slaunt 0.1.17 → 0.1.18

package/src/desktop/native-claude-connection.js

@@ -0,0 +1,42 @@
+'use strict';
+const {Client}=require('@modelcontextprotocol/sdk/client/index.js');
+const {StreamableHTTPClientTransport}=require('@modelcontextprotocol/sdk/client/streamableHttp.js');
+const {createNativeClaudeBroker}=require('./native-claude-broker');
+const ENDPOINT='https://central-mcp-ccr-production.up.railway.app/mcp';
+
+function validToken(value){return typeof value==='string' && value.length>0 && value.length<=16384 && !/[\x00-\x1f\x7f]/.test(value);}
+function authorizedFetch({grantProvider,fetchImpl=fetch,endpoint=ENDPOINT}) {
+  if(!grantProvider || typeof grantProvider.getFreshTokens!=='function' || typeof grantProvider.refreshAfterUnauthorized!=='function')throw new Error('broker-grant-unavailable');
+  const allowed=new URL(endpoint);
+  return async (input,init)=>{
+    const request=new Request(input,init);
+    const url=new URL(request.url);
+    if(url.origin!==allowed.origin || url.pathname!==allowed.pathname || url.username || url.password || url.hash)throw new Error('broker-destination-invalid');
+    const replay=request.clone();
+    const send=async(request,token)=>{
+      if(!validToken(token))throw new Error('broker-grant-invalid');
+      const headers=new Headers(request.headers);headers.set('authorization',`Bearer ${token}`);headers.set('x-slaunt-client','claude-code');
+      return fetchImpl(new Request(request,{headers,redirect:'error',credentials:'omit',cache:'no-store'}));
+    };
+    const tokens=await grantProvider.getFreshTokens();
+    let response=await send(request,tokens?.accessToken);
+    if(response.status!==401)return response;
+    try{await response.body?.cancel();}catch{}
+    const refreshed=await grantProvider.refreshAfterUnauthorized(tokens.accessToken);
+    return send(replay,refreshed?.accessToken);
+  };
+}
+
+async function startNativeClaudeConnection({grantProvider,fetchImpl=fetch,root,makeClient=()=>new Client({name:'Slaunt Claude broker',version:'0.1.0'},{capabilities:{}}),makeTransport=(url,options)=>new StreamableHTTPClientTransport(url,options)}={}) {
+  const transport=makeTransport(new URL(ENDPOINT),{fetch:authorizedFetch({grantProvider,fetchImpl})});
+  const client=makeClient();
+  let broker,closed=false;
+  const close=async()=>{if(closed)return;closed=true;broker?.close();await client.close().catch(()=>{});await transport.close().catch(()=>{});};
+  try {
+    await client.connect(transport,{timeout:15000});
+    broker=createNativeClaudeBroker({client,root});
+    client.onclose=()=>{broker.close();closed=true;};
+    return {event:broker.event,close};
+  } catch {await close();throw new Error('broker-connection-unavailable');}
+}
+module.exports={ENDPOINT,authorizedFetch,startNativeClaudeConnection};

package/src/desktop/tool-guard-command.js

@@ -0,0 +1,13 @@
+'use strict';
+// Runs with Electron's embedded Node runtime, without starting the desktop UI.
+const { runGuardCommand, DENIAL } = require('./tool-guard');
+const { resolveBrokerIdentity } = require('./client-identity');
+let identity;
+try { identity = resolveBrokerIdentity(process.argv); } catch {
+  process.stdout.write(`${JSON.stringify(DENIAL)}\n`, () => process.exit(0));
+}
+if (identity) {
+  void runGuardCommand({ clientKey: identity.key }).then(() => process.exit(0), () => {
+    process.stdout.write(`${JSON.stringify(DENIAL)}\n`, () => process.exit(0));
+  });
+}

