create-walle 0.9.25 → 0.9.26

package/template/claude-task-manager/lib/codesign-identity.js

@@ -0,0 +1,140 @@
+'use strict';
+
+// macOS code-signing identity helpers, shared between the CTM server (api-prompts.js, for the
+// hotkey + screen-auth helpers) and the standalone daemon-node provisioner (bin/ensure-stable-node.js).
+// Kept dependency-free (only Node built-ins) so the provisioner can require it WITHOUT pulling in
+// the whole server module (db, queue-engine, approval-agent, …).
+//
+// Why a stable identity matters: a Developer-ID signature carries a Team Identifier, giving a
+// binary a stable, OS-trusted Designated Requirement. macOS keys a TCC grant to that requirement,
+// so a Developer-ID (or notarized) binary keeps its grant across rebuilds/restarts; a self-signed
+// or ad-hoc binary does not. Without a Developer ID (most end users) we fall back to a stable
+// self-signed local cert.
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execFileSync, spawnSync } = require('child_process');
+
+const SIGN_IDENTITY_CN = 'Wall-E Local Signing';
+const SIGN_KEYCHAIN = path.join(os.homedir(), '.walle', 'walle-signing.keychain-db');
+
+function signLocalCtmBinary(binaryPath, identifier) {
+  if (process.platform !== 'darwin' || !fs.existsSync(SIGN_KEYCHAIN)) return false;
+  try {
+    try {
+      execFileSync('security', ['unlock-keychain', '-p', 'walle', SIGN_KEYCHAIN], { stdio: 'ignore' });
+    } catch {}
+    const certs = execFileSync(
+      'security',
+      ['find-certificate', '-a', '-c', SIGN_IDENTITY_CN, '-Z', SIGN_KEYCHAIN],
+      { encoding: 'utf8' },
+    );
+    const match = certs.match(/SHA-1 hash:\s*([0-9A-Fa-f]{40})/);
+    if (!match) return false;
+    try {
+      execFileSync(
+        'security',
+        ['set-key-partition-list', '-S', 'apple-tool:,apple:', '-s', '-k', 'walle', SIGN_KEYCHAIN],
+        { stdio: 'ignore' },
+      );
+    } catch {}
+    execFileSync(
+      'codesign',
+      ['--force', '--sign', match[1], '--identifier', identifier, '--keychain', SIGN_KEYCHAIN, binaryPath],
+      { stdio: 'ignore', timeout: 120000 },
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Returns the SHA-1 hash of an available "Developer ID Application" codesigning identity, or ''.
+function developerIdIdentityHash() {
+  if (process.platform !== 'darwin') return '';
+  try {
+    const out = execFileSync('security', ['find-identity', '-v', '-p', 'codesigning'], { encoding: 'utf8' });
+    const match = out.match(/([0-9A-Fa-f]{40})\s+"Developer ID Application:[^"]*"/);
+    return match ? match[1] : '';
+  } catch {
+    return '';
+  }
+}
+
+// Sign a local CTM helper with the best available identity: Developer ID first (stable team id
+// → persistent TCC grant + honored system prompt), else the stable self-signed local cert.
+function signCtmBinaryPreferDeveloperId(binaryPath, identifier) {
+  const devId = developerIdIdentityHash();
+  if (devId) {
+    try {
+      execFileSync(
+        'codesign',
+        ['--force', '--sign', devId, '--identifier', identifier, binaryPath],
+        { stdio: 'ignore', timeout: 120000 },
+      );
+      return { signed: true, identity: 'developer-id' };
+    } catch {}
+  }
+  const ok = signLocalCtmBinary(binaryPath, identifier);
+  return { signed: ok, identity: ok ? 'self-signed' : null };
+}
+
+// Developer-ID-sign a whole .app bundle DIRECTORY (with --deep, so the cloned node exec AND its
+// co-located @rpath dylibs in Contents/lib are all covered). Used to give a branded daemon bundle
+// (Coding Task Manager.app / Wall-E.app) a STABLE Team Identifier so its TCC grants persist AND
+// macOS keeps showing the bundle's CFBundleName in prompts (Info.plist is untouched by signing).
+// Returns { signed, identity }. No-op without a Developer ID (returns { signed:false }) — callers
+// fall back to the notarized bare node; we never self-sign here (self-signed gives no stable Team
+// ID and re-introduces the per-restart re-prompt this is meant to fix).
