mtech-ai-local-runner 0.1.63 → 0.1.64

package/dist/src/adapters/claude-code/adapter.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
-import { CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT } from '../../safety/claude-release.js';
+import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT } from '../../safety/claude-release.js';
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
@@ -23,6 +23,46 @@ function allowlistedEnv(env) {
     }
     return result;
 }
+export function claudeLaunchArgs(input) {
+    const args = [
+        "--print",
+        "--input-format", "stream-json",
+        "--output-format", "stream-json",
+        "--verbose",
+        "--include-partial-messages",
+        "--no-chrome",
+        "--permission-mode", "default",
+        "--model", input.modelId,
+        ...(input.maxBudgetUsd === null ? [] : ["--max-budget-usd", String(input.maxBudgetUsd)]),
+        "--name", input.name,
+        "--strict-mcp-config",
+        "--mcp-config", input.mcpConfigPath,
+        "--settings", JSON.stringify(input.settings),
+        "--setting-sources", "",
+        "--disable-slash-commands",
+        "--tools", "",
+        "--allowedTools", LOCAL_NAMES.join(","),
+    ];
+    if (input.resumeSessionId) {
+        args.push("--resume", input.resumeSessionId);
+    }
+    else {
+        args.push("--session-id", input.sessionId);
+    }
+    return args;
+}
+/** The inline `--settings`: only the runner's PreToolUse hook. */
+export function claudeLaunchSettings(hookCommand) {
+    return { hooks: { PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand }] }] } };
+}
+/** The allowlisted environment, the documented opt-outs and the encoded hook policy; nothing else of the runner's environment reaches the CLI. */
+export function claudeLaunchEnv(env, hookPolicy) {
+    return { ...allowlistedEnv(env), ...CLAUDE_LAUNCH_OPT_OUTS, [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy) };
+}
+/** The one stream-json user message line written to the CLI's stdin. */
+export function claudeUserInput(text) {
+    return `${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text }] } })}\n`;
+}
 function contractBudget(taskPackage) {
     const pkg = taskPackage;
     const execution = pkg.agent_execution;
@@ -141,40 +181,16 @@ export class ClaudeCodeAdapter {
                 registeredReadTools: this.options.registeredReadTools,
                 generatedPaths: [mcpConfigPath],
             });
-            const settings = {
-                hooks: {
-                    PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand }] }],
-                },
-            };
-            const args = [
-                "--print",
-                "--input-format", "stream-json",
-                "--output-format", "stream-json",
-                "--verbose",
-                "--include-partial-messages",
-                "--no-chrome",
-                "--permission-mode", "default",
-                "--model", resolvedModelId,
-                ...(maxBudgetUsd === null ? [] : ["--max-budget-usd", String(maxBudgetUsd)]),
-                "--name", this.options.workItemLabel.trim().slice(0, 80) || `work-item-${ctx.bindingId.slice(0, 8)}`,
-                "--strict-mcp-config",
-                "--mcp-config", mcpConfigPath,
-                "--settings", JSON.stringify(settings),
-                "--setting-sources", "",
-                "--disable-slash-commands",
-                "--tools", "",
-                "--allowedTools", LOCAL_NAMES.join(","),
-            ];
-            if (ctx.resumeSessionId) {
-                args.push("--resume", ctx.resumeSessionId);
-            }
-            else {
-                args.push("--session-id", ctx.sessionId);
-            }
-            const env = {
-                ...allowlistedEnv(this.options.env),
-                [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
-            };
+            const args = claudeLaunchArgs({
+                modelId: resolvedModelId,
+                maxBudgetUsd,
+                name: this.options.workItemLabel.trim().slice(0, 80) || `work-item-${ctx.bindingId.slice(0, 8)}`,
+                mcpConfigPath,
+                settings: claudeLaunchSettings(hookCommand),
+                sessionId: ctx.sessionId,
+                resumeSessionId: ctx.resumeSessionId,
+            });
+            const env = claudeLaunchEnv(this.options.env, hookPolicy);
             await this.options.assertCurrentInputs?.();
             if (this.cancelled)
                 throw new Error('adapter startup cancelled');
@@ -186,7 +202,7 @@ export class ClaudeCodeAdapter {
             this.handle = handle;
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
-            handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: prompt }] } })}\n`);
+            handle.stdin.write(claudeUserInput(prompt));
         }
         catch (error) {
             // Settle only the ownership-acquisition fence before cleanup. Waiting for

package/dist/src/adapters/claude-code/runtime-options.js

@@ -30,6 +30,10 @@ async function canonicalFuture(file) {
         }
     }
 }
+/** The job MCP config: only the job-scoped ai_local server, with its token. Jobs and the offline release review write this. */
+export function claudeJobMcpConfig(endpoint) {
+    return { mcpServers: { ai_local: { type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` } } } };
+}
 /** Wiring only. No release verifier or admission certificate exists here. */
 export function createClaudeCodeAdapterOptions(input) {
     if (input.securityHost && (input.securityPolicy || input.nativeBinding || input.commandRegistry) || !!input.securityHost !== !!input.binaryIdentity)
@@ -146,7 +150,7 @@ export function createClaudeCodeAdapterOptions(input) {
             }
         },
         writeLocalMcpConfig: endpoint => {
-            writeFileSync(config, JSON.stringify({ mcpServers: { ai_local: { type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` } } } }), { mode: 0o600, flag: 'wx' });
+            writeFileSync(config, JSON.stringify(claudeJobMcpConfig(endpoint)), { mode: 0o600, flag: 'wx' });
             return config;
         },
     };

