@mcoda/codali 0.1.134 → 0.1.135-codali.4

package/dist/tools/shell/IsolatedExecutor.d.ts

@@ -0,0 +1,15 @@
+import { type ToolContext, type ToolHandlerResult } from "../ToolTypes.js";
+import { type HostRuntime } from "./HostToolchain.js";
+export interface ExecutorStatus {
+    available: boolean;
+    backend: "bubblewrap" | "sandbox-exec" | "unavailable";
+    reason?: string;
+}
+/** All paths have been canonicalized by the host, before launching the sandbox. */
+export declare const darwinSandboxProfile: (root: string, scratch: string, writePaths: string[], runtimes: HostRuntime[], network?: boolean) => string;
+export declare const executorStatus: () => ExecutorStatus;
+export declare const createIsolatedExecutor: (options?: {
+    network?: boolean;
+    status?: ExecutorStatus;
+}) => ((command: string, args: string[], context: ToolContext) => Promise<ToolHandlerResult>);
+//# sourceMappingURL=IsolatedExecutor.d.ts.map

package/dist/tools/shell/IsolatedExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IsolatedExecutor.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/IsolatedExecutor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjG,MAAM,WAAW,cAAc;IAAG,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,GAAG,cAAc,GAAG,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AAEhI,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,EAAE,YAAY,MAAM,EAAE,EAAE,UAAU,WAAW,EAAE,EAAE,iBAAe,KAAG,MA2BpI,CAAC;AAQF,eAAO,MAAM,cAAc,QAAO,cAcjC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,UAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAAO,KAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAoD3L,CAAC"}

