@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/src/harness-readiness.ts

@@ -0,0 +1,71 @@
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  readFileSync,
+  existsSync,
+  realpathSync,
+  rmSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { DockerHarnessBoundary } from './harness-container.js';
+import { HarnessRpc } from './harness-rpc.js';
+
+/** Real readiness, not an advertised upstream capability. Runs without credentials or model traffic. */
+export async function proveHarnessReadiness(
+  boundary: DockerHarnessBoundary,
+  root: string,
+): Promise<void> {
+  const dir = mkdtempSync(join(realpathSync(root), 'harness-proof-'));
+  for (const p of ['work', 'home', 'runtime']) mkdirSync(join(dir, p), { mode: 0o700 });
+  writeFileSync(join(dir, 'host-secret'), 'not-mounted');
+  writeFileSync(join(dir, 'runtime/readonly'), 'fixed');
+  const run = randomUUID();
+  let rpc: HarnessRpc | undefined;
+  try {
+    const script = `(async()=>{const fs=require('node:fs'),net=require('node:net'),cp=require('node:child_process'),rl=require('node:readline');for await(const line of rl.createInterface({input:process.stdin})){const m=JSON.parse(line);const denied=p=>{try{fs.readFileSync(p);return false}catch{return true}};const writeDenied=p=>{try{fs.writeFileSync(p,'bad');return false}catch{return true}};const connect=(host,port)=>new Promise(r=>{const s=net.connect({host,port});s.on('connect',()=>{s.destroy();r(true)});s.on('error',()=>r(false));s.setTimeout(500,()=>{s.destroy();r(false)})});fs.writeFileSync('/workspace/owned','ok');const bash=cp.execFileSync('/bin/bash',['-c','printf bash-ok'],{encoding:'utf8'});const response=await fetch('http://127.0.0.1:47123/proof',{method:'POST',body:'proof'});const result={host:denied(${JSON.stringify(join(dir, 'host-secret'))}),socket:denied('/var/run/docker.sock'),runtime:writeDenied('/runtime/readonly'),root:writeDenied('/escape'),bash,interfaces:fs.readdirSync('/sys/class/net'),external:await connect('1.1.1.1',53),metadata:await connect('169.254.169.254',80),other_port:await connect('127.0.0.1',47124),gateway:await response.text(),status:fs.readFileSync('/proc/self/status','utf8')};cp.spawn('/usr/local/bin/node',['-e',"setTimeout(()=>require('node:fs').writeFileSync('/workspace/late','bad'),1500)"],{detached:true,stdio:'ignore'}).unref();process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n')}})().catch(()=>process.exit(2));`;
+    const receipt = await boundary.prepare(
+      run,
+      join(dir, 'work'),
+      join(dir, 'runtime'),
+      join(dir, 'home'),
+      ['/usr/local/bin/node', '-e', script],
+    );
+    await boundary.gateway(receipt, async (req) => {
+      if (req.path !== '/proof' || req.body.toString() !== 'proof')
+        throw Error('Unexpected readiness traffic');
+      return { status: 200, body: Buffer.from('host-relay') };
+    });
+    rpc = new HarnessRpc(await boundary.launchHarness(receipt, 'acp'));
+    const proof = await rpc.request('proof', {}, 10000);
+    if (
+      !proof.host ||
+      !proof.socket ||
+      !proof.runtime ||
+      !proof.root ||
+      proof.bash !== 'bash-ok' ||
+      proof.external ||
+      proof.metadata ||
+      proof.other_port ||
+      JSON.stringify(proof.interfaces) !== '["lo"]' ||
+      proof.gateway !== 'host-relay' ||
+      !/NoNewPrivs:\s+1/.test(String(proof.status)) ||
+      !/Seccomp:\s+2/.test(String(proof.status)) ||
+      !/CapEff:\s+0000000000000000/.test(String(proof.status))
+    )
+      throw Error('Whole-harness readiness proof failed');
+    await rpc.close();
+    await boundary.cleanupRun(run);
+    await new Promise((r) => setTimeout(r, 1700));
+    if (
+      existsSync(join(dir, 'work/late')) ||
+      readFileSync(join(dir, 'work/owned'), 'utf8') !== 'ok'
+    )
+      throw Error('Harness descendant stop proof failed');
+  } finally {
+    await rpc?.close();
+    await boundary.cleanupRun(run);
+    rmSync(dir, { recursive: true, force: true });
+  }
+}

package/src/harness-rpc.ts

@@ -0,0 +1,244 @@
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { TextDecoder } from 'node:util';
+import { ServiceError } from './protocol.js';
+