package/dist/src/cli.js

@@ -34,6 +34,7 @@ import { runHookClient } from "./asks/hook-client.js";
 import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand } from "./asks/commands.js";
 import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
+import { runClaudeReleaseCommand } from "./commands/claude-release.js";
 function hookAction(result) {
     return result.reason === "invalid_command"
         ? "Run the runner with a Node executable and package path outside the workspace, without quotes, $, backquotes or backslashes, then rerun doctor."
@@ -178,6 +179,9 @@ export async function main(argv, env, io = {}) {
     }
     if (argv[0] === "integrations")
         return runIntegrationsCommand(argv.slice(1), { env, stateRoot: defaultStateRootFromEnv(env), stdout, stderr });
+    // Offline Claude release review (Work Item 1c8026f1, P2c): no runner config, daemon or Gateway call.
+    if (argv[0] === "claude-release")
+        return runClaudeReleaseCommand(argv.slice(1), { stdout, stderr, fetchFn: io.fetchFn ?? fetch, ...io.claudeRelease });
     let config;
     try {
         config = loadConfig(argv, env);

package/dist/src/commands/claude-release.js

@@ -0,0 +1,105 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { packagedHookCommandParts } from '../safety/hook-command.js';
+import { measureCommandFile } from '../safety/registered-command-integrity.js';
+import { hostClaudePlatform, parseClaudeSyncRelease } from '../safety/claude-release.js';
+import { privateDirectory, verifyClaudeCodeSignature } from '../safety/claude-release-copy.js';
+import { fetchClaudeReleaseForReview } from '../safety/claude-review-fetch.js';
+import { runClaudeReviewCampaign } from '../safety/claude-review-campaign.js';
+import { CLAUDE_AUTH_OBSERVATION_MAX_BYTES, CLAUDE_REVIEW_EVIDENCE_FILE, claudeReleaseCandidate, claudeReviewEvidenceSha256, parseClaudeAuthObservation } from '../safety/claude-review-evidence.js';
+export const CLAUDE_RELEASE_USAGE = 'Usage: mtec-ai-local-runner claude-release fetch --version <version> --platform <darwin-arm64|darwin-x64> --out <dir>\n'
+    + '       mtec-ai-local-runner claude-release review --binary <path> --version <version> --platform <platform> --sha256 <sha256> --model <id> [--model <id> ...] --out <dir> [--auth-observation <file>]';
+function flags(argv, single, repeated = []) {
+    const values = new Map();
+    for (let i = 0; i < argv.length; i += 2) {
+        const flag = argv[i], value = argv[i + 1], name = flag.startsWith('--') ? flag.slice(2) : '';
+        if (!name || value === undefined || value.startsWith('--') || ![...single, ...repeated].includes(name))
+            return null;
+        const list = values.get(name) ?? [];
+        if (list.length && !repeated.includes(name))
+            return null;
+        list.push(value);
+        values.set(name, list);
+    }
+    return values;
+}
+const one = (f, name) => f.get(name)?.[0];
+const codeOf = (error) => error instanceof Error && /^CLAUDE_[A-Z_]+$/.test(error.message) ? error.message : 'CLAUDE_REVIEW_FAILED';
+const absolute = (value) => typeof value === 'string' && path.isAbsolute(value) && path.resolve(value) === value && !/[\r\n\0]/.test(value);
+/** Read-only roots for the reviewed CLI's PreToolUse hook: this Node's prefix and the installed package (dist/src/commands -> package). */
+function reviewReadRoots() { return [path.dirname(path.dirname(process.execPath)), path.resolve(fileURLToPath(new URL('../../../', import.meta.url)))]; }
+async function boundedObservation(file) {
+    const s = await lstat(file).catch(() => undefined);
+    if (!s?.isFile() || s.size > CLAUDE_AUTH_OBSERVATION_MAX_BYTES)
+        throw Error('CLAUDE_AUTH_OBSERVATION_REJECTED');
+    return readFile(file);
+}
+async function writeEvidence(out, evidence) {
+    const file = path.join(out, CLAUDE_REVIEW_EVIDENCE_FILE), temporary = path.join(out, `.${randomUUID()}.evidence`);
+    try {
+        await writeFile(temporary, `${JSON.stringify(evidence, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+        await rename(temporary, file);
+    }
+    catch (error) {
+        await rm(temporary, { force: true }).catch(() => { });
+        throw error;
+    }
+    return file;
+}
+/** `claude-release fetch|review` (design "Release review"). fetch is the only networked step; review needs no network beyond loopback. */
+export async function runClaudeReleaseCommand(argv, io) {
+    const usage = () => { io.stderr(CLAUDE_RELEASE_USAGE); return 1; };
+    const failed = (error) => { io.stderr(JSON.stringify({ ok: false, code: codeOf(error) })); return 1; };
+    if (argv[0] === 'fetch') {
+        const f = flags(argv.slice(1), ['version', 'platform', 'out']);
+        if (!f || f.size !== 3)
+            return usage();
+        try {
+            const result = await fetchClaudeReleaseForReview({ version: one(f, 'version'), platform: one(f, 'platform'), out: one(f, 'out'), fetchFn: io.fetchFn, ...(io.codesign ? { codesign: io.codesign } : {}) });
+            io.stdout(JSON.stringify({ ok: true, ...result }));
+            return 0;
+        }
+        catch (error) {
+            return failed(error);
+        }
+    }
+    if (argv[0] !== 'review')
+        return usage();
+    const f = flags(argv.slice(1), ['binary', 'version', 'platform', 'sha256', 'out', 'auth-observation'], ['model']);
+    if (!f || !['binary', 'version', 'platform', 'sha256', 'out', 'model'].every(name => f.has(name)))
+        return usage();
+    try {
+        const release = { version: one(f, 'version'), platform: one(f, 'platform'), binary_sha256: one(f, 'sha256') }, models = [...f.get('model')];
+        const binary = one(f, 'binary'), out = one(f, 'out'), observation = one(f, 'auth-observation');
+        if (!parseClaudeSyncRelease({ ...release, model_ids: models }) || !absolute(binary) || !absolute(out) || observation !== undefined && !absolute(observation))
+            throw Error('CLAUDE_REVIEW_INPUT_REJECTED');
+        if (release.platform !== hostClaudePlatform())
+            throw Error('CLAUDE_REVIEW_PLATFORM_MISMATCH');
+        // The reviewed bytes are the named bytes: re-hash and re-verify the signature before anything runs (RW-03).
+        const s = await lstat(binary).catch(() => undefined);
+        if (!s?.isFile() || await measureCommandFile(binary).catch(() => undefined) !== release.binary_sha256)
+            throw Error('CLAUDE_REVIEW_BINARY_REJECTED');
+        await verifyClaudeCodeSignature(binary, io.codesign);
+        const auth = observation === undefined ? undefined : parseClaudeAuthObservation(await boundedObservation(observation), release);
+        try {
+            await privateDirectory(out);
+        }
+        catch {
+            throw Error('CLAUDE_REVIEW_OUTPUT_REJECTED');
+        }
+        const evidence = await (io.campaign ?? runClaudeReviewCampaign)({ binary, release, models, hook: io.hook ?? packagedHookCommandParts(), readRoots: reviewReadRoots(),
+            ...(auth ? { authObservation: auth } : {}), ...(io.codesign ? { codesign: io.codesign } : {}) });
+        const file = await writeEvidence(out, evidence), entry = claudeReleaseCandidate(evidence);
+        if (!entry) {
+            io.stdout(JSON.stringify({ ok: false, evidence: file, evidence_sha256: claudeReviewEvidenceSha256(evidence), failed: evidence.scenarios.filter(x => x.result === 'failed').map(x => x.id) }));
+            return 2;
+        }
+        io.stdout(JSON.stringify({ ok: true, evidence: file, ready_for_listing: evidence.verdict.ready_for_listing, blocked_by: evidence.verdict.blocked_by, entry }));
+        return 0;
+    }
+    catch (error) {
+        return failed(error);
+    }
+}

