open-swe/deploy/seahaven/fetch-config.sh

#!/usr/bin/env bash
# fetch-config.sh — AWS-sourced boot hook that materializes the app's .env.
#
# The stock `langgraph dev` runtime + the Open SWE app read a plain `.env` from
# the app working directory (python-dotenv). On the AWS lift-and-shift we do NOT
# commit a .env; instead every non-sensitive value lives in SSM Parameter Store
# (`/open-swe-<env>/*`) and every secret lives in AWS Secrets Manager
# (`open-swe-<env>/*`). This hook is run by systemd BEFORE the service starts; it
# pulls both sources via the EC2 instance role (no static keys), assembles a
# single .env on a tmpfs, and writes it owned by the unprivileged service user
# `chmod 600` (T5 SC-01: the privileged pre-hook materializes the secret; the app
# itself then runs as that NON-root service user, not root).
#
# It is intentionally FAIL-FAST: if any required secret/param is missing or empty
# it prints the offending variable NAMES (never values) and exits 1, so the
# service never starts with a partial .env.
#
# ---------------------------------------------------------------------------
# Naming contract (source of truth: T9 env/secret/config inventory)
#   SSM      /open-swe-<env>/<ENV_VAR_NAME>      -> exported as ENV_VAR_NAME
#   Secrets  open-swe-<env>/<ENV_VAR_NAME>       -> exported as ENV_VAR_NAME
# i.e. the last path segment IS the literal environment-variable name. This is a
# deliberate (documented) deviation from the handbook's kebab-case value-name
# example (`my-stack/slack-signing`): a .env materializer needs a lossless,
# unambiguous round-trip from store key -> env var, and the env var name is the
# only key that guarantees that. The `open-swe-<env>` stack prefix still follows
# kebab-case per naming-conventions.md.
# ---------------------------------------------------------------------------
#
# Wiring into systemd (AWS EC2 variant):
#   The unit runs as the unprivileged service user (User=openswe). ONLY the
#   ExecStartPre pre-hook runs as root (the `+` prefix) so it can pull from AWS,
#   write the tmpfs .env, and chown it to the service user. The app (ExecStart)
#   and the seeder (ExecStartPost) then run as openswe and read the openswe-owned
#   0600 .env — the agent never runs as root (T5 SC-01). Pass the env as the
#   positional arg (T5 BOOT-01):
#
#     [Service]
#     User=openswe
#     Group=openswe
#     Environment=ENV_DIR=/run/open-swe SERVICE_USER=openswe
#     # ExecStartPre runs as root (+) so it can chown the .env to the service user.
#     ExecStartPre=+/opt/open-swe/deploy/seahaven/fetch-config.sh prod
#     ExecStart=/opt/open-swe/.venv/bin/langgraph dev --host 127.0.0.1 --port 2024 \
#               --no-browser --no-reload
#     ExecStartPost=/opt/open-swe/deploy/seahaven/seed_store.sh prod
#
#   tmpfs: /run is already a tmpfs on systemd hosts, so ENV_DIR=/run/open-swe is
#   tmpfs-backed by default (the .env never touches disk). Set RUN_DEDICATED_TMPFS=1
#   to mount a private tmpfs at ENV_DIR instead. The app's CWD `.env` is a symlink
#   into ENV_DIR (created idempotently below), so python-dotenv finds it unchanged.
#
# Idempotent, re-runnable on every (re)start. No secret is ever echoed.

set -euo pipefail
umask 077

# --- Inputs ------------------------------------------------------------------
ENV="${1:-${OPENSWE_ENV:-}}"
case "$ENV" in
  dev | prod) ;;
  *)
    echo "fetch-config: ENV must be 'dev' or 'prod' (got '${ENV:-<empty>}')" >&2
    echo "usage: fetch-config.sh <dev|prod>   (or set OPENSWE_ENV)" >&2
    exit 2
    ;;
esac

REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}"
SSM_PREFIX="/open-swe-${ENV}/"
SECRET_PREFIX="open-swe-${ENV}/"

ENV_DIR="${ENV_DIR:-/run/open-swe}"          # tmpfs-backed (/run) by default
ENV_FILE="${ENV_DIR}/.env"
APP_DIR="${APP_DIR:-/opt/open-swe}"           # where the app + its CWD .env live
APP_ENV_LINK="${APP_DIR}/.env"                # symlink -> ENV_FILE

# The unprivileged service user that runs the app and OWNS the .env (T5 SC-01).
# fetch-config runs as root (ExecStartPre=+) only to chown the secret to it.
SERVICE_USER="${SERVICE_USER:-openswe}"
SERVICE_GROUP="${SERVICE_GROUP:-${SERVICE_USER}}"

