@aimarket/warden 0.20.0 → 0.22.0

package/native/macos/Sources/WardenDesktop/StandardIO.swift

@@ -0,0 +1,139 @@
+import AppKit
+
+/// Bounded NDJSON transport over an exclusive inherited pipe, not a public listener.
+/// Parsing and every surface operation run on the application's main actor.
+@MainActor public final class WardenDesktopStandardIO {
+    private let surface: WardenDesktopSurface
+    private var initialized = false
+    private var stopped = false
+    public init(surface: WardenDesktopSurface) { self.surface = surface }
+    #if WARDEN_DESKTOP_TESTS
+    public var extraRequest: ((String, [String: Any]) throws -> [String: Any]?)?
+    #endif
+    private func send(_ value: [String: Any]) {
+        do {
+            let data = try JSONSerialization.data(withJSONObject: value, options: [.withoutEscapingSlashes, .sortedKeys])
+            guard data.count <= 1_048_576 else { throw DesktopError.invalid }
+            try FileHandle.standardOutput.write(contentsOf: data + Data([10]))
+        } catch { stopped = true; NSApp.terminate(nil) }
+    }
+    public func receive(_ data: Data) {
+        guard !stopped else { return }
+        var id: Any = NSNull()
+        do {
+            let raw = try DesktopJSON.parse(data)
+            guard let msg = raw as? [String: Any], Set(msg.keys).isSubset(of: ["jsonrpc", "id", "method", "params"]), msg["jsonrpc"] as? String == "2.0",
+                  let method = msg["method"] as? String else { throw DesktopError.invalid }
+            if let v = msg["id"] {
+                guard v is String || (v is NSNumber && CFGetTypeID(v as! NSNumber) != CFBooleanGetTypeID() && (v as! NSNumber).doubleValue.isFinite && abs((v as! NSNumber).doubleValue) <= 9_007_199_254_740_991 && (v as! NSNumber).doubleValue.rounded() == (v as! NSNumber).doubleValue) else { throw DesktopError.invalid }
+                id = v
+            }
+            let params: [String: Any]
+            if let p = msg["params"] { guard let object = p as? [String: Any] else { throw DesktopError.invalid }; params = object } else { params = [:] }
+            if method == "notifications/initialized" || method == "notifications/cancelled" { return }
+            if method == "warden/screen/cancel" { try surface.cancel(params); if msg["id"] != nil { send(["jsonrpc": "2.0", "id": id, "result": [:]]) }; return }
+            guard msg["id"] != nil else { return }
+            let result: [String: Any]
+            if method == "initialize" {
+                guard !initialized else { throw DesktopError.invalid }; initialized = true
+                result = ["protocolVersion": "2025-06-18", "capabilities": ["tools": [:]], "serverInfo": ["name": "warden-macos-owned-surface", "version": "1.0.0"]]
+            } else {
+                guard initialized else { throw DesktopError.invalid }
+                let extra: [String: Any]?
+                #if WARDEN_DESKTOP_TESTS
+                extra = try extraRequest?(method, params)
+                #else
+                extra = nil
+                #endif
+                if let extra = extra { result = extra }
+                else if method == "tools/list" {
+                    result = ["tools": [
+                        ["name": "screenshot", "description": "Observe registered native controls in the connected application.", "inputSchema": ["type": "object", "properties": [:], "additionalProperties": false]],
+                        ["name": "click", "description": "Activate a registered native button through an atomic target-side commit.", "inputSchema": ["type": "object", "properties": ["index": ["type": "string"]], "required": ["index"], "additionalProperties": false]],
+                    ]]
+                } else if method == "tools/call" {
+                    guard Set(params.keys).isSubset(of: ["name", "arguments"]), params["name"] as? String == "screenshot" else { throw DesktopError.unsupported }
+                    if let a = params["arguments"] { guard let args = a as? [String: Any], args.isEmpty else { throw DesktopError.invalid } }
+                    result = try surface.read()
+                } else if method == "warden/screen/prepare" { result = try surface.prepare(params) }
+                else if method == "warden/screen/commit" { result = try surface.commit(params) }
+                else if method == "ping" { result = [:] }
+                else { throw DesktopError.unsupported }
+            }
+            send(["jsonrpc": "2.0", "id": id, "result": result])
+        } catch {
+            // No raw UI text, arguments, tickets, paths or arbitrary backend errors in diagnostics.