+export type RpcObject = Record<string, unknown>;
+export interface HarnessLaunch {
+  executable: string;
+  args: string[];
+  cwd: string;
+  env: Record<string, string>;
+  dialect: 'acp' | 'codex';
+}
+export const HARNESS_RPC_LIMITS = {
+  frame: 1024 * 1024,
+  total: 4 * 1024 * 1024,
+  pending: 16,
+  timeout: 10000,
+} as const;
+export interface HarnessHandlers {
+  request?: (method: string, params: RpcObject) => Promise<unknown>;
+  notification?: (method: string, params: RpcObject) => void;
+  failed?: (error: Error) => void;
+}
+/** Bounded stdio framing only. A launch is not a workspace or credential sandbox. */
+export class HarnessRpc {
+  readonly process: ChildProcessWithoutNullStreams;
+  private serial = 0;
+  private received = 0;
+  private stderr = 0;
+  private buffer = '';
+  private decoder = new TextDecoder('utf-8', { fatal: true });
+  private pending = new Map<
+    number,
+    { resolve: (value: RpcObject) => void; reject: (error: Error) => void; timer: NodeJS.Timeout }
+  >();
+  private inbound = new Set<string>();
+  private failure?: Error;
+  private stopping = false;
+  readonly exited: Promise<void>;
+  constructor(
+    readonly launch: HarnessLaunch,
+    readonly handlers: HarnessHandlers = {},
+  ) {
+    this.process = spawn(launch.executable, launch.args, {
+      cwd: launch.cwd,
+      env: launch.env,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    this.exited = new Promise((resolve) =>
+      this.process.once('close', () => {
+        if (!this.stopping) this.fail(new Error('Harness exited before connection closed'));
+        resolve();
+      }),
+    );
+    this.process.on('error', (error) => this.fail(error));
+    this.process.stdin.on('error', (error) => this.fail(error));
+    this.process.stderr.on('data', (bytes: Buffer) => {
+      this.stderr += bytes.length;
+      if (this.stderr > HARNESS_RPC_LIMITS.total)
+        this.fail(new Error('Harness stderr exceeded its bound'));
+    });
+    this.process.stdout.on('data', (bytes: Buffer) => {
+      try {
+        this.received += bytes.length;
+        if (this.received > HARNESS_RPC_LIMITS.total)
+          throw new Error('Harness output exceeded its bound');
+        this.buffer += this.decoder.decode(bytes, { stream: true });
+        let end;
+        while ((end = this.buffer.indexOf('\n')) >= 0) {
+          const line = this.buffer.slice(0, end);
+          this.buffer = this.buffer.slice(end + 1);
+          if (Buffer.byteLength(line) > HARNESS_RPC_LIMITS.frame)
+            throw new Error('Harness frame exceeded its bound');
+          if (!line.trim()) throw new Error('Empty harness frame');
+          this.message(JSON.parse(line));
+        }
+        if (Buffer.byteLength(this.buffer) > HARNESS_RPC_LIMITS.frame)
+          throw new Error('Harness frame exceeded its bound');
+      } catch (error) {
+        this.fail(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    this.process.stdout.on('end', () => {
+      if (
+        !this.stopping &&
+        (this.buffer.length ||
+          (() => {
+            try {
+              return Boolean(this.decoder.decode());
+            } catch {
+              return true;
+            }
+          })())
+      )
+        this.fail(new Error('Truncated harness frame'));
+    });
+  }
+  private object(value: unknown): RpcObject {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+      throw new Error('Invalid harness object');
+    return value as RpcObject;
+  }
+  private message(value: unknown): void {
+    if (this.failure || this.stopping) return;
+    const message = this.object(value);
+    if (this.launch.dialect === 'acp' ? message.jsonrpc !== '2.0' : message.jsonrpc !== undefined)
+      throw new Error('Harness RPC dialect mismatch');
+    if (typeof message.method === 'string') {
+      if (
+        message.method.length > 192 ||
+        Object.hasOwn(message, 'result') ||
+        Object.hasOwn(message, 'error')
+      )
+        throw new Error('Invalid harness request envelope');
+      const params = message.params === undefined ? {} : this.object(message.params);
+      if (message.id === undefined) {
