chati-dev 4.5.16 → 4.5.28

package/src/installer-v2/provider-executable.js

@@ -0,0 +1,247 @@
+import { createHash } from 'node:crypto';
+import {
+  closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync,
+} from 'node:fs';
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+
+const MAX_PROVIDER_EXECUTABLE_BYTES = 1024 * 1024 * 1024;
+const PROVIDER_EXECUTABLE_DIGEST = /^[a-f0-9]{64}$/;
+const CODEX_SUPPORTING_EXECUTABLE = 'codex-code-mode-host';
+const CODEX_NATIVE_TARGETS = Object.freeze({
+  'linux/x64': Object.freeze(['@openai/codex-linux-x64', 'x86_64-unknown-linux-musl']),
+  'linux/arm64': Object.freeze(['@openai/codex-linux-arm64', 'aarch64-unknown-linux-musl']),
+  'darwin/x64': Object.freeze(['@openai/codex-darwin-x64', 'x86_64-apple-darwin']),
+  'darwin/arm64': Object.freeze(['@openai/codex-darwin-arm64', 'aarch64-apple-darwin']),
+});
+
+function fail(code, message) {
+  throw Object.assign(new Error(message), { code });
+}
+
+function snapshot(stat) {
+  return Object.freeze({
+    dev: stat.dev, ino: stat.ino, mode: stat.mode, uid: stat.uid, gid: stat.gid,
+    nlink: stat.nlink, size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs,
+  });
+}
+
+function sameSnapshot(left, right) {
+  return Object.keys(left).every((key) => left[key] === right[key]);
+}
+
+function assertExecutableStat(stat) {
+  if (!stat.isFile() || stat.nlink < 1 || stat.size < 1 || stat.size > MAX_PROVIDER_EXECUTABLE_BYTES
+    || (stat.mode & 0o111) === 0) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'provider executable binding must identify one bounded executable regular file');
+  }
+}
+
+export function digestProviderExecutable(descriptor, expectedSnapshot = null) {
+  const before = snapshot(fstatSync(descriptor));
+  assertExecutableStat(fstatSync(descriptor));
+  const hash = createHash('sha256');
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  let position = 0;
+  while (position < before.size) {
+    const bytesRead = readSync(descriptor, buffer, 0, Math.min(buffer.length, before.size - position), position);
+    if (bytesRead === 0) fail('PROVIDER_EXECUTABLE_DRIFT', 'provider executable changed while it was being hashed');
+    hash.update(buffer.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+  const after = snapshot(fstatSync(descriptor));
+  if (!sameSnapshot(before, after) || (expectedSnapshot && !sameSnapshot(after, expectedSnapshot))) {
+    fail('PROVIDER_EXECUTABLE_DRIFT', 'provider executable changed during trust validation');
+  }
+  return Object.freeze({ sha256: hash.digest('hex'), snapshot: after });
+}
+
+function resolveFromPath(command, pathEnv) {
+  for (const entry of String(pathEnv || '').split(delimiter).filter(Boolean)) {
+    const candidate = resolve(entry, command);
+    try {
+      const stat = lstatSync(candidate);
+      if ((stat.isFile() || stat.isSymbolicLink()) && (stat.mode & 0o111) !== 0) return realpathSync(candidate);
+    } catch { /* continue through the explicit search path */ }
+  }
+  return fail('PROVIDER_EXECUTABLE_NOT_FOUND', `selected provider executable ${command} was not found`);
+}
+
+function codexNativeExecutable(wrapperPath, { platform = process.platform, arch = process.arch } = {}) {
+  const target = CODEX_NATIVE_TARGETS[`${platform}/${arch}`];
+  if (!target) fail('PROVIDER_EXECUTABLE_UNSUPPORTED', `Codex native executable binding is unsupported on ${platform}/${arch}`);
+  const [packageName, triple] = target;
+  const packageRoot = dirname(dirname(wrapperPath));
+  const nativePackageDirectory = basename(packageName);
+  const candidates = [
+    join(packageRoot, 'node_modules', packageName, 'vendor', triple, 'bin', 'codex'),
+    join(dirname(packageRoot), nativePackageDirectory, 'vendor', triple, 'bin', 'codex'),
+    join(packageRoot, 'vendor', triple, 'bin', 'codex'),
+  ];
+  for (const candidate of candidates) {
+    try {
+      const resolved = realpathSync(candidate);
+      assertExecutableStat(lstatSync(resolved));
+      return resolved;
