talentos 1.1.5 → 1.2.0

package/dist/agent/native/probe.js

@@ -0,0 +1,474 @@
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { writePrivateFile } from "../../agent-config.js";
+import { providerPathEnv } from "../../provider-binary.js";
+import { ApprovalBridge } from "./approvals.js";
+import { HOOK_ENTRY, ROOM_SERVER } from "./launch.js";
+// The behavioural proof the owner-native profile rests on (#10987, R12 R3/R4).
+// A real `claude` runs against a loopback Messages API that scripts tool calls,
+// in an isolated HOME and config, with our hook installed exactly as in a job.
+// A flag or version check proves nothing: the hook must be seen to fire, and its
+// refusal to hold, in every permission mode and for subagent calls too.
+// Cached per binary identity, version, probe revision and hook code; a changed
+// rule or provider re-proves it. Never run per job.
+export const PROBE_REVISION = 1;
+const PROBE_MS = 45_000;
+const SUB_MARK = "TALENTOS_SUBAGENT_PROBE";
+const MODEL = "claude-sonnet-4-5";
+export class OwnerNativeProbeError extends Error {
+    exitCode = 78;
+    constructor(version, detail) {
+        super(`Claude Code ${version} cannot safely run your full setup in rooms (${detail}). Update Claude Code, then run talentos agent native enable again. Rooms keep working without it.`);
+    }
+}
+const sse = (events) => events
+    .map(([name, data]) => `event: ${name}\ndata: ${JSON.stringify(data)}\n\n`)
+    .join("");
+function message(model, id) {
+    return [
+        "message_start",
+        {
+            type: "message_start",
+            message: {
+                id,
+                type: "message",
+                role: "assistant",
+                model,
+                content: [],
+                stop_reason: null,
+                usage: { input_tokens: 1, output_tokens: 1 },
+            },
+        },
+    ];
+}
+function toolReply(model, id, tool) {
+    return sse([
+        message(model, id),
+        [
+            "content_block_start",
+            {
+                type: "content_block_start",
+                index: 0,
+                content_block: {
+                    type: "tool_use",
+                    id: `toolu_${id}`,
+                    name: tool.name,
+                    input: {},
+                },
+            },
+        ],
+        [
+            "content_block_delta",
+            {
+                type: "content_block_delta",
+                index: 0,
+                delta: {
+                    type: "input_json_delta",
+                    partial_json: JSON.stringify(tool.input),
+                },
+            },
+        ],
+        ["content_block_stop", { type: "content_block_stop", index: 0 }],
+        [
+            "message_delta",
+            {
+                type: "message_delta",
+                delta: { stop_reason: "tool_use" },
+                usage: { output_tokens: 5 },
+            },
+        ],
+        ["message_stop", { type: "message_stop" }],
+    ]);
+}
+function textReply(model, id, text) {
+    return sse([
+        message(model, id),
+        [
+            "content_block_start",
+            {
+                type: "content_block_start",
+                index: 0,
+                content_block: { type: "text", text: "" },
+            },
+        ],
+        [
+            "content_block_delta",
+            {
+                type: "content_block_delta",
+                index: 0,
+                delta: { type: "text_delta", text },
+            },
+        ],
+        ["content_block_stop", { type: "content_block_stop", index: 0 }],
+        [
+            "message_delta",
+            {
+                type: "message_delta",
+                delta: { stop_reason: "end_turn" },
+                usage: { output_tokens: 2 },
+            },
+        ],
+        ["message_stop", { type: "message_stop" }],
+    ]);
+}
+export async function runScenario(binary, scenario, hookEntry) {
+    const root = await mkdtemp(join(tmpdir(), "talentos-owner-probe-"));
+    const home = join(root, "home");
+    const cfg = join(root, "cfg");
+    const work = join(root, "work");
+    const jobDir = join(root, "job");
+    const created = join(work, "probe-created");
+    const userMarker = join(root, "user-hook-ran");
+    const results = [];
+    try {
+        await Promise.all([home, cfg, work, jobDir].map((dir) => mkdir(dir, { recursive: true })));
+        // A stand-in owner behind the real supervisor bridge: the ask is pending for
+        // `answerAfterMs`, then the server "says" the scenario's answer.
