mtech-ai-local-runner 0.1.7 → 0.1.9

package/dist/src/safety/local-tool-worker.js

@@ -0,0 +1,57 @@
+/** Standalone worker: --eval avoids ambient module/config lookup. All paths are host-supplied. */
+export const LOCAL_TOOL_WORKER = String.raw `
+const fs = require('node:fs');
+const input = JSON.parse(process.argv[1]);
+let current = '';
+for (const part of input.path.split('/').filter(Boolean)) {
+  current += '/' + part;
+  try {
+    if (fs.lstatSync(current).isSymbolicLink()) throw Error('DENIED_SYMLINK');
+  } catch (error) {
+    if (!(error.code === 'ENOENT' && current === input.path && input.tool === 'local_edit')) throw error;
+  }
+}
+let before;
+try { before = fs.lstatSync(input.path); } catch (error) {
+  if (!(error.code === 'ENOENT' && input.tool === 'local_edit')) throw error;
+}
+if (before && (!before.isFile() || before.nlink !== 1 || before.size > 1048576)) throw Error('DENIED_FILE');
+const fd = before ? fs.openSync(input.path, fs.constants.O_NOFOLLOW | fs.constants.O_RDONLY) : null;
+try {
+  const actual = fd === null ? null : fs.fstatSync(fd);
+  if (actual) {
+    const final = fs.lstatSync(input.path);
+    if (actual.ino !== before.ino || actual.dev !== before.dev || actual.ino !== final.ino || actual.dev !== final.dev || actual.nlink !== 1) throw Error('DENIED_RACE');
+  }
+  let result;
+  if (input.tool === 'local_edit') {
+    const data = Buffer.from(input.content, 'utf8');
+    const temp = fs.openSync(input.temp, fs.constants.O_NOFOLLOW | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, before ? before.mode & 0o777 : 0o600);
+    try {
+      fs.writeFileSync(temp, data);
+      fs.fsyncSync(temp);
+      const tempStat = fs.fstatSync(temp), tempFinal = fs.lstatSync(input.temp);
+      if (tempStat.nlink !== 1 || tempStat.ino !== tempFinal.ino || tempStat.dev !== tempFinal.dev) throw Error('DENIED_RACE');
+      if (actual) {
+        const still = fs.lstatSync(input.path);
+        if (still.isSymbolicLink() || still.ino !== actual.ino || still.dev !== actual.dev || still.nlink !== 1) throw Error('DENIED_RACE');
+        fs.renameSync(input.temp, input.path);
+      } else {
+        // Exclusive creation: a concurrent target cannot be overwritten.
+        fs.linkSync(input.temp, input.path);
+      }
+      result = {written: data.length};
+    } finally {
+      fs.closeSync(temp);
+      try { fs.unlinkSync(input.temp); } catch {}
+    }
+  } else {
+    const buffer = Buffer.alloc(1048577);
+    const count = fs.readSync(fd, buffer, 0, buffer.length, 0);
+    if (count > 1048576) throw Error('DENIED_SIZE');
+    const content = buffer.subarray(0, count).toString('utf8');
+    result = input.tool === 'local_search' ? {matches: content.split('\n').flatMap((line, index) => line.includes(input.query) ? [{line: index + 1, text: line}] : [])} : {content};
+  }
+  process.stdout.write(JSON.stringify(result));
+} finally { if (fd !== null) fs.closeSync(fd); }
+`;

