bare-operating-system/packages/bare-os-booter/lib/host/host-delegate-registry.js

/**
 * Host-backed CLI delegates (git, curl, wget, systemctl family) with optional allowlist.
 * When `BARE_OS_DELEGATE_ALLOW` is unset or empty, all registered delegates are allowed.
 * When set (comma-separated), only listed kinds run: `git`, `curl`, `wget`, `openssl`, `ssh-keygen`, `tar`, `systemctl`, `warc`, `archive`, `hrpc`, `bundlebee`, `sidecar`, `pear_runtime_matrix`, etc.
 */

import path from '#host-path'
import { runCurlCli } from './curl-cli.js'
import { runGitCli } from './git-cli.js'
import { runSystemctlCli } from './systemctl-cli.js'
import { runArchiveCli } from './archive-cli.js'
import { runTarCli } from './tar-cli.js'
import { runWarcCli } from './warc-cli.js'
import { runWgetCli } from './wget-cli.js'
import {
  runBundlebeeCli,
  runHrpcCli,
  runPearRuntimeMatrixCli,
  runSidecarCli
} from './host-bridge-cli.js'

/** @typedef {{ kind: string, describe: () => string, shouldDelegate: (cmd: string) => boolean, run: (ctx: Record<string, unknown>, argv: string[]) => Promise<unknown> }} BareOsHostDelegate */

/** @returns {Set<string> | null} */
export function parseDelegateAllowSet(env) {
  const raw = env && env.BARE_OS_DELEGATE_ALLOW
  const profile = String(env?.BARE_OS_ZERO_TRUST_PROFILE || '')
    .trim()
    .toLowerCase()
  if (raw == null || raw === '') {
    if (profile === 'strict' || profile === 'security') return new Set()
    return null
  }
  const s = String(raw).trim()
  if (s === '0' || s === 'false') return null
  const out = new Set(
    s
      .split(/[\s,]+/)
      .map((x) => x.trim().toLowerCase())
      .filter(Boolean)
  )
  return out.size ? out : null
}

/**
 * @param {string} kind
 * @param {Set<string> | null} allow
 */
export function isDelegateKindAllowed(kind, allow) {
  if (!allow) return true
  if (allow.size === 0) return false
  return allow.has(String(kind).toLowerCase())
}

/**
 * @returns {BareOsHostDelegate[]}
 */
export function loadBareOsHostDelegates() {
  return [
    {
      kind: 'git',
      describe: () => 'git (isomorphic-git)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'git')
      },
      run: (ctx, argv) => runGitCli(ctx, argv)
    },
    {
      kind: 'curl',
      describe: () => 'curl (fetch)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'curl')
      },
      run: (ctx, argv) => runCurlCli(ctx, argv)
    },
    {
      kind: 'wget',
      describe: () => 'wget (fetch)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'wget')
      },
      run: (ctx, argv) => runWgetCli(ctx, argv)
    },
    {
      kind: 'openssl',
      describe: () => 'openssl (bare-crypto subset)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'openssl')
      },
      async run(ctx, argv) {
        const { runOpensslCli } = await import('./openssl-cli.js')
        return runOpensslCli(ctx, argv)
      }
    },
    {
      kind: 'ssh-keygen',
      describe: () => 'ssh-keygen (ed25519, bare-crypto)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'ssh-keygen')
      },
      async run(ctx, argv) {
        const { runSshKeygenCli } = await import('./ssh-keygen-cli.js')
        return runSshKeygenCli(ctx, argv)
      }
    },
    {
      kind: 'tar',
      describe: () => 'tar (ustar VFS)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'tar')
      },
      run: (ctx, argv) => runTarCli(ctx, argv)
    },
    {
      kind: 'systemctl',
      describe: () => 'systemctl / bare-initctl / journalctl',
      shouldDelegate(cmd) {
        const base = cmd.includes('/') ? cmd.split('/').pop() : cmd
        return (
          base === 'systemctl' ||
          base === 'bare-initctl' ||
          base === 'journalctl'
        )
      },
      run: (ctx, argv) => runSystemctlCli(ctx, argv)
    },
    {
      kind: 'hrpc',
      describe: () =>
        'hrpc (probe / request; host replaces ctx.bareOsHrpcRequest when BARE_OS_HRPC_BRIDGE_WIRED=1)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'hrpc')
      },
      run: (ctx, argv) => runHrpcCli(ctx, argv)
    },
    {
      kind: 'bundlebee',
      describe: () =>
        'bundlebee (hint / status; emits bare-os:bundlebee-cli; BARE_OS_BUNDLEBEE_STAGE_JSON)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'bundlebee')
      },
      run: (ctx, argv) => runBundlebeeCli(ctx, argv)
    },
    {
      kind: 'warc',
      describe: () => 'warc (WARC 1.0 list / write-response via VFS)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'warc')
      },
      run: (ctx, argv) => runWarcCli(ctx, argv)
    },
    {
      kind: 'archive',
      describe: () => 'archive (ustar tar compatibility front-end)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'archive')
      },
      run: (ctx, argv) => runArchiveCli(ctx, argv)
    },
    {
      kind: 'sidecar',
      describe: () =>
        'sidecar cap (ctx.bareOsSidecarResourceCap; BARE_OS_SIDECAR_BRIDGE_WIRED for host listeners)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'sidecar')
      },
      run: (ctx, argv) => runSidecarCli(ctx, argv)
    },
    {
      kind: 'pear_runtime_matrix',
      describe: () =>
        'pear-runtime-matrix (ctx.bareOsPearRuntimeMatrixProbe; BARE_OS_PEAR_RUNTIME_MATRIX_JSON)',
      shouldDelegate(cmd) {
        return matchBasename(cmd, 'pear-runtime-matrix')
      },
      run: (ctx, argv) => runPearRuntimeMatrixCli(ctx, argv)
    }
  ]
}

/**
 * @param {string} cmd
 * @param {string} base
 */
function matchBasename(cmd, base) {
  if (cmd === base) return true
  if (!cmd.includes('/')) return false
  const b = path.posix.basename(cmd)
  if (b !== base) return false
  if (cmd.startsWith('./') || cmd.startsWith('../')) return false
  return true
}