pi-harness-runtime 1.1.6 → 1.1.7

package/packages/runtime/dist/command-executor.js

@@ -0,0 +1,383 @@
+/**
+ * Command Executor — RFC-0025
+ *
+ * Safe shell command execution with timeout, output capture, and security policies.
+ *
+ * Features:
+ * - Timeout enforcement
+ * - Output capture (stdout/stderr)
+ * - Working directory control
+ * - Environment variable injection
+ * - Security policy enforcement
+ * - Process management (kill, signal)
+ */
+import { spawn, } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { join } from "node:path";
+const DEFAULT_POLICY = {
+    allowShellBuiltins: true,
+    allowEnvInjection: true,
+    maxTimeout: 300000, // 5 minutes default
+};
+export class CommandExecutor extends EventEmitter {
+    policy;
+    runningProcesses = new Map();
+    defaultOptions;
+    constructor(policy = {}) {
+        super();
+        this.policy = { ...DEFAULT_POLICY, ...policy };
+        this.defaultOptions = {
+            captureStdout: true,
+            captureStderr: true,
+            ignoreExitCode: false,
+            policyCheck: true,
+        };
+    }
+    /**
+     * Execute a command synchronously
+     */
+    exec(command, options = {}) {
+        const opts = { ...this.defaultOptions, ...options };
+        const startTime = Date.now();
+        // Policy check
+        if (opts.policyCheck !== false) {
+            const policyResult = this.checkPolicy(command, opts);
+            if (!policyResult.allowed) {
+                this.emit("policyViolation", policyResult.reason ?? "Policy violation", command);
+                return {
+                    success: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: policyResult.reason ?? "Policy violation",
+                    timedOut: false,
+                    duration: Date.now() - startTime,
+                    command,
+                };
+            }
+        }
+        // Spawn process
+        const spawnOpts = {
+            cwd: opts.cwd ?? process.cwd(),
+            env: { ...process.env, ...opts.env },
+            shell: opts.shell ?? (process.platform === "win32" ? "cmd.exe" : "/bin/sh"),
+            uid: opts.uid,
+            gid: opts.gid,
+            windowsHide: true,
+        };
+        let proc;
+        try {
+            proc = spawn(command, [], spawnOpts);
+        }
+        catch (error) {
+            this.emit("error", error, command);
+            return {
+                success: false,
+                exitCode: null,
+                stdout: "",
+                stderr: String(error),
+                timedOut: false,
+                duration: Date.now() - startTime,
+                command,
+            };
+        }
+        this.runningProcesses.set(proc.pid, proc);
+        const event = {
+            command,
+            timestamp: new Date().toISOString(),
+            pid: proc.pid,
+        };
+        this.emit("start", event);
+        // Collect output
+        let stdout = "";
+        let stderr = "";
+        if (opts.captureStdout && proc.stdout) {
+            proc.stdout.on("data", (data) => {
+                stdout += data.toString();
+            });
+        }
+        if (opts.captureStderr && proc.stderr) {
+            proc.stderr.on("data", (data) => {
+                stderr += data.toString();
+            });
+        }
+        // Handle timeout
+        let timedOutFlag = false;
+        let timeoutId;
+        if (opts.timeout && opts.timeout > 0) {
+            const maxTimeout = this.policy.maxTimeout ?? Infinity;
+            const effectiveTimeout = Math.min(opts.timeout, maxTimeout);
+            timeoutId = setTimeout(() => {
+                timedOutFlag = true;
+                this.kill(proc.pid);
+                this.emit("timeout", event);
+            }, effectiveTimeout);
+        }
+        // Wait for completion
+        const exitCode = this.waitForExit(proc);
+        // Cleanup
+        if (timeoutId)
+            clearTimeout(timeoutId);
+        this.runningProcesses.delete(proc.pid);
+        const duration = Date.now() - startTime;
+        this.emit("exit", { ...event, exitCode: exitCode ?? -1, duration });
+        const success = (exitCode === 0 || opts.ignoreExitCode) && !timedOutFlag ? true : false;
+        return {
+            success,
+            exitCode,
+            stdout,
+            stderr,
+            timedOut: timedOutFlag,
+            duration,
+            command,
+        };
+    }
+    /**
+     * Execute a command asynchronously (non-blocking)
+     */
+    async execAsync(command, options = {}) {
+        const opts = { ...this.defaultOptions, ...options };
+        const startTime = Date.now();
+        // Policy check
+        if (opts.policyCheck !== false) {
+            const policyResult = this.checkPolicy(command, opts);
+            if (!policyResult.allowed) {
+                this.emit("policyViolation", policyResult.reason ?? "Policy violation", command);
+                return {
+                    success: false,
+                    exitCode: null,
+                    stdout: "",
+                    stderr: policyResult.reason ?? "Policy violation",
