mtech-ai-local-runner 0.1.60 → 0.1.62

package/dist/src/safety/claude-managed-scope.js

@@ -0,0 +1,87 @@
+import os from 'node:os';
+import path from 'node:path';
+import { lstat, readdir } from 'node:fs/promises';
+import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
+import { CLAUDE_MANAGED_PREFERENCE_DOMAIN, CLAUDE_MANAGED_SETTINGS_DIRECTORY, CLAUDE_MANAGED_SETTINGS_FILES, CLAUDE_POLICY_OBSERVER, claudeCanonicalSha256 } from './claude-release.js';
+const unverified = () => Error('CLAUDE_MANAGED_SCOPE_UNVERIFIED');
+/** Claude managed sources the Runner checks on macOS (gate managed_scope_exclusion, scope unmanaged_personal_only). */
+export function claudeManagedPaths(user, root = '/') {
+    if (!/^[A-Za-z0-9._-]{1,255}$/.test(user) || user.startsWith('.') || !path.isAbsolute(root))
+        throw unverified();
+    const at = (file) => path.join(root, file);
+    return { directory: at(CLAUDE_MANAGED_SETTINGS_DIRECTORY), files: [...CLAUDE_MANAGED_SETTINGS_FILES.map(at),
+            at(`/Library/Managed Preferences/${CLAUDE_MANAGED_PREFERENCE_DOMAIN}.plist`), at(`/Library/Managed Preferences/${user}/${CLAUDE_MANAGED_PREFERENCE_DOMAIN}.plist`)] };
+}
+async function absent(file) {
+    try {
+        await lstat(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw unverified();
+    }
+    throw unverified();
+}
+/** Each managed file must be absent. The settings directory must be absent or an empty real directory,
+ * so drop-in or unknown sources also block. Unreadable means unknown, and unknown blocks. */
+export async function assertClaudeManagedPathsAbsent(user, root = '/') {
+    const { directory, files } = claudeManagedPaths(user, root);
+    for (const file of files)
+        await absent(file);
+    let s;
+    try {
+        s = await lstat(directory);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw unverified();
+    }
+    if (!s.isDirectory() || s.isSymbolicLink())
+        throw unverified();
+    let entries;
+    try {
+        entries = await readdir(directory);
+    }
+    catch {
+        throw unverified();
+    }
+    if (entries.length !== 0)
+        throw unverified();
+}
+/** Compiled defaults: the pinned installed observer (single-use clients) and the real managed locations. */
+export function claudeManagedScopeDeps(root = '/') {
+    return {
+        checkReady: async () => { verifyPolicyObserver(CLAUDE_POLICY_OBSERVER); await createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).checkReady(); },
+        collect: () => createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).collectOnce(),
+        managedPathsAbsent: () => assertClaudeManagedPathsAbsent(os.userInfo().username, root),
+    };
+}
+export async function claudeManagedScopeReady(deps) {
+    try {
+        await deps.checkReady();
+        await deps.managedPathsAbsent();
+    }
+    catch {
+        throw unverified();
+    }
+}
+/** Per-job managed scope: no configuration profile at all for machine and user (complete, empty, at most 60 s old),
+ * plus absent Claude managed files. Managed, partial, unknown or stale input blocks. */
+export async function collectClaudeManagedScope(deps) {
+    try {
+        const value = await deps.collect(), now = (deps.now ?? Date.now)();
+        const r = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        const observedAt = r.observedAt;
+        if (r.complete !== true || r.empty !== true || r.scope !== 'machine_and_current_user' || typeof observedAt !== 'number' || !Number.isSafeInteger(observedAt)
+            || observedAt > now || now - observedAt > 60_000 || typeof r.inventoryFingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(r.inventoryFingerprint))
+            throw unverified();
+        await deps.managedPathsAbsent();
+        const bound = { observer_sha256: CLAUDE_POLICY_OBSERVER.sha256, inventory_fingerprint: r.inventoryFingerprint, managed_paths: 'absent' };
+        return Object.freeze({ observerSha256: CLAUDE_POLICY_OBSERVER.sha256, inventoryFingerprint: r.inventoryFingerprint, fingerprint: claudeCanonicalSha256(bound) });
+    }
+    catch {
+        throw unverified();
+    }
+}

package/dist/src/safety/claude-production-host.js

@@ -0,0 +1,261 @@
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { lstat, realpath } from 'node:fs/promises';
+import { isDeepStrictEqual } from 'node:util';
+import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
+import { claudeLoginFromStatus } from '../adapters/claude-code/login-status.js';
+import { captureClaudeBinaryIdentity } from './claude-binary-identity.js';
+import { commandRegistryFingerprint } from './job-security-session.js';
+import { localToolInventory } from './local-tool-server.js';