+            send(["jsonrpc": "2.0", "id": id, "error": ["code": -32041, "message": "Native desktop refused or outcome is uncertain; do not retry automatically."]])
+        }
+    }
+    public func start() {
+        DispatchQueue.global(qos: .userInitiated).async {
+            var buffer = Data()
+            let pending = DispatchSemaphore(value: 32)
+            while true {
+                let chunk = FileHandle.standardInput.availableData
+                if chunk.isEmpty { DispatchQueue.main.async { NSApp.terminate(nil) }; return }
+                for byte in chunk {
+                    if byte == 10 {
+                        let line = buffer; buffer.removeAll(keepingCapacity: true)
+                        if !line.isEmpty { pending.wait(); DispatchQueue.main.async { defer { pending.signal() }; self.receive(line) } }
+                    } else {
+                        buffer.append(byte)
+                        if buffer.count > 65_536 { DispatchQueue.main.async { NSApp.terminate(nil) }; return }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Audit duplicate JSON keys before Foundation parsing (including escaped aliases).
+/// Depth and wire limits apply before recursively constructing a Foundation object.
+public enum DesktopJSON {
+    public static func parse(_ data: Data) throws -> Any {
+        guard data.count <= 65_536, String(data: data, encoding: .utf8) != nil else { throw DesktopError.invalid }
+        var scan = Scanner(bytes: Array(data)); try scan.value(0); scan.whitespace()
+        guard scan.offset == data.count else { throw DesktopError.invalid }
+        return try JSONSerialization.jsonObject(with: data, options: [.fragmentsAllowed])
+    }
+    private struct Scanner {
+        let bytes: [UInt8]; var offset = 0
+        mutating func whitespace() { while offset < bytes.count && [9, 10, 13, 32].contains(bytes[offset]) { offset += 1 } }
+        mutating func take(_ b: UInt8) throws { whitespace(); guard offset < bytes.count, bytes[offset] == b else { throw DesktopError.invalid }; offset += 1 }
+        mutating func string() throws -> String {
+            try take(34); let start = offset - 1
+            while offset < bytes.count {
+                let b = bytes[offset]; offset += 1
+                if b == 92 { guard offset < bytes.count else { throw DesktopError.invalid }; offset += 1 }
+                else if b == 34 {
+                    guard let text = try JSONSerialization.jsonObject(with: Data(bytes[start..<offset]), options: [.fragmentsAllowed]) as? String else { throw DesktopError.invalid }; return text
+                }
+            }
+            throw DesktopError.invalid
+        }
+        mutating func value(_ depth: Int) throws {
+            guard depth <= 32 else { throw DesktopError.invalid }; whitespace(); guard offset < bytes.count else { throw DesktopError.invalid }
+            switch bytes[offset] {
+            case 123:
+                offset += 1; whitespace(); if offset < bytes.count && bytes[offset] == 125 { offset += 1; return }
+                var keys = Set<String>()
+                while true {
+                    let key = try string(); guard keys.insert(key).inserted else { throw DesktopError.invalid }
+                    try take(58); try value(depth + 1); whitespace(); guard offset < bytes.count else { throw DesktopError.invalid }
+                    if bytes[offset] == 125 { offset += 1; return }; try take(44)
+                }
+            case 91:
+                offset += 1; whitespace(); if offset < bytes.count && bytes[offset] == 93 { offset += 1; return }
+                while true {
+                    try value(depth + 1); whitespace(); guard offset < bytes.count else { throw DesktopError.invalid }
+                    if bytes[offset] == 93 { offset += 1; return }; try take(44)
+                }
+            case 34: _ = try string()
+            default:
+                let start = offset
+                while offset < bytes.count && ![9, 10, 13, 32, 44, 93, 125].contains(bytes[offset]) { offset += 1 }
+                guard offset > start else { throw DesktopError.invalid }
+            }
+        }
+    }
+}

package/native/macos/Sources/WardenDesktopHost/Main.swift

@@ -0,0 +1,211 @@
+import AppKit
+#if canImport(WardenDesktop)
+import WardenDesktop
+#endif
+
+#if WARDEN_DESKTOP_TESTS
+@MainActor final class TestApplication: NSApplication {
+    var interceptActions = false
+    var interceptedActions = 0
+    override func sendAction(_ action: Selector, to target: Any?, from sender: Any?) -> Bool {
+        if interceptActions { interceptedActions += 1; return true }
+        return super.sendAction(action, to: target, from: sender)
+    }
+}
+@MainActor final class RaceButton: NSButton {
+    var onHit: (() -> Void)?
