mtech-ai-local-runner 0.1.61 → 0.1.62

package/dist/src/safety/claude-production-host.js

@@ -0,0 +1,261 @@
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { lstat, realpath } from 'node:fs/promises';
+import { isDeepStrictEqual } from 'node:util';
+import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
+import { claudeLoginFromStatus } from '../adapters/claude-code/login-status.js';
+import { captureClaudeBinaryIdentity } from './claude-binary-identity.js';
+import { commandRegistryFingerprint } from './job-security-session.js';
+import { localToolInventory } from './local-tool-server.js';
+import { CLAUDE_MANDATORY_GATES, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256, hostClaudePlatform, requireClaudeRequirements } from './claude-release.js';
+import { claudeReleaseCopyPath, claudeReleaseRoot, createClaudeReleaseProvisioner, verifyClaudeCodeSignature, verifyClaudeReleaseCopy } from './claude-release-copy.js';
+import { claudeManagedScopeDeps, claudeManagedScopeReady, collectClaudeManagedScope } from './claude-managed-scope.js';
+/** A release whose provisioning failed is not fetched again before this delay, doubled per further consecutive failure
+ * of the same release up to CLAUDE_PROVISION_MAX_RETRY_MS. A listing change or a success resets it. */
+export const CLAUDE_PROVISION_RETRY_MS = 15 * 60_000;
+/** Upper bound of the provisioning backoff: a deterministic failure costs at most one download a day. */
+export const CLAUDE_PROVISION_MAX_RETRY_MS = 24 * 60 * 60_000;
+/** The provisioner is running another release: not a failure, so no backoff; the next sync or probe retries. */
+const PROVISION_BUSY = 'CLAUDE_RELEASE_PROVISION_BUSY';
+/** File identity of the copy for the probe memo; undefined when it cannot be read or its path is not its realpath. */
+async function copyStamp(file) {
+    try {
+        if (await realpath(file) !== file)
+            return undefined;
+        const s = await lstat(file, { bigint: true });
+        return [s.dev, s.ino, s.size, s.mtimeNs, s.ctimeNs, s.mode, s.nlink, s.uid].join(':');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The fixed launch shape of adapters/claude-code/adapter.ts (`args`); pinned as configSha256. Change both together.
+ * `flags` is every flag name the adapter always passes, `conditional_flags` every flag it passes only for some jobs
+ * (budget, resume or new session), and `settings_keys` the leaf paths of its inline `--settings` JSON. The adapter test
+ * checks both directions: every argv flag is pinned here, and every key here is observed in argv. */
+export const CLAUDE_LAUNCH_CONFIG = Object.freeze({ transport: CLAUDE_TRANSPORT, input_format: 'stream-json', output_format: 'stream-json', permission_mode: 'default',
+    tools: '', allowed_tools: 'ai_local', strict_mcp_config: true, setting_sources: '', disable_slash_commands: true, chrome: false,
+    flags: Object.freeze(['--allowedTools', '--disable-slash-commands', '--include-partial-messages', '--input-format', '--mcp-config', '--model', '--name',
+        '--no-chrome', '--output-format', '--permission-mode', '--print', '--setting-sources', '--settings', '--strict-mcp-config', '--tools', '--verbose']),
+    conditional_flags: Object.freeze(['--max-budget-usd', '--resume', '--session-id']),
+    settings_keys: Object.freeze(['hooks.PreToolUse']) });
+const CHECK_IDS = { CLAUDE_RELEASE_NOT_LISTED: 'release_list', CLAUDE_RELEASE_PLATFORM_MISMATCH: 'release_platform',
+    CLAUDE_RELEASE_COPY_UNAVAILABLE: 'release_copy', CLAUDE_CODE_SIGNATURE_REJECTED: 'release_copy', CLAUDE_MANAGED_SCOPE_UNVERIFIED: 'managed_scope' };
+/** A login probe answer (any status) is reused this long for the same release and copy identity. */
+export const CLAUDE_LOGIN_PROBE_TTL_MS = 5 * 60_000;
+const CLAUDE_LOGIN_PROBE_TIMEOUT_MS = 10_000;
+/** Readiness only: after a signature failure, the same release and copy identity is not re-hashed or run through
+ * codesign again before this delay; a new identity, a new listing or the delay re-checks at once. */
+export const CLAUDE_SIGNATURE_RECHECK_MS = 5 * 60_000;
+/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment and the job's
+ * account location. The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
+ * `timeoutMs` is a trusted in-process test seam only. */
+export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS) {
+    return binary => new Promise(resolve => {
+        const account = env.CLAUDE_CONFIG_DIR ?? path.join(home, '.claude');
+        if (!path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
+            return resolve({ authenticated: false, loginStatus: 'unknown' });
+        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, CLAUDE_CONFIG_DIR: account,
+            DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
+        for (const key of ['USER', 'LOGNAME']) {
+            const value = env[key];
+            if (value !== undefined)
+                childEnv[key] = value;
+        }
+        execFile(binary, ['auth', 'status', '--json'], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 65_536, env: childEnv }, (error, stdout) => {
+            if (!error)
+                return resolve(claudeLoginFromStatus(stdout));
+            // Claude exits 1 for a known logged-out JSON answer; other failures prove nothing.