+        const startedAt = Date.now();
+        const owner = scenario.answer
+            ? await new ApprovalBridge({
+                gateway: {
+                    request: () => Promise.resolve({ status: "pending" }),
+                    status: (keys) => Promise.resolve(keys.map((actionKey) => ({
+                        actionKey,
+                        status: Date.now() - startedAt < (scenario.answerAfterMs ?? 0)
+                            ? "pending"
+                            : scenario.answer,
+                    }))),
+                },
+                statusEveryMs: 50,
+            }).start()
+            : undefined;
+        await writeFile(join(jobDir, "context.json"), JSON.stringify({
+            ...(owner ? { askSocket: owner.socketPath } : {}),
+            home,
+            writeRoots: [realpathSync.native(work)],
+        }));
+        await writeFile(join(jobDir, "settings.json"), JSON.stringify({
+            hooks: {
+                PreToolUse: [
+                    {
+                        matcher: "*",
+                        hooks: [
+                            {
+                                type: "command",
+                                command: `"${process.execPath}" "${hookEntry}" "${jobDir}"`,
+                                timeout: scenario.hookTimeoutSeconds ?? 10,
+                            },
+                        ],
+                    },
+                ],
+            },
+        }));
+        await writeFile(join(jobDir, "mcp.json"), JSON.stringify({
+            mcpServers: {
+                [ROOM_SERVER]: {
+                    command: process.execPath,
+                    args: [join(root, "none.js")],
+                },
+            },
+        }));
+        // A stand-in for the owner's own setup: a user-level hook and MCP server.
+        await writeFile(join(cfg, "settings.json"), JSON.stringify({
+            permissions: scenario.ownerPermissions ?? {},
+            hooks: {
+                PreToolUse: [
+                    {
+                        matcher: "*",
+                        hooks: [
+                            {
+                                type: "command",
+                                command: `"${process.execPath}" -e "require('fs').writeFileSync(process.argv[1],'1')" "${userMarker}"`,
+                            },
+                        ],
+                    },
+                ],
+            },
+        }));
+        const userServers = JSON.stringify({
+            mcpServers: {
+                owners_own: {
+                    command: process.execPath,
+                    args: [join(root, "none2.js")],
+                },
+            },
+        });
+        await writeFile(join(home, ".claude.json"), userServers);
+        await writeFile(join(cfg, ".claude.json"), userServers);
+        let counter = 0;
+        // Each scripted call is made once, so a provider that re-prompts cannot loop.
+        let mainSent = false;
+        let subSent = false;
+        const server = createServer((request, response) => {
+            let raw = "";
+            request.on("data", (chunk) => (raw += chunk));
+            request.on("end", () => {
+                if (!request.url?.startsWith("/v1/messages")) {
+                    response.writeHead(200, { "content-type": "application/json" });
+                    response.end("{}");
+                    return;
+                }
+                const body = JSON.parse(raw || "{}");
+                const model = body.model ?? MODEL;
+                const id = `msg_${++counter}`;
+                const last = body.messages?.at(-1)?.content;
+                const result = Array.isArray(last)
+                    ? last.find((part) => part.type === "tool_result")
+                    : undefined;
+                response.writeHead(200, { "content-type": "text/event-stream" });
+                if (result) {
+                    results.push(JSON.stringify(result.content));
+                    response.end(textReply(model, id, "done"));
+                    return;
+                }
+                if (!body.tools?.length) {
+                    response.end(textReply(model, id, "ok"));
+                    return;
+                }
+                const first = JSON.stringify(body.messages?.[0] ?? "");
+                if (scenario.sub && first.includes(SUB_MARK)) {
+                    response.end(subSent