+    } catch { /* try the next supported package layout */ }
+  }
+  return fail('PROVIDER_EXECUTABLE_NOT_FOUND', 'Codex wrapper does not resolve to its installed native executable');
+}
+
+function effectiveProviderExecutable(harnessId, resolvedCommand, options) {
+  if (harnessId !== 'codex') return resolvedCommand;
+  let descriptor;
+  let prefix;
+  try {
+    descriptor = openSync(resolvedCommand, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const buffer = Buffer.alloc(64);
+    const bytes = readSync(descriptor, buffer, 0, buffer.length, 0);
+    prefix = buffer.subarray(0, bytes).toString('utf8');
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+  return prefix.startsWith('#!') ? codexNativeExecutable(resolvedCommand, options) : resolvedCommand;
+}
+
+function digestExecutablePath(executablePath) {
+  let descriptor;
+  try {
+    const pathStat = lstatSync(executablePath);
+    if (pathStat.isSymbolicLink()) fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'provider executable binding may not end in a symlink');
+    descriptor = openSync(executablePath, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const pinned = fstatSync(descriptor);
+    if (pathStat.dev !== pinned.dev || pathStat.ino !== pinned.ino) {
+      fail('PROVIDER_EXECUTABLE_DRIFT', 'provider executable changed before descriptor pinning');
+    }
+    return digestProviderExecutable(descriptor);
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+}
+
+function supportingExecutablesFor(harnessId, executablePath) {
+  if (harnessId !== 'codex') return Object.freeze([]);
+  const supportPath = join(dirname(executablePath), CODEX_SUPPORTING_EXECUTABLE);
+  const executable_path = realpathSync(supportPath);
+  if (dirname(executable_path) !== dirname(executablePath) || basename(executable_path) !== CODEX_SUPPORTING_EXECUTABLE) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'Codex supporting executable must be its native code-mode host sibling');
+  }
+  const digest = digestExecutablePath(executable_path);
+  return Object.freeze([Object.freeze({ executable_path, executable_sha256: digest.sha256 })]);
+}
+
+export function resolveProviderExecutableBinding(harnessId, {
+  pathEnv = process.env.PATH,
+  platform = process.platform,
+  arch = process.arch,
+} = {}) {
+  if (!['claude', 'codex', 'grok'].includes(harnessId)) {
+    fail('PROVIDER_EXECUTABLE_UNSUPPORTED', `provider executable binding is unsupported for ${harnessId}`);
+  }
+  const executable_path = effectiveProviderExecutable(
+    harnessId,
+    resolveFromPath(harnessId, pathEnv),
+    { platform, arch },
+  );
+  const digest = digestExecutablePath(executable_path);
+  return Object.freeze({
+    executable_path,
+    executable_sha256: digest.sha256,
+    supporting_executables: supportingExecutablesFor(harnessId, executable_path),
+  });
+}
+
+function validateExecutableReference(reference, label, { exact = false } = {}) {
+  if (!reference || typeof reference !== 'object' || Array.isArray(reference)
+    || typeof reference.executable_path !== 'string' || !isAbsolute(reference.executable_path)
+    || resolve(reference.executable_path) !== reference.executable_path
+    || typeof reference.executable_sha256 !== 'string'
+    || !PROVIDER_EXECUTABLE_DIGEST.test(reference.executable_sha256)) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', `${label} must contain a canonical absolute path and SHA-256 digest`);
+  }
+  if (exact && Object.keys(reference).some((key) => key !== 'executable_path' && key !== 'executable_sha256')) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', `${label} contains unsupported fields`);
+  }
+  return Object.freeze({
+    executable_path: reference.executable_path,
+    executable_sha256: reference.executable_sha256,
+  });
+}
+
+export function validateProviderExecutableBinding(binding, { harnessId, requireCodexSupportingExecutable = false } = {}) {
+  const primary = validateExecutableReference(binding, `${harnessId || 'provider'} executable binding`);