+function devIdSignBundle(bundleAppDir, identifier) {
+  const devId = developerIdIdentityHash();
+  if (!devId) return { signed: false, identity: null };
+  try {
+    execFileSync(
+      'codesign',
+      ['--force', '--deep', '--sign', devId, '--identifier', identifier, bundleAppDir],
+      { stdio: 'ignore', timeout: 120000 },
+    );
+    return { signed: true, identity: 'developer-id' };
+  } catch {
+    return { signed: false, identity: null };
+  }
+}
+
+function localCodeSignIdentifier(binaryPath) {
+  if (process.platform !== 'darwin' || !binaryPath || !fs.existsSync(binaryPath)) return '';
+  try {
+    const out = spawnSync('codesign', ['-dv', '--verbose=4', binaryPath], { encoding: 'utf8' });
+    const text = `${out.stdout || ''}\n${out.stderr || ''}`;
+    const match = text.match(/^Identifier=(.+)$/m);
+    return match ? match[1].trim() : '';
+  } catch {
+    return '';
+  }
+}
+
+// The signing Team Identifier, or '' when unsigned/self-signed. Present ⇒ Developer-ID signed.
+function localCodeSignTeamId(binaryPath) {
+  if (process.platform !== 'darwin' || !binaryPath || !fs.existsSync(binaryPath)) return '';
+  try {
+    const out = spawnSync('codesign', ['-dv', '--verbose=4', binaryPath], { encoding: 'utf8' });
+    const text = `${out.stdout || ''}\n${out.stderr || ''}`;
+    const match = text.match(/^TeamIdentifier=(.+)$/m);
+    const team = match ? match[1].trim() : '';
+    return team === 'not set' ? '' : team;
+  } catch {
+    return '';
+  }
+}
+
+module.exports = {
+  SIGN_IDENTITY_CN,
+  SIGN_KEYCHAIN,
+  signLocalCtmBinary,
+  developerIdIdentityHash,
+  signCtmBinaryPreferDeveloperId,
+  devIdSignBundle,
+  localCodeSignIdentifier,
+  localCodeSignTeamId,
+};

package/template/claude-task-manager/lib/codex-app-server-client.js

@@ -0,0 +1,119 @@
+'use strict';
+
+// Codex app-server JSON-RPC client (driven mode).
+//
+// Spawns `codex app-server` and drives a conversation over newline-delimited JSON-RPC
+// stdio, answering the server-initiated approval requests through the shared
+// decideApproval cascade (via codex-approval-bridge) instead of PTY-scraping the TUI.
+// This is the engine for a future CTM-driven-Codex session type; the message framing,
+// id correlation, and approval dispatch are testable without a real process via the
+// `transport` injection.
+//
+// Validated against codex-cli 0.132.0 (see docs/codex-app-server-approvals.md).
+
+const { spawn } = require('child_process');
+const bridge = require('./codex-approval-bridge');
+
+// A transport is { write(jsonString), onLine(cb), close() }. The default spawns codex;
+// tests inject a fake one to drive the client deterministically.
+function spawnCodexTransport({ cwd, env, spawnFn = spawn, command = 'codex', args = ['app-server'] } = {}) {
+  const child = spawnFn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], cwd, env });
+  let buf = '';
+  let lineCb = null;
+  child.stdout.on('data', (d) => {
+    buf += d.toString();
+    let i;
+    while ((i = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, i); buf = buf.slice(i + 1);
+      if (line.trim() && lineCb) lineCb(line);
+    }
+  });
+  return {
+    write: (s) => { try { child.stdin.write(s + '\n'); } catch {} },
+    onLine: (cb) => { lineCb = cb; },
+    close: () => { try { child.kill(); } catch {} },
+    _child: child,
+  };
+}
+
+// decide(context, kind) → Promise<'allow'|'deny'|'abort'>. onItem/onNotification get the
+// streamed turn/item events (the UI surface). onApproval (optional) is notified of each
+// approval request + resolution for logging/telemetry.