+                        ? textReply(model, id, "done")
+                        : toolReply(model, id, scenario.sub));
+                    subSent = true;
+                    return;
+                }
+                response.end(mainSent
+                    ? textReply(model, id, "done")
+                    : toolReply(model, id, scenario.main));
+                mainSent = true;
+            });
+        });
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+        const address = server.address();
+        if (!address || typeof address === "string") {
+            throw new Error("No probe port");
+        }
+        const args = [
+            "-p",
+            "run the probe",
+            "--output-format",
+            "stream-json",
+            "--verbose",
+            "--settings",
+            join(jobDir, "settings.json"),
+            "--mcp-config",
+            join(jobDir, "mcp.json"),
+            "--model",
+            MODEL,
+            ...(scenario.mode ? ["--permission-mode", scenario.mode] : []),
+        ];
+        const child = spawn(binary, args, {
+            cwd: work,
+            env: {
+                PATH: providerPathEnv(binary, home),
+                HOME: home,
+                CLAUDE_CONFIG_DIR: cfg,
+                ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
+                ANTHROPIC_API_KEY: `talentos-probe-${randomUUID()}`,
+                CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+                DISABLE_AUTOUPDATER: "1",
+                TMPDIR: tmpdir(),
+            },
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => (stdout += chunk));
+        const timer = setTimeout(() => child.kill("SIGKILL"), scenario.runMs ?? PROBE_MS);
+        await new Promise((resolve) => child.once("close", () => resolve()));
+        clearTimeout(timer);
+        owner?.stop();
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+        const initServers = [];
+        for (const line of stdout.split("\n")) {
+            try {
+                const event = JSON.parse(line);
+                if (event.type === "system" && event.subtype === "init") {
+                    initServers.push(...(event.mcp_servers ?? []).map((s) => s.name));
+                }
+            }
+            catch {
+                // Not JSON.
+            }
+        }
+        const calls = (await readFile(join(jobDir, "calls.jsonl"), "utf8").catch(() => ""))
+            .split("\n")
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+        return {
+            calls,
+            created: existsSync(created) || existsSync(join(work, "probe-created-sub")),
+            initServers,
+            results,
+            userHookRan: existsSync(userMarker),
+            ran: existsSync(join(work, "probe-asked")),
+            wrote: existsSync(join(work, "probe-written")),
+        };
+    }
+    finally {
+        await rm(root, { force: true, recursive: true });
+    }
+}
+const writeTool = () => ({
+    name: "Write",
+    input: { file_path: "probe-written", content: "x" },
+});
+const mkdirAsk = () => ({
+    name: "Bash",
+    input: { command: "mkdir probe-asked" },
+});
+const touch = (name) => ({
+    name: "Bash",
+    input: { command: `touch ${name}` },
+});
+/** Throws OwnerNativeProbeError unless every guarantee holds. */
+export async function probeOwnerNative(input) {
+    const hookEntry = input.hookEntry ?? HOOK_ENTRY;
+    const fail = (detail) => {
+        throw new OwnerNativeProbeError(input.version, detail);
+    };
+    const scenarios = [
+        ...["default", "acceptEdits", "bypassPermissions"].map((mode) => ({
+            main: touch("probe-created"),
+            mode,
+            name: `hook holds in ${mode}`,
+        })),
+        {
+            main: { name: "Bash", input: { command: "ls" } },
+            name: "vetted read is allowed",
+        },
+        // The hook may only tighten: a vetted edit runs, and the very same edit does
+        // not when the owner's own settings say to ask or to deny (headless, an ask
+        // is a refusal).
+        { main: writeTool(), mode: "default", name: "vetted edit is allowed" },
+        {
+            main: writeTool(),
+            mode: "default",
+            name: "owner ask rule holds",
+            ownerPermissions: { ask: ["Write"] },
+        },
+        // PR 2: the hook holds the call while the owner decides.