+import { CLAUDE_MANDATORY_GATES, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256, hostClaudePlatform, requireClaudeRequirements } from './claude-release.js';
+import { claudeReleaseCopyPath, claudeReleaseRoot, createClaudeReleaseProvisioner, verifyClaudeCodeSignature, verifyClaudeReleaseCopy } from './claude-release-copy.js';
+import { claudeManagedScopeDeps, claudeManagedScopeReady, collectClaudeManagedScope } from './claude-managed-scope.js';
+/** A release whose provisioning failed is not fetched again before this delay, doubled per further consecutive failure
+ * of the same release up to CLAUDE_PROVISION_MAX_RETRY_MS. A listing change or a success resets it. */
+export const CLAUDE_PROVISION_RETRY_MS = 15 * 60_000;
+/** Upper bound of the provisioning backoff: a deterministic failure costs at most one download a day. */
+export const CLAUDE_PROVISION_MAX_RETRY_MS = 24 * 60 * 60_000;
+/** The provisioner is running another release: not a failure, so no backoff; the next sync or probe retries. */
+const PROVISION_BUSY = 'CLAUDE_RELEASE_PROVISION_BUSY';
+/** File identity of the copy for the probe memo; undefined when it cannot be read or its path is not its realpath. */
+async function copyStamp(file) {
+    try {
+        if (await realpath(file) !== file)
+            return undefined;
+        const s = await lstat(file, { bigint: true });
+        return [s.dev, s.ino, s.size, s.mtimeNs, s.ctimeNs, s.mode, s.nlink, s.uid].join(':');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The fixed launch shape of adapters/claude-code/adapter.ts (`args`); pinned as configSha256. Change both together.
+ * `flags` is every flag name the adapter always passes, `conditional_flags` every flag it passes only for some jobs
+ * (budget, resume or new session), and `settings_keys` the leaf paths of its inline `--settings` JSON. The adapter test
+ * checks both directions: every argv flag is pinned here, and every key here is observed in argv. */
+export const CLAUDE_LAUNCH_CONFIG = Object.freeze({ transport: CLAUDE_TRANSPORT, input_format: 'stream-json', output_format: 'stream-json', permission_mode: 'default',
+    tools: '', allowed_tools: 'ai_local', strict_mcp_config: true, setting_sources: '', disable_slash_commands: true, chrome: false,
+    flags: Object.freeze(['--allowedTools', '--disable-slash-commands', '--include-partial-messages', '--input-format', '--mcp-config', '--model', '--name',
+        '--no-chrome', '--output-format', '--permission-mode', '--print', '--setting-sources', '--settings', '--strict-mcp-config', '--tools', '--verbose']),
+    conditional_flags: Object.freeze(['--max-budget-usd', '--resume', '--session-id']),
+    settings_keys: Object.freeze(['hooks.PreToolUse']) });
+const CHECK_IDS = { CLAUDE_RELEASE_NOT_LISTED: 'release_list', CLAUDE_RELEASE_PLATFORM_MISMATCH: 'release_platform',
+    CLAUDE_RELEASE_COPY_UNAVAILABLE: 'release_copy', CLAUDE_CODE_SIGNATURE_REJECTED: 'release_copy', CLAUDE_MANAGED_SCOPE_UNVERIFIED: 'managed_scope' };
+/** A login probe answer (any status) is reused this long for the same release and copy identity. */
+export const CLAUDE_LOGIN_PROBE_TTL_MS = 5 * 60_000;
+const CLAUDE_LOGIN_PROBE_TIMEOUT_MS = 10_000;
+/** Readiness only: after a signature failure, the same release and copy identity is not re-hashed or run through
+ * codesign again before this delay; a new identity, a new listing or the delay re-checks at once. */
+export const CLAUDE_SIGNATURE_RECHECK_MS = 5 * 60_000;
+/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment and the job's
+ * account location. The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
+ * `timeoutMs` is a trusted in-process test seam only. */
+export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS) {
+    return binary => new Promise(resolve => {
+        const account = env.CLAUDE_CONFIG_DIR ?? path.join(home, '.claude');
+        if (!path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
+            return resolve({ authenticated: false, loginStatus: 'unknown' });
+        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, CLAUDE_CONFIG_DIR: account,
+            DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
+        for (const key of ['USER', 'LOGNAME']) {
+            const value = env[key];
+            if (value !== undefined)
+                childEnv[key] = value;
+        }
+        execFile(binary, ['auth', 'status', '--json'], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 65_536, env: childEnv }, (error, stdout) => {
+            if (!error)
+                return resolve(claudeLoginFromStatus(stdout));
+            // Claude exits 1 for a known logged-out JSON answer; other failures prove nothing.