+function createCodexAppServerClient({ transport, decide, onItem, onNotification, onApproval, log = () => {} } = {}) {
+  if (!transport) throw new Error('createCodexAppServerClient: transport required');
+  let nextId = 1;
+  const pending = new Map(); // id → { resolve, reject }
+
+  const send = (obj) => transport.write(JSON.stringify(obj));
+  function request(method, params) {
+    const id = nextId++;
+    return new Promise((resolve, reject) => {
+      pending.set(id, { resolve, reject });
+      send({ id, method, params: params || {} });
+    });
+  }
+  function respond(id, result) { send({ id, result }); }
+
+  async function handleMessage(msg) {
+    if (!msg || typeof msg !== 'object') return;
+    // 1) a response to one of OUR requests
+    if (msg.id != null && (Object.prototype.hasOwnProperty.call(msg, 'result') || msg.error) && pending.has(msg.id)) {
+      const p = pending.get(msg.id); pending.delete(msg.id);
+      if (msg.error) p.reject(Object.assign(new Error(msg.error.message || 'rpc error'), { rpc: msg.error }));
+      else p.resolve(msg.result);
+      return;
+    }
+    // 2) a SERVER-initiated request (id + method) — approvals live here
+    if (msg.id != null && msg.method) {
+      const appr = bridge.parseCodexApprovalRequest(msg.method, msg.params || {});
+      if (appr) {
+        let decision = 'deny';
+        try { decision = (await decide(appr.context, appr.kind)) || 'deny'; }
+        catch (e) { decision = 'deny'; log('[codex-client] decide() threw, denying:', e.message); }
+        respond(msg.id, bridge.buildCodexApprovalResponse(decision, appr.protocol));
+        if (onApproval) { try { onApproval({ method: msg.method, kind: appr.kind, decision, context: appr.context }); } catch {} }
+        return;
+      }
+      // Unknown server request — answer with an empty result so the agent isn't wedged.
+      respond(msg.id, {});
+      return;
+    }
+    // 3) a notification (method, no id)
+    if (msg.method) {
+      if (/^item\//.test(msg.method)) { if (onItem) { try { onItem(msg.method, msg.params); } catch {} } }
+      else if (onNotification) { try { onNotification(msg.method, msg.params); } catch {} }
+    }
+  }
+
+  transport.onLine((line) => {
+    let msg; try { msg = JSON.parse(line); } catch { return; }
+    handleMessage(msg);
+  });
+
+  async function initialize(clientInfo = { name: 'ctm', version: '1.0.0' }) {
+    const result = await request('initialize', { clientInfo });
+    send({ method: 'initialized', params: {} }); // notification, no id
+    return result;
+  }
+  // Route approvals to us (approvalsReviewer:user) and ask on request; workspace-write
+  // sandbox so the agent runs contained by default. Caller may override any field.
+  function startThread(opts = {}) {
+    return request('thread/start', {
+      approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write',
+      ...opts,
+    });
+  }
+  function startTurn(threadId, input, opts = {}) {
+    const inp = typeof input === 'string' ? [{ type: 'text', text: input }] : input;
+    return request('turn/start', { threadId, input: inp, ...opts });
+  }
+
+  return {
+    initialize, startThread, startTurn, request,
+    close: () => transport.close(),
+    // exposed for unit tests
+    _handleMessage: handleMessage,
+  };
+}
+
+module.exports = { createCodexAppServerClient, spawnCodexTransport };

package/template/claude-task-manager/lib/codex-approval-bridge.js

@@ -0,0 +1,118 @@
+'use strict';
+
+// Codex app-server approval bridge.
+//
+// Codex (OpenAI CLI) exposes a JSON-RPC app-server over stdio. When the agent wants to
+// run a command or apply a patch it sends the CLIENT a server-initiated REQUEST and
+// BLOCKS the turn until the client answers with a decision keyed by the request id.
+// This is Codex's analog of Claude's PreToolUse hook — structured, bound to the exact
+// tool call, no PTY scrape, no TOCTOU.
+//
+// Verified against codex-cli 0.132.0 (see memory ctm-approver-protocol-hook-prototype-
+// validated). The binary is mid-migration: it emits TWO protocol generations depending
+// on what the client negotiates, so a robust bridge handles BOTH:
+//   v2 (current):  item/commandExecution/requestApproval, item/fileChange/requestApproval,
+//                  item/permissions/requestApproval  — decisions camelCase
+//                  (accept | acceptForSession | decline | cancel)
+//   legacy:        execCommandApproval, applyPatchApproval — decisions snake_case
+//                  (approved | approved_for_session | denied | abort)
+//
+// This module is PURE (no child process / no I/O) so it unit-tests the exact wire
+// mapping. The stdio client that drives a real `codex app-server` composes these.