+                    timedOut: false,
+                    duration: Date.now() - startTime,
+                    command,
+                };
+            }
+        }
+        // Spawn process
+        const spawnOpts = {
+            cwd: opts.cwd ?? process.cwd(),
+            env: { ...process.env, ...opts.env },
+            shell: opts.shell ?? (process.platform === "win32" ? "cmd.exe" : "/bin/sh"),
+            uid: opts.uid,
+            gid: opts.gid,
+            windowsHide: true,
+        };
+        return new Promise((resolve) => {
+            const proc = spawn(command, [], spawnOpts);
+            this.runningProcesses.set(proc.pid, proc);
+            const event = {
+                command,
+                timestamp: new Date().toISOString(),
+                pid: proc.pid,
+            };
+            this.emit("start", event);
+            // Collect output
+            let stdout = "";
+            let stderr = "";
+            if (opts.captureStdout && proc.stdout) {
+                proc.stdout.on("data", (data) => {
+                    stdout += data.toString();
+                });
+            }
+            if (opts.captureStderr && proc.stderr) {
+                proc.stderr.on("data", (data) => {
+                    stderr += data.toString();
+                });
+            }
+            // Handle timeout
+            let timedOut = false;
+            const timeoutId = setTimeout(() => {
+                timedOut = true;
+                this.kill(proc.pid);
+                this.emit("timeout", event);
+            }, opts.timeout ?? this.policy.maxTimeout ?? 300000);
+            proc.on("close", (code) => {
+                clearTimeout(timeoutId);
+                this.runningProcesses.delete(proc.pid);
+                const duration = Date.now() - startTime;
+                const exitCode = code !== null ? code : -1;
+                this.emit("exit", { ...event, exitCode, duration });
+                const execSuccess = (code === 0 || opts.ignoreExitCode) && !timedOut ? true : false;
+                resolve({
+                    success: execSuccess,
+                    exitCode: code,
+                    stdout,
+                    stderr,
+                    timedOut: timedOut,
+                    duration,
+                    command,
+                });
+            });
+            proc.on("error", (error) => {
+                clearTimeout(timeoutId);
+                this.runningProcesses.delete(proc.pid);
+                this.emit("error", error, command);
+                resolve({
+                    success: false,
+                    exitCode: null,
+                    stdout,
+                    stderr: stderr + "\n" + String(error),
+                    timedOut: false,
+                    duration: Date.now() - startTime,
+                    command,
+                });
+            });
+        });
+    }
+    /**
+     * Kill a running process
+     */
+    kill(pid, signal = "SIGTERM") {
+        const proc = this.runningProcesses.get(pid);
+        if (!proc) {
+            return false;
+        }
+        try {
+            proc.kill(signal);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Kill all running processes
+     */
+    killAll(signal = "SIGTERM") {
+        let killed = 0;
+        for (const entry of Array.from(this.runningProcesses.entries())) {
+            const [_pid, proc] = entry;
+            try {
+                proc.kill(signal);
+                killed++;
+            }
+            catch {
+                // Process already exited
+            }
+        }
+        this.runningProcesses.clear();
+        return killed;
+    }
+    /**
+     * Get count of running processes
+     */
+    getRunningCount() {
+        return this.runningProcesses.size;
+    }
+    /**
+     * Get list of running process PIDs
+     */
+    getRunningPids() {
+        return Array.from(this.runningProcesses.keys());
+    }
+    /**
+     * Check policy for a command
+     */
+    checkPolicy(command, _options) {
+        // Check denied commands
+        if (this.policy.deniedCommands) {
+            for (const pattern of this.policy.deniedCommands) {
+                if (pattern.test(command)) {
+                    return {
+                        allowed: false,
+                        reason: `Command matches denied pattern: ${pattern}`,
+                    };
+                }
+            }
+        }
+        // Check allowed commands (if specified, must match)
+        if (this.policy.allowedCommands && this.policy.allowedCommands.length > 0) {
+            let allowed = false;
+            for (const pattern of this.policy.allowedCommands) {
+                if (pattern.test(command)) {
+                    allowed = true;
+                    break;
+                }
+            }
+            if (!allowed) {
+                return {
+                    allowed: false,
+                    reason: "Command not in allowed list",
+                };
+            }
+        }
+        // Check denied directories
+        if (_options?.cwd) {
+            if (this.policy.deniedDirs) {