+    override func hitTest(_ point: NSPoint) -> NSView? { onHit?(); return super.hitTest(point) }
+}
+#endif
+
+@MainActor final class DemoOwner: NSObject {
+    var count = 0
+    var buttons: [NSButton] = []
+    var window: NSWindow!
+    var surface: WardenDesktopSurface!
+    var clockOffset = 0.0
+    var uptimeOffset: UInt64 = 0
+    #if WARDEN_DESKTOP_TESTS
+    var clockReads = 0
+    var invalidateOnClockRead = 0
+    var clockRaceTriggered = false
+    var auxiliaryWindows: [NSWindow] = []
+    var nestedCommit: [String: Any]?
+    var reentrantRefused = false
+    #endif
+    var raceBeforeCommit = false
+    var hitRaceTriggered = false
+    @objc func pressed(_ sender: NSButton) {
+        precondition(Thread.isMainThread)
+        count += 1
+        #if WARDEN_DESKTOP_TESTS
+        if let params = nestedCommit {
+            nestedCommit = nil
+            let receipt = try? surface.commit(params)
+            var readRefused = false, invalidateRefused = false
+            do { _ = try surface.read() } catch { readRefused = true }
+            do { try surface.invalidate() } catch { invalidateRefused = true }
+            reentrantRefused = receipt?["status"] as? String == "refused" && readRefused && invalidateRefused
+        }
+        #endif
+        sender.title = "Pressed \(count)"
+    }
+    @objc func alternate(_ sender: NSButton) { count += 100 }
+    #if WARDEN_DESKTOP_TESTS
+    @objc func invalidAction(_ sender: NSButton) -> String { "not a void action" }
+    @objc func blockAction(_ sender: @convention(block) () -> Void) { count += 1000 }
+    #endif
+    func monotonicClock() -> UInt64 {
+        #if WARDEN_DESKTOP_TESTS
+        if invalidateOnClockRead > 0 {
+            clockReads += 1
+            if clockReads == invalidateOnClockRead {
+                clockRaceTriggered = true
+                try? surface.invalidate(); buttons[0].tag += 1
+            }
+        }
+        #endif
+        return DispatchTime.now().uptimeNanoseconds + uptimeOffset
+    }
+    func start() throws {
+        window = NSWindow(contentRect: NSRect(x: 40, y: 80, width: 340, height: 160), styleMask: [.titled, .closable], backing: .buffered, defer: false)
+        window.title = "WARDEN native test — local only"
+        window.isReleasedWhenClosed = false
+        window.isRestorable = false
+        #if WARDEN_DESKTOP_TESTS
+        let button = RaceButton(title: "Local action", target: self, action: #selector(pressed(_:)))
+        #else
+        let button = NSButton(title: "Local action", target: self, action: #selector(pressed(_:)))
+        #endif
+        button.setAccessibilityElement(true); button.setAccessibilityRole(.button)
+        button.setButtonType(.momentaryPushIn); button.setAccessibilityIdentifier("warden.demo.local-action")
+        button.frame = NSRect(x: 30, y: 55, width: 180, height: 36)
+        window.contentView!.addSubview(button); buttons = [button]
+        window.orderFront(nil) // Never activate another app or generate global input.
