@zhivex-ai/harness 1.4.0 → 1.4.1

package/dist/index-wm9xeq1n.js

@@ -0,0 +1,329 @@
+import {
+  createEditProposal,
+  editChangesSchema,
+  workspaceFilePathSchema
+} from "./index-xdbkcccf.js";
+
+// src/runtime/tool-policy.ts
+import { createHash } from "node:crypto";
+import { z } from "zod";
+var normalizedPath = workspaceFilePathSchema.refine((value) => !value.includes("\\"), "Use forward slashes.");
+var nameSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/);
+var harnessToolPolicySchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  explicitReview: z.strictObject({ schemaVersion: z.literal(1) }).optional(),
+  rules: z.array(z.strictObject({
+    id: nameSchema,
+    tools: z.array(nameSchema).min(1).max(128),
+    paths: z.array(normalizedPath).min(1).max(256).optional(),
+    decision: z.enum(["allow", "ask_user", "deny"]),
+    reason: z.string().min(1).max(512)
+  })).max(128)
+}).superRefine((policy, context) => {
+  if (new Set(policy.rules.map((rule) => rule.id)).size !== policy.rules.length) {
+    context.addIssue({ code: "custom", message: "Tool policy rule ids must be unique." });
+  }
+});
+var rank = { allow: 0, ask_user: 1, deny: 2 };
+var createHarnessToolPolicy = (input) => {
+  const policy = harnessToolPolicySchema.parse(input);
+  const canonical = { schemaVersion: 1, ...policy.explicitReview ? { explicitReview: policy.explicitReview } : {}, rules: policy.rules.map((rule) => ({
+    ...rule,
+    tools: [...new Set(rule.tools)].sort(),
+    ...rule.paths ? { paths: [...new Set(rule.paths)].sort() } : {}
+  })).sort((a, b) => a.id.localeCompare(b.id)) };
+  const digest = `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+  const evaluate = (request) => {
+    if (request.hardDenied)
+      return { decision: "deny", ruleIds: [], reason: "Denied by the harness permission boundary." };
+    const paths = request.paths?.map((value) => normalizedPath.parse(value)) ?? [];
+    if (paths.length === 0 && canonical.rules.some((rule) => rule.tools.includes(request.toolName) && rule.paths)) {
+      return { decision: "deny", ruleIds: [], reason: "Path-scoped policy cannot evaluate a request without resolved paths." };
+    }
+    const matching = canonical.rules.filter((rule) => rule.tools.includes(request.toolName) && (!rule.paths || paths.some((target) => rule.paths?.includes(target))));
+    let decision = request.requiresApproval ? "ask_user" : "allow";
+    for (const rule of matching)
+      if (rank[rule.decision] > rank[decision])
+        decision = rule.decision;
+    const decisive = matching.filter((rule) => rule.decision === decision);
+    return { decision, ruleIds: decisive.map((rule) => rule.id), reason: decisive.length > 0 ? decisive.map((rule) => rule.reason).join("; ") : request.requiresApproval ? "Existing tool approval is required." : "No additional restriction from application policy." };
+  };
+  return { digest, evaluate, policy: structuredClone(canonical) };
+};
+
+class HarnessToolPolicyDeniedError extends Error {
+  policyDecision;
+  constructor(policyDecision) {
+    super(`Tool denied by application policy${policyDecision.ruleIds.length ? ` (${policyDecision.ruleIds.join(", ")})` : ""}: ${policyDecision.reason}`);
+    this.policyDecision = policyDecision;
+    this.name = "HarnessToolPolicyDeniedError";
+  }
+}
+var applyHarnessToolPolicy = (tools, input, options = {}) => {
+  const engine = createHarnessToolPolicy(input);
+  if (engine.policy.rules.some((rule) => rule.paths) && !options.resolvePaths) {
+    throw new Error("Path-scoped tool policy requires a trusted resolvePaths callback.");
+  }
+  const result = {};
+  for (const [name, definition] of Object.entries(tools)) {
