@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/src/hosts/claude-state.ts

@@ -0,0 +1,403 @@
+import { runtimeSeedSources } from "../runtime/config";
+import {
+  candidateArtifactEnvironment,
+  candidateArtifactReadRoots,
+} from "../candidate-artifacts";
+import {
+  cp,
+  mkdir,
+  realpath,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { delimiter, dirname, join } from "node:path";
+import type { HostAdapter } from "../engine";
+import { nativeStateParent } from "../native-transcript-state";
+import {
+  workspaceBoundaryException,
+  workspaceStatePath,
+} from "../fixtures/workspace-state";
+import {
+  candidateTranscriptEnvironment,
+  candidateTranscriptRoots,
+} from "../native-transcripts";
+import { prepareHookMounts, runtimeHooksEnabled } from "../runtime/hooks";
+import {
+  insideRuntimeRoot as inside,
+  runtimeExecutableProtection,
+} from "../runtime/paths";
+import { prepareRuntimeState } from "../runtime/state";
+import {
+  sharedCacheDenyRoots,
+  sharedCacheRoots,
+} from "../runtime/shared-cache";
+import { stageClaudeAuthentication } from "./claude-credential";
+import { claudeHostSettings } from "./claude-settings";
+import { evaluationProtectedRoots } from "./isolation-roots";
+type Request = Parameters<HostAdapter["run"]>[0];
+export interface ClaudeHostOptions {
+  binary: string;
+  model: string;
+  effort: string;
+  projectRoot: string;
+  resultsRoot: string;
+  additionalProtectedRoots: string[];
+  credentialFile?: string;
+  uvCacheDir?: string;
+  toolchainBinDir?: string;
+  projectSettings?: boolean;
+  timeoutMs?: number;
+  retainHostDiagnostics?: boolean;
+}
+
+function minimalRoots(roots: string[]): string[] {
+  return roots.filter(
+    (root) => !roots.some((other) => other !== root && inside(other, root)),
+  );
+}
+
+function claudeSeedSources(request: Request): string[] {
+  return runtimeSeedSources(request.runtimePolicy);
+}
+
+async function createClaudePrivateState(
+  stateRoot: string,
+  options: ClaudeHostOptions,
+) {
+  await mkdir(join(stateRoot, "private"), { mode: 0o700 });
+  const privateRoot = await realpath(join(stateRoot, "private"));
+  const home = join(stateRoot, "home"),
+    temp = join(stateRoot, "tmp");
+  await Promise.all([home, temp].map((path) => mkdir(path, { mode: 0o700 })));
+  const authentication = await stageClaudeAuthentication(
+    join(privateRoot, "config"),
+    options.credentialFile,
+  );
+  return {
+    privateRoot,
+    home,
+    temp,
+    authentication,
+    credential: authentication.credentialFile,
+  };
+}
+
+async function protectedClaudeRoots(
+  request: Request,
+  options: ClaudeHostOptions,
+  credential: string,
+) {
+  const candidates = await evaluationProtectedRoots({
+    ownedStateRoot: dirname(dirname(dirname(credential))),
+    workspace: request.workspace,
+    projectRoot: options.projectRoot,
+    resultsRoot: options.resultsRoot,
+    additionalRoots: [
+      ...options.additionalProtectedRoots,
+      ...claudeSeedSources(request),
+    ],
+  });
+  const roots = request.runtimePolicy ? candidates : minimalRoots(candidates);
+  const namespace = await nativeStateParent();
+  if (roots.some((root) => root !== namespace && inside(root, credential)))
+    throw new Error("Claude private state overlaps a protected root");
+  const binary = await realpath(options.binary);
+  const executableRoots = runtimeExecutableProtection(
+    [dirname(binary)],
+    roots,
+    Boolean(request.runtimePolicy),
+  );
+  if (executableRoots.some((root) => inside(root, binary)))
+    throw new Error("Claude executable resides inside a protected root");
+  return roots;
+}
+
+async function claudeToolchainDirectory(
+  options: ClaudeHostOptions,
+  roots: string[],
+): Promise<string | null> {
+  const directory = options.toolchainBinDir
+    ? await realpath(options.toolchainBinDir)
+    : null;
+  if (
+    directory &&
+    (roots.some((root) => inside(root, directory)) ||
+      !(await stat(directory)).isDirectory())
+  )
