feat(furrow): reach a run's live workspace from anywhere

go/agentfield-package.yaml

@@ -63,6 +63,61 @@ user_environment:
       description: Engine reasoning-effort variant (low | high) — unset keeps the engine default
     - name: SWE_PRO_MAX_COST
       description: Per-run USD ceiling for the engine — unset means no per-run cap
+    - name: SWE_FURROW_ENABLED
+      description: >-
+        Furrow workspace mirroring. Set 1/true/yes/on to force it on, 0 to force it
+        off. Unset, it follows FURROW_PUBLIC_ADDR: cloud deploys (where the desktop
+        app provisions a public sync port and sets that variable) mirror out of the
+        box, local installs stay off. Mirroring copies the whole build workspace —
+        including untracked files and any secrets the coder wrote there — into a
+        second encrypted store on this node.
+      # No default on purpose: a non-empty default is injected into the node's
+      # environment as an EXPLICIT value, which would defeat the unset-follows-
+      # FURROW_PUBLIC_ADDR behaviour that turns mirroring on in cloud deploys.
+      default: ""
+    - name: SWE_FURROW_EXPOSE_SECRETS
+      description: >-
+        Return the recovery key and transport token from get_workspace_handle instead of
+        redacting them. That reasoner authorizes no one — any caller with a run ID is
+        answered — and the key decrypts the workspace while the token grants read-write
+        access to its remote. Enable only on a single-tenant, trusted cluster.
+      default: "0"
+    - name: SWE_FURROW_BIN
+      description: Path to the furrow client binary — unset auto-resolves (/usr/local/bin/furrow, then vendored bin/furrow-<os>-<arch>)
+      default: ""
+    - name: SWE_FURROWD_BIN
+      description: Path to the furrow daemon binary — unset auto-resolves (/usr/local/bin/furrowd, then vendored bin/furrowd-<os>-<arch>)
+      default: ""
+    - name: SWE_FURROW_DATA_DIR
+      description: Furrow client data directory — unset uses $AGENTFIELD_HOME/furrow/store when AGENTFIELD_HOME is set, otherwise <workspace root>/.furrow-store
+      default: ""
+    - name: SWE_FURROW_REMOTES_ROOT
+      description: Furrow remote stores root — unset uses $AGENTFIELD_HOME/furrow/remotes when AGENTFIELD_HOME is set, otherwise <workspace root>/.furrow-remotes
+      default: ""
+    - name: SWE_FURROW_TTL_HOURS
+      description: Retention time for mirrored workspaces in hours
+      default: "72"
+    - name: SWE_FURROW_MAX_GB
+      description: Maximum aggregate furrow store size in GB; 0 means unlimited disk (no budget eviction)
+      default: "20"
+    - name: FURROWD_ADDR
+      description: Address on which furrowd listens
+      default: ":8802"
+    - name: FURROW_PUBLIC_ADDR
+      description: >-
+        Public furrowd host and port advertised in ssh:// workspace handles. The
+        AgentField desktop app's cloud deploy sets this on the control-plane service
+        (a Railway TCP proxy in front of furrowd's port 8802) and nodes inherit it;
+        its presence also turns mirroring on unless SWE_FURROW_ENABLED says otherwise.
+      default: ""
+    - name: FURROW_DIAL_TOKEN
+      description: Token from an ssh:// workspace handle used by furrow clients
+    - name: FURROW_DIAL_INSECURE
+      description: Allow the default self-signed furrowd certificate; required for ssh:// handles until certificate pinning is available
+    - name: FURROWD_TLS_CERT
+      description: Path to an operator-provided furrowd TLS certificate
+    - name: FURROWD_TLS_KEY
+      description: Path to the matching operator-provided furrowd TLS private key
     - name: AGENTFIELD_SERVER
       description: Control-plane URL
       default: http://localhost:8080

