@optimuslabs/harness-map-staging 1.5.35 → 1.5.38

package/dist/agent_access/decision.js

@@ -0,0 +1,20 @@
+/**
+ * Whether an agent may be used, and whether to open the blocked-agent window beside the block
+ * (docs/agent-exception-requests/DESIGN.md). Pure: it reads only what it is given, so the prompt
+ * gate and the tests can call it alike.
+ *
+ * An agent the organization has not approved (Unapproved, or Shadow: never reviewed) is blocked, and
+ * the window opens beside every such block.
+ */
+/** The id an agent is approved under: Claude Desktop's Code tab runs Claude Code. */
+const APPROVAL_ID = { claude_desktop: 'claude' };
+export function approvalId(agent) {
+    return APPROVAL_ID[agent] ?? agent;
+}
+export function agentAccessDecision(agent, approvedAgents) {
+    // Before the first sync nothing is enforced, as for the other approval lists.
+    if (!Array.isArray(approvedAgents))
+        return { allowed: true, window: false };
+    const allowed = approvedAgents.includes(approvalId(agent));
+    return { allowed, window: !allowed };
+}

package/dist/agent_access/window_runner.js

@@ -0,0 +1,129 @@
+/**
+ * Shows the blocked-agent window (docs/agent-exception-requests/DESIGN.md).
+ *
+ * Started detached by the prompt gate (`launchAgentAccessWindow`), so the hook returns its block at
+ * once. Run as `node window_runner.js <agent> [<words.json>]`: an agent's own block reads the window's
+ * words from the synced approvals; a tenant or email-domain block passes them, built by the gate, in
+ * a file of its own temporary folder. It draws the window with `osascript` (macOS only),
+ * then acts on what the user chose: Open launches the approved app, Cancel only closes it. The prompt
+ * was already blocked. Nothing here talks to the network; a failure is logged and never thrown.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { hookRunLog } from '../log_config_files/runtime/hook_logger.js';
+import { readRemediationInstructionsFile } from '../log_config_files/runtime/management_storage.js';
+import { approvalId } from './decision.js';
+const HERE = dirname(fileURLToPath(import.meta.url));
+const WINDOW_SCRIPT = join(HERE, '..', 'agent_block_window', 'agent_block_window.jxa');
+/** The agents the gate checks, by approval id: nothing else is ever passed to a process. */
+const AGENTS = ['claude', 'cursor', 'codex', 'copilot', 'opencode'];
+/** A macOS bundle identifier, and nothing that could be read as an option or a path. */
+const BUNDLE_ID = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+/** Where the gate leaves a login block's words for the runner: a folder of its own under tmpdir. */
+const WORDS_PREFIX = 'optimus-window-words-';
+/** Write a login block's words where only the runner reads them; returns the file's path. */
+function writeWords(words) {
+    const dir = mkdtempSync(join(tmpdir(), WORDS_PREFIX));
+    const path = join(dir, 'words.json');
+    writeFileSync(path, JSON.stringify(words), { mode: 0o600 });
+    return path;
+}
+/**
+ * The words in a file the gate wrote with `writeWords`, and nothing else: the path must be a
+ * `words.json` directly inside one of its folders under tmpdir. The folder is removed once read.
+ */
+export function readWords(path) {
+    try {
+        const real = realpathSync(path);
+        const folder = dirname(real);
+        if (basename(real) !== 'words.json' || dirname(folder) !== realpathSync(tmpdir()))
+            return null;
+        if (!basename(folder).startsWith(WORDS_PREFIX))
+            return null;
+        const words = JSON.parse(readFileSync(real, 'utf8'));
+        rmSync(folder, { recursive: true, force: true });
+        return words && typeof words === 'object' ? words : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The agent's own block window, as remediation sync stored it; undefined when none was synced. */
+function syncedWindow(agent) {
+    return readRemediationInstructionsFile().agent_access_windows?.[approvalId(agent)];
+}
+/**
+ * Start the runner in the background, detached from the hook, on macOS only; true when it started.
