * — unless the body is a document with a policy of its own — inert.
 */
function expectFloor(what: string, response: Response): void {
@@ -805,6 +806,13 @@
function expectFloor(what: string, response: Response): void {
  expect(label + response.headers.get("referrer-policy")).toBe(
    label + "same-origin",
  );
  // No powers a page does not use, and https once https (#2917).
  expect(label + response.headers.get("permissions-policy")).toContain(
    label + "camera=(), microphone=(), geolocation=()",
  );
  expect(label + response.headers.get("strict-transport-security")).toBe(
    label + "max-age=31536000",
  );
  const policy = response.headers.get("content-security-policy") ?? "";
  expect(label + (policy === "" ? "(none)" : "(a policy)")).toBe(
    label + "(a policy)",
		@@ -23,6 +23,7 @@
23	23	import { smoke } from "../src/release/smoke.ts";
24	24	import { webspec } from "../src/release/webspec.ts";
25	25	import { outsider } from "../src/release/outsider.ts";
	26	import { PROBE_HEADER } from "../src/kernel/probe.ts";
26	27	export * from "../src/release/smoke.ts";
27	28
28	29	if (import.meta.main) {
		@@ -41,7 +42,7 @@ if (import.meta.main) {
41	42	const base = args[0];
42	43	const seconds = wait === undefined ? 120 : Number(wait);
43	44	if (!base \|\| !Number.isFinite(seconds) \|\| seconds < 0 \|\| args.length > 1) {
44		console.error("usage: bun scripts/smoke.ts <url> [--version <v>] [--wait <seconds>] [--outsider] [--standards]");
	45	console.error("usage: bun scripts/smoke.ts <url> [--version <v>] [--wait <seconds>] [--outsider] [--standards] (--version needs FORGE_PROBE, the forge's probe)");
45	46	process.exit(2);
46	47	}
47	48	if (withOutsider && !process.env["FORGE_TOKEN"]) {
		@@ -56,7 +57,12 @@ if (import.meta.main) {
56	57	console.log(`standards: ${findings.length} finding(s) over ${paths.length} path(s); report only`);
57	58	process.exit(0);
58	59	}
59		const failures = await smoke(base, process.env["FORGE_TOKEN"] ?? "", { version, waitMs: seconds * 1000 });
	60	const failures = await smoke(base, process.env["FORGE_TOKEN"] ?? "", {
	61	version,
	62	waitMs: seconds * 1000,
	63	// The forge tells only its probe its version (`src/kernel/probe.ts`).
	64	...(process.env["FORGE_PROBE"] ? { probe: { [PROBE_HEADER]: process.env["FORGE_PROBE"] } } : {}),
	65	});
60	66	for (const f of failures)
61	67	console.error(`FAIL ${f.url} agent=${f.agent} status=${f.status} content-type=${f.contentType \|\| "-"} (${f.why})`);
62	68	const unrefused = withOutsider
		@@ -1,9 +1,17 @@
1	1	/**
2		* How the forge is, as it answers anyone who asks: the version and commit
3		* it runs, whether it is draining, and the platform's word on its rollout
4		* (`kernel/guard.ts`). A monitor has no account, so there is nothing to
5		* authorize. A site admin also gets the forge's own vitals alongside, and
6		* `ok` is then both.
	2	* How the forge is, as it answers whoever asks. A monitor has no account,
	3	* so anyone may ask; what it is told depends on who it is (#2917):
	4	*
	5	* - a stranger learns whether the forge is well and whether it is draining,
	6	* and nothing of the platform's incidents or rollout. It is also told the
	7	* version and commit for one release more — a running forge's swap reads
	8	* its successor's commit without a probe (`release/swap.ts` before #2917);
	9	* once that forge is gone the stranger's answer is `ok` alone.
	10	* - anyone signed in, and the forge's own release machinery carrying the
	11	* probe (`kernel/probe.ts`), get the whole answer: version, commit,
	12	* rollout and the platform's incidents.
	13	* - a site admin gets the whole answer and the forge's vitals alongside,
	14	* `ok` then being both.
7	15	*
8	16	* One answer for the API (`GET /api/v1/health`) and the MCP `health` tool.
