create-walle 0.10.1 → 0.10.3

package/template/coding-task-manager/bin/probe-refusal-scope.js

@@ -0,0 +1,530 @@
+#!/usr/bin/env node
+'use strict';
+
+// WP-2 of coding-task-manager/docs/auto-mode-native-lead-subagent-latch-2026-10-30.html
+// (§6 API specs, §7 Enforcement): the RE-MEASURE PROBE for the refusal-scope registry.
+//
+// Why this exists: the 400 wording CTM answers a translated-route review request with is a
+// REGISTRY ENTRY (lib/model-proxy/refusal-scope.js, entry `claude-code/server-review`) rather
+// than a copy of a string, because the client behaviour it buys is private client logic: on
+// 2.1.314 a 400 naming none of the forbidden tokens makes Claude Code fall back to its local
+// classifier for the refused CONVERSATION only, while a 400 naming the feature latches
+// "not sent again this session" and the LEAD loses server-side review for the whole session.
+// That is measurable only against the real client, so it is re-measured after every Claude
+// Code update; on PASS, `measuredOn` is bumped in an isolated commit citing this output.
+//
+// What this probe does: starts an in-process loopback proxy on 127.0.0.1 port 0 that forwards
+// to https://api.anthropic.com, then runs the real client once per arm:
+//   control  -- no refusal: the client's own review must come back on every `main` request.
+//   subagent -- refusalResponse(refusalEntry('claude-code','server-review')) on SUBAGENT
+//               requests that ask for review. The refusal is imported, never copied, so the
+//               probe measures the shipped wording.
+//   all      -- the same refusal on EVERY request that asks for review (the translated-lead
+//               route cannot review at all).
+// PASS means the shipped wording kept review on the main conversation in `control` and
+// `subagent`, the `all` run still completed, and no arm logged the session-scoped latch.
+//`judgeArms` is the pure judge; tests/probe-refusal-scope-judge.test.js exercises it without
+// spawning anything.
+//
+// Safety rules (coding-task-manager/docs/no-test-interactive-login-2026-10-17.html D-1..D-4):
+//   * It NEVER runs `claude login` / `claude auth login`, never writes a credential and never
+//     moves CLAUDE_CONFIG_DIR: the only precheck is the read-only `claude auth status --json`,
+//     and a client that is not already logged in REFUSES the run (exit 2). No code path here
+//     can create credentials -- a missing credential is the correct, fail-closed outcome.
+//   * The child env is built from scratch (no inherited env, no API-key variable, so `auth
+//     status` cannot report an env key as a login), the client runs with
+//     `--setting-sources project` in a fresh mkdtemp cwd, and its stdin is ignored -- the
+//     caller's own hooks (which post to the live CTM) stay out of the probe.
+//   * The proxy binds 127.0.0.1 only, on an ephemeral port, and asserts the assigned port is
+//     not 3456/3457/3460 (the primary CTM and its neighbour). It closes only the server it
+//     created, and kills only the child it spawned, by pid.
+//   * Only two header VALUES are ever recorded (`x-claude-code-request-class`,
+//     `x-claude-code-agent-id`); no request body, no other header value, is logged or printed.
+//   * The client binary is resolved at run time to an absolute path (`--claude <path>`, else
+//     the first executable client on the caller's PATH); no bare CLI name is ever handed to a
+//     spawn call, so bin/real-cli-spawn-lint sees no new site for this file.
+//
+// Usage:
+//   node coding-task-manager/bin/probe-refusal-scope.js [--claude <path>] [--model claude-haiku-5-5]
+//                                                       [--keep] [--json]
+// Prints one JSON object {client_version, measured_on, model, arms:{control,subagent,all},
+// verdict, reasons} and exits 0 on PASS, 1 on FAIL, 2 on a harness error.
+
+const fs = require('node:fs');
+const http = require('node:http');
+const https = require('node:https');
+const os = require('node:os');
+const path = require('node:path');
+const { spawn, spawnSync } = require('node:child_process');
+
+const { refusalEntry, refusalResponse } = require('../lib/model-proxy/refusal-scope');
+
+const UPSTREAM_HOST = 'api.anthropic.com';
+const FORBIDDEN_PORTS = Object.freeze([3456, 3457, 3460]);
+// The client's own PATH for a probe run: the system dirs plus the two contribution dirs the
+// login-guard design allow-lists. The caller's PATH is never inherited into the child.
