@aiwg/cli 2026.10.9 → 2026.10.10

package/dist/src/serve/worker-invocation-paths.js

@@ -0,0 +1,144 @@
+/** Inspect worker paths and read bounded briefs without following symlinks. */
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { lstat, realpath, open } from 'node:fs/promises';
+import { workerConfigDigest } from '../config/aiwg-config.js';
+/** Include the Codex transport capture in the existing output ownership checks. */
+export function workerOutputPaths(invocation) {
+    const paths = { stdout: invocation.stdoutPath, stderr: invocation.stderrPath, final: invocation.finalPath };
+    const lastMessage = `${invocation.finalPath}.last-message`;
+    if (invocation.transport === 'shell' && invocation.selected.cli === 'codex' && invocation.argv?.includes(lastMessage)) {
+        paths.lastMessage = lastMessage;
+    }
+    return paths;
+}
+export async function inspectWorkerPath(filename, kind) {
+    if (!path.isAbsolute(filename) || filename.includes('\0'))
+        throw new Error('Absolute NUL-free paths are required');
+    if (filename.split('/').includes('..'))
+        throw new Error('Worker path traversal is not allowed');
+    const normalized = path.resolve(filename);
+    let current = normalized;
+    while (true) {
+        try {
+            const canonical = await realpath(current);
+            if (canonical !== current)
+                throw new Error(`Symlink path is not allowed: ${filename}`);
+            if (current !== normalized)
+                return false;
+            const stat = await lstat(normalized);
+            if (kind === 'directory' ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1) {
+                throw new Error(`Expected an unaliased ${kind}: ${filename}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw error;
+            current = parent;
+        }
+    }
+}
+const inspectPath = inspectWorkerPath;
+export async function readBrief(filename) {
+    if (!await inspectPath(filename, 'file'))
+        return null;
+    const handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 262144)
+            throw new Error('Brief must be a bounded regular file (256 KiB)');
+        const buffer = Buffer.alloc(262145);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null);
+            if (!bytesRead)
+                break;
+            length += bytesRead;
+        }
+        if (length > 262144)
+            throw new Error('Brief exceeds 256 KiB');
+        return buffer.subarray(0, length);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Canonical containment shared by launch metadata and saved-plan authority. */
+const beneath = (root, filename) => {
+    const r = path.relative(root, filename);
+    return r === '' || !r.startsWith('..') && !path.isAbsolute(r);
+};
+async function resolveRealish(target) {
+    const parts = target.split('/').filter(Boolean);
+    for (let i = parts.length; i >= 0; i--) {
+        const candidate = i === 0 ? '/' : `/${parts.slice(0, i).join('/')}`;
+        try {
+            const real = await realpath(candidate);
+            const remainder = parts.slice(i).join('/');
+            return remainder ? path.join(real, remainder) : real;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return target;
+}
+export async function realBeneath(root, filename) {
+    const [realRoot, realFilename] = await Promise.all([resolveRealish(root), resolveRealish(filename)]);
+    return beneath(realRoot, realFilename);
+}
+/** The persisted conductor plan, never worker-supplied JSON, owns the minted ID. */
+export async function assertConductorWorkerPlan(saved, filename, drivers) {
+    if (!filename)
+        throw new Error('Conductor-owned saved plan is required to verify invocation identity');
+    const invocation = saved.invocation;
+    if (!invocation?.cwd)
+        throw new Error('Conductor plan has no worker cwd');
+    const roots = [invocation.cwd, ...(drivers[invocation.selected.cli]?.qualification.installation?.workerWritableRoots ?? [])];
+    for (const root of roots) {
+        if (await realBeneath(root, filename))
+            throw new Error('Invocation plan must be outside worker-writable roots');
+    }
+    if (!await inspectWorkerPath(filename, 'file'))
+        throw new Error('Conductor-owned saved plan is missing');
+    // Pin every ancestor, just as launch input reads do, and refuse aliased files.