+            resolve(error.code === 1 && typeof stdout === 'string' ? claudeLoginFromStatus(stdout, true) : { authenticated: false, loginStatus: 'unknown' });
+        });
+    });
+}
+/** Compiled Claude composition (decision 9095c7a8). The Gateway's synced release is the only one fetched or run.
+ * No environment, task or saved JSON creates an admission capability. */
+export function createClaudeProductionHost(input) {
+    const platform = input.platform ?? hostClaudePlatform(), now = input.now ?? Date.now, abort = new AbortController();
+    const managed = input.managedScope ?? claudeManagedScopeDeps(), login = input.login ?? pinnedClaudeLogin(input.home, input.env);
+    const provisioner = createClaudeReleaseProvisioner({ home: input.home, platform, fetchFn: input.fetchFn, codesign: input.codesign, signal: abort.signal });
+    const failures = new Map(), key = (r) => `${r.version}/${r.platform}/${r.binary_sha256}`;
+    let listed = null, inflight, retryKey, pending = Promise.resolve(), closed = false;
+    /** Probe-only memo (readiness runs on every heartbeat): the release and the copy's file identity, held across a
+     * full byte and code-signature verification in this process that saw the file unchanged throughout. Job paths never
+     * read it; any failed verification clears it. */
+    let probeMemo;
+    /** Probe-only negative memo: a code-signature failure of this release's copy at this file identity, until
+     * CLAUDE_SIGNATURE_RECHECK_MS passes, a new file identity appears or the listed release changes. Job paths never read it. */
+    let signatureRejected;
+    /** Readiness only: the last login probe answer, for the release, copy path and copy identity it ran against. */
+    let loginCache;
+    const report = (event) => { try {
+        input.report?.(event);
+    }
+    catch { /* A reporter never fails provisioning. */ } };
+    /** Background only: handleRelease is not awaited, so this promise settles and never rejects. */
+    const provision = (release) => {
+        const k = key(release), last = failures.get(k);
+        if (closed || release.platform !== platform || inflight !== undefined
+            || last !== undefined && now() - last.at < Math.min(CLAUDE_PROVISION_RETRY_MS * 2 ** (last.count - 1), CLAUDE_PROVISION_MAX_RETRY_MS))
+            return;
+        inflight = k;
+        if (retryKey === k)
+            retryKey = undefined;
+        pending = (async () => {
+            try {
+                await provisioner.ensure(release);
+                failures.delete(k);
+            }
+            catch (error) {
+                const code = error instanceof Error && /^CLAUDE_[A-Z_]+$/.test(error.message) ? error.message : 'CLAUDE_RELEASE_PROVISION_FAILED';
+                if (code === PROVISION_BUSY) {
+                    retryKey = k;
+                    return;
+                }
+                failures.set(k, { count: (failures.get(k)?.count ?? 0) + 1, at: now() });
+                report({ event: 'claude_release_provision_failed', code });
+            }
+            finally {
+                inflight = undefined;
+            }
+        })();
+    };
+    const currentRelease = () => {
+        const release = listed;
+        if (!release)
+            throw Error('CLAUDE_RELEASE_NOT_LISTED');
+        if (release.platform !== platform)
+            throw Error('CLAUDE_RELEASE_PLATFORM_MISMATCH');
+        return release;
+    };
+    const verifyRelease = async (release) => {
+        try {
+            return await verifyClaudeReleaseCopy(input.home, release);
+        }
+        catch {
+            probeMemo = undefined;
+            provision(release);
+            throw Error('CLAUDE_RELEASE_COPY_UNAVAILABLE');
+        }
+    };
+    /** Full location and byte verification of the listed copy: every job path. */
+    const verifiedCopy = async () => {
+        const release = currentRelease();
+        return { release, binary: await verifyRelease(release) };
+    };
+    /** Readiness only: skips the re-hash and codesign while the release and the copy's file identity are unchanged since
+     * a full verification. A copy is never reported ready, nor run by the login probe, before its signature passed here. */
+    const probedCopy = async () => {
+        const release = currentRelease(), k = key(release), memo = probeMemo;
+        if (memo?.key === k) {
+            const stamp = await copyStamp(memo.binary);
+            if (stamp !== undefined && stamp === memo.stamp)
+                return { release, binary: memo.binary, stamp };
+        }
+        probeMemo = undefined;
+        const bad = signatureRejected;
+        // The same release and file identity, failed less than the delay ago: blocked without hashing or running codesign.
