@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/dist/src/harness-backend.js

@@ -0,0 +1,466 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync, lstatSync, realpathSync, readdirSync, readlinkSync, createReadStream, mkdirSync, writeFileSync, existsSync, } from 'node:fs';
+import { join, relative, dirname, isAbsolute } from 'node:path';
+import { DockerHarnessBoundary } from './harness-container.js';
+import { engineRequest, engineJson } from './execution-boundary.js';
+import { HarnessProtocol } from './harness-protocol.js';
+import { HARNESS_TARGETS } from './harness-probe.js';
+import { AnthropicHarnessGateway } from './harness-model-gateway.js';
+import { HarnessWireBridge } from './harness-wire-bridge.js';
+import { harnessToolIds, matchesCodexCommandScope } from './harness-tool-identity.js';
+import { proveHarnessReadiness } from './harness-readiness.js';
+import { ProviderCredentialStore, resolveProviderAuth } from './provider-auth.js';
+import { providerRoute } from './provider-config.js';
+import { readTree, validateTree } from './workspaces.js';
+import { repositoryPath } from './repository-snapshots.js';
+import { digest, ServiceError } from './protocol.js';
+import { hostDigests } from './host.js';
+export async function harnessRuntimeDigest(root) {
+    const entries = [];
+    async function walk(dir) {
+        for (const name of readdirSync(dir).sort()) {
+            const p = join(dir, name), s = lstatSync(p);
+            if (s.isDirectory())
+                await walk(p);
+            else if (s.isSymbolicLink()) {
+                if (!realpathSync(p).startsWith(root + '/'))
+                    throw Error('Runtime symlink escapes prepared artifact');
+                entries.push({ path: relative(root, p), link: readlinkSync(p) });
+            }
+            else if (s.isFile()) {
+                const hash = createHash('sha256');
+                for await (const chunk of createReadStream(p))
+                    hash.update(chunk);
+                entries.push({
+                    path: relative(root, p),
+                    hash: hash.digest('hex'),
+                    executable: Boolean(s.mode & 0o111),
+                });
+            }
+            else
+                throw Error('Unsupported harness runtime artifact');
+        }
+    }
+    await walk(root);
+    return digest(entries);
+}
+export function assertHarnessArtifactRoot(root) {
+    const allowed = [
+        'node_modules',
+        'codex',
+        'package.json',
+        'package-lock.json',
+        'runtime-manifest.json',
+    ];
+    if (!isAbsolute(root) ||
+        realpathSync(root) !== root ||
+        readdirSync(root).some((name) => !allowed.includes(name)))
+        throw Error('Select a dedicated prepared artifact root containing only pinned runtime packages; source, state and user configuration are excluded');
+}
+/** Host-owned registry and fixed launch templates. No project-controlled commands, inherited env or real keys enter containers. */
+export class DockerHarnessBackend {
+    path;
+    root;
+    socket;
+    executor;
+    docker;
+    pins;
+    fileDigest;
+    boundary;
+    descriptors = [];
+    protocols = new Map();
+    receipts = new Map();
+    constructor(path, root, socket, executor, docker = process.platform === 'darwin'
+        ? '/opt/homebrew/bin/docker'
+        : '/usr/bin/docker') {
+        this.path = path;
+        this.root = root;
+        this.socket = socket;
+        this.executor = executor;
+        this.docker = docker;
+        const stat = lstatSync(path), bytes = readFileSync(path);
+        if (!stat.isFile() ||
+            stat.isSymbolicLink() ||
+            stat.uid !== process.getuid?.() ||
+            (stat.mode & 0o077) !== 0 ||
+            bytes.length > 65536)
+            throw Error('Harness config must be an owner-only regular file, at most 64 KiB');
+        this.fileDigest = digest(bytes.toString());
+        const value = JSON.parse(bytes.toString());
+        if (value.schema !== 1 ||
+            Object.keys(value).some((k) => !['schema', 'runtimes'].includes(k)) ||
+            !Array.isArray(value.runtimes) ||
+            value.runtimes.length > 8)
+            throw Error('Unsupported harness registry');
+        const ids = new Set();
