@mettlelabs/mettle 0.0.0-beta.1-linux-arm64 → 0.0.0-beta.11

package/harness/chunk-zvkxtj82.mjs

@@ -1,42 +0,0 @@
-import {
-  string,
-  number,
-  array,
-  strictObject,
-  _enum
-} from "./chunk-1sygmp11.mjs";
-
-// apps/harness/src/access.ts
-var identity = string().min(1).max(256);
-var RunAuthoritySchema = strictObject({
-  tenantId: identity,
-  actorId: identity,
-  engagementId: identity,
-  policyRevision: identity
-});
-var ApiPrincipalSchema = RunAuthoritySchema.extend({
-  permissions: array(_enum([
-    "run:create",
-    "engagement:create",
-    "run:read",
-    "run:control",
-    "run:recover",
-    "run:delete"
-  ])).min(1).refine((permissions) => new Set(permissions).size === permissions.length),
-  expiresAt: number().int().positive()
-});
-var ApiTokenRecordSchema = strictObject({
-  tokenSha256: string().regex(/^[a-f0-9]{64}$/),
-  principal: ApiPrincipalSchema
-});
-var BEARER_TOKEN_PATTERN = /^Bearer ([A-Za-z0-9_-]{43})$/;
-function authorityFor(principal) {
-  return RunAuthoritySchema.parse({
-    tenantId: principal.tenantId,
-    actorId: principal.actorId,
-    engagementId: principal.engagementId,
-    policyRevision: principal.policyRevision
-  });
-}
-
-export { RunAuthoritySchema, ApiPrincipalSchema, ApiTokenRecordSchema, BEARER_TOKEN_PATTERN, authorityFor };

package/harness/issue-api-token.mjs

@@ -1,35 +0,0 @@
-import"./chunk-2gt4cy7x.mjs";
-import"./chunk-zvkxtj82.mjs";
-import {
-  writeApiTokenFiles
-} from "./chunk-4jtnt9k5.mjs";
-
-// apps/harness/scripts/issue-api-token.ts
-import { readFile } from "node:fs/promises";
-import { parseArgs } from "node:util";
-try {
-  const { values } = parseArgs({
-    options: {
-      request: { type: "string" },
-      "output-dir": { type: "string" },
-      help: { type: "boolean" }
-    },
-    strict: true,
-    allowPositionals: false
-  });
-  if (values.help) {
-    process.stdout.write(`Usage: issue-api-token --request <request.json> --output-dir <new-private-directory>
-`);
-  } else {
-    if (!values.request || !values["output-dir"])
-      throw new Error("Explicit request and output directory required.");
-    const request = JSON.parse(await readFile(values.request, "utf8"));
-    const result = await writeApiTokenFiles(request, values["output-dir"]);
-    process.stdout.write(`${JSON.stringify(result)}
-`);
-  }
-} catch {
-  process.stderr.write(`API token issuance failed. Check the request, existing parent directory, and unused output path; no credentials printed.
-`);
-  process.exitCode = 1;
-}

