crew-runner 0.1.0 → 0.2.2

package/src/computer-run.ts

@@ -0,0 +1,151 @@
+import type * as acp from "@agentclientprotocol/sdk";
+import { runAcp, type SeenCall } from "./acp.ts";
+import type { Claimed, RunEvent, RunnerApi } from "./api.ts";
+import type { Outcome } from "./claude.ts";
+import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { computerFolders, computerPrompt, judgeInRun, newRunMemory, noteAllowed, prepareWorkspaceFolder, type Folders, type Grant, type Verdict } from "./computer.ts";
+
+const POLL_MS = 3_000;
+// How often a computer run checks it is still running. The owner's off switch cancels it on the server.
+const ALIVE_MS = 5_000;
+const sleep = (ms: number, signal?: AbortSignal) =>
+  new Promise<void>((r) => {
+    const t = setTimeout(r, ms);
+    signal?.addEventListener("abort", () => (clearTimeout(t), r()), { once: true });
+  });
+
+type Ask = Pick<RunnerApi, "askOwner" | "ownerAnswer" | "alive">;
+
+// Waits for the owner's answer on their CrewCortex card. Anything but a yes (no, expired, run stopped, network) is a no.
+// "task": the owner chose "Allow for this task" on a card that offered it; on any other card it counts once.
+export type Yes = "once" | "task";
+async function answerTo(api: Pick<RunnerApi, "ownerAnswer">, runId: string, card: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<Yes | false> {
+  while (!signal?.aborted) {
+    const answer = await api.ownerAnswer(runId, card).catch(() => null);
+    if (answer === "approved_task") return v.grant ? "task" : "once";
+    if (answer === "approved") return "once";
+    if (answer !== "pending") return false;
+    await sleep(pollMs, signal);
+  }
+  return false;
+}
+
+const ask = (api: Pick<RunnerApi, "askOwner">, runId: string, v: Extract<Verdict, { kind: "ask" }>) =>
+  (v.grant ? api.askOwner(runId, v.category, v.detail, v.grant) : api.askOwner(runId, v.category, v.detail)).catch(() => null);
+
+export async function ownerSaysYes(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<Yes | false> {
+  const card = await ask(api, runId, v);
+  return card ? answerTo(api, runId, card, v, signal, pollMs) : false;
+}
+
+// One run's decisions. Grants the owner gave with "Allow for this task", and whether the run has read anything on this
+// computer yet, live here and nowhere else, so they end with the run and never reach another one. Every step that runs under a grant is written to the action log with the card that
+// allowed it; a step runs only once its record is saved, and a refusal is recorded as well as possible.
+export function stepDecider(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, f: Folders, record: (output: Record<string, unknown>) => Promise<boolean>, signal?: AbortSignal) {
+  const grants = new Map<Grant, string>();
+  const mem = newRunMemory();
+  return async (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>): Promise<boolean> => {
+    const v = judgeInRun(f, p, calls, mem);
+    const why = v.kind === "allow" ? {} : v.kind === "deny" ? { reason: v.reason } : { asked: v.category, detail: v.detail };
+    let how: Record<string, unknown> = {};
+    let yes = v.kind === "allow";
+    if (v.kind === "ask") {
+      const grantedBy = v.grant && grants.get(v.grant);
+      if (grantedBy) {
+        yes = true;
+        how = { allowed_by_card: grantedBy };
+      } else {
+        const card = await ask(api, runId, v);
+        const answer = card ? await answerTo(api, runId, card, v, signal) : false;
+        yes = answer !== false;
+        if (answer === "task" && card) how = { card, scope: "task" };
+        if (answer === "task" && v.grant && card) grants.set(v.grant, card);
+      }
+    }
+    const allowed = yes && (await record({ decision: "allowed", ...why, ...how }));
+    if (allowed) noteAllowed(f, p, calls, v, mem);
+    else await record({ decision: "refused", ...why, ...how });
+    return allowed;
+  };
+}
+
+// Claude Code's working folder for one run: new, empty and read-only, so Claude Code never finds anything there to read
+// or run without asking the runner, and no approved step can leave a file or link there. Removed after the run.
+export async function makeScratch(): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "crew-mac-"));
+  await chmod(dir, 0o500);
+  return dir;
+}
+
+export type ComputerRunOptions = {
+  timeoutMs: number; bin?: string; signal?: AbortSignal; home?: string; aliveMs?: number;
+  launch?: { command: string; args: string[]; env?: Record<string, string> };
+};
+
+// Aborts `stop` once the server says the run is no longer running (the owner switched @mac off, or it was cancelled).