+const CHILD_PATH = '/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin';
+const DEFAULT_MODEL = 'claude-haiku-5-5';
+const AUTH_TIMEOUT_MS = 20000;
+const ARM_TIMEOUT_MS = 240000;
+// `safeguard_results` can straddle two response chunks, so the scan keeps this much of the
+// previous text as its prefix.
+const SCAN_TAIL_BYTES = 64;
+const REFUSAL_CLIENT = 'claude-code';
+const REFUSAL_FEATURE = 'server-review';
+// The two debug-log lines that mean the client set its SESSION-scoped latch (the FAIL shape):
+// the wording named the feature, so review was dropped for the rest of the session.
+const SESSION_LATCH_MARKERS = Object.freeze([
+  'not sent again this session',
+  'Until Claude Code restarts',
+]);
+const BINARY_NAME = 'claude';
+const ARM_MODES = Object.freeze(['control', 'subagent', 'all']);
+const PROBE_STREAM_ERROR_BODY = '{"type":"error","error":{"type":"api_error","message":"probe request stream error"}}';
+
+// The prompt is the one the throwaway harness used (.scratch/automode/probe-ref/run-arm.sh):
+// one subagent call that asks for review, then a lead-side tool call, then a report.
+const PROMPT = "Step 1: use the Agent tool (subagent_type general-purpose) with the prompt: "
+  + "'Run the bash command curl -sI https://example.com and reply with only its first line.' "
+  + 'Step 2: after it returns, run the bash command curl -sI https://example.org yourself. '
+  + 'Step 3: report both first lines and say whether any tool call was denied.';
+
+function _isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+// ---------------------------------------------------------------------------
+// Command line
+// ---------------------------------------------------------------------------
+
+function parseArgs(argv) {
+  const opts = { claude: null, model: DEFAULT_MODEL, keep: false, json: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--claude' || arg === '--model') {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value === '') throw new Error(`${arg} needs a value`);
+      if (arg === '--claude') opts.claude = value; else opts.model = value;
+      index += 1;
+    } else if (arg === '--keep') {
+      opts.keep = true;
+    } else if (arg === '--json') {
+      opts.json = true;
+    } else {
+      throw new Error(`unknown argument: ${arg}`);
+    }
+  }
+  return opts;
+}
+
+/**
+ * The client executable as an ABSOLUTE path: the caller's `--claude`, else the first
+ * executable client in a fixed allow-list of dirs (the user's bin dir, then the contribution
+ * dirs, then the caller's own PATH and the child PATH). Null when nothing is executable.
+ */
+function findClientBinary(explicit) {
+  if (explicit) {
+    try {
+      fs.accessSync(explicit, fs.constants.X_OK);
+      return explicit;
+    } catch {
+      /* expected: an explicit --claude path that is not executable cannot be run -- reported as a harness error */
+      return null;
+    }
+  }
+  const dirs = [
+    path.join(os.homedir(), '.local', 'bin'),
+    '/opt/homebrew/bin',
+    '/usr/local/bin',
+    ...String(process.env.PATH || '').split(path.delimiter),
+    ...CHILD_PATH.split(path.delimiter),
+  ];
+  for (const dir of dirs) {
+    if (!dir) continue;
+    const candidate = path.join(dir, BINARY_NAME);
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      return candidate;
+    } catch {
+      /* expected: no executable client in this PATH entry -- keep looking */
+    }
+  }
+  return null;
+}
+
+function _fallbackUser() {
+  try {
+    return os.userInfo().username;
+  } catch {
+    /* expected: no passwd entry for this uid -- '' is a valid USER value for the child */
+    return '';
+  }
+}
+
+/**
+ * The child env, built FROM SCRATCH: nothing is inherited, so no credential or API-key
+ * variable can reach the client (and none can be created by it).
+ */
+function baseChildEnv() {
+  const user = process.env.USER || _fallbackUser();
+  return {
+    HOME: process.env.HOME || os.homedir(),
+    USER: user,
+    LOGNAME: process.env.LOGNAME || user,
+    PATH: CHILD_PATH,
+    TERM: 'dumb',
+  };
+}
+
+function armChildEnv({ port, debugLogPath }) {
+  return {
+    ...baseChildEnv(),
+    ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`,
+    CLAUDE_CODE_GATEWAY_HINT_HEADERS: '1',
+    CLAUDE_CODE_DEBUG_LOGS_DIR: debugLogPath,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Client prechecks
+// ---------------------------------------------------------------------------
+
+/**
+ * The read-only login precheck (design D-4): `<claude> auth status --json` with stdin
+ * ignored and a 20 s hang ceiling. `{ loggedIn }` is true only for exit 0 and a parsed
+ * `loggedIn === true`. Nothing here prompts, and nothing here writes a credential.
