@optimuslabs/harness-map-staging 1.5.41 → 1.5.42

package/dist/agent_access/window_runner.js

@@ -30,6 +30,11 @@ const KINDS = ['agent', 'login', 'skill'];
 const BUNDLE_ID = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
 /** Where the gate leaves a login block's words for the runner: a folder of its own under tmpdir. */
 const WORDS_PREFIX = 'optimus-window-words-';
+/**
+ * How long the window may stay open. It waits for a person, so this is long; it exists so a window
+ * that never appears (osascript stuck before drawing) is stopped and reported, not left spinning.
+ */
+const WINDOW_TIME_LIMIT_MS = 5 * 60 * 1000;
 /** Write a login block's words where only the runner reads them; returns the file's path. */
 function writeWords(words) {
     const dir = mkdtempSync(join(tmpdir(), WORDS_PREFIX));
@@ -108,19 +113,39 @@ function agentVersion(agent) {
     const out = spawnSync('plutil', ['-extract', 'CFBundleShortVersionString', 'raw', plist], { encoding: 'utf8' });
     return out.status === 0 ? (out.stdout || '').trim().slice(0, 32) : '';
 }
+/**
+ * True when this process is Intel code under Rosetta on Apple Silicon (an x64 node, such as Intel
+ * Homebrew's). Its children run as Intel code too, and osascript as Intel code hangs in
+ * `ObjC.registerSubclass` before the window is drawn. False on a real Intel Mac (no such sysctl).
+ */
+export function underRosetta() {
+    const out = spawnSync('sysctl', ['-n', 'sysctl.proc_translated'], { encoding: 'utf8' });
+    return out.status === 0 && (out.stdout || '').trim() === '1';
+}
+/** The osascript command line for the window: native arm64 through `arch` when under Rosetta. */
+function osascriptCommand(args, rosetta) {
+    return rosetta ? ['/usr/bin/arch', ['-arm64', '/usr/bin/osascript', ...args]] : ['osascript', args];
+}
 /** Draw the window and return what the user did; null when it could not open. */
 export function showWindow(words) {
     return drawWindow(words).result;
 }
 /** Draw the window: what the user did, or why it could not be shown (`error`, '' when it was). */
-export function drawWindow(words) {
+export function drawWindow(words, rosetta = underRosetta()) {
     if (!words)
         return { result: null, error: 'no words to show' };
     const dir = mkdtempSync(join(tmpdir(), 'optimus-window-'));
     const payloadPath = join(dir, 'payload.json');
     try {
         writeFileSync(payloadPath, JSON.stringify({ words }));
-        const out = spawnSync('osascript', ['-l', 'JavaScript', WINDOW_SCRIPT, payloadPath], { encoding: 'utf8' });
+        const [cmd, args] = osascriptCommand(['-l', 'JavaScript', WINDOW_SCRIPT, payloadPath], rosetta);
+        // A fixed command, no shell: osascript (or arch running it) with our own script and payload.
+        const out = spawnSync(cmd, args, { encoding: 'utf8', timeout: WINDOW_TIME_LIMIT_MS }); // nosafe: SAFE801
+        if (out.error?.code === 'ETIMEDOUT') {
+            const error = `osascript stopped: still running after ${WINDOW_TIME_LIMIT_MS / 1000}s`;
+            hookRunLog(`agent_access_window: ${error}`);
+            return { result: null, error };
+        }
         if (out.status !== 0) {
             const error = `osascript failed (exit ${out.status ?? out.signal}): ${(out.stderr || out.error?.message || '').trim()}`;
             hookRunLog(`agent_access_window: ${error}`);
@@ -156,13 +181,20 @@ export function actOn(result) {
  */
 export async function runAgentAccessWindow(agent, kind, wordsPath = '') {
     const launched = process.env[JOB_LABEL_ENV] ? 'launchd' : 'spawn';
-    const metadata = { darwin: release(), kind, launched, agent_version: agentVersion(agent) };
+    const rosetta = underRosetta();
+    const metadata = {
+        darwin: release(),
+        kind,
+        launched,
+        rosetta: rosetta ? 'yes' : 'no',
+        agent_version: agentVersion(agent),
+    };
     // The server knows a fixed set of units; the window is part of the prompt gate's compliance.
     // "started" first: a window process the agent stopped never reports more, and that shows.
     const report = { unit: 'compliance', command: 'agent_access_window', metadata };
     await reportFunctionalRun({ ...report, outcome: 'started', message: `${agent}: window process started (${launched})` });
     const words = wordsPath ? readWords(wordsPath) : syncedWindow(agent);
-    const { result, error } = drawWindow(words ?? undefined);
+    const { result, error } = drawWindow(words ?? undefined, rosetta);
     if (result)
         actOn(result);
     await reportFunctionalRun({

package/dist/agent_block_window/Manrope-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2019 The Manrope Project Authors (https://github.com/sharanda/manrope)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.41",
+  "version": "1.5.42",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {