@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/serve/worker-artifacts.mjs

@@ -0,0 +1,56 @@
+/** Validate bounded artifact declarations without touching the worker filesystem. */
+import path from 'node:path';
+
+const safeId = /^[a-z0-9][a-z0-9-]{0,51}$/;
+const safeName = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const allowed = new Set(['name', 'content', 'location', 'prefix', 'relativePath']);
+
+function normalizedRelative(value) {
+  return typeof value === 'string' && value.length > 0 && value.length <= 4096
+    && !/[\\\x00-\x1f\x7f]/.test(value) && !path.posix.isAbsolute(value)
+    && !value.split('/').some(part => !part || part === '.' || part === '..')
+    && path.posix.normalize(value) === value;
+}
+
+/** The installed module owns the prefix; its loader rechecks the whole declaration. */
+export function validateWorkerArtifacts(invocation) {
+  const artifacts = invocation.artifacts ?? [];
+  if (!Array.isArray(artifacts) || artifacts.length > 16) throw new Error('Worker artifact count exceeds bound');
+  const names = new Set();
+  let total = 0, workspaceCount = 0;
+  for (const artifact of artifacts) {
+    if (!artifact || typeof artifact.name !== 'string' || !safeName.test(artifact.name)
+      || /[^A-Za-z0-9_-]/.test(artifact.name) || names.has(artifact.name)
+      || typeof artifact.content !== 'string' || Object.keys(artifact).some(key => !allowed.has(key))) {
+      throw new Error('Invalid worker artifact declaration');
+    }
+    names.add(artifact.name);
+    const size = Buffer.byteLength(artifact.content);
+    total += size;
+    if (size > 1048576 || total > 4194304) throw new Error('Worker artifact bytes exceed bound');
+    if (artifact.location === 'workspace-relative') {
+      if (++workspaceCount > 1) throw new Error('Only one workspace-relative worker artifact is allowed');
+      const { prefix, relativePath } = artifact;
+      const id = invocation.invocationId;
+      if (typeof id !== 'string' || !safeId.test(id) || /[^a-z0-9-]/.test(id)) throw new Error('Invalid worker artifact invocation id');
+      if (!normalizedRelative(prefix) || prefix.length > 256 || !prefix.endsWith('-')
+        || !normalizedRelative(relativePath) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(path.posix.basename(relativePath))
+        || path.posix.dirname(relativePath) !== `${prefix}${id}`) {
+        throw new Error('Worker artifact path must be normalized and bound to its prefix and invocation id');
+      }
+      if (typeof invocation.cwd !== 'string' || !path.posix.isAbsolute(invocation.cwd)
+        || /[\\\x00-\x1f\x7f]/.test(invocation.cwd) || path.posix.normalize(invocation.cwd) !== invocation.cwd) {
+        throw new Error('Worker artifact requires a normalized absolute cwd');
+      }
+      const target = path.posix.resolve(invocation.cwd, relativePath);
+      if (!target.startsWith(`${invocation.cwd === '/' ? '' : invocation.cwd}/`)) throw new Error('Worker artifact escapes cwd');
+      if (['briefPath', 'stdoutPath', 'stderrPath', 'finalPath'].some(key => invocation[key] && path.resolve(invocation[key]) === target)) {
+        throw new Error('Worker artifact and input/output paths must be distinct');
+      }
+    } else if (artifact.location !== undefined && artifact.location !== 'run-directory'
+      || artifact.prefix !== undefined || artifact.relativePath !== undefined) {
+      throw new Error('Invalid worker artifact declaration');
+    }
+  }
+  return artifacts;
+}

package/dist/src/serve/worker-command-request.js

@@ -0,0 +1,68 @@
+// Parses direct worker requests; configured role authority is validated by the resolver.