package/dist/src/safety/claude-production-host.js

@@ -7,7 +7,7 @@ import { claudeLoginFromStatus } from '../adapters/claude-code/login-status.js';
 import { captureClaudeBinaryIdentity } from './claude-binary-identity.js';
 import { commandRegistryFingerprint } from './job-security-session.js';
 import { localToolInventory } from './local-tool-server.js';
-import { CLAUDE_MANDATORY_GATES, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256, hostClaudePlatform, requireClaudeRequirements } from './claude-release.js';
+import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_MANDATORY_GATES, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256, hostClaudePlatform, requireClaudeRequirements } from './claude-release.js';
 import { claudeReleaseCopyPath, claudeReleaseRoot, createClaudeReleaseProvisioner, verifyClaudeCodeSignature, verifyClaudeReleaseCopy } from './claude-release-copy.js';
 import { claudeManagedScopeDeps, claudeManagedScopeReady, collectClaudeManagedScope } from './claude-managed-scope.js';
 /** A release whose provisioning failed is not fetched again before this delay, doubled per further consecutive failure
@@ -38,7 +38,7 @@ export const CLAUDE_LAUNCH_CONFIG = Object.freeze({ transport: CLAUDE_TRANSPORT,
     flags: Object.freeze(['--allowedTools', '--disable-slash-commands', '--include-partial-messages', '--input-format', '--mcp-config', '--model', '--name',
         '--no-chrome', '--output-format', '--permission-mode', '--print', '--setting-sources', '--settings', '--strict-mcp-config', '--tools', '--verbose']),
     conditional_flags: Object.freeze(['--max-budget-usd', '--resume', '--session-id']),
-    settings_keys: Object.freeze(['hooks.PreToolUse']) });
+    settings_keys: Object.freeze(['hooks.PreToolUse']), env_opt_outs: CLAUDE_LAUNCH_OPT_OUTS });
 const CHECK_IDS = { CLAUDE_RELEASE_NOT_LISTED: 'release_list', CLAUDE_RELEASE_PLATFORM_MISMATCH: 'release_platform',
     CLAUDE_RELEASE_COPY_UNAVAILABLE: 'release_copy', CLAUDE_CODE_SIGNATURE_REJECTED: 'release_copy', CLAUDE_MANAGED_SCOPE_UNVERIFIED: 'managed_scope' };
 /** A login probe answer (any status) is reused this long for the same release and copy identity. */

