mtech-ai-local-runner 0.1.29 → 0.1.31

package/dist/src/publication/candidate.js

@@ -0,0 +1,95 @@
+import { createHash } from 'node:crypto';
+import { lstat, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { measureCommandFile } from '../safety/registered-command-integrity.js';
+export function protocolHash(value) {
+    const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object' ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, c]) => [k, canonical(c)])) : v;
+    return createHash('sha256').update(JSON.stringify(canonical(value)).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`)).digest('hex');
+}
+const denied = () => new Error('CANDIDATE_REJECTED');
+function freeze(v) { if (v && typeof v === 'object') {
+    for (const c of Object.values(v))
+        freeze(c);
+    Object.freeze(v);
+} return v; }
+const sensitive = (s) => /^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(s);
+const validPath = (p) => typeof p === 'string' && p.length > 0 && !p.includes('\0') && !p.includes('\\') && !path.isAbsolute(p) && p.split('/').every(s => s !== '.' && s !== '..' && s !== '' && !sensitive(s));
+function matches(file, scope) { if (scope.endsWith('/**')) {
+    const dir = scope.slice(0, -3);
+    return validPath(dir) && (file === dir || file.startsWith(dir + '/'));
+} return validPath(scope) && file === scope; }
+/** Object identity is host authority; serializing an evidence envelope cannot mint it.
+ * This is a verification foundation, not host adapter registration or a Gateway attestation. */
+export class CandidateVerifier {
+    options;
+    issued = new WeakSet();
+    constructor(options) { this.options = { ...options, binding: freeze(structuredClone(options.binding)), commands: freeze(structuredClone(options.commands)), allowedPaths: [...options.allowedPaths], blockedPaths: [...options.blockedPaths] }; }
+    async snapshot() {
+        const o = this.options, b = o.binding;
+        if (!await o.current() || !Number.isSafeInteger(b.generation) || b.generation < 1 || !Number.isSafeInteger(o.maxFiles) || o.maxFiles < 1 || !Number.isSafeInteger(o.maxDiffBytes) || o.maxDiffBytes < 1 || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || Object.values(b).some(v => v === '') || ![b.contract_fingerprint, b.task_package_fingerprint, b.launch_fingerprint].every(v => /^[a-f0-9]{64}$/.test(v)) || !/^[a-f0-9]{40}$/.test(b.base_commit_sha) || b.working_branch !== `ai-work/local/${b.attempt_id}` || !/^[A-Za-z0-9-]+$/.test(b.attempt_id) || !path.isAbsolute(o.root) || await realpath(o.root) !== o.root)
+            throw denied();
+        const observation = structuredClone(await o.observe());
+        if (observation.base_commit_sha !== b.base_commit_sha || observation.head_commit_sha !== b.base_commit_sha || observation.working_branch !== b.working_branch || Buffer.byteLength(observation.diff) > o.maxDiffBytes || !observation.diff.length || !observation.changed_files.length || observation.changed_files.length > o.maxFiles || new Set(observation.changed_files.map(f => f.path)).size !== observation.changed_files.length)
+            throw denied();
+        const entries = [];
+        for (const f of [...observation.changed_files].sort((a, b) => a.path < b.path ? -1 : 1)) {
+            if (!validPath(f.path) || !['added', 'modified', 'deleted'].includes(f.status) || !o.allowedPaths.some(s => matches(f.path, s)) || o.blockedPaths.some(s => s === '.env.*' ? f.path.startsWith('.env.') : matches(f.path, s)))
+                throw denied();
+            let current = o.root;
+            const parts = f.path.split('/');
+            for (let i = 0; i < parts.length; i++) {
+                current = path.join(current, parts[i]);
+                try {
+                    const stat = await lstat(current);
+                    if ((i === parts.length - 1 && stat.size > o.maxFileBytes) || stat.isSymbolicLink() || (i < parts.length - 1 && !stat.isDirectory()) || (i === parts.length - 1 && f.status === 'deleted'))
+                        throw denied();
+                }
+                catch (e) {
+                    if (e.code === 'ENOENT' && i === parts.length - 1 && f.status === 'deleted')
+                        break;
+                    throw denied();
+                }
+            }
+            entries.push({ ...f, content_sha256: f.status === 'deleted' ? null : await measureCommandFile(path.join(o.root, f.path)) });
+        }
