@mettlelabs/mettle 0.0.0-beta.1 → 0.0.0-beta.1-linux-x64

package/harness/chunk-zvkxtj82.mjs

@@ -0,0 +1,42 @@
+import {
+  string,
+  number,
+  array,
+  strictObject,
+  _enum
+} from "./chunk-1sygmp11.mjs";
+
+// apps/harness/src/access.ts
+var identity = string().min(1).max(256);
+var RunAuthoritySchema = strictObject({
+  tenantId: identity,
+  actorId: identity,
+  engagementId: identity,
+  policyRevision: identity
+});
+var ApiPrincipalSchema = RunAuthoritySchema.extend({
+  permissions: array(_enum([
+    "run:create",
+    "engagement:create",
+    "run:read",
+    "run:control",
+    "run:recover",
+    "run:delete"
+  ])).min(1).refine((permissions) => new Set(permissions).size === permissions.length),
+  expiresAt: number().int().positive()
+});
+var ApiTokenRecordSchema = strictObject({
+  tokenSha256: string().regex(/^[a-f0-9]{64}$/),
+  principal: ApiPrincipalSchema
+});
+var BEARER_TOKEN_PATTERN = /^Bearer ([A-Za-z0-9_-]{43})$/;
+function authorityFor(principal) {
+  return RunAuthoritySchema.parse({
+    tenantId: principal.tenantId,
+    actorId: principal.actorId,
+    engagementId: principal.engagementId,
+    policyRevision: principal.policyRevision
+  });
+}
+
+export { RunAuthoritySchema, ApiPrincipalSchema, ApiTokenRecordSchema, BEARER_TOKEN_PATTERN, authorityFor };

package/harness/issue-api-token.mjs

@@ -0,0 +1,35 @@
+import"./chunk-2gt4cy7x.mjs";
+import"./chunk-zvkxtj82.mjs";
+import {
+  writeApiTokenFiles
+} from "./chunk-4jtnt9k5.mjs";
+
+// apps/harness/scripts/issue-api-token.ts
+import { readFile } from "node:fs/promises";
+import { parseArgs } from "node:util";
+try {
+  const { values } = parseArgs({
+    options: {
+      request: { type: "string" },
+      "output-dir": { type: "string" },
+      help: { type: "boolean" }
+    },
+    strict: true,
+    allowPositionals: false
+  });
+  if (values.help) {
+    process.stdout.write(`Usage: issue-api-token --request <request.json> --output-dir <new-private-directory>
+`);
+  } else {
+    if (!values.request || !values["output-dir"])
+      throw new Error("Explicit request and output directory required.");
+    const request = JSON.parse(await readFile(values.request, "utf8"));
+    const result = await writeApiTokenFiles(request, values["output-dir"]);
+    process.stdout.write(`${JSON.stringify(result)}
+`);
+  }
+} catch {
+  process.stderr.write(`API token issuance failed. Check the request, existing parent directory, and unused output path; no credentials printed.
+`);
+  process.exitCode = 1;
+}