+    throw new Error("Claude toolchain directory is unavailable or protected");
+  return directory;
+}
+
+async function prepareClaudeRuntime(
+  options: ClaudeHostOptions,
+  roots: string[],
+  workspace: string,
+): Promise<string | null> {
+  if (!options.uvCacheDir) return null;
+  const cache = await realpath(options.uvCacheDir);
+  if (
+    roots.some((root) => inside(root, cache)) ||
+    !(await stat(cache)).isDirectory()
+  )
+    throw new Error("Claude UV cache is unavailable or protected");
+  const runtimeRoot = join(workspace, ".git", "sevro-runtime");
+  await mkdir(runtimeRoot, { recursive: true, mode: 0o700 });
+  await cp(cache, join(runtimeRoot, "uv-cache"), {
+    recursive: true,
+    force: false,
+    errorOnExist: true,
+  });
+  return runtimeRoot;
+}
+
+function claudeEnvironment(
+  state: Awaited<ReturnType<typeof createClaudePrivateState>>,
+  request: Request,
+  toolchain: string | null,
+  runtime: string | null,
+): Record<string, string> {
+  return {
+    ...state.authentication.environment,
+    ...request.runtimePolicy?.environment,
+    CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1",
+    PATH: claudePath(request, toolchain),
+    LANG: process.env.LANG ?? "C",
+    HOME: runtime ? join(runtime, "host-home") : state.home,
+    TMPDIR: state.temp,
+    CLAUDE_CONFIG_DIR: dirname(state.credential),
+    NO_COLOR: "1",
+    ...claudeRuntimeEnvironment(runtime),
+  };
+}
+
+function claudePath(request: Request, toolchain: string | null): string {
+  const path =
+    request.runtimePolicy?.environment.PATH ??
+    process.env.PATH ??
+    "/usr/bin:/bin";
+  return [request.fixtureBinDir, toolchain, path]
+    .filter(Boolean)
+    .join(delimiter);
+}
+
+function claudeRuntimeEnvironment(
+  runtime: string | null,
+): Record<string, string> {
+  return runtime
+    ? {
+        UV_CACHE_DIR: join(runtime, "uv-cache"),
+        UV_PROJECT_ENVIRONMENT: join(runtime, "project-environment"),
+        UV_OFFLINE: "1",
+        PYTHONDONTWRITEBYTECODE: "1",
+      }
+    : {};
+}
+
+export async function prepareClaudeState(
+  stateRoot: string,
+  options: ClaudeHostOptions,
+  request: Request,
+  pluginDirs: string[],
+) {
+  await requireClaudeRuntimeNamespace(request, stateRoot);
+  const state = await createClaudePrivateState(stateRoot, options);
+  const transcripts = await claudeTranscriptAccess(
+    stateRoot,
+    state.credential,
+    request,
+  );
+  const roots = await protectedClaudeRoots(request, options, state.credential);
+  const toolchain = await claudeToolchainDirectory(options, roots);
+  const runtime = await prepareClaudeRuntime(options, roots, request.workspace);
+  const settingsPath = join(state.privateRoot, "settings.json");
+  const hooks = await claudeHookMounts(
+    request,
+    stateRoot,
+    state.privateRoot,
+    pluginDirs,
+    roots,
+  );
+  const effectivePlugins = hooks?.directories ?? pluginDirs;
+  const env = claudeEnvironment(state, request, toolchain, runtime);
+  const runtimeWriteRoot = await applyClaudeRuntimeEnvironment(
+    request,
+    env,
+    runtime,
+    stateRoot,
+  );
+  const cacheRoots = await sharedCacheRoots(
+    request.runtimePolicy,
+    request.runtimeRole,
+    roots,
+  );
+  await writeFile(
+    settingsPath,
+    JSON.stringify(
+      claudeHostSettings(
+        state.privateRoot,
+        state.credential,
+        [...pluginDirs, ...effectivePlugins],
+        [
+          ...roots,
+          ...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole),
+        ],
+        transcripts.policy,
+        [
+          ...transcripts.readRoots,
+          ...candidateTranscriptRoots(request.candidateTranscriptRoot),
+          ...candidateArtifactReadRoots(request.candidateArtifactRoots),
+        ],
+        runtimeWriteRoot
+          ? { root: runtimeWriteRoot, workspace: request.workspace, cacheRoots }
+          : undefined,
+        request.workspace,
+      ),
+    ),
+    { flag: "wx", mode: 0o600 },
+  );
+  Object.assign(env, transcripts.environment);