+import { DEFAULT_WORKER_SELECTION, WorkerPolicyError } from '../models/provider-policy.js';
+/** Only fixed argument guidance is safe to expose in public request diagnostics. */
+export class WorkerRequestArgumentError extends WorkerPolicyError {
+    pointer;
+    constructor(key) {
+        super('OG_CONFIG_REFERENCE', key === 'task'
+            ? `Missing required --task. Valid task classes: ${Object.keys(DEFAULT_WORKER_SELECTION.taskClasses).join(', ')}, plus classes configured in defaults.workerSelection.taskClasses.`
+            : `--${key.replace('_', '-')} must be an absolute path; relative paths are not resolved against cwd or --workdir.`);
+        this.pointer = `/request/${key}`;
+    }
+}
+/** Reject unsupported syntax before discovery or any path reads. */
+export function parseWorkerCommandArgs(args) {
+    const names = { role: 'role', task: 'task', group: 'group', brief: 'brief',
+        workdir: 'workdir', 'final-output': 'final_output', transport: 'transport', format: 'format' };
+    const result = {};
+    let json = false;
+    let premiumAuthorized = false;
+    for (let i = 0; i < args.length; i++) {
+        const token = args[i];
+        if (token === '--authorize-premium') {
+            if (premiumAuthorized)
+                throw new Error('Duplicate --authorize-premium');
+            premiumAuthorized = true;
+            continue;
+        }
+        if (token === '--json') {
+            if (json)
+                throw new Error('Duplicate --json');
+            json = true;
+            continue;
+        }
+        const match = /^--([^=]+)(?:=([\s\S]*))?$/.exec(token);
+        if (!match || !Object.hasOwn(names, match[1]))
+            throw new Error(`Unsupported models resolve argument: ${token}`);
+        const key = names[match[1]];
+        if (key in result)
+            throw new Error(`Duplicate --${match[1]}`);
+        const value = match[2] ?? args[++i];
+        if (!value || value.startsWith('--') && match[2] === undefined || value.includes('\0')) {
+            if (key === 'task' && !value?.includes('\0'))
+                throw new WorkerRequestArgumentError('task');
+            throw new Error(`--${match[1]} requires a value`);
+        }
+        result[key] = value;
+    }
+    if (json && result.format && result.format !== 'json')
+        throw new Error('--json conflicts with --format');
+    if (json)
+        result.format = 'json';
+    for (const key of ['role', 'task', 'group', 'brief', 'workdir', 'final_output']) {
+        if (key === 'task' && !result[key])
+            throw new WorkerRequestArgumentError('task');
+        if (!result[key])
+            throw new Error(`Missing ${key}`);
+    }
+    if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.role))
+        throw new Error('Unsupported role');
+    if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.group))
+        throw new Error('Invalid group');
+    if (result.transport && !['shell', 'mcp'].includes(result.transport))
+        throw new Error('Unsupported transport');
+    if (result.format && !['shell', 'json'].includes(result.format))
+        throw new Error('Unsupported renderer; use POSIX shell or JSON');
+    return { ...result, ...(premiumAuthorized ? { authority: { premiumAuthorized: true, maxAutoTier: 3 } } : {}) };
+}
+//# sourceMappingURL=worker-command-request.js.map

package/dist/src/serve/worker-invocation-paths.js

@@ -0,0 +1,144 @@
+/** Inspect worker paths and read bounded briefs without following symlinks. */
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { lstat, realpath, open } from 'node:fs/promises';
+import { workerConfigDigest } from '../config/aiwg-config.js';
+/** Include the Codex transport capture in the existing output ownership checks. */
+export function workerOutputPaths(invocation) {
+    const paths = { stdout: invocation.stdoutPath, stderr: invocation.stderrPath, final: invocation.finalPath };
+    const lastMessage = `${invocation.finalPath}.last-message`;
+    if (invocation.transport === 'shell' && invocation.selected.cli === 'codex' && invocation.argv?.includes(lastMessage)) {
+        paths.lastMessage = lastMessage;
+    }
+    return paths;
+}
+export async function inspectWorkerPath(filename, kind) {
+    if (!path.isAbsolute(filename) || filename.includes('\0'))
+        throw new Error('Absolute NUL-free paths are required');
+    if (filename.split('/').includes('..'))