+// A network error or an older server (no answer) is not a stop. Returns the function that ends the watch.
+export function watchRun(api: Pick<RunnerApi, "alive">, runId: string, stop: AbortController, everyMs = ALIVE_MS): () => void {
+  let busy = false;
+  const timer = setInterval(() => {
+    if (busy || stop.signal.aborted) return;
+    busy = true;
+    api.alive(runId).catch(() => null).then((running) => {
+      busy = false;
+      if (running === false) stop.abort();
+    });
+  }, everyMs);
+  return () => clearInterval(timer);
+}
+
+// One @mac run: the workspace folder, Claude Code's own tools, every decision written to the run's action log.
+export async function runComputer(api: Ask, pkg: Claimed, sink: (events: RunEvent[]) => Promise<void>, opts: ComputerRunOptions): Promise<Outcome> {
+  const slug = pkg.computer?.workspace_slug;
+  if (!slug) return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  let f;
+  let scratch;
+  try {
+    f = computerFolders(slug, opts.home);
+    await prepareWorkspaceFolder(f);
+    scratch = await makeScratch();
+  } catch {
+    return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  }
+  // One signal for Ctrl+C and for the owner's off switch.
+  const stop = new AbortController();
+  const onOuter = () => stop.abort();
+  if (opts.signal?.aborted) stop.abort();
+  else opts.signal?.addEventListener("abort", onOuter, { once: true });
+  const unwatch = watchRun(api, pkg.run_id, stop, opts.aliveMs);
+  // Every decision goes into the run's action log. A step is allowed only once its record is saved; a refusal is
+  // recorded as well as possible (refusing never needs the record to land).
+  const record = async (output: Record<string, unknown>): Promise<boolean> => {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        await sink([{ type: "step", kind: "tool", name: "permission", output }]);
+        return true;
+      } catch {
+        if (stop.signal.aborted) return false;
+      }
+    }
+    return false;
+  };
+  const decide = stepDecider(api, pkg.run_id, f, record, stop.signal);
+  const systemPrompt = `${computerPrompt(f, slug)}\n\nWorkspace guidance (from CrewCortex):\n${pkg.instructions}`;
+  try {
+    return await runAcp("claude", pkg, sink, {
+      timeoutMs: opts.timeoutMs,
+      bin: opts.bin,
+      signal: stop.signal,
+      launch: opts.launch,
+      // No additional directories: Claude Code then asks the runner about everything outside the scratch folder (the
+      // workspace folder, Downloads and dev projects included), instead of approving reads and read-only commands by itself.
+      computer: { cwd: scratch, additionalDirectories: [], systemPrompt, decide },
+    });
+  } finally {
+    unwatch();
+    await chmod(scratch, 0o700).then(() => rm(scratch, { recursive: true, force: true })).catch(() => undefined);
+    opts.signal?.removeEventListener("abort", onOuter);
+  }
+}

package/src/computer-web.ts

@@ -0,0 +1,187 @@
+// Web requests in computer mode. A plain curl that only downloads a public page (to the screen or into this workspace's
+// folder) runs without asking. A curl that sends what its own command line shows can be allowed for the rest of a task.
+// Anything this cannot read with certainty is left to the card. Reading is strict on purpose: it accepts a small part of
+// what zsh accepts and gives up on everything else, so a command never means more to the shell than it does here.
+
+// Unquoted characters zsh gives no meaning to in an argument. "~" is handled at the start of a word only; "=" and "%"
+// never start one, and "=" never follows "=" or ":" (zsh expands =name to a program's path, also after = or : under
+// MAGIC_EQUAL_SUBST).
+const PLAIN_CHAR = /^[A-Za-z0-9_\-./:@%+,=]$/;
+
+// The words of one plain command, or null when anything could be expanded, chained, redirected or read differently by
+// zsh: unquoted specials, $, backticks, !, escapes, "''" (one quote under RC_QUOTES), non-ASCII and control characters.
+// `quoted`: the word had a quote in it, so a leading ~ is a literal folder name, not the home folder.
