@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/dist/src/harness-probe.js

@@ -0,0 +1,111 @@
+import { realpathSync, readFileSync, lstatSync, mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, isAbsolute } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { HarnessRpc } from './harness-rpc.js';
+import { digest, ServiceError } from './protocol.js';
+import { VERSION } from './config.js';
+export const HARNESS_TARGETS = {
+    'gemini-acp': { dialect: 'acp', args: ['--acp'], version: '0.64.0' },
+    'claude-acp': { dialect: 'acp', args: [], version: '0.23.1' },
+    'codex-app-server': { dialect: 'codex', args: ['app-server'], version: '0.163.0' },
+};
+/** Operator-only negotiation. No repository, credential, task or model request is admitted. */
+export async function probeHarness(pin) {
+    if (!Object.hasOwn(HARNESS_TARGETS, pin.target) || !isAbsolute(pin.executable))
+        throw new ServiceError('invalid_harness', 'Select a pinned supported absolute executable');
+    const target = HARNESS_TARGETS[pin.target], executable = realpathSync(pin.executable), stat = lstatSync(executable);
+    if (!stat.isFile() ||
+        stat.size > 512 * 1024 * 1024 ||
+        createHash('sha256').update(readFileSync(executable)).digest('hex') !== pin.executable_digest ||
+        pin.version !== target.version)
+        throw new ServiceError('harness_pin_changed', 'Harness executable digest or admitted version changed');
+    const dir = mkdtempSync(join(tmpdir(), 'sal-harness-probe-')), home = join(dir, 'home');
+    mkdirSync(home, { mode: 0o700 });
+    for (const name of ['.codex', '.config', '.cache'])
+        mkdirSync(join(home, name), { mode: 0o700 });
+    const env = {
+        HOME: home,
+        CODEX_HOME: join(home, '.codex'),
+        XDG_CONFIG_HOME: join(home, '.config'),
+        XDG_CACHE_HOME: join(home, '.cache'),
+        TMPDIR: dir,
+        PATH: [dirname(process.execPath), dirname(executable), '/usr/bin', '/bin'].join(':'),
+        LANG: 'en_US.UTF-8',
+        NO_COLOR: '1',
+        GEMINI_CLI_NO_RELAUNCH: 'true',
+    };
+    let rpc;
+    try {
+        const version = pin.target === 'claude-acp'
+            ? {
+                stdout: (() => {
+                    const metadata = JSON.parse(readFileSync(join(dirname(executable), '../package.json'), 'utf8'));
+                    if (metadata.name !== '@zed-industries/claude-agent-acp')
+                        throw new Error('Unexpected Claude ACP package');
+                    return metadata.version;
+                })(),
+            }
+            : await promisify(execFile)(executable, ['--version'], {
+                cwd: dir,
+                env,
+                timeout: 10000,
+                maxBuffer: 16384,
+            });
+        if (!new RegExp('(^|[^0-9.])' + pin.version.replaceAll('.', '\\.') + '([^0-9.]|$)').test(version.stdout.trim()))
+            throw new ServiceError('harness_version_changed', 'Harness reported a different version');
+        const launch = {
+            executable,
+            args: [...target.args],
+            cwd: dir,
+            env,
+            dialect: target.dialect,
+        };
+        rpc = new HarnessRpc(launch);
+        const advertised = target.dialect === 'acp'
+            ? await rpc.request('initialize', {
+                protocolVersion: 1,
+                clientInfo: { name: 'salaam', version: VERSION },
+                clientCapabilities: {
+                    fs: { readTextFile: false, writeTextFile: false },
+                    terminal: false,
+                },
+            })
+            : await rpc.request('initialize', {
+                clientInfo: { name: 'salaam', version: VERSION },
+                capabilities: { experimentalApi: false, requestAttestation: false },
+            });
+        if (target.dialect === 'acp' && advertised.protocolVersion !== 1)
+            throw new ServiceError('harness_protocol_changed', 'Harness did not negotiate ACP protocol version 1');
+        if (target.dialect === 'codex')
+            rpc.notify('initialized', {});
+        const enforced = {
+            files: false,
+            commands: false,
+            model_requests: false,
+            output_cap: false,
+            resume_dispatch: false,
+            isolation: 'unproven',
+            retention: 'unknown',
+        };
+        const admittedPin = { ...pin, executable };
+        return {
+            schema_version: 1,
+            pin: admittedPin,
+            launch_digest: digest({
+                pin: admittedPin,
+                args: target.args,
+                environment: 'empty-home-no-credentials-v1',
+            }),
+            capability_digest: digest({ advertised, enforced }),
+            advertised,
+            enforced,
+        };
+    }
+    finally {
+        await rpc?.close();