+ * `words` are a tenant or email-domain block's, built by the gate; without them the runner reads the
+ * agent's own block window from the synced approvals. False when there is nothing to show (an
+ * approvals file synced before the window existed), so Cursor's hook keeps its own alert.
+ */
+export function launchAgentAccessWindow(agent, words) {
+    if (process.platform !== 'darwin' || !AGENTS.includes(agent))
+        return false;
+    if (!words && !syncedWindow(agent))
+        return false;
+    try {
+        const args = [fileURLToPath(import.meta.url), agent, ...(words ? [writeWords(words)] : [])];
+        const options = { detached: true, stdio: 'ignore' };
+        // An argument list, no shell: an agent from the fixed list above, and the path of a file it wrote.
+        const child = spawn(process.execPath, args, options); // nosafe: SAFE801
+        child.unref();
+        return true;
+    }
+    catch (err) {
+        hookRunLog(`agent_access_window: could not start: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+/** Draw the window and return what the user did; null when it could not open. */
+export function showWindow(words) {
+    if (!words)
+        return null;
+    const dir = mkdtempSync(join(tmpdir(), 'optimus-window-'));
+    const payloadPath = join(dir, 'payload.json');
+    try {
+        writeFileSync(payloadPath, JSON.stringify({ words }));
+        const out = spawnSync('osascript', ['-l', 'JavaScript', WINDOW_SCRIPT, payloadPath], { encoding: 'utf8' });
+        if (out.status !== 0) {
+            hookRunLog(`agent_access_window: osascript failed: ${(out.stderr || '').trim()}`);
+            return null;
+        }
+        return JSON.parse(out.stdout.trim());
+    }
+    catch (err) {
+        hookRunLog(`agent_access_window: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Open an app by bundle identifier; anything else is refused. */
+export function openApp(bundleId) {
+    if (!BUNDLE_ID.test(bundleId))
+        return false;
+    // `open -b` with a checked bundle identifier as its only argument, no shell.
+    spawnSync('open', ['-b', bundleId]); // nosafe: SAFE801
+    return true;
+}
+/** Act on what the user chose in the window. */
+export function actOn(result) {
+    if (result.action === 'open')
+        openApp(result.bundle_id ?? '');
+}
+export function runAgentAccessWindow(agent, wordsPath = '') {
+    const words = wordsPath ? readWords(wordsPath) : syncedWindow(agent);
+    const result = showWindow(words ?? undefined);
+    if (result)
+        actOn(result);
+}
+const isEntryPoint = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
+if (isEntryPoint) {
+    const [agent, wordsPath] = process.argv.slice(2);
+    if (agent && AGENTS.includes(agent))
+        runAgentAccessWindow(agent, wordsPath);
+}

package/dist/agent_block_window/agent_block_window.jxa

@@ -0,0 +1,223 @@
+/**
+ * The blocked-agent window (docs/agent-exception-requests/DESIGN.md), run as
+ * `osascript -l JavaScript agent_block_window.jxa <payload.json> [--self-test]`.
+ * Kept as `.jxa` so TypeScript leaves it alone; the build copies it into dist.
+ *
+ * A native macOS window with a web view. Its words come from the backend (`payload.words`); this
+ * script only draws them and prints what the user did as one JSON line:
+ *   {"action": "open", "agent", "bundle_id"} or {"action": "cancel"}
+ * Closing the window, or Escape, is "cancel". Nothing here talks to the network.
+ * `--self-test` makes the page press Cancel by itself once loaded, to check the page-to-script path
+ * without a person.