package/harness/launcher.mjs

@@ -0,0 +1,159 @@
+import {
+  CONTRACT_VERSION,
+  RunConfigSchema,
+  HarnessError,
+  publicError,
+  COORDINATOR_TARGET
+} from "./chunk-2gt4cy7x.mjs";
+import {
+  RunAuthoritySchema
+} from "./chunk-zvkxtj82.mjs";
+import {
+  SandboxConfigSchema,
+  DockerEngine,
+  checkSandbox
+} from "./chunk-xqyc4ca2.mjs";
+import {
+  liveRoute,
+  liveProfiles,
+  loadInvestigationGrant,
+  SOURCE_TOTAL_BYTES,
+  SOURCE_FILES_MAX,
+  InvestigationProfilesSchema
+} from "./chunk-32y07kkp.mjs";
+import {
+  privateFile,
+  ownedDirectory
+} from "./chunk-7bg2gnv2.mjs";
+
+// apps/harness/scripts/launcher.ts
+import { parseArgs } from "node:util";
+
+// apps/harness/src/runtime/launcher.ts
+import { join } from "node:path";
+function launchTokenRequest() {
+  return {
+    tenantId: "local-team",
+    actorId: "operator",
+    engagementId: "counter-development",
+    policyRevision: "v1",
+    permissions: [
+      "run:create",
+      "run:read",
+      "run:control",
+      "run:recover",
+      "engagement:create"
+    ],
+    ttlSeconds: 86400
+  };
+}
+function launchRunConfig(environment) {
+  return RunConfigSchema.parse({
+    contractVersion: CONTRACT_VERSION,
+    model: liveRoute(environment).model
+  });
+}
+async function investigationProfiles(setup) {
+  const { environment, location = "local", engineId } = setup;
+  const { tenantId, actorId, engagementId, policyRevision } = launchTokenRequest();
+  const base = {
+    authority: setup.authority ?? RunAuthoritySchema.parse({
+      tenantId,
+      actorId,
+      engagementId,
+      policyRevision
+    }),
+    models: liveProfiles(environment).map((model) => ({
+      id: model.route.model,
+      provider: model.route.provider
+    })),
+    expiresAt: setup.expiresAt ?? new Date(Date.now() + launchTokenRequest().ttlSeconds * 1000).toISOString(),
+    stages: { maxWorkers: 2, huntPartitions: 2 }
+  };
+  const pinned = async (input) => {
+    const config = SandboxConfigSchema.parse(input);
+    if (location === "vm" && !engineId)
+      throw new HarnessError("investigation_config", "VM setup requires --engine-id from the designated VM, independently of the forwarded socket.");
+    const engine = await checkSandbox({ ...config, ...engineId ? { engineId } : {} }, setup.engine ?? new DockerEngine(config.socket));
+    return SandboxConfigSchema.parse({ ...config, engineId: engine, location });
+  };
+  const profiles = [];
+  if (setup.review) {
+    if (setup.githubTokenFile)
+      await privateFile(setup.githubTokenFile, 4096);
+    const localRoot = setup.localRoot ? await ownedDirectory(setup.localRoot, new HarnessError("investigation_config", "The local review root must be a directory owned by this operator.")) : undefined;
+    profiles.push({
+      ...base,
+      id: `${location}-review`,
+      mode: "codereview",
+      sandbox: await pinned({
+        image: environment.HARNESS_SANDBOX_IMAGE,
+        socket: environment.HARNESS_SANDBOX_SOCKET,
+        runtime: environment.HARNESS_SANDBOX_RUNTIME
+      }),
+      workspaceRoot: join(setup.directory, "snapshots"),
+      ...localRoot ? { localRoot } : {},
+      maxFiles: SOURCE_FILES_MAX,
+      maxSourceBytes: SOURCE_TOTAL_BYTES,
+      allowPatchProposals: true,
+      ...setup.githubTokenFile ? { githubTokenFile: setup.githubTokenFile } : {}
+    });
+  }
+  if (setup.pentestGrant) {
+    const grant = await loadInvestigationGrant(setup.pentestGrant);
+    if (grant.mode !== "pentest")
+      throw new HarnessError("investigation_config", "The pentest profile requires a pentest grant.");
+    if (location === "vm" && !grant.sandbox)
+      throw new HarnessError("investigation_config", "VM profiles require an isolated live target grant.");
+    profiles.push({
+      ...base,
+      id: `${location}-pentest`,
+      mode: "pentest",
+      grant: {
+        ...grant,
+        ...grant.sandbox ? { sandbox: await pinned(grant.sandbox) } : {}
+      }
+    });
+  }
+  return InvestigationProfilesSchema.parse(profiles);
+}
+
+// apps/harness/scripts/launcher.ts
+var USAGE = "Usage: launcher.ts token-request | run-config | investigation-profiles --directory <path> [--github-token-file <path>]";
+try {
+  const { positionals, values } = parseArgs({
+    strict: true,
+    allowPositionals: true,
+    options: {
+      directory: { type: "string" },
+      "github-token-file": { type: "string" }
+    }
+  });
+  const [command] = positionals;
+  if (positionals.length !== 1 || command !== "investigation-profiles" && Object.keys(values).length > 0)
+    throw new Error(USAGE);
+  if (command === "token-request")
+    process.stdout.write(`${JSON.stringify(launchTokenRequest())}
+`);
+  else if (command === "run-config")
+    process.stdout.write(`${JSON.stringify({
+      target: COORDINATOR_TARGET,
+      config: launchRunConfig(process.env)
+    })}
+`);
+  else if (command === "investigation-profiles" && values.directory) {
+    const profiles = await investigationProfiles({
+      environment: process.env,
+      directory: values.directory,
+      review: true,
+      ...values["github-token-file"] ? { githubTokenFile: values["github-token-file"] } : {}
+    });
+    process.stdout.write(`${JSON.stringify(profiles, null, 2)}
+`);
+  } else
+    throw new Error(USAGE);
+} catch (error) {
+  process.stderr.write(`${error instanceof Error && error.message === USAGE ? USAGE : publicError(error)}
+`);
+  process.exitCode = 1;
+}