+  const rawSupporting = binding.supporting_executables === undefined ? [] : binding.supporting_executables;
+  if (!Array.isArray(rawSupporting)) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', `${harnessId || 'provider'} supporting executables must be an array`);
+  }
+  const supporting_executables = rawSupporting.map((reference) => validateExecutableReference(
+    reference, `${harnessId || 'provider'} supporting executable`, { exact: true },
+  ));
+  if (harnessId !== 'codex' && supporting_executables.length > 0) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'only Codex may declare supporting executables');
+  }
+  if (harnessId === 'codex' && ((requireCodexSupportingExecutable && supporting_executables.length !== 1)
+    || (supporting_executables.length > 0 && (
+      supporting_executables.length !== 1
+      || basename(supporting_executables[0].executable_path) !== CODEX_SUPPORTING_EXECUTABLE
+      || dirname(supporting_executables[0].executable_path) !== dirname(primary.executable_path)
+    )))) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'Codex supporting executable must be its native code-mode host sibling');
+  }
+  return Object.freeze({
+    ...primary,
+    supporting_executables: Object.freeze(supporting_executables),
+  });
+}
+
+function assertOutsideProject(executablePath, projectDir) {
+  if (!projectDir) return;
+  const relativePath = relative(resolve(projectDir), executablePath);
+  if (relativePath === '' || (relativePath !== '..' && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath))) {
+    fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'provider executable must be installed outside the controlled project tree');
+  }
+}
+
+function openPinnedExecutable(reference, { projectDir } = {}) {
+  assertOutsideProject(reference.executable_path, projectDir);
+  let descriptor;
+  try {
+    const pathStat = lstatSync(reference.executable_path);
+    if (pathStat.isSymbolicLink()) fail('PROVIDER_EXECUTABLE_BINDING_INVALID', 'provider executable binding may not end in a symlink');
+    descriptor = openSync(reference.executable_path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const pinned = fstatSync(descriptor);
+    if (pathStat.dev !== pinned.dev || pathStat.ino !== pinned.ino) {
+      fail('PROVIDER_EXECUTABLE_DRIFT', 'provider executable changed before descriptor pinning');
+    }
+    const executable = digestProviderExecutable(descriptor);
+    if (executable.sha256 !== reference.executable_sha256) {
+      fail('PROVIDER_EXECUTABLE_DRIFT', 'provider executable digest differs from the sealed installation binding');
+    }
+    return Object.freeze({ descriptor, binding: reference, executable });
+  } catch (error) {
+    if (descriptor !== undefined) closeSync(descriptor);
+    if (error?.code?.startsWith('PROVIDER_EXECUTABLE_')) throw error;
+    return fail('PROVIDER_EXECUTABLE_BINDING_INVALID', `provider executable binding cannot be opened safely: ${error.message}`);
+  }
+}
+
+export function openPinnedProviderExecutable(binding, { harnessId, projectDir } = {}) {
+  const validated = validateProviderExecutableBinding(binding, { harnessId });
+  return openPinnedExecutable(validated, { projectDir });
+}
+
+export function openPinnedProviderSupportingExecutables(binding, { harnessId, projectDir } = {}) {
+  const validated = validateProviderExecutableBinding(binding, { harnessId });
+  return Object.freeze(validated.supporting_executables.map((reference) => openPinnedExecutable(reference, { projectDir })));
+}
+
+export function bindProviderExecutables(input, options = {}) {
+  if (!input?.installation?.enabled_providers) fail('INVALID_INSTALLATION', 'installation input is required');
+  const enabled_providers = input.installation.enabled_providers.map((binding) => ({
+    ...binding,
+    ...resolveProviderExecutableBinding(binding.harness_id, options),
+  }));
+  return Object.freeze({
+    ...input,
+    installation: Object.freeze({ ...input.installation, enabled_providers: Object.freeze(enabled_providers) }),
+  });
+}