+            resolve(error.code === 1 && typeof stdout === 'string' ? claudeLoginFromStatus(stdout, true) : { authenticated: false, loginStatus: 'unknown' });
+        });
+    });
+}
+/** Compiled Claude composition (decision 9095c7a8). The Gateway's synced release is the only one fetched or run.
+ * No environment, task or saved JSON creates an admission capability. */
+export function createClaudeProductionHost(input) {
+    const platform = input.platform ?? hostClaudePlatform(), now = input.now ?? Date.now, abort = new AbortController();
+    const managed = input.managedScope ?? claudeManagedScopeDeps(), login = input.login ?? pinnedClaudeLogin(input.home, input.env);
+    const provisioner = createClaudeReleaseProvisioner({ home: input.home, platform, fetchFn: input.fetchFn, codesign: input.codesign, signal: abort.signal });
+    const failures = new Map(), key = (r) => `${r.version}/${r.platform}/${r.binary_sha256}`;
+    let listed = null, inflight, retryKey, pending = Promise.resolve(), closed = false;
+    /** Probe-only memo (readiness runs on every heartbeat): the release and the copy's file identity, held across a
+     * full byte and code-signature verification in this process that saw the file unchanged throughout. Job paths never
+     * read it; any failed verification clears it. */
+    let probeMemo;
+    /** Probe-only negative memo: a code-signature failure of this release's copy at this file identity, until
+     * CLAUDE_SIGNATURE_RECHECK_MS passes, a new file identity appears or the listed release changes. Job paths never read it. */
+    let signatureRejected;
+    /** Readiness only: the last login probe answer, for the release, copy path and copy identity it ran against. */
+    let loginCache;
+    const report = (event) => { try {
+        input.report?.(event);
+    }
+    catch { /* A reporter never fails provisioning. */ } };
+    /** Background only: handleRelease is not awaited, so this promise settles and never rejects. */
+    const provision = (release) => {
+        const k = key(release), last = failures.get(k);
+        if (closed || release.platform !== platform || inflight !== undefined
+            || last !== undefined && now() - last.at < Math.min(CLAUDE_PROVISION_RETRY_MS * 2 ** (last.count - 1), CLAUDE_PROVISION_MAX_RETRY_MS))
+            return;
+        inflight = k;
+        if (retryKey === k)
+            retryKey = undefined;
+        pending = (async () => {
+            try {
+                await provisioner.ensure(release);
+                failures.delete(k);
+            }
+            catch (error) {
+                const code = error instanceof Error && /^CLAUDE_[A-Z_]+$/.test(error.message) ? error.message : 'CLAUDE_RELEASE_PROVISION_FAILED';
+                if (code === PROVISION_BUSY) {
+                    retryKey = k;
+                    return;
+                }
+                failures.set(k, { count: (failures.get(k)?.count ?? 0) + 1, at: now() });
+                report({ event: 'claude_release_provision_failed', code });
+            }
+            finally {
+                inflight = undefined;
+            }
+        })();
+    };
+    const currentRelease = () => {
+        const release = listed;
+        if (!release)
+            throw Error('CLAUDE_RELEASE_NOT_LISTED');
+        if (release.platform !== platform)
+            throw Error('CLAUDE_RELEASE_PLATFORM_MISMATCH');
+        return release;
+    };
+    const verifyRelease = async (release) => {
+        try {
+            return await verifyClaudeReleaseCopy(input.home, release);
+        }
+        catch {
+            probeMemo = undefined;
+            provision(release);
+            throw Error('CLAUDE_RELEASE_COPY_UNAVAILABLE');
+        }
+    };
+    /** Full location and byte verification of the listed copy: every job path. */
+    const verifiedCopy = async () => {
+        const release = currentRelease();
+        return { release, binary: await verifyRelease(release) };
+    };
+    /** Readiness only: skips the re-hash and codesign while the release and the copy's file identity are unchanged since
+     * a full verification. A copy is never reported ready, nor run by the login probe, before its signature passed here. */
+    const probedCopy = async () => {
+        const release = currentRelease(), k = key(release), memo = probeMemo;
+        if (memo?.key === k) {
+            const stamp = await copyStamp(memo.binary);
+            if (stamp !== undefined && stamp === memo.stamp)
+                return { release, binary: memo.binary, stamp };
+        }
+        probeMemo = undefined;
+        const bad = signatureRejected;
+        // The same release and file identity, failed less than the delay ago: blocked without hashing or running codesign.
+        if (bad?.key === k && now() - bad.at < CLAUDE_SIGNATURE_RECHECK_MS) {
+            const stamp = await copyStamp(bad.binary);
+            if (stamp !== undefined && stamp === bad.stamp)
+                throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+        }
+        signatureRejected = undefined;
+        let before;
+        try {
+            before = await copyStamp(claudeReleaseCopyPath(input.home, release));
+        }
+        catch { /* No stamp, no memo; verification decides. */ }
+        const binary = await verifyRelease(release);
+        // Bytes and signature are separate checks (verifyClaudeReleaseCopy, verifyClaudeCodeSignature): both, as on job paths.