+ */
+ObjC.import('Cocoa');
+ObjC.import('WebKit');
+
+const WIDTH = 540;
+
+function readPayload(path) {
+  const text = $.NSString.stringWithContentsOfFileEncodingError(path, $.NSUTF8StringEncoding, null);
+  if (text.isNil()) throw new Error(`Cannot read ${path}`);
+  return JSON.parse(text.js);
+}
+
+/** Every payload string goes through this before it reaches the page. */
+function esc(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+const STYLE = `
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; background: transparent; }
+  body { font: 14px/1.45 -apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif; color: #e8e8ea;
+         -webkit-user-select: none; cursor: default; }
+  .card { background: #2b2d31; }
+  header { display: flex; align-items: center; justify-content: space-between; padding: 16px 20px;
+           border-bottom: 1px solid #3a3c41; }
+  .brand { display: flex; align-items: center; gap: 10px; font-weight: 600; font-size: 15px; color: #cfd0d3; }
+  .logo { flex: none; width: 24px; height: 24px; border-radius: 50%; background: #c9f2cf; color: #15361c;
+          display: grid; place-items: center; font: 700 12px/1 ui-rounded, -apple-system, sans-serif; }
+  .logo.big { width: 44px; height: 44px; font-size: 18px; }
+  .scope { font-size: 13px; color: #b7b8bc; }
+  main { padding: 22px 20px 18px; }
+  h1 { font-size: 22px; line-height: 1.25; font-weight: 700; margin: 0 0 16px; color: #fff; }
+  .box { border-radius: 10px; padding: 14px 16px; margin-bottom: 14px; }
+  .reason { background: #3a2224; border: 1px solid #7a3d3d; display: flex; gap: 12px; }
+  .reason .icon { flex: none; width: 18px; height: 18px; margin-top: 2px; border: 1.6px solid #f0a8a8;
+                  border-radius: 50%; color: #f0a8a8; display: grid; place-items: center; font: 700 11px/1 sans-serif; }
+  .reason strong { display: block; color: #fff; font-size: 15px; margin-bottom: 4px; }
+  .reason p { margin: 0; color: #dedee0; }
+  .reason hr { border: 0; border-top: 1px solid #7a3d3d; margin: 12px 0 10px; }
+  .findings { display: grid; grid-template-columns: max-content 1fr; gap: 6px 16px; margin: 0; }
+  .findings dt { font-size: 12px; font-weight: 700; letter-spacing: .06em; color: #f0d58a; padding-top: 1px; }
+  .findings dt.critical, .findings dt.high { color: #f0a8a8; }
+  .findings dt.low, .findings dt.unknown { color: #b7b8bc; }
+  .findings dd { margin: 0; color: #dedee0; }
+  .path { background: #2c382f; border: 1px solid #3f6a47; }
+  .row { display: flex; align-items: center; gap: 16px; }
+  .grow { flex: 1; }
+  .label { font-size: 11.5px; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; color: #8fd39a; }
+  .path h2 { margin: 4px 0 2px; font-size: 16px; color: #fff; }
+  .path p { margin: 0; color: #b9bdb9; font-size: 13px; }
+  .path p.sub { color: #d4e7d7; font-size: 13.5px; margin-bottom: 4px; }
+  .path hr { border: 0; border-top: 1px solid #44574a; margin: 14px 0 12px; }
+  .also { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; color: #b9bdb9; font-size: 13px; }
+  .chip { background: #2f3134; border: 1px solid #4b4d52; border-radius: 7px; padding: 5px 12px; color: #e8e8ea; font-size: 13px; }
+  button { font: inherit; cursor: pointer; border-radius: 8px; }
+  .primary { background: #2f6fdb; color: #fff; border: 0; padding: 10px 22px; font-weight: 600; font-size: 14px; white-space: nowrap; }
+  .primary:hover { background: #3a7bea; }
+  .secondary { background: #3a3c41; color: #e8e8ea; border: 1px solid #4b4d52; padding: 8px 20px; font-size: 14px; }
+  .secondary:hover { background: #44464b; }
+  .link { background: none; border: 0; padding: 0; color: #7fb0ff; text-decoration: underline; font-size: 14px; }
+  footer { display: flex; align-items: center; justify-content: space-between; padding: 14px 20px;
+           border-top: 1px solid #3a3c41; gap: 12px; }
+`;
+
+function header(w, withScope) {
+  return `<header><div class="brand"><span class="logo">o/</span>${esc(w.brand)}</div>${