+        if (bad?.key === k && now() - bad.at < CLAUDE_SIGNATURE_RECHECK_MS) {
+            const stamp = await copyStamp(bad.binary);
+            if (stamp !== undefined && stamp === bad.stamp)
+                throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+        }
+        signatureRejected = undefined;
+        let before;
+        try {
+            before = await copyStamp(claudeReleaseCopyPath(input.home, release));
+        }
+        catch { /* No stamp, no memo; verification decides. */ }
+        const binary = await verifyRelease(release);
+        // Bytes and signature are separate checks (verifyClaudeReleaseCopy, verifyClaudeCodeSignature): both, as on job paths.
+        try {
+            await verifyClaudeCodeSignature(binary, input.codesign);
+        }
+        catch {
+            probeMemo = undefined;
+            const rejectedStamp = await copyStamp(binary);
+            if (before !== undefined && rejectedStamp === before && listed === release)
+                signatureRejected = { key: k, binary, stamp: rejectedStamp, at: now() };
+            throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+        }
+        const after = await copyStamp(binary);
+        if (before !== undefined && after === before && listed === release)
+            probeMemo = { key: k, binary, stamp: after };
+        return { release, binary, stamp: after };
+    };
+    const blocked = (code, executableVersion) => ({ available: false, authenticated: false, loginStatus: 'unknown', capabilities: [], reason: code,
+        ...(executableVersion ? { executableVersion } : {}), admission: { checks: [{ id: CHECK_IDS[code] ?? 'release_copy', status: 'blocked', code }] } });
+    const securityHost = async (request) => {
+        if (closed)
+            throw Error('CLAUDE_HOST_CLOSED');
+        const requirements = requireClaudeRequirements(request.requirements, { adapterId: request.adapterId, adapterVersion: request.adapterVersion }), release = requirements.release;
+        const { release: synced, binary } = await verifiedCopy();
+        if (release.version !== synced.version || release.platform !== synced.platform || release.binary_sha256 !== synced.binary_sha256
+            || !isDeepStrictEqual([...release.model_ids], [...synced.model_ids]) || release.platform !== platform || !release.model_ids.includes(request.modelId))
+            throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+        await verifyClaudeCodeSignature(binary, input.codesign);
+        const scope = await collectClaudeManagedScope(managed), commandRegistry = [];
+        const pin = { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: request.jobId, generation: request.generation, modelId: request.modelId, sourceSha: request.sourceSha,
+            binarySha256: release.binary_sha256, configSha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), managedPolicySha256: scope.fingerprint,
+            toolsSha256: claudeCanonicalSha256({ tools: localToolInventory() }), commandsSha256: commandRegistryFingerprint(commandRegistry),
+            osProfileSha256: claudeCanonicalSha256({ platform }), requirementsSha256: requirements.fingerprint, securityMode: CLAUDE_RELEASE_MODE };
+        return { pin, commandRegistry,
+            // The job MCP token is the session identity (accepted risk job_mcp_token_possession_not_os_identity).
