@north-light/crouter 0.3.349 → 0.3.350

package/packages/crouter-identity/dist/index.js

@@ -0,0 +1,166 @@
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
+/** App-memory form keys omit the app id. */
+export const ENFORCED = new Set(['crtr:llm', 'crtr:act', 'crtr:memory:read:app', 'crtr:memory:rw:app', 'crtr:files:read:user:.', 'crtr:files:rw:user:.']);
+const id = /^[A-Za-z0-9_-]{1,64}$/;
+function validPath(path, directoryOnly = false) {
+    if (path === '.' && directoryOnly)
+        return true;
+    return path.length > 0 && !path.startsWith('/') && !path.includes('..') && !path.includes(':') &&
+        !path.includes('\\') && !/\s/.test(path) &&
+        !path.split('/').some((part, index, parts) => part === '.' || (part === '' && index !== parts.length - 1)) &&
+        (!directoryOnly || !path.endsWith('/'));
+}
+function selector(value) {
+    if (value === 'crtr:llm' || value === 'crtr:act' || value === 'crtr:schedule')
+        return { kind: value.slice(5), value };
+    if (value === 'crtr:files:share')
+        return { kind: 'share', value };
+    if (value === 'crtr:memory:manage:user')
+        return { kind: 'memory', access: 'manage', holder: 'user' };
+    let match = /^crtr:memory:(read|rw):user(?::(.+))?$/.exec(value);
+    if (match && (match[2] === undefined || validPath(match[2])))
+        return { kind: 'memory', access: match[1], holder: 'user', path: match[2] };
+    match = /^crtr:memory:(read|rw):app:([A-Za-z0-9_-]{1,64})(?::profile:([A-Za-z0-9_-]{1,64})(?::(.+))?)?$/.exec(value);
+    if (match && (match[4] === undefined || validPath(match[4]))) {
+        return { kind: 'memory', access: match[1], holder: `app:${match[2]}`, profile: match[3], path: match[4] };
+    }
+    match = /^crtr:files:(read|rw):(user|app:[A-Za-z0-9_-]{1,64}):(.+)$/.exec(value);
+    if (match && validPath(match[3], true))
+        return { kind: 'files', access: match[1], holder: match[2], path: match[3] };
+    match = /^crtr:(conversations|objects):read:app:([A-Za-z0-9_-]{1,64})$/.exec(value);
+    if (match)
+        return { kind: match[1], value };
+    match = /^crtr:peer:([A-Za-z0-9_-]{1,64})$/.exec(value);
+    if (match)
+        return { kind: 'peer', value };
+    match = /^([^:]+):([^:]+)$/.exec(value);
+    if (match && match[1] !== 'crtr' && id.test(match[1]) && id.test(match[2]))
+        return { kind: 'provider', value };
+    throw new TypeError(`Unsupported scope: ${value}`);
+}
+export function parseScope(value, grantee) {
+    const parsed = selector(value);
+    if (grantee && (parsed.kind === 'memory' || parsed.kind === 'files') && parsed.holder.startsWith('app:') && parsed.holder !== grantee) {
+        throw new TypeError(`Unsupported scope: ${value}`);
+    }
+    return value;
+}
+function containsPath(held, requested) {
+    if (held === undefined)
+        return true;
+    if (requested === undefined)
+        return false;
+    return held === requested || (held.endsWith('/') && requested.startsWith(held));
+}
+export function covers(held, requested) {
+    const h = selector(held);
+    const r = selector(requested);
+    if (h.kind !== r.kind)
+        return false;
+    if (h.kind === 'memory' && r.kind === 'memory') {
+        return h.holder === r.holder && (h.access === r.access || h.access === 'manage' || (h.access === 'rw' && r.access === 'read')) &&
+            (h.profile === undefined || h.profile === r.profile) && containsPath(h.path, r.path);
+    }
+    if (h.kind === 'files' && r.kind === 'files') {
+        return h.holder === r.holder && (h.access === 'rw' || r.access === 'read') &&
+            (h.path === '.' || h.path === r.path || r.path.startsWith(`${h.path}/`));
+    }
+    return held === requested;
+}
+/** Keys are scoped to one configured issuer; failed refreshes keep the last successful set. */
+export class JwksCache {
+    issuer;
+    fetcher;
+    keys;
+    lastUnknownRefresh = -Infinity;
+    discovery;
