talentos 1.1.5 → 1.2.0

package/dist/agent/codex-probe.js

@@ -0,0 +1,424 @@
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdtemp, readFile, realpath, rm, stat, writeFile, } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { writePrivateFile } from "../agent-config.js";
+import { homeDir } from "../install.js";
+import { ProviderBinaryError, providerPathEnv } from "../provider-binary.js";
+import { codexRoomArgs, ROOM_TOOLS } from "./codex-policy.js";
+const PROBE_MS = 30_000;
+const MAX_BYTES = 4_000_000;
+const PROBE_REVISION = 2;
+const RESOURCE_REFUSAL = /Method not found|unknown MCP server/u;
+const INPUT_TYPES = new Set([
+    "message",
+    "reasoning",
+    "compaction",
+    "function_call",
+    "function_call_output",
+    "tool_search_call",
+    "additional_tools",
+    "tool_search_output",
+]);
+// These route only to the sole tools-only MCP server, which has no resource
+// handlers. The loopback probe exercises their refusal on fresh and resume.
+const RESOURCE_HELPERS = [
+    "list_mcp_resources", // Sole tools-only MCP server: no resources to list.
+    "list_mcp_resource_templates", // Sole tools-only MCP server: no templates.
+    "read_mcp_resource", // MCP RPC only; the proxy has no resources/read handler.
+];
+export class CodexBoundaryError extends ProviderBinaryError {
+    constructor(version) {
+        super(`Codex ${version} cannot safely run room jobs. Update Codex, then run talentos agent repair. If this persists, report this version to TalentOS support.`);
+    }
+}
+function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid tool envelope");
+    }
+    return value;
+}
+/** Names retain their namespace: another MCP server cannot impersonate a room tool. */
+export function codexAdvertisedTools(value) {
+    const request = record(value);
+    if (request.functions !== undefined) {
+        throw new Error("Unknown top-level schema container");
+    }
+    const names = [];
+    function inspect(value, namespace = "") {
+        if (!Array.isArray(value)) {
+            throw new Error("Invalid tools");
+        }
+        for (const item of value) {
+            const tool = record(item);
+            if (tool.type === "namespace") {
+                if (namespace ||
+                    tool.functions !== undefined ||
+                    tool.function !== undefined ||
+                    tool.namespace !== undefined ||
+                    !["functions", "mcp__talentos"].includes(String(tool.name))) {
+                    throw new Error("Unknown namespace");
+                }
+                inspect(tool.tools, String(tool.name));
+            }
+            else if (tool.type === "function" && typeof tool.name === "string") {
+                if (tool.tools !== undefined ||
+                    tool.functions !== undefined ||
+                    tool.function !== undefined ||
+                    (namespace &&
+                        tool.namespace !== undefined &&
+                        tool.namespace !== namespace)) {
+                    throw new Error("Conflicting tool envelope");
+                }
+                const ns = namespace ||
+                    (typeof tool.namespace === "string" ? tool.namespace : "");
+                const name = tool.name;
+                const allowed = ns === "mcp__talentos"
+                    ? ROOM_TOOLS.includes(name)
+                    : ns === "functions" && RESOURCE_HELPERS.includes(name);
+                if (!(allowed && tool.parameters) ||
+                    typeof tool.parameters !== "object" ||
+                    Array.isArray(tool.parameters)) {
+                    throw new Error("Unexpected callable tool");
+                }
+                names.push(`${ns}.${name}`);
+            }
+            else {
+                throw new Error("Unknown tool schema");
+            }
+        }
+    }
+    if (request.tools !== undefined) {
+        inspect(request.tools);
+    }
+    if (!Array.isArray(request.input)) {
+        throw new Error("Missing input");
+    }
+    for (const item of request.input) {
+        const input = record(item);
+        if (typeof input.type !== "string" || !INPUT_TYPES.has(input.type)) {
+            throw new Error("Unknown input envelope");
+        }
+        if (input.type === "additional_tools" ||
+            input.type === "tool_search_output") {
+            inspect(input.tools);
+        }
+        else if (input.tools !== undefined || input.functions !== undefined) {
+            throw new Error("Unknown schema envelope");
+        }
+    }
+    return names;
+}