package/dist/tools/shell/IsolatedExecutor.js

@@ -0,0 +1,138 @@
+import { existsSync, realpathSync, mkdtempSync, rmSync, promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { runProcess } from "./AsyncProcess.js";
+import { resolveShellWorkingDirectory } from "./ShellWorkingDirectory.js";
+import { ToolExecutionError } from "../ToolTypes.js";
+import { discoverHostToolchain, extraRuntimeMounts } from "./HostToolchain.js";
+/** All paths have been canonicalized by the host, before launching the sandbox. */
+export const darwinSandboxProfile = (root, scratch, writePaths, runtimes, network = false) => {
+    const quoted = (value) => JSON.stringify(value);
+    const ancestors = new Set();
+    for (const target of [root, scratch, ...extraRuntimeMounts(runtimes).map(runtime => runtime.readOnlyRoot)]) {
+        for (let parent = path.dirname(target); parent !== path.dirname(parent); parent = path.dirname(parent))
+            ancestors.add(parent);
+    }
+    return [
+        "(version 1)", "(deny default)", "(allow process*)", "(allow sysctl-read)",
+        // dyld opens the root directory when locating its shared cache. This literal
+        // permits the directory itself, never a recursive read of the filesystem.
+        '(allow file-read* (literal "/"))',
+        // realpath/lstat needs ancestor metadata, not directory contents or sibling files.
+        ...[...ancestors].map(parent => `(allow file-read-metadata (literal ${quoted(parent)}))`),
+        '(allow file-read* (subpath "/usr") (subpath "/bin") (subpath "/sbin") (subpath "/System") (subpath "/Library") (subpath "/private/etc") (subpath "/dev"))',
+        // Git and other native tools open the null device read/write for discarded IO.
+        '(allow file-write-data (literal "/dev/null"))',
+        // Apple's /bin/sh reads this system selector before starting npm scripts.
+        // Permit only that selector, not other private /var files or directories.
+        '(allow file-read* (literal "/private/var/select/sh") (literal "/var/select/sh"))',
+        '(allow file-read-metadata (literal "/private/var/select") (literal "/var/select"))',
+        `(allow file-read* (subpath ${quoted(root)}))`,
+        ...extraRuntimeMounts(runtimes).map(runtime => `(allow file-read* (${runtime.directory ? "subpath" : "literal"} ${quoted(runtime.readOnlyRoot)}))`),
+        `(allow file-read* file-write* (subpath ${quoted(scratch)}))`,
+        ...writePaths.map(file => `(allow file-write* (subpath ${quoted(file)}))`),
+        ...[".git", ".mcoda"].map(dir => `(deny file-write* (subpath ${quoted(path.join(root, dir))}))`),
+        network ? "(allow network*)" : "(deny network*)",
+    ].join("\n");
+};
+const bubblewrapRoot = () => {
+    const args = ["--die-with-parent", "--new-session", "--unshare-all", "--ro-bind", "/usr", "/usr", "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp"];
+    for (const dir of ["/bin", "/sbin", "/lib", "/lib64"])
+        if (existsSync(dir))
+            args.push("--ro-bind", realpathSync(dir), dir);
+    return args;
+};
+export const executorStatus = () => {
+    if (process.platform === "linux") {
+        if (!existsSync("/usr/bin/bwrap"))
+            return { available: false, backend: "unavailable", reason: "Install bubblewrap to enable isolated shell execution" };
+        const probe = spawnSync("/usr/bin/bwrap", [...bubblewrapRoot(), "--", "/usr/bin/true"], { timeout: 3000, stdio: "ignore" });
+        return probe.status === 0 ? { available: true, backend: "bubblewrap" } : { available: false, backend: "unavailable", reason: "bubblewrap user namespaces are unavailable" };
+    }
+    if (process.platform === "darwin" && existsSync("/usr/bin/sandbox-exec")) {
+        const scratch = realpathSync(mkdtempSync(path.join(os.tmpdir(), "codali-isolation-probe-")));
+        try {
+            const probe = spawnSync("/usr/bin/sandbox-exec", ["-p", darwinSandboxProfile(scratch, scratch, [], []), "/usr/bin/true"], { timeout: 3000, stdio: "ignore" });
+            if (probe.status === 0)
+                return { available: true, backend: "sandbox-exec" };
+        }
+        finally {
+            rmSync(scratch, { recursive: true, force: true });
+        }
+    }
+    return { available: false, backend: "unavailable", reason: "No supported isolation backend on this platform" };
+};
+export const createIsolatedExecutor = (options = {}) => {
+    const status = options.status ?? executorStatus();
+    return async (command, args, context) => {
+        if (!status.available)
+            throw new ToolExecutionError("tool_permission_denied", status.reason ?? "Isolation unavailable");
+        const root = realpathSync(context.workspaceRoot);
+        const cwd = resolveShellWorkingDirectory(root, context.shellWorkingDirectory);
+        if (root === path.parse(root).root)
+            throw new ToolExecutionError("tool_permission_denied", "Filesystem root cannot be an isolated workspace");
+        const runtimes = discoverHostToolchain(root);
+        const writePaths = (context.allowedWritePaths ?? ["."]).map(file => {
+            const requested = path.resolve(root, file);
+            if (requested !== root && !requested.startsWith(`${root}${path.sep}`))
+                throw new ToolExecutionError("tool_permission_denied", "Shell write scope escapes workspace");
+            if (!existsSync(requested))
+                throw new ToolExecutionError("tool_permission_denied", "Create the scoped directory/file with write_file before shell execution");
+            const real = realpathSync(requested);
+            if (real !== root && !real.startsWith(`${root}${path.sep}`))
+                throw new ToolExecutionError("tool_permission_denied", "Shell write scope resolves outside workspace");
+            if ([".git", ".mcoda"].some(dir => real === path.join(root, dir) || real.startsWith(`${root}/${dir}/`)))
+                throw new ToolExecutionError("tool_permission_denied", "Repository control metadata cannot be a write scope");
+            return real;
+        });
+        if (status.backend === "bubblewrap") {
+            const launch = bubblewrapRoot();
+            if (options.network) {
+                launch.push("--share-net");
+                for (const file of ["/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs"])
+                    if (existsSync(file))
+                        launch.push("--ro-bind", realpathSync(file), file);
+            }
+            launch.push("--dir", path.dirname(root), "--ro-bind", root, root);
+            for (const runtime of extraRuntimeMounts(runtimes))
+                launch.push("--dir", path.dirname(runtime.readOnlyRoot), "--ro-bind", runtime.readOnlyRoot, runtime.readOnlyRoot);
+            launch.push("--dir", "/tmp/codali-bin");
+            for (const runtime of runtimes)
+                launch.push("--symlink", runtime.executable, `/tmp/codali-bin/${runtime.name}`);
+            for (const file of writePaths)
+                launch.push("--bind", file, file);
+            launch.push("--chdir", cwd, "--dir", "/tmp/home", "--setenv", "HOME", "/tmp/home", "--setenv", "TMPDIR", "/tmp", "--setenv", "PATH", "/tmp/codali-bin:/usr/local/bin:/usr/bin:/bin");
+            for (const [key, value] of Object.entries({ CARGO_HOME: "/tmp/home/cargo", XDG_CACHE_HOME: "/tmp/home/cache", PYTHONPYCACHEPREFIX: "/tmp/home/pycache", PYTHONUSERBASE: "/tmp/home/python", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1" }))
+                launch.push("--setenv", key, value);
+            // Git hooks/config and private session state are not part of executable workspace access.
+            for (const dir of [".git", ".mcoda"])
+                if (existsSync(path.join(root, dir)))
+                    launch.push("--ro-bind", path.join(root, dir), path.join(root, dir));
+            launch.push("--", command, ...args);
+            return runProcess("/usr/bin/bwrap", launch, context);
+        }
+        const scratch = realpathSync(await fs.mkdtemp(path.join(os.tmpdir(), "codali-shell-")));
+        try {
+            await fs.chmod(scratch, 0o700);
+            const privateHome = path.join(scratch, "home");
+            const privateBin = path.join(scratch, "bin");
+            await fs.mkdir(privateHome, { mode: 0o700 });
+            await fs.mkdir(privateBin, { mode: 0o700 });
+            for (const runtime of runtimes)
+                await fs.symlink(runtime.executable, path.join(privateBin, runtime.name));
+            const profile = darwinSandboxProfile(root, scratch, writePaths, runtimes, options.network);
+            return await runProcess("/usr/bin/sandbox-exec", ["-p", profile, runtimes.find(runtime => runtime.name === command)?.executable ?? command, ...args], context, {
+                ...runtimes.find(runtime => runtime.name === "cc")?.environment,
+                HOME: privateHome, TMPDIR: scratch, PATH: `${privateBin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`,
+                CARGO_HOME: path.join(privateHome, "cargo"), XDG_CACHE_HOME: path.join(privateHome, "cache"),
+                PYTHONPYCACHEPREFIX: path.join(privateHome, "pycache"), PYTHONUSERBASE: path.join(privateHome, "python"),
+                // Host Git settings can invoke external helpers or read private paths.
+                GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1",
+            });
+        }
+        finally {
+            await fs.rm(scratch, { recursive: true, force: true });
+        }
+    };
+};