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/src/harness-protocol.js

@@ -0,0 +1,325 @@
+import { HarnessRpc } from './harness-rpc.js';
+import { digest, ServiceError } from './protocol.js';
+const identity = (v) => {
+    if (typeof v !== 'string' || !v.length || v.length > 256)
+        throw new ServiceError('harness_identity', 'Missing or invalid upstream identity');
+    return v;
+};
+/** One owned invocation per adapter. Resume inspects the existing identity; it never resubmits a prompt. */
+export class HarnessProtocol {
+    hooks;
+    rpc;
+    checkpoint;
+    pendingTurns = [];
+    terminal;
+    closing = false;
+    failed = false;
+    constructor(launch, checkpoint, hooks) {
+        this.hooks = hooks;
+        if (checkpoint.schema_version !== 1 ||
+            checkpoint.dialect !== launch.dialect ||
+            !checkpoint.worker_id ||
+            !checkpoint.attempt_id)
+            throw new Error('Harness checkpoint ownership mismatch');
+        this.checkpoint = structuredClone(checkpoint);
+        if (['creating', 'dispatching', 'running'].includes(this.checkpoint.state)) {
+            const recovered = { ...this.checkpoint, state: 'unknown' };
+            const saved = this.hooks.save(structuredClone(recovered));
+            if (saved !== undefined)
+                throw new Error('Harness recovery must commit synchronously');
+            this.checkpoint = recovered;
+        }
+        this.rpc = new HarnessRpc(launch, {
+            request: (method, params) => this.permission(method, params),
+            notification: (method, params) => this.notification(method, params),
+            failed: (error) => {
+                if (!this.closing) {
+                    try {
+                        this.unknown();
+                    }
+                    finally {
+                        this.failed = true;
+                        this.terminal?.reject(error);
+                        this.hooks.failed?.(error);
+                    }
+                }
+            },
+        });
+    }
+    view() {
+        return structuredClone(this.checkpoint);
+    }
+    save(update) {
+        this.assertUsable();
+        const next = { ...this.checkpoint, ...update };
+        try {
+            const result = this.hooks.save(structuredClone(next));
+            if (result !== undefined)
+                throw new Error('Harness checkpoint save must commit synchronously');
+        }
+        catch (error) {
+            this.failed = true;
+            void this.rpc.close();
+            try {
+                this.hooks.failed?.(error);
+            }
+            catch { }
+            throw error;
+        }
+        this.checkpoint = next;
+    }
+    assertUsable() {
+        if (this.failed)
+            throw new ServiceError('harness_control_failed', 'Harness control is no longer usable');
+    }
+    unknown() {
+        if (this.failed)
+            return;
+        if (!['terminal', 'prepared', 'idle'].includes(this.checkpoint.state))
+            this.save({ state: 'unknown' });
+    }
+    async initialize(gatewayAuth = false) {
+        this.assertUsable();
+        const result = await this.rpc.request('initialize', this.checkpoint.dialect === 'acp'
+            ? {
+                protocolVersion: 1,
+                clientCapabilities: {
+                    fs: { readTextFile: false, writeTextFile: false },
+                    terminal: false,
+                    ...(gatewayAuth ? { auth: { _meta: { gateway: true } } } : {}),
+                },
+                clientInfo: { name: 'salaam', version: '0.0.1' },
+            }
+            : {
+                clientInfo: { name: 'salaam', version: '0.0.1' },
+                capabilities: { experimentalApi: false },
+            });
+        if (this.checkpoint.dialect === 'acp') {
+            if (result.protocolVersion !== 1)
+                throw new ServiceError('harness_protocol_changed', 'ACP v1 negotiation required');
+            const caps = result.agentCapabilities;
+            this.save({ load_session: caps?.loadSession === true });
+        }
+        else
+            this.rpc.notify('initialized', {});
+        return result;
+    }
+    async create(params) {
+        this.assertUsable();
+        if (this.checkpoint.state !== 'prepared' || this.checkpoint.session_id)
+            throw new ServiceError('harness_replay', 'An owned session intent cannot be recreated');
+        this.save({ state: 'creating' });
+        try {
+            const result = await this.rpc.request(this.checkpoint.dialect === 'acp' ? 'session/new' : 'thread/start', params, 30000);
+            const id = this.checkpoint.dialect === 'acp'
+                ? identity(result.sessionId)
+                : identity(result.thread?.id);
+            this.save({ session_id: id, state: 'idle' });