+        if (!o.commands.length || new Set(o.commands.map(c => c.id)).size !== o.commands.length || o.commands.some(c => !c.id || !path.isAbsolute(c.executable) || !c.integrity || !c.argv.every(a => typeof a === 'string')))
+            throw denied();
+        const commands = o.commands.map(c => ({ id: c.id, fingerprint: protocolHash(c) }));
+        const diff_hash = createHash('sha256').update(observation.diff).digest('hex');
+        const changed_file_manifest_hash = protocolHash(entries.map(({ content_sha256: _, ...f }) => f));
+        const snapshot_fingerprint = protocolHash({ binding: b, entries, diff_hash, changed_file_manifest_hash, commands });
+        if (!await o.current())
+            throw denied();
+        return freeze({ snapshot_fingerprint, changed_file_manifest_hash, diff_hash, commands, changed_files: observation.changed_files, diff_bytes: Buffer.byteLength(observation.diff) });
+    }
+    async verify() {
+        try {
+            const snapshot = await this.snapshot(), outcomes = structuredClone(await this.options.verify(snapshot));
+            if (outcomes.length !== snapshot.commands.length || new Set(outcomes.map(r => r.command_id)).size !== outcomes.length || snapshot.commands.some(c => !outcomes.some(r => r.command_id === c.id && r.command_fingerprint === c.fingerprint && r.snapshot_fingerprint === snapshot.snapshot_fingerprint && r.status === 'passed')) || protocolHash(await this.snapshot()) !== protocolHash(snapshot))
+                throw denied();
+            const b = this.options.binding, verification_fingerprint = protocolHash({ binding: b, snapshot_fingerprint: snapshot.snapshot_fingerprint, outcomes: [...outcomes].sort((a, b) => a.command_id < b.command_id ? -1 : 1) });
+            const evidence = { ...b, ...snapshot, verification_fingerprint, verification_status: 'passed', snapshot_reference: { kind: 'runner_local_snapshot', fingerprint: snapshot.snapshot_fingerprint, runner_id: b.runner_id, job_id: b.job_id, generation: b.generation } };
+            const { commands: _, ...wire } = evidence;
+            const candidate = freeze({ evidence: { ...wire, candidate_fingerprint: protocolHash(wire) }, testReceipts: outcomes });
+            this.issued.add(candidate);
+            return candidate;
+        }
+        catch {
+            throw denied();
+        }
+    }
+    async assertCurrent(candidate) {
+        try {
+            if (!this.issued.has(candidate) || !await this.options.current())
+                throw denied();
+            if (this.options.assertRetainedSeal)
+                await this.options.assertRetainedSeal();
+            else if (candidate.evidence.snapshot_fingerprint !== (await this.snapshot()).snapshot_fingerprint)
+                throw denied();
+            return candidate.evidence;
+        }
+        catch {
+            throw denied();
+        }
+    }
+}

package/dist/src/publication/execution-host.js

@@ -0,0 +1,55 @@
+import { protocolHash } from './candidate.js';
+import { PublicationOutcomeUnknownError } from './publisher.js';
+/** Binds the real candidate/publisher pipeline to coordinator ownership and keeps
+ * its lease alive through terminal publication. Model reports are never input. */
+export function createLocalFixExecutionHost(composition) {
+    const registration = composition.registration ? structuredClone(composition.registration) : undefined;
+    return { prepare: async (input) => {
+            try {
+                const scope = input.job.taskPackage.local_fix_scope;
+                if (!registration || !scope)
+                    throw Error();
+                for (const field of ['host_release_sha256', 'test_isolation_sha256', 'publisher_release_sha256'])
+                    if (!/^[a-f0-9]{64}$/.test(registration.receipt[field]) || registration.receipt[field] !== scope[field])
+                        throw Error();
+                const ids = scope.required_commands, entries = scope.registered_tests;
+                if (!Array.isArray(ids) || !ids.length || new Set(ids).size !== ids.length || ids.length !== registration.commands.length)
+                    throw Error();
+                for (const c of registration.commands) {
+                    if (c.candidateReadPaths?.some(p => !Array.isArray(scope.allowed_paths) || !scope.allowed_paths.includes(p) || Object.hasOwn(c.integrity.readFiles, p)))
+                        throw Error();
+                    const e = entries[c.id];