package/harness/launcher.mjs

@@ -1,159 +0,0 @@
-import {
-  CONTRACT_VERSION,
-  RunConfigSchema,
-  HarnessError,
-  publicError,
-  COORDINATOR_TARGET
-} from "./chunk-2gt4cy7x.mjs";
-import {
-  RunAuthoritySchema
-} from "./chunk-zvkxtj82.mjs";
-import {
-  SandboxConfigSchema,
-  DockerEngine,
-  checkSandbox
-} from "./chunk-xqyc4ca2.mjs";
-import {
-  liveRoute,
-  liveProfiles,
-  loadInvestigationGrant,
-  SOURCE_TOTAL_BYTES,
-  SOURCE_FILES_MAX,
-  InvestigationProfilesSchema
-} from "./chunk-32y07kkp.mjs";
-import {
-  privateFile,
-  ownedDirectory
-} from "./chunk-7bg2gnv2.mjs";
-
-// apps/harness/scripts/launcher.ts
-import { parseArgs } from "node:util";
-
-// apps/harness/src/runtime/launcher.ts
-import { join } from "node:path";
-function launchTokenRequest() {
-  return {
-    tenantId: "local-team",
-    actorId: "operator",
-    engagementId: "counter-development",
-    policyRevision: "v1",
-    permissions: [
-      "run:create",
-      "run:read",
-      "run:control",
-      "run:recover",
-      "engagement:create"
-    ],
-    ttlSeconds: 86400
-  };
-}
-function launchRunConfig(environment) {
-  return RunConfigSchema.parse({
-    contractVersion: CONTRACT_VERSION,
-    model: liveRoute(environment).model
-  });
-}
-async function investigationProfiles(setup) {
-  const { environment, location = "local", engineId } = setup;
-  const { tenantId, actorId, engagementId, policyRevision } = launchTokenRequest();
-  const base = {
-    authority: setup.authority ?? RunAuthoritySchema.parse({
-      tenantId,
-      actorId,
-      engagementId,
-      policyRevision
-    }),
-    models: liveProfiles(environment).map((model) => ({
-      id: model.route.model,
-      provider: model.route.provider
-    })),
-    expiresAt: setup.expiresAt ?? new Date(Date.now() + launchTokenRequest().ttlSeconds * 1000).toISOString(),
-    stages: { maxWorkers: 2, huntPartitions: 2 }
-  };
-  const pinned = async (input) => {
-    const config = SandboxConfigSchema.parse(input);
-    if (location === "vm" && !engineId)
-      throw new HarnessError("investigation_config", "VM setup requires --engine-id from the designated VM, independently of the forwarded socket.");
-    const engine = await checkSandbox({ ...config, ...engineId ? { engineId } : {} }, setup.engine ?? new DockerEngine(config.socket));
-    return SandboxConfigSchema.parse({ ...config, engineId: engine, location });
-  };
-  const profiles = [];
-  if (setup.review) {
-    if (setup.githubTokenFile)
-      await privateFile(setup.githubTokenFile, 4096);
-    const localRoot = setup.localRoot ? await ownedDirectory(setup.localRoot, new HarnessError("investigation_config", "The local review root must be a directory owned by this operator.")) : undefined;
-    profiles.push({
-      ...base,
-      id: `${location}-review`,
-      mode: "codereview",
-      sandbox: await pinned({
-        image: environment.HARNESS_SANDBOX_IMAGE,
-        socket: environment.HARNESS_SANDBOX_SOCKET,
-        runtime: environment.HARNESS_SANDBOX_RUNTIME
-      }),
-      workspaceRoot: join(setup.directory, "snapshots"),
-      ...localRoot ? { localRoot } : {},
-      maxFiles: SOURCE_FILES_MAX,
-      maxSourceBytes: SOURCE_TOTAL_BYTES,
-      allowPatchProposals: true,
-      ...setup.githubTokenFile ? { githubTokenFile: setup.githubTokenFile } : {}
-    });
-  }
-  if (setup.pentestGrant) {
-    const grant = await loadInvestigationGrant(setup.pentestGrant);
-    if (grant.mode !== "pentest")
-      throw new HarnessError("investigation_config", "The pentest profile requires a pentest grant.");
-    if (location === "vm" && !grant.sandbox)
-      throw new HarnessError("investigation_config", "VM profiles require an isolated live target grant.");
-    profiles.push({
-      ...base,
-      id: `${location}-pentest`,
-      mode: "pentest",
-      grant: {
-        ...grant,
-        ...grant.sandbox ? { sandbox: await pinned(grant.sandbox) } : {}
-      }
-    });
-  }
-  return InvestigationProfilesSchema.parse(profiles);
-}
-
-// apps/harness/scripts/launcher.ts
-var USAGE = "Usage: launcher.ts token-request | run-config | investigation-profiles --directory <path> [--github-token-file <path>]";
-try {
-  const { positionals, values } = parseArgs({
-    strict: true,
-    allowPositionals: true,
-    options: {
-      directory: { type: "string" },
-      "github-token-file": { type: "string" }
-    }
-  });
-  const [command] = positionals;
-  if (positionals.length !== 1 || command !== "investigation-profiles" && Object.keys(values).length > 0)
-    throw new Error(USAGE);
-  if (command === "token-request")
-    process.stdout.write(`${JSON.stringify(launchTokenRequest())}
-`);
-  else if (command === "run-config")
-    process.stdout.write(`${JSON.stringify({
-      target: COORDINATOR_TARGET,
-      config: launchRunConfig(process.env)
-    })}
-`);
-  else if (command === "investigation-profiles" && values.directory) {
-    const profiles = await investigationProfiles({
-      environment: process.env,
-      directory: values.directory,
-      review: true,
-      ...values["github-token-file"] ? { githubTokenFile: values["github-token-file"] } : {}
-    });
-    process.stdout.write(`${JSON.stringify(profiles, null, 2)}
-`);
-  } else
-    throw new Error(USAGE);
-} catch (error) {
-  process.stderr.write(`${error instanceof Error && error.message === USAGE ? USAGE : publicError(error)}
-`);
-  process.exitCode = 1;
-}