package/dist/src/safety/pre-tool-use-hook.js

@@ -1,6 +1,4 @@
-import { evaluateCommand, evaluatePathAction } from "./command-policy.js";
-const PATH_EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-const READ_PATH_TOOLS = new Set(["Read", "Glob", "Grep"]);
+export const CLAUDE_LOCAL_MCP_TOOLS = Object.freeze(["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`));
 function allow(reasonCode) {
     return {
         hookSpecificOutput: {
@@ -19,16 +17,6 @@ function deny(reasonCode) {
         },
     };
 }
-function pathFromToolInput(toolInput, keys) {
-    if (!toolInput)
-        return undefined;
-    for (const key of keys) {
-        const value = toolInput[key];
-        if (typeof value === "string" && value.length > 0)
-            return value;
-    }
-    return undefined;
-}
 /**
  * Pure PreToolUse decision function: deterministic, side-effect free, and
  * never echoes raw commands/paths/tool output/secrets back in a decision
@@ -42,30 +30,6 @@ export function evaluateHookEvent(input, policy) {
     if (typeof toolName !== "string" || toolName.length === 0) {
         return deny("DENIED_MALFORMED_INPUT");
     }
-    if (toolName === "Bash") {
-        const command = input.tool_input?.command;
-        if (typeof command !== "string" || command.length === 0) {
-            return deny("DENIED_MALFORMED_INPUT");
-        }
-        const decision = evaluateCommand(command, { requiredCommands: policy.requiredCommands });
-        return decision.allowed ? allow(decision.reasonCode) : deny(decision.reasonCode);
-    }
-    if (PATH_EDIT_TOOLS.has(toolName) || READ_PATH_TOOLS.has(toolName)) {
-        const relativePath = pathFromToolInput(input.tool_input, ["file_path", "path", "notebook_path", "pattern"]);
-        if (!relativePath) {
-            return deny("DENIED_MALFORMED_INPUT");
-        }
-        const decision = evaluatePathAction(relativePath, {
-            worktreeRoot: policy.worktreeRoot,
-            blockedPaths: policy.blockedPaths,
-        });
-        return decision.allowed ? allow(decision.reasonCode) : deny(decision.reasonCode);
-    }
-    if (toolName.startsWith("mcp__")) {
-        const contractToolName = toolName.includes("__") ? toolName.slice(toolName.lastIndexOf("__") + 2) : toolName;
-        return policy.allowedMcpTools.includes(toolName) || policy.allowedMcpTools.includes(contractToolName)
-            ? allow("ALLOWED_MCP_READ_TOOL")
-            : deny("DENIED_MCP_TOOL_NOT_ALLOWED");
-    }
-    return deny("DENIED_UNKNOWN_TOOL");
+    return CLAUDE_LOCAL_MCP_TOOLS.includes(toolName) && policy.allowedMcpTools.includes(toolName)
+        ? allow("ALLOWED_LOCAL_TOOL") : deny("DENIED_TOOL_NOT_ALLOWED");
 }

package/dist/src/safety/registered-command-integrity.js

@@ -0,0 +1,52 @@
+import { constants } from 'node:fs';
+import { open, lstat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+const denied = () => new Error('DENIED_COMMAND_INTEGRITY');
+/** Measures one no-follow regular file. This does not claim atomic path-based
+ * exec: OS confinement must contain a racing/hostile script independently. */
+export async function measureCommandFile(file) {
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await fd.stat({ bigint: true });
+        if (!before.isFile() || before.nlink !== 1n || before.size > 512n * 1024n * 1024n)
+            throw denied();
+        const hash = createHash('sha256');
+        let size = 0n;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            size += BigInt(chunk.length);
+            if (size > 512n * 1024n * 1024n)
+                throw denied();
+            hash.update(chunk);
+        }
+        const after = await fd.stat({ bigint: true }), named = await lstat(file, { bigint: true });
+        for (const stat of [after, named])
+            if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino
+                || stat.nlink !== 1n || stat.size !== before.size || stat.mtimeNs !== before.mtimeNs || stat.ctimeNs !== before.ctimeNs)
+                throw denied();
+        if (size !== before.size)
+            throw denied();
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+export async function verifyCommandIntegrity(integrity, executable, paths, files) {
+    try {
+        const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+        if (!integrity || !hex(integrity.executableSha256) || !integrity.readFiles || Array.isArray(integrity.readFiles)
+            || new Set(paths).size !== paths.length || files.length !== paths.length
+            || JSON.stringify(Object.keys(integrity.readFiles).sort()) !== JSON.stringify([...paths].sort()))
+            throw denied();
+        if (await measureCommandFile(executable) !== integrity.executableSha256)
+            throw denied();
+        for (let i = 0; i < paths.length; i++) {
+            const expected = integrity.readFiles[paths[i]];
+            if (!hex(expected) || await measureCommandFile(files[i]) !== expected)
+                throw denied();
+        }
+    }
+    catch {
+        throw denied();
+    }
+}