+        throw new Error('Worker path traversal is not allowed');
+    const normalized = path.resolve(filename);
+    let current = normalized;
+    while (true) {
+        try {
+            const canonical = await realpath(current);
+            if (canonical !== current)
+                throw new Error(`Symlink path is not allowed: ${filename}`);
+            if (current !== normalized)
+                return false;
+            const stat = await lstat(normalized);
+            if (kind === 'directory' ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1) {
+                throw new Error(`Expected an unaliased ${kind}: ${filename}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw error;
+            current = parent;
+        }
+    }
+}
+const inspectPath = inspectWorkerPath;
+export async function readBrief(filename) {
+    if (!await inspectPath(filename, 'file'))
+        return null;
+    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 262144)
+            throw new Error('Brief must be a bounded regular file (256 KiB)');
+        const buffer = Buffer.alloc(262145);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null);
+            if (!bytesRead)
+                break;
+            length += bytesRead;
+        }
+        if (length > 262144)
+            throw new Error('Brief exceeds 256 KiB');
+        return buffer.subarray(0, length);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Canonical containment shared by launch metadata and saved-plan authority. */
+const beneath = (root, filename) => {
+    const r = path.relative(root, filename);
+    return r === '' || !r.startsWith('..') && !path.isAbsolute(r);
+};
+async function resolveRealish(target) {
+    const parts = target.split('/').filter(Boolean);
+    for (let i = parts.length; i >= 0; i--) {
+        const candidate = i === 0 ? '/' : `/${parts.slice(0, i).join('/')}`;
+        try {
+            const real = await realpath(candidate);
+            const remainder = parts.slice(i).join('/');
+            return remainder ? path.join(real, remainder) : real;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return target;
+}
+export async function realBeneath(root, filename) {
+    const [realRoot, realFilename] = await Promise.all([resolveRealish(root), resolveRealish(filename)]);
+    return beneath(realRoot, realFilename);
+}
+/** The persisted conductor plan, never worker-supplied JSON, owns the minted ID. */
+export async function assertConductorWorkerPlan(saved, filename, drivers) {
+    if (!filename)
+        throw new Error('Conductor-owned saved plan is required to verify invocation identity');
+    const invocation = saved.invocation;
+    if (!invocation?.cwd)
+        throw new Error('Conductor plan has no worker cwd');
+    const roots = [invocation.cwd, ...(drivers[invocation.selected.cli]?.qualification.installation?.workerWritableRoots ?? [])];
+    for (const root of roots) {
+        if (await realBeneath(root, filename))
+            throw new Error('Invocation plan must be outside worker-writable roots');
+    }
+    if (!await inspectWorkerPath(filename, 'file'))
+        throw new Error('Conductor-owned saved plan is missing');
+    // Pin every ancestor, just as launch input reads do, and refuse aliased files.
+    let directory = await open('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        const components = filename.split('/').filter(Boolean), leaf = components.pop();
+        for (const component of components) {
+            const next = await open(`/proc/self/fd/${directory.fd}/${component}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+            await directory.close();
+            directory = next;
+        }
+        const handle = await open(`/proc/self/fd/${directory.fd}/${leaf}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid() || stat.size > 1048576) {
+                throw new Error('Conductor-owned saved plan must be bounded, unaliased and owned');
+            }
+            const bytes = Buffer.alloc(1048577);
+            let length = 0;
+            while (length < bytes.length) {
+                const { bytesRead } = await handle.read(bytes, length, bytes.length - length, length);
+                if (!bytesRead)
+                    break;
+                length += bytesRead;
+            }
+            if (length > 1048576 || workerConfigDigest(JSON.parse(bytes.subarray(0, length).toString('utf8'))) !== workerConfigDigest(saved)) {
+                throw new Error('Invocation identity differs from conductor-owned saved plan');
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    finally {
+        await directory.close();
+    }
+}
+//# sourceMappingURL=worker-invocation-paths.js.map

package/dist/src/serve/worker-invocation-preparation.js

@@ -0,0 +1,169 @@
+/** Validate and render a prepared invocation against trusted installation controls. */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { validateWorkerArtifacts } from './worker-artifacts.mjs';
+import { assertValidWorkerPayload } from '../mission-protocol/codecs.js';
+import { qualificationDigest } from '../models/qualification-digest.mjs';
+import { qualifyWorkerInvocationProfile, assertOperatorWorkerNativeArgv, assertWorkerSelectionAllowed, assertWorkerLaunchMode, requiresWorkerExternalBoundary, assertWorkerHealthQualification, WorkerPolicyError, DEFAULT_WORKER_SELECTION } from '../models/provider-policy.js';
+/**
+ * The exact digest formula an MCP worker binding's `inputSchemaDigest`/
+ * `outputSchemaDigest` are pinned against (used below and reused verbatim by
+ * the #2892 MCP worker-invoke bridge's own live `tools/list` schema-drift
+ * check — see `src/mcp/tools/worker-invoke.mjs` M3). Deliberately the raw
+ * `JSON.stringify` of the schema object, NOT `workerConfigDigest`'s
+ * canonicalized (sorted-key) form — a schema's own declared key order is
+ * part of what gets pinned at qualification time.