package/harness/sandbox.mjs

@@ -1,132 +0,0 @@
-import {
-  HarnessError,
-  publicError,
-  FIXTURE_TARGET,
-  fixtureConfig
-} from "./chunk-2gt4cy7x.mjs";
-import {
-  ToolExecutor,
-  SandboxProbeJournal,
-  SandboxJournal,
-  reapSandboxes
-} from "./chunk-msg872ea.mjs";
-import {
-  sandboxRuntime,
-  PROBE_TOOL,
-  ToolRegistry,
-  DockerEngine,
-  sandboxConfig,
-  checkSandbox,
-  SandboxWorker
-} from "./chunk-xqyc4ca2.mjs";
-import"./chunk-7bg2gnv2.mjs";
-import"./chunk-zvkxtj82.mjs";
-import {
-  databaseConfig
-} from "./chunk-5cvb1jnb.mjs";
-import {
-  uuid
-} from "./chunk-1sygmp11.mjs";
-
-// apps/harness/src/sandbox/probe.ts
-import { randomUUID } from "node:crypto";
-async function sandboxProbe(args) {
-  const [command, argument] = args;
-  if (!["check", "run", "cleanup", "reap"].includes(command ?? "") || args.length !== (command === "cleanup" ? 2 : 1) || command === "cleanup" && !uuid().safeParse(argument).success)
-    throw new HarnessError("sandbox_command", "Use sandbox check, run, reap, or cleanup <runId>.");
-  const config = sandboxConfig();
-  const engine = new DockerEngine(config.socket);
-  if (command === "check") {
-    const workerId = await checkSandbox(config, engine);
-    console.log(JSON.stringify({
-      configured: true,
-      runtime: sandboxRuntime(config),
-      workerId,
-      image: config.image,
-      executed: false,
-      productionApproved: false
-    }));
-    return;
-  }
-  const journal = new SandboxProbeJournal(databaseConfig());
-  const controller = new AbortController;
-  let lease;
-  let heartbeat;
-  let heartbeatTask;
-  const stop = () => controller.abort();
-  process.on("SIGINT", stop);
-  process.on("SIGTERM", stop);
-  try {
-    if (command === "reap") {
-      const report = await reapSandboxes(config, engine, journal, controller.signal);
-      console.log(JSON.stringify(report));
-      if (report.interrupted || report.outcomes.some((outcome) => outcome.status === "blocked"))
-        process.exitCode = 1;
-      return;
-    }
-    if (command === "run")
-      await checkSandbox(config, engine);
-    const runId = argument ?? randomUUID();
-    if (command === "run")
-      await journal.createRun(runId, FIXTURE_TARGET, fixtureConfig());
-    lease = await journal.acquire(runId);
-    const owned = lease;
-    heartbeat = setInterval(() => {
-      if (heartbeatTask)
-        return;
-      heartbeatTask = journal.heartbeat(owned).then(async () => {
-        if ((await journal.read(runId)).stopRequested)
-          controller.abort();
-      }).catch(() => controller.abort()).finally(() => {
-        heartbeatTask = undefined;
-      });
-    }, 1000);
-    const worker = new SandboxWorker(config, engine, new SandboxJournal(journal, lease));
-    if (command === "cleanup") {
-      const removed = await worker.reap();
-      console.log(JSON.stringify({
-        runId,
-        removed,
-        actionReplayed: false,
-        actionReconciled: false
-      }));
-      return;
-    }
-    console.log(JSON.stringify({
-      runId,
-      diagnostic: "offline-sandbox-probe",
-      providerCalls: 0
-    }));
-    const callId = "sandbox-probe-1";
-    await journal.beginModel(lease, "sandbox-diagnostic", {
-      diagnostic: "offline-sandbox-probe"
-    });
-    await journal.completeModel(lease, "sandbox-diagnostic", {
-      tool_calls: [{ id: callId, name: PROBE_TOOL, args: {} }]
-    });
-    const executor = new ToolExecutor(journal, lease, controller.signal, new ToolRegistry([worker.tool()]));
-    const result = JSON.parse(await executor.execute(callId, PROBE_TOOL, {}));
-    await journal.finish(lease, "completed");
-    console.log(JSON.stringify({ runId, ...result, productionApproved: false }));
-  } finally {
-    controller.abort();
-    if (heartbeat)
-      clearInterval(heartbeat);
-    await heartbeatTask;
-    if (lease)
-      await journal.release(lease).catch(() => {
-        return;
-      });
-    await journal.close();
-    process.off("SIGINT", stop);
-    process.off("SIGTERM", stop);
-  }
-}
-
-// apps/harness/scripts/sandbox.ts
-try {
-  await sandboxProbe(process.argv.slice(2));
-} catch (error) {
-  console.error(publicError(error));
-  process.exitCode = 1;
-}