@garuda-agent/garuda 0.0.1 → 0.14.1

package/SECURITY.md

@@ -0,0 +1,32 @@
+# Security policy
+
+Garuda runs commands and edits files for a model, so we take security reports seriously.
+
+## Supported versions
+
+| Version | Supported |
+| --- | --- |
+| 0.14.x | Yes |
+| Older | No |
+
+## Report a vulnerability
+
+Do not open a public issue. Use GitHub's private vulnerability reporting: in this repository, open
+**Security**, then **Report a vulnerability**. Give:
+
+- the version (`garuda --version`) and the platform (macOS or Linux, the sandbox in use);
+- the steps to reproduce, and what you expected;
+- the effect, for example a sandbox escape, a permission or team-policy bypass, a secret in a
+  session file or the audit log, or a write that the user did not approve.
+
+You get an answer within 7 days. We agree a fix and a disclosure date with you, and we credit you in
+the release notes unless you ask us not to.
+
+## Scope
+
+In scope: the permission engine and the team policy, the OS sandbox (Seatbelt, bubblewrap), the
+network allowlist and its proxy, secret redaction, the audit log, and the consent for project
+content (hooks, MCP servers, settings, commands, skills, agents).
+
+Known limits are listed in the README under the status table. A report about one of them is still
+welcome when it shows a new way to reach the same effect.

package/dist/anthropic-NQDBCHJU.js

@@ -0,0 +1,327 @@
+#!/usr/bin/env node
+
+// src/model/anthropic.ts
+import Anthropic from "@anthropic-ai/sdk";
+import { Agent, fetch as undiciFetch } from "undici";
+var WEB_SEARCH_TOOL = "web_search_20250305";
+var AnthropicClient = class {
+  /** Claude's web search runs on Anthropic's servers (0.6). */
+  serverTools = ["web_search"];
+  client;
+  model;
+  constructor(options) {
+    this.model = options.model;
+    this.client = options.client ?? new Anthropic(clientOptions(options.apiKey));
+  }
+  async *stream(request, options) {
+    const stream = this.client.messages.stream(
+      toWireParams(this.model, request),
+      options?.signal === void 0 ? {} : { signal: options.signal }
+    );
+    for await (const event of stream) {
+      if (event.type === "content_block_delta" && event.delta.type === "text_delta") {
+        yield { type: "text_delta", text: event.delta.text };
+      } else if (event.type === "content_block_delta" && event.delta.type === "thinking_delta" && event.delta.thinking !== "" && request.thinking?.hide !== true) {
+        yield { type: "thinking_delta", text: event.delta.thinking };
+      }
+    }
+    const final = await stream.finalMessage();
+    const response = fromWireMessage(final);
+    yield {
+      type: "response",
+      response: request.thinking?.hide === true ? withHiddenThinking(response) : response
+    };
+  }
+};
+function withHiddenThinking(response) {
+  return {
+    ...response,
+    content: response.content.map((b) => b.type === "thinking" ? { ...b, text: "" } : b)
+  };
+}
+var STREAM_IDLE_MS = 20 * 6e4;
+var dispatchers = /* @__PURE__ */ new Map();
+function streamFetch(idleMs = STREAM_IDLE_MS) {
+  let agent = dispatchers.get(idleMs);
+  if (agent === void 0) {
+    agent = new Agent({ bodyTimeout: idleMs });
+    dispatchers.set(idleMs, agent);
+  }
+  const dispatcher = agent;
+  return ((input, init) => undiciFetch(input, { ...init, dispatcher }));
+}
+function clientOptions(apiKey) {
+  return { ...apiKey === void 0 ? {} : { apiKey }, fetch: streamFetch() };
+}
+function toWireParams(model, request) {
+  const params = {
+    model,
+    max_tokens: request.maxTokens,
+    system: [{ type: "text", text: request.system, cache_control: { type: "ephemeral" } }],
+    messages: request.messages.map(toWireMessage)
+  };
+  const last = params.messages.at(-1);
+  if (last !== void 0 && Array.isArray(last.content) && last.content.length > 0) {
+    const blocks = last.content;
+    const block = blocks.findLast((b) => b.type !== "thinking" && b.type !== "redacted_thinking");
+    if (block !== void 0) block.cache_control = { type: "ephemeral" };
+  }
+  const tools = toWireTools(request.tools, request.serverTools ?? []);
+  if (tools.length > 0) params.tools = tools;
+  const thinking = request.thinking;
+  if (thinking?.adaptive === true || thinking?.display !== void 0) {
+    params.thinking = {
+      type: "adaptive",
+      ...thinking.display === void 0 ? {} : { display: thinking.display }
+    };
+  }
+  if (thinking?.effort !== void 0) params.output_config = { effort: thinking.effort };
+  return params;
+}
+function toWireTools(tools, serverTools = []) {
+  const out = [
+    ...tools.map(
+      (tool) => ({
+        name: tool.name,
+        description: tool.description,
+        input_schema: { ...tool.inputSchema, type: "object" }
+      })
+    ),
+    ...serverTools.map(
+      (spec) => ({
+        type: WEB_SEARCH_TOOL,
+        name: "web_search",
+        max_uses: spec.maxUses,
+        ...spec.allowedDomains === void 0 ? {} : { allowed_domains: [...spec.allowedDomains] },
+        ...spec.blockedDomains === void 0 ? {} : { blocked_domains: [...spec.blockedDomains] }
+      })
+    )
+  ];
+  const last = out.at(-1);
+  if (last !== void 0) last.cache_control = { type: "ephemeral" };
+  return out;
+}
+function toWireMessage(message) {
+  return { role: message.role, content: message.content.map(toWireBlock) };
+}
+function toWireBlock(block) {
+  switch (block.type) {
+    case "text":
+      return block.citations === void 0 ? { type: "text", text: block.text } : {
+        type: "text",
+        text: block.text,
+        citations: structuredClone(block.citations)
+      };
+    // Server tool blocks go back exactly as they came (the results hold encrypted content), and so
+    // do thinking blocks (0.9: the signature checks them).
