@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/bin/_agent-browser-safe.test.mjs

@@ -1,165 +0,0 @@
-// DDR-185 security addendum, round 3 — the hardened agent-browser wrapper
-// behind `maude design agent-browser-safe`
-// (apps/studio/bin/_agent-browser-safe.mjs). This suite locks the SECURITY
-// CORE: the closed subcommand allow-list (no cookies/clipboard/storage/
-// connect/chat/eval reachable — `eval` was REMOVED in round 3, see below),
-// the fixed positional-argument ARITY per subcommand with NO flag
-// vocabulary at all, and the `--config`-pin + full env-clearing that closes
-// the project-level `agent-browser.json` auto-discovery bypass a live
-// adversarial pass found round 2 never considered.
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import {
-  ALLOWED_SUBCOMMANDS,
-  CLEARED_ENV_KEYS,
-  SUBCOMMAND_ARITY,
-  validateArgv,
-} from './_agent-browser-safe.mjs';
-
-describe('validateArgv — subcommand allow-list', () => {
-  for (const sub of ALLOWED_SUBCOMMANDS) {
-    test(`accepts "${sub}" with its minimum expected argument count`, () => {
-      const [min] = SUBCOMMAND_ARITY[sub];
-      const args = Array.from({ length: min }, (_, i) => `arg${i}`);
-      expect(validateArgv([sub, ...args])).toBeNull();
-    });
-  }
-
-  test('round 3: "eval" is REMOVED — arbitrary JS execution can\'t be argv-constrained (ethical-hacker Finding 1)', () => {
-    // Round 2 kept eval on the allow-list; a live adversarial pass proved
-    // eval defeats --allowed-domains entirely (window.location.href escapes
-    // the navigation gate; a no-cors fetch() exfiltrates without even
-    // needing a domain match) — no argv check can close that, so the
-    // capability itself is cut, mirroring this DDR's own `find` precedent.
-    expect(ALLOWED_SUBCOMMANDS).not.toContain('eval');
-    const reason = validateArgv(['eval', '1+1']);
-    expect(reason).toContain('eval');
-  });
-
-  for (const sub of [
-    'cookies',
-    'clipboard',
-    'storage',
-    'connect',
-    'chat',
-    'upload',
-    'auth',
-    'profiles',
-  ]) {
-    test(`rejects the credential/session-hijack-capable subcommand "${sub}" (ethical-hacker Finding D)`, () => {
-      const reason = validateArgv([sub, 'get']);
-      expect(reason).toContain(sub);
-    });
-  }
-
-  test('rejects when no subcommand is given', () => {
-    expect(validateArgv([])).not.toBeNull();
-  });
-});
-
-describe('validateArgv — fixed arity, NO flag vocabulary at all', () => {
-  test('rejects an extra argument beyond the expected arity, whatever it looks like', () => {
-    const reason = validateArgv(['open', 'http://localhost:1', 'extra']);
-    expect(reason).toContain('exactly 1');
-  });
-
-  test('rejects the --provider/-p remote-cloud-browser PoC verbatim (round-2 finding)', () => {
-    expect(
-      validateArgv(['open', 'http://localhost:1', '--provider', 'browserbase'])
-    ).not.toBeNull();
-    expect(validateArgv(['open', '-p', 'browserbase', 'http://localhost:1'])).not.toBeNull();
-  });
-
-  test('rejects the persistent-profile PoC verbatim (still closed under the arity model)', () => {
-    expect(
-      validateArgv(['open', '--profile', 'Default', 'https://github.com/settings/tokens'])
-    ).not.toBeNull();
-  });
-
-  test('rejects the CDP-attach PoC verbatim (still closed under the arity model)', () => {
-    expect(validateArgv(['snapshot', '--cdp', '9222'])).not.toBeNull();
-  });
-
-  test('a positional value that itself starts with "-" is NOT mistaken for a flag (arity-based, not prefix-based)', () => {
-    // agent-browser-safe get "-weird-thing" must still work — the arity
-    // model looks at COUNT, not at whether a token happens to start with a
-    // dash.