+            nativeBinding: () => ({ jobId: request.jobId, threadId: request.launchFingerprint, turnId: request.contractFingerprint, generation: request.generation }),
+            verify: async (captured) => {
+                if (closed || captured.binarySha256 !== release.binary_sha256 || captured.securityMode !== CLAUDE_RELEASE_MODE)
+                    throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+                await verifyClaudeReleaseCopy(input.home, release).catch(error => { probeMemo = undefined; throw error; });
+                return { version: 2, pin: captured, checks: CLAUDE_MANDATORY_GATES.map(gate => ({ gate, status: 'passed' })) };
+            } };
+    };
+    return {
+        /** Sync consumer: the Gateway's one listed release, or null. Provisioning starts when the listed release changes,
+         * or again for the same release when the provisioner was busy. A listing change also resets the backoff. */
+        handleRelease(value) {
+            if (closed)
+                return;
+            const changed = (listed ? key(listed) : null) !== (value ? key(value) : null);
+            listed = value;
+            if (changed) {
+                failures.clear();
+                signatureRejected = undefined;
+            }
+            if (value && (changed || retryKey === key(value)))
+                provision(value);
+        },
+        /** Settles once the provisioning started so far has ended. */
+        async settled() { await pending; },
+        async probe() {
+            let copy;
+            try {
+                copy = await probedCopy();
+            }
+            catch (error) {
+                return blocked(error instanceof Error ? error.message : 'CLAUDE_RELEASE_COPY_UNAVAILABLE');
+            }
+            try {
+                await claudeManagedScopeReady(managed);
+            }
+            catch {
+                return blocked('CLAUDE_MANAGED_SCOPE_UNVERIFIED', copy.release.version);
+            }
+            // At most one vendor process per TTL, also for an employee who stays logged out; a new release or copy probes at once.
+            const identity = [key(copy.release), copy.binary, copy.stamp ?? ''].join('\0'), cached = loginCache;
+            let status;
+            if (cached?.identity === identity && now() - cached.at < CLAUDE_LOGIN_PROBE_TTL_MS)
+                status = cached.status;
+            else {
+                status = await login(copy.binary).catch(() => ({ authenticated: false, loginStatus: 'unknown' }));
+                loginCache = { identity, at: now(), status };
+            }
+            return { available: true, authenticated: status.authenticated, loginStatus: status.loginStatus, executableVersion: copy.release.version, capabilities: [...CLAUDE_CAPABILITIES] };
+        },
+        /** Per job: a fresh identity of the current verified copy, so a release change moves the launch path safely. */
+        async binaryIdentity() {
+            const { binary } = await verifiedCopy();
+            return captureClaudeBinaryIdentity({ launchPath: binary, allowedRoots: [claudeReleaseRoot(input.home)] });
+        },
+        securityHost,
+        async close() { closed = true; abort.abort(); await pending; },
+    };
+}

package/dist/src/safety/claude-release-copy.js

@@ -0,0 +1,233 @@
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, open, realpath, rename, rm } from 'node:fs/promises';
+import { measureCommandFile } from './registered-command-integrity.js';
+import { CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, claudeReleaseUrl, parseClaudeSyncRelease } from './claude-release.js';
+const rejected = () => Error('CLAUDE_RELEASE_COPY_REJECTED');
+const validHome = (home) => typeof home === 'string' && path.isAbsolute(home) && path.resolve(home) === home && home !== '/' && home.length <= 4096 && !/[\r\n\0]/.test(home);
+/** Runner-owned root of pinned Claude copies. The employee's own `claude` install is never used. */
+export function claudeReleaseRoot(home) {
+    if (!validHome(home))
+        throw rejected();
+    return path.join(home, '.local', 'share', 'mtec-ai-local-runner', 'claude');
+}
+export function claudeReleaseCopyPath(home, release) {
+    const r = parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
+    if (!r)
+        throw rejected();
+    return path.join(claudeReleaseRoot(home), r.version, r.binary_sha256, 'claude');
+}
+/** Every path from `home` down to `target`, both inclusive. */
+function chainFrom(home, target) {
+    const paths = [home];
+    let current = home;
+    for (const part of path.relative(home, target).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        paths.push(current);
+    }
+    return paths;
+}
+/** Owned by the runner's user, not writable by group or others, and not a symlink. */