package/dist/src/safety/security-requirements.js

@@ -0,0 +1,38 @@
+import { createHash } from 'node:crypto';
+import { SUPPORTED_CLI_MODE, SUPPORTED_CLI_GATES, SUPPORTED_CLI_RISKS } from './cli-security-modes.js';
+import { JOB_SECURITY_GATES } from './job-security-policy.js';
+const rejected = () => new Error('SECURITY_REQUIREMENTS_REJECTED');
+function canonical(v) { if (Array.isArray(v))
+    return v.map(canonical); if (v && typeof v === 'object')
+    return Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])])); return v; }
+/** Same canonical domain as Gateway JSON_UNESCAPED_SLASHES packages. */
+export function securityRequirementsFingerprint(value) {
+    const unsigned = { ...value };
+    delete unsigned.fingerprint;
+    return createHash('sha256').update(JSON.stringify(canonical(unsigned)).replace(/[\u007f-\uffff]/g, c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'))).digest('hex');
+}
+export function requireSecurityRequirements(value, expected) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw rejected();
+        const r = value;
+        const supported = r.version === 'cli-security-requirements-v2';
+        const fields = ['version', 'adapter_id', 'adapter_version', 'mandatory_gates', 'status', 'evidence_class', 'release_manifest_sha256', 'fingerprint', ...(supported ? ['security_mode', 'accepted_residual_risks'] : [])];
+        if (JSON.stringify(Object.keys(r).sort()) !== JSON.stringify(fields.sort())
+            || (!supported && r.version !== 'cli-security-requirements-v1') || r.adapter_id !== expected.adapterId || r.adapter_version !== expected.adapterVersion
+            || JSON.stringify(r.mandatory_gates) !== JSON.stringify(supported ? SUPPORTED_CLI_GATES : JOB_SECURITY_GATES) || r.status !== 'verified' || r.evidence_class !== (supported ? 'supported_policy_release' : 'native_release')
+            || supported && (r.adapter_id !== 'codex_cli' || r.security_mode !== SUPPORTED_CLI_MODE || JSON.stringify(r.accepted_residual_risks) !== JSON.stringify(SUPPORTED_CLI_RISKS))
+            || typeof r.release_manifest_sha256 !== 'string' || typeof r.fingerprint !== 'string'
+            || !/^[a-f0-9]{64}$/.test(r.release_manifest_sha256) || !/^[a-f0-9]{64}$/.test(r.fingerprint)
+            || securityRequirementsFingerprint(r) !== r.fingerprint || expected.requirementsSha256 !== undefined && expected.requirementsSha256 !== r.fingerprint)
+            throw rejected();
+        const copy = structuredClone(r);
+        Object.freeze(copy.mandatory_gates);
+        if (copy.accepted_residual_risks)
+            Object.freeze(copy.accepted_residual_risks);
+        return Object.freeze(copy);
+    }
+    catch {
+        throw rejected();
+    }
+}

package/dist/src/safety/subprocess-sandbox.js

@@ -0,0 +1,62 @@
+import { spawn } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import path from 'node:path';
+const quote = (value) => JSON.stringify(value);
+/** Deny-default Seatbelt profile. No inherited profile, environment or shell. */
+export function sandboxProfile(request) {
+    const executable = realpathSync(request.executable);
+    const directories = new Set(['/']);
+    for (const file of [executable, ...request.readFiles, ...request.writeFiles ?? []]) {
+        let directory = path.dirname(file);
+        while (directory !== '/') {
+            directories.add(directory);
+            directory = path.dirname(directory);
+        }
+    }
+    const read = [...directories, ...request.readFiles, executable, '/dev/null', '/dev/random', '/dev/urandom'].map(file => `(literal ${quote(file)})`).join(' ');
+    const write = (request.writeFiles ?? []).map(file => `(literal ${quote(file)})`).join(' ');
+    return `(version 1)(deny default)(allow process-exec (literal ${quote(executable)}))(allow sysctl-read)(allow file-read-metadata)(allow file-map-executable (subpath "/System/Library") (subpath "/usr/lib") (literal ${quote(executable)}))(allow file-read-data (subpath "/System/Library") (subpath "/usr/lib") (subpath "/usr/share") ${read})${write ? `(allow file-write* ${write})` : ''}`;
+}
+export async function runSandboxed(request) {
+    if (process.platform !== 'darwin')
+        throw new Error('LOCAL_SANDBOX_UNAVAILABLE: macOS Seatbelt required');
+    const profile = sandboxProfile(request);
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0, settled = false;
+        const child = spawn('/usr/bin/sandbox-exec', ['-p', profile, realpathSync(request.executable), ...request.argv], {
+            cwd: request.cwd ?? '/', env: { PATH: '/usr/bin:/bin', LANG: 'C', HOME: '/nonexistent', TMPDIR: '/nonexistent' }, stdio: ['ignore', 'pipe', 'pipe'], detached: true, signal: request.signal,
+        });
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolve(Buffer.concat(chunks).toString('utf8'));
+        };
+        const kill = () => {
+            try {
+                if (child.pid)
+                    process.kill(-child.pid, 'SIGKILL');
+            }
+            catch { /* already exited */ }
+        };
+        const timer = request.timeoutMs === undefined ? undefined : setTimeout(() => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: command timed out')); }, request.timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 1024 * 1024) {
+                kill();
+                finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: output limit'));
+            }
+            else
+                chunks.push(chunk);
+        });
+        // Do not disclose arbitrary subprocess stderr or paths to the model.
+        child.stderr.resume();
+        child.on('error', () => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: could not start restricted process')); });
+        child.on('close', (code) => { kill(); finish(code === 0 ? undefined : new Error('LOCAL_SANDBOX_UNAVAILABLE: restricted process failed')); });
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "private": false,
   "license": "UNLICENSED",
   "bin": {