-    expect(validateArgv(['get', '-weird-thing'])).toBeNull();
-  });
-
-  test('screenshot accepts 0 or 1 positional args (optional path)', () => {
-    expect(validateArgv(['screenshot'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png', 'extra'])).not.toBeNull();
-  });
-
-  test('get accepts 1 or 2 positional args (thing + optional selector)', () => {
-    expect(validateArgv(['get', 'text'])).toBeNull();
-    expect(validateArgv(['get', 'text', '.selector'])).toBeNull();
-    expect(validateArgv(['get'])).not.toBeNull();
-  });
-
-  test('snapshot and close accept exactly 0 arguments', () => {
-    expect(validateArgv(['snapshot'])).toBeNull();
-    expect(validateArgv(['snapshot', '-i'])).not.toBeNull();
-    expect(validateArgv(['close'])).toBeNull();
-    expect(validateArgv(['close', '--all'])).not.toBeNull();
-  });
-
-  test('an ordinary allowed invocation with no extra args passes', () => {
-    expect(validateArgv(['open', 'http://localhost:3000/'])).toBeNull();
-    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
-  });
-});
-
-describe('CLEARED_ENV_KEYS', () => {
-  test('round 3: covers AGENT_BROWSER_CONFIG (defense in depth alongside the --config pin)', () => {
-    expect(CLEARED_ENV_KEYS).toContain('AGENT_BROWSER_CONFIG');
-  });
-
-  test('round 2: covers the three vars a live verification pass found missing from round 1', () => {
-    for (const key of [
-      'AGENT_BROWSER_AUTO_CONNECT',
-      'AGENT_BROWSER_PROXY',
-      'AGENT_BROWSER_ENGINE',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-
-  test('covers all four standard proxy env vars, both cases', () => {
-    for (const key of [
-      'HTTP_PROXY',
-      'HTTPS_PROXY',
-      'ALL_PROXY',
-      'http_proxy',
-      'https_proxy',
-      'all_proxy',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-
-  test('still covers the original round-1 set', () => {
-    for (const key of [
-      'AGENT_BROWSER_PROFILE',
-      'AGENT_BROWSER_SESSION_NAME',
-      'AGENT_BROWSER_ACTION_POLICY',
-      'AGENT_BROWSER_CONFIRM_ACTIONS',
-      'AGENT_BROWSER_CONFIRM_INTERACTIVE',
-    ]) {
-      expect(CLEARED_ENV_KEYS).toContain(key);
-    }
-  });
-});
-
-describe('the forced --config target (round 3: closes ./agent-browser.json auto-discovery)', () => {
-  test('_agent-browser-safe-config.json exists and is valid, empty JSON', () => {
-    // Must stay valid JSON — agent-browser exits with an error if --config
-    // points to a missing/invalid file, which would break every allowed
-    // subcommand, not just fail safe.
-    const raw = readFileSync(new URL('./_agent-browser-safe-config.json', import.meta.url), 'utf8');
-    expect(JSON.parse(raw)).toEqual({});
-  });
-});

package/apps/studio/bin/_curl-local.test.mjs

@@ -1,280 +0,0 @@
-// DDR-185 — the loopback-only curl gate behind `maude design curl-local`
-// (apps/studio/bin/_curl-local.mjs). This suite locks the SECURITY CORE: the
-// strict-loopback address classifier (accepts ONLY 127.0.0.0/8 / ::1 / the
-// IPv4-mapped form — unlike `_fetch-asset.mjs`'s `classifyAddress`, an
-// ordinary private-LAN address like 192.168.1.1 is REJECTED here, not
-// allowed), the every-record DNS check (closes the multi-A-record rebinding
-// gap), and — round 2 of the security addendum — the Maude-owned request
-// parser (`parseRequestArgv`) that REPLACED the raw-curl-argv allowlist a
-// live security fan-out found still bypassable via curl's own concatenated
-// short-flag syntax (`-K<path>`, `-x<url>`, `-T<path>` all slipped past the
-// `a.split('=')[0]` check) and a missing `--noproxy` reject entry. This file
-// no longer recognizes ANY curl flag at all — only its own small vocabulary
-// — so there is no curl-syntax bypass class left to enumerate against.