+    case "server_tool_use":
+    case "server_tool_result":
+    case "thinking":
+      return structuredClone(block.wire);
+    case "tool_use":
+      return { type: "tool_use", id: block.id, name: block.name, input: block.input };
+    case "tool_result":
+      return {
+        type: "tool_result",
+        tool_use_id: block.toolUseId,
+        content: block.content,
+        is_error: block.isError
+      };
+  }
+}
+function fromWireMessage(message) {
+  const content = [];
+  for (const block of message.content) {
+    if (block.type === "text") {
+      const citations = block.citations ?? [];
+      content.push(
+        citations.length === 0 ? { type: "text", text: block.text } : { type: "text", text: block.text, citations: structuredClone(citations) }
+      );
+    } else if (block.type === "tool_use") {
+      content.push({ type: "tool_use", id: block.id, name: block.name, input: block.input });
+    } else if (block.type === "server_tool_use") {
+      content.push({
+        type: "server_tool_use",
+        id: block.id,
+        name: block.name,
+        input: block.input,
+        wire: structuredClone(block)
+      });
+    } else if (block.type === "web_search_tool_result") {
+      content.push(webSearchResult(block));
+    } else if (block.type === "thinking") {
+      content.push({ type: "thinking", text: block.thinking, wire: structuredClone(block) });
+    } else if (block.type === "redacted_thinking") {
+      content.push({ type: "thinking", text: "", wire: structuredClone(block) });
+    }
+  }
+  return {
+    content,
+    stopReason: fromWireStopReason(message.stop_reason),
+    usage: fromWireUsage(message.usage)
+  };
+}
+function webSearchResult(block) {
+  const wire = structuredClone(block);
+  if (!Array.isArray(block.content)) {
+    return {
+      type: "server_tool_result",
+      toolUseId: block.tool_use_id,
+      name: "web_search",
+      results: [],
+      error: block.content.error_code,
+      wire
+    };
+  }
+  return {
+    type: "server_tool_result",
+    toolUseId: block.tool_use_id,
+    name: "web_search",
+    results: block.content.map((r) => ({
+      title: r.title,
+      url: r.url,
+      ...r.page_age === null || r.page_age === void 0 ? {} : { age: r.page_age }
+    })),
+    wire
+  };
+}
+function fromWireStopReason(reason) {
+  switch (reason) {
+    case "end_turn":
+    case "stop_sequence":
+      return "end_turn";
+    case "tool_use":
+      return "tool_use";
+    case "max_tokens":
+    case "model_context_window_exceeded":
+      return "max_tokens";
+    case "refusal":
+      return "refusal";
+    case "pause_turn":
+      return "pause_turn";
+    default:
+      return "other";
+  }
+}
+function fromWireUsage(usage) {
+  const searches = usage.server_tool_use?.web_search_requests ?? 0;
+  return {
+    inputTokens: usage.input_tokens,
+    outputTokens: usage.output_tokens,
+    cacheReadTokens: usage.cache_read_input_tokens ?? 0,
+    cacheWriteTokens: usage.cache_creation_input_tokens ?? 0,
+    ...searches > 0 ? { webSearches: searches } : {}
+  };
+}
+var BATCH_CHECK_TIMEOUT_MS = 6e4;
+var MAX_FAILED_CHECKS = 10;
+var BATCH_POLL_MS = [5e3, 1e4, 2e4, 3e4];
+var AnthropicBatchClient = class {
+  serverTools = ["web_search"];
+  client;
+  model;
+  pollMs;
+  onWait;
+  noticeMs;
+  constructor(options) {
+    this.model = options.model;
+    this.pollMs = options.pollMs ?? BATCH_POLL_MS;
+    this.onWait = options.onWait;
+    this.noticeMs = options.noticeMs ?? 6e4;
+    this.client = options.client ?? new Anthropic(clientOptions(options.apiKey));
+  }
+  async *stream(request, options) {
+    const signal = options?.signal;
+    const params = toWireParams(
+      this.model,
+      request
+    );
+    const batch = await this.client.messages.batches.create(
+      { requests: [{ custom_id: "garuda", params }] },
+      signal === void 0 ? {} : { signal }