+export function probeResponse(response, item) {
+    const result = {
+        id: "probe",
+        object: "response",
+        status: "completed",
+        output: [item],
+        usage: { input_tokens: 0, output_tokens: 0, total_tokens: 0 },
+    };
+    response.writeHead(200, { "Content-Type": "text/event-stream" });
+    for (const event of [
+        {
+            type: "response.created",
+            response: { ...result, status: "in_progress", output: [] },
+        },
+        { type: "response.output_item.added", output_index: 0, item },
+        { type: "response.output_item.done", output_index: 0, item },
+        { type: "response.completed", response: result },
+    ]) {
+        response.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+    }
+    response.end();
+}
+async function execute(binary, args, cwd, env, signal) {
+    signal.throwIfAborted();
+    const child = spawn(binary, args, {
+        cwd,
+        env,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    const kill = () => {
+        try {
+            if (process.platform === "win32") {
+                child.kill("SIGKILL");
+            }
+            else if (child.pid) {
+                process.kill(-child.pid, "SIGKILL");
+            }
+        }
+        catch {
+            /* The child may already have exited. */
+        }
+    };
+    signal.addEventListener("abort", kill, { once: true });
+    try {
+        return await new Promise((resolve, reject) => {
+            let output = "";
+            child.stdout.on("data", (chunk) => {
+                output += chunk.toString();
+                if (Buffer.byteLength(output) > MAX_BYTES) {
+                    kill();
+                    reject(new Error("Probe output limit"));
+                }
+            });
+            child.once("error", reject);
+            child.once("close", (code) => code === 0 && !signal.aborted
+                ? resolve(output)
+                : reject(new Error("Probe failed")));
+        });
+    }
+    finally {
+        signal.removeEventListener("abort", kill);
+        kill();
+    }
+}
+function digest(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+async function identity(binary) {
+    const target = await realpath(binary);
+    const info = await stat(target);
+    return JSON.stringify([
+        binary,
+        target,
+        info.dev,
+        info.ino,
+        info.size,
+        info.mtimeMs,
+        info.ctimeMs,
+    ]);
+}
+/** A synthetic turn uses no owner login or live API. Inconclusive probes never permit service. */
+export async function probeCodexBoundary(binary, version, catalog, stop) {
+    try {
+        await proveCodexBoundary(binary, version, catalog, stop);
+    }
+    catch {
+        throw new CodexBoundaryError(version);
+    }
+}
+async function proveCodexBoundary(binary, version, catalog, stop) {
+    const before = await identity(binary);
+    const key = digest(JSON.stringify([
+        PROBE_REVISION,
+        RESOURCE_HELPERS,
+        before,
+        version,
+        catalog,
+        codexRoomArgs({
+            catalogPath: "catalog",
+            mcpCommand: "mcp",
+            mcpArgs: [],
+            prompt: "probe",
+        }),
+    ]));
+    const cache = join(homeDir(), ".talentos", "codex-boundary", `${key}.json`);
+    try {
+        if ((await readFile(cache, "utf8")) === JSON.stringify({ key, safe: true })) {
+            return;
+        }
+    }
+    catch {
+        /* Missing or corrupt cache requires a new proof. */
+    }
+    const directory = await mkdtemp(join(tmpdir(), "talentos-codex-boundary-"));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), PROBE_MS);
+    const signal = stop
+        ? AbortSignal.any([stop, controller.signal])
+        : controller.signal;
+    const server = createServer();
+    let failure;
+    let turn = 0;
+    let requests = 0;
+    const observations = [new Set(), new Set()];
+    const nonce = randomUUID();
+    const marker = `room-probe-${nonce}`;
+    const calls = [[], []];
+    const finished = [false, false];
+    const turnSteps = [];
+    let canaryUrl = "";
+    const canary = join(directory, "private-canary");
+    try {
+        await writeFile(canary, nonce, { mode: 0o600 });
+        const catalogPath = join(directory, "catalog.json");
+        await writeFile(catalogPath, catalog, { mode: 0o600 });
+        const mcp = join(directory, "mcp.mjs");
+        // Match startMcpProxy's sole capability and handlers. No resources, owner
+        // credentials, filesystem readers or generic network tool can be reached.