+        try {
+            await verifyClaudeCodeSignature(binary, input.codesign);
+        }
+        catch {
+            probeMemo = undefined;
+            const rejectedStamp = await copyStamp(binary);
+            if (before !== undefined && rejectedStamp === before && listed === release)
+                signatureRejected = { key: k, binary, stamp: rejectedStamp, at: now() };
+            throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+        }
+        const after = await copyStamp(binary);
+        if (before !== undefined && after === before && listed === release)
+            probeMemo = { key: k, binary, stamp: after };
+        return { release, binary, stamp: after };
+    };
+    const blocked = (code, executableVersion) => ({ available: false, authenticated: false, loginStatus: 'unknown', capabilities: [], reason: code,
+        ...(executableVersion ? { executableVersion } : {}), admission: { checks: [{ id: CHECK_IDS[code] ?? 'release_copy', status: 'blocked', code }] } });
+    const securityHost = async (request) => {
+        if (closed)
+            throw Error('CLAUDE_HOST_CLOSED');
+        const requirements = requireClaudeRequirements(request.requirements, { adapterId: request.adapterId, adapterVersion: request.adapterVersion }), release = requirements.release;
+        const { release: synced, binary } = await verifiedCopy();
+        if (release.version !== synced.version || release.platform !== synced.platform || release.binary_sha256 !== synced.binary_sha256
+            || !isDeepStrictEqual([...release.model_ids], [...synced.model_ids]) || release.platform !== platform || !release.model_ids.includes(request.modelId))
+            throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+        await verifyClaudeCodeSignature(binary, input.codesign);
+        const scope = await collectClaudeManagedScope(managed), commandRegistry = [];
+        const pin = { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: request.jobId, generation: request.generation, modelId: request.modelId, sourceSha: request.sourceSha,
+            binarySha256: release.binary_sha256, configSha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), managedPolicySha256: scope.fingerprint,
+            toolsSha256: claudeCanonicalSha256({ tools: localToolInventory() }), commandsSha256: commandRegistryFingerprint(commandRegistry),
+            osProfileSha256: claudeCanonicalSha256({ platform }), requirementsSha256: requirements.fingerprint, securityMode: CLAUDE_RELEASE_MODE };
+        return { pin, commandRegistry,
+            // The job MCP token is the session identity (accepted risk job_mcp_token_possession_not_os_identity).
+            nativeBinding: () => ({ jobId: request.jobId, threadId: request.launchFingerprint, turnId: request.contractFingerprint, generation: request.generation }),
+            verify: async (captured) => {
+                if (closed || captured.binarySha256 !== release.binary_sha256 || captured.securityMode !== CLAUDE_RELEASE_MODE)
+                    throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+                await verifyClaudeReleaseCopy(input.home, release).catch(error => { probeMemo = undefined; throw error; });
+                return { version: 2, pin: captured, checks: CLAUDE_MANDATORY_GATES.map(gate => ({ gate, status: 'passed' })) };
+            } };
+    };
+    return {
+        /** Sync consumer: the Gateway's one listed release, or null. Provisioning starts when the listed release changes,
+         * or again for the same release when the provisioner was busy. A listing change also resets the backoff. */
+        handleRelease(value) {
+            if (closed)
+                return;
+            const changed = (listed ? key(listed) : null) !== (value ? key(value) : null);
+            listed = value;
+            if (changed) {
+                failures.clear();
+                signatureRejected = undefined;
+            }
+            if (value && (changed || retryKey === key(value)))
+                provision(value);
+        },
+        /** Settles once the provisioning started so far has ended. */
+        async settled() { await pending; },
+        async probe() {
+            let copy;
+            try {
+                copy = await probedCopy();
+            }
+            catch (error) {
+                return blocked(error instanceof Error ? error.message : 'CLAUDE_RELEASE_COPY_UNAVAILABLE');
+            }
+            try {
+                await claudeManagedScopeReady(managed);
+            }
+            catch {
+                return blocked('CLAUDE_MANAGED_SCOPE_UNVERIFIED', copy.release.version);
+            }
+            // At most one vendor process per TTL, also for an employee who stays logged out; a new release or copy probes at once.