+        this.pins = value.runtimes.map((p) => {
+            if (Object.keys(p).some((k) => ![
+                'id',
+                'target',
+                'version',
+                'runtime_root',
+                'runtime_digest',
+                'model',
+                'output',
+                'requests',
+            ].includes(k)) ||
+                !/^[a-zA-Z0-9_-]{1,64}$/.test(p.id) ||
+                ids.has(p.id) ||
+                !Object.hasOwn(HARNESS_TARGETS, p.target) ||
+                p.version !== HARNESS_TARGETS[p.target].version ||
+                !isAbsolute(p.runtime_root) ||
+                realpathSync(p.runtime_root) !== p.runtime_root ||
+                !/^[a-f0-9]{64}$/.test(p.runtime_digest) ||
+                p.model !== 'claude-sonnet-4-6' ||
+                !Number.isSafeInteger(p.output) ||
+                p.output < 1 ||
+                p.output > 8192 ||
+                !Number.isSafeInteger(p.requests) ||
+                p.requests < 1 ||
+                p.requests > 32)
+                throw Error('Select exact reviewed harness artifacts and the tested Sonnet 4.6 route');
+            ids.add(p.id);
+            assertHarnessArtifactRoot(p.runtime_root);
+            return structuredClone(p);
+        });
+    }
+    async prepare() {
+        if (this.executor.evidence.probe !== 'passed')
+            throw Error('Harness requires a proven real executor');
+        mkdirSync(this.root, { recursive: true, mode: 0o700 });
+        for (const p of this.pins) {
+            if ((await harnessRuntimeDigest(p.runtime_root)) !== p.runtime_digest)
+                throw Error('Harness runtime artifact changed');
+            if (p.target !== 'codex-app-server') {
+                const pkg = JSON.parse(readFileSync(join(p.runtime_root, 'node_modules', p.target === 'gemini-acp'
+                    ? '@google/gemini-cli/package.json'
+                    : '@zed-industries/claude-agent-acp/package.json'), 'utf8'));
+                if (pkg.version !== p.version)
+                    throw Error('Harness package version differs from its pin');
+            }
+        }
+        const executable = realpathSync(this.docker);
+        this.boundary = new DockerHarnessBoundary(engineRequest(this.socket), this.executor.engineId, {
+            executable,
+            digest: createHash('sha256').update(readFileSync(executable)).digest('hex'),
+            socket: this.socket,
+        });
+        await proveHarnessReadiness(this.boundary, this.root);
+        this.descriptors = this.pins.map((p) => ({
+            id: p.id,
+            kind: 'harness',
+            target: p.target,
+            version: p.version,
+            config_digest: digest(p),
+            adapter_digest: hostDigests().build_digest,
+            execution_identity: {
+                version: String(this.executor.evidence.engine_version),
+                kernel: String(this.executor.evidence.kernel),
+                arch: String(this.executor.evidence.arch),
+            },
+            boundary_digest: this.boundary.profileDigest,
+            engine_id: this.executor.engineId,
+            evidence: 'proven',
+            model_usage: 'unknown',
+            provider_route: {
+                provider: 'anthropic',
+                model: p.model,
+                wire: p.target === 'claude-acp'
+                    ? 'anthropic'
+                    : p.target === 'gemini-acp'
+                        ? 'google'
+                        : 'responses',
+                wire_model: p.target === 'gemini-acp' ? 'gemini-2.5-flash' : p.model,
+            },
+            output_cap: p.output,
+            max_model_requests: p.requests,
+            files: true,
+            commands: true,
+        }));
+    }
+    runtimes() {
+        return structuredClone(this.descriptors);
+    }
+    validate(runtime) {
+        if (!this.boundary ||
+            digest(readFileSync(this.path, 'utf8')) !== this.fileDigest ||
+            !this.descriptors.some((r) => digest(r) === digest(runtime)))
+            throw new ServiceError('worker_binding_changed', 'Operator runtime configuration or proven boundary changed');
+    }
+    assertAuthority(runtime, tools) {
+        if (runtime.target === 'codex-app-server' && !tools.includes('salaam_command'))