+            return this.view();
+        }
+        catch (error) {
+            this.unknown();
+            throw error;
+        }
+    }
+    async prompt(text) {
+        this.assertUsable();
+        if (this.checkpoint.state !== 'idle' ||
+            !this.checkpoint.session_id ||
+            this.checkpoint.prompt_digest)
+            throw new ServiceError('harness_replay', 'This invocation already owns a prompt or uncertain work');
+        if (!text.trim() || Buffer.byteLength(text) > 65536 || text.trimStart().startsWith('/'))
+            throw new Error('Invalid external instruction');
+        this.save({ state: 'dispatching', prompt_digest: digest(text) });
+        try {
+            if (this.checkpoint.dialect === 'acp') {
+                const result = await this.rpc.request('session/prompt', { sessionId: this.checkpoint.session_id, prompt: [{ type: 'text', text }] }, 180000);
+                if (!['end_turn', 'max_tokens', 'max_turn_requests', 'refusal', 'cancelled'].includes(String(result.stopReason)))
+                    throw new Error('Unknown ACP terminal stop reason');
+                this.save({ state: 'terminal', result });
+                return result;
+            }
+            const done = new Promise((resolve, reject) => {
+                this.terminal = { resolve, reject };
+            });
+            // Avoid an unhandled rejection if transport failure happens before turn/start returns.
+            void done.catch(() => { });
+            const result = await this.rpc.request('turn/start', { threadId: this.checkpoint.session_id, input: [{ type: 'text', text }] }, 30000);
+            const turn = identity(result.turn?.id);
+            this.save({ state: 'running', turn_id: turn });
+            for (const notification of this.pendingTurns.splice(0))
+                this.codexTerminal(notification);
+            if (this.checkpoint.cancel_requested &&
+                this.checkpoint.cancel_state === 'intent' &&
+                this.view().state !== 'terminal')
+                await this.forwardCancel();
+            const timer = setTimeout(() => {
+                try {
+                    this.unknown();
+                }
+                catch (error) {
+                    this.terminal?.reject(error);
+                    return;
+                }
+                this.terminal?.reject(new ServiceError('harness_outcome_unknown', 'No owned terminal turn receipt'));
+            }, 180000);
+            try {
+                return await done;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        catch (error) {
+            this.unknown();
+            throw error;
+        }
+    }
+    async cancel() {
+        this.assertUsable();
+        if (!['dispatching', 'running'].includes(this.checkpoint.state) || !this.checkpoint.session_id)
+            throw new ServiceError('harness_not_running', 'No running owned prompt');
+        if (this.checkpoint.cancel_requested)
+            return this.view();
+        this.save({ cancel_requested: true, cancel_state: 'intent' });
+        if (this.checkpoint.dialect === 'codex' && !this.checkpoint.turn_id)
+            return this.view();
+        await this.forwardCancel();
+        return this.view();
+    }
+    async forwardCancel() {
+        this.save({ cancel_state: 'dispatching' });
+        if (this.checkpoint.dialect === 'acp')
+            this.rpc.notify('session/cancel', { sessionId: this.checkpoint.session_id });
+        else {
+            if (!this.checkpoint.turn_id)
+                throw new ServiceError('harness_outcome_unknown', 'Turn acceptance is not yet known');
+            await this.rpc.request('turn/interrupt', {
+                threadId: this.checkpoint.session_id,
+                turnId: this.checkpoint.turn_id,
+            });
+            this.save({ cancel_state: 'acknowledged' });
+        }
+        // Acknowledgement is not proof of a terminal turn or stopped tools.
+    }
+    async inspect(params = {}) {
+        this.assertUsable();
+        if (!this.checkpoint.session_id)
+            throw new ServiceError('harness_outcome_unknown', 'No accepted upstream session identity');
+        if (this.checkpoint.dialect === 'acp') {
+            if (this.checkpoint.state === 'unknown')
+                throw new ServiceError('harness_outcome_unknown', 'ACP cannot safely reconcile an uncertain prompt; inspect retained artifacts and resolve explicitly');
+            if (!this.checkpoint.load_session)
+                throw new ServiceError('harness_resume_unsupported', 'Peer did not admit session loading');
+            const result = await this.rpc.request('session/load', {
+                ...params,
+                sessionId: this.checkpoint.session_id,
+            });
+            // ACP history loading cannot prove which uncertain prompt completed.