package/src/desktop/tool-guard.js

@@ -0,0 +1,225 @@
+'use strict';
+
+const fs = require('node:fs');
+const net = require('node:net');
+const path = require('node:path');
+const { createHash, randomUUID } = require('node:crypto');
+
+const DENIAL = Object.freeze({ hookSpecificOutput: {
+  hookEventName: 'PreToolUse', permissionDecision: 'deny',
+  permissionDecisionReason: 'Slaunt authorization unavailable or denied. Reconnect Slaunt and start a new turn.'
+} });
+const MAX_BYTES = 8192;
+const hash = value => createHash('sha256').update(value).digest('hex');
+const validString = value => typeof value === 'string' && Boolean(value.trim())
+  && value.length <= 256 && !/[\x00-\x1f\x7f]/.test(value);
+const rootPath = () => {
+  if (process.platform === 'win32' || !process.getuid) throw new Error('guard-platform-unsupported');
+  return `/tmp/slaunt-guard-${process.getuid()}`;
+};
+function ensureRoot(root) {
+  try { fs.mkdirSync(root, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') throw e; }
+  const stat = fs.lstatSync(root);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid()
+      || (stat.mode & 0o077)) throw new Error('unsafe-guard-directory');
+}
+function socketPath(root, clientKey, sessionId, turnId) {
+  if (!['codex', 'claude-code'].includes(clientKey) || !validString(sessionId)) throw new Error('invalid-guard-session');
+  if (clientKey === 'codex' && !validString(turnId)) throw new Error('invalid-guard-turn');
+  return path.join(root, `${hash(JSON.stringify([clientKey, sessionId, clientKey === 'codex' ? turnId : null])).slice(0, 40)}.sock`);
+}
+function requestFromHook(input) {
+  if (!input || (input.hook_event_name ?? input.event_name) !== 'PreToolUse'
+      || !['session_id', 'tool_name', 'tool_use_id'].every(key => validString(input[key]))
+      || !Object.hasOwn(input, 'tool_input')) throw new Error('invalid-guard-event');
+  const args = { event_name: 'PreToolUse', session_id: input.session_id,
+    tool_name: input.tool_name, tool_use_id: input.tool_use_id,
+    request_id: randomUUID(), input_sha256: hash(JSON.stringify(input.tool_input)) };
+  if (input.turn_id !== undefined) {
+    if (!validString(input.turn_id)) throw new Error('invalid-guard-turn');
+    args.turn_id = input.turn_id;
+  }
+  return args;
+}
+function matchingPermit(response, args) {
+  const result = response?.structuredContent;
+  return !response?.isError && result?.decision === 'allow'
+    && ['request_id', 'tool_use_id', 'tool_name', 'input_sha256'].every(key => result[key] === args[key]);
+}
+
+// Keep the existing authenticated MCP connection and runtime. A new connection
+// here could authorize a different thread or lose a remote stop request.
+function createToolGuardServer({ client, clientKey, root = rootPath(), timeoutMs = 6000 }) {
+  const listeners = new Map();
+  const sockets = new Set();
+  const activeTurns = new Map();
+  let closed = false;
+  let activeSession = null;
+  async function bind(sessionId, { turnId, threadId = sessionId } = {}) {
+    if (closed) throw new Error('guard-closed');
+    // SessionStart has no turn yet. Codex sockets bind on UserPromptSubmit,
+    // using that request's native thread selector, never the last active thread.
+    if (clientKey === 'codex' && turnId === undefined) return;
+    if (!validString(threadId)) throw new Error('invalid-guard-thread');
+    const address = socketPath(root, clientKey, sessionId, turnId);
+    activeSession = sessionId;
+    if (clientKey === 'codex') activeTurns.set(threadId, turnId);
+    if (listeners.has(address)) {
+      const existing = listeners.get(address);
+      if (existing.threadId !== threadId) {
+        existing.conflicted = true;
+        throw new Error('ambiguous-guard-turn');
+      }
+      return existing.ready;
+    }
+    if (listeners.size >= 128) {
+      const [oldAddress, old] = listeners.entries().next().value;
+      old.server.close(); listeners.delete(oldAddress);
+    }
+    if (activeTurns.size > 128) activeTurns.delete(activeTurns.keys().next().value);
+    ensureRoot(root);
+    // Refuse to replace another active broker. Remove only our user's stale
+    // socket, checking inode identity again after probing it.
+    let previous;
+    try { previous = fs.lstatSync(address); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    if (previous) {
+      if (!previous.isSocket() || previous.uid !== process.getuid()) throw new Error('unsafe-guard-socket');
+      await new Promise((resolve, reject) => {
+        const probe = net.createConnection(address);
+        probe.setTimeout(500, () => { probe.destroy(); reject(new Error('guard-broker-busy')); });
+        probe.once('connect', () => { probe.destroy(); reject(new Error('guard-broker-busy')); });
+        probe.once('error', error => {
+          if (error.code === 'ECONNREFUSED' || error.code === 'ENOENT') resolve(); else reject(error);
+        });
+      });
+      const current = fs.lstatSync(address);
+      if (current.ino !== previous.ino || current.dev !== previous.dev) throw new Error('guard-socket-changed');
+      fs.unlinkSync(address);
+    }
+    const server = net.createServer(socket => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+      socket.on('error', () => {});
+      let data = '';
+      let handled = false;
+      let settled = false;
+      const finish = result => {
+        if (settled) return;
+        settled = true;
+        if (!socket.destroyed) socket.end(`${JSON.stringify(result)}\n`);
+      };