+            const identity = [key(copy.release), copy.binary, copy.stamp ?? ''].join('\0'), cached = loginCache;
+            let status;
+            if (cached?.identity === identity && now() - cached.at < CLAUDE_LOGIN_PROBE_TTL_MS)
+                status = cached.status;
+            else {
+                status = await login(copy.binary).catch(() => ({ authenticated: false, loginStatus: 'unknown' }));
+                loginCache = { identity, at: now(), status };
+            }
+            return { available: true, authenticated: status.authenticated, loginStatus: status.loginStatus, executableVersion: copy.release.version, capabilities: [...CLAUDE_CAPABILITIES] };
+        },
+        /** Per job: a fresh identity of the current verified copy, so a release change moves the launch path safely. */
+        async binaryIdentity() {
+            const { binary } = await verifiedCopy();
+            return captureClaudeBinaryIdentity({ launchPath: binary, allowedRoots: [claudeReleaseRoot(input.home)] });
+        },
+        securityHost,
+        async close() { closed = true; abort.abort(); await pending; },
+    };
+}

package/dist/src/safety/claude-release-copy.js

@@ -0,0 +1,233 @@
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, open, realpath, rename, rm } from 'node:fs/promises';
+import { measureCommandFile } from './registered-command-integrity.js';
+import { CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, claudeReleaseUrl, parseClaudeSyncRelease } from './claude-release.js';
+const rejected = () => Error('CLAUDE_RELEASE_COPY_REJECTED');
+const validHome = (home) => typeof home === 'string' && path.isAbsolute(home) && path.resolve(home) === home && home !== '/' && home.length <= 4096 && !/[\r\n\0]/.test(home);
+/** Runner-owned root of pinned Claude copies. The employee's own `claude` install is never used. */
+export function claudeReleaseRoot(home) {
+    if (!validHome(home))
+        throw rejected();
+    return path.join(home, '.local', 'share', 'mtec-ai-local-runner', 'claude');
+}
+export function claudeReleaseCopyPath(home, release) {
+    const r = parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
+    if (!r)
+        throw rejected();
+    return path.join(claudeReleaseRoot(home), r.version, r.binary_sha256, 'claude');
+}
+/** Every path from `home` down to `target`, both inclusive. */
+function chainFrom(home, target) {
+    const paths = [home];
+    let current = home;
+    for (const part of path.relative(home, target).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        paths.push(current);
+    }
+    return paths;
+}
+/** Owned by the runner's user, not writable by group or others, and not a symlink. */
+const ownerOnly = (s, uid) => s.uid === BigInt(uid) && (s.mode & 18n) === 0n && !s.isSymbolicLink();
+/** The predicate for every directory of the copy's chain, from `home` down. */
+const ownerOnlyDirectory = (s, uid) => ownerOnly(s, uid) && s.isDirectory();
+/** Owner-only chain, no symlink or hard link, executable, unchanged realpath and re-hashed bytes
+ * (modeled on verifyCodexStandaloneBinary). A measurement, not an atomic exec; the identity re-measures before spawn. */
+export async function verifyClaudeReleaseCopy(home, release) {
+    try {
+        const binary = claudeReleaseCopyPath(home, release), uid = process.getuid?.();
+        if (uid === undefined || await realpath(home) !== home)
+            throw rejected();
+        const paths = chainFrom(home, binary);
+        const inspect = async () => Promise.all(paths.map(async (file, index) => {
+            const s = await lstat(file, { bigint: true }), last = index === paths.length - 1;
+            if (last ? !ownerOnly(s, uid) || !s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n : !ownerOnlyDirectory(s, uid))
+                throw rejected();
+            return [s.dev, s.ino, s.uid, s.mode, last ? s.mtimeNs : 0n, last ? s.ctimeNs : 0n].join(':');
+        }));
+        const before = await inspect();
+        if (await realpath(binary) !== binary || await measureCommandFile(binary) !== release.binary_sha256)
+            throw rejected();
+        const after = await inspect();
+        if (after.join('|') !== before.join('|') || await realpath(binary) !== binary)
+            throw rejected();
+        return binary;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export const CLAUDE_CODESIGN = '/usr/bin/codesign';
+/** Apple-anchored chain through the Developer ID CA (1.2.840.113635.100.6.2.6) to a Developer ID Application leaf
+ * (1.2.840.113635.100.6.1.13) of Anthropic's team, with the official identifier. Apple Development, Apple Distribution
+ * and Mac App Store leaves of the same team do not match. */
+export const CLAUDE_CODE_REQUIREMENT = `=anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${CLAUDE_TEAM_ID}" and identifier "${CLAUDE_SIGNING_IDENTIFIER}"`;
+/** Absolute tool path, no shell, fixed environment; a non-zero exit rejects. */
+export const runCodesign = args => new Promise((resolve, reject) => {
+    execFile(CLAUDE_CODESIGN, [...args], { encoding: 'utf8', timeout: 120_000, maxBuffer: 65_536, env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } }, (error, stdout, stderr) => error ? reject(Error('CLAUDE_CODE_SIGNATURE_REJECTED')) : resolve({ stdout, stderr }));
+});
+export async function verifyClaudeCodeSignature(file, run = runCodesign) {
+    try {
+        if (!path.isAbsolute(file) || /[\r\n\0]/.test(file))
+            throw Error();
+        await run(['--verify', '--strict', '-R', CLAUDE_CODE_REQUIREMENT, file]);
+        const { stdout, stderr } = await run(['-dv', '--verbose=2', file]);
+        const lines = `${stdout}\n${stderr}`.split('\n').map(line => line.trim());
+        const only = (key, value) => { const found = lines.filter(line => line.startsWith(`${key}=`)); return found.length === 1 && found[0] === `${key}=${value}`; };
+        if (!only('Identifier', CLAUDE_SIGNING_IDENTIFIER) || !only('TeamIdentifier', CLAUDE_TEAM_ID))
+            throw Error();
+    }
+    catch {
+        throw Error('CLAUDE_CODE_SIGNATURE_REJECTED');
+    }
+}
+/** Official builds are about 245 MB; the cap stays below measureCommandFile's 512 MiB limit. */
+export const CLAUDE_RELEASE_MAX_BYTES = 384 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 15 * 60_000;
+async function privateDirectory(dir) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const s = await lstat(dir), uid = process.getuid?.();
+    if (uid === undefined || !s.isDirectory() || s.isSymbolicLink() || s.uid !== uid || (s.mode & 0o077) !== 0 || await realpath(dir) !== dir)
+        throw rejected();
+}
+async function writeAll(file, chunk) {
+    for (let offset = 0; offset < chunk.byteLength;) {
+        const { bytesWritten } = await file.write(chunk, offset, chunk.byteLength - offset);
+        offset += bytesWritten;
+    }
+}
+/** The release exactly as the strict parser reads it, or null: the URL and paths never come from a looser reading. */
+function listedRelease(release) {
+    try {
+        return parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
+    }
+    catch {
+        return null;
+    }
+}
+/** Guarded fetch of one listed release (design "Provisioning a listed release"). Fixed endpoint and no redirect.