+    constructor(issuer, fetcher = fetch, jwksUri) {
+        this.issuer = issuer;
+        this.fetcher = fetcher;
+        if (jwksUri)
+            this.discovery = { jwks_uri: jwksUri };
+    }
+    async load() {
+        if (!this.discovery) {
+            const response = await this.fetcher(`${this.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`);
+            if (!response.ok)
+                throw new Error(`Directory discovery failed: ${response.status}`);
+            const value = await response.json();
+            if (!value || typeof value !== 'object' || !('jwks_uri' in value) || typeof value.jwks_uri !== 'string')
+                throw new Error('Directory discovery has no jwks_uri');
+            this.discovery = { jwks_uri: value.jwks_uri };
+        }
+        const response = await this.fetcher(this.discovery.jwks_uri);
+        if (!response.ok)
+            throw new Error(`Directory JWKS failed: ${response.status}`);
+        const keys = await response.json();
+        if (!keys || typeof keys !== 'object' || !('keys' in keys) || !Array.isArray(keys.keys))
+            throw new Error('Invalid directory JWKS');
+        this.keys = keys;
+        return this.keys;
+    }
+    async forKid(kid) {
+        if (!this.keys)
+            return this.load();
+        if (this.keys.keys.some((key) => key.kid === kid))
+            return this.keys;
+        if (Date.now() - this.lastUnknownRefresh >= 30_000) {
+            this.lastUnknownRefresh = Date.now();
+            await this.load();
+        }
+        return this.keys;
+    }
+}
+function validatePrincipal(value, kind) {
+    return typeof value === 'string' && value.startsWith(`${kind}:`) && id.test(value.slice(kind.length + 1));
+}
+function keySet(jwks, kid) {
+    return jwks instanceof JwksCache ? jwks.forKid(kid) : Promise.resolve(jwks);
+}
+export async function verifyAccessToken(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
+        throw new Error('Invalid access token header');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'], typ: 'at+jwt',
+    });
+    if (payload.aud !== options.audience || !validatePrincipal(payload.sub, 'user') || !validatePrincipal(payload.grantee, 'app') ||
+        typeof payload.client_id !== 'string' || !id.test(payload.client_id) || typeof payload.grant !== 'string' ||
+        typeof payload.exp !== 'number') {
+        throw new Error('Invalid access token claims');
+    }
+    return payload;
+}
+/** The directory's grant-sync notice: ES256 with the directory signing key named
+ *  by `kid`, no `typ`, `aud` = the runtime's registered URL, a lifetime of at most
+ *  five minutes, and a `jti` the runtime uses to answer replays without a sync. */
+export async function verifySyncNotice(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.alg !== 'ES256')
+        throw new Error('Invalid sync notice algorithm');
+    if (typeof header.kid !== 'string' || header.kid === '')
+        throw new Error('Sync notice has no key id');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'], requiredClaims: ['exp', 'iat', 'jti'],
+        maxTokenAge: 300, clockTolerance: 30,
+    });
+    if (payload.aud !== options.audience || payload.purpose !== 'grant_sync' || typeof payload.jti !== 'string' || payload.jti === '' ||
+        typeof payload.exp !== 'number' || typeof payload.iat !== 'number' || payload.exp - payload.iat > 300) {
+        throw new Error('Invalid sync notice claims');
+    }
+    return payload;
+}
+export async function verifyIdToken(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.alg !== 'ES256')
+        throw new Error('Invalid ID token algorithm');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'],
+    });
+    if (payload.aud !== options.audience || typeof payload.exp !== 'number' || !validatePrincipal(payload.sub, 'user'))
+        throw new Error('Invalid ID token claims');
+    return payload;
+}

