firedrill-run 2.2.5 → 3.0.1

package/dist/cli/src/runner-model-transport.js

@@ -0,0 +1,392 @@
+import { createHash } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { request } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { checkServerIdentity } from 'node:tls';
+import { API_ORIGIN, CliError } from './http.js';
+import { identifier } from './world-contracts.js';
+import { voiceChannels, voiceOperations } from './runner-voice.js';
+import { localExecutionTimeout } from './runner-execution-deadline.js';
+const SCHEMA = 'firedrill.local-runtime-frame.v2', FRAME_MAX = 65536, CHUNK = 16384;
+const REQUEST_MAX = 2 * 1024 ** 2, RESPONSE_MAX = 32 * 1024 ** 2;
+const SPEECH_REQUEST_MAX = 36 * 1024 ** 2, REQUEST_BUFFER_MAX = 128 * 1024 ** 2;
+const speechTypes = new Set(['audio/pcm', 'audio/wav', 'audio/mpeg', 'audio/flac', 'audio/ogg', 'audio/aac']);
+const HASH = /^[a-f0-9]{64}$/;
+const failure = () => new CliError('local_runtime_transport_failed', 'The private execution connection did not finish. No operation was retried.');
+const excluded4 = new BlockList();
+for (const [address, prefix] of [['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24],
+    ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 3]])
+    excluded4.addSubnet(address, prefix, 'ipv4');
+const global6 = new BlockList(), excluded6 = new BlockList();
+global6.addSubnet('2000::', 3, 'ipv6');
+for (const [address, prefix] of [['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20]])
+    excluded6.addSubnet(address, prefix, 'ipv6');
+function publicAddress(address) {
+    const family = isIP(address);
+    return family === 4 ? !excluded4.check(address, 'ipv4') : family === 6 && global6.check(address, 'ipv6') && !excluded6.check(address, 'ipv6');
+}
+function exact(frame, fields) {
+    if (Object.keys(frame).sort().join(',') !== ['schema', 'kind', 'id', ...fields].sort().join(','))
+        throw failure();
+}
+export function encodeModelFrame(frame) {
+    const body = Buffer.from(JSON.stringify(frame));
+    if (!body.length || body.length > FRAME_MAX)
+        throw failure();
+    const prefix = Buffer.alloc(4);
+    prefix.writeUInt32BE(body.length);
+    return Buffer.concat([prefix, body]);
+}
+/** Private child pipes only. No frame bodies, prompts or keys reach a console. */
+export async function* readModelFrames(stream, signal) {
+    if (stream.isTTY)
+        throw failure();
+    let prefix = Buffer.alloc(4), prefixSize = 0, length = 0, parts = [], size = 0;
+    const aborted = () => stream.destroy(failure());
+    signal.addEventListener('abort', aborted, { once: true });
+    try {
+        signal.throwIfAborted();
+        for await (const input of stream) {
+            const chunk = Buffer.isBuffer(input) ? input : Buffer.from(input);
+            let offset = 0;
+            while (offset < chunk.length) {
+                if (!length) {
+                    const count = Math.min(4 - prefixSize, chunk.length - offset);
+                    chunk.copy(prefix, prefixSize, offset, offset + count);
+                    prefixSize += count;
+                    offset += count;
+                    if (prefixSize !== 4)
+                        continue;
+                    length = prefix.readUInt32BE();
+                    prefixSize = 0;
+                    if (!length || length > FRAME_MAX)
+                        throw failure();
+                }
+                const count = Math.min(length - size, chunk.length - offset);
+                parts.push(chunk.subarray(offset, offset + count));
+                size += count;
+                offset += count;
+                if (size === length) {
+                    let value;
+                    try {
+                        value = JSON.parse(Buffer.concat(parts, size).toString('utf8'));
+                    }
+                    catch {
+                        throw failure();
+                    }
+                    length = 0;
+                    size = 0;
+                    parts = [];
+                    yield value;
+                }
+            }
+        }
+        if (prefixSize || length)
+            throw failure();
+    }
+    finally {
+        signal.removeEventListener('abort', aborted);
+    }
+}
+export function modelFrameWriter(stream, signal) {
+    if (stream.isTTY)
+        throw failure();
+    let writing = Promise.resolve();
+    const aborted = () => stream.destroy(failure());
+    signal.addEventListener('abort', aborted, { once: true });
+    stream.once('close', () => signal.removeEventListener('abort', aborted));
+    // Destroy errors must not become an uncaught stream exception. Callers also
+    // retain their child/process lifecycle and must handle its own exit signal.
