@hraness/slopcamera 3.2.4

package/apps/desktop/application/html-overlay-integrity.ts

@@ -0,0 +1,337 @@
+import { createHash } from "node:crypto";
+
+import { z } from "zod";
+import playwrightCorePackage from "playwright-core/package.json";
+import { HtmlOverlayExecutionProfileSchema, type HtmlOverlayExecutionProfile } from "../html-overlay/execution-profile";
+import { createSparkHtmlOverlayRuntimeSource } from "../html-overlay/spark-runtime";
+
+import { canonicalJson } from "../core/canonical-json";
+import {
+  HtmlOverlayAuthoringInputSchema,
+  HtmlOverlayDeclaredResourcesSchema,
+  createHtmlOverlayBrowserRuntimeSource,
+  createHtmlOverlayImportMap,
+  getApprovedHtmlOverlayLibraryLock,
+  htmlOverlayAssetLocalUrl,
+  type HtmlOverlayActiveLibraryLock,
+  type HtmlOverlayAuthoringInput,
+  type HtmlOverlayDeclaredResource,
+  type HtmlOverlayImportMap,
+} from "../html-overlay";
+import {
+  HtmlOverlayBrowserRuntimeBindingSchema,
+  type HtmlOverlayBrowserRuntimeBinding,
+} from "./html-overlay-browser-runtime";
+
+const Sha256Schema = z.string().regex(/^[a-f0-9]{64}$/u);
+const IntegrityLeafSchema = z.strictObject({
+  key: z.string().min(1).max(512),
+  sha256: Sha256Schema,
+});
+
+export const HtmlOverlayExecutionIntegritySchema = z.strictObject({
+  algorithm: z.literal("sha256-merkle-v1"),
+  leaves: z.array(IntegrityLeafSchema).min(4).max(256).superRefine((leaves, context) => {
+    for (let index = 1; index < leaves.length; index += 1) {
+      if (leaves[index - 1]!.key >= leaves[index]!.key) {
+        context.addIssue({
+          code: "custom",
+          message: "HTML-overlay integrity leaves must have unique ASCII-sorted keys.",
+          path: [index, "key"],
+        });
+      }
+    }
+  }),
+  rootSha256: Sha256Schema,
+  runtimeSha256: Sha256Schema,
+  schemaVersion: z.literal(1),
+});
+export type HtmlOverlayExecutionIntegrity = Readonly<
+  z.infer<typeof HtmlOverlayExecutionIntegritySchema>
+>;
+
+export interface HtmlOverlayExecutionBundle {
+  readonly importMap: HtmlOverlayImportMap;
+  readonly integrity: HtmlOverlayExecutionIntegrity;
+  readonly libraryLocks: readonly HtmlOverlayActiveLibraryLock[];
+  readonly runtimeSource: string;
+}
+
+/**
+ * Receipt-bound browser behavior. Any change to launch isolation, the private
+ * routing model, deterministic context, or transparent capture changes the
+ * execution root even when every authored and browser byte stays identical.
+ */
+export const HTML_OVERLAY_RENDERER_CONTRACT = Object.freeze({
+  browser: "playwright-chromium",
+  browserVersion: playwrightCorePackage.version,
+  browserContext: Object.freeze({
+    acceptDownloads: false,
+    colorScheme: "light",
+    locale: "en-US",
+    offline: true,
+    permissions: Object.freeze([] as string[]),
+    reducedMotion: "no-preference",
+    serviceWorkers: "block",
+    timezoneId: "UTC",
+  }),
+  contentSecurityPolicy: Object.freeze([
+    "default-src 'none'",
+    "base-uri 'none'",
+    "connect-src 'none'",
+    "font-src https://slopcamera-overlay.invalid data:",
+    "form-action 'none'",
+    "frame-src 'none'",
+    "img-src https://slopcamera-overlay.invalid data:",
+    "media-src https://slopcamera-overlay.invalid data:",
+    "object-src 'none'",
+    "script-src 'unsafe-inline' https://slopcamera-overlay.invalid",
+    "style-src 'unsafe-inline'",
+    "worker-src 'none'",
+  ]),
+  documentUrl: "https://slopcamera-overlay.invalid/slopcamera-overlay/document",
+  environment: Object.freeze({
+    fixed: Object.freeze({
+      LANG: "en_US.UTF-8",
+      LC_ALL: "en_US.UTF-8",
+      PATH: "/usr/bin:/bin",
+      TZ: "UTC",
+    }),
+    inherited: Object.freeze([] as string[]),
+    privateDirectories: Object.freeze(["HOME", "TMPDIR"]),
+  }),
+  launch: Object.freeze({
+    args: Object.freeze([
+      "--disable-background-networking",
+      "--disable-breakpad",
+      "--disable-component-update",
