@murk-security/runner-linux-x64 0.7.1 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@murk-security/runner-linux-x64",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "MURK local runner (prebuilt harness + adapter) for linux/x64. Installed automatically by @murk-security/cli.",
   "os": [
     "linux"

package/runners/basic_harness_run.py

@@ -30,6 +30,7 @@ import json
 import os
 import re
 import signal
+import socket
 import sqlite3
 import subprocess
 import sys
@@ -959,6 +960,23 @@ def _run_remediate(spec: dict, em: "Emitter") -> int:
     return 0
 
 
+def _target_listening(origin: str, timeout: float = 6.0) -> bool:
+    """Whether something is listening at the origin's host:port (a quick TCP connect). A refused or
+    timed-out connect means the app isn't running there, so the scan would hunt against nothing and
+    report no findings -- which reads as 'found nothing' rather than 'nothing was there'. An
+    unparseable origin returns True (don't block on a parse failure)."""
+    try:
+        u = urlparse(origin if "//" in origin else "http://" + origin)
+        host = u.hostname or ""
+        port = u.port or (443 if u.scheme == "https" else 80)
+        if not host:
+            return True
+        with socket.create_connection((host, port), timeout=timeout):
+            return True
+    except Exception:
+        return False
+
+
 def main() -> int:
     ap = argparse.ArgumentParser()
     ap.add_argument("--spec", required=True)
@@ -1015,6 +1033,21 @@ def main() -> int:
         em.emit("run.completed", {"stop": "halt", "findings": 0, "ok": True,
                                   "message": "no findings with a reproduction recipe to retest"})
         return 0
+    # Fail fast if a live target isn't actually up. Otherwise the whole hunt runs against a dead
+    # origin and reports no findings, which reads as "the scanner found nothing" rather than
+    # "nothing was running there to scan". The `murk scan` CLI pre-checks before booking a local
+    # run; this covers hosted runs and is a backstop for local. Skippable for tests/dev.
+    _live_origins = (spec.get("target") or {}).get("origins") or []
+    if kind == "assess" and _live_origins and os.environ.get("BASIC_HARNESS_SKIP_REACHABILITY") != "1":
+        if all(not _target_listening(o) for o in _live_origins):
+            em.emit("run.failed", {
+                "category": "target",
+                "message": ("couldn't reach the target (" + ", ".join(_live_origins) + ") — is the "
+                            "application running and listening there? No scan was performed."),
+                "stop": "unreachable",
+            })
+            return 4
+
     goal = build_retest_brief(retest_findings) if kind == "retest" else build_brief(spec)
     rounds = (os.environ.get("BASIC_HARNESS_RETEST_ROUNDS", "1") if kind == "retest"
               else os.environ.get("BASIC_HARNESS_ROUNDS", "3"))
@@ -1093,6 +1126,12 @@ def main() -> int:
         "-max-cost", os.environ.get("BASIC_HARNESS_MAX_COST", prof["max_cost"]),
         "-compact-tokens", "100000", "-ui", "", "-hold=false",
     ]
+    # How far the agents may go. Pass the spec's action tier through to the harness so the Go
+    # side (the exploiter agent and its tier-gated behaviour) matches what prod_env enforces for
+    # its ops on the same spec. Without this the harness stayed at its "passive" default no matter
+    # the spec. The harness fail-closes to passive on anything unrecognized.
+    action_tier = str((spec.get("policy") or {}).get("actionTier") or "passive")
+    cmd += ["-action-tier", action_tier]
     # Route model calls through the murk model gateway when the control plane set
     # OPENROUTER_BASE_URL (then OPENROUTER_API_KEY is a signed gateway token, not the
     # OpenRouter key); direct to OpenRouter otherwise.