+                    if (!ids.includes(c.id) || !e || e.review_status !== 'reviewed' || protocolHash(c) !== protocolHash({ id: c.id, executable: e.executable, argv: e.argv, integrity: { executableSha256: e.executable_sha256, readFiles: e.read_files }, ...('candidate_read_paths' in e ? { candidateReadPaths: e.candidate_read_paths } : {}) }))
+                        throw Error();
+                }
+            }
+            catch {
+                throw Error('LOCAL_FIX_HOST_REGISTRATION_REJECTED');
+            }
+            const session = await composition.prepare(input);
+            let closed = false, closing, finalization;
+            return {
+                finalize() {
+                    if (closed)
+                        return Promise.reject(new Error('LOCAL_FIX_SESSION_CLOSED'));
+                    if (!finalization)
+                        finalization = (async () => {
+                            const candidate = await session.verifier.verify();
+                            if (closed)
+                                throw Error('LOCAL_FIX_SESSION_CLOSED');
+                            let publication;
+                            try {
+                                publication = await session.publisher.publish(candidate);
+                            }
+                            catch {
+                                throw new PublicationOutcomeUnknownError();
+                            }
+                            const e = candidate.evidence;
+                            return { publication_id: publication.publication_id, status: 'completed', candidate_fingerprint: e.candidate_fingerprint, snapshot_fingerprint: e.snapshot_fingerprint, verification_fingerprint: e.verification_fingerprint, commit_sha: publication.committed_sha, working_branch: e.working_branch, pr_url: publication.pull_request_url, pull_request_provider_id: publication.pull_request_id, changed_files: e.changed_files.map(f => f.path), diff_hash: e.diff_hash, changed_file_manifest_hash: e.changed_file_manifest_hash };
+                        })();
+                    return finalization;
+                },
+                close() { closed = true; return closing ??= session.close(); },
+            };
+        } };
+}

package/dist/src/publication/git-credential-broker.js

@@ -0,0 +1,150 @@
+import { spawn } from 'node:child_process';
+import { lstat, realpath, readFile, mkdtemp, chmod, rm } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import path from 'node:path';
+import { measureCommandFile } from '../safety/registered-command-integrity.js';
+const denied = () => Error('GIT_CREDENTIAL_SCOPE_REJECTED');
+export const publicationGitConfig = '[core]\nrepositoryformatversion = 0\nbare = false\nhooksPath = /dev/null\nfsmonitor = false\n';
+export function strictPublicationOrigin(origin) {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:' || url.username || url.password || url.port || url.search || url.hash || url.href !== origin || !/^\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\.git$/.test(url.pathname) || url.pathname.includes('..') || !/^[a-z0-9.-]+$/.test(url.hostname))
+        throw denied();
+}
+export async function assertPinnedGit(file) { if (!path.isAbsolute(file.executable) || await realpath(file.executable) !== file.executable || await measureCommandFile(file.executable) !== file.sha256)
+    throw denied(); }
+export async function assertPrivateCheckout(checkout, privateRoot) {
+    if (!path.isAbsolute(privateRoot) || await realpath(privateRoot) !== privateRoot || !checkout.startsWith(privateRoot + '/') || await realpath(checkout) !== checkout)
+        throw denied();
+    for (const dir of [privateRoot, checkout, path.join(checkout, '.git')]) {
+        const s = await lstat(dir);
+        if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) || (process.getuid && s.uid !== process.getuid()))
+            throw denied();
+    }
+    if (await readFile(path.join(checkout, '.git', 'config'), 'utf8') !== publicationGitConfig)
+        throw denied();
+}
+/** No inherited auth, proxy, Git/SSH config or helper environment. */
+export function publicationGitEnvironment() { return { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_ATTR_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0', GIT_NO_REPLACE_OBJECTS: '1', GIT_OPTIONAL_LOCKS: '0' }; }