+    stream.on('error', () => undefined);
+    return frame => {
+        const body = encodeModelFrame(frame);
+        const next = writing.then(async () => {
+            signal.throwIfAborted();
+            await new Promise((resolve, reject) => stream.write(body, error => error ? reject(failure()) : resolve()));
+        });
+        writing = next;
+        return next;
+    };
+}
+export class LocalModelRelay {
+    routes = new Map();
+    pending = new Map();
+    requestBytes = 0;
+    seen = new Set();
+    stopped = new AbortController();
+    signal;
+    emit;
+    constructor(configuration, emit, signal) {
+        this.emit = emit;
+        if (!Number.isSafeInteger(configuration.control.budget_seconds) || configuration.control.budget_seconds < 1)
+            throw failure();
+        this.signal = AbortSignal.any([signal, this.stopped.signal, AbortSignal.timeout(localExecutionTimeout(configuration))]);
+        for (const channel of configuration.model_channels) {
+            const url = new URL(channel.endpoint);
+            if (url.origin !== API_ORIGIN || url.username || url.password || url.search || url.hash
+                || !/^\/api\/internal\/target-model\/[a-f0-9-]{36}$/.test(url.pathname)
+                || !/^[A-Za-z0-9_-]{32,256}$/.test(channel.token) || this.routes.has('model:' + channel.binding_id))
+                throw failure();
+            identifier(channel.binding_id);
+            identifier(url.pathname.split('/').at(-1));
+            this.routes.set('model:' + channel.binding_id, { endpoint: channel.endpoint, token: channel.token, kind: 'model', provider: channel.provider });
+        }
+        if (configuration.control.purpose === 'simulation_trial' && ['conversation', 'browser_chat'].includes(configuration.control.invocation_mode)) {
+            const channel = configuration.participant_channel;
+            if (!channel || channel.role !== 'participant')
+                throw failure();
+            const url = new URL(channel.endpoint), id = url.pathname.split('/').at(-1);
+            if (url.origin !== API_ORIGIN || url.username || url.password || url.search || url.hash
+                || !/^\/api\/internal\/model\/[a-f0-9-]{36}$/.test(url.pathname)
+                || !/^[A-Za-z0-9_-]{32,256}$/.test(channel.token) || this.routes.has('model:' + id))
+                throw failure();
+            identifier(id);
+            this.routes.set('model:' + id, { endpoint: channel.endpoint, token: channel.token, kind: 'model', provider: 'anthropic' });
+        }
+        else if (configuration.participant_channel !== null)
+            throw failure();
+        voiceChannels(configuration.voice_channels, configuration.control.purpose === 'simulation_trial' && configuration.control.invocation_mode === 'voice');
+        for (const channel of configuration.voice_channels) {
+            const id = new URL(channel.endpoint).pathname.split('/').at(-1);
+            if (this.routes.has('model:' + id))
+                throw failure();
+            this.routes.set('model:' + id, { endpoint: channel.endpoint, token: channel.token, kind: 'model', provider: 'openai',
+                operation: voiceOperations[channel.role] });
+        }
+        for (const channel of configuration.real_channels) {
+            const url = new URL(channel.endpoint);
+            if (!(configuration.control.purpose === 'simulation_trial' || ['world_validation', 'world_inspection_session'].includes(configuration.control.purpose)
+                && configuration.control.validation_scope === 'target_startup_only'
+                && typeof configuration.control.startup_authorization_sha256 === 'string'
+                && HASH.test(configuration.control.startup_authorization_sha256))