# Sea Haven owner guard inputs (applied after the store is read, below). The owner
# normally comes from SSM /open-swe-<env>/DEFAULT_REPO_OWNER; OPENSWE_REPO_OWNER is an
# explicit operator override that wins over the store. FORBIDDEN = the upstream org
# the fork must never target; SAFE = the fallback when the resolved owner is blank or
# forbidden. (Upper/lower + whitespace are normalized before the guard check.)
OPENSWE_REPO_OWNER="${OPENSWE_REPO_OWNER:-}"
FORBIDDEN_REPO_OWNER="langchain-ai"
# Fallback org when the resolved owner is blank/forbidden — PER-ENV (mirrors the
# iacManagedSsm owner) so a dev box can NEVER fall back into the real Sea Haven org;
# it stays isolated in its own dev org. Defends the blank/upstream cases in-env.
case "$ENV" in
  dev) SAFE_REPO_OWNER="seahaven-open-swe-dev" ;;
  *) SAFE_REPO_OWNER="Sea-Haven-Industries" ;;
esac

for bin in aws jq; do
  command -v "$bin" >/dev/null 2>&1 || { echo "fetch-config: '$bin' not found on PATH" >&2; exit 3; }
done

log() { echo "fetch-config[$ENV]: $*"; }   # NAMES/counts only — never values
b64d() { base64 --decode; }                # GNU coreutils on the EC2 host

# Accept a store key into VARS iff it is a valid env-var identifier and not a
# duplicate. Rejects non-identifier names (T5 SH-INJ-002 / set -e DoS hardening)
# and flat-namespace collisions (T5 SSM-05). $3 = source label for logs.
accept_var() {
  local key="$1" value="$2" src="$3"
  if ! [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
    log "WARNING: skipping ${src} key with non-identifier name (rejected)"
    return 0
  fi
  if [ -n "${VARS[$key]+set}" ]; then
    echo "fetch-config[$ENV]: FAIL-FAST — duplicate key '${key}' from ${src} (flat-namespace collision)" >&2
    exit 1
  fi
  VARS["$key"]="$value"
}

# --- tmpfs ------------------------------------------------------------------
mkdir -p "$ENV_DIR"
# Owned by the service user so the unprivileged app can traverse it (T5 SC-01).
chown "${SERVICE_USER}:${SERVICE_GROUP}" "$ENV_DIR" 2>/dev/null || true
chmod 700 "$ENV_DIR"
if [ "${RUN_DEDICATED_TMPFS:-0}" = "1" ] && ! mountpoint -q "$ENV_DIR"; then
  mount -t tmpfs -o nosuid,nodev,noexec,mode=0700,size=4m tmpfs "$ENV_DIR"
  log "mounted dedicated tmpfs at $ENV_DIR"
fi

# --- Collect values into an associative array --------------------------------
declare -A VARS=()

# 1) SSM Parameter Store (non-sensitive config). NOT --recursive: the contract is
#    a FLAT namespace /open-swe-<env>/<VAR>, so a non-recursive list returns exactly
#    those keys and cannot collapse two nested paths onto one name (T5 SSM-05). aws
#    CLI v2 auto-paginates NextToken.
log "reading SSM params under ${SSM_PREFIX} ..."
ssm_json="$(
  aws ssm get-parameters-by-path \
    --path "$SSM_PREFIX" \
    --with-decryption \
    --region "$REGION" \
    --no-cli-pager \
    --output json
)"
# Records are base64-encoded (name<TAB>value) so values with spaces/newlines/tabs
# survive the line-based read intact.
ssm_count=0
while IFS=$'\t' read -r nb vb; do
  [ -n "$nb" ] || continue
  name="$(printf '%s' "$nb" | b64d)"
  value="$(printf '%s' "$vb" | b64d; printf 'x')"; value="${value%x}"
  key="${name##*/}"                        # strip /open-swe-<env>/ prefix
  [ -n "$key" ] || continue
  accept_var "$key" "$value" "SSM"
  ssm_count=$((ssm_count + 1))
done < <(jq -r '.Parameters[] | (.Name|@base64) + "\t" + (.Value|@base64)' <<<"$ssm_json")
log "loaded ${ssm_count} config param(s) from SSM"