package/dist/src/safety/claude-release-copy.js

@@ -86,7 +86,8 @@ export async function verifyClaudeCodeSignature(file, run = runCodesign) {
 /** Official builds are about 245 MB; the cap stays below measureCommandFile's 512 MiB limit. */
 export const CLAUDE_RELEASE_MAX_BYTES = 384 * 1024 * 1024;
 const FETCH_TIMEOUT_MS = 15 * 60_000;
-async function privateDirectory(dir) {
+/** A 0700 directory owned by the runner's user at its own realpath, created if absent. */
+export async function privateDirectory(dir) {
     await mkdir(dir, { recursive: true, mode: 0o700 });
     const s = await lstat(dir), uid = process.getuid?.();
     if (uid === undefined || !s.isDirectory() || s.isSymbolicLink() || s.uid !== uid || (s.mode & 0o077) !== 0 || await realpath(dir) !== dir)
@@ -98,6 +99,63 @@ async function writeAll(file, chunk) {
         offset += bytesWritten;
     }
 }
+/** A 200 response with a body whose declared length, if any, is within maxBytes. */
+async function boundedBody(response, maxBytes) {
+    const body = response.body, declared = response.headers.get('content-length');
+    if (response.status !== 200 || !body || declared !== null && (!/^\d{1,12}$/.test(declared) || Number(declared) > maxBytes)) {
+        await body?.cancel().catch(() => { });
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    }
+    return body;
+}
+/** Streams one official artifact into an open exclusive file under a byte cap, hashing it as it is written. */
+export async function readClaudeArtifact(response, file, maxBytes) {
+    const reader = (await boundedBody(response, maxBytes)).getReader(), hash = createHash('sha256');
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes)
+                throw Error('CLAUDE_RELEASE_SIZE_REJECTED');
+            hash.update(value);
+            await writeAll(file, value);
+        }
+    }
+    catch (error) {
+        await reader.cancel().catch(() => { });
+        throw error instanceof Error && error.message === 'CLAUDE_RELEASE_SIZE_REJECTED' ? error : Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    }
+    return { sha256: hash.digest('hex'), size };
+}
+/** One small official JSON document (the release manifest), at most maxBytes. */
+export async function readClaudeJson(response, maxBytes) {
+    const reader = (await boundedBody(response, maxBytes)).getReader(), chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes)
+                throw Error();
+            chunks.push(value);
+        }
+    }
+    catch {
+        await reader.cancel().catch(() => { });
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+    }
+    catch {
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    }
+}
 /** The release exactly as the strict parser reads it, or null: the URL and paths never come from a looser reading. */
 function listedRelease(release) {
     try {
@@ -156,32 +214,10 @@ export function createClaudeReleaseProvisioner(input) {
             catch {
                 throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
             }
-            const body = response.body, declared = response.headers.get('content-length');
-            if (response.status !== 200 || !body || declared !== null && (!/^\d{1,12}$/.test(declared) || Number(declared) > maxBytes)) {
-                await body?.cancel().catch(() => { });
-                throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
-            }
-            const hash = createHash('sha256'), reader = body.getReader();
-            let size = 0;
-            try {
-                for (;;) {
-                    const { done, value } = await reader.read();
-                    if (done)
-                        break;
-                    size += value.byteLength;
-                    if (size > maxBytes)
-                        throw Error('CLAUDE_RELEASE_SIZE_REJECTED');
-                    hash.update(value);
-                    await writeAll(file, value);
-                }
-            }
-            catch (error) {
-                await reader.cancel().catch(() => { });
-                throw error instanceof Error && error.message === 'CLAUDE_RELEASE_SIZE_REJECTED' ? error : Error('CLAUDE_RELEASE_FETCH_REJECTED');
-            }
+            const { sha256 } = await readClaudeArtifact(response, file, maxBytes);
             await file.sync();
             await file.close();
-            if (hash.digest('hex') !== release.binary_sha256 || await measureCommandFile(temporary).catch(() => undefined) !== release.binary_sha256)
+            if (sha256 !== release.binary_sha256 || await measureCommandFile(temporary).catch(() => undefined) !== release.binary_sha256)
                 throw Error('CLAUDE_RELEASE_HASH_MISMATCH');
             await verifyClaudeCodeSignature(temporary, input.codesign);
             await chmod(temporary, 0o500);

package/dist/src/safety/claude-release.js

@@ -85,5 +85,22 @@ export function claudeReleaseUrl(release) {
     const r = parseClaudeSyncRelease({ version: release.version, platform: release.platform, binary_sha256: release.binary_sha256, model_ids: [...release.model_ids] });
     if (!r)
         throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
-    return `${CLAUDE_DOWNLOAD_BASE}/${r.version}/${r.platform}/claude`;
+    return claudeArtifactUrl(r.version, r.platform);
+}
+/** Documented Claude Code opt-outs on every Claude launch, job and release review alike (owner choice 2026-10-28): the
+ * pinned copy never updates itself and sends no telemetry, error reports or other non-essential traffic. */
+export const CLAUDE_LAUNCH_OPT_OUTS = Object.freeze({ DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+    DISABLE_TELEMETRY: '1', DISABLE_ERROR_REPORTING: '1', DISABLE_BUG_COMMAND: '1', DISABLE_NON_ESSENTIAL_MODEL_CALLS: '1' });
+const RELEASE_VERSION = /^\d{1,4}\.\d{1,4}\.\d{1,6}$/;
+/** The official per-version manifest; platforms[<platform>].checksum is the binary sha256 (Work Evidence c85ec02c). */
+export function claudeManifestUrl(version) {
+    if (typeof version !== 'string' || !RELEASE_VERSION.test(version))
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    return `${CLAUDE_DOWNLOAD_BASE}/${version}/manifest.json`;
+}
+/** The uncompressed official binary of one version and platform; the only artifact the Runner fetches. */
+export function claudeArtifactUrl(version, platform) {
+    if (typeof version !== 'string' || !RELEASE_VERSION.test(version) || !CLAUDE_PLATFORMS.includes(platform))
+        throw Error('CLAUDE_RELEASE_FETCH_REJECTED');
+    return `${CLAUDE_DOWNLOAD_BASE}/${version}/${platform}/claude`;
 }