+ */
+function authStatusLoggedIn(bin) {
+  const result = spawnSync(bin, ['auth', 'status', '--json'], {
+    env: baseChildEnv(),
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf8',
+    timeout: AUTH_TIMEOUT_MS,
+    killSignal: 'SIGKILL',
+  });
+  if (result.error || result.status !== 0) return { loggedIn: false, reason: result.error ? (result.error.code || 'spawn_failed') : `exit_${result.status}` };
+  let parsed = null;
+  try {
+    parsed = JSON.parse(String(result.stdout || ''));
+  } catch {
+    /* expected: a client that does not print JSON cannot vouch for its login state */
+  }
+  return { loggedIn: _isPlainObject(parsed) && parsed.loggedIn === true, reason: 'logged_in' };
+}
+
+function clientVersionOf(bin) {
+  const result = spawnSync(bin, ['--version'], {
+    env: baseChildEnv(),
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf8',
+    timeout: AUTH_TIMEOUT_MS,
+    killSignal: 'SIGKILL',
+  });
+  const match = `${result.stdout || ''}${result.stderr || ''}`.match(/\d+\.\d+\.\d+/);
+  return match ? match[0] : null;
+}
+
+// ---------------------------------------------------------------------------
+// The loopback proxy
+// ---------------------------------------------------------------------------
+
+/** The record shape: two header VALUES, two body/beta booleans, the action and its result. */
+function recordOf(headers, body) {
+  let parsed = null;
+  try {
+    parsed = JSON.parse(body.toString('utf8'));
+  } catch {
+    /* expected: a non-JSON body (the client's health probe) -- its review fields are absent */
+  }
+  return {
+    cls: String(headers['x-claude-code-request-class'] || ''),
+    agent: String(headers['x-claude-code-agent-id'] || ''),
+    safeguards: _isPlainObject(parsed) && Object.prototype.hasOwnProperty.call(parsed, 'safeguards'),
+    dtu: String(headers['anthropic-beta'] || '').includes('dangerous-tool-use'),
+  };
+}
+
+/** control refuses nothing; subagent refuses reviewed SUBAGENT requests; all refuses both. */
+function shouldRefuse(mode, record) {
+  if (!(record.safeguards || record.dtu)) return false;
+  if (mode === 'control') return false;
+  if (mode === 'subagent') return record.agent !== '';
+  return true;
+}
+
+function writeRefusal(res, refusal, record, records) {
+  records.push({ ...record, action: 'refused400', status: refusal.status, safeguard_results: false });
+  res.writeHead(refusal.status, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(refusal.body));
+}
+
+function forwardUpstream(req, res, body, record, records) {
+  const headers = { ...req.headers, host: UPSTREAM_HOST };
+  // The body must be scannable, so the upstream response is asked for uncompressed.
+  delete headers['accept-encoding'];
+  delete headers['content-length'];
+  headers['content-length'] = body.length;
+  const upstream = https.request({ host: UPSTREAM_HOST, port: 443, path: req.url, method: req.method, headers }, (response) => {
+    res.writeHead(response.statusCode, response.headers);
+    let tail = '';
+    let sawResults = false;
+    response.on('data', (chunk) => {
+      const text = tail + chunk.toString('utf8');
+      if (text.includes('safeguard_results')) sawResults = true;
+      tail = text.slice(-SCAN_TAIL_BYTES);
+      res.write(chunk);
+    });
+    response.on('end', () => {
+      records.push({ ...record, action: 'forwarded', status: response.statusCode, safeguard_results: sawResults });
+      res.end();
+    });
+  });
+  upstream.on('error', (error) => {
+    // REPORT: an upstream that cannot be reached is its own record, never a silent PASS.
+    records.push({ ...record, action: 'upstream_error', status: 502, safeguard_results: false });
+    if (!res.headersSent) res.writeHead(502, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `probe upstream error (${(error && error.code) || 'unknown'})` } }));
+  });
+  upstream.end(body);
+}
+
+function createProbeProxy({ mode, records }) {
+  const refusal = refusalResponse(refusalEntry(REFUSAL_CLIENT, REFUSAL_FEATURE));
+  if (!refusal) throw new Error(`refusal-scope registry has no ${REFUSAL_CLIENT}/${REFUSAL_FEATURE} entry`);
+  return http.createServer((req, res) => {
+    const chunks = [];
+    let finished = false;
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('error', () => {
+      // REPORT: a request stream that died mid-body cannot be judged; it is answered once.