+    const additionalApproval = engine.policy.rules.some((rule) => rule.tools.includes(name) && rule.decision === "ask_user");
+    const requiresApproval = definition.requiresApproval === true || additionalApproval;
+    const execute = "execute" in definition ? definition.execute : undefined;
+    if (!execute && engine.policy.rules.some((rule) => rule.tools.includes(name))) {
+      throw new Error(`Tool policy cannot wrap provider-executed tool ${name}.`);
+    }
+    result[name] = {
+      ...definition,
+      ...requiresApproval ? {
+        independent: false,
+        requiresApproval: true,
+        approvalMode: "interrupt",
+        approvalVersion: `${("approvalVersion" in definition ? definition.approvalVersion : undefined) ?? "policy"}:${engine.digest}`
+      } : {},
+      metadata: { ...definition.metadata, harnessToolPolicyDigest: engine.digest },
+      ...execute ? { execute: async (toolInput, context) => {
+        const decision = engine.evaluate({
+          toolName: name,
+          ...options.resolvePaths ? { paths: options.resolvePaths(name, toolInput) } : {},
+          requiresApproval
+        });
+        await options.onDecision?.(name, decision);
+        if (decision.decision === "deny")
+          throw new HarnessToolPolicyDeniedError(decision);
+        return execute(toolInput, context);
+      } } : {}
+    };
+  }
+  return result;
+};
+
+// src/runtime/policy-inspection.ts
+import { createRedactionPolicy } from "@zhivex-ai/agents";
+var redaction = createRedactionPolicy({ includeEmails: true });
+var sanitizePolicyText = (text) => redaction.redactText(text).replace(/\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]+/gi, "[REDACTED]").replace(/[\x00-\x1f\x7f-\x9f]/g, "").replace(/(?:[A-Za-z]:\\|\/)[^\s;,]+/g, "[PRIVATE_PATH]");
+var inspections = new WeakMap;
+function bindHarnessPolicyInspection(host, input) {
+  if (inspections.has(host))
+    throw new Error("POLICY_INSPECTION_ALREADY_BOUND");
+  const compiled = input.policy ? createHarnessToolPolicy(input.policy) : undefined;
+  const execution = input.config.execution;
+  const limits = {
+    maxSteps: input.config.maxSteps,
+    timeoutMs: input.config.timeoutMs,
+    ...input.config.unlimitedDuration === undefined ? {} : { unlimitedDuration: input.config.unlimitedDuration },
+    budget: structuredClone(input.config.budget),
+    ...execution.backend === "oci" ? { oci: {
+      maxProcessRuntimeMs: execution.maxProcessRuntimeMs,
+      maxProcessOutputBytes: execution.maxProcessOutputBytes,
+      maxMemoryMb: execution.maxMemoryMb,
+      maxPids: execution.maxPids,
+      maxCpus: execution.maxCpus,
+      maxWorkspaceBytes: execution.maxWorkspaceBytes,
+      maxFileWriteBytes: execution.maxFileWriteBytes,
+      tmpfsMb: execution.tmpfsMb
+    } } : {}
+  };
+  inspections.set(host, {
+    schemaVersion: 1,
+    kind: "policy-inspection",
+    digest: compiled?.digest ?? null,
+    source: compiled ? input.operatorFile ? "operator-file" : "application" : "baseline",
+    explicitReviewRequired: compiled?.policy.explicitReview?.schemaVersion === 1,
+    tools: Object.entries(input.tools).sort(([a], [b]) => a.localeCompare(b)).map(([name, tool]) => ({ name: sanitizePolicyText(name), requiresApproval: tool.requiresApproval === true })),
+    restrictions: (compiled?.policy.rules ?? []).map((rule) => ({
+      ruleId: sanitizePolicyText(rule.id),
+      tools: rule.tools.map(sanitizePolicyText),
+      decision: rule.decision,
+      reason: sanitizePolicyText(rule.reason),
+      pathCount: rule.paths?.length ?? 0
+    })),
+    execution: { configuredBackend: execution.backend, activeBackend: input.hasOciEnvironment ? "oci" : "none", evidence: "configuration-only" },
+    limits
+  });
+}
+function inspectHarnessPolicy(host) {