+            throw new ServiceError('runtime_role_unsupported', 'The pinned Codex route requires an explicitly command-enabled profile');
+    }
+    runRoot(run) {
+        if (!/^[0-9a-f-]{36}$/.test(run))
+            throw Error('Invalid owned run ID');
+        return join(this.root, run);
+    }
+    async execute(binding, run, prompt, tree, hooks) {
+        this.validate(binding.external);
+        const pin = this.pins.find((p) => p.id === binding.external.id);
+        if ((await harnessRuntimeDigest(pin.runtime_root)) !== pin.runtime_digest)
+            throw Error('Harness runtime changed before launch');
+        hooks.assertActive();
+        const dir = this.runRoot(run), work = join(dir, 'workspace'), home = join(dir, 'home'), token = randomUUID() + randomUUID();
+        if (existsSync(dir))
+            throw new ServiceError('harness_replay', 'Owned runtime directory already exists; reconcile without replay');
+        for (const p of [dir, work, home])
+            mkdirSync(p, { mode: 0o700 });
+        validateTree(tree);
+        for (const [p, file] of Object.entries(tree)) {
+            repositoryPath(p);
+            mkdirSync(dirname(join(work, p)), { recursive: true, mode: 0o700 });
+            writeFileSync(join(work, p), Buffer.from(file.content, 'base64'), {
+                mode: file.executable ? 0o700 : 0o600,
+            });
+        }
+        const codex = pin.target === 'codex-app-server', claude = pin.target === 'claude-acp';
+        const files = binding.tools.includes('salaam_files'), commands = binding.tools.includes('salaam_command');
+        const tools = codex
+            ? commands
+                ? ['exec_command']
+                : []
+            : claude
+                ? [
+                    'Read',
+                    'Glob',
+                    'Grep',
+                    ...(files ? ['Edit', 'Write'] : []),
+                    ...(commands ? ['Bash'] : []),
+                ]
+                : [
+                    'list_directory',
+                    'read_file',
+                    'grep_search',
+                    'glob',
+                    ...(files ? ['replace', 'write_file'] : []),
+                    ...(commands ? ['run_shell_command'] : []),
+                ];
+        let args, env;
+        if (codex) {
+            mkdirSync(join(home, '.codex'));
+            writeFileSync(join(home, '.codex/config.toml'), `model = "${pin.model}"\nmodel_provider = "salaam"\n[model_providers.salaam]\nname = "Salaam explicit Claude gateway"\nbase_url = "http://127.0.0.1:47123/v1"\nenv_key = "ANTHROPIC_API_KEY"\nwire_api = "responses"\nrequires_openai_auth = false\n`, { mode: 0o600 });
+            const arch = this.executor.evidence.arch === 'arm64' ? 'aarch64' : 'x86_64';
+            const binary = '/runtime/codex/vendor/' + arch + '-unknown-linux-musl/bin/codex';
+            const wrapper = `const cp=require('node:child_process');if(cp.execFileSync(${JSON.stringify(binary)},['--version'],{encoding:'utf8'}).trim()!=='codex-cli ${pin.version}')process.exit(2);const c=cp.spawn(${JSON.stringify(binary)},['app-server'],{stdio:'inherit',env:process.env});c.on('exit',n=>process.exit(n??1));c.on('error',()=>process.exit(2));`;
+            args = ['/usr/local/bin/node', '-e', wrapper];
+            env = { CODEX_HOME: '/home/agent/.codex', ANTHROPIC_API_KEY: token };
+        }
+        else if (claude) {
+            args = [
+                '/usr/local/bin/node',
+                '/runtime/node_modules/@zed-industries/claude-agent-acp/dist/index.js',
+            ];
+            env = {
+                ANTHROPIC_BASE_URL: 'http://127.0.0.1:47123',
+                ANTHROPIC_API_KEY: token,
+                ANTHROPIC_MODEL: pin.model,
+                ANTHROPIC_DEFAULT_SONNET_MODEL: pin.model,
+                ANTHROPIC_DEFAULT_HAIKU_MODEL: pin.model,
+                ANTHROPIC_DEFAULT_OPUS_MODEL: pin.model,
+                DISABLE_TELEMETRY: '1',
+                CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+            };
+        }
+        else {
+            args = [
+                '/usr/local/bin/node',
+                '/runtime/node_modules/@google/gemini-cli/bundle/gemini.js',
+                '--acp',