package/dist/src/safety/claude-review-campaign.js

@@ -0,0 +1,123 @@
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { constants, existsSync } from 'node:fs';
+import { chmod, copyFile, lstat, rm, stat } from 'node:fs/promises';
+import { isDeepStrictEqual } from 'node:util';
+import { NodeProcessGroupHost } from '../process/node-process-group-host.js';
+import { packageVersion } from '../package-version.js';
+import { HOOK_POLICY_ENV_VAR } from './hook-policy-builder.js';
+import { CLAUDE_LOCAL_MCP_TOOLS } from './pre-tool-use-hook.js';
+import { localToolInventory } from './local-tool-server.js';
+import { measureCommandFile } from './registered-command-integrity.js';
+import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, claudeCanonicalSha256, parseClaudeSyncRelease } from './claude-release.js';
+import { CLAUDE_CODE_REQUIREMENT, verifyClaudeCodeSignature } from './claude-release-copy.js';
+import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
+import { CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, CLAUDE_REVIEW_PROFILE_VERSION } from './claude-review-sandbox.js';
+import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
+import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, claudeReviewEnv, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
+import { CLAUDE_REVIEW_STAGES, buildClaudeReviewEvidence } from './claude-review-evidence.js';
+const AI_LOCAL = Object.freeze([...CLAUDE_LOCAL_MCP_TOOLS].sort());
+const DISCOVERY = Object.freeze(['initialize_response', 'initialized_notification', 'inventory_response']);
+const PLANTED_SENTINELS = Object.freeze(['api-key-helper', 'pre-tool-use', 'session-start', 'user-prompt-submit']);
+const sha = (text) => createHash('sha256').update(text).digest('hex');
+function scenario(id, checks, counts) {
+    const failures = Object.keys(checks).filter(name => !checks[name]).sort();
+    return { id, stage: CLAUDE_REVIEW_STAGES[id], result: failures.length ? 'failed' : 'passed', counts, failures };
+}
+/** Scenario verdicts from recorded runs. Counts are booleans' tallies and script-fixed numbers only, so they are deterministic. */
+export function evaluateClaudeReview(input) {
+    const { runs, canaries } = input, IDS = CLAUDE_REVIEW_TOOL_IDS;
+    const scripted = runs.filter(r => r.kind !== 'slash'), slash = runs.find(r => r.kind === 'slash'), planted = runs.find(r => r.kind === 'planted');
+    const baseline = runs.find(r => r.kind === 'baseline' && r.model === planted?.model);
+    const every = (list, test) => list.length > 0 && list.every(test);
+    const messages = (r) => r.requests.filter(q => q.kind === 'primary' || q.kind === 'auxiliary');
+    const first = (r) => r.requests.find(q => q.kind === 'primary');
+    const offered = (r) => r ? [...(first(r)?.toolNames ?? [])].sort() : [];
+    const tool = (r, id) => r?.toolResults.get(id);
+    const denied = (r, id) => tool(r, id)?.isError === true;
+    const hits = (name, list = runs) => list.reduce((n, r) => n + (r.canaryHits[name] ?? 0), 0);
+    const sentinel = (names) => runs.some(r => r.sentinels.some(s => names.includes(s)));
+    const initialized = (r) => DISCOVERY.every(event => r.discovery.includes(event));
+    const returned = (r) => { const t = tool(r, IDS.allowed); return !!t && !t.isError && t.text.includes(canaries.source); };
+    const names = [...new Set(runs.flatMap(r => r.requests.flatMap(q => q.toolNames)))].sort();
+    // Source content may reach the provider only inside the allowed read's tool result.
+    const implicit = runs.reduce((n, r) => n + r.requests.filter(q => q.canaries.includes('source') && !q.toolResultIds.includes(IDS.allowed)).length, 0);
+    const slashFirst = slash ? first(slash) : undefined;
+    const delivery = !slash ? 'missing' : slashFirst?.firstUserText === CLAUDE_REVIEW_SLASH_PROMPT ? 'literal' : slash.terminal && !slashFirst ? 'refused_locally' : 'missing';
+    const versionLine = new RegExp(`^${input.release.version.replace(/\./g, '\\.')}(?:\\s|$)`);
+    return [
+        scenario('inventory', { copy_sha256_matches: input.copySha256 === input.release.binary_sha256, copy_unchanged: input.copyUnchanged,
+            version_output_matches: versionLine.test(input.version.line), version_run_sandboxed: input.version.sandboxed, version_run_exit_confirmed: input.version.exitConfirmed }, { version_runs: 1 }),
+        scenario('tools_offered', { primary_requests_seen: every(scripted, r => !!first(r)), exact_ai_local_set: every(scripted, r => isDeepStrictEqual(offered(r), [...AI_LOCAL])),
+            no_other_tool_names: names.every(name => AI_LOCAL.includes(name)) }, { runs_checked: scripted.length, offered_names: names }),
+        scenario('mcp_startup', { initialized: every(runs, initialized) }, { runs_initialized: runs.filter(initialized).length }),
+        scenario('allowed_read', { content_returned: every(scripted, returned), served_by_ai_local: every(scripted, r => r.reads.successful >= 1) }, { reads_returned: scripted.filter(returned).length }),
+        scenario('disallowed_tool', { native_denied: every(scripted, r => denied(r, IDS.native)), unregistered_mcp_denied: every(scripted, r => denied(r, IDS.unregistered)),
+            native_not_executed: !sentinel(['bash']) }, { runs_checked: scripted.length }),
+        scenario('settings_ignored', { baseline_compared: !!planted && !!baseline, same_tools: !!planted && !!baseline && isDeepStrictEqual(offered(planted), offered(baseline)),
+            same_denials: !!planted && !!baseline && Object.values(IDS).every(id => tool(planted, id) !== undefined && tool(planted, id)?.isError === tool(baseline, id)?.isError),
+            no_planted_content: hits('planted') === 0, no_planted_mcp: runs.every(r => r.requests.every(q => q.kind !== 'planted_mcp')), no_planted_hook: !sentinel(PLANTED_SENTINELS),
+            no_planted_model: runs.every(r => r.requests.every(q => q.model !== 'planted-model')) }, { planted_sources: CLAUDE_REVIEW_PLANTED_SOURCES.length }),