+    let directory = await open('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        const components = filename.split('/').filter(Boolean), leaf = components.pop();
+        for (const component of components) {
+            const next = await open(`/proc/self/fd/${directory.fd}/${component}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+            await directory.close();
+            directory = next;
+        }
+        const handle = await open(`/proc/self/fd/${directory.fd}/${leaf}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid() || stat.size > 1048576) {
+                throw new Error('Conductor-owned saved plan must be bounded, unaliased and owned');
+            }
+            const bytes = Buffer.alloc(1048577);
+            let length = 0;
+            while (length < bytes.length) {
+                const { bytesRead } = await handle.read(bytes, length, bytes.length - length, length);
+                if (!bytesRead)
+                    break;
+                length += bytesRead;
+            }
+            if (length > 1048576 || workerConfigDigest(JSON.parse(bytes.subarray(0, length).toString('utf8'))) !== workerConfigDigest(saved)) {
+                throw new Error('Invocation identity differs from conductor-owned saved plan');
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    finally {
+        await directory.close();
+    }
+}
+//# sourceMappingURL=worker-invocation-paths.js.map

package/dist/src/serve/worker-invocation-preparation.js

@@ -0,0 +1,169 @@
+/** Validate and render a prepared invocation against trusted installation controls. */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { validateWorkerArtifacts } from './worker-artifacts.mjs';
+import { assertValidWorkerPayload } from '../mission-protocol/codecs.js';
+import { qualificationDigest } from '../models/qualification-digest.mjs';
+import { qualifyWorkerInvocationProfile, assertOperatorWorkerNativeArgv, assertWorkerSelectionAllowed, assertWorkerLaunchMode, requiresWorkerExternalBoundary, assertWorkerHealthQualification, WorkerPolicyError, DEFAULT_WORKER_SELECTION } from '../models/provider-policy.js';
+/**
+ * The exact digest formula an MCP worker binding's `inputSchemaDigest`/
+ * `outputSchemaDigest` are pinned against (used below and reused verbatim by
+ * the #2892 MCP worker-invoke bridge's own live `tools/list` schema-drift
+ * check — see `src/mcp/tools/worker-invoke.mjs` M3). Deliberately the raw
+ * `JSON.stringify` of the schema object, NOT `workerConfigDigest`'s
+ * canonicalized (sorted-key) form — a schema's own declared key order is
+ * part of what gets pinned at qualification time.
+ */
+export function mcpToolSchemaDigest(schema) {
+    return `sha256:${createHash('sha256').update(JSON.stringify(schema)).digest('hex')}`;
+}
+export async function prepareWorkerInvocation(invocation, qualification) {
+    const result = structuredClone(invocation);
+    validateWorkerArtifacts(result);
+    // shellCommand is derived syntax, never authority supplied by a brief.
+    if (result.transport === 'shell')
+        result.shellCommand = '';
+    // Validate the established invocation shape first. Health is optional and
+    // is checked after policy, installation and transport qualification below.