+                '--model',
+                'gemini-2.5-flash',
+            ];
+            env = {
+                GEMINI_API_KEY: token,
+                GOOGLE_GEMINI_BASE_URL: 'http://127.0.0.1:47123',
+                GEMINI_CLI_NO_RELAUNCH: 'true',
+                DISABLE_TELEMETRY: '1',
+            };
+        }
+        const receipt = await this.boundary.prepare(run, work, pin.runtime_root, home, args, env);
+        this.receipts.set(run, receipt);
+        hooks.receipt(receipt);
+        const intents = new Map();
+        const checkBoundary = async () => {
+            try {
+                hooks.assertActive();
+                await this.boundary.assert(receipt);
+                const info = engineJson(await engineRequest(this.socket)('GET', '/info'));
+                const identity = binding.external.execution_identity;
+                if (info.ServerVersion !== identity.version || info.KernelVersion !== identity.kernel)
+                    throw Error('Harness engine version or kernel changed');
+            }
+            catch (error) {
+                try {
+                    hooks.failed(error);
+                }
+                catch { }
+                throw error;
+            }
+        };
+        const gateway = new AnthropicHarnessGateway({
+            model: pin.model,
+            output: pin.output,
+            token,
+            credential: async () => {
+                const auth = await resolveProviderAuth(providerRoute('anthropic', pin.model, pin.output), new ProviderCredentialStore(), {});
+                if (!auth.auth.apiKey)
+                    throw Error('No operator-configured Claude credential');
+                return auth.auth.apiKey;
+            },
+            admit: hooks.modelRequest,
+        });
+        const bridge = claude
+            ? null
+            : new HarnessWireBridge(gateway, {
+                protocol: codex ? 'responses' : 'google',
+                model: codex ? pin.model : 'gemini-2.5-flash',
+                tools,
+            }, (intent) => {
+                for (const id of harnessToolIds(pin.target, pin.version, intent))
+                    intents.set(id, intent);
+            });
+        await this.boundary.gateway(receipt, async (request) => {
+            await checkBoundary();
+            if (bridge)
+                return bridge.request(request);
+            const body = JSON.parse(request.body.toString());
+            if (Array.isArray(body.tools))
+                body.tools = body.tools.filter((t) => tools.includes(t.name));
+            return gateway.request({ ...request, body: Buffer.from(JSON.stringify(body)) });
+        });
+        const checkpoint = {
+            schema_version: 1,
+            dialect: codex ? 'codex' : 'acp',
+            worker_id: binding.worker_id,
+            attempt_id: binding.attempt_id,
+            state: 'prepared',
+            session_id: null,
+            turn_id: null,
+            prompt_digest: null,
+            cancel_requested: false,
+            result: null,
+            load_session: false,
+        };
+        hooks.checkpoint(checkpoint);
+        const protocol = new HarnessProtocol(await this.boundary.launchHarness(receipt, checkpoint.dialect), checkpoint, {
+            save: hooks.checkpoint,
+            permission: async (owned) => {
+                await checkBoundary();
+                const params = owned.params, call = params.toolCall, known = intents.get(codex ? params.itemId : call?.toolCallId);
+                let scope;
+                if (codex) {
+                    if (matchesCodexCommandScope(pin.version, known, params))
+                        scope = {
+                            id: params.itemId,
+                            kind: 'command',
+                            arguments: { cmd: known.arguments.cmd, cwd: params.cwd },
+                        };
+                }
+                else {
+                    const input = (claude ? call?.rawInput : known?.arguments);
+                    const name = claude ? call?.title : known?.name;
+                    if (input && typeof input.command === 'string')
+                        scope = { id: call.toolCallId, kind: 'command', arguments: input };
+                    else if (input &&