+        this.handlers.notification?.(message.method, params);
+        return;
+      }
+      if (
+        (typeof message.id !== 'string' && typeof message.id !== 'number') ||
+        (typeof message.id === 'string' && message.id.length > 256) ||
+        (typeof message.id === 'number' && !Number.isSafeInteger(message.id))
+      )
+        throw new Error('Invalid harness request ID');
+      const key = JSON.stringify(message.id);
+      if (this.inbound.has(key) || this.inbound.size >= HARNESS_RPC_LIMITS.pending)
+        throw new Error('Duplicate or excessive harness requests');
+      this.inbound.add(key);
+      Promise.resolve()
+        .then(() => {
+          if (!this.handlers.request)
+            throw new ServiceError(
+              'harness_permission_denied',
+              'Harness client authority is unavailable',
+            );
+          return this.handlers.request(message.method as string, params);
+        })
+        .then(
+          (result) => this.send({ id: message.id, result: result ?? {} }),
+          () =>
+            this.send({
+              id: message.id,
+              error: { code: -32000, message: 'Harness request denied' },
+            }),
+        )
+        .catch((error) => this.fail(error))
+        .finally(() => this.inbound.delete(key));
+      return;
+    }
+    if (
+      !Number.isSafeInteger(message.id) ||
+      Object.hasOwn(message, 'result') === Object.hasOwn(message, 'error')
+    )
+      throw new Error('Invalid harness reply');
+    const waiter = this.pending.get(message.id as number);
+    if (!waiter) throw new Error('Unowned or duplicate harness reply');
+    this.pending.delete(message.id as number);
+    clearTimeout(waiter.timer);
+    if (Object.hasOwn(message, 'error'))
+      waiter.reject(new ServiceError('harness_rpc_error', 'Harness rejected the request'));
+    else {
+      try {
+        waiter.resolve(this.object(message.result));
+      } catch (error) {
+        waiter.reject(error as Error);
+        throw error;
+      }
+    }
+  }
+  private send(value: RpcObject): void {
+    if (this.failure || this.stopping) throw this.failure ?? new Error('Harness connection closed');
+    const frame =
+      JSON.stringify({ ...(this.launch.dialect === 'acp' ? { jsonrpc: '2.0' } : {}), ...value }) +
+      '\n';
+    if (Buffer.byteLength(frame) > HARNESS_RPC_LIMITS.frame)
+      throw new Error('Outbound harness frame exceeded its bound');
+    if (this.process.stdin.writableLength + Buffer.byteLength(frame) > HARNESS_RPC_LIMITS.total)
+      throw new Error('Harness input backpressure exceeded its bound');
+    this.process.stdin.write(frame);
+  }
+  request(
+    method: string,
+    params: RpcObject,
+    timeout: number = HARNESS_RPC_LIMITS.timeout,
+  ): Promise<RpcObject> {
+    if (this.failure || this.stopping)
+      return Promise.reject(this.failure ?? new Error('Harness connection closed'));
+    if (
+      this.pending.size >= HARNESS_RPC_LIMITS.pending ||
+      !Number.isSafeInteger(timeout) ||
+      timeout < 1 ||
+      timeout > 300000
+    )
+      return Promise.reject(new Error('Harness request bound exceeded'));
+    const id = ++this.serial;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () =>
+          this.fail(
+            new ServiceError(
+              'harness_outcome_unknown',
+              'Harness reply deadline reached; the request must not be replayed',
+            ),
+          ),
+        timeout,
+      );
+      this.pending.set(id, { resolve, reject, timer });
+      try {
+        this.send({ id, method, params });
+      } catch (error) {
+        this.fail(error as Error);
+      }
+    });
+  }
+  notify(method: string, params: RpcObject): void {
+    this.send({ method, params });
+  }
+  private fail(error: Error): void {
+    if (this.failure || this.stopping) return;
+    this.failure = error;
+    for (const waiter of this.pending.values()) {
+      clearTimeout(waiter.timer);
+      waiter.reject(error);
+    }
+    this.pending.clear();
+    this.process.kill('SIGKILL');
+    // A failed persistence observer must not leave the transport usable or make a timer throw.