+                for (const dir of this.policy.deniedDirs) {
+                    if (_options.cwd.startsWith(dir)) {
+                        return {
+                            allowed: false,
+                            reason: `Working directory matches denied path: ${dir}`,
+                        };
+                    }
+                }
+            }
+        }
+        // Check for dangerous shell operators
+        const dangerousPatterns = [
+            { pattern: /;\s*rm\s+-rf/i, reason: "Attempted rm -rf" },
+            {
+                pattern: />\s*\/dev\/null/i,
+                reason: "Output redirection to /dev/null",
+            },
+            { pattern: /\|\s*sh\s*$/i, reason: "Pipe to shell" },
+            { pattern: /&\s*$/, reason: "Background execution" },
+        ];
+        for (const { pattern, reason } of dangerousPatterns) {
+            if (pattern.test(command)) {
+                // Only block if explicitly denied
+                if (this.policy.deniedCommands) {
+                    return { allowed: false, reason };
+                }
+            }
+        }
+        return { allowed: true };
+    }
+    /**
+     * Update policy at runtime
+     */
+    updatePolicy(updates) {
+        Object.assign(this.policy, updates);
+    }
+    /**
+     * Get current policy
+     */
+    getPolicy() {
+        return { ...this.policy };
+    }
+    // --- Private Methods ------------------------------------------------
+    waitForExit(_proc) {
+        // Note: This method is for synchronous execution.
+        // For async execution, use execAsync() which properly handles events.
+        // This returns null for sync - actual exit code is captured via events.
+        return null;
+    }
+}
+/**
+ * Create a CommandExecutor with safe defaults for harness runtime
+ */
+export function createHarnessExecutor() {
+    return new CommandExecutor({
+        // Allow common development commands
+        allowedCommands: [
+            /^(git|npm|npx|yarn|pnpm|bun|node|python3?|make|cargo|go)\s/,
+            /^(tsc|esbuild|rollup|vite|webpack)\s/,
+            /^(jest|vitest|mocha|pytest|cargo test|npm test)\s/,
+            /^(eslint|ruff|black|prettier)\s/,
+            /^(mkdir|rm|cp|mv|cat|echo|ls|cd)\s/,
+        ],
+        // Deny dangerous patterns
+        deniedCommands: [
+            /rm\s+-rf\s+\/(?!node_modules)/, // rm -rf / except rm -rf node_modules
+            /curl\s+.*\|.*sh$/i, // curl | sh
+            /wget\s+.*\|.*sh$/i, // wget | sh
+            /base64\s+-d\s+.*\|.*sh/i, // base64 decode | sh
+            /:\(\)\{.*\}\s*:/, // Fork bomb
+        ],
+        maxTimeout: 300000, // 5 minutes
+        // Default to user's home directory
+        allowedDirs: [join(process.env.HOME ?? "", "")],
+    });
+}
+//# sourceMappingURL=command-executor.js.map

package/packages/runtime/dist/command-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-executor.js","sourceRoot":"","sources":["../src/command-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACN,KAAK,GAGL,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsEjC,MAAM,cAAc,GAAkB;IACrC,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;IACvB,UAAU,EAAE,MAAM,EAAE,oBAAoB;CACxC,CAAC;AAEF,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC/B,MAAM,CAAgB;IAC/B,gBAAgB,GAA8B,IAAI,GAAG,EAAE,CAAC;IACxD,cAAc,CAAiB;IAEvC,YAAY,MAAM,GAAkB,EAAE;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG;YACrB,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,IAAI;SACjB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAe,EAAE,OAAO,GAAmB,EAAE;QACjD,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,eAAe;QACf,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CACR,iBAAiB,EACjB,YAAY,CAAC,MAAM,IAAI,kBAAkB,EACzC,OAAO,CACP,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,kBAAkB;oBACjD,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,gBAAgB;QAChB,MAAM,SAAS,GAAiB;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC9B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YACpC,KAAK,EACJ,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI;SACjB,CAAC;QAEF,IAAI,IAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAc,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;gBACrB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,OAAO;aACP,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAI,EAAE,IAAI,CAAC,CAAC;QAE3C,MAAM,KAAK,GAAiB;YAC3B,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,EAAE,IAAI,CAAC,GAAG;SACb,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE1B,iBAAiB;QACjB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,SAAqC,CAAC;QAE1C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;YACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAE5D,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACtB,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAExC,UAAU;QACV,IAAI,SAAS;YAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;QAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEpE,MAAM,OAAO,GACZ,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAEzE,OAAO;YACN,OAAO;YACP,QAAQ;YACR,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,YAAY;YACtB,QAAQ;YACR,OAAO;SACP,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACd,OAAe,EACf,OAAO,GAAmB,EAAE;QAE5B,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,eAAe;QACf,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CACR,iBAAiB,EACjB,YAAY,CAAC,MAAM,IAAI,kBAAkB,EACzC,OAAO,CACP,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,kBAAkB;oBACjD,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,OAAO;iBACP,CAAC;YACH,CAAC;QACF,CAAC;QAED,gBAAgB;QAChB,MAAM,SAAS,GAAiB;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC9B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YACpC,KAAK,EACJ,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI;SACjB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAI,EAAE,IAAI,CAAC,CAAC;YAE3C,MAAM,KAAK,GAAiB;gBAC3B,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG,EAAE,IAAI,CAAC,GAAG;aACb,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE1B,iBAAiB;YACjB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACJ,CAAC;YAED,iBAAiB;YACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,SAAS,GAAG,UAAU,CAC3B,GAAG,EAAE;gBACJ,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC,EACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAChD,CAAC;YAEF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;gBAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAEpD,MAAM,WAAW,GAChB,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;gBAEjE,OAAO,CAAC;oBACP,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,IAAI;oBACd,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,QAAQ;oBAClB,QAAQ;oBACR,OAAO;iBACP,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAEnC,OAAO,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,MAAM;oBACN,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;oBACrC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,OAAO;iBACP,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,GAAW,EAAE,MAAM,GAAmB,SAAS;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,GAAmB,SAAS;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,MAAM,EAAE,CAAC;YACV,CAAC;YAAC,MAAM,CAAC;gBACR,yBAAyB;YAC1B,CAAC;QACF,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;OAEG;IACH,eAAe;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,cAAc;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,WAAW,CACV,OAAe,EACf,QAAyB;QAEzB,wBAAwB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAClD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,mCAAmC,OAAO,EAAE;qBACpD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3E,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBACnD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACP,CAAC;YACF,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,6BAA6B;iBACrC,CAAC;YACH,CAAC;QACF,CAAC;QAED,2BAA2B;QAC3B,IAAI,QAAQ,EAAE,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,0CAA0C,GAAG,EAAE;yBACvD,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,sCAAsC;QACtC,MAAM,iBAAiB,GAAG;YACzB,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACxD;gBACC,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,iCAAiC;aACzC;YACD,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE;YACpD,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE;SACpD,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,kCAAkC;gBAClC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACnC,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAA+B;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,SAAS;QACR,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,uEAAuE;IAE/D,WAAW,CAAC,KAAmB;QACtC,kDAAkD;QAClD,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACpC,OAAO,IAAI,eAAe,CAAC;QAC1B,oCAAoC;QACpC,eAAe,EAAE;YAChB,4DAA4D;YAC5D,sCAAsC;YACtC,mDAAmD;YACnD,iCAAiC;YACjC,oCAAoC;SACpC;QACD,0BAA0B;QAC1B,cAAc,EAAE;YACf,+BAA+B,EAAE,sCAAsC;YACvE,mBAAmB,EAAE,YAAY;YACjC,mBAAmB,EAAE,YAAY;YACjC,yBAAyB,EAAE,qBAAqB;YAChD,iBAAiB,EAAE,YAAY;SAC/B;QACD,UAAU,EAAE,MAAM,EAAE,YAAY;QAChC,mCAAmC;QACnC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;KAC/C,CAAC,CAAC;AACJ,CAAC"}

package/packages/runtime/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Runtime (RFC-0030)
+ *
+ * Local runtime agent and command executor.
+ */
+export * from "./command-executor.js";
+export * from "./local-runtime-agent.js";
+export * from "./policy-engine.js";
+export * from "./runtime-api.js";
+export * from "./workspace-manager.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/runtime/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC"}

package/packages/runtime/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * Runtime (RFC-0030)
+ *
+ * Local runtime agent and command executor.
+ */
+export * from "./command-executor.js";
+export * from "./local-runtime-agent.js";
+export * from "./policy-engine.js";
+export * from "./runtime-api.js";
+export * from "./workspace-manager.js";
+//# sourceMappingURL=index.js.map

package/packages/runtime/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC"}

package/packages/runtime/dist/local-runtime-agent.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Local Runtime Agent — RFC-0024
+ *
+ * Server-side coordinator for local browser agent (RFC-0023).
+ * Runs on the server, communicates with browser agent on user's machine.