+      const timer = setTimeout(() => { finish(DENIAL); socket.destroySoon(); }, timeoutMs);
+      socket.on('close', () => clearTimeout(timer));
+      socket.on('data', chunk => {
+        if (handled) return;
+        data += chunk.toString('utf8');
+        if (Buffer.byteLength(data) > MAX_BYTES) { handled = true; finish(DENIAL); return; }
+        if (!data.includes('\n')) return;
+        handled = true;
+        void (async () => {
+          let args;
+          try {
+            args = JSON.parse(data);
+            if (record.conflicted || (clientKey === 'claude-code' && activeSession !== sessionId)
+                || (clientKey === 'codex' && (args.turn_id !== turnId || activeTurns.get(threadId) !== turnId))
+                || args.session_id !== sessionId || args.event_name !== 'PreToolUse'
+                || !['tool_name', 'tool_use_id', 'request_id'].every(key => validString(args[key]))
+                || !/^[a-f0-9]{64}$/.test(args.input_sha256)
+                || Object.keys(args).some(key => !['event_name', 'session_id', 'tool_name', 'tool_use_id', 'request_id', 'input_sha256', 'turn_id'].includes(key))) {
+              throw new Error('invalid-guard-request');
+            }
+            const response = await client.callTool({ name: 'tool_authorize', arguments: args,
+              ...(clientKey === 'codex' ? { _meta: { 'ai.slaunt/codex-session-id': threadId } } : {})
+            }, undefined, { timeout: timeoutMs - 1000 });
+            // Do not forward upstream JSON: it must never rewrite tool inputs,
+            // grant native permissions, or leak diagnostic data to the model.
+            const stillBound = clientKey === 'claude-code' ? activeSession === sessionId : activeTurns.get(threadId) === turnId;
+            finish(!record.conflicted && stillBound && matchingPermit(response, args)
+              ? { structuredContent: { decision: 'allow', ...Object.fromEntries(
+                ['request_id', 'tool_use_id', 'tool_name', 'input_sha256'].map(key => [key, args[key]])) } } : DENIAL);
+          } catch { finish(DENIAL); }
+        })();
+      });
+    });
+    server.maxConnections = 32;
+    const record = { server, threadId, conflicted: false, ready: null };
+    record.ready = new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(address, () => {
+        try { fs.chmodSync(address, 0o600); resolve(); }
+        catch { reject(new Error('guard-socket-unavailable')); }
+      });
+    });
+    listeners.set(address, record);
+    try { await record.ready; } catch (error) { listeners.delete(address); server.close(); throw error; }
+  }
+  function close() {
+    closed = true;
+    for (const socket of sockets) socket.destroy();
+    for (const { server } of listeners.values()) server.close();
+    listeners.clear();
+  }
+  return { bind, close, invalidate: () => { activeSession = null; } };
+}
+
+async function authorizeHook({ input, clientKey, root = rootPath(), timeoutMs = 8000 }) {
+  try {
+    const args = requestFromHook(input);
+    ensureRoot(root);
+    const address = socketPath(root, clientKey, args.session_id, args.turn_id);
+    const stat = fs.lstatSync(address);
+    if (!stat.isSocket() || stat.uid !== process.getuid() || (stat.mode & 0o077)) return DENIAL;
+    return await new Promise(resolve => {
+      const socket = net.createConnection(address);
+      let data = '';
+      const timer = setTimeout(() => finish(DENIAL), timeoutMs);
+      let done = false;
+      function finish(result) {
+        if (done) return;
+        done = true; clearTimeout(timer); socket.destroy(); resolve(result);
+      }
+      socket.once('connect', () => socket.write(`${JSON.stringify(args)}\n`));
+      socket.on('data', chunk => {
+        data += chunk.toString('utf8');
+        if (Buffer.byteLength(data) > MAX_BYTES) return finish(DENIAL);
+        if (!data.includes('\n')) return;
+        try {
+          const result = JSON.parse(data);
+          // A Slaunt permit lets the host continue its normal permission flow.
+          // In particular, do not bypass Claude's native approval prompts.
+          finish(matchingPermit(result, args)
+            ? { hookSpecificOutput: { hookEventName: 'PreToolUse' } } : DENIAL);
+        } catch { finish(DENIAL); }
+      });
+      socket.once('error', () => finish(DENIAL));
+      socket.once('end', () => finish(DENIAL));
+    });
+  } catch { return DENIAL; }
+}
+
+async function runGuardCommand({ stdin = process.stdin, stdout = process.stdout, clientKey, timeoutMs = 10000 }) {
+  // This deadline includes input reading and runs before Electron app readiness.
+  return new Promise(resolve => {
+    let done = false;
+    let data = '';
+    const finish = result => {
+      if (done) return;
+      done = true; clearTimeout(timer); stdin.pause();
+      stdout.write(`${JSON.stringify(result)}\n`, () => resolve());
+    };
+    const timer = setTimeout(() => finish(DENIAL), timeoutMs);
+    stdin.on('error', () => finish(DENIAL));
+    stdin.on('data', chunk => {
+      data += chunk.toString('utf8');
+      if (Buffer.byteLength(data) > 1024 * 1024) finish(DENIAL);
+    });
+    stdin.on('end', () => {
+      if (done) return;
+      try { void authorizeHook({ input: JSON.parse(data), clientKey }).then(finish, () => finish(DENIAL)); }
+      catch { finish(DENIAL); }
+    });
+    stdin.resume();
+  });
+}
+
+module.exports = { DENIAL, requestFromHook, matchingPermit, createToolGuardServer, authorizeHook, runGuardCommand };