+  Object.assign(
+    env,
+    candidateTranscriptEnvironment(request.candidateTranscriptRoot),
+    candidateArtifactEnvironment(request.candidateArtifactRoots),
+  );
+  if (runtime) await mkdir(join(runtime, "host-home"), { mode: 0o700 });
+  return {
+    credential: state.credential,
+    settingsPath,
+    env,
+    hooks,
+    pluginDirs: effectivePlugins,
+  };
+}
+
+/** Claude's implicit /tmp/claude writes cannot contain the read-denied peer namespace. */
+async function requireClaudeRuntimeNamespace(
+  request: Request,
+  stateRoot: string,
+) {
+  if (
+    !request.runtimePolicy &&
+    !workspaceBoundaryException(workspaceStatePath(), request.workspace).length
+  )
+    return;
+  const implicitRoots = await Promise.all(
+    ["/tmp/claude", "/private/tmp/claude"].map(implicitClaudeWritePaths),
+  );
+  const namespace = dirname(stateRoot);
+  if (
+    implicitRoots
+      .flat()
+      .some((root) => inside(root, namespace) || inside(namespace, root))
+  )
+    throw new Error(
+      "Claude namespace overlaps an implicit native writable root",
+    );
+}
+
+async function implicitClaudeWritePaths(root: string): Promise<string[]> {
+  try {
+    return [root, await realpath(root)];
+  } catch (cause) {
+    if ((cause as NodeJS.ErrnoException).code !== "ENOENT")
+      throw new Error("Claude implicit native writable root is unreadable", {
+        cause,
+      });
+    return [root];
+  }
+}
+
+async function claudeTranscriptAccess(
+  stateRoot: string,
+  credential: string,
+  request: Request,
+) {
+  const policy = request.runtimePolicy;
+  if (!policy?.nativeTranscripts)
+    return { policy, environment: {}, readRoots: [] };
+  const view = join(stateRoot, "native-home");
+  const projects = join(view, "projects");
+  await mkdir(projects, { recursive: true, mode: 0o700 });
+  await symlink(projects, join(dirname(credential), "projects"));
+  const startup = join(view, "shell-env");
+  const script = `export CLAUDE_CONFIG_DIR='${view.replaceAll("'", `'"'"'`)}'\n`;
+  await writeFile(startup, script, { flag: "wx", mode: 0o600 });
+  await writeFile(join(view, ".zshenv"), script, { flag: "wx", mode: 0o600 });
+  return {
+    policy,
+    readRoots: [projects, view],
+    environment: {
+      SEVRO_NATIVE_TRANSCRIPT_ROOT: projects,
+      BASH_ENV: startup,
+      ZDOTDIR: view,
+    },
+  };
+}
+
+async function claudeHookMounts(
+  request: Request,
+  stateRoot: string,
+  privateRoot: string,
+  pluginDirs: string[],
+  roots: string[],
+) {
+  const policy = request.runtimePolicy;
+  if (!policy || !runtimeHooksEnabled(policy)) return undefined;
+  return prepareHookMounts({
+    workspace: request.workspace,
+    stateRoot,
+    privateRoot,
+    pluginRoots: pluginDirs,
+    protectedRoots: [privateRoot, ...roots, ...runtimeSeedSources(policy)],
+    policy,
+  });
+}
+
+async function applyClaudeRuntimeEnvironment(
+  request: Request,
+  env: Record<string, string>,
+  runtime: string | null,
+  stateRoot: string,
+): Promise<string | undefined> {
+  const isolated = await prepareRuntimeState(
+    request.workspace,
+    claudeCommandPolicy(request),
+    request.runtimeRole ?? "candidate",
+    claudeRuntimeDirectory(request, stateRoot),
+  );
+  if (request.runtimePolicy) {
+    Object.assign(env, isolated.environment);
+    env.PATH = [request.fixtureBinDir, isolated.environment.PATH ?? env.PATH]
+      .filter(Boolean)
+      .join(delimiter);
+    return isolated.root;
+  }
+  applyLegacyClaudeCommandEnvironment(env, isolated, runtime);
+  return undefined;
+}
+
+function claudeRuntimeDirectory(request: Request, stateRoot: string) {
+  return request.runtimePolicy
+    ? (request.candidateRuntimeRoot ?? join(stateRoot, "runtime"))
+    : undefined;
+}
+
+function applyLegacyClaudeCommandEnvironment(
+  env: Record<string, string>,
+  isolated: Awaited<ReturnType<typeof prepareRuntimeState>>,
+  runtime: string | null,
+): void {
+  if (!runtime) env.HOME = isolated.home;
+  env.TMPDIR = isolated.temp;