+const ownerOnly = (s, uid) => s.uid === BigInt(uid) && (s.mode & 18n) === 0n && !s.isSymbolicLink();
+/** The predicate for every directory of the copy's chain, from `home` down. */
+const ownerOnlyDirectory = (s, uid) => ownerOnly(s, uid) && s.isDirectory();
+/** Owner-only chain, no symlink or hard link, executable, unchanged realpath and re-hashed bytes
+ * (modeled on verifyCodexStandaloneBinary). A measurement, not an atomic exec; the identity re-measures before spawn. */
+export async function verifyClaudeReleaseCopy(home, release) {
+    try {
+        const binary = claudeReleaseCopyPath(home, release), uid = process.getuid?.();
+        if (uid === undefined || await realpath(home) !== home)
+            throw rejected();
+        const paths = chainFrom(home, binary);
+        const inspect = async () => Promise.all(paths.map(async (file, index) => {
+            const s = await lstat(file, { bigint: true }), last = index === paths.length - 1;
+            if (last ? !ownerOnly(s, uid) || !s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n : !ownerOnlyDirectory(s, uid))
+                throw rejected();
+            return [s.dev, s.ino, s.uid, s.mode, last ? s.mtimeNs : 0n, last ? s.ctimeNs : 0n].join(':');
+        }));
+        const before = await inspect();
+        if (await realpath(binary) !== binary || await measureCommandFile(binary) !== release.binary_sha256)
+            throw rejected();
+        const after = await inspect();
+        if (after.join('|') !== before.join('|') || await realpath(binary) !== binary)
+            throw rejected();
+        return binary;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export const CLAUDE_CODESIGN = '/usr/bin/codesign';
+/** Apple-anchored chain through the Developer ID CA (1.2.840.113635.100.6.2.6) to a Developer ID Application leaf
+ * (1.2.840.113635.100.6.1.13) of Anthropic's team, with the official identifier. Apple Development, Apple Distribution
+ * and Mac App Store leaves of the same team do not match. */
+export const CLAUDE_CODE_REQUIREMENT = `=anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${CLAUDE_TEAM_ID}" and identifier "${CLAUDE_SIGNING_IDENTIFIER}"`;
+/** Absolute tool path, no shell, fixed environment; a non-zero exit rejects. */
+export const runCodesign = args => new Promise((resolve, reject) => {
+    execFile(CLAUDE_CODESIGN, [...args], { encoding: 'utf8', timeout: 120_000, maxBuffer: 65_536, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => error ? reject(Error('CLAUDE_CODE_SIGNATURE_REJECTED')) : resolve({ stdout, stderr }));
+});
+export async function verifyClaudeCodeSignature(file, run = runCodesign) {
+    try {
+        if (!path.isAbsolute(file) || /[\r\n\0]/.test(file))
+            throw Error();
+        await run(['--verify', '--strict', '-R', CLAUDE_CODE_REQUIREMENT, file]);
+        const { stdout, stderr } = await run(['-dv', '--verbose=2', file]);
+        const lines = `${stdout}\n${stderr}`.split('\n').map(line => line.trim());
+        const only = (key, value) => { const found = lines.filter(line => line.startsWith(`${key}=`)); return found.length === 1 && found[0] === `${key}=${value}`; };
+        if (!only('Identifier', CLAUDE_SIGNING_IDENTIFIER) || !only('TeamIdentifier', CLAUDE_TEAM_ID))
+            throw Error();
+    }
+    catch {
+        throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+    }
+}
+/** Official builds are about 245 MB; the cap stays below measureCommandFile's 512 MiB limit. */
+export const CLAUDE_RELEASE_MAX_BYTES = 384 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 15 * 60_000;
+async function privateDirectory(dir) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const s = await lstat(dir), uid = process.getuid?.();
+    if (uid === undefined || !s.isDirectory() || s.isSymbolicLink() || s.uid !== uid || (s.mode & 0o077) !== 0 || await realpath(dir) !== dir)
+        throw rejected();
+}
+async function writeAll(file, chunk) {
+    for (let offset = 0; offset < chunk.byteLength;) {
+        const { bytesWritten } = await file.write(chunk, offset, chunk.byteLength - offset);
+        offset += bytesWritten;
+    }
+}
+/** The release exactly as the strict parser reads it, or null: the URL and paths never come from a looser reading. */
+function listedRelease(release) {
+    try {
+        return parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
+    }
+    catch {
+        return null;
+    }
+}
+/** Guarded fetch of one listed release (design "Provisioning a listed release"). Fixed endpoint and no redirect.
+ * Exclusive 0600 temp file in a 0700 staging directory under the same root, so the same filesystem.
+ * Byte cap and streaming sha256, then the code signature, then chmod and an atomic rename,
+ * then bytes/location and the signature once more on the installed path.