+        surface = try WardenDesktopSurface(window: window, applicationID: "dev.warden.macos.demo", now: { [weak self] in Date().timeIntervalSince1970 * 1000 + (self?.clockOffset ?? 0) }, uptime: { [weak self] in self?.monotonicClock() ?? DispatchTime.now().uptimeNanoseconds })
+        try surface.register(id: "3", button: button, target: self, selector: #selector(pressed(_:)))
+    }
+    #if WARDEN_DESKTOP_TESTS
+    func presentSheet() -> [String: Any] {
+        let sheet = NSWindow(contentRect: NSRect(x: 0, y: 0, width: 200, height: 80), styleMask: [.titled], backing: .buffered, defer: false)
+        sheet.isReleasedWhenClosed = false; sheet.isRestorable = false
+        auxiliaryWindows.append(sheet); window.beginSheet(sheet)
+        return ["sheets": window.sheets.count, "attached": window.attachedSheet != nil, "logicalParent": sheet.sheetParent != nil, "knownSheet": NSApp.windows.contains(where: { $0 === sheet })]
+    }
+    func testRequest(_ method: String, _ params: [String: Any]) throws -> [String: Any]? {
+        if method == "test/clock-race" {
+            clockReads = 0; invalidateOnClockRead = params["at"] as? Int ?? 2
+            return [:]
+        }
+        if method == "test/clock-stats" { return ["triggered": clockRaceTriggered] }
+        if method == "test/intercept-dispatch" { (NSApp as! TestApplication).interceptActions = true; return [:] }
+        if method == "test/dispatch-stats" { return ["intercepted": (NSApp as! TestApplication).interceptedActions] }
+        if method == "test/arm-reentrant" { nestedCommit = params; return [:] }
+        if method == "test/invalid-registration" {
+            let button = NSButton(title: "Not registered", target: self, action: #selector(invalidAction(_:)))
+            if params["kind"] as? String == "block" { button.action = #selector(blockAction(_:)) }
+            button.setAccessibilityElement(true); button.setAccessibilityRole(.button); button.setButtonType(.momentaryPushIn)
+            button.setAccessibilityIdentifier("warden.demo.invalid-signature"); button.frame = NSRect(x: 230, y: 10, width: 80, height: 30); window.contentView!.addSubview(button)
+            defer { button.removeFromSuperview() }
+            do { try surface.register(id: "4", button: button, target: self, selector: button.action!); return ["refused": false] }
+            catch { return ["refused": true] }
+        }
+        if method == "warden/screen/commit" && raceBeforeCommit { try surface.invalidate(); raceBeforeCommit = false; return try surface.commit(params) }
+        if method == "test/stats" { return ["count": count, "mainThread": Thread.isMainThread, "windowVisible": window.isVisible, "hitRaceTriggered": hitRaceTriggered, "reentrantRefused": reentrantRefused, "pid": ProcessInfo.processInfo.processIdentifier] }
+        guard method == "test/change", let kind = params["kind"] as? String else { return nil }
+        if kind == "race-before-commit" { raceBeforeCommit = true; return [:] }
+        if kind == "monotonic-expiry" { uptimeOffset += 300_001_000_000; return [:] }
+        if kind == "expiry" { clockOffset += 300_001; return [:] }
+        if kind == "rollback" { clockOffset -= 1000; return [:] }
+        if kind == "untracked-sheet" { return presentSheet() }
+        if kind == "untracked-ancestor-alpha" { window.contentView!.alphaValue = 0; return [:] }
+        if kind == "untracked-partial-alpha" { buttons[0].alphaValue = 0.5; return [:] }
+        if kind == "untracked-implementation" {
+            guard let a = class_getInstanceMethod(DemoOwner.self, #selector(pressed(_:))), let b = class_getInstanceMethod(DemoOwner.self, #selector(alternate(_:))) else { throw DesktopError.invalid }