+                || url.origin !== API_ORIGIN || url.username || url.password || url.search || url.hash
+                || url.pathname !== '/api/internal/real-dependency/' + identifier(channel.id)
+                || !/^[A-Za-z0-9_-]{32,256}$/.test(channel.token) || this.routes.has('real:' + channel.id))
+                throw failure();
+            this.routes.set('real:' + channel.id, { endpoint: channel.endpoint, token: channel.token, kind: 'real' });
+        }
+        this.signal.addEventListener('abort', () => this.close(), { once: true });
+        if (this.signal.aborted)
+            this.close();
+    }
+    async accept(value) {
+        if (this.signal.aborted || !value || typeof value !== 'object' || Array.isArray(value))
+            throw failure();
+        const frame = value;
+        if (frame.schema !== SCHEMA || typeof frame.kind !== 'string' || typeof frame.id !== 'string' || identifier(frame.id) !== frame.id)
+            throw failure();
+        if (frame.kind === 'request_start') {
+            exact(frame, ['binding_id', 'operation', 'connection_kind', 'length', 'sha256']);
+            const audio = frame.connection_kind === 'model' && (frame.operation === 'audio/transcriptions' || frame.operation === 'audio/speech');
+            if (this.pending.size >= 64 || this.seen.has(frame.id) || this.seen.size >= 1000000 || typeof frame.binding_id !== 'string'
+                || typeof frame.connection_kind !== 'string' || !['model', 'real'].includes(frame.connection_kind)
+                || !this.routes.has(frame.connection_kind + ':' + frame.binding_id)
+                || frame.connection_kind === 'model' && this.routes.get('model:' + frame.binding_id)?.operation !== undefined
+                    && this.routes.get('model:' + frame.binding_id).operation !== frame.operation
+                || typeof frame.operation !== 'string' || !(frame.connection_kind === 'real' ? ['dispatch', 'acknowledge']
+                : this.routes.get('model:' + frame.binding_id)?.provider === 'openai' ? ['chat/completions', 'responses', 'audio/transcriptions', 'audio/speech'] : ['messages', 'messages/count_tokens']).includes(frame.operation)
+                || !Number.isSafeInteger(frame.length) || Number(frame.length) < 1 || Number(frame.length) > (audio ? SPEECH_REQUEST_MAX : REQUEST_MAX)
+                || this.requestBytes + Number(frame.length) > REQUEST_BUFFER_MAX
+                || typeof frame.sha256 !== 'string' || !HASH.test(frame.sha256))
+                throw failure();
+            const state = { id: frame.id, binding: frame.binding_id, connectionKind: frame.connection_kind,
+                operation: frame.operation, expectedSize: Number(frame.length),
+                expectedHash: frame.sha256, chunks: [], size: 0, sequence: 0, sent: false, controller: new AbortController() };
+            state.timer = setTimeout(() => { void this.failed(state); }, 30000);
+            this.seen.add(frame.id);
+            this.pending.set(frame.id, state);
+            this.requestBytes += state.expectedSize;
+            return;
+        }
+        const state = this.pending.get(frame.id);
+        if (!state) {
+            if (frame.kind === 'cancel' && this.seen.has(frame.id)) {
+                exact(frame, []);
+                return;
+            }
+            throw failure();
+        }
+        if (frame.kind === 'cancel') {
+            exact(frame, []);
+            this.finish(state);
+            return;
+        }
+        if (frame.kind === 'response_ack') {
+            exact(frame, ['sequence']);
+            if (!Number.isSafeInteger(frame.sequence) || !state.ack || state.ack.sequence !== frame.sequence)
+                throw failure();
+            state.ack.resolve();
+            return;
+        }