# 2) Secrets Manager (sensitive values). batch-get-secret-value filters by name
#    prefix; one secret per env var, SecretString = the value. The AWS CLI does NOT
#    auto-paginate this operation (unlike list/get-parameters-by-path), and a single
#    response caps well under the full set (~10 items/page) — so we MUST follow
#    NextToken ourselves or secrets on later pages are silently dropped (they then
#    surface as FAIL-FAST "missing required var"). `--no-cli-pager` only disables the
#    OUTPUT pager, not API pagination. Each page's records are base64(name<TAB>value).
batch_get_secrets_tsv() {
  local token="" page
  while :; do
    if [ -n "$token" ]; then
      page="$(aws secretsmanager batch-get-secret-value \
        --filters "Key=name,Values=${SECRET_PREFIX}" \
        --region "$REGION" --no-cli-pager --output json --next-token "$token")"
    else
      page="$(aws secretsmanager batch-get-secret-value \
        --filters "Key=name,Values=${SECRET_PREFIX}" \
        --region "$REGION" --no-cli-pager --output json)"
    fi
    printf '%s' "$page" \
      | jq -r '.SecretValues[] | select(.SecretString != null) | (.Name|@base64) + "\t" + (.SecretString|@base64)'
    token="$(printf '%s' "$page" | jq -r '.NextToken // empty')"
    [ -n "$token" ] || break
  done
}

log "reading secrets under ${SECRET_PREFIX} ..."
secret_count=0
while IFS=$'\t' read -r nb vb; do
  [ -n "$nb" ] || continue
  name="$(printf '%s' "$nb" | b64d)"
  case "$name" in
    "${SECRET_PREFIX}"*) ;;                # defensive: exact-prefix only
    *) continue ;;
  esac
  value="$(printf '%s' "$vb" | b64d; printf 'x')"; value="${value%x}"
  key="${name##*/}"
  [ -n "$key" ] || continue
  accept_var "$key" "$value" "Secrets"
  secret_count=$((secret_count + 1))
done < <(batch_get_secrets_tsv)
log "loaded ${secret_count} secret(s) from Secrets Manager"

# --- Sea Haven DEFAULT_REPO_OWNER guard --------------------------------------
# OSWE-OWNER-04 (revised for multi-org): HONOR the configured owner — the
# OPENSWE_REPO_OWNER env override if set, else the store value — so per-env orgs
# work (dev = seahaven-open-swe-dev, prod = Sea-Haven-Industries). But GUARD the two
# values that must NEVER reach the agent: blank, and the upstream 'langchain-ai' org
# (the fork's origin). Either falls back to the Sea Haven org so a stale/blank/mis-set
# value can never point the agent upstream. Comparison is case- and whitespace-
# insensitive. The POSITIVE org allowlist is enforced by the app (ALLOWED_GITHUB_ORGS).
resolved_owner="${OPENSWE_REPO_OWNER:-${VARS[DEFAULT_REPO_OWNER]:-}}"
# Normalize for the guard CHECK ONLY (the original value is what gets stored when
# allowed): lowercase, strip whitespace, take the FIRST path segment so a value like
# 'langchain-ai/open-swe' still trips the guard, and drop dots (GitHub owners contain
# none) so 'langchain-ai.' can't slip past. Homoglyph/unicode variants are out of scope
# here — the owner comes from admin-written SSM/IaC, not attacker-controlled input.
norm_owner="$(printf '%s' "$resolved_owner" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
norm_owner="${norm_owner%%/*}"
norm_owner="${norm_owner//./}"
case "$norm_owner" in
  "" | "$FORBIDDEN_REPO_OWNER")
    log "WARNING: DEFAULT_REPO_OWNER ('${resolved_owner:-<blank>}') is blank or the upstream org -> forcing '${SAFE_REPO_OWNER}'"
    resolved_owner="$SAFE_REPO_OWNER"
    ;;
esac
VARS[DEFAULT_REPO_OWNER]="$resolved_owner"

# --- FAIL-FAST: required vars -------------------------------------------------
# Hard-required regardless of mode:
required=(
  DASHBOARD_JWT_SECRET            # RuntimeError on startup if missing (oauth.py)
  TOKEN_ENCRYPTION_KEY           # Fernet key(s); decrypts per-user GitHub tokens
)
# NOTE: the GitHub App is NOT created/duplicated for dev — only prod owns the
# (single, shared) GitHub App + Slack app. So the GitHub App quintet + Slack +
# webhook-signing secrets are required for PROD only (see the prod block below).
# Dev boots without them: it has no GitHub-App/Slack/webhook integration — it is a
# deployment-validation env (boot/health/boundary), not a live-triggered agent.