+    withScope ? `<div class="scope">${esc(w.scope)}</div>` : ''
+  }</header>`;
+}
+
+function openButton(app) {
+  return app ? `<button class="primary" data-open="${esc(app.agent)}" data-bundle="${esc(app.bundle_id)}">${esc(app.open)}</button>` : '';
+}
+
+/** The other approved agents, as chips under their label; '' when there are none. */
+function alsoApproved(w) {
+  const chips = (w.also_approved?.agents ?? []).map((a) => `<span class="chip">${esc(a.name)}</span>`).join('');
+  return chips ? `<div class="also">${esc(w.also_approved.label)} ${chips}</div>` : '';
+}
+
+function pathCard(w) {
+  const best = w.best_match;
+  // With nothing in the blocked agent's category to open, the other approved agents still show.
+  if (!best) {
+    const others = alsoApproved(w);
+    return others ? `<section class="box path">${others}</section>` : '';
+  }
+  const others = alsoApproved(w);
+  const also = others ? `<hr>${others}` : '';
+  // A login block names the account to use but has nothing to open, so no button.
+  const button = best.bundle_id ? openButton(best) : '';
+  const subtitle = best.subtitle ? `<p class="sub">${esc(best.subtitle)}</p>` : '';
+  return `<section class="box path"><div class="row"><div class="grow">
+      <div class="label">${esc(best.label)}</div><h2>${esc(best.title)}</h2>${subtitle}<p>${esc(best.body)}</p>
+    </div>${button}</div>${also}</section>`;
+}
+
+/** A skill's scan findings under the reason, by severity ({severity, label, text}); '' when none. */
+function findings(reason) {
+  const rows = (reason?.findings ?? [])
+    .map((f) => {
+      const level = ['critical', 'high', 'medium', 'low'].includes(f.severity) ? f.severity : 'unknown';
+      return `<dt class="${level}">${esc(f.label)}</dt><dd>${esc(f.text)}</dd>`;
+    })
+    .join('');
+  return rows ? `<hr><dl class="findings">${rows}</dl>` : '';
+}
+
+function formView(w) {
+  const body = w.reason?.body ? `<p>${esc(w.reason.body)}</p>` : '';
+  return `${header(w, true)}<main>
+      <h1>${esc(w.title)}</h1>
+      <section class="box reason"><span class="icon">!</span>
+        <div class="grow"><strong>${esc(w.reason?.title)}</strong>${body}${findings(w.reason)}</div></section>
+      ${pathCard(w)}
+    </main>
+    <footer><span></span><button class="secondary" data-close="cancel">${esc(w.cancel)}</button></footer>`;
+}
+
+function pageHtml(p, selfTest) {
+  return `<!doctype html><html><head><meta charset="utf-8"><style>${STYLE}</style></head><body>
+  <div class="card" id="card">${formView(p.words)}</div>
+  <script>
+    const post = (m) => window.webkit.messageHandlers.optimus.postMessage(JSON.stringify(m));
+    const size = () => window.webkit.messageHandlers.optimus.postMessage(JSON.stringify({ type: 'size', height: document.getElementById('card').offsetHeight }));
+    document.querySelectorAll('[data-close]').forEach((b) => b.onclick = () => post({ action: b.dataset.close }));
+    document.querySelectorAll('[data-open]').forEach((b) => b.onclick = () => post({ action: 'open', agent: b.dataset.open, bundle_id: b.dataset.bundle }));
+    document.addEventListener('keydown', (e) => { if (e.key === 'Escape') post({ action: 'cancel' }); });
+    window.addEventListener('load', size);
+    ${selfTest ? "window.addEventListener('load', () => setTimeout(() => post({ action: 'cancel' }), 300));" : ''}
+  </script></body></html>`;
+}
+
+function place(win, height) {
+  win.setContentSize($.NSMakeSize(WIDTH, Math.min(Math.max(height, 120), 900)));
+  win.center;
+}
+
+function run(argv) {
+  const payload = readPayload(argv[0]);
+  const app = $.NSApplication.sharedApplication;
+  app.setActivationPolicy($.NSApplicationActivationPolicyAccessory);
+  app.finishLaunching;
+
+  let result = null;
+  let win = null;
+  ObjC.registerSubclass({
+    name: 'OptimusBlockWindowHandler',
+    superclass: 'NSObject',
+    // Not declared as conforming to WKScriptMessageHandler: osascript cannot see that protocol, and
+    // WebKit only needs the method below.