+    );
+    const started = Date.now();
+    this.onWait?.({ batchId: batch.id, waitedMs: 0, status: "created" });
+    let noticed = 0;
+    let failed = 0;
+    try {
+      for (let i = 0; ; i++) {
+        await wait(this.pollMs[Math.min(i, this.pollMs.length - 1)] ?? 3e4, signal);
+        let status;
+        try {
+          const state = await this.client.messages.batches.retrieve(batch.id, void 0, {
+            timeout: BATCH_CHECK_TIMEOUT_MS,
+            ...signal === void 0 ? {} : { signal }
+          });
+          status = state.processing_status;
+          failed = 0;
+        } catch (error) {
+          if (signal?.aborted === true || ++failed >= MAX_FAILED_CHECKS) throw error;
+          status = "check failed, trying again";
+        }
+        if (status === "ended") break;
+        const waited = Date.now() - started;
+        if (waited - noticed >= this.noticeMs) {
+          noticed = waited;
+          this.onWait?.({ batchId: batch.id, waitedMs: waited, status });
+        }
+      }
+    } catch (error) {
+      await this.client.messages.batches.cancel(batch.id).catch(() => void 0);
+      throw error;
+    }
+    const results = await this.client.messages.batches.results(batch.id);
+    for await (const item of results) {
+      if (item.custom_id !== "garuda") continue;
+      const result = item.result;
+      if (result.type === "succeeded") {
+        const response = { ...fromWireMessage(result.message), priceFactor: 0.5 };
+        const text = response.content.map((b) => b.type === "text" ? b.text : "").join("");
+        if (text !== "") yield { type: "text_delta", text };
+        yield { type: "response", response };
+        return;
+      }
+      if (result.type === "errored") {
+        const detail = result.error.error;
+        throw Object.assign(new Error(`Batch request failed: ${detail.message}`), {
+          error: result.error
+        });
+      }
+      throw new Error(`The batch request was ${result.type}.`);
+    }
+    throw new Error("The batch ended without a result.");
+  }
+};
+function wait(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+export {
+  AnthropicBatchClient,
+  AnthropicClient,
+  BATCH_CHECK_TIMEOUT_MS,
+  BATCH_POLL_MS,
+  STREAM_IDLE_MS,
+  WEB_SEARCH_TOOL,
+  clientOptions,
+  fromWireMessage,
+  streamFetch,
+  toWireMessage,
+  toWireParams,
+  toWireTools,
+  withHiddenThinking
+};
+//# sourceMappingURL=anthropic-NQDBCHJU.js.map

package/dist/chunk-35GMLLJW.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import {
+  hostCommand,
+  shellWord
+} from "./chunk-ZGZ2ZADL.js";
+import {
+  JOBS_DIR
+} from "./chunk-KKB5W47S.js";
+
+// src/jobs/launchd.ts
+import { createHash } from "crypto";
+import { existsSync, readFileSync } from "fs";
+import { mkdir, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { basename, join } from "path";
+function defaultAgentEnv() {
+  const shell = process.env.SHELL ?? "";
+  return {
+    home: homedir(),
+    uid: process.getuid?.() ?? 501,
+    shell: /\/(zsh|bash)$/.test(shell) ? shell : "/bin/zsh",
+    node: process.execPath,
+    script: process.argv[1] ?? ""
+  };
+}
+function agentLabel(id) {
+  return `dev.garuda.job.${id}`;
+}
+function agentPath(home, id) {
+  return join(home, "Library", "LaunchAgents", `${agentLabel(id)}.plist`);
+}
+function nextTime(at, now = /* @__PURE__ */ new Date()) {
+  const [hour, minute] = at.split(":").map(Number);
+  const next = new Date(now);
+  next.setHours(hour, minute, 0, 0);
+  if (next.getTime() <= now.getTime()) next.setDate(next.getDate() + 1);
+  return next;
+}
+var xml = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function jobSpec(job) {
+  return {
+    label: agentLabel(job.id),
+    root: job.root,
+    args: ["run", job.id, "--from-launchd"],
+    log: join(job.root, JOBS_DIR, `${job.id}.log`)
+  };
+}
+function nightSpec(root) {