+
+// Recognize an incoming server→client method as an approval request and normalize it
+// to { kind, protocol, context } for the shared decideApproval cascade. Returns null
+// for non-approval methods (notifications, other requests).
+//   kind:     'command' | 'patch' | 'permissions'
+//   protocol: 'v2' | 'legacy'   (decides the response vocabulary)
+//   context:  { toolName, command, warning, fullContext }  (decideApproval input)
+function parseCodexApprovalRequest(method, params = {}) {
+  switch (method) {
+    case 'item/commandExecution/requestApproval': {
+      // v2 gives a `command` display string + parsed commandActions (not raw argv).
+      const command = String(params.command || _joinActions(params.commandActions) || '').trim();
+      return {
+        kind: 'command', protocol: 'v2',
+        context: _ctx('Bash command', command, params.reason),
+      };
+    }
+    case 'item/fileChange/requestApproval': {
+      return {
+        kind: 'patch', protocol: 'v2',
+        context: _ctx('Edit', _grantRootLabel(params.grantRoot) || 'apply file changes', params.reason),
+      };
+    }
+    case 'item/permissions/requestApproval': {
+      return {
+        kind: 'permissions', protocol: 'v2',
+        context: _ctx('Permissions', String(params.reason || 'permission escalation'), params.reason),
+      };
+    }
+    case 'execCommandApproval': {
+      // legacy carries the real argv array.
+      const argv = Array.isArray(params.command) ? params.command : [];
+      const command = argv.length ? argv.join(' ') : String(params.command || '').trim();
+      return {
+        kind: 'command', protocol: 'legacy',
+        context: _ctx('Bash command', command, params.reason),
+      };
+    }
+    case 'applyPatchApproval': {
+      const files = params.fileChanges && typeof params.fileChanges === 'object'
+        ? Object.keys(params.fileChanges) : [];
+      const command = files.length ? `apply patch to ${files.join(', ')}` : 'apply patch';
+      return {
+        kind: 'patch', protocol: 'legacy',
+        context: _ctx('Edit', command.slice(0, 2000), params.reason),
+      };
+    }
+    default:
+      return null;
+  }
+}
+
+// Map our shared decideApproval() result to the JSON-RPC result VALUE Codex expects.
+// decideApproval returns { decision: 'allow' | 'ask', decidedBy, ... }. Codex has no
+// "park" — for an 'ask' (human-needed) the caller decides whether to hold the response
+// (durable approval) or deny. This pure mapper covers the terminal decisions:
+//   allow → v2 'accept'          / legacy 'approved'
+//   deny  → v2 'decline'         / legacy 'denied'    (continue the turn, try alternative)
+//   abort → v2 'cancel'          / legacy 'abort'     (deny + interrupt the whole turn)
+// `decision` is one of 'allow' | 'deny' | 'abort'.
+function buildCodexApprovalResponse(decision, protocol) {
+  const v2 = protocol !== 'legacy';
+  const table = v2
+    ? { allow: 'accept', deny: 'decline', abort: 'cancel' }
+    : { allow: 'approved', deny: 'denied', abort: 'abort' };
+  const value = table[decision] || (v2 ? 'decline' : 'denied');
+  return { decision: value };
+}
+
+// Convenience: turn a decideApproval verdict object into the Codex response value.
+// Blocklist/dangerous → 'deny' (Codex has no hard-deny that also refuses to retry; the
+// caller may prefer 'abort' for truly dangerous). Default: allow→accept, else decline.
+function decisionFromVerdict(verdict) {
+  if (verdict && verdict.decision === 'allow') return 'allow';
+  if (verdict && verdict.decidedBy === 'blocklist') return 'abort';
+  return 'deny';
+}
+
+function _ctx(toolName, command, reason) {
+  const warning = reason ? String(reason).slice(0, 500) : '';
+  return { toolName, command: String(command || '').slice(0, 2000), warning, fullContext: String(command || '').slice(0, 2000) };
+}
+
+function _joinActions(actions) {
+  if (!Array.isArray(actions)) return '';
+  return actions.map((a) => (a && (a.command || a.cmd || a.type)) || '').filter(Boolean).join(' ; ').slice(0, 2000);
+}
+
+function _grantRootLabel(grantRoot) {
+  return grantRoot ? `grant write access under ${grantRoot}` : '';
+}
+
+module.exports = {
+  parseCodexApprovalRequest,
+  buildCodexApprovalResponse,
+  decisionFromVerdict,
+};