+        if (state.sent)
+            throw failure();
+        if (frame.kind === 'request_chunk') {
+            exact(frame, ['sequence', 'data']);
+            if (frame.sequence !== state.sequence || !Number.isSafeInteger(frame.sequence) || typeof frame.data !== 'string'
+                || !frame.data.length || frame.data.length > 4 * Math.ceil(CHUNK / 3))
+                throw failure();
+            const body = Buffer.from(frame.data, 'base64');
+            if (!body.length || body.length > CHUNK || body.toString('base64') !== frame.data || state.size + body.length > state.expectedSize)
+                throw failure();
+            state.chunks.push(body);
+            state.size += body.length;
+            state.sequence += 1;
+            if (state.timer)
+                clearTimeout(state.timer);
+            state.timer = setTimeout(() => { void this.failed(state); }, 30000);
+            return;
+        }
+        if (frame.kind !== 'request_end')
+            throw failure();
+        exact(frame, ['sequence']);
+        if (frame.sequence !== state.sequence || state.size !== state.expectedSize)
+            throw failure();
+        const body = Buffer.concat(state.chunks, state.size);
+        if (createHash('sha256').update(body).digest('hex') !== state.expectedHash)
+            throw failure();
+        state.sent = true;
+        state.chunks = [];
+        if (state.timer)
+            clearTimeout(state.timer);
+        // Do not await the response here: the independent reader must keep accepting
+        // its chunk acknowledgments. This dispatch has no retry or reconnect loop.
+        void this.forward(state, body).catch(() => this.failed(state));
+    }
+    async chunk(state, sequence, body) {
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            let timer;
+            const aborted = () => done(failure());
+            const done = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                state.controller.signal.removeEventListener('abort', aborted);
+                state.ack = undefined;
+                error ? reject(error) : resolve();
+            };
+            timer = setTimeout(() => done(failure()), 30000);
+            state.ack = { sequence, resolve: () => done(), reject: error => done(error) };
+            state.controller.signal.addEventListener('abort', aborted, { once: true });
+            if (state.controller.signal.aborted || this.signal.aborted) {
+                done(failure());
+                return;
+            }
+            void this.emit({ schema: SCHEMA, kind: 'response_chunk', id: state.id, sequence, data: body.toString('base64') }).catch(() => done(failure()));
+        });
+    }
+    async forward(state, body) {
+        const channel = this.routes.get(state.connectionKind + ':' + state.binding);
+        if (!channel || channel.kind !== state.connectionKind || this.signal.aborted || state.controller.signal.aborted)
+            throw failure();
+        const url = new URL(channel.endpoint);
+        const answers = await lookup(url.hostname, { all: true, verbatim: true });
+        if (!answers.length || answers.some(item => !publicAddress(item.address)) || this.signal.aborted || state.controller.signal.aborted)
+            throw failure();
+        const address = answers.find(item => item.family === 4) ?? answers[0];
+        const path = channel.kind === 'real' ? url.pathname + (state.operation === 'acknowledge' ? '/acknowledge' : '')
+            : url.pathname + '/v1/' + state.operation;
+        const requestMs = channel.kind === 'real' ? 90000 : 900000;
+        // Literal checked address, original TLS identity/Host, no second DNS lookup,
+        // proxy environment, cookies, redirects, client certificate or ambient agent.