+    const contract = { ...result };
+    delete contract.health;
+    assertValidWorkerPayload('workerResolvedInvocation', contract);
+    if ((qualification.platform ?? process.platform) !== 'linux') {
+        throw new Error('Unsupported worker invocation platform; Linux is required');
+    }
+    if (!Number.isFinite(qualification.now) || Date.parse(result.expiresAt) <= qualification.now) {
+        throw new Error('Worker invocation is expired or has no validation clock');
+    }
+    if (qualification.adapter.id !== qualification.adapterId) {
+        throw new Error('Worker invocation adapter identity mismatch');
+    }
+    assertWorkerLaunchMode(qualification.adapter, qualification.permissions);
+    if (result.isolation !== undefined && result.isolation !== (qualification.permissions?.launchMode ?? 'systemd-unit')) {
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker launch mode differs from the execution policy');
+    }
+    for (const [key, value] of Object.entries(qualification.expectedDigests ?? {})) {
+        if (result[key] !== value)
+            throw new WorkerPolicyError('OG_PIN_MISMATCH', `Worker invocation ${key} changed`);
+    }
+    const verified = Date.parse(qualification.adapter.qualification.verifiedAt ?? '');
+    const policyDays = qualification.policy?.freshness?.policyDays ?? DEFAULT_WORKER_SELECTION.freshness.policyDays;
+    if (!Number.isFinite(verified) || verified > qualification.now || qualification.now - verified >= policyDays * 86400000) {
+        throw new Error('Worker installation qualification is stale or invalid');
+    }
+    assertWorkerSelectionAllowed(result.selected, qualification);
+    const profile = qualifyWorkerInvocationProfile(qualification.adapter, {
+        profile: result.selected.profileRef, transport: result.transport,
+        cliVersion: qualification.cliVersion,
+        requiredControls: qualification.requiredControls, policy: qualification.policy,
+        permissions: qualification.permissions, effort: result.selected.effort.value, boundary: qualification.boundary,
+        mcp: qualification.mcp,
+    });
+    if (requiresWorkerExternalBoundary(qualification.adapter, { ...qualification,
+        profile: result.selected.profileRef, transport: result.transport, effort: result.selected.effort.value })) {
+        const installed = qualification.installation;
+        const evidence = profile.installationQualification;
+        if (!installed || !evidence || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef']
+            .some(key => installed.evidence?.[key] !== evidence[key])
+            || !qualification.boundary || qualificationDigest(qualification.boundary) !== qualificationDigest(installed.boundary)) {
+            throw new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Worker installation evidence and qualified boundary must match');
+        }
+    }
+    if (profile.installationQualification) {
+        const installedAt = Date.parse(profile.installationQualification.verifiedAt);
+        if (!Number.isFinite(installedAt) || installedAt > qualification.now
+            || qualification.now - installedAt >= policyDays * 86400000) {
+            throw new Error('Worker installation qualification is stale or invalid');
+        }
+    }
+    const scopeDigest = profile.installationQualification?.scopeDigest ?? qualification.adapter.qualification.fixtureDigest;
+    if (result.selected.qualificationDigest !== scopeDigest)
+        throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker qualification digest changed');
+    const absolute = (value) => typeof value === 'string' && path.posix.isAbsolute(value) && !value.includes('\0');
+    for (const key of ['cwd', 'briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
+        if (!absolute(result[key]))
+            throw new Error(`Worker invocation requires absolute ${key}`);
+    }
+    const briefPath = path.posix.normalize(result.briefPath);
+    if ([result.stdoutPath, result.stderrPath, result.finalPath].some(value => path.posix.normalize(value) === briefPath)
+        || path.posix.normalize(result.stdoutPath) === path.posix.normalize(result.stderrPath)) {
+        throw new Error('Worker invocation input/output paths must be distinct');
+    }
+    if (result.transport === 'shell') {
+        assertOperatorWorkerNativeArgv(qualification.adapter, result.argv, result.selected, qualification.permissions);
+        if (!absolute(result.argv[0]) || result.argv[0].includes('=') || result.argv.some(value => value.includes('\0'))) {
+            throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker invocation requires an absolute binary without equals and NUL-free argv');
+        }
+        if (result.envNames.some(name => !profile.envAllowlist.includes(name))) {
+            throw new Error('Worker invocation environment is outside the qualified allowlist');
+        }
+        const quote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
+        // Only validated environment names appear as shell syntax; their values
+        // remain in the conductor environment and are never printed in the plan.
+        const environment = result.envNames.map(name => `${name}="\${${name}-}"`).join(' ');
+        // The frozen 'closed' value means empty stdin (immediate EOF). 'brief-json'
+        // pipes a conductor-built params document framed from the brief file
+        // (worker-stdin-frame.mjs), so brief text never enters any argv.