+      "--disable-default-apps",
+      "--disable-domain-reliability",
+      "--disable-extensions",
+      "--disable-features=Translate,MediaRouter,OptimizationHints",
+      "--disable-quic",
+      "--disable-sync",
+      "--enable-unsafe-swiftshader",
+      "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+      "--metrics-recording-only",
+      "--mute-audio",
+      "--no-default-browser-check",
+      "--no-first-run",
+      "--no-proxy-server",
+      "--use-angle=swiftshader",
+    ]),
+    headless: true,
+    libraryArgs: Object.freeze({
+      vgpu: Object.freeze([
+        "--enable-unsafe-webgpu",
+        "--use-webgpu-adapter=swiftshader",
+      ]),
+    }),
+  }),
+  routing: Object.freeze({
+    allowedOrigin: "https://slopcamera-overlay.invalid",
+    declaredResourcesOnly: true,
+    remoteNetworkDenied: true,
+  }),
+  runtimeSnapshot: Object.freeze({
+    macosAnchor: "/private/tmp",
+    macosAnchorPolicy: "physical-root-owned-sticky-direct-child",
+    cleanupIdentity: "container-direct-children-and-complete-runtime-manifest",
+    copyBufferBytes: 4 * 1024 * 1024,
+    filesystemGuard: "anchor-basename-and-recursive-parent-watch-with-path-identities",
+    orphanRecovery: "active-to-released-lease-last-atomic-quarantine-double-open-proof",
+    verifiedMacosFilesystemFlags: "user-immutable-recursive",
+  }),
+  schemaVersion: 1,
+  screenshot: Object.freeze({
+    omitBackground: true,
+    scale: "css",
+    type: "png",
+  }),
+});
+
+/** Legacy contract above remains immutable so completed receipts remain verifiable. */
+const HARDWARE_LAUNCH_CONTRACT = Object.freeze({
+  ...HTML_OVERLAY_RENDERER_CONTRACT.launch,
+  args: Object.freeze([
+    ...HTML_OVERLAY_RENDERER_CONTRACT.launch.args.filter(argument => argument !== "--enable-unsafe-swiftshader" && argument !== "--use-angle=swiftshader"),
+    "--use-angle=metal",
+    "--disable-software-rasterizer",
+  ]),
+});
+function legacyHtmlOverlayRendererContract(profileInput?: HtmlOverlayExecutionProfile) {
+  if (profileInput === undefined) return HTML_OVERLAY_RENDERER_CONTRACT;
+  const executionProfile = HtmlOverlayExecutionProfileSchema.parse(profileInput);
+  return Object.freeze({
+    ...HTML_OVERLAY_RENDERER_CONTRACT,
+    contentSecurityPolicy: executionProfile === "three-spark-webgl2-hardware-v1"
+      ? Object.freeze(HTML_OVERLAY_RENDERER_CONTRACT.contentSecurityPolicy.map(directive => {
+        if (directive === "worker-src 'none'") return "worker-src blob:";
+        if (directive === "connect-src 'none'") return "connect-src https://slopcamera-overlay.invalid data:";
+        if (directive.startsWith("script-src ")) return `${directive} 'wasm-unsafe-eval'`;
+        return directive;
+      })) : HTML_OVERLAY_RENDERER_CONTRACT.contentSecurityPolicy,
+    executionProfile,
+    launch: HARDWARE_LAUNCH_CONTRACT,
+    gpu: Object.freeze({
+      admission: "matching-active-webgl2-and-cdp-angle-metal-v1",
+      capture: "host-held-native-context-health-before-and-after-every-screenshot",
+      fallback: "reject-software-or-unknown",
+      platform: "darwin",
+      receipt: "bounded-context-device-driver-os-evidence-per-batch",
+    }),
+    schemaVersion: 2,
+  });
+}
+
+/** Fetch opt-in grants only the exact declared private paths and changes execution identity. */
+export function htmlOverlayRendererContract(
+  profileInput?: HtmlOverlayExecutionProfile,
+  resourcesInput: readonly HtmlOverlayDeclaredResource[] = [],
+) {
+  const contract = legacyHtmlOverlayRendererContract(profileInput);
+  const resources = HtmlOverlayDeclaredResourcesSchema.parse(resourcesInput);
+  const urls = resources.filter(resource => resource.transport === "fetch")
+    .map(resource => `${HTML_OVERLAY_RENDERER_CONTRACT.routing.allowedOrigin}${htmlOverlayAssetLocalUrl(resource)}`);
+  // Spark already has its separately qualified private-origin/data fetch policy.