+}
+
+function claudeCommandPolicy(request: Request) {
+  return (
+    request.runtimePolicy ?? {
+      format: "sevro.runtime.v1" as const,
+      environment: {},
+      readOnlyRoots: [],
+    }
+  );
+}

package/src/hosts/claude-tool-calls.ts

@@ -1,20 +1,12 @@
-import { createHash } from "node:crypto";
+import { sha256 } from "../identity";
+import { isRecord } from "../value-guards";
 import { summarizeClaudeEvents } from "./claude-events";
 
 const MAX_RETAINED_CALLS = 128;
 type Entry = Record<string, unknown>;
 
-function record(value: unknown): value is Entry {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
 function label(value: unknown, max = 256): string | null {
-  return typeof value === "string" &&
-    value.length >= 1 &&
-    value.length <= max &&
-    /^[A-Za-z0-9_.:-]+$/.test(value)
-    ? value
-    : null;
+  return typeof value === "string" && boundedLabel(value, max) ? value : null;
 }
 
 interface SkillCall {
@@ -49,111 +41,184 @@ export interface ClaudeToolCallsObservation {
   };
 }
 
+interface CallState {
+  calls: Array<SkillCall | AgentCall>;
+  malformed: boolean;
+  truncated: boolean;
+  ordinal: number;
+}
+type Actor = { actor: "parent" | "nested"; parentToolUseId: string | null };
+
 /** Retain ordered host call metadata, never tool prompts or results. */
 export function claudeToolCallsObservation(
   stream: string,
   exitCode: number,
 ): ClaudeToolCallsObservation {
   const summary = summarizeClaudeEvents(stream, exitCode);
-  const calls: Array<SkillCall | AgentCall> = [];
-  let malformed = false;
-  let truncated = false;
-  let ordinal = 0;
+  const state: CallState = {
+    calls: [],
+    malformed: false,
+    truncated: false,
+    ordinal: 0,
+  };
   for (const line of stream.split("\n")) {
     if (!line.trim()) continue;
-    let event: unknown;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      malformed = true;
-      continue;
-    }
-    if (!record(event) || event.type !== "assistant") continue;
-    const blocks = record(event.message) ? event.message.content : null;
-    if (!Array.isArray(blocks)) {
-      malformed = true;
-      continue;
-    }
-    const parentToolUseId = label(event.parent_tool_use_id, 128);
-    const actor = parentToolUseId ? "nested" : "parent";
-    if (
-      event.parent_tool_use_id !== undefined &&
-      event.parent_tool_use_id !== null &&
-      actor === "parent"
-    )
-      malformed = true;
-    for (const value of blocks) {
-      if (!record(value) || value.type !== "tool_use") continue;
-      ordinal++;
-      if (!["Skill", "Agent", "Task"].includes(String(value.name))) continue;
-      if (calls.length >= MAX_RETAINED_CALLS) {
-        truncated = true;
-        break;
-      }
-      const input = record(value.input) ? value.input : null;
-      if (value.name === "Skill") {
-        const invocation = label(input?.skill);
-        if (!invocation) {
-          malformed = true;
-          continue;
-        }
-        calls.push({
-          ordinal,
-          actor,
-          parentToolUseId,
-          name: "Skill",
-          skill: invocation.split(":").at(-1)!,
-          invocation,
-        });
-        continue;
-      }
-      const toolUseId = label(value.id, 128);
-      const subagentType = label(input?.subagent_type ?? input?.subagentType);
-      const runInBackground =
-        typeof input?.run_in_background === "boolean"
-          ? input.run_in_background
-          : null;
-      const model = input?.model === undefined ? null : label(input.model, 128);
-      const boundedPrompt =
-        typeof input?.prompt === "string" &&
-        Buffer.byteLength(input.prompt, "utf8") <= 1024 * 1024
-          ? input.prompt
-          : null;
-      const promptSha256 = boundedPrompt
-        ? createHash("sha256").update(boundedPrompt).digest("hex")
-        : null;
-      const promptFirstLineSha256 = boundedPrompt
-        ? createHash("sha256")
-            .update(boundedPrompt.split(/\r?\n/, 1)[0]!)