package/src/installer-v2/wizard-installation.js

@@ -109,7 +109,7 @@ export function buildWizardV2InstallationInput({
   return Object.freeze({
     project_id: `project-${projectSlug}`,
     installation,
-    capability_snapshot: { snapshot_id: snapshotId, expires_at: expiresAt, models },
+    capability_snapshot: { snapshot_id: snapshotId, source_catalog_ref: sourceCatalogId, expires_at: expiresAt, models },
   });
 }
 

package/src/orchestrator/browser-runtime.js

@@ -1,25 +1,56 @@
-import { assertBrowserCapabilityForTask, BrowserCapability } from '@chati/browser-capability';
+import { canonicalize, sha256 } from '@chati/core';
+import { assertBrowserCapabilityForTask, validateBrowserLaunchRequest } from '@chati/browser-capability';
 
 /**
- * G3 browser boundary. This runtime has no reference to Playwright, Chrome,
- * MCP, credentials or a shared profile. It can only validate a task policy and
- * use the internal fake adapter supplied by BrowserCapability.
+ * Production browser boundary. It authorizes a policy-bound delegation to the
+ * selected harness but never claims that a browser was launched. The harness
+ * must later produce real, redacted browser evidence for review and completion.
  */
 export function createProjectBrowserSession({ task, request } = {}) {
   const policy = assertBrowserCapabilityForTask(task);
-  if (!policy) return Object.freeze({ state: 'not-required', manifest: null, capability: null });
-  const capability = new BrowserCapability({});
-  const manifest = capability.preflight({ ...request, policy });
-  return Object.freeze({ state: 'preflighted', policy, manifest, capability });
+  if (!policy) return Object.freeze({ state: 'not-required', manifest: null, policy: null });
+  const validatedRequest = validateBrowserLaunchRequest(request, policy);
+  const core = canonicalize({
+    schema_version: 1,
+    manifest_type: 'BrowserDelegationManifest',
+    browser_session_id: validatedRequest.browser_session_id,
+    task_id: validatedRequest.task_id,
+    policy_ref: policy.policy_id,
+    mode: policy.mode,
+    tool: policy.tool,
+    allowed_domain: validatedRequest.hostname,
+    profile_isolation: policy.profile_isolation,
+    classification: validatedRequest.classification,
+    evidence_class: 'delegation-only',
+    artifact_policy: policy.artifact_policy,
+    action_confirmation: policy.action_confirmation,
+    ...(validatedRequest.tenant_ref ? { tenant_ref: validatedRequest.tenant_ref } : {}),
+    ...(validatedRequest.action_confirmation_ref ? { action_confirmation_ref: validatedRequest.action_confirmation_ref } : {}),
+    delegation: { adapter: 'selected-harness-browser-tool', status: 'authorized', evidence_status: 'required' },
+  });
+  const manifest = Object.freeze(canonicalize({ ...core, manifest_hash: sha256(core) }));
+  return Object.freeze({ state: 'authorized', policy, request: validatedRequest, manifest });
 }
 
-/** Only the same local session may advance its fake adapter past preflight. */
+/** Marks the validated request as delegated, without fabricating launch I/O. */
 export function launchProjectBrowserSession({ session, request } = {}) {
-  if (!session || session.state !== 'preflighted' || !session.capability || !session.policy) {
-    const error = new Error('browser launch requires a preflighted project-local browser session');
+  if (!session || session.state !== 'authorized' || !session.policy || !session.request) {
+    const error = new Error('browser delegation requires an authorized project-local browser session');
     error.code = 'BROWSER_PREFLIGHT_REQUIRED';
     throw error;
   }
-  const manifest = session.capability.launch({ ...request, policy: session.policy });
-  return Object.freeze({ state: 'launched', manifest, fake_launches: session.capability.fakeLaunches, capability: session.capability, policy: session.policy });
+  const validated = validateBrowserLaunchRequest(request, session.policy);
+  if (sha256(validated) !== sha256(session.request)) {
+    const error = new Error('browser delegation request changed after authorization');
+    error.code = 'BROWSER_REQUEST_CHANGED';
+    throw error;
+  }
+  const priorManifest = { ...session.manifest };
+  delete priorManifest.manifest_hash;
+  const core = canonicalize({
+    ...priorManifest,
+    delegation: { adapter: 'selected-harness-browser-tool', status: 'delegated', evidence_status: 'required' },
+  });
+  const manifest = Object.freeze(canonicalize({ ...core, manifest_hash: sha256(core) }));
+  return Object.freeze({ state: 'delegated', manifest, policy: session.policy });
 }