+            return result;
+        }
+        const result = await this.rpc.request('thread/read', {
+            threadId: this.checkpoint.session_id,
+            includeTurns: true,
+        });
+        const thread = result.thread;
+        if (identity(thread?.id) !== this.checkpoint.session_id)
+            throw new ServiceError('harness_identity', 'Returned thread belongs to another worker');
+        if (this.checkpoint.turn_id && Array.isArray(thread.turns)) {
+            const turn = thread.turns.find((t) => t.id === this.checkpoint.turn_id);
+            if (turn && ['completed', 'failed', 'interrupted'].includes(String(turn.status)))
+                this.save({ state: 'terminal', result: { turn } });
+        }
+        return result;
+    }
+    async permission(method, params) {
+        this.assertUsable();
+        const state = this.checkpoint;
+        if (!state.session_id ||
+            state.cancel_requested ||
+            !['dispatching', 'running'].includes(state.state))
+            throw new ServiceError('harness_permission_denied', 'No active owned invocation');
+        if (state.dialect === 'acp') {
+            if (method !== 'session/request_permission' || params.sessionId !== state.session_id)
+                throw new ServiceError('harness_permission_denied', 'Client method or session is unowned');
+            identity(params.toolCall?.toolCallId);
+        }
+        else {
+            if (!['item/commandExecution/requestApproval', 'item/fileChange/requestApproval'].includes(method) ||
+                params.threadId !== state.session_id ||
+                !state.turn_id ||
+                params.turnId !== state.turn_id)
+                throw new ServiceError('harness_permission_denied', 'Approval thread or turn is unowned');
+            identity(params.itemId);
+        }
+        const decision = await this.hooks.permission({
+            worker_id: state.worker_id,
+            attempt_id: state.attempt_id,
+            session_id: state.session_id,
+            turn_id: state.turn_id,
+            method,
+            params,
+        });
+        this.assertUsable();
+        if (this.checkpoint.cancel_requested ||
+            !['dispatching', 'running'].includes(this.checkpoint.state))
+            throw new ServiceError('harness_permission_denied', 'Owned invocation stopped before the decision');
+        if (decision !== 'approve' && decision !== 'deny')
+            throw new ServiceError('harness_permission_denied', 'Invalid local permission decision');
+        if (state.dialect === 'acp') {
+            const options = Array.isArray(params.options) ? params.options : [];
+            const option = options.find((o) => o.kind === (decision === 'approve' ? 'allow_once' : 'reject_once'));
+            if (!option || typeof option.optionId !== 'string')
+                throw new ServiceError('harness_permission_denied', 'Peer lacks a once-only permission choice');
+            return { outcome: { outcome: 'selected', optionId: option.optionId } };
+        }
+        return { decision: decision === 'approve' ? 'accept' : 'decline' };
+    }
+    notification(method, params) {
+        const state = this.checkpoint;
+        if (state.dialect === 'acp' && method === 'session/update') {
+            if (params.sessionId !== state.session_id) {
+                if (state.state === 'creating')
+                    return;
+                throw new ServiceError('harness_identity', 'Unowned ACP update');
+            }
+            if (state.state === 'dispatching')
+                this.save({ state: 'running' });
+        }
+        else if (state.dialect === 'codex' && method.startsWith('turn/')) {
+            if (params.threadId !== state.session_id)
+                throw new ServiceError('harness_identity', 'Unowned Codex thread notification');
+            if (method === 'turn/completed') {
+                if (!state.turn_id && state.state === 'dispatching') {
+                    if (this.pendingTurns.length >= 16)
+                        throw Error('Unaccepted turn event bound');
+                    this.pendingTurns.push(params);
+                }
+                else
+                    this.codexTerminal(params);
+            }
+        }
+        this.hooks.event?.(method, params);
+    }
+    codexTerminal(params) {
+        const turn = params.turn;
+        if (params.threadId !== this.checkpoint.session_id ||
+            identity(turn?.id) !== this.checkpoint.turn_id)