+    // Pending callers already reject; the committed dispatch intent remains for recovery.
+    try {
+      this.handlers.failed?.(error);
+    } catch {}
+  }
+  async close(): Promise<void> {
+    this.stopping = true;
+    for (const waiter of this.pending.values()) {
+      clearTimeout(waiter.timer);
+      waiter.reject(new Error('Harness connection closed'));
+    }
+    this.pending.clear();
+    this.process.kill('SIGKILL');
+    await this.exited;
+  }
+}

package/src/harness-tool-identity.ts

@@ -0,0 +1,91 @@
+import { HARNESS_TARGETS, type HarnessTarget } from './harness-probe.js';
+import { ServiceError } from './protocol.js';
+/** Correlation only: these IDs never authenticate a worker or grant operator authority. */
+export function harnessToolIds(
+  target: HarnessTarget,
+  version: string,
+  intent: { id: string; name: string },
+): string[] {
+  if (
+    !Object.hasOwn(HARNESS_TARGETS, target) ||
+    HARNESS_TARGETS[target].version !== version ||
+    !/^[a-zA-Z0-9_-]{1,128}$/.test(intent.id) ||
+    !/^[a-zA-Z0-9_-]{1,128}$/.test(intent.name)
+  )
+    throw new ServiceError(
+      'harness_tool_identity',
+      'Unproved runtime or malformed model tool identity',
+    );
+  // Gemini 0.64.0 namespaces model-call IDs when projecting them into ACP tool calls.
+  return target === 'gemini-acp' ? [intent.id, intent.name + '__' + intent.id] : [intent.id];
+}
+
+/** Parse only literal shell argv displays; never evaluate expansions, redirections or operators. */
+function literalWords(display: string): string[] | null {
+  const words: string[] = [];
+  let word = '',
+    quote = '',
+    present = false;
+  for (let i = 0; i < display.length; i++) {
+    const c = display[i]!;
+    if (quote === "'") {
+      if (c === "'") quote = '';
+      else word += c;
+    } else if (c === '\\') {
+      const next = display[++i];
+      if (next === undefined || next === '\n') return null;
+      if (quote === '"' && !['"', '\\', '$', '`'].includes(next)) word += '\\';
+      word += next;
+      present = true;
+    } else if (quote === '"') {
+      if (c === '"') quote = '';
+      else if (c === '$' || c === '`') return null;
+      else word += c;
+    } else if (c === "'" || c === '"') {
+      quote = c;
+      present = true;
+    } else if (c === '\n' || c === '\r') return null;
+    else if (/\s/.test(c)) {
+      if (present) words.push(word);
+      word = '';
+      present = false;
+    } else {
+      if (';&|<>()$`*?[]{}~#'.includes(c)) return null;
+      word += c;
+      present = true;
+    }
+  }
+  if (quote) return null;
+  if (present) words.push(word);
+  return words;
+}
+
+/** Correlate the pinned app-server's concrete shell display with an independently captured model call. No grant is implied. */
+export function matchesCodexCommandScope(
+  version: string,
+  intent: { id: string; name: string; arguments: Record<string, unknown> } | undefined,
+  params: Record<string, unknown>,
+): boolean {
+  if (
+    version !== HARNESS_TARGETS['codex-app-server'].version ||
+    !intent ||
+    intent.name !== 'exec_command' ||
+    intent.id !== params.itemId ||
+    typeof intent.arguments.cmd !== 'string' ||
+    typeof params.command !== 'string' ||
+    typeof intent.arguments.workdir !== 'string' ||
+    params.cwd !== intent.arguments.workdir ||
+    intent.arguments.shell !== undefined ||
+    intent.arguments.login === false
+  )
+    return false;
+  const words = literalWords(params.command);
+  return (
+    words?.length === 3 &&
+    // The pinned image exposes Bash at both paths. Codex selects /bin/bash
+    // for its UID-1000 passwd entry and /usr/bin/bash for an unmapped UID.
+    ['/usr/bin/bash', '/bin/bash'].includes(words[0]!) &&
+    words[1] === '-lc' &&
+    words[2] === intent.arguments.cmd
+  );
+}