+  const hash = createHash("sha256").update(root).digest("hex").slice(0, 8);
+  const name = basename(root).replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 40) || "project";
+  return {
+    label: `dev.garuda.night.${name}-${hash}`,
+    root,
+    args: ["night", "--from-launchd"],
+    log: join(root, JOBS_DIR, "night.log")
+  };
+}
+function specPath(home, spec) {
+  return join(home, "Library", "LaunchAgents", `${spec.label}.plist`);
+}
+function agentPlist(job, env, when) {
+  return specPlist(jobSpec(job), env, when);
+}
+function specPlist(spec, env, when) {
+  const program = env.script === "" || env.script === env.node ? shellWord(env.node) : `${shellWord(env.node)} ${shellWord(env.script)}`;
+  const command = `cd ${shellWord(spec.root)} && exec ${program} ${spec.args.map(shellWord).join(" ")}`;
+  const args = ["/usr/bin/caffeinate", "-i", env.shell, "-lic", command];
+  const int = (key, value) => `      <key>${key}</key><integer>${value}</integer>`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "  <dict>",
+    `    <key>Label</key><string>${xml(spec.label)}</string>`,
+    "    <key>ProgramArguments</key>",
+    "    <array>",
+    ...args.map((a) => `      <string>${xml(a)}</string>`),
+    "    </array>",
+    `    <key>WorkingDirectory</key><string>${xml(spec.root)}</string>`,
+    "    <key>StartCalendarInterval</key>",
+    "    <dict>",
+    int("Month", when.getMonth() + 1),
+    int("Day", when.getDate()),
+    int("Hour", when.getHours()),
+    int("Minute", when.getMinutes()),
+    "    </dict>",
+    "    <key>RunAtLoad</key><false/>",
+    `    <key>StandardOutPath</key><string>${xml(spec.log)}</string>`,
+    `    <key>StandardErrorPath</key><string>${xml(spec.log)}</string>`,
+    "  </dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+async function installAgent(executor, job, env, now = /* @__PURE__ */ new Date()) {
+  if (job.at === void 0) throw new Error("The job has no time.");
+  return installSpec(executor, jobSpec(job), env, nextTime(job.at, now));
+}
+async function installSpec(executor, spec, env, when) {
+  const plist = specPath(env.home, spec);
+  await mkdir(join(env.home, "Library", "LaunchAgents"), { recursive: true });
+  await writeFile(plist, specPlist(spec, env, when), { mode: 420 });
+  await hostCommand(executor, spec.root, ["launchctl", "bootout", `gui/${env.uid}/${spec.label}`], {
+    check: false
+  });
+  await hostCommand(executor, spec.root, ["launchctl", "bootstrap", `gui/${env.uid}`, plist]);
+  return { plist, when };
+}
+async function removeSpec(executor, spec, env) {
+  const plist = specPath(env.home, spec);
+  const had = existsSync(plist);
+  await rm(plist, { force: true });
+  const out = await hostCommand(
+    executor,
+    spec.root,
+    ["launchctl", "bootout", `gui/${env.uid}/${spec.label}`],
+    { check: false }
+  );
+  return had || out.exitCode === 0;
+}
+function nightAgentTime(root, env) {
+  let text;
+  try {
+    text = readFileSync(specPath(env.home, nightSpec(root)), "utf8");
+  } catch {
+    return void 0;
+  }
+  const n = (key) => Number(new RegExp(`<key>${key}</key><integer>(\\d+)</integer>`).exec(text)?.[1]);
+  const month = n("Month");
+  const day = n("Day");
+  if (Number.isNaN(month) || Number.isNaN(day)) return void 0;
+  const now = /* @__PURE__ */ new Date();
+  const when = new Date(now.getFullYear(), month - 1, day, n("Hour"), n("Minute"));
+  if (when.getTime() < now.getTime() - 180 * 864e5) when.setFullYear(now.getFullYear() + 1);
+  return when;
+}
+async function removeAgent(executor, job, env) {
+  return removeSpec(executor, jobSpec(job), env);
+}
+
+export {
+  defaultAgentEnv,
+  agentLabel,
+  agentPath,
+  nextTime,
+  jobSpec,
+  nightSpec,
+  specPath,
+  agentPlist,
+  specPlist,
+  installAgent,
+  installSpec,
+  removeSpec,
+  nightAgentTime,
+  removeAgent
+};
+//# sourceMappingURL=chunk-35GMLLJW.js.map