package/packages/crouter-identity/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@north-light/crouter-identity",
+  "version": "0.3.350",
+  "description": "Northlight access-token verification and scope rules",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "jose": "^6.2.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vallum-security/crouter.git",
+    "directory": "packages/crouter-identity"
+  },
+  "license": "GPL-3.0-only"
+}

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.349",
+  "version": "0.3.350",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.349",
+      "version": "0.3.350",
       "hasInstallScript": true,
       "license": "GPL-3.0-only",
       "workspaces": [
@@ -18,8 +18,10 @@
         "@earendil-works/pi-ai": "0.87.1",
         "@earendil-works/pi-coding-agent": "0.87.1",
         "@earendil-works/pi-tui": "0.87.1",
+        "@north-light/crouter-identity": "^0.3.350",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
+        "jose": "^6.2.12",
         "proper-lockfile": "4.1.2",
         "string-width": "^7.0.0",
         "tar": "^7.5.22",
@@ -32,6 +34,7 @@
       "bin": {
         "crouter": "bin/crouter",
         "crtr": "bin/crtr",
+        "crtr-launcher": "bin/crtr-launcher",
         "crtrd": "bin/crtrd"
       },
       "devDependencies": {
@@ -4324,6 +4327,10 @@
       "resolved": "packages/crouter-env-docker",
       "link": true
     },
+    "node_modules/@north-light/crouter-identity": {
+      "resolved": "packages/crouter-identity",
+      "link": true
+    },
     "node_modules/@north-light/crouter-plugin": {
       "resolved": "packages/crouter-plugin",
       "link": true
@@ -7485,6 +7492,15 @@
         "jiti": "lib/jiti-cli.mjs"
       }
     },
+    "node_modules/jose": {
+      "version": "6.2.12",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
+      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/json-bigint": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
@@ -10869,28 +10885,38 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/crouter-api",
-      "version": "0.3.349",
+      "version": "0.3.350",
       "license": "GPL-3.0-only"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/crouter-env-docker",
-      "version": "0.3.349",
+      "version": "0.3.350",
       "license": "GPL-3.0-only"
     },
+    "packages/crouter-identity": {
+      "name": "@north-light/crouter-identity",
+      "version": "0.3.350",
+      "license": "GPL-3.0-only",
+      "dependencies": {
+        "jose": "^6.2.1"
+      }
+    },
     "packages/crouter-plugin": {
       "name": "@north-light/crouter-plugin",
-      "version": "0.3.349",
+      "version": "0.3.350",
       "license": "GPL-3.0-only",
       "dependencies": {
-        "@north-light/crouter-api": "^0.3.349"
+        "@north-light/crouter-api": "^0.3.350"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/crouter-sdk",
-      "version": "0.3.349",
+      "version": "0.3.350",
       "license": "GPL-3.0-only",
       "dependencies": {
-        "@north-light/crouter-api": "^0.3.349"
+        "@north-light/crouter-api": "^0.3.350",
+        "@north-light/crouter-identity": "^0.3.350",
+        "jose": "^6.2.1"
       }
     }
   }

package/scripts/build-native-linux.mjs

@@ -0,0 +1,16 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+if (process.platform !== 'linux') throw new Error('The native addon builds only on Linux');
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const header = resolve(dirname(process.execPath), '../include/node');
+if (!existsSync(join(header, 'node_api.h'))) throw new Error(`Node headers not found: ${header}`);
+// The build passes its staging directory; run by hand it writes into dist/.
+const target = resolve(process.argv[2] ?? join(root, 'dist/native/linux/addon.node'));
+mkdirSync(dirname(target), { recursive: true });
+const args = ['-std=c11', '-O2', '-fPIC', '-shared', '-Wall', '-Wextra', '-Werror', `-I${header}`, join(root, 'src/native/linux/addon.c'), '-o', target];
+const result = spawnSync('cc', args, { stdio: 'inherit' });
+if (result.error) throw result.error;
+if (result.status !== 0) throw new Error(`cc failed: ${result.status ?? result.signal}`);

package/scripts/install-runtime.mjs

@@ -7,6 +7,14 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ENTRY_NAMES, GENERATION_ID, MANIFEST_KEYS, PACKAGE_NAME, MANIFEST_SCHEMA, contained, isSealed, publishedMarkerPath, runtimeHome, sortInventory, validateManifestShape } from '../bin/runtime-generation-manifest.mjs';
 import { patchPiTreeRootOrdering } from './patch-pi-tree-root-ordering.mjs';
+import { smokeValidate } from './runtime-smoke.mjs';
+import { scrubInheritedBrokerEnv, unsafeIsolationReason } from './lib/isolation-env.mjs';
+
+scrubInheritedBrokerEnv();
+// CI has no account store to protect, and its checkout sits inside the runner's
+// home while the lanes move HOME elsewhere; test-env-scrub skips CI the same way.
+const unsafeReason = process.env.CI ? null : unsafeIsolationReason();
+if (unsafeReason) throw new Error(`Unsafe crouter runtime install: ${unsafeReason}`);
 
 const PACKAGE_ROOT = process.argv[2] ? resolve(process.argv[2]) : resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const RUNTIME_HOME = runtimeHome();
@@ -129,12 +137,6 @@ async function removeStage(root) {
   await rm(root, { recursive: true, force: true });
 }
 
-async function smokeValidate(stage) {
-  await run(process.execPath, ['--input-type=module', '--eval', "await import('./dist/index.js')"], stage);
-  const lazyPiModule = 'node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.js';
-  await lstat(join(stage, lazyPiModule));
-  await run(process.execPath, ['--input-type=module', '--eval', `await import('./${lazyPiModule}')`], stage);
-}
 