# Active model-provider key(s): model selection is store-driven (team_settings),
# so fetch-config cannot infer it from .env. Default to the seeded cross-family
# pair (anthropic builder + openai reviewer). Override with a comma list.
IFS=',' read -r -a provider_keys <<<"${REQUIRED_PROVIDER_KEYS:-ANTHROPIC_API_KEY,OPENAI_API_KEY}"
for k in "${provider_keys[@]}"; do
  k="${k//[[:space:]]/}"
  [ -n "$k" ] && required+=("$k")
done

# Sandbox provider key(s) — depends on SANDBOX_TYPE (default langsmith).
sandbox_type="${VARS[SANDBOX_TYPE]:-langsmith}"
case "$sandbox_type" in
  langsmith) required+=(LANGSMITH_API_KEY_PROD DEFAULT_SANDBOX_SNAPSHOT_ID) ;;
  daytona)   required+=(DAYTONA_API_KEY) ;;
  runloop)   required+=(RUNLOOP_API_KEY) ;;
  modal | local) ;;                         # no key required
  *) log "WARNING: unknown SANDBOX_TYPE='${sandbox_type}' — not enforcing a sandbox key" ;;
esac

# Prod-only: the GitHub App (installation-token minting + dashboard OAuth) and the
# webhook-signing secrets. Dev has no GitHub/Slack app, so none of these are
# required there; prod owns the single shared app and must have all of them.
if [ "$ENV" = "prod" ]; then
  required+=(
    GITHUB_APP_ID                 # GitHub App trio (installation-token minting) ...
    GITHUB_APP_PRIVATE_KEY        # ... multiline PEM ...
    GITHUB_APP_INSTALLATION_ID    # ... used by utils/github_app.py
    GITHUB_APP_CLIENT_ID          # dashboard OAuth login
    GITHUB_APP_CLIENT_SECRET      # dashboard OAuth login
    GITHUB_WEBHOOK_SECRET         # webhook signature verification
    SLACK_SIGNING_SECRET          # Slack webhook signature verification
  )
  if [ -n "${VARS[LINEAR_API_KEY]:-}" ] && [ "${OPENSWE_REQUIRE_LINEAR:-1}" = "1" ]; then
    required+=(LINEAR_WEBHOOK_SECRET)
  fi
fi

missing=()
for k in "${required[@]}"; do
  [ -n "${VARS[$k]:-}" ] || missing+=("$k")
done
# de-dup the names for a clean report
if [ "${#missing[@]}" -gt 0 ]; then
  mapfile -t missing < <(printf '%s\n' "${missing[@]}" | sort -u)
  echo "fetch-config[$ENV]: FAIL-FAST — ${#missing[@]} required var(s) missing/empty:" >&2
  printf '  - %s\n' "${missing[@]}" >&2
  echo "fetch-config[$ENV]: refusing to write a partial .env; service will not start." >&2
  exit 1
fi

# --- Write the .env atomically (root-only on tmpfs) --------------------------
# python-dotenv reads double-quoted values (incl. multiline PEMs). Its decoder
# unescapes ONLY backslash and double-quote (\\ -> \, \" -> "); it does NOT honor
# \$ or \` escapes, so escaping those would leave a spurious backslash. Escape
# exactly backslash then double-quote — real newlines stay literal (multiline OK).
# (Caveat: python-dotenv interpolates a literal `${VAR}` substring; the secret
# domain here — base64/hex/PEM keys — never contains one, so no extra guard.)
emit_var() {
  local name="$1" value="$2" esc
  esc="${value//\\/\\\\}"
  esc="${esc//\"/\\\"}"
  printf '%s="%s"\n' "$name" "$esc"
}

tmp="$(mktemp "${ENV_DIR}/.env.XXXXXX")"
chmod 600 "$tmp"
{
  printf '# Generated by fetch-config.sh for env=%s at %s — DO NOT EDIT.\n' \
    "$ENV" "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
  printf '# Source: SSM /open-swe-%s/* + Secrets Manager open-swe-%s/*\n\n' "$ENV" "$ENV"
  for k in $(printf '%s\n' "${!VARS[@]}" | sort); do
    emit_var "$k" "${VARS[$k]}"
  done
} >"$tmp"

mv -f "$tmp" "$ENV_FILE"
# Owned by the unprivileged service user (T5 SC-01) so the app reads it without
# running as root. fetch-config itself runs as root (ExecStartPre=+) to chown.
chown "${SERVICE_USER}:${SERVICE_GROUP}" "$ENV_FILE"
chmod 600 "$ENV_FILE"

# Point the app's CWD .env at the tmpfs file (idempotent).
if [ "$APP_ENV_LINK" != "$ENV_FILE" ]; then
  if [ -L "$APP_ENV_LINK" ] || [ ! -e "$APP_ENV_LINK" ]; then
    ln -sfn "$ENV_FILE" "$APP_ENV_LINK"
  elif [ "$(readlink -f "$APP_ENV_LINK" 2>/dev/null || true)" != "$(readlink -f "$ENV_FILE")" ]; then
    log "WARNING: ${APP_ENV_LINK} exists and is not a symlink to ${ENV_FILE} — leaving it untouched"
  fi
fi

total=$((ssm_count + secret_count))
log "wrote ${ENV_FILE} (${total} vars, sandbox=${sandbox_type}) — ${SERVICE_USER}:${SERVICE_GROUP} 0600"