+        {
+            answer: "approved",
+            main: mkdirAsk(),
+            mode: "default",
+            name: "approved ask runs",
+        },
+        {
+            answer: "denied",
+            main: mkdirAsk(),
+            mode: "default",
+            name: "declined ask holds",
+        },
+        {
+            main: writeTool(),
+            mode: "default",
+            name: "owner deny rule holds",
+            ownerPermissions: { deny: ["Write"] },
+        },
+        {
+            main: {
+                name: "Agent",
+                input: {
+                    description: "probe",
+                    prompt: `${SUB_MARK} run it`,
+                    subagent_type: "general-purpose",
+                },
+            },
+            name: "hook fires for subagents",
+            sub: touch("probe-created-sub"),
+        },
+    ];
+    let outcomes;
+    try {
+        outcomes = await Promise.all(scenarios.map((scenario) => runScenario(input.binary, scenario, hookEntry)));
+    }
+    catch {
+        return fail("the probe could not run");
+    }
+    for (const [index, scenario] of scenarios.entries()) {
+        const outcome = outcomes[index];
+        const denied = outcome.calls.filter((call) => call.tool === "Bash" && call.decision === "deny");
+        if (scenario.name.startsWith("hook holds")) {
+            if (outcome.created || denied.length === 0) {
+                fail(`the safety hook did not hold in ${scenario.mode} mode`);
+            }
+        }
+        else if (scenario.name === "vetted read is allowed") {
+            if (!outcome.calls.some((call) => call.tool === "Bash" && call.decision === "allow") ||
+                outcome.results.some((r) => r.includes("approval"))) {
+                fail("a vetted read was blocked");
+            }
+            if (!outcome.userHookRan) {
+                fail("your own hooks stopped running");
+            }
+            if (!(outcome.initServers.includes("owners_own") &&
+                outcome.initServers.includes(ROOM_SERVER))) {
+                fail("your own tool servers did not load next to the room tools");
+            }
+        }
+        else if (scenario.name === "approved ask runs") {
+            if (!outcome.ran) {
+                fail("an approved action did not run");
+            }
+        }
+        else if (scenario.name === "declined ask holds") {
+            if (outcome.ran) {
+                fail("a declined action ran");
+            }
+        }
+        else if (scenario.name === "vetted edit is allowed") {
+            if (!outcome.wrote) {
+                fail("a vetted edit was blocked");
+            }
+        }
+        else if (scenario.name === "owner ask rule holds" ||
+            scenario.name === "owner deny rule holds") {
+            if (outcome.wrote) {
+                fail("the hook overrode one of your own permission rules");
+            }
+        }
+        else if (!outcome.calls.some((call) => call.subagent && call.decision === "deny") ||
+            outcome.created) {
+            fail("the safety hook did not cover subagent calls");
+        }
+    }
+}
+function cacheKey(binary, version, hookEntry) {
+    const real = realpathSync.native(binary);
+    return createHash("sha256")
+        .update(JSON.stringify([
+        real,
+        statSync(real).mtimeMs,
+        version,
+        PROBE_REVISION,
+        readFileSync(hookEntry, "utf8"),
+    ]))
+        .digest("hex");
+}
+/** Cached probe: re-proves only when the binary, its version, the probe or the hook code changed. */
+export async function ensureOwnerNativeProbe(input) {
+    const hookEntry = input.hookEntry ?? HOOK_ENTRY;
+    const key = cacheKey(input.binary, input.version, hookEntry);
+    try {
+        const cached = JSON.parse(await readFile(input.cachePath, "utf8"));
+        if (cached.key === key && cached.ok === true) {
+            return;
+        }
+    }
+    catch {
+        // No usable cache: prove it.
+    }
+    await probeOwnerNative({
+        binary: input.binary,
+        hookEntry,
+        version: input.version,
+    });
+    await writePrivateFile(input.cachePath, `${JSON.stringify({ key, ok: true, at: Date.now() })}\n`);
+}

package/dist/agent/native/shell.js

@@ -0,0 +1,174 @@
+// A deliberately small shell reader for the owner-native hook (#10987). It
+// understands quotes, `;`, `&&`, `||`, `|` and simple redirections, and it
+// REFUSES everything else it cannot reason about (substitution, expansion,
+// subshells, heredocs, comments, background jobs, env assignments). A refusal
+// is "unparseable", which the policy treats as the strictest ask.