+ * Exclusive 0600 temp file in a 0700 staging directory under the same root, so the same filesystem.
+ * Byte cap and streaming sha256, then the code signature, then chmod and an atomic rename,
+ * then bytes/location and the signature once more on the installed path.
+ * Bytes that fail any check are deleted and never run. */
+export function createClaudeReleaseProvisioner(input) {
+    const maxBytes = input.maxBytes ?? CLAUDE_RELEASE_MAX_BYTES;
+    let current;
+    async function install(release) {
+        if (!input.platform || release.platform !== input.platform)
+            throw Error('CLAUDE_RELEASE_PLATFORM_MISMATCH');
+        let existing;
+        try {
+            existing = await verifyClaudeReleaseCopy(input.home, release);
+        }
+        catch { /* Absent or drifted: fetch the listed bytes. */ }
+        // Bytes and location are one check, the code signature another: no success without both on the path we return.
+        if (existing) {
+            await verifyClaudeCodeSignature(existing, input.codesign);
+            return existing;
+        }
+        const url = claudeReleaseUrl(release), target = claudeReleaseCopyPath(input.home, release), staging = path.join(claudeReleaseRoot(input.home), '.staging');
+        if (await realpath(input.home) !== input.home)
+            throw rejected();
+        await privateDirectory(staging);
+        // The installed copy must pass the owner-only chain from home (verifyClaudeReleaseCopy); refuse an unsafe parent
+        // now, so it never costs a download that the final check would throw away.
+        const uid = process.getuid?.();
+        if (uid === undefined)
+            throw rejected();
+        for (const dir of chainFrom(input.home, claudeReleaseRoot(input.home)))
+            if (!ownerOnlyDirectory(await lstat(dir, { bigint: true }), uid))
+                throw rejected();
+        const temporary = path.join(staging, `${randomUUID()}.download`);
+        const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        const controller = new AbortController(), stop = () => controller.abort(), timer = setTimeout(stop, input.timeoutMs ?? FETCH_TIMEOUT_MS);
+        if (input.signal?.aborted)
+            stop();
+        else
+            input.signal?.addEventListener('abort', stop, { once: true });
+        let installed = false;
+        try {
+            let response;
+            try {
+                response = await input.fetchFn(url, { method: 'GET', redirect: 'error', signal: controller.signal });
+            }
+            catch {
+                throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            const body = response.body, declared = response.headers.get('content-length');
+            if (response.status !== 200 || !body || declared !== null && (!/^\d{1,12}$/.test(declared) || Number(declared) > maxBytes)) {
+                await body?.cancel().catch(() => { });
+                throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            const hash = createHash('sha256'), reader = body.getReader();
+            let size = 0;
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > maxBytes)
+                        throw Error('CLAUDE_RELEASE_SIZE_REJECTED');
+                    hash.update(value);
+                    await writeAll(file, value);
+                }
+            }
+            catch (error) {
+                await reader.cancel().catch(() => { });
+                throw error instanceof Error && error.message === 'CLAUDE_RELEASE_SIZE_REJECTED' ? error : Error('CLAUDE_RELEASE_FETCH_REJECTED');
+            }
+            await file.sync();
+            await file.close();
+            if (hash.digest('hex') !== release.binary_sha256 || await measureCommandFile(temporary).catch(() => undefined) !== release.binary_sha256)
+                throw Error('CLAUDE_RELEASE_HASH_MISMATCH');
+            await verifyClaudeCodeSignature(temporary, input.codesign);
+            await chmod(temporary, 0o500);
+            await privateDirectory(path.dirname(target));
+            await rename(temporary, target);
+            installed = true;
+            try {
+                const directory = await open(path.dirname(target), constants.O_RDONLY);
+                try {
+                    await directory.sync();
+                }
+                finally {
+                    await directory.close();
+                }
+                const copy = await verifyClaudeReleaseCopy(input.home, release);
+                await verifyClaudeCodeSignature(copy, input.codesign);
+                return copy;
+            }
+            catch (error) {
+                await rm(target, { force: true }).catch(() => { });
+                throw error;
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            input.signal?.removeEventListener('abort', stop);
+            await file.close().catch(() => { });
+            if (!installed)
+                await rm(temporary, { force: true }).catch(() => { });
+        }
+    }
+    return {
+        /** One provisioning at a time: the same release joins the running one; another release is refused until it ends. */
+        ensure(listed) {
+            const release = listedRelease(listed);
+            if (!release)
+                return Promise.reject(Error('CLAUDE_RELEASE_FETCH_REJECTED'));
+            const key = `${release.version}/${release.platform}/${release.binary_sha256}`;
+            if (current?.key === key)
+                return current.promise;
+            if (current)
+                return Promise.reject(Error('CLAUDE_RELEASE_PROVISION_BUSY'));
+            const promise = install(release).finally(() => { if (current?.promise === promise)
+                current = undefined; });
+            current = { key, promise };
+            return promise;
+        },
+    };
+}

package/dist/src/safety/claude-release.js

@@ -0,0 +1,89 @@
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+/*
+ * Runner mirror of the Gateway Claude release contract (AiOpsClaudeReleasePolicy, Work Decision 9095c7a8).