+        await writeFile(mcp, `import {Server} from ${JSON.stringify(import.meta.resolve("@modelcontextprotocol/sdk/server/index.js"))};
+import {StdioServerTransport} from ${JSON.stringify(import.meta.resolve("@modelcontextprotocol/sdk/server/stdio.js"))};
+import {ListToolsRequestSchema,CallToolRequestSchema} from ${JSON.stringify(import.meta.resolve("@modelcontextprotocol/sdk/types.js"))};
+const server=new Server({name:'talentos',version:'probe'},{capabilities:{tools:{}}});
+server.setRequestHandler(ListToolsRequestSchema,async()=>({tools:${JSON.stringify([...ROOM_TOOLS, "search_memory", "run_routine"].map((name) => ({ name, description: name, inputSchema: { type: "object", properties: {} }, annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false } })))}}));
+server.setRequestHandler(CallToolRequestSchema,async r=>({content:[{type:'text',text:r.params.name==='read_room'?${JSON.stringify(marker)}:'private-tool-refused'}]}));
+await server.connect(new StdioServerTransport());`, { mode: 0o600 });
+        server.on("request", async (request, response) => {
+            try {
+                if (request.method !== "POST" ||
+                    request.url !== "/v1/responses" ||
+                    ++requests > 20) {
+                    throw new Error("Unexpected probe request");
+                }
+                let raw = "";
+                for await (const chunk of request) {
+                    raw += chunk.toString();
+                    if (Buffer.byteLength(raw) > MAX_BYTES) {
+                        throw new Error("Request limit");
+                    }
+                }
+                const body = record(JSON.parse(raw));
+                for (const name of codexAdvertisedTools(body)) {
+                    observations[turn]?.add(name);
+                }
+                const helpers = RESOURCE_HELPERS.filter((name) => observations[turn]?.has(`functions.${name}`));
+                const steps = turnSteps[turn] ?? [
+                    "read_room",
+                    ...helpers,
+                    ...(helpers.includes("read_mcp_resource")
+                        ? ["read_mcp_resource", "read_mcp_resource"]
+                        : []),
+                ];
+                turnSteps[turn] = steps;
+                if (helpers.some((name) => !steps.includes(name))) {
+                    throw new Error("Helper surface changed during proof");
+                }
+                const input = body.input;
+                const completed = calls[turn] ?? [];
+                if (completed.length) {
+                    const output = input.find((item) => item.type === "function_call_output" &&
+                        item.call_id === `${turn}-${completed.length - 1}`);
+                    if (!output) {
+                        throw new Error("Missing tool result");
+                    }
+                    const text = JSON.stringify(output.output);
+                    const previous = completed.at(-1);
+                    if (previous === "read_room") {
+                        if (!text.includes(marker)) {
+                            throw new Error("Room tool did not execute");
+                        }
+                    }
+                    else if (previous === "list_mcp_resources" ||
+                        previous === "list_mcp_resource_templates") {
+                        const field = previous === "list_mcp_resources"
+                            ? "resources"
+                            : "resourceTemplates";
+                        if (output.output !== JSON.stringify({ [field]: [] })) {
+                            throw new Error("Resource listing is not empty");
+                        }
+                    }
+                    else if (typeof output.output !== "string" ||
+                        !output.output.startsWith("resources/read failed:") ||
+                        !RESOURCE_REFUSAL.test(output.output) ||
+                        text.includes(nonce)) {
+                        throw new Error("Resource helper did not refuse");
+                    }
+                }
+                const name = steps[completed.length];
+                if (!name) {
+                    finished[turn] = true;
+                    probeResponse(response, {
+                        type: "message",
+                        id: "answer",
+                        role: "assistant",
+                        status: "completed",
+                        content: [
+                            {
+                                type: "output_text",
+                                text: "Boundary verified.",
+                                annotations: [],
+                            },
+                        ],
+                    });
+                    return;
+                }
+                completed.push(name);
+                const reads = completed.filter((tool) => tool === "read_mcp_resource").length;
+                probeResponse(response, {
+                    type: "function_call",
+                    id: `${turn}-${completed.length - 1}`,
+                    call_id: `${turn}-${completed.length - 1}`,
+                    name,
+                    namespace: name === "read_room" ? "mcp__talentos" : "functions",
+                    arguments: JSON.stringify(name === "read_mcp_resource"
+                        ? {
+                            server: reads === 3 ? "unknown_owner_server" : "talentos",
+                            uri: reads > 1 ? canaryUrl : pathToFileURL(canary).href,