+            method_exchangeImplementations(a, b); return [:]
+        }
+        if kind == "untracked-button-alpha" { buttons[0].alphaValue = 0; return [:] }
+        if kind == "untracked-window-alpha" { window.alphaValue = 0; return [:] }
+        if kind == "untracked-title" { buttons[0].title = "Untracked change"; return [:] }
+        if kind.hasPrefix("hit-untracked-") {
+            (buttons[0] as! RaceButton).onHit = { [weak self] in
+                guard let s = self, !s.hitRaceTriggered else { return }
+                s.hitRaceTriggered = true
+                switch kind {
+                case "hit-untracked-sheet": _ = s.presentSheet()
+                case "hit-untracked-button-alpha": s.buttons[0].alphaValue = 0
+                case "hit-untracked-window-alpha": s.window.alphaValue = 0
+                case "hit-untracked-handler": s.buttons[0].action = #selector(DemoOwner.alternate(_:))
+                case "hit-untracked-title": s.buttons[0].title = "Different outcome"
+                case "hit-untracked-disabled": s.buttons[0].isEnabled = false
+                case "hit-untracked-bounds": s.buttons[0].frame.origin.x += 5
+                case "hit-untracked-expiry": s.clockOffset += 300_001
+                case "hit-untracked-monotonic-expiry": s.uptimeOffset += 300_001_000_000
+                default: break
+                }
+            }
+            return [:]
+        }
+        if kind == "hit-test-mutation" {
+            (buttons[0] as! RaceButton).onHit = { [weak self] in
+                guard let s = self, !s.hitRaceTriggered else { return }
+                s.hitRaceTriggered = true; try? s.surface.invalidate(); s.buttons[0].tag += 1
+            }
+            return [:]
+        }
+        if kind == "replace-object" {
+            try surface.invalidate()
+            let old = buttons[0], replacement = NSButton(title: old.title, target: self, action: #selector(pressed(_:)))
+            replacement.setAccessibilityElement(true); replacement.setAccessibilityRole(.button)
+            replacement.setButtonType(.momentaryPushIn); replacement.frame = old.frame; replacement.setAccessibilityIdentifier(old.accessibilityIdentifier())
+            old.removeFromSuperview(); window.contentView!.addSubview(replacement); return [:]
+        }
+        try surface.invalidate() // BEFORE every controlled mutation, including ABA/semantics.
+        switch kind {
+        case "aba", "semantic": break
+        case "title": buttons[0].title = "Other action"
+        case "unicode": buttons[0].title = "Отправить / 发送 / Envoyer"; window.title = "WARDEN — проверка 发送"
+        case "identity": buttons[0].setAccessibilityIdentifier("warden.demo.changed")
+        case "handler": buttons[0].action = #selector(alternate(_:))
+        case "bounds": buttons[0].frame.origin.x += 5
+        case "window": window.title = "Changed native window"
+        case "disabled": buttons[0].isEnabled = false
+        case "hidden": buttons[0].isHidden = true
+        case "close": window.orderOut(nil)
+        case "overlay":
+            let overlay = NSView(frame: buttons[0].frame); window.contentView!.addSubview(overlay, positioned: .above, relativeTo: buttons[0])
+        default: throw DesktopError.invalid
+        }
+        return [:]
+    }
+    #endif
+}
+
+@main struct WardenDesktopHost {
+    @MainActor static func main() {
+        // A native reference application, not an agent injected into unrelated applications.
+        // The reusable library must be embedded by those applications themselves.