+ * Gates, risks, transport, distribution endpoint and signing identity change only with a Runner release.
+ * Only the reviewed release entry moves with the Gateway: the `claude_release` sync field and the job descriptor.
+ */
+export const CLAUDE_RELEASE_MODE = 'supported_cli_claude_release_policy_v1';
+export const CLAUDE_REQUIREMENTS_VERSION = 'cli-claude-security-requirements-v1';
+export const CLAUDE_TRANSPORT = 'official_stream_json_v1';
+export const CLAUDE_EVIDENCE_CLASS = 'reviewed_claude_release';
+export const CLAUDE_POLICY_SCOPE = 'unmanaged_personal_only';
+export const CLAUDE_PLATFORMS = Object.freeze(['darwin-arm64', 'darwin-x64']);
+export const CLAUDE_RELEASE_GATES = Object.freeze(['binary_release', 'official_permissions', 'managed_scope_exclusion', 'required_mcp_startup', 'source_exclusion', 'auth_backend_compatibility']);
+export const CLAUDE_INPUT_GATES = Object.freeze(['exact_inputs', 'launch_binding', 'repository_scope', 'private_paths_environment', 'owned_lifecycle']);
+export const CLAUDE_MANDATORY_GATES = Object.freeze([...CLAUDE_RELEASE_GATES, ...CLAUDE_INPUT_GATES]);
+export const CLAUDE_RISKS = Object.freeze(['vendor_native_policy_enforcement', 'managed_policy_not_directly_observed_per_job', 'first_inference_order_not_observed_per_job',
+    'job_mcp_token_possession_not_os_identity', 'account_startup_may_refresh_shared_credentials', 'concurrent_policy_change_not_atomic',
+    'local_account_metadata_not_remote_entitlement', 'privileged_prelaunch_mdm_snapshot_not_continuously_reobserved', 'release_list_served_by_gateway']);
+/** Apple Developer ID team and code identifier of official builds (Work Evidence c85ec02c). */
+export const CLAUDE_TEAM_ID = 'Q6L2SF6YDW';
+export const CLAUDE_SIGNING_IDENTIFIER = 'com.anthropic.claude-code';
+/** Official native-build distribution. Never taken from the Gateway, a task, config or env. */
+export const CLAUDE_DOWNLOAD_BASE = 'https://downloads.claude.ai/claude-code-releases';
+/** The installed privileged observer; the same reviewed binary the Codex daemon release pins. */
+export const CLAUDE_POLICY_OBSERVER = Object.freeze({ protocol: 'policy-inventory-v1', sha256: '2a07812cd47782826a359b749096b681a6ee49e91f990d48abdc60f2d46e4c9c' });
+/** macOS managed sources (docs/superpowers/specs/2026-10-16-cli-managed-auth-lab-scope.json) and the MDM preference domain. */
+export const CLAUDE_MANAGED_SETTINGS_DIRECTORY = '/Library/Application Support/ClaudeCode';
+export const CLAUDE_MANAGED_SETTINGS_FILES = Object.freeze([`${CLAUDE_MANAGED_SETTINGS_DIRECTORY}/managed-settings.json`, `${CLAUDE_MANAGED_SETTINGS_DIRECTORY}/managed-mcp.json`]);
+export const CLAUDE_MANAGED_PREFERENCE_DOMAIN = 'com.anthropic.claudecode';
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const keys = (v) => Object.keys(v).sort();
+const digest = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const models = (v) => Array.isArray(v) && v.length > 0 && new Set(v).size === v.length && v.every(m => typeof m === 'string' && /^[A-Za-z0-9._:-]{1,128}$/.test(m));
+const common = (v) => typeof v.version === 'string' && /^\d{1,4}\.\d{1,4}\.\d{1,6}$/.test(v.version)
+    && CLAUDE_PLATFORMS.includes(v.platform) && digest(v.binary_sha256) && models(v.model_ids);
+function canonical(v) { if (Array.isArray(v))
+    return v.map(canonical); if (record(v))
+    return Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])])); return v; }
+function freeze(value) { if (value && typeof value === 'object') {
+    for (const item of Object.values(value))
+        freeze(item);
+    Object.freeze(value);
+} return value; }
+/** Same canonical JSON as securityRequirementsFingerprint and the Gateway's JSON_UNESCAPED_SLASHES hashing. */
+export function claudeCanonicalSha256(value) {
+    return createHash('sha256').update(JSON.stringify(canonical(value)).replace(/[\u007f-￿]/g, c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'))).digest('hex');
+}
+/** The sync field `claude_release`: the one release this runner may fetch. Null or malformed both read as not listed. */
+export function parseClaudeSyncRelease(value) {
+    if (!record(value) || !isDeepStrictEqual(keys(value), ['binary_sha256', 'model_ids', 'platform', 'version']) || !common(value))