+  // Keep it, and every contract with no opt-in, byte-identical to prior receipts.
+  if (urls.length === 0 || !contract.contentSecurityPolicy.includes("connect-src 'none'")) return contract;
+  return Object.freeze({
+    ...contract,
+    contentSecurityPolicy: Object.freeze(contract.contentSecurityPolicy.map(directive =>
+      directive === "connect-src 'none'" ? `connect-src ${urls.join(" ")}` : directive)),
+    schemaVersion: 3,
+  });
+}
+
+export function assertHtmlOverlayExecutionProfileLibraries(
+  libraries: readonly string[], profile?: HtmlOverlayExecutionProfile,
+): void {
+  if (profile === undefined) return;
+  HtmlOverlayExecutionProfileSchema.parse(profile);
+  const expected = profile === "three-webgl2-hardware-v1" ? ["three"] : ["@sparkjsdev/spark", "three", "three/addons/postprocessing/Pass.js"];
+  if (canonicalJson([...libraries].sort()) !== canonicalJson(expected)) throw new Error("Hardware execution profile requires its exact approved scene library set.");
+}
+
+function sha256(value: string | Uint8Array): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function leafSha256(key: string, value: unknown): string {
+  return sha256(canonicalJson({
+    domain: "slopcamera.html-overlay-integrity-leaf/v1",
+    key,
+    value,
+  }));
+}
+
+function merkleRoot(leaves: readonly Readonly<{ key: string; sha256: string }>[]): string {
+  let level = leaves.map(leaf => sha256([
+    "slopcamera.html-overlay-integrity-node/v1",
+    "leaf",
+    leaf.key,
+    leaf.sha256,
+  ].join("\0")));
+  while (level.length > 1) {
+    const next: string[] = [];
+    for (let index = 0; index < level.length; index += 2) {
+      const left = level[index]!;
+      const right = level[index + 1] ?? left;
+      next.push(sha256([
+        "slopcamera.html-overlay-integrity-node/v1",
+        "branch",
+        left,
+        right,
+      ].join("\0")));
+    }
+    level = next;
+  }
+  return level[0]!;
+}
+
+/**
+ * Freezes every byte-bearing browser input behind one reproducible Merkle root.
+ * The renderer verifies the declared browser, resource, and module bytes and
+ * executes the exact runtime source returned in this bundle.
+ */
+export function createHtmlOverlayExecutionBundle(
+  authoringInput: HtmlOverlayAuthoringInput,
+  browserRuntimeInput: HtmlOverlayBrowserRuntimeBinding,
+  executionProfile?: HtmlOverlayExecutionProfile,
+): HtmlOverlayExecutionBundle {
+  const authoring = HtmlOverlayAuthoringInputSchema.parse(authoringInput);
+  assertHtmlOverlayExecutionProfileLibraries(authoring.libraries, executionProfile);
+  const browserRuntime = HtmlOverlayBrowserRuntimeBindingSchema.parse(
+    browserRuntimeInput,
+  );
+  const libraryLocks = authoring.libraries.map(
+    getApprovedHtmlOverlayLibraryLock,
+  );
+  const importMap = createHtmlOverlayImportMap(authoring.libraries);
+  const legacyRuntimeSource = createHtmlOverlayBrowserRuntimeSource({
+    canvas: authoring.canvas,
+    parameters: authoring.parameters,
+    resources: authoring.resources,
+    seed: authoring.seed,
+    timing: authoring.timing,
+  });
+  const runtimeSource = executionProfile === "three-spark-webgl2-hardware-v1" ? createSparkHtmlOverlayRuntimeSource(legacyRuntimeSource) : legacyRuntimeSource;
+  const runtimeSha256 = sha256(Buffer.from(runtimeSource, "utf8"));
+  const entries: Array<Readonly<{ key: string; value: unknown }>> = [
+    {
+      key: "authoring-config",
+      value: {
+        canvas: authoring.canvas,
+        kind: authoring.kind,
+        parameters: authoring.parameters,
+        schemaVersion: authoring.schemaVersion,
+        seed: authoring.seed,
+        timing: authoring.timing,
+      },
+    },
+    { key: "browser-runtime", value: browserRuntime },
+    { key: "renderer-contract", value: htmlOverlayRendererContract(executionProfile, authoring.resources) },