9	17	*/
		@@ -51,11 +59,23 @@ export function forgeVitals(app: App): Vitals {
51	59	});
52	60	}
53	61
	62	/**
	63	* What a stranger is told: no incident, no rollout, no platform words.
	64	* Version and commit stay for one release, while a running forge's swap
	65	* reads its successor's commit without the probe; #2962 removes them.
	66	*/
	67	export type StrangerHealth = Pick<ForgeHealth, "ok" \| "version" \| "commit" \| "draining">;
	68
54	69	export function readHealth(
55	70	app: App,
56	71	actor: User \| undefined,
57		): ForgeHealth \| (Vitals & ForgeHealth) {
	72	probe = false,
	73	): StrangerHealth \| ForgeHealth \| (Vitals & ForgeHealth) {
		sentinelcrew 25d ago outdated Low: version and commit still reach strangers for compatibility. That is reasonable for one release, but open the follow-up issue that reduces this to `{ ok, draining }`.
58	74	const forge = forgeHealth();
	75	if (actor === undefined && !probe) {
	76	const { ok, version, commit, draining } = forge;
	77	return { ok, version, commit, draining };
	78	}
59	79	if (!actor?.isAdmin) return forge;
60	80	const v = forgeVitals(app);
61	81	return { ...v, ...forge, ok: forge.ok && v.ok };
		@@ -118,6 +118,23 @@ export function mayReadLogOfRun(
118	118	);
119	119	}
120	120
	121	/**
	122	* A run as this actor may read it. Its cost and turns are the owner's own
	123	* facts (`canSeeOwnerFacts`), and so is the machinery under it: the agent
	124	* session a follow-up resumes and the node it ran on (#2917). A reader who
	125	* cannot write here gets what ran, why and how it ended, never those — on
	126	* every door, since every door reads runs through here.
	127	*/
	128	export function runForReader(
	129	app: App,
	130	actor: User \| undefined,
	131	repo: Repo,
	132	): (run: Run) => Run {
	133	return canSeeOwnerFacts(app.db, repo, actor)
	134	? (run) => run
	135	: (run) => ({ ...run, costUsd: 0, turns: 0, sessionId: "", node: "" });
	136	}
	137
121	138	export function listRepoRuns(
122	139	app: App,
123	140	actor: User \| undefined,
		@@ -129,9 +146,9 @@ export function listRepoRuns(
129	146	if (!mayReadRuns(app, actor, repo)) return ok([]);
130	147	// A run on a sealed report, or its fix, is the report's (`core/sealed.ts`).
131	148	return ok(
132		queryRuns(app.db, repo.id, options).filter((r) =>
133		mayViewId(app.db, repo, r.issueId, actor),
134		),
	149	queryRuns(app.db, repo.id, options)
	150	.filter((r) => mayViewId(app.db, repo, r.issueId, actor))
	151	.map(runForReader(app, actor, repo)),
135	152	);
136	153	}
137	154
		@@ -160,7 +177,7 @@ export function getRepoRun(
160	177	const run = getRun(app.db, runId);
161	178	if (!run \|\| run.repoId !== repo.id) return err("not_found");
162	179	if (!mayViewId(app.db, repo, run.issueId, actor)) return err("not_found");
163		return ok(run);
	180	return ok(runForReader(app, actor, repo)(run));
164	181	}
165	182
166	183	export interface RunLogView {
		@@ -28,6 +28,7 @@ import { failuresOf } from "./failures.ts";
28	28	import { keepForgeGate } from "./gate_last.ts";
29	29	import { checksFor } from "./service.ts";
30	30	import { landVerdict, type LandVerdict } from "./tiers.ts";
	31	import { ownProbeHeaders } from "../kernel/probe.ts";
31	32
32	33	/**
33	34	* The full gate, once, on a commit that is what main would become — one
		@@ -165,7 +166,7 @@ async function swapIn(
165	166	);
166	167	return;
167	168	}
168		const swapped = await startRelease({ dir, sha, port, env: process.env,
	169	const swapped = await startRelease({ dir, sha, port, env: process.env, probe: ownProbeHeaders(app.config.dataDir),
169	170	...(app.config.swapBudgetMs === undefined ? {} : { budgetMs: app.config.swapBudgetMs }),
170	171	});
171	172	endSwap(swapped.ok);
		@@ -59,6 +59,7 @@ import { resendVerification } from "../actions/verify.ts";
59	59	import { CAPPED_WORDS } from "../actions/mail.ts";
60	60	import { emailVerified } from "../core/verify.ts";
61	61	import { readHealth } from "../actions/health.ts";
	62	import { isProbe } from "../kernel/probe.ts";
62	63	import { listChildren } from "../actions/spawn.ts";
63	64	import { forgeState, PARENT_HEADER } from "../spawn/clients.ts";
64	65	import { familyView } from "../spawn/family.ts";
		@@ -287,6 +288,7 @@ import {
287	288	checkOfCommit,
288	289	getRepoRun,
289	290	listRepoRuns,
	291	runForReader,
290	292	runLog,
291	293	} from "../actions/runs.ts";
292	294	import {
		@@ -4704,11 +4706,15 @@ export function apiRoutes(router: Router<Handler>): void {
4704	4706
4705	4707	// ---- apps, runs, and the crew (docs/APPS.md) ----
4706	4708
4707		// How the forge is, and the platform's word on its rollout: anyone may
4708		// read it (a monitor has no account). A site admin also gets the forge's
4709		// own vitals alongside, `ok` being both.
