mtech-ai-local-runner 0.1.46 → 0.1.47

package/README.md

@@ -1,3 +1,16 @@
+## 0.1.47: Claude security host wiring remains gated
+
+Claude now shares the job security session and checks a live opaque executable
+identity before launch. Account/control overlaps and aliases fail before control
+creation; preparation failure and cancellation revoke authority. A trusted
+host/probe/identity tuple is an in-process composition seam, not an environment
+switch or a receipt loaded from disk. Fake-data tests do not enable production:
+exact-release/native-policy, managed-input and credential/IPC/network evidence
+and production verifier registration remain outstanding. Existing login, settings
+and executable path are preserved. This release neither upgrades nor starts an
+installed daemon. See `docs/ai-ops-gateway/claude-execution-admission-remaining.md`
+in the Gateway repository for the consolidated verification boundary.
+
 ## 0.1.46: login and execution are separate
 
 A locally logged-in account may still be blocked by security admission. New

package/dist/src/adapters/claude-code/adapter.js

@@ -74,45 +74,49 @@ export class ClaudeCodeAdapter {
             throw new Error("adapter has already been started");
         this.started = true;
         this.p1 = ctx.approvedTaskPackage?.verification?.mode === 'runner_observed_v1';
-        const generation = ctx.generation;
-        if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
-            throw new Error("JOB_SECURITY_REJECTED");
-        const assertAdmission = () => {
-            const repositories = ctx.taskPackage?.repositories;
-            if (!Array.isArray(repositories) || repositories.length !== 1 || repositories[0]?.base_commit_sha !== this.options.securityPolicy?.pin.sourceSha)
-                throw new Error('JOB_SECURITY_REJECTED');
-            requireJobSecurity(this.options.securityPolicy, { adapterId: "claude_code_cli", adapterVersion: "1", jobId: this.options.jobId ?? ctx.bindingId, modelId: resolvedModelId, generation });
-            if (ctx.approvedTaskPackage?.resolved_provider !== "anthropic" || ctx.approvedTaskPackage?.resolved_model_id !== resolvedModelId
-                || ctx.approvedTaskPackage?.repository?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
-                throw new Error("SECURITY_REQUIREMENTS_REJECTED");
-            requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "claude_code_cli", adapterVersion: "1", requirementsSha256: this.options.securityPolicy.pin.requirementsSha256 });
-        };
-        assertAdmission();
-        if (!ctx.securityBinding)
-            throw new Error('SECURITY_REQUIREMENTS_REJECTED');
-        this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
-        const pkg = ctx.taskPackage;
-        const cwd = this.options.cwd;
-        const rel = cwd ? path.relative(path.resolve(this.options.worktreeRoot), path.resolve(cwd)) : "";
-        if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))
-            throw new Error("trusted cwd must live outside the assigned worktree");
-        const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
-        if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
-            throw new Error("refusing to start: no positive remaining contract budget was supplied");
-        }
-        if (!this.options.worktreeRoot) {
-            throw new Error("refusing to start: no assigned worktree was supplied");
-        }
-        if (!ctx.sessionId) {
-            throw new Error("refusing to start: no runner-generated session ID was supplied");
-        }
-        const hookCommand = this.requireTrustedHookCommand();
-        const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
-        if (this.cancelled)
-            throw new Error('adapter startup cancelled');
         let acquired;
         this.startupAcquisition = new Promise(resolve => { acquired = resolve; });
         try {
+            const generation = ctx.generation;
+            if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
+                throw new Error("JOB_SECURITY_REJECTED");
+            if (this.options.prepareSecurity)
+                await this.options.prepareSecurity(ctx);
+            if (this.cancelled)
+                throw new Error('adapter startup cancelled');
+            const assertAdmission = () => {