+        return null;
+    return freeze({ version: value.version, platform: value.platform, binary_sha256: value.binary_sha256, model_ids: [...value.model_ids] });
+}
+export function requireClaudeRelease(value) {
+    if (!record(value) || !isDeepStrictEqual(keys(value), ['binary_sha256', 'decision_id', 'evidence_sha256', 'model_ids', 'platform', 'review_status', 'version']) || !common(value)
+        || !digest(value.evidence_sha256) || typeof value.decision_id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value.decision_id)
+        || value.review_status !== 'reviewed')
+        throw Error('CLAUDE_REQUIREMENTS_REJECTED');
+    return freeze(structuredClone(value));
+}
+const DESCRIPTOR_KEYS = ['accepted_residual_risks', 'adapter_id', 'adapter_version', 'evidence_class', 'fingerprint', 'mandatory_gates', 'model_ids', 'policy_scope', 'release', 'release_manifest_sha256', 'security_mode', 'status', 'transport', 'version'];
+/** Strict parser for the frozen Claude job descriptor: only the verified descriptor of one reviewed release passes. */
+export function requireClaudeRequirements(value, expected) {
+    const rejected = () => Error('CLAUDE_REQUIREMENTS_REJECTED');
+    if (!record(value) || !isDeepStrictEqual(keys(value), DESCRIPTOR_KEYS))
+        throw rejected();
+    const release = requireClaudeRelease(value.release), { fingerprint, ...unsigned } = value;
+    if (value.version !== CLAUDE_REQUIREMENTS_VERSION || value.security_mode !== CLAUDE_RELEASE_MODE || value.transport !== CLAUDE_TRANSPORT
+        || value.adapter_id !== 'claude_code_cli' || value.adapter_id !== expected.adapterId || value.adapter_version !== '1' || value.adapter_version !== expected.adapterVersion
+        || !isDeepStrictEqual(value.mandatory_gates, [...CLAUDE_MANDATORY_GATES]) || value.status !== 'verified' || value.evidence_class !== CLAUDE_EVIDENCE_CLASS
+        || value.policy_scope !== CLAUDE_POLICY_SCOPE || !isDeepStrictEqual(value.accepted_residual_risks, [...CLAUDE_RISKS])
+        || value.release_manifest_sha256 !== claudeCanonicalSha256(release) || !isDeepStrictEqual(value.model_ids, [...release.model_ids])
+        || !digest(fingerprint) || claudeCanonicalSha256(unsigned) !== fingerprint || expected.requirementsSha256 !== undefined && fingerprint !== expected.requirementsSha256)
+        throw rejected();
+    return freeze(structuredClone(value));
+}
+/** Host platform in the Gateway's naming, or undefined where no official build is admitted. */
+export function hostClaudePlatform(platform = process.platform, arch = process.arch) {
+    if (platform !== 'darwin')
+        return undefined;
+    return arch === 'arm64' ? 'darwin-arm64' : arch === 'x64' ? 'darwin-x64' : undefined;
+}
+export function claudeReleaseUrl(release) {
+    const r = parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
+    if (!r)
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    return `${CLAUDE_DOWNLOAD_BASE}/${r.version}/${r.platform}/claude`;
+}

package/dist/src/safety/job-security-policy.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { SUPPORTED_CLI_MODE, SUPPORTED_CLI_GATES } from './cli-security-modes.js';
+import { CLAUDE_RELEASE_MODE, CLAUDE_MANDATORY_GATES } from './claude-release.js';
 /** Mandatory for every CLI. New adapter IDs do not alter this gate set. */
 export const JOB_SECURITY_GATES = Object.freeze(['binary_binding', 'native_tools', 'managed_policy', 'credential_boundary', 'source_command_scope', 'request_binding', 'provider_egress', 'owned_lifecycle']);
 const issued = new WeakMap();
@@ -7,9 +8,12 @@ const rejected = () => new Error('JOB_SECURITY_REJECTED');
 const keys = ['adapterId', 'adapterVersion', 'jobId', 'generation', 'modelId', 'sourceSha', 'binarySha256', 'configSha256', 'managedPolicySha256', 'toolsSha256', 'commandsSha256', 'osProfileSha256', 'requirementsSha256'];
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const exact = (v, names) => JSON.stringify(Object.keys(v).sort()) === JSON.stringify([...names].sort());
+/** Each explicit mode belongs to exactly one adapter and one gate set (Claude: decision 9095c7a8). */