+ */
+export function mcpToolSchemaDigest(schema) {
+    return `sha256:${createHash('sha256').update(JSON.stringify(schema)).digest('hex')}`;
+}
+export async function prepareWorkerInvocation(invocation, qualification) {
+    const result = structuredClone(invocation);
+    validateWorkerArtifacts(result);
+    // shellCommand is derived syntax, never authority supplied by a brief.
+    if (result.transport === 'shell')
+        result.shellCommand = '';
+    // Validate the established invocation shape first. Health is optional and
+    // is checked after policy, installation and transport qualification below.
+    const contract = { ...result };
+    delete contract.health;
+    assertValidWorkerPayload('workerResolvedInvocation', contract);
+    if ((qualification.platform ?? process.platform) !== 'linux') {
+        throw new Error('Unsupported worker invocation platform; Linux is required');
+    }
+    if (!Number.isFinite(qualification.now) || Date.parse(result.expiresAt) <= qualification.now) {
+        throw new Error('Worker invocation is expired or has no validation clock');
+    }
+    if (qualification.adapter.id !== qualification.adapterId) {
+        throw new Error('Worker invocation adapter identity mismatch');
+    }
+    assertWorkerLaunchMode(qualification.adapter, qualification.permissions);
+    if (result.isolation !== undefined && result.isolation !== (qualification.permissions?.launchMode ?? 'systemd-unit')) {
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker launch mode differs from the execution policy');
+    }
+    for (const [key, value] of Object.entries(qualification.expectedDigests ?? {})) {
+        if (result[key] !== value)
+            throw new WorkerPolicyError('OG_PIN_MISMATCH', `Worker invocation ${key} changed`);
+    }
+    const verified = Date.parse(qualification.adapter.qualification.verifiedAt ?? '');
+    const policyDays = qualification.policy?.freshness?.policyDays ?? DEFAULT_WORKER_SELECTION.freshness.policyDays;
+    if (!Number.isFinite(verified) || verified > qualification.now || qualification.now - verified >= policyDays * 86400000) {
+        throw new Error('Worker installation qualification is stale or invalid');
+    }
+    assertWorkerSelectionAllowed(result.selected, qualification);
+    const profile = qualifyWorkerInvocationProfile(qualification.adapter, {
+        profile: result.selected.profileRef, transport: result.transport,
+        cliVersion: qualification.cliVersion,
+        requiredControls: qualification.requiredControls, policy: qualification.policy,
+        permissions: qualification.permissions, effort: result.selected.effort.value, boundary: qualification.boundary,
+        mcp: qualification.mcp,
+    });
+    if (requiresWorkerExternalBoundary(qualification.adapter, { ...qualification,
+        profile: result.selected.profileRef, transport: result.transport, effort: result.selected.effort.value })) {
+        const installed = qualification.installation;
+        const evidence = profile.installationQualification;
+        if (!installed || !evidence || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef']
+            .some(key => installed.evidence?.[key] !== evidence[key])
+            || !qualification.boundary || qualificationDigest(qualification.boundary) !== qualificationDigest(installed.boundary)) {
+            throw new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Worker installation evidence and qualified boundary must match');
+        }
+    }
+    if (profile.installationQualification) {
+        const installedAt = Date.parse(profile.installationQualification.verifiedAt);
+        if (!Number.isFinite(installedAt) || installedAt > qualification.now
+            || qualification.now - installedAt >= policyDays * 86400000) {
+            throw new Error('Worker installation qualification is stale or invalid');
+        }
+    }
+    const scopeDigest = profile.installationQualification?.scopeDigest ?? qualification.adapter.qualification.fixtureDigest;
+    if (result.selected.qualificationDigest !== scopeDigest)
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker qualification digest changed');
+    const absolute = (value) => typeof value === 'string' && path.posix.isAbsolute(value) && !value.includes('\0');
+    for (const key of ['cwd', 'briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
+        if (!absolute(result[key]))
+            throw new Error(`Worker invocation requires absolute ${key}`);
+    }
+    const briefPath = path.posix.normalize(result.briefPath);
+    if ([result.stdoutPath, result.stderrPath, result.finalPath].some(value => path.posix.normalize(value) === briefPath)
+        || path.posix.normalize(result.stdoutPath) === path.posix.normalize(result.stderrPath)) {
+        throw new Error('Worker invocation input/output paths must be distinct');
+    }
+    if (result.transport === 'shell') {
+        assertOperatorWorkerNativeArgv(qualification.adapter, result.argv, result.selected, qualification.permissions);
+        if (!absolute(result.argv[0]) || result.argv[0].includes('=') || result.argv.some(value => value.includes('\0'))) {
+            throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker invocation requires an absolute binary without equals and NUL-free argv');
+        }
+        if (result.envNames.some(name => !profile.envAllowlist.includes(name))) {
+            throw new Error('Worker invocation environment is outside the qualified allowlist');
+        }
+        const quote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
+        // Only validated environment names appear as shell syntax; their values
+        // remain in the conductor environment and are never printed in the plan.