+                const repositories = ctx.taskPackage?.repositories;
+                if (!Array.isArray(repositories) || repositories.length !== 1 || repositories[0]?.base_commit_sha !== this.options.securityPolicy?.pin.sourceSha)
+                    throw new Error('JOB_SECURITY_REJECTED');
+                requireJobSecurity(this.options.securityPolicy, { adapterId: "claude_code_cli", adapterVersion: "1", jobId: this.options.jobId ?? ctx.bindingId, modelId: resolvedModelId, generation });
+                if (ctx.approvedTaskPackage?.resolved_provider !== "anthropic" || ctx.approvedTaskPackage?.resolved_model_id !== resolvedModelId
+                    || ctx.approvedTaskPackage?.repository?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
+                    throw new Error("SECURITY_REQUIREMENTS_REJECTED");
+                requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "claude_code_cli", adapterVersion: "1", requirementsSha256: this.options.securityPolicy.pin.requirementsSha256 });
+            };
+            assertAdmission();
+            if (!ctx.securityBinding)
+                throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+            this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+            const pkg = ctx.taskPackage;
+            const cwd = this.options.cwd;
+            const rel = cwd ? path.relative(path.resolve(this.options.worktreeRoot), path.resolve(cwd)) : "";
+            if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))
+                throw new Error("trusted cwd must live outside the assigned worktree");
+            const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
+            if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
+                throw new Error("refusing to start: no positive remaining contract budget was supplied");
+            }
+            if (!this.options.worktreeRoot) {
+                throw new Error("refusing to start: no assigned worktree was supplied");
+            }
+            if (!ctx.sessionId) {
+                throw new Error("refusing to start: no runner-generated session ID was supplied");
+            }
+            const hookCommand = this.requireTrustedHookCommand();
+            const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
+            if (this.cancelled)
+                throw new Error('adapter startup cancelled');
             if (!this.options.createTools || !this.options.writeLocalMcpConfig)
                 throw new Error("job-local tool setup is required");
             this.tools = await this.options.createTools(ctx, pkg, ctx.approvedTaskPackage ?? {});
@@ -166,6 +170,9 @@ export class ClaudeCodeAdapter {
                 ...allowlistedEnv(this.options.env),
                 [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
             };
+            await this.options.assertCurrentInputs?.();
+            if (this.cancelled)
+                throw new Error('adapter startup cancelled');
             assertAdmission();
             const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
                 cwd,
@@ -259,6 +266,7 @@ export class ClaudeCodeAdapter {
         if (this.cancelPromise)
             return this.cancelPromise;
         this.localReadObservations();
+        this.revokeSecurity();
         this.revokeTools(this.tools);
         const cleanup = (async () => { await this.startupAcquisition; await this.cleanup(); })();
         // This bounds cleanup confirmation, never admitted model runtime. Unknown
@@ -269,6 +277,18 @@ export class ClaudeCodeAdapter {
         });
         return this.cancelPromise;
     }
+    securityRevoked = false;
+    revokeSecurity() {
+        if (this.securityRevoked)
+            return;
+        this.securityRevoked = true;
+        try {
+            this.options.revokeSecurity?.();
+        }
+        catch {
+            this.revokeFailed = true;
+        }
+    }
     revokeTools(tools) {
         if (!tools || this.revokedTools === tools)
             return;
@@ -291,6 +311,7 @@ export class ClaudeCodeAdapter {
         this.tools = undefined;
         this.handle = null;
         const operation = Promise.resolve().then(async () => {
+            this.revokeSecurity();
             this.revokeTools(tools);
             let failed = this.revokeFailed;
             try {