+ *
+ * Architecture:
+ *   Server Runtime -> HTTP/RPC request -> Local Browser Agent on iMac
+ *       -> Playwright persistent profile -> Human login if needed
+ *       -> scrape usage/reset time -> return safe quota summary
+ *
+ * Security Rules:
+ * - Never return raw cookies
+ * - Never return localStorage
+ * - Bind to localhost by default
+ * - If remote access needed, require VPN/Tailscale and token
+ * - Log only safe summaries
+ */
+import { EventEmitter } from "node:events";
+export interface QuotaSummary {
+    provider: string;
+    authenticated: boolean;
+    checkedAt: string;
+    usageTextSample?: string;
+    resetAt?: string;
+    quotaUsedPct?: number;
+    quotaResetIn?: string;
+}
+export interface AuthSession {
+    provider: string;
+    startedAt: string;
+    lastCheckedAt: string;
+    authenticated: boolean;
+}
+export interface LocalRuntimeAgentConfig {
+    /** Port to listen on (default: 3847) */
+    port?: number;
+    /** Host to bind to (default: localhost) */
+    host?: string;
+    /** Secret token for authentication (optional) */
+    authToken?: string;
+    /** Local browser agent URL (default: http://localhost:3848) */
+    browserAgentUrl?: string;
+    /** Request timeout in ms (default: 30000) */
+    requestTimeoutMs?: number;
+}
+export interface LocalRuntimeAgentEvents {
+    onQuotaChecked: (summary: QuotaSummary) => void;
+    onAuthStarted: (provider: string) => void;
+    onAuthCompleted: (provider: string) => void;
+    onError: (error: Error) => void;
+}
+export declare class LocalRuntimeAgent extends EventEmitter {
+    private readonly config;
+    private server;
+    private authSessions;
+    private isRunning;
+    constructor(config?: LocalRuntimeAgentConfig);
+    /**
+     * Start the Local Runtime Agent server
+     */
+    start(): Promise<void>;
+    /**
+     * Stop the Local Runtime Agent server
+     */
+    stop(): Promise<void>;
+    /**
+     * Check if the agent is running
+     */
+    isListening(): boolean;
+    /**
+     * Get quota summary for a provider via local browser agent
+     */
+    getQuota(provider: string): Promise<QuotaSummary>;
+    /**
+     * Start authentication flow for a provider
+     */
+    startAuth(provider: string): Promise<{
+        started: boolean;
+        message: string;
+    }>;
+    /**
+     * Check authentication status for a provider
+     */
+    checkAuth(provider: string): Promise<{
+        authenticated: boolean;
+        since?: string;
+    }>;
+    /**
+     * Get all active auth sessions
+     */
+    getAuthSessions(): AuthSession[];
+    private handleRequest;
+    private authenticateRequest;
+    private handleHealth;
+    private handleQuota;
+    private handleAuthStart;
+    private handleAuthReset;
+    private handleSessions;
+    private fetchWithTimeout;
+    private redactQuotaResponse;
+    private redactText;
+    private trackQuotaCheck;
+    private emitError;
+    private sendJson;
+}
+/**
+ * Create a LocalRuntimeAgent with default config for harness runtime
+ */
+export declare function createHarnessRuntimeAgent(): LocalRuntimeAgent;
+//# sourceMappingURL=local-runtime-agent.d.ts.map

package/packages/runtime/dist/local-runtime-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runtime-agent.d.ts","sourceRoot":"","sources":["../src/local-runtime-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,YAAY;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACvC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACvC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAChD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AASD,qBAAa,iBAAkB,SAAQ,YAAY;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiF;IACxG,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAAS;IAE1B,YAAY,MAAM,GAAE,uBAA4B,EAS/C;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA4B3B;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAc1B;IAED;;OAEG;IACH,WAAW,IAAI,OAAO,CAErB;IAED;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBtD;IAED;;OAEG;IACG,SAAS,CACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAyBhD;IAED;;OAEG;IACG,SAAS,CACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAqBrD;IAED;;OAEG;IACH,eAAe,IAAI,WAAW,EAAE,CAE/B;YAIa,aAAa;IAoD3B,OAAO,CAAC,mBAAmB;YAwBb,YAAY;YAwBZ,WAAW;YAcX,eAAe;YAQf,eAAe;IAqB7B,OAAO,CAAC,cAAc;YAMR,gBAAgB;IAqB9B,OAAO,CAAC,mBAAmB;IA6B3B,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,QAAQ;CAQhB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,iBAAiB,CAO7D"}