 /** Atomically mark generation `id` eligible as a sibling-fallback candidate
  *  (see `runtime-generation-manifest.mjs`'s `publishedMarkerPath` for the
@@ -436,7 +438,7 @@ async function install() {
       platform: process.platform,
       arch: process.arch,
       createdAt: new Date().toISOString(),
-      entries: { cli: 'dist/cli.js', daemon: 'dist/daemon/crtrd-cli.js', broker: 'dist/core/runtime/broker-cli.js' },
+      entries: { cli: 'dist/cli.js', daemon: 'dist/daemon/crtrd-cli.js', broker: 'dist/core/runtime/broker-cli.js', launcher: 'dist/launcher/main.js' },
       files,
     };
     if (JSON.stringify(Object.keys(manifest).sort()) !== JSON.stringify(MANIFEST_KEYS) || manifest.packageName !== PACKAGE_NAME) throw new Error('generated runtime manifest has an invalid schema or package identity');

package/scripts/lib/isolation-env.mjs

@@ -0,0 +1,42 @@
+import { realpathSync } from 'node:fs';
+import { tmpdir, userInfo } from 'node:os';
+import { isAbsolute, relative, sep } from 'node:path';
+
+// A node's shell inherits broker identity and pi paths. Neither an installer
+// nor a test lane is that broker; nested processes must resolve their own roots.
+export function scrubInheritedBrokerEnv(env = process.env) {
+  for (const key of Object.keys(env)) {
+    if (key.startsWith('PI_') || (key.startsWith('CRTR_') &&
+      key !== 'CRTR_HOME' && key !== 'CRTR_RUNTIME_HOME' && key !== 'CRTR_NO_DAEMON_AUTOSTART')) {
+      delete env[key];
+    }
+  }
+}
+
+// A normal host install uses the account HOME. When HOME is overridden, no
+// working directory or configured write root may still point into that account.
+export function unsafeIsolationReason({ requireTemporaryHome = false, requireCrtrHome = false } = {}) {
+  const inside = (home, target) => {
+    const rel = relative(home, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+  };
+  try {
+    const home = realpathSync(process.env.HOME);
+    const accountHome = realpathSync(userInfo().homedir);
+    if (home === accountHome) return requireTemporaryHome ? 'HOME is the account home' : null;
+    if (requireCrtrHome && !process.env.CRTR_HOME) return 'CRTR_HOME is missing';
+    for (const [name, path] of [
+      ['cwd', process.cwd()], ['TMPDIR', tmpdir()],
+      ...(process.env.CRTR_HOME ? [['CRTR_HOME', process.env.CRTR_HOME]] : []),
+      ...(process.env.CRTR_RUNTIME_HOME ? [['CRTR_RUNTIME_HOME', process.env.CRTR_RUNTIME_HOME]] : []),
+    ]) {
+      const target = realpathSync(path);
+      if (inside(accountHome, target) && !inside(home, target)) {
+        return `${name} is inside the account home but outside HOME`;
+      }
+    }
+    return null;
+  } catch {
+    return 'HOME, account home, cwd, TMPDIR, CRTR_HOME, or CRTR_RUNTIME_HOME cannot be resolved';
+  }
+}

package/scripts/runtime-smoke.mjs

@@ -0,0 +1,49 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, readdir, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+
+const exec = promisify(execFile);
+
+// npm ci can succeed with workspace links whose targets were omitted from
+// npm pack. Reject those before publishing or selecting a generation.
+async function validateLinks(root, directory = root) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) await validateLinks(root, path);
+    else if (entry.isSymbolicLink()) {
+      let target;
+      try { target = await realpath(path); }
+      catch (error) { throw new Error(`Broken runtime symlink: ${relative(root, path)}`, { cause: error }); }
+      const rel = relative(root, target);
+      if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`)) {
+        throw new Error(`Runtime symlink escapes generation: ${relative(root, path)}`);
+      }
+    }
+  }
+}
+
+export async function smokeValidate(stage) {
+  stage = await realpath(resolve(stage));
+  await validateLinks(stage);
+  const home = await mkdtemp(join(tmpdir(), 'crtr-runtime-smoke-'));
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) =>
+    !key.startsWith('CRTR_') && !key.startsWith('PI_') && key !== 'NODE_OPTIONS'));
+  Object.assign(env, {
+    HOME: home, CRTR_HOME: join(home, 'canvas'),
+    CRTR_NO_DAEMON_AUTOSTART: '1', PI_CODING_AGENT_DIR: join(home, 'pi'),
+  });
+  try {
+    // Load the actual daemon and broker graphs without starting either. The
+    // public index alone does not reach daemon-only dependencies.
+    await exec(process.execPath, ['--input-type=module', '--eval', `
+      await import('./dist/index.js');
+      await import('./dist/daemon/crtrd.js');
+      await import('./dist/core/runtime/broker.js');
+      await import('./node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.js');
+    `], { cwd: stage, env, timeout: 30_000, maxBuffer: 1024 * 1024 });
+  } finally {
+    await rm(home, { recursive: true, force: true });
+  }
+}