+        scenario('slash_refused', { not_expanded: !!slash && hits('planted', [slash]) === 0, no_command_side_effect: !sentinel(['slash']), delivered_or_refused: delivery !== 'missing' }, { delivery }),
+        scenario('source_exclusion', { outside_denied: every(scripted, r => denied(r, IDS.outside)), secret_denied: every(scripted, r => denied(r, IDS.secret)),
+            no_outside_content: hits('outside') === 0, no_secret_content: hits('secret') === 0, no_implicit_source: implicit === 0 }, { runs_checked: scripted.length }),
+        scenario('fake_credentials', { fake_key_only: scripted.length > 0 && runs.every(r => messages(r).every(q => q.apiKey === CLAUDE_REVIEW_FAKE_KEY)),
+            no_authorization_header: runs.every(r => messages(r).every(q => !q.authorization)), no_credential_content: hits('credential') === 0,
+            fake_key_not_in_body: runs.every(r => r.fakeKeyInBody === 0), environment_exact: every(runs, r => isDeepStrictEqual(r.envKeys, [...input.expectedEnvKeys])),
+            keychain_reads_only: runs.every(r => r.keychainOperations.every(op => CLAUDE_REVIEW_KEYCHAIN_READS.includes(op))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
+        scenario('communication_boundary', { sandboxed: every(runs, r => r.sandboxed) && input.version.sandboxed, no_unlisted_destination: runs.every(r => r.decoyConnections === 0) }, { sandboxed_runs: runs.filter(r => r.sandboxed).length + (input.version.sandboxed ? 1 : 0) }),
+        scenario('cleanup', { runs_terminal: every(runs, r => r.terminal), owned_exit_confirmed: every(runs, r => r.exitConfirmed) && input.version.exitConfirmed,
+            temp_removed: input.tempRemoved }, { owned_exits: runs.length + 1 }),
+    ];
+}
+/** The offline campaign (design "Release review"): stages 1, 2, 4 and 5 against one exact binary, fake data, loopback only. */
+export async function runClaudeReviewCampaign(input) {
+    if (process.platform !== 'darwin' || !existsSync('/usr/bin/sandbox-exec'))
+        throw Error('CLAUDE_REVIEW_UNSUPPORTED_HOST');
+    const models = [...input.models];
+    if (!parseClaudeSyncRelease({ ...input.release, model_ids: models }))
+        throw Error('CLAUDE_REVIEW_INPUT_REJECTED');
+    const now = input.now ?? (() => new Date()), startedAt = now().toISOString(), sandbox = input.sandbox ?? true, timeoutMs = input.timeoutMs ?? CLAUDE_REVIEW_RUN_TIMEOUT_MS;
+    const processHost = input.processHost ?? new NodeProcessGroupHost(), deniedHome = os.userInfo().homedir;
+    const layout = await createClaudeReviewLayout(), runs = [];
+    let version = { line: '', sandboxed: sandbox, exitConfirmed: false }, sha256 = '', size = 0, copyUnchanged = false, tempRemoved = false;
+    try {
+        // Run only a private copy of the named bytes, re-hashed and re-verified here (RW-03).
+        const copy = path.join(layout.cli.bin, 'claude');
+        await copyFile(input.binary, copy, constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE);
+        await chmod(copy, 0o500);
+        sha256 = await measureCommandFile(copy);
+        size = (await stat(copy)).size;
+        if (sha256 !== input.release.binary_sha256)
+            throw Error('CLAUDE_REVIEW_BINARY_REJECTED');
+        await verifyClaudeCodeSignature(copy, input.codesign);
+        const common = { binary: copy, layout, hook: input.hook, readRoots: input.readRoots, deniedHome, processHost, sandbox, timeoutMs };
+        version = await runClaudeVersion(common);
+        for (const model of models)
+            runs.push(await runClaudeReview({ ...common, kind: 'baseline', model }));
+        runs.push(await runClaudeReview({ ...common, kind: 'planted', model: models[0] }));
+        runs.push(await runClaudeReview({ ...common, kind: 'slash', model: models[0] }));
+        copyUnchanged = await measureCommandFile(copy).catch(() => '') === sha256;
+    }
+    finally {
+        await rm(layout.root, { recursive: true, force: true }).catch(() => { });
+        tempRemoved = await lstat(layout.root).then(() => false, () => true);
+    }
+    const launchEnvKeys = [...Object.keys(layout.env), ...Object.keys(CLAUDE_LAUNCH_OPT_OUTS), HOOK_POLICY_ENV_VAR].sort(), reviewEnvKeys = Object.keys(claudeReviewEnv('http://127.0.0.1:1')).sort();
+    const scenarios = evaluateClaudeReview({ release: input.release, copySha256: sha256, copyUnchanged, version, runs, canaries: layout.canaries,
+        expectedEnvKeys: [...launchEnvKeys, ...reviewEnvKeys].sort(), tempRemoved });
+    return buildClaudeReviewEvidence({
+        release: { ...input.release, model_ids: models },
+        protocol: { launch_config_sha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), tools_sha256: claudeCanonicalSha256({ tools: localToolInventory() }),
+            sandbox_profile: CLAUDE_REVIEW_PROFILE_VERSION, sandbox_profile_template_sha256: CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, launch_env_keys: launchEnvKeys,
+            review_env_keys: reviewEnvKeys, prompt_sha256: sha(CLAUDE_REVIEW_PROMPT), slash_prompt_sha256: sha(CLAUDE_REVIEW_SLASH_PROMPT), scripted_tool_ids: Object.values(CLAUDE_REVIEW_TOOL_IDS) },
+        inventory: { binary_sha256: sha256, size_bytes: size, team_id: CLAUDE_TEAM_ID, signing_identifier: CLAUDE_SIGNING_IDENTIFIER,
+            code_requirement_sha256: sha(CLAUDE_CODE_REQUIREMENT), version_output: version.line },
+        scenarios,
+        ...(input.authObservation ? { authObservation: { sha256: input.authObservation.sha256, decision_id: input.authObservation.observation.decision_id } } : {}),
+        observations: { started_at: startedAt, finished_at: now().toISOString(), root: layout.root, runner_package_version: input.runnerVersion ?? packageVersion(),
+            runs: runs.map(r => ({ kind: r.kind, model: r.model, duration_ms: r.durationMs, auxiliary_requests: r.requests.filter(q => q.kind === 'auxiliary').length,
+                unknown_requests: r.requests.filter(q => q.kind === 'unknown' || q.kind === 'invalid').length, proxy_attempts: [...r.proxyAttempts], keychain_lookups: r.keychainOperations.length })) },
+    });
+}