package/dist/src/adapters/claude-code/runtime-options.js

@@ -1,15 +1,52 @@
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { mkdir, realpath, rm } from 'node:fs/promises';
+import { lstat } from 'node:fs/promises';
+import { JobSecuritySession } from '../../safety/job-security-session.js';
+import { assertCurrentClaudeBinary, claudeBinaryLaunchPath } from '../../safety/claude-binary-identity.js';
 import { writeFileSync } from 'node:fs';
 import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
 import { JobToolSession } from '../../safety/job-tool-session.js';
 import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
 import { requireJobSecurity } from '../../safety/job-security-policy.js';
 const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+/** Resolve the existing prefix without creating a path through an account alias. */
+async function canonicalFuture(file) {
+    let parent = file;
+    const tail = [];
+    for (;;) {
+        try {
+            await lstat(parent);
+            return path.join(await realpath(parent), ...tail);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const next = path.dirname(parent);
+            if (next === parent)
+                throw error;
+            tail.unshift(path.basename(parent));
+            parent = next;
+        }
+    }
+}
 /** Wiring only. No release verifier or admission certificate exists here. */
 export function createClaudeCodeAdapterOptions(input) {
+    if (input.securityHost && (input.securityPolicy || input.nativeBinding || input.commandRegistry) || !!input.securityHost !== !!input.binaryIdentity)
+        throw Error('CLAUDE_SECURITY_AUTHORITY_CONFLICT');
+    const security = new JobSecuritySession(input.securityHost);
+    let securityPolicy = input.securityPolicy, disposed = false;
     const checkout = path.resolve(input.worktreePath), state = path.resolve(input.stateRoot);
+    const account = input.env.CLAUDE_CONFIG_DIR ?? (input.env.HOME ? path.join(input.env.HOME, '.claude') : undefined);
+    if (account !== undefined && (!path.isAbsolute(account) || /[\r\n\0]/.test(account)))
+        throw Error('CLAUDE_ACCOUNT_CONTEXT_UNAVAILABLE');
+    const assertOutsideAccount = (storage, source, auth = account) => { if (auth && [storage, source].some(root => inside(path.resolve(auth), root) || inside(root, path.resolve(auth))))
+        throw Error('CLAUDE_ACCOUNT_CONTROL_OVERLAP'); };
+    assertOutsideAccount(state, checkout);
+    const revoke = () => { disposed = true; security.revoke(); securityPolicy?.revoke(); };
+    const binary = input.binaryIdentity ? claudeBinaryLaunchPath(input.binaryIdentity) : input.binaryPath;
+    if (input.binaryPath && binary !== input.binaryPath)
+        throw Error('CLAUDE_BINARY_IDENTITY_REJECTED');
     if (inside(checkout, state))
         throw new Error('Claude job controls must be outside the checkout');
     const control = path.join(state, 'claude-jobs', randomUUID());
@@ -22,47 +59,91 @@ export function createClaudeCodeAdapterOptions(input) {
     env.TMPDIR = path.join(control, 'tmp'); // Claude owns credential access. Preserve the account location by path only;
     // never read/copy its files or send this environment to scoped workers.
     // https://code.claude.com/docs/en/authentication#log-in-with-multiple-accounts
-    env.CLAUDE_CONFIG_DIR = input.env.CLAUDE_CONFIG_DIR ?? (input.env.HOME ? path.join(input.env.HOME, '.claude') : undefined);
+    env.CLAUDE_CONFIG_DIR = account;
     if (env.CLAUDE_CONFIG_DIR && !path.isAbsolute(env.CLAUDE_CONFIG_DIR))
         throw new Error('Claude account configuration path must be absolute');
     return {
-        processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, securityPolicy: input.securityPolicy,
-        cwd, env, binaryPath: input.binaryPath, hookExecutablePath: input.hookExecutablePath, hookNodeExecutablePath: input.hookNodeExecutablePath,
+        processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, get securityPolicy() { return securityPolicy; },
+        ...(input.securityHost ? { prepareSecurity: async (ctx) => {
+                try {
+                    if (disposed || !ctx.securityBinding || !account)
+                        throw Error('JOB_SECURITY_SESSION_REJECTED');
+                    const approved = ctx.approvedTaskPackage, repo = approved?.repository;
+                    securityPolicy = await security.authorize({ adapterId: 'claude_code_cli', adapterVersion: '1', jobId: input.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId,
+                        sourceSha: String(repo?.base_commit_sha ?? ''), requirements: approved?.security_requirements, ...ctx.securityBinding });
+                    if (disposed)
+                        throw Error('JOB_SECURITY_SESSION_REJECTED');
+                    await assertCurrentClaudeBinary(input.binaryIdentity, binary, securityPolicy.pin.binarySha256);
+                    return securityPolicy;
+                }
+                catch (error) {
+                    revoke();
+                    throw error;
+                }
+            } } : {}),
+        revokeSecurity: revoke,
+        assertCurrentInputs: async () => { if (disposed)
+            throw Error('JOB_SECURITY_SESSION_REJECTED'); if (input.binaryIdentity) {
+            if (!securityPolicy)
+                throw Error('JOB_SECURITY_SESSION_REJECTED');
+            await assertCurrentClaudeBinary(input.binaryIdentity, binary, securityPolicy.pin.binarySha256);
+        } },