+        const worker = `env -i${environment ? ` ${environment}` : ''} ${result.argv.map(quote).join(' ')}`;
+        const outputs = `> ${quote(result.stdoutPath)} 2> ${quote(result.stderrPath)}`;
+        if (result.stdin === 'brief-json') {
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, result.briefPath, result.selected.model, result.cwd].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'adapter-frame') {
+            const binding = qualification.stdinFramerBinding;
+            if (!binding || !absolute(binding.storePath) || !/^sha256:[a-f0-9]{64}$/.test(binding.storeDigest)) {
+                throw new Error('Adapter stdin framer requires a trusted installation binding');
+            }
+            const framer = fileURLToPath(new URL('./worker-stdin-frame.mjs', import.meta.url));
+            const frame = [process.execPath, framer, '--adapter-frame', result.briefPath, result.cwd,
+                result.selected.cli, qualification.adapterId, result.selected.qualificationDigest, result.briefDigest,
+                binding.storePath, binding.storeDigest, JSON.stringify(qualification.policy ?? null), result.selected.model].map(quote).join(' ');
+            result.shellCommand = `cd ${quote(result.cwd)} && env -i${environment ? ` ${environment}` : ''} ${frame} | ${worker} ${outputs}`;
+        }
+        else if (result.stdin === 'closed' || result.stdin === 'brief-text') {
+            const stdin = result.stdin === 'closed' ? '< /dev/null' : `< ${quote(result.briefPath)}`;
+            result.shellCommand = `cd ${quote(result.cwd)} && ${worker} ${stdin} ${outputs}`;
+        }
+        else {
+            throw new Error(`Unsupported worker stdin mode: ${result.stdin}`);
+        }
+    }
+    else {
+        const binding = result.mcp;
+        for (const key of ['serverRef', 'tool', 'inputSchemaDigest', 'outputSchemaDigest', 'sessionIsolation']) {
+            if (binding[key] !== profile.mcp[key])
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker binding changed: ${key}`);
+        }
+        if (binding.timeoutSeconds > result.limits.wallSeconds) {
+            throw new Error('MCP worker timeout exceeds the invocation deadline');
+        }
+        for (const key of ['input', 'output']) {
+            const schema = qualification.mcpSchemas?.[key];
+            if (!schema || mcpToolSchemaDigest(schema) !== binding[`${key}SchemaDigest`]) {
+                throw new WorkerPolicyError('OG_PIN_MISMATCH', `MCP worker ${key} schema digest changed`);
+            }
+        }
+        const { default: Ajv2020 } = await import('ajv/dist/2020.js');
+        const { default: addFormats } = await import('ajv-formats');
+        const validate = addFormats(new Ajv2020({ strict: true, allErrors: true })).compile(qualification.mcpSchemas.input);
+        if (!validate(binding.arguments))
+            throw new Error('MCP worker arguments violate the pinned input schema');
+    }
+    assertValidWorkerPayload('workerResolvedInvocation', result);
+    if (result.health !== undefined) {
+        if (result.health.profileRef !== result.selected.profileRef
+            || result.health.hardTimeoutSeconds > Math.min(result.limits.wallSeconds, result.mcp?.timeoutSeconds ?? Infinity)) {
+            throw new Error('Worker health profile or wall ceiling mismatch');
+        }
+        if (['native', 'external'].includes(result.health.stepEnforcement)
+            && profile.controls.stepCap?.support !== result.health.stepEnforcement)
+            throw new Error('Unqualified worker step enforcement');
+    }
+    assertWorkerHealthQualification(profile, { profileRef: result.selected.profileRef, cliVersion: qualification.cliVersion,
+        accountScope: qualification.installation?.accountScope ?? '', inferenceProvider: result.selected.inferenceProvider,
+        model: result.selected.model, effort: result.selected.effort.value });
+    return result;
+}
+//# sourceMappingURL=worker-invocation-preparation.js.map