-            .digest("hex")
-        : null;
-      if (
-        !toolUseId ||
-        !subagentType ||
-        runInBackground === null ||
-        (input?.model !== undefined && !model) ||
-        !promptSha256
-      )
-        malformed = true;
-      calls.push({
-        ordinal,
-        actor,
-        parentToolUseId,
-        name: "Agent",
-        toolUseId,
-        subagentType,
-        runInBackground,
-        model,
-        promptSha256,
-        promptFirstLineSha256,
-      });
-    }
-    if (truncated) break;
+    collectEvent(line, state);
+    if (state.truncated) break;
   }
   return {
     id: "sevro.claude.tool-calls",
-    completeness:
-      summary.complete && !malformed && !truncated ? "complete" : "partial",
-    data: { method: "stream_tool_calls", calls, truncated },
+    completeness: callCompleteness(summary.complete, state),
+    data: {
+      method: "stream_tool_calls",
+      calls: state.calls,
+      truncated: state.truncated,
+    },
   };
 }
+
+function callCompleteness(
+  complete: boolean,
+  state: CallState,
+): "complete" | "partial" {
+  return complete && !state.malformed && !state.truncated
+    ? "complete"
+    : "partial";
+}
+
+function collectEvent(line: string, state: CallState): void {
+  let event: unknown;
+  try {
+    event = JSON.parse(line);
+  } catch {
+    state.malformed = true;
+    return;
+  }
+  if (!isRecord(event) || event.type !== "assistant") return;
+  collectAssistant(event, state);
+}
+
+function collectAssistant(event: Entry, state: CallState): void {
+  const blocks: unknown = isRecord(event.message)
+    ? event.message.content
+    : null;
+  if (!Array.isArray(blocks)) {
+    state.malformed = true;
+    return;
+  }
+  const actor = actorContext(event, state);
+  for (const block of blocks) {
+    collectBlock(block, actor, state);
+    if (state.truncated) break;
+  }
+}
+
+function actorContext(event: Entry, state: CallState): Actor {
+  const parentToolUseId = label(event.parent_tool_use_id, 128);
+  const actor = parentToolUseId ? "nested" : "parent";
+  if (
+    event.parent_tool_use_id !== undefined &&
+    event.parent_tool_use_id !== null &&
+    actor === "parent"
+  )
+    state.malformed = true;
+  return { actor, parentToolUseId };
+}
+
+function collectBlock(value: unknown, actor: Actor, state: CallState): void {
+  if (!isRecord(value) || value.type !== "tool_use") return;
+  state.ordinal++;
+  if (!["Skill", "Agent", "Task"].includes(String(value.name))) return;
+  if (state.calls.length >= MAX_RETAINED_CALLS) {
+    state.truncated = true;
+    return;
+  }
+  collectSupportedCall(value, actor, state);
+}
+
+function collectSupportedCall(
+  value: Entry,
+  actor: Actor,
+  state: CallState,
+): void {
+  const input = isRecord(value.input) ? value.input : {};
+  if (value.name === "Skill") {
+    collectSkill(input, actor, state);
+    return;
+  }
+  const call = agentCall(value, input, actor, state.ordinal);
+  if (!validAgentCall(call, input)) state.malformed = true;
+  state.calls.push(call);
+}
+
+function collectSkill(input: Entry, actor: Actor, state: CallState): void {
+  const invocation = label(input.skill);
+  if (!invocation) {
+    state.malformed = true;
+    return;
+  }
+  state.calls.push({
+    ordinal: state.ordinal,
+    ...actor,
+    name: "Skill",
+    skill: invocation.slice(invocation.lastIndexOf(":") + 1),
+    invocation,
+  });
+}
+
+function boundedPrompt(input: Entry): string | null {
+  if (typeof input.prompt !== "string") return null;
+  return Buffer.byteLength(input.prompt, "utf8") <= 1024 * 1024
+    ? input.prompt
+    : null;
+}
+
+function promptDigest(prompt: string | null): string | null {
+  return prompt ? sha256(prompt) : null;
+}
+
+function firstLineDigest(prompt: string | null): string | null {
+  return prompt ? sha256(prompt.split(/\r?\n/, 1).join("")) : null;
+}
+
+function agentCall(
+  value: Entry,
+  input: Entry,
+  actor: Actor,
+  ordinal: number,
+): AgentCall {
+  const prompt = boundedPrompt(input);
+  return {
+    ordinal,
+    ...actor,
+    name: "Agent",
+    toolUseId: label(value.id, 128),
+    subagentType: label(input.subagent_type ?? input.subagentType),
+    runInBackground:
+      typeof input.run_in_background === "boolean"
+        ? input.run_in_background
+        : null,
+    model: input.model === undefined ? null : label(input.model, 128),
+    promptSha256: promptDigest(prompt),
+    promptFirstLineSha256: firstLineDigest(prompt),
+  };
+}
+
+function validAgentCall(call: AgentCall, input: Entry): boolean {
+  const required = [call.toolUseId, call.subagentType, call.promptSha256];
+  return (
+    required.every(Boolean) &&
+    call.runInBackground !== null &&
+    validAgentModel(input, call.model)
+  );
+}
+
+function validAgentModel(input: Entry, model: string | null): boolean {
+  return input.model === undefined || model !== null;
+}
+
+function boundedLabel(value: string, max: number): boolean {
+  return (
+    value.length >= 1 && value.length <= max && /^[A-Za-z0-9_.:-]+$/.test(value)
+  );
+}