+const DIGIT = /\d/u;
+const ONE_DIGIT = /^\d$/u;
+const ASSIGNMENT = /^[A-Za-z_]\w*=/u;
+const SEPARATORS = new Set([";", "|", "&", "\n"]);
+export function parseShell(source) {
+    const commands = [];
+    let argv = [];
+    let redirects = [];
+    let word = "";
+    let started = false;
+    let glob = false;
+    let pending;
+    const fail = (reason) => ({ ok: false, reason });
+    const endWord = () => {
+        if (!started) {
+            return;
+        }
+        const finished = { glob, text: word };
+        if (pending) {
+            redirects.push({ mode: pending, target: finished });
+            pending = undefined;
+        }
+        else {
+            argv.push(finished);
+        }
+        word = "";
+        started = false;
+        glob = false;
+    };
+    const endCommand = () => {
+        endWord();
+        if (pending) {
+            return false;
+        }
+        if (argv.length > 0) {
+            commands.push({ argv, redirects });
+        }
+        else if (redirects.length > 0) {
+            return false;
+        }
+        argv = [];
+        redirects = [];
+        return true;
+    };
+    for (let i = 0; i < source.length; i++) {
+        const c = source[i];
+        if (c === "'") {
+            const close = source.indexOf("'", i + 1);
+            if (close < 0) {
+                return fail("unterminated quote");
+            }
+            word += source.slice(i + 1, close);
+            started = true;
+            i = close;
+            continue;
+        }
+        if (c === '"') {
+            let j = i + 1;
+            for (; j < source.length && source[j] !== '"'; j++) {
+                const d = source[j];
+                if (d === "$" || d === "`") {
+                    return fail("expansion inside quotes");
+                }
+                if (d === "\\") {
+                    j++;
+                    word += source[j] ?? "";
+                    continue;
+                }
+                word += d;
+            }
+            if (j >= source.length) {
+                return fail("unterminated quote");
+            }
+            started = true;
+            i = j;
+            continue;
+        }
+        if (c === "\\") {
+            const next = source[i + 1];
+            if (next === undefined || next === "\n") {
+                return fail("line continuation");
+            }
+            word += next;
+            started = true;
+            i++;
+            continue;
+        }
+        if (c === "$" || c === "`" || c === "(" || c === ")" || c === "#") {
+            return fail("expansion, subshell or comment");
+        }
+        if (c === "{" || c === "}" || c === "!") {
+            return fail("shell grouping");
+        }
+        if (c === " " || c === "\t" || c === "\r") {
+            endWord();
+            continue;
+        }
+        if (c === ">" || c === "<") {
+            // `2>&1` and `>&2` duplicate descriptors; anything else after `&` is background/`&>`.
+            if (c === ">" && source[i + 1] === "&") {
+                const fd = source[i + 2];
+                if (fd !== undefined && DIGIT.test(fd)) {
+                    if (started && !ONE_DIGIT.test(word)) {
+                        return fail("odd redirection");
+                    }
+                    word = "";
+                    started = false;
+                    i += 2;
+                    continue;
+                }
+                return fail("odd redirection");
+            }
+            if (c === "<" && (source[i + 1] === "<" || source[i + 1] === "(")) {
+                return fail("heredoc or process substitution");
+            }
+            if (c === ">" && source[i + 1] === "(") {
+                return fail("process substitution");
+            }
+            // A leading file descriptor (`2>`) belongs to the redirection.
+            if (started && ONE_DIGIT.test(word)) {
+                word = "";
+                started = false;
+            }
+            else {
+                endWord();
+            }
+            const append = c === ">" && source[i + 1] === ">";
+            if (append) {
+                i++;
+            }
+            if (pending) {
+                return fail("odd redirection");
+            }
+            pending = c === "<" ? "read" : "write";
+            continue;
+        }
+        if (SEPARATORS.has(c)) {
+            if (c === "&" && source[i + 1] !== "&") {
+                return fail("background job");
+            }
+            if (!endCommand()) {
+                return fail("empty command");
+            }
+            if ((c === "&" || c === "|") && source[i + 1] === c) {
+                i++;
+            }
+            continue;
+        }
+        if (c === "*" || c === "?" || c === "[") {
+            glob = true;
+        }
+        word += c;
+        started = true;
+    }
+    if (!endCommand()) {
+        return fail("empty command");
+    }
+    if (commands.length === 0) {
+        return fail("empty command");
+    }
+    // `FOO=bar cmd` changes what the command does (PATH, LD_PRELOAD, GIT_*).
+    for (const command of commands) {
+        const first = command.argv[0];
+        if (first && ASSIGNMENT.test(first.text)) {
+            return fail("environment assignment");
+        }
+    }
+    return { ok: true, commands };
+}