package/harness/sandbox.mjs

@@ -0,0 +1,132 @@
+import {
+  HarnessError,
+  publicError,
+  FIXTURE_TARGET,
+  fixtureConfig
+} from "./chunk-2gt4cy7x.mjs";
+import {
+  ToolExecutor,
+  SandboxProbeJournal,
+  SandboxJournal,
+  reapSandboxes
+} from "./chunk-msg872ea.mjs";
+import {
+  sandboxRuntime,
+  PROBE_TOOL,
+  ToolRegistry,
+  DockerEngine,
+  sandboxConfig,
+  checkSandbox,
+  SandboxWorker
+} from "./chunk-xqyc4ca2.mjs";
+import"./chunk-7bg2gnv2.mjs";
+import"./chunk-zvkxtj82.mjs";
+import {
+  databaseConfig
+} from "./chunk-5cvb1jnb.mjs";
+import {
+  uuid
+} from "./chunk-1sygmp11.mjs";
+
+// apps/harness/src/sandbox/probe.ts
+import { randomUUID } from "node:crypto";
+async function sandboxProbe(args) {
+  const [command, argument] = args;
+  if (!["check", "run", "cleanup", "reap"].includes(command ?? "") || args.length !== (command === "cleanup" ? 2 : 1) || command === "cleanup" && !uuid().safeParse(argument).success)
+    throw new HarnessError("sandbox_command", "Use sandbox check, run, reap, or cleanup <runId>.");
+  const config = sandboxConfig();
+  const engine = new DockerEngine(config.socket);
+  if (command === "check") {
+    const workerId = await checkSandbox(config, engine);
+    console.log(JSON.stringify({
+      configured: true,
+      runtime: sandboxRuntime(config),
+      workerId,
+      image: config.image,
+      executed: false,
+      productionApproved: false
+    }));
+    return;
+  }
+  const journal = new SandboxProbeJournal(databaseConfig());
+  const controller = new AbortController;
+  let lease;
+  let heartbeat;
+  let heartbeatTask;
+  const stop = () => controller.abort();
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+  try {
+    if (command === "reap") {
+      const report = await reapSandboxes(config, engine, journal, controller.signal);
+      console.log(JSON.stringify(report));
+      if (report.interrupted || report.outcomes.some((outcome) => outcome.status === "blocked"))
+        process.exitCode = 1;
+      return;
+    }
+    if (command === "run")
+      await checkSandbox(config, engine);
+    const runId = argument ?? randomUUID();
+    if (command === "run")
+      await journal.createRun(runId, FIXTURE_TARGET, fixtureConfig());
+    lease = await journal.acquire(runId);
+    const owned = lease;
+    heartbeat = setInterval(() => {
+      if (heartbeatTask)
+        return;
+      heartbeatTask = journal.heartbeat(owned).then(async () => {
+        if ((await journal.read(runId)).stopRequested)
+          controller.abort();
+      }).catch(() => controller.abort()).finally(() => {
+        heartbeatTask = undefined;
+      });
+    }, 1000);
+    const worker = new SandboxWorker(config, engine, new SandboxJournal(journal, lease));
+    if (command === "cleanup") {
+      const removed = await worker.reap();
+      console.log(JSON.stringify({
+        runId,
+        removed,
+        actionReplayed: false,
+        actionReconciled: false
+      }));
+      return;
+    }
+    console.log(JSON.stringify({
+      runId,
+      diagnostic: "offline-sandbox-probe",
+      providerCalls: 0
+    }));
+    const callId = "sandbox-probe-1";
+    await journal.beginModel(lease, "sandbox-diagnostic", {
+      diagnostic: "offline-sandbox-probe"
+    });
+    await journal.completeModel(lease, "sandbox-diagnostic", {
+      tool_calls: [{ id: callId, name: PROBE_TOOL, args: {} }]
+    });
+    const executor = new ToolExecutor(journal, lease, controller.signal, new ToolRegistry([worker.tool()]));
+    const result = JSON.parse(await executor.execute(callId, PROBE_TOOL, {}));
+    await journal.finish(lease, "completed");
+    console.log(JSON.stringify({ runId, ...result, productionApproved: false }));
+  } finally {
+    controller.abort();
+    if (heartbeat)
+      clearInterval(heartbeat);
+    await heartbeatTask;
+    if (lease)
+      await journal.release(lease).catch(() => {
+        return;
+      });
+    await journal.close();
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+  }
+}
+
+// apps/harness/scripts/sandbox.ts
+try {
+  await sandboxProbe(process.argv.slice(2));
+} catch (error) {
+  console.error(publicError(error));
+  process.exitCode = 1;
+}