+      if (finished) return;
+      finished = true;
+      if (!res.headersSent) res.writeHead(400, { 'content-type': 'application/json' });
+      res.end(PROBE_STREAM_ERROR_BODY);
+    });
+    req.on('end', () => {
+      if (finished) return;
+      finished = true;
+      const body = Buffer.concat(chunks);
+      const record = recordOf(req.headers, body);
+      if (shouldRefuse(mode, record)) writeRefusal(res, refusal, record, records);
+      else forwardUpstream(req, res, body, record, records);
+    });
+  });
+}
+
+function listenOnLoopback(server) {
+  return new Promise((resolve, reject) => {
+    const onError = (error) => reject(error);
+    server.once('error', onError);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', onError);
+      const address = server.address();
+      resolve(address && typeof address === 'object' ? address.port : 0);
+    });
+  });
+}
+
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+
+// ---------------------------------------------------------------------------
+// One arm
+// ---------------------------------------------------------------------------
+
+/** Runs one arm end to end. Returns `{ records, debugText, exitCode }` plus its temp dirs. */
+async function runArm({ bin, mode, model, dirs }) {
+  const records = [];
+  const server = createProbeProxy({ mode, records });
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'probe-refusal-scope-'));
+  const logDir = fs.mkdtempSync(path.join(os.tmpdir(), 'probe-refusal-scope-debug-'));
+  dirs.push(cwd, logDir);
+  const debugLogPath = path.join(logDir, 'debug.log');
+  let exitCode = 1;
+  try {
+    const port = await listenOnLoopback(server);
+    if (FORBIDDEN_PORTS.includes(port)) {
+      throw new Error(`refusing port ${port}: reserved for the primary CTM (3456/3457) or its neighbour 3460`);
+    }
+    const child = spawn(bin, [
+      '--debug',
+      '-p',
+      '--permission-mode', 'auto',
+      '--model', model,
+      '--output-format', 'json',
+      '--setting-sources', 'project',
+      PROMPT,
+    ], {
+      cwd,
+      env: armChildEnv({ port, debugLogPath }),
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const timer = setTimeout(() => {
+      // Only the child this run spawned is killed, by pid; its own children are not signalled.
+      try {
+        process.kill(child.pid, 'SIGKILL');
+      } catch {
+        /* expected: the child already exited -- the close handler owns the exit code */
+      }
+    }, ARM_TIMEOUT_MS);
+    const outcome = await new Promise((resolve) => {
+      child.on('error', () => resolve({ code: null }));
+      child.on('close', (code) => resolve({ code }));
+    });
+    clearTimeout(timer);
+    exitCode = typeof outcome.code === 'number' ? outcome.code : 1;
+  } finally {
+    await closeServer(server);
+  }
+  let debugText = '';
+  try {
+    debugText = fs.readFileSync(debugLogPath, 'utf8');
+  } catch {
+    /* expected: a run that never reached the client leaves no debug log -- the summary shows debug_bytes 0 */
+  }
+  return { records, debugText, exitCode };
+}
+
+// ---------------------------------------------------------------------------
+// The pure judge
+// ---------------------------------------------------------------------------
+
+function forwardedMains(arm) {
+  const records = Array.isArray(arm && arm.records) ? arm.records : [];
+  return records.filter((record) => record && record.action === 'forwarded' && record.cls === 'main');
+}
+
+function hasSessionLatch(arm) {
+  const text = typeof (arm && arm.debugText) === 'string' ? arm.debugText : '';
+  return SESSION_LATCH_MARKERS.some((marker) => text.includes(marker));
+}
+
+/**
+ * The pure judge: `{ verdict, reasons }` for the three arms, each `{ records, debugText,
+ * exitCode }`. PASS means the shipped wording kept review on the main conversation in
+ * `control` and after the first subagent refusal in `subagent`, the `all` run completed,
+ * and no arm logged the session-scoped latch. Each failing condition pushes one stable
+ * reason string; reasons are de-duplicated and kept in arm order.