+ * Bytes that fail any check are deleted and never run. */
+export function createClaudeReleaseProvisioner(input) {
+    const maxBytes = input.maxBytes ?? CLAUDE_RELEASE_MAX_BYTES;
+    let current;
+    async function install(release) {
+        if (!input.platform || release.platform !== input.platform)
+            throw Error('CLAUDE_RELEASE_PLATFORM_MISMATCH');
+        let existing;
+        try {
+            existing = await verifyClaudeReleaseCopy(input.home, release);
+        }
+        catch { /* Absent or drifted: fetch the listed bytes. */ }
+        // Bytes and location are one check, the code signature another: no success without both on the path we return.
+        if (existing) {
+            await verifyClaudeCodeSignature(existing, input.codesign);
+            return existing;
+        }
+        const url = claudeReleaseUrl(release), target = claudeReleaseCopyPath(input.home, release), staging = path.join(claudeReleaseRoot(input.home), '.staging');
+        if (await realpath(input.home) !== input.home)
+            throw rejected();
+        await privateDirectory(staging);
+        // The installed copy must pass the owner-only chain from home (verifyClaudeReleaseCopy); refuse an unsafe parent
+        // now, so it never costs a download that the final check would throw away.
+        const uid = process.getuid?.();
+        if (uid === undefined)
+            throw rejected();
+        for (const dir of chainFrom(input.home, claudeReleaseRoot(input.home)))
+            if (!ownerOnlyDirectory(await lstat(dir, { bigint: true }), uid))
+                throw rejected();
+        const temporary = path.join(staging, `${randomUUID()}.download`);
+        const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        const controller = new AbortController(), stop = () => controller.abort(), timer = setTimeout(stop, input.timeoutMs ?? FETCH_TIMEOUT_MS);
+        if (input.signal?.aborted)
+            stop();
+        else
+            input.signal?.addEventListener('abort', stop, { once: true });
+        let installed = false;
+        try {
+            let response;
+            try {
+                response = await input.fetchFn(url, { method: 'GET', redirect: 'error', signal: controller.signal });
+            }
+            catch {
+                throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            const body = response.body, declared = response.headers.get('content-length');
+            if (response.status !== 200 || !body || declared !== null && (!/^\d{1,12}$/.test(declared) || Number(declared) > maxBytes)) {
+                await body?.cancel().catch(() => { });
+                throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            const hash = createHash('sha256'), reader = body.getReader();
+            let size = 0;
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > maxBytes)
+                        throw Error('CLAUDE_RELEASE_SIZE_REJECTED');
+                    hash.update(value);
+                    await writeAll(file, value);
+                }
+            }
+            catch (error) {
+                await reader.cancel().catch(() => { });
+                throw error instanceof Error && error.message === 'CLAUDE_RELEASE_SIZE_REJECTED' ? error : Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            await file.sync();
+            await file.close();
+            if (hash.digest('hex') !== release.binary_sha256 || await measureCommandFile(temporary).catch(() => undefined) !== release.binary_sha256)
+                throw Error('CLAUDE_RELEASE_HASH_MISMATCH');
+            await verifyClaudeCodeSignature(temporary, input.codesign);
+            await chmod(temporary, 0o500);
+            await privateDirectory(path.dirname(target));
+            await rename(temporary, target);
+            installed = true;
+            try {
+                const directory = await open(path.dirname(target), constants.O_RDONLY);
+                try {
+                    await directory.sync();
+                }
+                finally {
+                    await directory.close();
+                }
+                const copy = await verifyClaudeReleaseCopy(input.home, release);
+                await verifyClaudeCodeSignature(copy, input.codesign);
+                return copy;
+            }
+            catch (error) {
+                await rm(target, { force: true }).catch(() => { });
+                throw error;
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            input.signal?.removeEventListener('abort', stop);
+            await file.close().catch(() => { });
+            if (!installed)
+                await rm(temporary, { force: true }).catch(() => { });
+        }
+    }
+    return {
+        /** One provisioning at a time: the same release joins the running one; another release is refused until it ends. */
+        ensure(listed) {
+            const release = listedRelease(listed);
+            if (!release)
+                return Promise.reject(Error('CLAUDE_RELEASE_FETCH_REJECTED'));
+            const key = `${release.version}/${release.platform}/${release.binary_sha256}`;
+            if (current?.key === key)
+                return current.promise;
+            if (current)
+                return Promise.reject(Error('CLAUDE_RELEASE_PROVISION_BUSY'));
+            const promise = install(release).finally(() => { if (current?.promise === promise)
+                current = undefined; });
+            current = { key, promise };
+            return promise;
+        },
+    };
+}