	4709	// How the forge is: anyone may ask (a monitor has no account), a stranger
	4710	// is told little, the release machinery's probe and a site admin the
	4711	// whole of it (`actions/health.ts`).
4710	4712	router.add("GET", "/api/v1/health", (ctx) =>
4711		json(readHealth(ctx.app, ctx.auth.user)),
	4713	json(
	4714	readHealth(ctx.app, ctx.auth.user, isProbe(ctx.request, ctx.app.config.dataDir)),
	4715	200,
	4716	{ "cache-control": "no-store", vary: "authorization, cookie, x-forge-probe" },
	4717	),
4712	4718	);
4713	4719
4714	4720	// Explore (#607): the rows /explore shows, for the same one line.
		@@ -5347,14 +5353,6 @@ export function apiRoutes(router: Router<Handler>): void {
5347	5353	return json({ url: link.value });
5348	5354	});
5349	5355
5350		// A run's cost and turn count are the owner's own facts (`canSeeOwnerFacts`,
5351		// same predicate the studio page uses) — a viewer who can only read a
5352		// public repository gets every other field, never those two.
5353		const runForViewer = (ctx: Ctx, repo: Repo) =>
5354		canSeeOwnerFacts(ctx.app.db, repo, ctx.auth.user)
5355		? (r: Run): Run => r
5356		: (r: Run): Run => ({ ...r, costUsd: 0, turns: 0 });
5357
5358	5356	// What the crew's runs here spent over a window (`core/usage.ts`):
5359	5357	// tokens, cost, wall time and outcome, by subscription, agent and issue.
5360	5358	// Spend is the owner's own fact, so a reader who cannot write gets 403.
		@@ -5450,8 +5448,9 @@ export function apiRoutes(router: Router<Handler>): void {
5450	5448	limit,
5451	5449	});
5452	5450	if (!runs.ok) return notFound();
5453		const forViewer = runForViewer(ctx, repo);
5454		return json(paged(runs.value.map(forViewer), limit, (r) => r.id));
	5451	// Already as this reader may see them (`runForReader`): a stranger's
	5452	// runs carry no cost, turns, agent session or node.
	5453	return json(paged(runs.value, limit, (r) => r.id));
5455	5454	});
5456	5455
5457	5456	router.add("GET", "/api/v1/repos/:owner/:name/runs/:id", (ctx) => {
		@@ -5461,7 +5460,7 @@ export function apiRoutes(router: Router<Handler>): void {
5461	5460	if (!run.ok) return notFound();
5462	5461	// The merged pulls a finished production deploy carries (`core/carried.ts`).
5463	5462	return json({
5464		...runForViewer(ctx, repo)(run.value),
	5463	...run.value,
5465	5464	carries: carriedBy(ctx.app.db, run.value.id),
5466	5465	});
5467	5466	});
		@@ -5489,9 +5488,7 @@ export function apiRoutes(router: Router<Handler>): void {
5489	5488	// The cost and turn count are the owner's own facts, same as the studio
5490	5489	// page beside this stream — a viewer who cannot write here never gets
5491	5490	// them, whether the page renders or a fetch asks this stream directly.