+        cwd, env, binaryPath: binary, hookExecutablePath: input.hookExecutablePath, hookNodeExecutablePath: input.hookNodeExecutablePath,
         maxBudgetUsd: input.maxBudgetUsd ?? 1, workItemLabel: input.workItemLabel ?? input.jobId,
         registeredReadTools: [], writeMcpConfig: () => { throw new Error('Gateway relay is not a model tool endpoint'); },
         createTools: async (ctx, pkg, approved) => {
-            await mkdir(state, { recursive: true, mode: 0o700 });
-            const realState = await realpath(state), realCheckout = await realpath(checkout);
-            if (realState !== state || inside(realCheckout, realState))
-                throw new Error('Claude job controls must be outside the checkout');
-            await mkdir(control, { recursive: true, mode: 0o700 });
-            for (const directory of [home, cwd, env.TMPDIR])
-                await mkdir(directory, { mode: 0o700 });
-            let active = true;
-            const tools = new JobToolSession({
-                policyOptions: jobToolPolicyOptions(checkout, pkg, approved, input.commandRegistry ?? [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' }),
-                binding: () => {
-                    const binding = input.nativeBinding?.();
-                    return binding && binding.jobId === input.jobId && binding.generation === input.securityPolicy?.pin.generation ? binding : null;
-                },
-                active: () => {
-                    if (!active)
-                        return false;
-                    try {
-                        requireJobSecurity(input.securityPolicy, { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: input.jobId, modelId: ctx.resolvedModelId });
-                        return true;
+            if (disposed)
+                throw Error('JOB_SECURITY_SESSION_REJECTED');
+            const policyOptions = jobToolPolicyOptions(checkout, pkg, approved, input.securityHost ? security.commands() : input.commandRegistry ?? [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' });
+            const canonicalAccount = account ? await canonicalFuture(account) : undefined;
+            assertOutsideAccount(await canonicalFuture(state), await canonicalFuture(checkout), canonicalAccount);
+            assertOutsideAccount(await canonicalFuture(control), await canonicalFuture(checkout), canonicalAccount);
+            let owned = false;
+            try {
+                await mkdir(state, { recursive: true, mode: 0o700 });
+                const realState = await realpath(state), realCheckout = await realpath(checkout);
+                assertOutsideAccount(realState, realCheckout, account ? await canonicalFuture(account) : undefined);
+                if (realState !== state || inside(realCheckout, realState))
+                    throw new Error('Claude job controls must be outside the checkout');
+                await mkdir(path.dirname(control), { recursive: true, mode: 0o700 });
+                if (await realpath(path.dirname(control)) !== path.dirname(control))
+                    throw Error('CLAUDE_CONTROL_ALIAS_REJECTED');
+                await mkdir(control, { mode: 0o700 });
+                owned = true;
+                for (const directory of [home, cwd, env.TMPDIR])
+                    await mkdir(directory, { mode: 0o700 });
+                let active = true;
+                const tools = new JobToolSession({
+                    policyOptions,
+                    binding: () => {
+                        const binding = input.securityHost ? security.binding() : input.nativeBinding?.();
+                        return binding && binding.jobId === input.jobId && binding.generation === securityPolicy?.pin.generation ? binding : null;
+                    },
+                    active: () => {
+                        if (!active)
+                            return false;
+                        try {
+                            requireJobSecurity(securityPolicy, { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: input.jobId, modelId: ctx.resolvedModelId, generation: ctx.generation, sourceSha: String(approved.repository.base_commit_sha) });
+                            return true;
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                });
+                return { start: () => tools.start(), revoke: () => { active = false; tools.revoke(); }, close: async () => { active = false; revoke(); try {
+                        await tools.close();
                     }
-                    catch {
-                        return false;
-                    }
-                },
-            });
-            return { start: () => tools.start(), revoke: () => { active = false; tools.revoke(); }, close: async () => { active = false; try {
-                    await tools.close();
-                }
-                finally {
+                    finally {
+                        await rm(control, { recursive: true, force: true });
+                    } } };
+            }
+            catch (error) {
+                revoke();
+                if (owned)
                     await rm(control, { recursive: true, force: true });
-                } } };
+                throw error;
+            }
         },
         writeLocalMcpConfig: endpoint => {
             writeFileSync(config, JSON.stringify({ mcpServers: { ai_local: { type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` } } } }), { mode: 0o600, flag: 'wx' });