+export function plainWords(command: string): { words: string[]; quoted: boolean[] } | null {
+  if (!/^[\x20-\x7e]*$/.test(command)) return null;
+  const words: string[] = [];
+  const quoted: boolean[] = [];
+  let word: string | null = null;
+  let q = false;
+  const end = () => {
+    if (word !== null) {
+      words.push(word);
+      quoted.push(q);
+    }
+    word = null;
+    q = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i]!;
+    if (c === " ") {
+      end();
+    } else if (c === "'") {
+      const close = command.indexOf("'", i + 1);
+      if (close < 0 || command[close + 1] === "'") return null;
+      word = (word ?? "") + command.slice(i + 1, close);
+      q = true;
+      i = close;
+    } else if (c === '"') {
+      const close = command.indexOf('"', i + 1);
+      if (close < 0) return null;
+      const inner = command.slice(i + 1, close);
+      // Inside double quotes zsh still expands $, ` and !, and a backslash escapes only those and \ and ". A backslash
+      // before a letter or digit stays as it is (curl reads "\n" in a write-out format itself).
+      if (/[$`!]/.test(inner) || /\\(?![A-Za-z0-9])/.test(inner)) return null;
+      word = (word ?? "") + inner;
+      q = true;
+      i = close;
+    } else if (c === "~" && word === null && (command[i + 1] === "/" || command[i + 1] === " " || i + 1 === command.length)) {
+      word = "~";
+    } else if (PLAIN_CHAR.test(c) && !(c === "=" && (word === null || /[=:]$/.test(word))) && !(word === null && c === "%")) {
+      word = (word ?? "") + c;
+    } else {
+      return null;
+    }
+  }
+  end();
+  return { words, quoted };
+}
+
+const MAX_ADDRESS = 500;
+// Names that only make sense on a local network or are reserved for testing.
+const PRIVATE_SUFFIXES = new Set(["localhost", "local", "localdomain", "internal", "intranet", "lan", "home", "corp", "private", "arpa", "test", "invalid"]);
+const LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+// http(s), a dotted name and nothing else before the path: no login, no port, no numeric or bracketed address.
+const ADDRESS = new RegExp(`^https?://(${LABEL}(?:\\.${LABEL})+)(?=[/?#]|$)[A-Za-z0-9\\-._~:/?#@!$&'()*+,;=%]*$`);
+
+// The host of a web address on a public name that curl and the WHATWG parser read the same way, or null. Letter case,
+// brackets and braces (curl expands those into several addresses) and anything unusual are refused, not interpreted.
+// A public name can still resolve to a private address; that reaches only ports 80 and 443 with a GET.
+export function publicHost(raw: string): string | null {
+  if (raw.length > MAX_ADDRESS) return null;
+  const m = ADDRESS.exec(raw);
+  if (!m) return null;
+  const host = m[1]!;
+  const top = host.slice(host.lastIndexOf(".") + 1);
+  if (!/^[a-z]{2,}$/.test(top) && !/^xn--[a-z0-9-]+$/.test(top)) return null;
+  if (PRIVATE_SUFFIXES.has(top)) return null;
+  try {
+    const url = new URL(raw);
+    return url.hostname === host && url.username === "" && url.password === "" && url.port === "" ? host : null;
+  } catch {
+    return null;
+  }
+}
+
+// curl's options a download may use. Switches only change what curl prints or how it waits; none sends anything.
+// Following redirects (-L) is not among them: a public site could send the request on to a local address, so it gets a
+// card (and may then be allowed for the task, for that host).
+const DOWNLOAD_SHORT = "sSfiI";
+const DOWNLOAD_SWITCHES = new Set(["--silent", "--show-error", "--fail", "--include", "--head", "--compressed", "--create-dirs"]);
+const REDIRECT_SWITCH = "--location";
+const NUMBER = /^\d{1,3}$/;
+// A write-out format of plain text and %{variable} only: %output{} writes a file, %header{} and @file read more.
+const WRITE_OUT = /^(?:[^%@\\]|%\{[a-z_]+\}|\\[nrt])*$/;
+const DOWNLOAD_VALUED: ReadonlyMap<string, (v: string) => boolean> = new Map([
+  ["-m", (v: string) => NUMBER.test(v)],
+  ["--max-time", (v: string) => NUMBER.test(v)],
+  ["--connect-timeout", (v: string) => NUMBER.test(v)],
+  ["--retry", (v: string) => /^[0-5]$/.test(v)],
+  ["-A", () => true],
+  ["--user-agent", () => true],
+  ["-w", (v: string) => WRITE_OUT.test(v)],
+  ["--write-out", (v: string) => WRITE_OUT.test(v)],
+]);
+// What a request may also carry when the owner allowed web requests for the task: only text written on the command line.