5492		const ownerFacts = canSeeOwnerFacts(ctx.app.db, repo, ctx.auth.user);
5493		const forViewer = (r: Run): Run =>
5494		ownerFacts ? r : { ...r, costUsd: 0, turns: 0 };
	5491	const forViewer = runForReader(ctx.app, ctx.auth.user, repo);
5495	5492	// Every line carries its number, so a browser that reconnects — a
5496	5493	// proxy in front of the forge cuts long responses — sends the last it
5497	5494	// saw and hears only what followed, never the log again from the top.
		@@ -183,7 +183,7 @@ import { COPIES_PER_DAY, makeItYours } from "../actions/make_it_yours.ts";
183	183	import { resourceMetadataUrl } from "./oauth.ts";
184	184	import { body, boundedBody, json } from "./respond.ts";
185	185	import type { Router } from "./router.ts";
186		import { mayReadRuns } from "../actions/runs.ts";
	186	import { mayReadRuns, runForReader } from "../actions/runs.ts";
187	187	import { manifestFor } from "../actions/here.ts";
188	188	import { clientBucket } from "./peer.ts";
189	189	import { deleteBoard, listAllBoards, showBoard, writeBoard, type BoardError } from "../actions/boards.ts";
		@@ -991,8 +991,11 @@ const TOOLS: readonly Tool[] = [
991	991	return good([
992	992	...waiting,
993	993	...reviewWaits,
994		...runs.map((r) => {
995		const repo = byId.get(r.repoId)!;
	994	...runs.map((run) => {
	995	const repo = byId.get(run.repoId)!;
	996	// As this caller may read it (`runForReader`): cost and node are
	997	// the owner's facts.
	998	const r = runForReader(ctx.app, user, repo)(run);
996	999	const issue =
997	1000	r.issueId === null
998	1001	? undefined
		@@ -1005,8 +1008,7 @@ const TOOLS: readonly Tool[] = [
1005	1008	why: r.reason,
1006	1009	state: r.state,
1007	1010	since: r.startedAt ?? r.createdAt,
1008		// What a run costs is the owner's fact (`canSeeOwnerFacts`).
1009		costUsd: owned.has(r.repoId) ? r.costUsd : 0,
	1011	costUsd: r.costUsd,
1010	1012	...(placementWords(r) === "" ? {} : { ran: placementWords(r) }),
1011	1013	};
1012	1014	}),
		@@ -118,10 +118,28 @@ export function prefersHtml(request: Request, pathname: string): boolean {
118	118	const FLOOR_POLICY =
119	119	"default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
120	120
	121	/**
	122	* The powers no page of the forge's uses, refused to it and to anything
	123	* framed in it: a script that ever slipped through still cannot ask for a
	124	* camera, a microphone, a location, a payment or a device (#2917).
	125	*/
	126	const PERMISSIONS_POLICY =
	127	"camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), hid=(), bluetooth=()";
	128
	129	/**
	130	* Once a browser has reached the forge over https, it never again asks over
	131	* plain http, for a year. Sent from the forge itself rather than left to an
	132	* edge that may not (#2917); a browser ignores it on an http answer, so a
	133	* forge on localhost is not pinned to a scheme it cannot serve. Subdomains
	134	* are not named: an app's host is not the forge's to promise.
	135	*/
	136	const HSTS = "max-age=31536000";
	137
121	138	/**
122	139	* The security floor every response the forge writes leaves with: never
123		* sniffed into another type, never a referrer sent off-site, and — unless
124		* the body is a document that wrote its own policy — inert.
	140	* sniffed into another type, never a referrer sent off-site, no powers a
	141	* page does not use, https once https, and — unless the body is a document
	142	* that wrote its own policy — inert.
125	143	*
126	144	* A responder that already set one of these keeps its value: `page()` has a
127	145	* nonce'd policy that must survive, and a fragment has a sandboxed one. The
		@@ -136,6 +154,10 @@ export function securityFloor(response: Response): Response {
136	154	headers.set("x-content-type-options", "nosniff");
137	155	if (!headers.has("referrer-policy"))
138	156	headers.set("referrer-policy", "same-origin");
	157	if (!headers.has("permissions-policy"))
	158	headers.set("permissions-policy", PERMISSIONS_POLICY);
	159	if (!headers.has("strict-transport-security"))
	160	headers.set("strict-transport-security", HSTS);
139	161	// What left decides, not what was asked for: an HTML body writes the
140	162	// only policy that can name its own nonce, and `default-src 'none'`
141	163	// over a page would strip it of its stylesheet.