package/dist/src/safety/claude-review-evidence.js

@@ -0,0 +1,96 @@
+import { isDeepStrictEqual } from 'node:util';
+import { CLAUDE_RELEASE_GATES, claudeCanonicalSha256 } from './claude-release.js';
+/*
+ * Offline Claude release review evidence (design "Release review", decision 9095c7a8). A fake-data campaign result, never
+ * a release certificate: the owner reviews it and lists the release in claude_release.php through a Gateway PR that cites
+ * a Work Decision. The campaign, the gate map and this format are Runner source constants.
+ */
+export const CLAUDE_REVIEW_EVIDENCE_VERSION = 'claude-release-review-evidence-v1';
+export const CLAUDE_REVIEW_CAMPAIGN = 'claude-release-campaign-v1';
+export const CLAUDE_REVIEW_EVIDENCE_FILE = 'claude-release-evidence.json';
+/** The only top-level key evidence_sha256 leaves out. Timestamps, temp paths, durations, the runner package version, proxy
+ * attempts and auxiliary or Keychain lookup counts live under it and nowhere else. */
+export const CLAUDE_REVIEW_VOLATILE_KEY = 'observations';
+export const CLAUDE_REVIEW_SCENARIOS = Object.freeze(['inventory', 'tools_offered', 'mcp_startup', 'allowed_read', 'disallowed_tool', 'settings_ignored',
+    'slash_refused', 'source_exclusion', 'fake_credentials', 'communication_boundary', 'cleanup']);
+/** Stages of docs/ai-ops-gateway/claude-native-validation-scope-0147.md. Stage 3 (managed sources) is the per-job runtime check. */
+export const CLAUDE_REVIEW_STAGES = Object.freeze({ inventory: 1, tools_offered: 2, mcp_startup: 2,
+    allowed_read: 2, disallowed_tool: 2, settings_ignored: 2, slash_refused: 2, source_exclusion: 2, fake_credentials: 4, communication_boundary: 5, cleanup: 2 });
+/** The four gates a fake-data campaign can evidence. allowed_read is the positive control of both tool-plane gates:
+ * a denial without a working allowed read proves nothing. */
+export const CLAUDE_REVIEW_GATE_SCENARIOS = Object.freeze({
+    binary_release: Object.freeze(['inventory']),
+    official_permissions: Object.freeze(['tools_offered', 'disallowed_tool', 'settings_ignored', 'slash_refused']),
+    required_mcp_startup: Object.freeze(['mcp_startup', 'tools_offered', 'allowed_read']),
+    source_exclusion: Object.freeze(['allowed_read', 'source_exclusion', 'fake_credentials', 'communication_boundary']),
+});
+/** managed_scope_exclusion is checked per job by the installed observer and the managed-path check (claude-managed-scope.ts). */
+export const CLAUDE_MANAGED_SCOPE_BASIS = 'observer_inventory_and_managed_paths_per_job';
+const gated = (gate) => Object.hasOwn(CLAUDE_REVIEW_GATE_SCENARIOS, gate);
+export function buildClaudeReviewEvidence(input) {
+    if (!isDeepStrictEqual(input.scenarios.map(s => s.id), [...CLAUDE_REVIEW_SCENARIOS])
+        || input.scenarios.some(s => s.stage !== CLAUDE_REVIEW_STAGES[s.id] || s.result !== (s.failures.length ? 'failed' : 'passed')))
+        throw Error('CLAUDE_REVIEW_EVIDENCE_REJECTED');
+    const passed = new Set(input.scenarios.filter(s => s.result === 'passed').map(s => s.id)), gates = {}, failedGates = [];
+    for (const gate of CLAUDE_RELEASE_GATES) {
+        if (gated(gate)) {
+            const scenarios = [...CLAUDE_REVIEW_GATE_SCENARIOS[gate]], ok = scenarios.every(id => passed.has(id));
+            gates[gate] = { status: ok ? 'passed' : 'failed', scenarios };
+            if (!ok)
+                failedGates.push(gate);
+        }
+        else if (gate === 'managed_scope_exclusion')
+            gates[gate] = { status: 'runtime_check', basis: CLAUDE_MANAGED_SCOPE_BASIS };
+        else