+    methods: {
+      'userContentController:didReceiveScriptMessage:': {
+        types: ['void', ['id', 'id']],
+        implementation: function (_controller, message) {
+          const m = JSON.parse(ObjC.unwrap(message.body));
+          if (m.type === 'size') {
+            place(win, m.height);
+            return;
+          }
+          result = m;
+        },
+      },
+    },
+  });
+
+  const config = $.WKWebViewConfiguration.alloc.init;
+  config.userContentController.addScriptMessageHandlerName($.OptimusBlockWindowHandler.alloc.init, 'optimus');
+
+  const width = WIDTH;
+  const style = $.NSWindowStyleMaskTitled | $.NSWindowStyleMaskClosable | $.NSWindowStyleMaskFullSizeContentView;
+  win = $.NSWindow.alloc.initWithContentRectStyleMaskBackingDefer($.NSMakeRect(0, 0, width, 480), style, $.NSBackingStoreBuffered, false);
+  win.titlebarAppearsTransparent = true;
+  win.titleVisibility = $.NSWindowTitleHidden;
+  win.movableByWindowBackground = true;
+  win.appearance = $.NSAppearance.appearanceNamed($.NSAppearanceNameDarkAqua);
+  win.backgroundColor = $.NSColor.colorWithSRGBRedGreenBlueAlpha(43 / 255, 45 / 255, 49 / 255, 1);
+  win.level = $.NSFloatingWindowLevel;
+  for (const button of [$.NSWindowMiniaturizeButton, $.NSWindowZoomButton]) {
+    win.standardWindowButton(button).hidden = true;
+  }
+
+  const web = $.WKWebView.alloc.initWithFrameConfiguration($.NSMakeRect(0, 0, width, 480), config);
+  web.setValueForKey($.NSNumber.numberWithBool(false), 'drawsBackground');
+  web.loadHTMLStringBaseURL($(pageHtml(payload, argv[1] === '--self-test')), $.NSURL.URLWithString('about:blank'));
+  win.contentView = web;
+  win.center;
+  win.makeKeyAndOrderFront(null);
+  app.activateIgnoringOtherApps(true);
+
+  // Pump events ourselves: osascript has no running NSApplication loop to hand them to the window.
+  // NSAnyEventMask, not NSEventMaskAny: the newer constant is all 64 bits, which a JavaScript number
+  // rounds to a mask matching no event at all; the old one arrives as -1, every bit set.
+  while (result === null) {
+    const event = app.nextEventMatchingMaskUntilDateInModeDequeue(
+      $.NSAnyEventMask,
+      $.NSDate.dateWithTimeIntervalSinceNow(0.1),
+      $.NSDefaultRunLoopMode,
+      true,
+    );
+    if (!event.isNil()) app.sendEvent(event);
+    if (!win.isVisible) result = { action: 'cancel' };
+  }
+  win.orderOut(null);
+  return JSON.stringify(result);
+}