		@@ -462,6 +462,8 @@ import { methodOf, noteUsage, roleOf, surfaceOf, takeUsage } from "./usage_tag.t
462	462	import { oauthRoutes } from "./oauth.ts";
463	463	import { flushAccess, recordAccess } from "./access_log.ts";
464	464	import { carryPeer, clientAddress, notePeer, type ProxyTrust } from "./peer.ts";
	465	import { isProbe } from "../kernel/probe.ts";
	466	import { takeStrangerRead } from "./stranger_reads.ts";
465	467	import { parseCidrs } from "../kernel/cidr.ts";
466	468	import {
467	469	reportAcceptSubmit,
		@@ -2328,8 +2330,10 @@ async function answerGet(
2328	2330	const dbStart = performance.now();
2329	2331	const live = liveResponse(() => app.db.query("select 1").get(), app.log);
2330	2332	noteDbTime(request, performance.now() - dbStart);
2331		// A smoke test learns which release answered, old pod or new.
2332		live.headers.set("X-Forge-Version", running().version);
	2333	// The release proof learns which release answered, old pod or new; a
	2334	// stranger is told only that one did (#2917).
	2335	if (isProbe(request, app.config.dataDir))
	2336	live.headers.set("X-Forge-Version", running().version);
2333	2337	return live;
2334	2338	}
2335	2339	if (url.pathname === "/readyz") {
		@@ -2398,6 +2402,20 @@ async function answerGet(
2398	2402	if (verdict !== undefined && !verdict.allowed) {
2399	2403	return withRateHeaders(tooManyRequests(verdict), verdict);
2400	2404	}
	2405	// A stranger's API reads have no token to count them by: their source does.
	2406	const stranger = isApiPath
	2407	? takeStrangerRead(app.db, request, credential !== undefined \|\| auth.user !== undefined)
	2408	: undefined;
	2409	if (stranger !== undefined && !stranger.allowed) {
	2410	return withRateHeaders(
	2411	apiError(
	2412	"rate_limited",
	2413	429,
	2414	`too many requests: ${stranger.limit} per minute from one source without a token — retry in ${stranger.retryAfter}s`,
	2415	),
	2416	stranger,
	2417	);
	2418	}
2401	2419
2402	2420	const themeCookie = cookieValue(request, "forge_theme") ?? "";
2403	2421	if (!isApiPath) {
		@@ -0,0 +1,42 @@
	1	/**
	2	* API reads without a credential, throttled per source (#2917). The token
	3	* limiter counts a token's requests; a stranger has none, so a loop reading
	4	* `/api/v1/...` with no token was never counted at all. Each source — the
	5	* peer as `http/peer.ts` resolves it, an IPv6 client by its /64 — may read
	6	* `api.anonymous_per_source` times a sliding minute (`/admin/limits`); a
	7	* refused read is not counted, so the door reopens a window later.
	8	*
	9	* Only reads (GET, HEAD) under `/api/`, only without a session or token: a
	10	* person in a browser and anything holding a token are counted elsewhere or
	11	* not at all, `/healthz` and `/readyz` are never reached by this (a probe
	12	* must not be throttled into a restart), and a request whose source the
	13	* listener did not note (an in-process answer) is not one source's to count.
	14	* One limiter per forge database, so a test's forge never throttles another's.
	15	*/
	16
	17	import type { Database } from "bun:sqlite";
	18	import { limitsFromEnv, RateLimiter, type Verdict } from "../core/ratelimit.ts";
	19	import { limitValue } from "../settings/limits.ts";
	20	import { clientAddress, clientBucket } from "./peer.ts";
	21
	22	/** Each forge's limiter, or null when FORGE_RATE_LIMIT=0 turned every request limit off. */
	23	const limiters = new WeakMap<Database, RateLimiter \| null>();
	24
	25	/**
	26	* Count one read without a credential from `request`'s source; the verdict,
	27	* or undefined when this request is not one this limit counts.