+                        typeof input.file_path === 'string' &&
+                        (claude || ['replace', 'write_file'].includes(String(name)))) {
+                        if (input.file_path.startsWith('/workspace/'))
+                            repositoryPath(input.file_path.slice('/workspace/'.length));
+                        else
+                            return 'deny';
+                        scope = { id: call.toolCallId, kind: 'write', arguments: input };
+                    }
+                }
+                if (!scope)
+                    return 'deny';
+                const decision = await hooks.permission(owned.method, {
+                    scope,
+                    upstream_session: owned.session_id,
+                    upstream_turn: owned.turn_id,
+                    request_digest: digest(params),
+                });
+                await checkBoundary();
+                return decision;
+            },
+            event: (method, params) => {
+                const p = params;
+                if (!codex &&
+                    method === 'session/update' &&
+                    p.update?.sessionUpdate === 'tool_call_update' &&
+                    ['completed', 'failed'].includes(p.update.status))
+                    hooks.toolResult(p.update.toolCallId, p.update.status === 'completed', p.update);
+                if (codex &&
+                    method === 'item/completed' &&
+                    ['commandExecution', 'fileChange'].includes(p.item?.type))
+                    hooks.toolResult(p.item.id, p.item.status === 'completed' &&
+                        (p.item.exitCode === undefined || p.item.exitCode === 0), p.item);
+            },
+        });
+        this.protocols.set(run, protocol);
+        await protocol.initialize(!codex);
+        if (!codex)
+            await protocol.rpc.request('authenticate', {
+                methodId: 'gateway',
+                _meta: {
+                    ...(claude ? {} : { 'api-key': token }),
+                    gateway: { baseUrl: 'http://127.0.0.1:47123', headers: { 'x-api-key': token } },
+                },
+            }, 30000);
+        await protocol.create(codex
+            ? {
+                cwd: '/workspace',
+                model: pin.model,
+                modelProvider: 'salaam',
+                sandbox: 'danger-full-access',
+                approvalPolicy: 'untrusted',
+            }
+            : {
+                cwd: '/workspace',
+                mcpServers: [],
+                ...(claude
+                    ? {
+                        _meta: {
+                            claudeCode: {
+                                options: {
+                                    model: pin.model,
+                                    settingSources: [],
+                                    plugins: [],
+                                    tools,
+                                    disallowedTools: [
+                                        'Skill',
+                                        'Task',
+                                        'Agent',
+                                        'WebFetch',
+                                        'WebSearch',
+                                        'AskUserQuestion',
+                                    ],
+                                    maxTurns: pin.requests,
+                                    maxThinkingTokens: 1024,
+                                },
+                            },
+                        },
+                    }
+                    : {}),
+            });
+        return { result: await protocol.prompt(prompt) };
+    }
+    async stop(run, runtime, _receipt) {
+        if (!this.boundary ||
+            runtime.engine_id !== this.executor.engineId ||
+            runtime.boundary_digest !== this.boundary.profileDigest)
+            throw Error('Cannot establish the original harness engine/profile for cleanup');
+        try {
+            await this.protocols.get(run)?.close();
+        }
+        finally {
+            this.protocols.delete(run);
+            await this.boundary.cleanupRun(run);
+            this.receipts.delete(run);
+        }
+    }
+    collect(run, _runtime) {
+        return readTree(join(this.runRoot(run), 'workspace'));
+    }
+}