@yunhozz/arc 0.1.2 → 0.1.3

package/scripts/probe-runtime-hooks.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {pathToFileURL} from 'node:url';
+import {summarizeProbe} from '../lib/runtime/capabilities.mjs';
+
+// This tool does not install hooks, grant trust, or execute the tool being probed.
+// Host-result receipts must be supplied by the trusted probe host after checking
+// actual non-execution. A hook-decision receipt alone never verifies denial.
+export function writeProbeReceipt(receipt,data,write = fs.writeFileSync) {
+    let fd;
+    try {
+      fd=fs.openSync(receipt,fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_EXCL|fs.constants.O_NOFOLLOW,0o600);
+      write(fd,JSON.stringify(data)+'\n');
+    } catch(error) {
+      if(fd !== undefined) fs.unlinkSync(receipt);
+      throw error;
+    } finally { if(fd !== undefined) fs.closeSync(fd); }
+}
+
+if(process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+try {
+  const [mode,...args] = process.argv.slice(2);
+  const options = {};
+  for(let i=0;i<args.length;i+=2) {
+    if(!['--platform','--session','--version','--receipt','--attempt','--scratch'].includes(args[i]) || !args[i+1]) throw new Error('Invalid probe options');
+    options[args[i].slice(2)] = args[i+1];
+  }
+  const {platform,session:sessionRef,version:platformVersion,attempt:attemptRef,scratch,receipt} = options;
+  if(!['codex','claude'].includes(platform) || !sessionRef || !platformVersion || !attemptRef || !receipt || !path.isAbsolute(receipt)) throw new Error('Explicit platform, session, version and absolute scratch receipt required');
+  if(mode === 'summary') {
+    const parsed = JSON.parse(fs.readFileSync(receipt,'utf8'));
+    console.log(JSON.stringify(summarizeProbe(Array.isArray(parsed)?parsed:[parsed],{platform,sessionRef,platformVersion,attemptRef})));
+  } else if(mode === 'hook') {
+    const input = JSON.parse(fs.readFileSync(0,'utf8'));
+    if(input.hook_event_name !== 'PreToolUse' || typeof input.tool_name !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]{0,79}$/.test(input.tool_name)) throw new Error('Only PreToolUse canary requests supported');
+    if(!scratch || !path.isAbsolute(scratch)) throw new Error('Explicit private scratch directory required');
+    const realScratch=fs.realpathSync(scratch);
+    const stat=fs.lstatSync(scratch);
+    if(stat.isSymbolicLink() || !stat.isDirectory() || (stat.mode & 0o077) !== 0 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      path.dirname(realScratch) !== fs.realpathSync(os.tmpdir()) ||
+      !path.basename(realScratch).startsWith('arc-runtime-probe-') ||
+      fs.realpathSync(path.dirname(path.resolve(receipt))) !== realScratch) throw new Error('Receipt must be directly inside private probe scratch');
+    const data={source:'native',kind:'hook-decision',platform,platformVersion,sessionRef,attemptRef,
+      event:'PreToolUse',toolPath:input.tool_name,
+      operation:input.tool_name === 'Agent' ? (platform === 'codex' ? 'spawn_agent' : 'Agent') : null,decision:'deny'};
+    // Exclusive creation prevents truncation and symlink following. No staging
+    // file is needed; remove our own new receipt if its write fails.
+    writeProbeReceipt(receipt,data);
+    console.log(JSON.stringify({hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:'ARC scratch canary deny'}}));
+  } else throw new Error('Expected hook or summary mode');
+} catch(error) { console.error(error.message); process.exitCode=1; }
+
+}

package/scripts/update-runtime-assets.mjs

@@ -0,0 +1,19 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const args=process.argv.slice(2);const i=args.indexOf('--root');
+const root=i<0?fileURLToPath(new URL('../',import.meta.url)):path.resolve(args[i+1]);
+const check=args.includes('--check');
+function safe(filename,directory=false){
+ const relative=path.relative(root,filename);if(relative.startsWith('..')||path.isAbsolute(relative))throw Error('Payload outside root');
+ let cursor=root;for(const part of relative.split(path.sep).filter(Boolean)){cursor=path.join(cursor,part);let stat;try{stat=fs.lstatSync(cursor);}catch(error){if(error.code==='ENOENT')continue;throw error;}if(stat.isSymbolicLink()||(!stat.isFile()&&!stat.isDirectory()))throw Error(`Unsafe runtime asset: ${cursor}`);}
+ if(fs.existsSync(filename)){const s=fs.lstatSync(filename);if(directory?!s.isDirectory():!s.isFile())throw Error(`Unexpected runtime asset type: ${filename}`);}
+}
+function sources(relative){const dir=path.join(root,relative);safe(dir,true);const result=[];for(const entry of fs.readdirSync(dir).sort()){const rel=path.join(relative,entry);const file=path.join(root,rel);safe(file,fs.lstatSync(file).isDirectory());if(fs.lstatSync(file).isDirectory())result.push(...sources(rel));else if(entry.endsWith('.mjs'))result.push(rel);else throw Error(`Unexpected canonical runtime file: ${rel}`);}return result;}
+try{
+ safe(root,true);const entries=sources('lib/runtime').map(name=>[path.relative('lib/runtime',name),fs.readFileSync(path.join(root,name))]);
+ const policy=path.join(root,'lib/policy/role-policy.json');safe(policy);entries.push(['role-policy.json',fs.readFileSync(policy)]);
+ const outputs=[];for(const platform of ['codex','claude'])for(const [name,bytes]of entries){const filename=path.join(root,platform,'skill/runtime',name);safe(filename);outputs.push({filename,bytes});}
+ let drift=false;for(const {filename,bytes}of outputs){if(!fs.existsSync(filename)||!fs.readFileSync(filename).equals(bytes)){drift=true;if(!check){fs.mkdirSync(path.dirname(filename),{recursive:true});fs.writeFileSync(filename,bytes);}}}
+ if(check&&drift){console.error('Runtime payload drift');process.exitCode=1;}else console.log(`Runtime payload ${check?'verified':'generated'} (${outputs.length} files)`);
+}catch(error){console.error(error.message);process.exitCode=1;}