+  const inspection = inspections.get(host);
+  if (!inspection)
+    throw new Error("POLICY_INSPECTION_HOST_UNAVAILABLE");
+  return structuredClone(inspection);
+}
+
+// src/approvals/approval-history.ts
+import { createHash as createHash2 } from "node:crypto";
+import { z as z2 } from "zod";
+var APPROVAL_HISTORY_KEY = "clientApprovalDecisionsV1";
+var canonical = (value) => Array.isArray(value) ? `[${value.map(canonical).join(",")}]` : value && typeof value === "object" ? `{${Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}` : JSON.stringify(value) ?? "null";
+var approvalInputDigest = (value) => createHash2("sha256").update(canonical(value)).digest("hex");
+var approvalProvenanceSchema = z2.strictObject({
+  schemaVersion: z2.literal(1),
+  origin: z2.enum(["interactive", "automatic", "application", "unknown"]),
+  channel: z2.string().regex(/^[a-z][a-z0-9._-]{0,79}$/),
+  policyDigest: z2.string().regex(/^sha256:[a-f0-9]{64}$/).nullable()
+});
+var rowSchema = z2.object({ approvalId: z2.string().max(256), digest: z2.string().regex(/^[a-f0-9]{64}$/), toolCallId: z2.string().max(256).optional(), name: z2.string().max(256), inputDigest: z2.string().regex(/^[a-f0-9]{64}$/).optional(), approved: z2.boolean(), decidedAt: z2.number().int().nonnegative(), reviewedRevision: z2.number().int().nonnegative(), provenance: approvalProvenanceSchema.optional() }).strict();
+function readApprovalDecisions(state) {
+  const value = state.metadata?.[APPROVAL_HISTORY_KEY];
+  if (value === undefined)
+    return [];
+  return z2.array(rowSchema).max(512).parse(value).map((row) => ({ ...row, provenance: row.provenance ?? {
+    schemaVersion: 1,
+    origin: "unknown",
+    channel: "unknown",
+    policyDigest: null
+  } }));
+}
+function approvalDecisionViews(state, journal, offset = 0) {
+  return readApprovalDecisions(state).slice(offset, offset + 25).map((row) => {
+    if (!row.approved)
+      return { ...row, status: "rejected" };
+    const entry = journal.find((entry2) => entry2.runId === state.runId && entry2.providerToolCallId === row.toolCallId && entry2.toolName === row.name && row.inputDigest !== undefined && approvalInputDigest(entry2.input) === row.inputDigest);
+    if (!entry)
+      return { ...row, status: ["created", "running", "waiting_approval", "cancel_requested"].includes(state.status) ? "approved" : "unknown" };
+    const evidence = { journalRevision: entry.revision, ...entry.completedAt === undefined ? {} : { completedAt: entry.completedAt } };
+    if (entry.status === "failed")
+      return { ...row, status: "failed", evidence };
+    if (entry.status !== "completed")
+      return { ...row, status: "unknown", evidence };
+    const out = entry.output && typeof entry.output === "object" && !Array.isArray(entry.output) ? entry.output : {};
+    if (row.name === "run_check") {
+      if (typeof out.exitCode !== "number" || !Number.isInteger(out.exitCode))
+        return { ...row, status: "unknown", evidence };
+      evidence.exitCode = out.exitCode;
+      if (typeof out.timedOut === "boolean")
+        evidence.timedOut = out.timedOut;
+      return { ...row, status: out.exitCode === 0 && !out.timedOut ? "succeeded" : "failed", evidence };
+    }
+    if (["apply_environment_patch", "verify_and_apply_environment_patch", "verify_and_apply_reviewed_edits"].includes(row.name)) {
+      const sha = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+      const importedSchema = z2.object({ kind: z2.literal("environment-patch-import"), patchId: sha, runId: z2.string(), changes: z2.array(z2.object({ path: z2.string().max(1024), beforeDigest: sha.optional(), afterDigest: sha.optional() })).max(50) });
+      const args = entry.input && typeof entry.input === "object" && !Array.isArray(entry.input) ? entry.input : {};