+        const response = await new Promise((resolve, reject) => {
+            const req = request({ protocol: 'https:', hostname: address.address, family: address.family, port: 443,
+                servername: url.hostname, path, method: 'POST', agent: false,
+                minVersion: 'TLSv1.3', rejectUnauthorized: true, checkServerIdentity: (_host, certificate) => checkServerIdentity(url.hostname, certificate),
+                signal: AbortSignal.any([this.signal, state.controller.signal, AbortSignal.timeout(requestMs)]),
+                headers: { Host: url.hostname, Authorization: 'Bearer ' + channel.token, 'Content-Type': 'application/json',
+                    'Content-Length': String(body.length), 'Accept-Encoding': 'identity', Connection: 'close' } }, resolve);
+            state.request = req;
+            req.once('error', () => reject(failure()));
+            req.setTimeout(requestMs, () => req.destroy(failure()));
+            req.end(body);
+        });
+        state.response = response;
+        const status = response.statusCode ?? 503;
+        const type = String(response.headers['content-type'] ?? '');
+        if (status !== 200) {
+            await this.emit({ schema: SCHEMA, kind: 'response_start', id: state.id,
+                status: [400, 401, 403, 404, 413, 429, ...(channel.kind === 'real' ? [409] : [])].includes(status) ? status : 503, content_type: 'application/json' });
+            await this.emit({ schema: SCHEMA, kind: 'response_end', id: state.id, sequence: 0, length: 0, sha256: createHash('sha256').digest('hex') });
+            this.finish(state);
+            return;
+        }
+        const media = type.split(';', 1)[0].trim().toLowerCase();
+        const contentType = media === 'application/json' ? 'application/json'
+            : channel.kind === 'model' && media === 'text/event-stream' ? 'text/event-stream'
+                : channel.kind === 'model' && state.operation === 'audio/speech' && speechTypes.has(media) ? media : null;
+        if (!contentType || response.headers['content-encoding'] && response.headers['content-encoding'] !== 'identity')
+            throw failure();
+        await this.emit({ schema: SCHEMA, kind: 'response_start', id: state.id, status: 200, content_type: contentType });
+        let sequence = 0, length = 0;
+        const hash = createHash('sha256');
+        for await (const input of response) {
+            const bytes = Buffer.isBuffer(input) ? input : Buffer.from(input);
+            for (let offset = 0; offset < bytes.length; offset += CHUNK) {
+                const part = bytes.subarray(offset, offset + CHUNK);
+                length += part.length;
+                if (length > RESPONSE_MAX || this.signal.aborted || state.controller.signal.aborted)
+                    throw failure();
+                hash.update(part);
+                await this.chunk(state, sequence++, part);
+            }
+        }
+        if (!response.complete)
+            throw failure();
+        await this.emit({ schema: SCHEMA, kind: 'response_end', id: state.id, sequence, length, sha256: hash.digest('hex') });
+        this.finish(state);
+    }
+    finish(state) {
+        if (!this.pending.delete(state.id))
+            return;
+        this.requestBytes -= state.expectedSize;
+        if (state.timer)
+            clearTimeout(state.timer);
+        state.ack?.reject(failure());
+        state.controller.abort();
+        state.request?.destroy();
+        state.response?.destroy();
+        state.chunks = [];
+    }
+    async failed(state) {
+        if (!this.pending.has(state.id))
+            return;
+        this.finish(state);
+        if (!this.signal.aborted) {
+            try {
+                await this.emit({ schema: SCHEMA, kind: 'response_error', id: state.id, code: 'local_model_transport_failed' });
+            }
+            catch {
+                this.close();
+            }
+        }
+    }
+    close() {
+        if (!this.stopped.signal.aborted)
+            this.stopped.abort();
+        for (const state of this.pending.values())
+            this.finish(state);
+        this.routes.clear();
+        this.seen.clear();
+    }
+}
+/** One dedicated private child channel. EOF/return is not target completion. */
+export async function serveLocalModelTransport(configuration, input, output, signal) {
+    if (!Number.isSafeInteger(configuration.control.budget_seconds) || configuration.control.budget_seconds < 1)
+        throw failure();
+    const stopped = new AbortController();
+    const combined = AbortSignal.any([signal, stopped.signal,
+        AbortSignal.timeout(localExecutionTimeout(configuration))]);
+    let relay;
+    try {
+        relay = new LocalModelRelay(configuration, modelFrameWriter(output, combined), combined);
+        for await (const frame of readModelFrames(input, combined))
+            await relay.accept(frame);
+    }
+    finally {
+        relay?.close();
+        stopped.abort();
+    }
+}