+export const publicationGitArgs = ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-c', 'core.attributesFile=/dev/null', '-c', 'core.excludesFile=/dev/null', '-c', 'core.logAllRefUpdates=false', '-c', 'credential.helper=', '-c', 'http.followRedirects=false', '-c', 'protocol.allow=never', '-c', 'protocol.https.allow=always'];
+/** Private one-operation Unix socket serves credentials only to the pinned Git
+ * helper for the registered HTTPS host and repository path. Secrets never enter
+ * argv/environment/disk. Owner-only directories/socket protect other UIDs; the
+ * required model/tool shutdown and OS confinement protect against the same UID. */
+export class ScopedGitCredentialBroker {
+    options;
+    constructor(options) { this.options = { ...options, git: { ...options.git }, remoteHelper: { ...options.remoteHelper }, node: options.node ? { ...options.node } : undefined, credentialHelper: options.credentialHelper ? { ...options.credentialHelper } : undefined }; }
+    async validate(scope) {
+        const o = this.options;
+        strictPublicationOrigin(o.origin);
+        if (scope.origin !== o.origin || !/^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.branch) || scope.ref !== `refs/heads/${o.branch}` || !/^[a-f0-9]{40}$/.test(scope.sha) || !await o.current() || !o.privateRoot)
+            throw denied();
+        await assertPrivateCheckout(scope.checkout, o.privateRoot);
+        if (await readFile(path.join(scope.checkout, '.git', 'HEAD'), 'utf8') !== `ref: ${scope.ref}\n` || (await readFile(path.join(scope.checkout, '.git', scope.ref), 'utf8')).trim() !== scope.sha)
+            throw denied();
+        await assertPinnedGit(o.git);
+        await assertPinnedGit(o.remoteHelper);
+        if (!o.node || !o.credentialHelper)
+            throw denied();
+        await assertPinnedGit(o.node);
+        await assertPinnedGit(o.credentialHelper);
+        if (await realpath(path.join(path.dirname(o.remoteHelper.executable), 'git-remote-https')) !== o.remoteHelper.executable)
+            throw denied();
+    }
+    async run(scope, read) {
+        let directory, server;
+        const sockets = new Set();
+        try {
+            const frozen = Object.freeze({ ...scope });
+            await this.validate(frozen);
+            const o = this.options, url = new URL(o.origin);
+            directory = await mkdtemp(path.join(o.privateRoot, 'auth-'));
+            await chmod(directory, 0o700);
+            const socketPath = path.join(directory, 's');
+            let used = false;
+            server = createServer(socket => {
+                sockets.add(socket);
+                socket.on('close', () => sockets.delete(socket));
+                let body = '';
+                socket.setTimeout(10000, () => socket.destroy());
+                socket.on('error', () => { });
+                socket.on('data', chunk => {
+                    body += chunk.toString();
+                    if (body.length > 16384) {
+                        socket.destroy();
+                        return;
+                    }
+                    if (!body.endsWith('\n'))
+                        return;
+                    socket.pause();
+                    void (async () => {
+                        try {
+                            const fields = JSON.parse(body);
+                            if (used || Object.keys(fields).some(k => !['protocol', 'host', 'path', 'username', 'wwwauth[]'].includes(k)) || fields.protocol !== 'https' || fields.host !== url.host || fields.path !== url.pathname.slice(1))
+                                throw denied();
+                            used = true;
+                            await this.validate(frozen);
+                            const credential = await o.authorization(frozen);
+                            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password) || credential.username.length + credential.password.length > 16384)
+                                throw denied();
+                            await this.validate(frozen);
+                            socket.end(JSON.stringify(credential));
+                        }
+                        catch {
+                            socket.destroy();
+                        }
+                    })();
+                });
+            });
+            await new Promise((resolve, reject) => { server.once('error', reject); server.listen(socketPath, resolve); });
+            await chmod(socketPath, 0o600);
+            // Git parses helper strings using a shell; quote each trusted absolute path.