+        const environment = result.envNames.map(name => `${name}="\${${name}-}"`).join(' ');
+        // The frozen 'closed' value means empty stdin (immediate EOF). 'brief-json'
+        // pipes a conductor-built params document framed from the brief file
+        // (worker-stdin-frame.mjs), so brief text never enters any argv.
+        const worker = `env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
+        const outputs = `> ${quote(result.stdoutPath)} 2> ${quote(result.stderrPath)}`;
+        if (result.stdin === 'brief-json') {
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, result.briefPath, result.selected.model, result.cwd].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'adapter-frame') {
+            const binding = qualification.stdinFramerBinding;
+            if (!binding || !absolute(binding.storePath) || !/^sha256:[a-f0-9]{64}$/.test(binding.storeDigest)) {
+                throw new Error('Adapter stdin framer requires a trusted installation binding');
+            }
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, '--adapter-frame', result.briefPath, result.cwd,
+                result.selected.cli, qualification.adapterId, result.selected.qualificationDigest, result.briefDigest,
+                binding.storePath, binding.storeDigest, JSON.stringify(qualification.policy ?? null), result.selected.model].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i${environment ? ` ${environment}` : ''} ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'closed' || result.stdin === 'brief-text') {
+            const stdin = result.stdin === 'closed' ? '< /dev/null' : `< ${quote(result.briefPath)}`;
+            result.shellCommand = `cd ${quote(result.cwd)} && ${worker} ${stdin} ${outputs}`;
+        }
+        else {
+            throw new Error(`Unsupported worker stdin mode: ${result.stdin}`);
+        }
+    }
+    else {
+        const binding = result.mcp;
+        for (const key of ['serverRef', 'tool', 'inputSchemaDigest', 'outputSchemaDigest', 'sessionIsolation']) {
+            if (binding[key] !== profile.mcp[key])
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker binding changed: ${key}`);
+        }
+        if (binding.timeoutSeconds > result.limits.wallSeconds) {
+            throw new Error('MCP worker timeout exceeds the invocation deadline');
+        }
+        for (const key of ['input', 'output']) {
+            const schema = qualification.mcpSchemas?.[key];
+            if (!schema || mcpToolSchemaDigest(schema) !== binding[`${key}SchemaDigest`]) {
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker ${key} schema digest changed`);
+            }
+        }
+        const { default: Ajv2020 } = await import('ajv/dist/2020.js');
+        const { default: addFormats } = await import('ajv-formats');
+        const validate = addFormats(new Ajv2020({ strict: true, allErrors: true })).compile(qualification.mcpSchemas.input);
+        if (!validate(binding.arguments))
+            throw new Error('MCP worker arguments violate the pinned input schema');
+    }
+    assertValidWorkerPayload('workerResolvedInvocation', result);
+    if (result.health !== undefined) {
+        if (result.health.profileRef !== result.selected.profileRef
+            || result.health.hardTimeoutSeconds > Math.min(result.limits.wallSeconds, result.mcp?.timeoutSeconds ?? Infinity)) {
+            throw new Error('Worker health profile or wall ceiling mismatch');
+        }
+        if (['native', 'external'].includes(result.health.stepEnforcement)
+            && profile.controls.stepCap?.support !== result.health.stepEnforcement)
+            throw new Error('Unqualified worker step enforcement');
+    }
+    assertWorkerHealthQualification(profile, { profileRef: result.selected.profileRef, cliVersion: qualification.cliVersion,
+        accountScope: qualification.installation?.accountScope ?? '', inferenceProvider: result.selected.inferenceProvider,
+        model: result.selected.model, effort: result.selected.effort.value });
+    return result;
+}
+//# sourceMappingURL=worker-invocation-preparation.js.map