awoooi/agent99-signoz-credential-provisioner.ps1

param(
  [ValidateSet("Check", "Apply", "Verify")]
  [string]$Mode = "Check",
  [Parameter(Mandatory = $true)][string]$TraceId,
  [Parameter(Mandatory = $true)][string]$RunId,
  [Parameter(Mandatory = $true)][string]$WorkItemId,
  [Parameter(Mandatory = $true)][string]$SourceRevision,
  [string]$AgentRoot = "C:\Wooo\Agent99"
)

$ErrorActionPreference = "Stop"
$TargetHost = "192.168.0.110"
$RemoteUser = "wooo"
$IdentityFile = Join-Path $AgentRoot "keys\agent99_ed25519"
$EvidenceDir = Join-Path $AgentRoot "evidence"
$RuntimeManifestPath = Join-Path $AgentRoot "state\runtime-manifest.json"
$EntrypointPath = [string]$MyInvocation.MyCommand.Path
$TargetProgram = Join-Path (Split-Path -Parent ([string]$MyInvocation.MyCommand.Path)) "agent99-signoz-credential-target.py"
$SafeIdPattern = "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
$ExpectedWorkItemId = "P0-OBS-002"
$ExpectedRuntimeFileCount = 20
$EvidenceRunId = if ($RunId -match $SafeIdPattern) { $RunId } else { "invalid-$PID" }
$EvidencePath = Join-Path $EvidenceDir "agent99-signoz-credential-$($Mode.ToLowerInvariant())-$EvidenceRunId.json"

function Test-RuntimeBinding {
  if (-not (Test-Path -LiteralPath $RuntimeManifestPath -PathType Leaf)) { return $false }
  if (-not (Test-Path -LiteralPath $TargetProgram -PathType Leaf)) { return $false }
  try {
    $manifest = Get-Content -LiteralPath $RuntimeManifestPath -Raw | ConvertFrom-Json
    if (
      -not [bool]$manifest.runtimeMatched -or
      [int]$manifest.fileCount -ne $ExpectedRuntimeFileCount -or
      [int]$manifest.mismatchCount -ne 0 -or
      [string]$manifest.sourceRevision -ne $SourceRevision
    ) { return $false }
    foreach ($name in @("agent99-signoz-credential-provisioner.ps1", "agent99-signoz-credential-target.py")) {
      $rows = @($manifest.files | Where-Object { [string]$_.name -eq $name })
      if ($rows.Count -ne 1) { return $false }
      $path = if ($name -eq "agent99-signoz-credential-provisioner.ps1") {
        $EntrypointPath
      } else { $TargetProgram }
      if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return $false }
      $hash = (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()
      if ([string]$rows[0].runtimeSha256 -ne $hash) { return $false }
    }
    return $true
  } catch { return $false }
}

function Invoke-FixedTargetProgram {
  $sshArguments = @(
    "-i", $IdentityFile,
    "-o", "BatchMode=yes",
    "-o", "IdentitiesOnly=yes",
    "-o", "StrictHostKeyChecking=yes",
    "-o", "NumberOfPasswordPrompts=0",
    "-o", "ConnectTimeout=8",
    "-o", "ServerAliveInterval=20",
    "-o", "ServerAliveCountMax=3",
    "-l", $RemoteUser,
    $TargetHost,
    "sudo -n /usr/bin/python3 - --mode $($Mode.ToLowerInvariant())"
  )
  $token = [Guid]::NewGuid().ToString("N")
  $stdoutPath = Join-Path $env:TEMP "agent99-signoz-credential-$token.out"
  $stderrPath = Join-Path $env:TEMP "agent99-signoz-credential-$token.err"
  try {
    $process = Start-Process -FilePath "ssh.exe" -ArgumentList $sshArguments `
      -RedirectStandardInput $TargetProgram -RedirectStandardOutput $stdoutPath `
      -RedirectStandardError $stderrPath -NoNewWindow -PassThru
    if (-not $process.WaitForExit(180000)) {
      try { & taskkill.exe /PID $process.Id /T /F 2>&1 | Out-Null } catch {}
      throw "target_timeout"
    }
    $process.WaitForExit() | Out-Null
    $stdout = if (Test-Path -LiteralPath $stdoutPath) {
      ([IO.File]::ReadAllText($stdoutPath, [Text.Encoding]::UTF8)).Trim()
    } else { "" }
    if ($stdout.Length -gt 8192) { throw "target_output_too_large" }
    try { $result = $stdout | ConvertFrom-Json } catch { throw "target_receipt_invalid" }
    if ($process.ExitCode -ne 0 -or [string]$result.terminal -eq "failed") {
      $code = if ($result.PSObject.Properties["error_code"]) { [string]$result.error_code } else { "target_failed" }
      throw $code
    }
    return $result
  } finally {
    Remove-Item -LiteralPath $stdoutPath, $stderrPath -Force -ErrorAction SilentlyContinue
    if ((Test-Path -LiteralPath $stdoutPath) -or (Test-Path -LiteralPath $stderrPath)) {
      throw "transient_transport_cleanup_failed"
    }
  }
}

New-Item -ItemType Directory -Path $EvidenceDir -Force | Out-Null
$receipt = [ordered]@{
  schema = "awoooi_agent99_signoz_credential_receipt_v1"
  trace_id = $TraceId
  run_id = $RunId
  work_item_id = $WorkItemId
  source_revision = $SourceRevision
  mode = $Mode.ToLowerInvariant()
  target_host = $TargetHost
  credential_path = "/etc/awoooi/secrets/signoz-metadata-api-key"
  terminal = "failed_closed"
  runtime_binding_verified = $false
  secret_in_transport = $false
  target = $null
}

try {
  if ($TraceId -notmatch $SafeIdPattern -or $RunId -notmatch $SafeIdPattern) { throw "invalid_identity" }
  if ($WorkItemId -ne $ExpectedWorkItemId) { throw "invalid_work_item" }
  if ($SourceRevision -notmatch "^[0-9a-f]{40}$") { throw "invalid_source_revision" }
  if (-not (Test-RuntimeBinding)) { throw "runtime_source_binding_failed" }
  $receipt.runtime_binding_verified = $true
  $target = Invoke-FixedTargetProgram
  $allowedTerminal = switch ($Mode) {
    "Check" { "check_pass_no_write" }
    "Apply" { "applied_verified" }
    "Verify" { "verify_pass" }
  }
  if ([string]$target.terminal -ne $allowedTerminal) { throw "unexpected_target_terminal" }
  $receipt.target = $target
  $receipt.terminal = $allowedTerminal
} catch {
  $receipt.error_code = [string]$_.Exception.Message
}

if (Test-Path -LiteralPath $EvidencePath) { throw "evidence_destination_exists" }
$json = $receipt | ConvertTo-Json -Depth 8
$bytes = [Text.Encoding]::UTF8.GetBytes($json)
$stream = [IO.File]::Open($EvidencePath, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() }
$json
if ([string]$receipt.terminal -notin @("check_pass_no_write", "applied_verified", "verify_pass")) { exit 1 }