package/dist/src/config.js

@@ -43,6 +43,25 @@ function parseWorkLoopId(args) {
     }
     return value;
 }
+/*
+ * The LaunchAgent starts the daemon as `run --state-root=<root>`, with the root setup used (Work Item 2ae45a4f).
+ * launchd does not pass setup's XDG_STATE_HOME, so the argument, not the environment, decides the root whenever it
+ * is given. Only one absolute, normalized path is accepted.
+ */
+function parseStateRootArgument(args) {
+    const prefix = "--state-root=";
+    const found = args.filter((arg) => arg.startsWith(prefix));
+    if (found.length === 0)
+        return undefined;
+    if (found.length > 1)
+        throw new Error("--state-root may be given only once");
+    const value = found[0].slice(prefix.length);
+    if (!value || !path.isAbsolute(value) || value === "/" || value.includes("\0")
+        || path.normalize(value) !== value || value.endsWith("/")) {
+        throw new Error("--state-root must be a normalized absolute path");
+    }
+    return value;
+}
 function parseAbsolutePath(value, label, required) {
     if (!value) {
         if (required)
@@ -98,8 +117,9 @@ export function loadConfig(argv, env) {
     if (!mode || !ALL_MODES.includes(mode)) {
         throw new Error(`mode must be one of ${ALL_MODES.join(", ")}`);
     }
-    const stateRoot = defaultStateRootFromEnv(env);
-    if (SERVICE_MODES.includes(mode)) {
+    const isServiceMode = SERVICE_MODES.includes(mode);
+    const stateRoot = (isServiceMode ? parseStateRootArgument(rest) : undefined) ?? defaultStateRootFromEnv(env);
+    if (isServiceMode) {
         let manualJobId;
         if (mode === 'manual-codex' || mode === 'publication-recover') {
             if (rest.length !== 1 || !rest[0].startsWith('--job-id=') || !UUID_PATTERN.test(rest[0].slice(9)))

package/dist/src/daemon/runtime.js

@@ -26,6 +26,9 @@ import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
 import { packagedHookCommandParts } from "../safety/hook-command.js";
 import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 export async function buildDaemon(input) {
+    const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
+    if (claudeParts !== 0 && claudeParts !== 3)
+        throw new Error('CLAUDE_SUPPORTED_HOST_REQUIRED');
     if (input.codexSupportedProbe && !input.codexSecurityHost)
         throw new Error('CODEX_SUPPORTED_HOST_REQUIRED');
     const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexDaemonHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
@@ -52,11 +55,12 @@ export async function buildDaemon(input) {
     // The same parts the CLI self-test ran before starting this daemon (verifyPackagedHook).
     const hook = packagedHookCommandParts();
     const plugin = new ClaudeCodePlugin({
-        probe: async () => (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
+        probe: async () => input.claudeSupportedProbe ? input.claudeSupportedProbe() : (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
         options: ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
             worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
             maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hook.hookScriptPath, hookNodeExecutablePath: hook.nodeExecutablePath,
             binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
+            securityHost: input.claudeSecurityHost, binaryIdentity: input.claudeBinaryIdentity,
         }),
     });
     const codex = new CodexPlugin({
@@ -109,6 +113,23 @@ export async function buildDaemon(input) {
     const poller = new JobPoller({
         reportError: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "poller_failed", ...diagnostic })}\n`); },
         heartbeat: async () => {
+            if (input.claudeSupportedProbe) {
+                let current;
+                try {
+                    current = await plugin.probe();
+                }
+                catch {
+                    current = { available: false, authenticated: false, capabilities: [] };
+                }
+                const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
+                const index = probes.findIndex(p => p.id === 'claude_code_cli');
+                if (index >= 0)
+                    probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
+                if (ready)
+                    versions.claude_code_cli = '1';
+                else
+                    delete versions.claude_code_cli;
+            }
             let current;
             try {
                 current = await codex.probe();