+    {
+      key: "document",
+      value: {
+        bytes: Buffer.byteLength(authoring.html, "utf8"),
+        sha256: sha256(Buffer.from(authoring.html, "utf8")),
+      },
+    },
+    { key: "import-map", value: importMap },
+    {
+      key: "runtime",
+      value: {
+        bytes: Buffer.byteLength(runtimeSource, "utf8"),
+        sha256: runtimeSha256,
+      },
+    },
+    ...libraryLocks.map(lock => ({
+      key: `library:${lock.specifier}`,
+      value: lock,
+    })),
+    ...authoring.resources.map(resource => ({
+      key: `resource:${resource.name}`,
+      value: resource,
+    })),
+  ];
+  const leaves = entries
+    .map(entry => ({
+      key: entry.key,
+      sha256: leafSha256(entry.key, entry.value),
+    }))
+    .sort((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0);
+  const integrity = HtmlOverlayExecutionIntegritySchema.parse({
+    algorithm: "sha256-merkle-v1",
+    leaves,
+    rootSha256: merkleRoot(leaves),
+    runtimeSha256,
+    schemaVersion: 1,
+  });
+  return Object.freeze({
+    importMap,
+    integrity: Object.freeze(integrity),
+    libraryLocks: Object.freeze(libraryLocks),
+    runtimeSource,
+  });
+}

package/apps/desktop/application/html-overlay-renderer.ts

@@ -0,0 +1,45 @@
+import type {
+  HtmlOverlayActiveLibraryLock,
+  HtmlOverlayAuthoringInput,
+  HtmlOverlayDeclaredResource,
+} from "../html-overlay";
+import type { HtmlOverlayBrowserRuntimeBinding } from "./html-overlay-browser-runtime";
+import type { HtmlOverlayExecutionIntegrity } from "./html-overlay-integrity";
+import type { HtmlOverlayExecutionProfile, HtmlOverlayGpuEvidence } from "../html-overlay/execution-profile";
+
+export interface BoundHtmlOverlayResource extends HtmlOverlayDeclaredResource {
+  /** Exact, descriptor-pinned source selected by the application boundary. */
+  readonly absolutePath: string;
+}
+
+export interface HtmlOverlayFrameRenderRequest {
+  readonly executionProfile?: HtmlOverlayExecutionProfile;
+  readonly authoring: HtmlOverlayAuthoringInput;
+  /** Complete browser runtime tree captured during node planning. */
+  readonly browserRuntime: HtmlOverlayBrowserRuntimeBinding;
+  readonly outputDirectory: string;
+  readonly resources: readonly BoundHtmlOverlayResource[];
+}
+
+export interface HtmlOverlayFrameRenderResult {
+  /** Host-observed hardware identity, present only for explicit hardware profiles. */
+  readonly gpuEvidence?: HtmlOverlayGpuEvidence;
+  /** Merkle binding for the browser tree, document, runtime, modules, and assets used. */
+  readonly executionIntegrity: HtmlOverlayExecutionIntegrity;
+  readonly frameCount: number;
+  /** Absolute printf-style path accepted by FFmpeg, for example frame-%08d.png. */
+  readonly framePattern: string;
+  /** Complete active executable allowlist used by this render. */
+  readonly libraryLocks: readonly HtmlOverlayActiveLibraryLock[];
+}
+
+/**
+ * Effectful browser boundary. Application tests replace it with a deterministic
+ * fake; the CLI host supplies the Chromium implementation.
+ */
+export interface HtmlOverlayRenderer {
+  renderFrames(
+    request: HtmlOverlayFrameRenderRequest,
+    signal: AbortSignal,
+  ): Promise<HtmlOverlayFrameRenderResult>;
+}

package/apps/desktop/application/index.ts

@@ -0,0 +1,13 @@
+export * from "./context";
+export * from "./creative-iteration";
+export * from "./default-registry";
+export * from "./errors";
+export * from "./gateway-port";
+export * from "./operation";
+export * from "./operation-completion-checkpoint";
+export * from "./operations";
+export * from "./project-store";
+export * from "./project-publication-lease";
+export * from "./receipts";
+export * from "./registry";
+export * from "./verified-receipt-reconciliation";