+            gates[gate] = input.authObservation ? { status: 'observed', observation_sha256: input.authObservation.sha256 } : { status: 'requires_owner_login_observation' };
+    }
+    const clean = passed.has('cleanup'), evidenced = failedGates.length === 0, auth = input.authObservation;
+    return { version: CLAUDE_REVIEW_EVIDENCE_VERSION, campaign: CLAUDE_REVIEW_CAMPAIGN,
+        release: { version: input.release.version, platform: input.release.platform, binary_sha256: input.release.binary_sha256, model_ids: [...input.release.model_ids] },
+        protocol: structuredClone(input.protocol), inventory: structuredClone(input.inventory), scenarios: structuredClone([...input.scenarios]), gates,
+        auth_observation: auth ? { sha256: auth.sha256, decision_id: auth.decision_id } : null,
+        verdict: { evidenced_gates_passed: evidenced, campaign_clean: clean, ready_for_listing: evidenced && clean && !!auth,
+            blocked_by: [...failedGates, ...(clean ? [] : ['cleanup']), ...(auth ? [] : ['auth_backend_compatibility'])] },
+        observations: structuredClone(input.observations) };
+}
+/** claudeCanonicalSha256 of the evidence without CLAUDE_REVIEW_VOLATILE_KEY: equal for the same binary and inputs. */
+export function claudeReviewEvidenceSha256(evidence) {
+    const { observations: _volatile, ...stable } = evidence;
+    return claudeCanonicalSha256(stable);
+}
+/** Null unless every evidenced gate and the campaign cleanup passed. */
+export function claudeReleaseCandidate(evidence) {
+    if (!evidence.verdict.evidenced_gates_passed || !evidence.verdict.campaign_clean)
+        return null;
+    return { version: evidence.release.version, platform: evidence.release.platform, binary_sha256: evidence.release.binary_sha256,
+        evidence_sha256: claudeReviewEvidenceSha256(evidence), model_ids: [...evidence.release.model_ids] };
+}
+export const CLAUDE_AUTH_OBSERVATION_VERSION = 'claude-auth-observation-v1';
+export const CLAUDE_AUTH_OBSERVATION_MAX_BYTES = 4096;
+const OBSERVATION_KEYS = ['auth_status', 'command', 'decision_id', 'exit_code', 'keychain_prompt_shown', 'launch', 'release', 'version'];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, TOKEN = /^[A-Za-z0-9._-]{1,32}$/;
+const plain = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+export function parseClaudeAuthObservation(bytes, release) {
+    const rejected = () => Error('CLAUDE_AUTH_OBSERVATION_REJECTED');
+    if (bytes.byteLength > CLAUDE_AUTH_OBSERVATION_MAX_BYTES)
+        throw rejected();
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw rejected();
+    }
+    if (!plain(value) || !isDeepStrictEqual(Object.keys(value).sort(), OBSERVATION_KEYS))
+        throw rejected();
+    const r = value.release, s = value.auth_status;
+    if (value.version !== CLAUDE_AUTH_OBSERVATION_VERSION || value.launch !== 'runner_pinned_copy' || value.command !== 'auth status --json' || value.exit_code !== 0
+        || value.keychain_prompt_shown !== false || typeof value.decision_id !== 'string' || !UUID.test(value.decision_id)
+        || !plain(r) || !isDeepStrictEqual(Object.keys(r).sort(), ['binary_sha256', 'platform', 'version'])
+        || r.version !== release.version || r.platform !== release.platform || r.binary_sha256 !== release.binary_sha256
+        || !plain(s) || s.loggedIn !== true || Object.keys(s).some(k => !['loggedIn', 'authMethod', 'apiProvider'].includes(k))
+        || ['authMethod', 'apiProvider'].some(k => s[k] !== undefined && (typeof s[k] !== 'string' || !TOKEN.test(s[k]))))
+        throw rejected();
+    const observation = structuredClone(value);
+    return { observation, sha256: claudeCanonicalSha256(observation) };
+}