+            const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
+            const helper = `!${quote(o.node.executable)} ${quote(o.credentialHelper.executable)} --local-fix-helper ${quote(socketPath)}`;
+            const args = [...publicationGitArgs, '-c', 'credential.useHttpPath=true', '-c', `credential.helper=${helper}`, ...(read ? ['ls-remote', '--refs', scope.origin, scope.ref] : ['push', '--porcelain', '--no-verify', scope.origin, `${scope.sha}:${scope.ref}`])];
+            const output = await new Promise((resolve, reject) => {
+                const child = spawn(o.git.executable, args, { cwd: scope.checkout, env: { ...publicationGitEnvironment(), GIT_EXEC_PATH: path.dirname(o.remoteHelper.executable) }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+                let stdout = '', bytes = 0, settled = false;
+                const fail = () => { if (!settled) {
+                    settled = true;
+                    try {
+                        if (child.pid)
+                            process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        child.kill('SIGKILL');
+                    }
+                    reject(denied());
+                } };
+                const timeout = setTimeout(fail, 60000);
+                child.on('error', fail);
+                child.stdout.on('data', (chunk) => { bytes += chunk.length; if (bytes > 65536)
+                    fail();
+                else
+                    stdout += chunk.toString(); });
+                // Never forward stderr: a failing helper may echo credential material.
+                child.stderr.on('data', () => { });
+                child.on('close', code => { clearTimeout(timeout); if (!settled) {
+                    settled = true;
+                    code === 0 ? resolve(stdout) : reject(denied());
+                } });
+            });
+            await this.validate(frozen);
+            return output;
+        }
+        catch {
+            throw denied();
+        }
+        finally {
+            for (const socket of sockets)
+                socket.destroy();
+            server?.close();
+            if (directory)
+                await rm(directory, { recursive: true, force: true });
+        }
+    }
+    async push(scope) { await this.run(scope, false); }
+    async head(scope) { const output = await this.run(scope, true); if (!output.trim())
+        return null; const lines = output.trim().split('\n'); if (lines.length !== 1)
+        throw denied(); const match = /^([a-f0-9]{40})\t(.+)$/.exec(lines[0]); if (!match || match[2] !== scope.ref)
+        throw denied(); return match[1]; }
+}

package/dist/src/publication/git-credential-helper.js

@@ -0,0 +1,29 @@
+import { connect } from 'node:net';
+/** Dedicated child of pinned Git only. No ambient credential or environment lookup.
+ * Its private socket is passed as an argument; the socket name is not a secret. */
+export async function runGitCredentialHelper(socketPath, operation, input = process.stdin, output = process.stdout) {
+    if (operation !== 'get')
+        return;
+    let body = '';
+    for await (const chunk of input) {
+        body += chunk.toString();
+        if (body.length > 16384)
+            throw Error('CREDENTIAL_REJECTED');
+    }
+    const fields = {};
+    for (const line of body.trim().split('\n')) {
+        const i = line.indexOf('=');
+        if (i < 1 || Object.hasOwn(fields, line.slice(0, i)))
+            throw Error('CREDENTIAL_REJECTED');
+        fields[line.slice(0, i)] = line.slice(i + 1);
+    }
+    const response = await new Promise((resolve, reject) => { const socket = connect(socketPath); let data = ''; socket.setTimeout(10000, () => socket.destroy(Error('timeout'))); socket.on('connect', () => socket.write(JSON.stringify(fields) + '\n')); socket.on('data', chunk => { data += chunk.toString(); if (data.length > 32768)
+        socket.destroy(Error('overflow')); }); socket.on('end', () => resolve(data)); socket.on('error', reject); });
+    const credential = JSON.parse(response);
+    if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
+        throw Error('CREDENTIAL_REJECTED');
+    output.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
+}
+if (process.argv[2] === '--local-fix-helper') {
+    runGitCredentialHelper(process.argv[3], process.argv[4]).catch(() => { process.exitCode = 1; });
+}