+            throw new ServiceError('harness_identity', 'Terminal receipt belongs to another turn');
+        if (!['completed', 'failed', 'interrupted'].includes(String(turn.status)))
+            throw new Error('Nonterminal Codex completion');
+        const result = { turn };
+        if (this.checkpoint.state === 'terminal') {
+            if (digest(this.checkpoint.result) !== digest(result))
+                throw new Error('Conflicting terminal receipt');
+            return;
+        }
+        this.save({ state: 'terminal', result });
+        this.terminal?.resolve(result);
+    }
+    async close() {
+        this.closing = true;
+        this.unknown();
+        await this.rpc.close();
+    }
+}

package/dist/src/harness-readiness.js

@@ -0,0 +1,50 @@
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, realpathSync, rmSync, } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { HarnessRpc } from './harness-rpc.js';
+/** Real readiness, not an advertised upstream capability. Runs without credentials or model traffic. */
+export async function proveHarnessReadiness(boundary, root) {
+    const dir = mkdtempSync(join(realpathSync(root), 'harness-proof-'));
+    for (const p of ['work', 'home', 'runtime'])
+        mkdirSync(join(dir, p), { mode: 0o700 });
+    writeFileSync(join(dir, 'host-secret'), 'not-mounted');
+    writeFileSync(join(dir, 'runtime/readonly'), 'fixed');
+    const run = randomUUID();
+    let rpc;
+    try {
+        const script = `(async()=>{const fs=require('node:fs'),net=require('node:net'),cp=require('node:child_process'),rl=require('node:readline');for await(const line of rl.createInterface({input:process.stdin})){const m=JSON.parse(line);const denied=p=>{try{fs.readFileSync(p);return false}catch{return true}};const writeDenied=p=>{try{fs.writeFileSync(p,'bad');return false}catch{return true}};const connect=(host,port)=>new Promise(r=>{const s=net.connect({host,port});s.on('connect',()=>{s.destroy();r(true)});s.on('error',()=>r(false));s.setTimeout(500,()=>{s.destroy();r(false)})});fs.writeFileSync('/workspace/owned','ok');const bash=cp.execFileSync('/bin/bash',['-c','printf bash-ok'],{encoding:'utf8'});const response=await fetch('http://127.0.0.1:47123/proof',{method:'POST',body:'proof'});const result={host:denied(${JSON.stringify(join(dir, 'host-secret'))}),socket:denied('/var/run/docker.sock'),runtime:writeDenied('/runtime/readonly'),root:writeDenied('/escape'),bash,interfaces:fs.readdirSync('/sys/class/net'),external:await connect('1.1.1.1',53),metadata:await connect('169.254.169.254',80),other_port:await connect('127.0.0.1',47124),gateway:await response.text(),status:fs.readFileSync('/proc/self/status','utf8')};cp.spawn('/usr/local/bin/node',['-e',"setTimeout(()=>require('node:fs').writeFileSync('/workspace/late','bad'),1500)"],{detached:true,stdio:'ignore'}).unref();process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n')}})().catch(()=>process.exit(2));`;
+        const receipt = await boundary.prepare(run, join(dir, 'work'), join(dir, 'runtime'), join(dir, 'home'), ['/usr/local/bin/node', '-e', script]);
+        await boundary.gateway(receipt, async (req) => {
+            if (req.path !== '/proof' || req.body.toString() !== 'proof')
+                throw Error('Unexpected readiness traffic');
+            return { status: 200, body: Buffer.from('host-relay') };
+        });
+        rpc = new HarnessRpc(await boundary.launchHarness(receipt, 'acp'));
+        const proof = await rpc.request('proof', {}, 10000);
+        if (!proof.host ||
+            !proof.socket ||
+            !proof.runtime ||
+            !proof.root ||
+            proof.bash !== 'bash-ok' ||
+            proof.external ||
+            proof.metadata ||
+            proof.other_port ||
+            JSON.stringify(proof.interfaces) !== '["lo"]' ||
+            proof.gateway !== 'host-relay' ||
+            !/NoNewPrivs:\s+1/.test(String(proof.status)) ||
+            !/Seccomp:\s+2/.test(String(proof.status)) ||
+            !/CapEff:\s+0000000000000000/.test(String(proof.status)))
+            throw Error('Whole-harness readiness proof failed');
+        await rpc.close();
+        await boundary.cleanupRun(run);
+        await new Promise((r) => setTimeout(r, 1700));
+        if (existsSync(join(dir, 'work/late')) ||
+            readFileSync(join(dir, 'work/owned'), 'utf8') !== 'ok')
+            throw Error('Harness descendant stop proof failed');
+    }
+    finally {
+        await rpc?.close();
+        await boundary.cleanupRun(run);
+        rmSync(dir, { recursive: true, force: true });
+    }
+}