+      const verified = row.name !== "apply_environment_patch";
+      const imported = importedSchema.safeParse(verified ? out.imported : out);
+      if (!imported.success || imported.data.runId !== state.runId)
+        return { ...row, status: "unknown", evidence };
+      if (verified) {
+        const proof = z2.object({ kind: z2.enum(["verified-environment-patch-import", "verified-reviewed-edit-import"]), patchId: sha, proposalId: sha.optional(), verification: z2.object({ command: z2.array(z2.string()).min(1).max(257), exitCode: z2.literal(0), timedOut: z2.literal(false) }) }).safeParse(out);
+        if (!proof.success || proof.data.patchId !== imported.data.patchId || JSON.stringify(proof.data.verification.command) !== JSON.stringify([args.command, ...Array.isArray(args.args) ? args.args : []]))
+          return { ...row, status: "unknown", evidence };
+        if (row.name === "verify_and_apply_reviewed_edits") {
+          const changes = editChangesSchema.safeParse(args.changes);
+          if (!changes.success || proof.data.kind !== "verified-reviewed-edit-import" || createEditProposal({ changes: changes.data }).proposalId !== proof.data.proposalId)
+            return { ...row, status: "unknown", evidence };
+          evidence.reviewedProposalId = proof.data.proposalId;
+        } else if (proof.data.kind !== "verified-environment-patch-import" || args.patchId !== proof.data.patchId)
+          return { ...row, status: "unknown", evidence };
+        evidence.verifiedPatchId = proof.data.patchId;
+        evidence.command = proof.data.verification.command;
+        evidence.exitCode = 0;
+        evidence.timedOut = false;
+      } else if (args.patchId !== imported.data.patchId)
+        return { ...row, status: "unknown", evidence };
+      evidence.proposalId = imported.data.patchId;
+      evidence.effects = imported.data.changes.map((change) => ({ ...change, beforeDigest: change.beforeDigest ?? null, afterDigest: change.afterDigest ?? null }));
+      return { ...row, status: "applied", evidence };
+    }
+    if (["apply_patch", "apply_reviewed_edits", "apply_reviewed_replacement"].includes(row.name)) {
+      const receipt = z2.object({ kind: z2.literal("patch-result"), result: z2.object({ proposalId: z2.string().regex(/^sha256:[a-f0-9]{64}$/), changes: z2.array(z2.object({ path: z2.string().max(1024), beforeDigest: z2.string().regex(/^sha256:[a-f0-9]{64}$/).nullable().optional(), afterDigest: z2.string().regex(/^sha256:[a-f0-9]{64}$/).nullable() })).min(1).max(50) }) }).safeParse(out);
+      if (!receipt.success)
+        return { ...row, status: "unknown", evidence };
+      evidence.proposalId = receipt.data.result.proposalId;
+      evidence.effects = receipt.data.result.changes.map((change) => ({ ...change, beforeDigest: change.beforeDigest ?? null }));
+      return { ...row, status: "applied", evidence };
+    }
+    return { ...row, status: "succeeded", evidence };
+  });
+}
+
+// src/runtime/policy-decisions.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { z as z3 } from "zod";
+var harnessPolicyDecisionEventSchema = z3.strictObject({
+  schemaVersion: z3.literal(1),
+  type: z3.literal("policy-decision"),
+  phase: z3.enum(["approval-request", "tool-entry"]).default("tool-entry"),
+  toolName: z3.string().max(512),
+  decision: z3.enum(["allow", "ask_user", "deny"]),
+  ruleIds: z3.array(z3.string().max(512)).max(128),
+  reason: z3.string().max(4096),
+  reasonTruncated: z3.boolean(),
+  policyDigest: z3.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
+  source: z3.enum(["operator-file", "application", "baseline"]),
+  approvalRequired: z3.boolean(),
+  explicitReviewRequired: z3.boolean(),
+  executionBackend: z3.enum(["none", "oci"]),