+const MODE_ADAPTER = Object.freeze({ [SUPPORTED_CLI_MODE]: 'codex_cli', [CLAUDE_RELEASE_MODE]: 'claude_code_cli' });
+const modeGates = (mode) => mode === SUPPORTED_CLI_MODE ? SUPPORTED_CLI_GATES : mode === CLAUDE_RELEASE_MODE ? CLAUDE_MANDATORY_GATES : JOB_SECURITY_GATES;
 function validPin(value) {
     if (!object(value) || !exact(value, value.securityMode === undefined ? keys : [...keys, 'securityMode'])
-        || value.securityMode !== undefined && (value.securityMode !== SUPPORTED_CLI_MODE || value.adapterId !== 'codex_cli') || !Number.isSafeInteger(value.generation) || Number(value.generation) < 1)
+        || value.securityMode !== undefined && (typeof value.securityMode !== 'string' || !Object.hasOwn(MODE_ADAPTER, value.securityMode) || MODE_ADAPTER[value.securityMode] !== value.adapterId) || !Number.isSafeInteger(value.generation) || Number(value.generation) < 1)
         return false;
     for (const name of keys.filter(k => k !== 'generation')) {
         const v = value[name];
@@ -28,7 +32,7 @@ export async function admitJobSecurity(expected, verify) {
             throw rejected();
         const pin = Object.freeze(structuredClone(expected));
         const receipt = await verify(pin);
-        const gates = pin.securityMode === SUPPORTED_CLI_MODE ? SUPPORTED_CLI_GATES : JOB_SECURITY_GATES;
+        const gates = modeGates(pin.securityMode);
         if (!object(receipt) || !exact(receipt, ['version', 'pin', 'checks']) || receipt.version !== (pin.securityMode ? 2 : 1)
             || !validPin(receipt.pin) || encoded(receipt.pin) !== encoded(pin) || !Array.isArray(receipt.checks)
             || receipt.checks.length !== gates.length)

package/dist/src/safety/job-security-receipt.js

@@ -1,5 +1,7 @@
 import { requireJobSecurity } from './job-security-policy.js';
 import { requireSecurityRequirements } from './security-requirements.js';
+import { SUPPORTED_CLI_MODE } from './cli-security-modes.js';
+import { CLAUDE_RELEASE_MODE } from './claude-release.js';
 /** Audit linkage only. Gateway must preserve employee_runner provenance; serialized
  * JSON never mints host authority or native isolation certification. */
 export function createJobSecurityReceipt(policy, input) {
@@ -10,8 +12,13 @@ export function createJobSecurityReceipt(policy, input) {
         const r = requireSecurityRequirements(input.requirements, { adapterId: policy.pin.adapterId, adapterVersion: policy.pin.adapterVersion, requirementsSha256: policy.pin.requirementsSha256 });
         if (policy.pin.securityMode !== r.security_mode)
             throw Error();
-        const supported = !!policy.pin.securityMode;
-        return Object.freeze({ ...(supported ? { security_mode: r.security_mode, accepted_residual_risks: Object.freeze([...r.accepted_residual_risks]) } : {}), receipt_version: supported ? 'cli-job-security-receipt-v2' : 'cli-job-security-receipt-v1', evidence_origin: 'employee_runner', phase: 'pre_execution', job_id: input.jobId, generation: input.generation,
+        const supported = policy.pin.securityMode === SUPPORTED_CLI_MODE, claude = policy.pin.securityMode === CLAUDE_RELEASE_MODE;
+        // Claude contract: docs/superpowers/plans/2026-10-27-claude-admission-p2a-gateway.md. The pinned binary is the listed release binary.
+        if (claude && policy.pin.binarySha256 !== r.release?.binary_sha256)
+            throw Error();
+        return Object.freeze({ ...(supported || claude ? { security_mode: r.security_mode, accepted_residual_risks: Object.freeze([...r.accepted_residual_risks]) } : {}),
+            ...(claude ? { transport: r.transport, release_manifest_sha256: r.release_manifest_sha256 } : {}),
+            receipt_version: claude ? 'cli-claude-job-security-receipt-v1' : supported ? 'cli-job-security-receipt-v2' : 'cli-job-security-receipt-v1', evidence_origin: 'employee_runner', phase: 'pre_execution', job_id: input.jobId, generation: input.generation,
             requirements_fingerprint: r.fingerprint, launch_fingerprint: input.launchFingerprint, contract_fingerprint: input.contractFingerprint, task_package_fingerprint: input.taskPackageFingerprint, policy_fingerprint: policy.fingerprint, pin: Object.freeze({ ...policy.pin }) });
     }
     catch {