+                        }
+                        : {}),
+                    status: "completed",
+                });
+            }
+            catch (error) {
+                failure = error;
+                response.writeHead(400).end();
+                controller.abort();
+            }
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const address = server.address();
+        if (!address || typeof address === "string") {
+            throw new Error("Missing probe port");
+        }
+        canaryUrl = `http://127.0.0.1:${address.port}/private-canary`;
+        const env = {
+            HOME: directory,
+            CODEX_HOME: directory,
+            XDG_CONFIG_HOME: directory,
+            XDG_CACHE_HOME: directory,
+            PATH: providerPathEnv(binary, directory),
+            TALENTOS_PROBE_KEY: "loopback-only",
+            ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+        };
+        let session;
+        for (turn = 0; turn < 2; turn++) {
+            const args = codexRoomArgs({
+                catalogPath,
+                mcpCommand: process.execPath,
+                mcpArgs: [mcp],
+                prompt: "Verify the room boundary.",
+                sessionId: session,
+            });
+            args.unshift("-c", 'model_provider="talentos_probe"', "-c", 'model_providers.talentos_probe.name="Loopback"', "-c", `model_providers.talentos_probe.base_url="http://127.0.0.1:${address.port}/v1"`, "-c", 'model_providers.talentos_probe.wire_api="responses"', "-c", 'model_providers.talentos_probe.env_key="TALENTOS_PROBE_KEY"');
+            const output = await execute(binary, args, directory, env, signal);
+            if (failure ||
+                !finished[turn] ||
+                calls[turn]?.length !== turnSteps[turn]?.length ||
+                !observations[turn]?.has("mcp__talentos.read_room")) {
+                throw new Error("Incomplete boundary proof");
+            }
+            const events = output
+                .trim()
+                .split("\n")
+                .map((line) => record(JSON.parse(line)));
+            const thread = events.find((event) => event.type === "thread.started")?.thread_id;
+            if (typeof thread !== "string" ||
+                (session && session !== thread) ||
+                !events.some((event) => event.type === "turn.completed")) {
+                throw new Error("Missing resumed session");
+            }
+            session = thread;
+        }
+        if ((await identity(binary)) !== before) {
+            throw new Error("Codex changed during probe");
+        }
+        signal.throwIfAborted();
+        // Failure to persist an optimization does not invalidate a completed proof.
+        await writePrivateFile(cache, JSON.stringify({ key, safe: true })).catch(() => undefined);
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+        await rm(directory, { recursive: true, force: true });
+    }
+}

package/dist/agent/mcp-entry.js

@@ -4,8 +4,11 @@ import { AgentClient } from "../client.js";
 import { startMcpProxy } from "../mcp-proxy.js";
 // A local stdio entry avoids putting the bearer key in Codex's argv or child
 // environment. Only the MCP proxy reads the linked-agent credential file.
-const config = (await localAgents()).find((agent) => agent.agentId === parseArgv(process.argv.slice(2)).options.agent);
+const { options } = parseArgv(process.argv.slice(2));
+const config = (await localAgents()).find((agent) => agent.agentId === options.agent);
 if (!config) {
     throw new Error("Linked agent configuration is unavailable.");
 }
-await startMcpProxy(new AgentClient({ apiUrl: config.apiUrl, apiKey: config.apiKey }));
+await startMcpProxy(new AgentClient({ apiUrl: config.apiUrl, apiKey: config.apiKey }), 
+// The launcher names the job's workspace; a job with none uploads nothing.
+options["upload-root"]);

package/dist/agent/native/approvals.js

@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+// The supervisor's half of an ask (#10987 PR 2). The hook (a separate process,
+// inside the provider) connects to this process over a unix socket, sends the
+// ask, and WAITS ON THAT CONNECTION. Nothing is ever read back from a file: an
+// answer exists only as bytes this process writes on the asker's own connection,
+// after the server said so. There is no decision file for the model to forge.
+//
+// The socket lives in a fresh 0700 directory under the system temp folder, never
+// inside any workspace or the job folder. Code that runs as the same user (an
+// approved script) could still impersonate this process; that needs running
+// code, which is itself an owner-approved tier 1 action.
+const ACTION_KEY = /^[0-9a-f]{64}$/u;
+const STATUS_EVERY_MS = 1000;
+const MAX_LINE = 4096;
+const asAnswer = (status) => status === "approved" || status === "denied" || status === "expired"
+    ? status
+    : undefined;
+function parseAsk(line) {
+    try {
+        const value = JSON.parse(line);
+        if (typeof value.actionKey === "string" &&
+            ACTION_KEY.test(value.actionKey) &&
+            typeof value.kind === "string" &&
+            value.kind.length <= 80 &&
+            typeof value.summary === "string" &&
+            value.summary.length <= 200 &&
+            (value.tier === 1 || value.tier === 2)) {
+            return {
+                actionKey: value.actionKey,
+                kind: value.kind,
+                summary: value.summary,
+                tier: value.tier,
+            };
+        }
+    }
+    catch {
+        // Not an ask.