+  evidence: z3.literal("policy-evaluation")
+});
+var observers = new AsyncLocalStorage;
+var observeHarnessPolicyDecisions = (observer, work) => observers.run(observer, work);
+async function publishHarnessPolicyDecision(host, toolName, decision, phase = "tool-entry") {
+  const observer = observers.getStore();
+  if (!observer)
+    return;
+  const view = inspectHarnessPolicy(host);
+  const reason = sanitizePolicyText(decision.reason);
+  const event = harnessPolicyDecisionEventSchema.parse({
+    schemaVersion: 1,
+    type: "policy-decision",
+    phase,
+    toolName: sanitizePolicyText(toolName).slice(0, 512),
+    decision: decision.decision,
+    ruleIds: decision.ruleIds.map((id) => sanitizePolicyText(id).slice(0, 512)),
+    reason: reason.slice(0, 4096),
+    reasonTruncated: reason.length > 4096,
+    policyDigest: view.digest,
+    source: view.source,
+    approvalRequired: decision.decision === "ask_user",
+    explicitReviewRequired: decision.decision === "ask_user" && view.explicitReviewRequired,
+    executionBackend: view.execution.activeBackend,
+    evidence: "policy-evaluation"
+  });
+  await observer(event);
+}
+function observeBaselineToolPolicy(tools, host) {
+  const result = {};
+  for (const [name, definition] of Object.entries(tools)) {
+    const execute = "execute" in definition ? definition.execute : undefined;
+    result[name] = { ...definition, ...execute ? { execute: async (input, context) => {
+      const owner = host();
+      if (owner)
+        await publishHarnessPolicyDecision(owner, name, {
+          decision: definition.requiresApproval === true ? "ask_user" : "allow",
+          ruleIds: [],
+          reason: definition.requiresApproval === true ? "Existing tool approval is required; entering the executor after approval." : "No additional application restriction; tool permission checks still apply."
+        });
+      return execute(input, context);
+    } } : {} };
+  }
+  return result;
+}
+async function publishPendingPolicyDecision(host, toolName, promoted) {
+  if (!observers.getStore())
+    return;
+  const view = inspectHarnessPolicy(host);
+  const rules = view.restrictions.filter((rule) => rule.tools.includes(toolName) && rule.decision === "ask_user");
+  await publishHarnessPolicyDecision(host, toolName, {
+    decision: "ask_user",
+    ruleIds: rules.map((rule) => rule.ruleId),
+    reason: promoted ? "Approval promoted from a child run; review is pending and no execution is certified." : rules.length ? rules.map((rule) => rule.reason).join("; ") + (rules.some((rule) => rule.pathCount > 0) ? "; Path-scoped ask rules conservatively require review for this tool." : "") : "Existing tool approval is required; review is pending and no execution is certified."
+  }, "approval-request");
+}
+function createPolicyDecisionEvidence() {
+  const events = [];
+  let observed = 0;
+  let bytes = 0;
+  return {
+    append(event) {
+      observed++;
+      const size = Buffer.byteLength(JSON.stringify(event));
+      if (events.length < 64 && bytes + size <= 256 * 1024) {
+        events.push(structuredClone(event));
+        bytes += size;
+      }
+    },
+    snapshot() {
+      return { schemaVersion: 1, scope: "invocation", observed, truncated: observed > events.length, events: structuredClone(events) };
+    }
+  };
+}
+
+export { APPROVAL_HISTORY_KEY, approvalInputDigest, readApprovalDecisions, approvalDecisionViews, harnessToolPolicySchema, createHarnessToolPolicy, applyHarnessToolPolicy, bindHarnessPolicyInspection, inspectHarnessPolicy, harnessPolicyDecisionEventSchema, observeHarnessPolicyDecisions, publishHarnessPolicyDecision, observeBaselineToolPolicy, publishPendingPolicyDecision, createPolicyDecisionEvidence };