+        guard Array(CommandLine.arguments.dropFirst()) == ["--demo"] else {
+            FileHandle.standardError.write(Data("Usage: warden-desktop --demo (owned native window only; no external AX/CGEvent dispatch)\n".utf8)); exit(2)
+        }
+        #if WARDEN_DESKTOP_TESTS
+        _ = TestApplication.shared
+        precondition(NSApp is TestApplication)
+        #else
+        _ = NSApplication.shared
+        #endif
+        NSApp.setActivationPolicy(.accessory)
+        let owner = DemoOwner()
+        do {
+            try owner.start()
+            let io = WardenDesktopStandardIO(surface: owner.surface)
+            #if WARDEN_DESKTOP_TESTS
+            io.extraRequest = { method, params in try owner.testRequest(method, params) }
+            #endif
+            io.start()
+            withExtendedLifetime([owner, io] as [AnyObject]) { NSApp.run() }
+        } catch {
+            FileHandle.standardError.write(Data("Native desktop unavailable; no action was run.\n".utf8)); exit(3)
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aimarket/warden",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "WARDEN — MCP security firewall. Stdio wrap proxy, inspection tools and library. Vets definitions before model exposure. Zero runtime dependencies.",
   "type": "module",
   "license": "MIT",
@@ -29,6 +29,11 @@
       "types": "./dist/jcs.d.ts",
       "import": "./dist/jcs.js",
       "default": "./dist/jcs.js"
+    },
+    "./atomic-screen": {
+      "types": "./dist/atomic-screen.d.ts",
+      "import": "./dist/atomic-screen.js",
+      "default": "./dist/atomic-screen.js"
     }
   },
   "files": [
@@ -45,7 +50,11 @@
     "LICENSE",
     "docs/security-hardening*.md",
     "docs/gates*.md",
-    "docs/flow-guard*.md"
+    "docs/flow-guard*.md",
+    "examples/atomic-screen-server.mjs",
+    "native/macos/Package.swift",
+    "native/macos/Sources",
+    "scripts/build-macos.mjs"
   ],
   "engines": {
     "node": ">=20"
@@ -57,12 +66,15 @@
     "prepare": "npm run build",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
+    "test:redteam": "node scripts/redteam/flow-redteam.mjs --check",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build && npm test && npm run check:ruleset && npm run check:quality",
+    "prepublishOnly": "npm run build && npm test && npm run test:redteam && npm run check:ruleset && npm run check:quality",
     "check:quality": "node scripts/check-quality-gate.mjs",
     "check:ruleset": "node scripts/check-published-ruleset.mjs",
-    "bench:wrap": "npm run build && node scripts/benchmark-wrap.mjs"
+    "bench:wrap": "npm run build && node scripts/benchmark-wrap.mjs",
+    "build:macos": "node scripts/build-macos.mjs",
+    "test:macos": "node scripts/build-macos.mjs && node scripts/build-macos.mjs --tests && npm run build && vitest run --config vitest.macos.config.ts"
   },
   "keywords": [
     "mcp",
@@ -84,8 +96,8 @@
   },
   "devDependencies": {
     "@types/node": "^26.6.4",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   }
 }

package/scripts/build-macos.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import { mkdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+
+if (process.platform !== 'darwin') throw new Error('Native desktop build requires macOS and Xcode command-line tools');
+if (process.argv.slice(2).some(x => x !== '--tests') || process.argv.slice(2).length > 1) throw new Error('Expected [--tests]');
+const root = fileURLToPath(new URL('..', import.meta.url));
+const build = join(root, 'native/macos/.build'); mkdirSync(build, { recursive: true });
+const cache = join(build, 'module-cache'); mkdirSync(cache, { recursive: true });
+{
+  if (!['arm64', 'x64'].includes(process.arch)) throw new Error('Unsupported macOS architecture');
+  const args = ['swiftc', '-swift-version', '5', '-parse-as-library', '-O', '-target', `${process.arch === 'arm64' ? 'arm64' : 'x86_64'}-apple-macos13.0`, '-module-cache-path', cache,
+    '-framework', 'AppKit', '-framework', 'CryptoKit', '-framework', 'Security',
+    ...['WardenDesktop/NativeSurface.swift', 'WardenDesktop/StandardIO.swift', 'WardenDesktopHost/Main.swift'].map(f => join(root, 'native/macos/Sources', f))];
+  const test = process.argv.includes('--tests');
+  if (test) args.push('-D', 'WARDEN_DESKTOP_TESTS');
+  const path = join(build, test ? 'warden-desktop-test' : 'warden-desktop');
+  execFileSync('/usr/bin/xcrun', [...args, '-o', path], { cwd: root, stdio: 'inherit', env: { ...process.env, CLANG_MODULE_CACHE_PATH: cache } });
+  process.stdout.write(path + '\n');
+}