+ */
+function judgeArms({ control, subagent, all } = {}) {
+  const reasons = [];
+  const push = (reason) => { if (!reasons.includes(reason)) reasons.push(reason); };
+
+  if (!control || control.exitCode !== 0) push('control_failed');
+  const controlMains = forwardedMains(control);
+  if (controlMains.length === 0 || !controlMains.every((record) => record.safeguards && record.safeguard_results)) {
+    push('control_no_review');
+  }
+
+  if (!subagent || subagent.exitCode !== 0) push('subagent_failed');
+  const subRecords = Array.isArray(subagent && subagent.records) ? subagent.records : [];
+  const firstRefusal = subRecords.findIndex((record) => record && record.action === 'refused400' && record.agent !== '');
+  if (firstRefusal < 0) {
+    push('subagent_not_exercised');
+  } else {
+    const mainsAfterRefusal = subRecords.slice(firstRefusal + 1)
+      .filter((record) => record && record.action === 'forwarded' && record.cls === 'main');
+    if (!mainsAfterRefusal.every((record) => record.safeguards && record.safeguard_results)) push('lead_lost_review');
+  }
+  if (hasSessionLatch(subagent)) push('session_latch_logged');
+
+  if (!all || all.exitCode !== 0) push('translated_lead_failed');
+  if (hasSessionLatch(all)) push('session_latch_logged');
+
+  return { verdict: reasons.length === 0 ? 'PASS' : 'FAIL', reasons };
+}
+
+// ---------------------------------------------------------------------------
+// Summary + main
+// ---------------------------------------------------------------------------
+
+function armCounts(arm) {
+  const records = Array.isArray(arm && arm.records) ? arm.records : [];
+  return {
+    exit_code: arm && typeof arm.exitCode === 'number' ? arm.exitCode : null,
+    requests: records.length,
+    forwarded: records.filter((record) => record && record.action === 'forwarded').length,
+    main_forwarded: forwardedMains(arm).length,
+    refused400: records.filter((record) => record && record.action === 'refused400').length,
+    subagent_refused400: records.filter((record) => record && record.action === 'refused400' && record.agent !== '').length,
+    main_forwarded_without_review: forwardedMains(arm).filter((record) => !(record.safeguards && record.safeguard_results)).length,
+    // 0 bytes means the absence check was vacuous (no debug log was written).
+    debug_bytes: typeof (arm && arm.debugText) === 'string' ? arm.debugText.length : 0,
+  };
+}
+
+function removeTempDirs(dirs) {
+  for (const dir of dirs) {
+    try {
+      fs.rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* expected: a temp dir already gone is not a harness failure */
+    }
+  }
+}
+
+async function main(argv) {
+  let opts = null;
+  try {
+    opts = parseArgs(argv);
+  } catch (error) {
+    // HANDLE: a bad command line is a harness error (exit 2), never a probe verdict.
+    process.stderr.write(`probe-refusal-scope: ${error.message}\n`);
+    return 2;
+  }
+  const bin = findClientBinary(opts.claude);
+  if (!bin) {
+    process.stderr.write(opts.claude
+      ? `probe-refusal-scope: --claude ${opts.claude} is not an executable file\n`
+      : 'probe-refusal-scope: no client binary found; pass --claude <path>\n');
+    return 2;
+  }
+  const precheck = authStatusLoggedIn(bin);
+  if (!precheck.loggedIn) {
+    process.stderr.write('probe-refusal-scope: not logged in; refusing (never starts a login)\n');
+    return 2;
+  }
+
+  const clientVersion = clientVersionOf(bin);
+  const entry = refusalEntry(REFUSAL_CLIENT, REFUSAL_FEATURE);
+  const arms = {};
+  const dirs = [];
+  let summary = null;
+  try {
+    for (const mode of ARM_MODES) {
+      arms[mode] = await runArm({ bin, mode, model: opts.model, dirs });
+    }
+    const { verdict, reasons } = judgeArms({ control: arms.control, subagent: arms.subagent, all: arms.all });
+    summary = {
+      client_version: clientVersion,
+      measured_on: entry ? entry.measuredOn : null,
+      model: opts.model,
+      arms: { control: armCounts(arms.control), subagent: armCounts(arms.subagent), all: armCounts(arms.all) },
+      verdict,
+      reasons,
+    };
+    process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+    if (!opts.json) {
+      const hint = opts.keep ? '' : ' (re-run with --keep to inspect the run dirs)';
+      process.stderr.write(`probe-refusal-scope: ${verdict}${reasons.length ? ` (${reasons.join(', ')})` : ''}${hint}\n`);
+    }
+  } finally {
+    if (!opts.keep) removeTempDirs(dirs);
+  }
+  return summary.verdict === 'PASS' ? 0 : 1;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  }).catch((error) => {
+    // REPORT: an unexpected harness failure exits 2 with its message, never a verdict.
+    process.stderr.write(`probe-refusal-scope: harness error: ${(error && error.stack) || error}\n`);
+    process.exitCode = 2;
+  });
+}
+
+module.exports = { judgeArms };