package/dist/src/safety/claude-binary-identity.js

@@ -0,0 +1,81 @@
+import path from 'node:path';
+import { lstat, realpath, readlink } from 'node:fs/promises';
+import { measureCommandFile } from './registered-command-integrity.js';
+const live = new WeakMap();
+const rejected = () => Error('CLAUDE_BINARY_IDENTITY_REJECTED');
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const validPath = (value) => typeof value === 'string' && path.isAbsolute(value) && path.resolve(value) === value && value !== '/' && value.length <= 4096 && !/[\r\n\0]/.test(value);
+/** Measurement only, never a release certificate or atomic path-based exec.
+ * Explicit roots are supplied by the trusted host, not task/config JSON. */
+async function measure(input) {
+    if (!validPath(input.launchPath) || !Array.isArray(input.allowedRoots) || !input.allowedRoots.length || input.allowedRoots.length > 8 || !input.allowedRoots.every(validPath))
+        throw rejected();
+    const roots = [...new Set(input.allowedRoots)], uid = process.getuid?.();
+    if (uid === undefined)
+        throw rejected();
+    for (const root of roots) {
+        const s = await lstat(root, { bigint: true });
+        if (await realpath(root) !== root || !s.isDirectory() || (s.mode & 18n) !== 0n || (s.uid !== BigInt(uid) && s.uid !== 0n))
+            throw rejected();
+    }
+    const allowed = (file) => roots.some(root => inside(root, file));
+    const target = await realpath(input.launchPath);
+    if (!allowed(input.launchPath) || !allowed(target))
+        throw rejected();
+    const inspect = async () => {
+        const stamps = [];
+        for (const file of [...new Set([input.launchPath, target])]) {
+            const root = roots.filter(r => inside(r, file)).sort((a, b) => b.length - a.length)[0];
+            const parts = [root];
+            let current = root;
+            for (const part of path.relative(root, file).split(path.sep).filter(Boolean)) {
+                current = path.join(current, part);
+                parts.push(current);
+            }
+            for (let i = 0; i < parts.length; i++) {
+                const name = parts[i], s = await lstat(name, { bigint: true }), link = s.isSymbolicLink(), last = i === parts.length - 1;
+                if ((s.uid !== BigInt(uid) && s.uid !== 0n) || (!link && (s.mode & 18n) !== 0n) || !allowed(await realpath(name))
+                    || (!last && !s.isDirectory() && !link) || (last && !link && (!s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n)))
+                    throw rejected();
+                stamps.push([name, s.dev.toString(), s.ino.toString(), s.uid.toString(), s.mode.toString(), link ? await readlink(name) : null,
+                    last || link ? s.mtimeNs.toString() : null, last || link ? s.ctimeNs.toString() : null, last ? s.nlink.toString() : null]);
+            }
+        }
+        if (await realpath(input.launchPath) !== target)
+            throw rejected();
+        return JSON.stringify(stamps);
+    };
+    const before = await inspect(), sha256 = await measureCommandFile(target), after = await inspect();
+    if (before !== after)
+        throw rejected();
+    return { sha256, stamp: after };
+}
+export async function captureClaudeBinaryIdentity(input) {
+    try {
+        const copy = structuredClone(input), measured = await measure(copy), identity = Object.freeze({ sha256: measured.sha256 });
+        live.set(identity, { input: copy, measured });
+        return identity;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export function claudeBinaryLaunchPath(identity) {
+    const value = live.get(identity);
+    if (!value)
+        throw rejected();
+    return value.input.launchPath;
+}
+export async function assertCurrentClaudeBinary(identity, launchPath, sha256) {
+    try {
+        const value = live.get(identity);
+        if (!value || launchPath !== value.input.launchPath || sha256 !== value.measured.sha256)
+            throw rejected();
+        const current = await measure(value.input);
+        if (current.sha256 !== sha256 || current.stamp !== value.measured.stamp)
+            throw rejected();
+    }
+    catch {
+        throw rejected();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.46",
+  "version": "0.1.47",
   "private": false,
   "license": "UNLICENSED",
   "bin": {