go/cmd/furrow-dial/main.go

@@ -0,0 +1,103 @@
+// furrow-dial is a FURROW_SSH_COMMAND shim. With FURROW_DIAL_INSECURE=1 TLS
+// certificate verification is disabled; furrow's encrypted payload remains
+// the confidentiality boundary, but transport authentication is then by token.
+package main
+
+import (
+	"bufio"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"strings"
+)
+
+func main() {
+	if err := dial(os.Args[1:], os.Stdin, os.Stdout); err != nil {
+		fmt.Fprintf(os.Stderr, "furrow-dial: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func dial(args []string, stdin io.Reader, stdout io.Writer) error {
+	if len(args) == 0 {
+		return errors.New("missing namespace")
+	}
+	namespace := args[len(args)-1]
+	addr := os.Getenv("FURROW_DIAL_ADDR")
+	if addr == "" {
+		for i, arg := range args {
+			if arg == "--" && i+1 < len(args) {
+				addr = args[i+1]
+				break
+			}
+		}
+	}
+	if addr == "" {
+		return errors.New("FURROW_DIAL_ADDR is unset and argv has no host")
+	}
+	token := os.Getenv("FURROW_DIAL_TOKEN")
+	if token == "" || strings.ContainsAny(token, " \r\n") || strings.ContainsAny(namespace, " \r\n") {
+		return errors.New("missing or invalid authentication parameters")
+	}
+	insecure := os.Getenv("FURROW_DIAL_INSECURE") == "1"
+	if insecure {
+		fmt.Fprintln(os.Stderr, "furrow-dial: warning: TLS certificate verification disabled; relying on furrow payload encryption")
+	}
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return fmt.Errorf("invalid address: %w", err)
+	}
+	conn, err := tls.Dial("tcp", addr, &tls.Config{ServerName: host, InsecureSkipVerify: insecure, MinVersion: tls.VersionTLS12}) //nolint:gosec -- explicitly operator-controlled for the generated self-signed certificate.
+	if err != nil {
+		return fmt.Errorf("connect: %w", err)
+	}
+	defer conn.Close()
+	if _, err := fmt.Fprintf(conn, "AUTH %s %s\n", token, namespace); err != nil {
+		return fmt.Errorf("authenticate: %w", err)
+	}
+	reader := bufio.NewReader(conn)
+	line, err := reader.ReadString('\n')
+	if err != nil || line != "OK\n" {
+		return errors.New("authentication failed")
+	}
+	inputDone := make(chan error, 1)
+	go func() {
+		_, err := io.Copy(conn, stdin)
+		if tcp, ok := conn.NetConn().(*net.TCPConn); ok {
+			_ = tcp.CloseWrite()
+		}
+		inputDone <- err
+	}()
+	outputDone := make(chan error, 1)
+	go func() {
+		_, err := io.Copy(stdout, reader)
+		outputDone <- err
+	}()
+	var inputErr, outputErr error
+	select {
+	case outputErr = <-outputDone:
+		// The remote side ended first. Closing the connection makes a pending
+		// socket write fail; a goroutine blocked reading an interactive stdin
+		// is harmless because process exit releases it.
+		_ = conn.Close()
+		return copyError("receive output", outputErr)
+	case inputErr = <-inputDone:
+		// A stdin EOF is a half-close: retain the read side so the remote can
+		// flush its final protocol response before it exits.
+		outputErr = <-outputDone
+	}
+	if inputErr != nil && !errors.Is(inputErr, net.ErrClosed) {
+		return fmt.Errorf("send input: %w", inputErr)
+	}
+	return copyError("receive output", outputErr)
+}
+
+func copyError(operation string, err error) error {
+	if err != nil && !errors.Is(err, net.ErrClosed) {
+		return fmt.Errorf("%s: %w", operation, err)
+	}
+	return nil
+}

go/cmd/furrow-dial/main_test.go

@@ -0,0 +1,21 @@
+package main
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestDialRejectsMissingNamespace(t *testing.T) {
+	if err := dial(nil, strings.NewReader(""), &bytes.Buffer{}); err == nil {
+		t.Fatal("dial accepted missing namespace")
+	}
+}
+
+func TestDialRejectsMissingAddress(t *testing.T) {
+	t.Setenv("FURROW_DIAL_ADDR", "")
+	t.Setenv("FURROW_DIAL_TOKEN", "token")
+	if err := dial([]string{"workspace"}, strings.NewReader(""), &bytes.Buffer{}); err == nil {
+		t.Fatal("dial accepted missing address")
+	}
+}