fix: complete image service integration

tools/sync-image-repository.mjs

@@ -0,0 +1,92 @@
+import { createHmac, randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+
+const DEFAULT_BASE_URL = 'https://sam-image.hided.net';
+const DEFAULT_SECRET_FILE = '/run/secrets/image_sync_core2026_secret';
+
+const parseArgs = (argv) => {
+    const result = {};
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--commit' || argument === '--url' || argument === '--secret-file') {
+            const value = argv[index + 1];
+            if (!value) {
+                throw new Error(`${argument} requires a value.`);
+            }
+            result[argument.slice(2)] = value;
+            index += 1;
+            continue;
+        }
+        throw new Error(`Unknown argument: ${argument}`);
+    }
+    return result;
+};
+
+const normalizeEndpoint = (baseUrl) => {
+    const url = new URL(baseUrl);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+        throw new Error('Image sync URL must use HTTP or HTTPS.');
+    }
+    url.pathname = `${url.pathname.replace(/\/$/, '')}/v1/sync`;
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+};
+
+export const syncImageRepository = async ({
+    baseUrl = DEFAULT_BASE_URL,
+    secretFile = DEFAULT_SECRET_FILE,
+    commit,
+    fetchImpl = fetch,
+    now = Date.now,
+    requestIdFactory = randomUUID,
+} = {}) => {
+    if (commit !== undefined && !/^[0-9a-f]{40,64}$/i.test(commit)) {
+        throw new Error('Commit must be a full 40-64 character hexadecimal object ID.');
+    }
+    const secret = (await readFile(secretFile, 'utf8')).trim();
+    if (secret.length < 32) {
+        throw new Error('IMAGE_SYNC_SECRET_FILE must contain at least 32 characters.');
+    }
+    const body = commit ? JSON.stringify({ commit }) : '{}';
+    const timestamp = String(Math.floor(now() / 1000));
+    const requestId = requestIdFactory();
+    const signature = createHmac('sha256', secret).update(`${timestamp}.${requestId}.${body}`).digest('hex');
+    const response = await fetchImpl(normalizeEndpoint(baseUrl), {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            'x-image-client': 'core2026',
+            'x-image-timestamp': timestamp,
+            'x-image-request-id': requestId,
+            'x-image-signature': signature,
+        },
+        body,
+    });
+    if (!response.ok) {
+        throw new Error(`Image repository sync failed with HTTP ${response.status}.`);
+    }
+    const payload = await response.json();
+    if (!payload || typeof payload !== 'object' || payload.ok !== true) {
+        throw new Error('Image repository returned an unexpected sync response.');
+    }
+    return payload;
+};
+
+const run = async () => {
+    const args = parseArgs(process.argv.slice(2));
+    const result = await syncImageRepository({
+        baseUrl: args.url ?? process.env.IMAGE_SYNC_URL ?? DEFAULT_BASE_URL,
+        secretFile: args['secret-file'] ?? process.env.IMAGE_SYNC_SECRET_FILE ?? DEFAULT_SECRET_FILE,
+        commit: args.commit,
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+};
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    run().catch((error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

tools/sync-image-repository.test.mjs

@@ -0,0 +1,67 @@
+import { createHmac } from 'node:crypto';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { syncImageRepository } from './sync-image-repository.mjs';
+
+test('signs a scoped Core2026 fallback sync without exposing the secret', async (t) => {
+    const directory = await mkdtemp(path.join(tmpdir(), 'sammo-image-sync-'));
+    t.after(() => rm(directory, { recursive: true, force: true }));
+    const secretFile = path.join(directory, 'secret');
+    const secret = 's'.repeat(32);
+    await writeFile(secretFile, `${secret}\n`, { mode: 0o600 });
+    let captured;
+    const result = await syncImageRepository({
+        baseUrl: 'https://sam-image.hided.net/',
+        secretFile,
+        commit: 'a'.repeat(40),
+        now: () => Date.parse('2026-08-08T00:00:00Z'),
+        requestIdFactory: () => 'request-1',
+        fetchImpl: async (url, init) => {
+            captured = { url, init };
+            return new Response(JSON.stringify({ ok: true, changed: false }), { status: 200 });
+        },
+    });
+
+    assert.deepEqual(result, { ok: true, changed: false });
+    assert.equal(captured.url, 'https://sam-image.hided.net/v1/sync');
+    assert.equal(captured.init.body, JSON.stringify({ commit: 'a'.repeat(40) }));
+    assert.equal(captured.init.headers['x-image-client'], 'core2026');
+    assert.equal(
+        captured.init.headers['x-image-signature'],
+        createHmac('sha256', secret)
+            .update(`${captured.init.headers['x-image-timestamp']}.request-1.${captured.init.body}`)
+            .digest('hex')
+    );
+    assert.equal(Object.values(captured.init.headers).includes(secret), false);
+});
+
+test('rejects invalid commits before reading the secret or making a request', async () => {
+    await assert.rejects(
+        syncImageRepository({
+            secretFile: '/does/not/exist',
+            commit: 'main',
+            fetchImpl: async () => {
+                throw new Error('must not fetch');
+            },
+        }),
+        /Commit must be a full/
+    );
+});
+
+test('reports authentication failures without returning a response body', async (t) => {
+    const directory = await mkdtemp(path.join(tmpdir(), 'sammo-image-sync-'));
+    t.after(() => rm(directory, { recursive: true, force: true }));
+    const secretFile = path.join(directory, 'secret');
+    await writeFile(secretFile, 's'.repeat(32), { mode: 0o600 });
+    await assert.rejects(
+        syncImageRepository({
+            secretFile,
+            fetchImpl: async () => new Response('{"reason":"sensitive detail"}', { status: 401 }),
+        }),
+        /HTTP 401/
+    );
+});