package/dist/tools/shell/ShellTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ShellTool.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/ShellTool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2C5F,eAAO,MAAM,eAAe,QAAO,cA2EjC,CAAC"}
+{"version":3,"file":"ShellTool.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/ShellTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA6C5F,eAAO,MAAM,eAAe,QAAO,cAmDjC,CAAC"}

package/dist/tools/shell/ShellTool.js

@@ -1,6 +1,7 @@
-import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { ToolExecutionError } from "../ToolTypes.js";
+import { runProcess } from "./AsyncProcess.js";
+import { resolveShellWorkingDirectory } from "./ShellWorkingDirectory.js";
 const resolveAllowlist = (context) => {
     return context.shellAllowlist ?? [];
 };
@@ -40,15 +41,17 @@ const isDestructiveShellAction = (command, args) => {
 };
 export const createShellTool = () => ({
     name: "run_shell",
-    description: "Run a shell command from the workspace root (allowlist only).",
+    description: 'Run an allowlisted executable. Default cwd is the workspace root; set cwd for a module-local command, e.g. {"command":"npm","args":["test"],"cwd":"packages/app"}. In terminal mode the workspace is read-only unless writePaths names root-relative paths inside the claimed task. Existing source files in those paths require current reads and structural analysis.',
     readOnly: false,
     capability: "shell",
     inputSchema: {
         type: "object",
         required: ["command"],
         properties: {
-            command: { type: "string" },
+            command: { type: "string", description: "One executable name, without arguments or shell syntax." },
             args: { type: "array", items: { type: "string" } },
+            cwd: { type: "string", description: "Existing working directory inside the workspace, relative to its root. Default: workspace root. Does not change the base of writePaths." },
+            writePaths: { type: "array", items: { type: "string" }, description: "Terminal mode: root-relative existing files/directories to make writable, regardless of cwd. Default: no workspace writes. Must fit the claimed task scope." },
         },
     },
     handler: async (args, context) => {
@@ -57,7 +60,7 @@ export const createShellTool = () => ({
                 retryable: false,
             });
         }
-        const { command, args: commandArgs = [] } = args;
+        const { command, args: commandArgs = [], cwd } = args;
         if (!context.allowDestructiveOperations
             && isDestructiveShellAction(command, commandArgs)) {
             throw new ToolExecutionError("tool_permission_denied", "Destructive operation blocked by policy", {
@@ -77,30 +80,7 @@ export const createShellTool = () => ({
                 details: { command },
             });
         }
-        const result = spawnSync(command, commandArgs, {
-            cwd: context.workspaceRoot,
-            encoding: "utf8",
-        });
-        if (result.error) {
-            throw result.error;
-        }
-        const stdout = result.stdout ?? "";
-        const stderr = result.stderr ?? "";
-        const exitCode = result.status ?? 0;
-        if (exitCode !== 0) {
-            const message = stderr || stdout || `Command failed with exit code ${exitCode}`;
-            throw new ToolExecutionError("tool_execution_failed", message, {
-                retryable: false,
-                details: { command, exitCode },
-            });
-        }
-        return {
-            output: stdout || stderr,
-            data: {
-                stdout,
-                stderr,
-                exitCode,
-            },
-        };
+        const shellWorkingDirectory = resolveShellWorkingDirectory(context.workspaceRoot, cwd);
+        return (context.shellExecutor ?? runProcess)(command, commandArgs, { ...context, shellWorkingDirectory });
     },
 });