+    }
+    return;
+}
+export class ApprovalBridge {
+    gateway;
+    onWaiting;
+    statusEveryMs;
+    waiters = new Map();
+    waiting = false;
+    polling = false;
+    lastPollAt = 0;
+    constructor(input) {
+        this.gateway = input.gateway;
+        this.onWaiting = input.onWaiting ?? (() => undefined);
+        this.statusEveryMs = input.statusEveryMs ?? STATUS_EVERY_MS;
+    }
+    /** Listens for the hook's asks; `stop` refuses anything still held. */
+    async start() {
+        const directory = mkdtempSync(join(tmpdir(), "tos-"));
+        const socketPath = join(directory, "a.sock");
+        const server = createServer((socket) => this.accept(socket));
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, resolve);
+        });
+        const timer = setInterval(() => {
+            this.poll().catch(() => undefined);
+        }, Math.max(100, Math.min(this.statusEveryMs, 250)));
+        return {
+            socketPath,
+            stop: () => {
+                clearInterval(timer);
+                for (const sockets of this.waiters.values()) {
+                    for (const socket of sockets) {
+                        socket.destroy();
+                    }
+                }
+                this.waiters.clear();
+                this.signal();
+                server.close();
+                rmSync(directory, { force: true, recursive: true });
+            },
+        };
+    }
+    accept(socket) {
+        let buffer = "";
+        socket.setEncoding("utf8");
+        socket.on("error", () => socket.destroy());
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > MAX_LINE) {
+                socket.destroy();
+                return;
+            }
+            const end = buffer.indexOf("\n");
+            if (end < 0) {
+                return;
+            }
+            const ask = parseAsk(buffer.slice(0, end));
+            buffer = "";
+            if (!ask) {
+                socket.destroy();
+                return;
+            }
+            this.forward(ask, socket).catch(() => socket.destroy());
+        });
+        socket.on("close", () => {
+            for (const [key, sockets] of this.waiters) {
+                sockets.delete(socket);
+                if (sockets.size === 0) {
+                    this.waiters.delete(key);
+                }
+            }
+            this.signal();
+        });
+    }
+    async forward(ask, socket) {
+        try {
+            const { status } = await this.gateway.request(ask);
+            const answer = asAnswer(status);
+            if (answer) {
+                this.reply(socket, answer);
+                return;
+            }
+        }
+        catch {
+            // A lost lease ends the ask; an unreachable server also refuses, because a
+            // held call must never outlive the answer it waits for.
+            this.reply(socket, "expired");
+            return;
+        }
+        const sockets = this.waiters.get(ask.actionKey) ?? new Set();
+        sockets.add(socket);
+        this.waiters.set(ask.actionKey, sockets);
+        this.signal();
+    }
+    async poll() {
+        if (this.polling ||
+            this.waiters.size === 0 ||
+            Date.now() - this.lastPollAt < this.statusEveryMs) {
+            return;
+        }
+        this.polling = true;
+        this.lastPollAt = Date.now();
+        try {
+            const keys = [...this.waiters.keys()].slice(0, 10);
+            const answers = new Map((await this.gateway.status(keys)).map((row) => [
+                row.actionKey,
+                row.status,
+            ]));
+            for (const key of keys) {
+                const status = answers.get(key);
+                const answer = status === undefined ? "expired" : asAnswer(status);
+                if (answer) {
+                    for (const socket of this.waiters.get(key) ?? []) {
+                        this.reply(socket, answer);
+                    }
+                    this.waiters.delete(key);
+                }
+            }
+        }
+        catch (error) {
+            const code = error.status;
+            if (code === 409 || code === 404) {
+                for (const sockets of this.waiters.values()) {
+                    for (const socket of sockets) {
+                        this.reply(socket, "expired");
+                    }
+                }
+                this.waiters.clear();
+            }
+        }
+        finally {
+            this.polling = false;
+            this.signal();
+        }
+    }
+    reply(socket, status) {
+        socket.end(`${JSON.stringify({ status })}\n`);
+    }
+    signal() {
+        const waiting = this.waiters.size > 0;
+        if (waiting !== this.waiting) {
+            this.waiting = waiting;
+            this.onWaiting(waiting);
+        }
+    }
+}