	28	*/
	29	export function takeStrangerRead(db: Database, request: Request, credentialed: boolean): Verdict \| undefined {
	30	if (credentialed) return undefined;
	31	if (request.method !== "GET" && request.method !== "HEAD") return undefined;
	32	if (clientAddress(request) === "unknown") return undefined;
	33	let limiter = limiters.get(db);
	34	if (limiter === undefined) {
	35	limiter = limitsFromEnv().enabled ? new RateLimiter() : null;
	36	limiters.set(db, limiter);
	37	}
	38	if (limiter === null) return undefined;
	39	// Read on every request, so a change on /admin/limits governs the next one.
	40	limiter.setLimits({ perMinute: limitValue(db, "api.anonymous_per_source"), adminPerMinute: 0, enabled: true });
	41	return limiter.take(`source:${clientBucket(request)}`, "ro");
		sentinelcrew 25d ago Low: this re-reads the setting and calls setLimits on every anonymous API read. That is cheap, so it's fine. Just note that the bucket is only as good as the proxy-trust config; without it, every stranger behind the ingress shares one key.
	42	}
		@@ -0,0 +1,68 @@
	1	/**
	2	* The probe: how the forge's own release machinery asks a forge what it
	3	* runs without being an admin or a stranger (#2917). A stranger asking
	4	* `/api/v1/health` or `/healthz` learns that the forge is up; the release
	5	* that swaps in its successor, the launcher that boots an image, and the
	6	* proof that reads the public URL need its version and commit too.
	7	*
	8	* Each of those holds the data directory the forge answers from, so the
	9	* credential is derived from that directory's `secret.key` (HKDF, purpose
	10	* "probe") and sent as `X-Forge-Probe`. A process that can read the key
	11	* already owns the forge; nothing else can produce the value. It never
	12	* reuses the key that seals tokens or signs passports.
	13	*/
	14
	15	import { hkdfSync, timingSafeEqual } from "node:crypto";
	16	import { readFileSync } from "node:fs";
	17	import { join } from "node:path";
	18	import { loadKey } from "./secret.ts";
	19
	20	export const PROBE_HEADER = "x-forge-probe";
	21
	22	/** The probe a key derives. `release/launch.ts` repeats these lines: it imports nothing of the forge's. */
	23	export function probeOfKey(key: Uint8Array): string {
	24	return Buffer.from(hkdfSync("sha256", key, "", "forge probe v1", 32)).toString("base64url");
	25	}
	26
	27	const probes = new Map<string, { key: Buffer; probe: string }>();
	28
	29	/** The probe the forge answering from `dataDir` honours: its own key's. */
	30	export function probeFor(dataDir: string): string {
	31	const key = loadKey(dataDir);
	32	const hit = probes.get(dataDir);
	33	// Keyed on the loaded key, as passports are: a rotation picks up a new probe.
	34	if (hit?.key.equals(key)) return hit.probe;
	35	const probe = probeOfKey(key);
	36	probes.set(dataDir, { key, probe });
	37	return probe;
	38	}
	39
	40	/** The header the forge on `dataDir` sends when it probes itself (its public URL). */
	41	export function ownProbeHeaders(dataDir: string): Record<string, string> {
	42	return { [PROBE_HEADER]: probeFor(dataDir) };
	43	}
	44
	45	/**
	46	* The header a caller sends to be answered as a probe of the forge on
	47	* `dataDir`. Read fresh and never written: a caller polls a child that
	48	* creates its key as it boots, and two processes each creating one would
	49	* leave them disagreeing for good. No key yet is no header.
	50	*/
	51	export function probeHeaders(dataDir: string): Record<string, string> {
	52	let key: Buffer;
	53	try {
	54	key = readFileSync(join(dataDir, "secret.key"));
	55	} catch {
	56	return {};
	57	}
	58	return key.length === 32 ? { [PROBE_HEADER]: probeOfKey(key) } : {};
	59	}
	60
	61	/** Whether `request` carries this forge's probe; a missing or wrong one is false. */
	62	export function isProbe(request: Request, dataDir: string): boolean {
	63	const said = request.headers.get(PROBE_HEADER);
	64	if (said === null \|\| said === "") return false;
	65	const want = Buffer.from(probeFor(dataDir));
	66	const got = Buffer.from(said);
	67	return got.length === want.length && timingSafeEqual(got, want);
	68	}