package/dist/tools/shell/ShellWorkingDirectory.d.ts

@@ -0,0 +1,3 @@
+/** Resolve only the process directory; write scopes still use workspaceRoot. */
+export declare const resolveShellWorkingDirectory: (workspaceRoot: string, requested?: string) => string;
+//# sourceMappingURL=ShellWorkingDirectory.d.ts.map

package/dist/tools/shell/ShellWorkingDirectory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShellWorkingDirectory.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/ShellWorkingDirectory.ts"],"names":[],"mappings":"AAIA,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,GAAI,eAAe,MAAM,EAAE,YAAY,MAAM,KAAG,MAoBxF,CAAC"}

package/dist/tools/shell/ShellWorkingDirectory.js

@@ -0,0 +1,30 @@
+import { realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { ToolExecutionError } from "../ToolTypes.js";
+/** Resolve only the process directory; write scopes still use workspaceRoot. */
+export const resolveShellWorkingDirectory = (workspaceRoot, requested) => {
+    if (requested !== undefined && (typeof requested !== "string" || !requested.trim())) {
+        throw new ToolExecutionError("tool_invalid_args", "cwd must be a non-empty directory path inside the workspace");
+    }
+    const root = realpathSync.native(workspaceRoot);
+    const inside = (candidate) => {
+        const relative = path.relative(root, candidate);
+        return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+    };
+    const candidate = path.resolve(root, requested ?? ".");
+    if (!inside(candidate))
+        throw new ToolExecutionError("tool_permission_denied", "Shell cwd escapes the workspace");
+    try {
+        const resolved = realpathSync.native(candidate);
+        if (!inside(resolved))
+            throw new ToolExecutionError("tool_permission_denied", "Shell cwd resolves outside the workspace");
+        if (!statSync(resolved).isDirectory())
+            throw new ToolExecutionError("tool_invalid_args", "Shell cwd must be an existing directory");
+        return resolved;
+    }
+    catch (error) {
+        if (error instanceof ToolExecutionError)
+            throw error;
+        throw new ToolExecutionError("tool_invalid_args", "Shell cwd is not an accessible existing directory");
+    }
+};

package/package.json

@@ -1,46 +1,49 @@
 {
-  "name": "@mcoda/codali",
-  "version": "0.1.134",
-  "description": "Standalone tool-runner adapter for mcoda.",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "author": "bekir dag",
   "bin": {
     "codali": "dist/cli.js",
     "dataset": "dist/dataset-cli.js"
   },
+  "bugs": {
+    "url": "https://github.com/bekirdag/mcoda/issues"
+  },
+  "dependencies": {
+    "@mcoda/db": "0.1.135-codali.4",
+    "@mcoda/shared": "0.1.135-codali.4",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "zod": "4.5.2"
+  },
+  "description": "Standalone tool-runner adapter for mcoda.",
+  "engines": {
+    "node": ">=20"
+  },
   "files": [
     "dist",
     "!dist/**/__tests__/**",
     "!dist/**/*.test.*",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "ORCHESTRATION.md",
+    "config"
   ],
-  "engines": {
-    "node": ">=20"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/bekirdag/mcoda.git"
-  },
-  "bugs": {
-    "url": "https://github.com/bekirdag/mcoda/issues"
-  },
   "homepage": "https://github.com/bekirdag/mcoda#readme",
   "license": "MIT",
-  "author": "bekir dag",
+  "main": "dist/index.js",
+  "name": "@mcoda/codali",
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
-    "@mcoda/db": "0.1.134",
-    "@mcoda/shared": "0.1.134"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bekirdag/mcoda.git"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "lint": "echo \"lint not configured\"",
     "test": "pnpm run build && node ../../scripts/run-node-tests.js dist"
-  }
-}
+  },
+  "type": "module",
+  "types": "dist/index.d.ts",
+  "version": "0.1.135-codali.4"
+}