+// A value starting with @ would read a local file (curl's -d @file, -H @file, --json @file).
+const inline = (v: string) => !v.startsWith("@");
+const SEND_VALUED: ReadonlyMap<string, (v: string) => boolean> = new Map([
+  ["-X", (v: string) => /^[A-Z]{1,10}$/.test(v)],
+  ["--request", (v: string) => /^[A-Z]{1,10}$/.test(v)],
+  ["-d", inline],
+  ["--data", inline],
+  ["--data-raw", () => true],
+  ["--json", inline],
+  ["-H", inline],
+  ["--header", inline],
+]);
+const OUTPUT = new Set(["-o", "--output"]);
+const DATA = new Set(["-d", "--data", "--data-raw", "--json"]);
+
+// "download": a read-only GET (or HEAD) of one public address, printed or saved where `saveOk` allows. "web": also sends
+// text written on the command line (a method, data, headers) or follows redirects, so it needs a card but can be allowed
+// for the task for the same method and host. null: not a curl request this can read with certainty (an upload of a file,
+// a login, a cookie jar, a config file, a pipe, another program), so it gets a card and is never covered by a task grant.
+// `output`: the file a download saves to, as written.
+// `redirects`: follows redirects (-L). `extras`: carries data or headers.
+export type CurlRequest = { kind: "download" | "web"; method: string; host: string; output: string | null; redirects: boolean; extras: boolean };
+
+export function curlRequest(command: string, saveOk: (path: string, quoted: boolean) => boolean): CurlRequest | null {
+  const parsed = plainWords(command);
+  if (!parsed || parsed.words[0] !== "curl") return null;
+  const { words, quoted } = parsed;
+  let sends = false;
+  let method: string | null = null;
+  let head = false;
+  let data = false;
+  let redirects = false;
+  let extras = false;
+  let host: string | null = null;
+  let output: string | null = null;
+  let outputs = 0;
+  for (let i = 1; i < words.length; i++) {
+    const w = words[i]!;
+    const value = words[i + 1];
+    if (!w.startsWith("-")) {
+      if (host !== null) return null;
+      host = publicHost(w);
+      if (host === null) return null;
+    } else if (/^-[A-Za-z]+$/.test(w) && [...w.slice(1)].every((c) => DOWNLOAD_SHORT.includes(c) || c === "L")) {
+      if (w.includes("L")) redirects = sends = true;
+      if (w.includes("I")) head = true;
+    } else if (w === REDIRECT_SWITCH) {
+      redirects = sends = true;
+    } else if (DOWNLOAD_SWITCHES.has(w)) {
+      if (w === "--head") head = true;
+    } else if (OUTPUT.has(w)) {
+      if (value === undefined || (value !== "-" && !saveOk(value, quoted[i + 1]!))) return null;
+      output = value === "-" ? null : value;
+      outputs++;
+      i++;
+    } else if (DOWNLOAD_VALUED.has(w)) {
+      if (value === undefined || !DOWNLOAD_VALUED.get(w)!(value)) return null;
+      i++;
+    } else if (SEND_VALUED.has(w)) {
+      if (value === undefined || !SEND_VALUED.get(w)!(value)) return null;
+      if (w === "-X" || w === "--request") method = value;
+      if (DATA.has(w)) data = true;
+      if (w !== "-X" && w !== "--request") extras = true;
+      sends = true;
+      i++;
+    } else {
+      return null;
+    }
+  }
+  if (host === null || outputs > 1) return null;
+  return { kind: sends ? "web" : "download", method: method ?? (data ? "POST" : head ? "HEAD" : "GET"), host, output, redirects, extras };
+}
+
+
+// Where curl reads a config file without being told to (curl -q is the only way to skip it). A config can add data,
+// uploads or a login to every request, so while one exists a download is never run without a card.
+export function curlConfigFiles(home: string, env: Record<string, string | undefined>): string[] {
+  const files = [`${home}/.curlrc`, `${home}/.config/curlrc`, `${home}/.config/.curlrc`];
+  if (env.CURL_HOME) files.push(`${env.CURL_HOME}/.curlrc`);
+  if (env.XDG_CONFIG_HOME) files.push(`${env.XDG_CONFIG_HOME}/curlrc`, `${env.XDG_CONFIG_HOME}/.curlrc`);
+  return files;
+}