-
-import { describe, expect, test } from 'bun:test';
-import {
-  buildCurlArgs,
-  CurlLocalArgvError,
-  CurlLocalError,
-  classifyRecords,
-  isLoopbackAddress,
-  parseRequestArgv,
-  resolveLoopbackIp,
-} from './_curl-local.mjs';
-
-describe('isLoopbackAddress', () => {
-  test('accepts IPv4 loopback (127.0.0.0/8, not just 127.0.0.1)', () => {
-    expect(isLoopbackAddress('127.0.0.1')).toBe(true);
-    expect(isLoopbackAddress('127.9.9.9')).toBe(true);
-    expect(isLoopbackAddress('127.255.255.255')).toBe(true);
-  });
-
-  test('accepts IPv6 ::1 and the IPv4-mapped loopback form', () => {
-    expect(isLoopbackAddress('::1')).toBe(true);
-    expect(isLoopbackAddress('::ffff:127.0.0.1')).toBe(true);
-  });
-
-  test("rejects ordinary private-LAN addresses — this is STRICTER than fetch-asset's classifier", () => {
-    // fetch-asset's classifyAddress blocks these too (as "not a safe egress
-    // target"), but for a different reason (SSRF from an external URL). Here
-    // the bar is "is this literally my own machine" — a private-LAN IP is a
-    // real, different host, not loopback, and must still prompt.
-    expect(isLoopbackAddress('192.168.1.1')).toBe(false);
-    expect(isLoopbackAddress('10.0.0.1')).toBe(false);
-    expect(isLoopbackAddress('172.16.0.1')).toBe(false);
-    expect(isLoopbackAddress('169.254.169.254')).toBe(false); // cloud IMDS
-  });
-
-  test('rejects public addresses and link-local/multicast/reserved ranges', () => {
-    for (const ip of ['8.8.8.8', '1.1.1.1', '224.0.0.1', '240.0.0.1', 'fe80::1']) {
-      expect(isLoopbackAddress(ip)).toBe(false);
-    }
-  });
-
-  test('rejects a non-IP string', () => {
-    expect(isLoopbackAddress('not-an-ip')).toBe(false);
-    expect(isLoopbackAddress('localhost')).toBe(false); // a hostname, not a literal — resolved separately
-  });
-});
-
-describe('classifyRecords — the every-record check (multi-A-record DNS rebinding)', () => {
-  test('all-loopback records pass', () => {
-    expect(
-      classifyRecords('localhost', [{ address: '127.0.0.1' }, { address: '127.0.0.2' }])
-    ).toBeNull();
-  });
-
-  test('a single non-loopback record among several loopback ones still fails the whole host', () => {
-    const reason = classifyRecords('rebind.example', [
-      { address: '127.0.0.1' },
-      { address: '93.184.216.34' },
-    ]);
-    expect(reason).toContain('93.184.216.34');
-    expect(reason).toContain('non-loopback');
-  });
-
-  test('empty record set fails', () => {
-    expect(classifyRecords('empty.example', [])).toContain('no DNS records');
-  });
-});
-
-describe('resolveLoopbackIp', () => {
-  test('an IP-literal host skips DNS entirely — loopback passes, returns itself', async () => {
-    await expect(resolveLoopbackIp('127.0.0.1')).resolves.toBe('127.0.0.1');
-  });
-
-  test('an IP-literal host that is not loopback throws CurlLocalError(3)', async () => {
-    await expect(resolveLoopbackIp('8.8.8.8')).rejects.toThrow(CurlLocalError);
-    try {
-      await resolveLoopbackIp('8.8.8.8');
-      throw new Error('should have thrown');
-    } catch (err) {
-      expect(err.code).toBe(3);
-    }
-  });
-
-  test('a hostname resolving to all-loopback records (injected lookup) passes, returns the pin IP', async () => {
-    const lookupFn = async () => [
-      { address: '127.0.0.1', family: 4 },
-      { address: '::1', family: 6 },
-    ];
-    await expect(resolveLoopbackIp('localhost', { lookupFn })).resolves.toBe('127.0.0.1');
-  });
-
-  test('a hostname with ONE non-loopback record among several is rejected (DNS-rebinding defense)', async () => {
-    const lookupFn = async () => [
-      { address: '127.0.0.1', family: 4 },
-      { address: '203.0.113.5', family: 4 }, // TEST-NET-3 — a real "other" address
-    ];
-    await expect(resolveLoopbackIp('rebind.example', { lookupFn })).rejects.toThrow(CurlLocalError);
-  });
-
-  test('DNS resolution failure is a rejection, not a silent pass', async () => {
-    const lookupFn = async () => {
-      const err = new Error('getaddrinfo ENOTFOUND nope.invalid');
-      err.code = 'ENOTFOUND';
-      throw err;
-    };
-    await expect(resolveLoopbackIp('nope.invalid', { lookupFn })).rejects.toThrow(CurlLocalError);
-  });
-});
-
-describe('parseRequestArgv — the Maude-owned flag vocabulary (never raw curl syntax)', () => {
-  test('a bare URL parses as a GET with no headers/body', () => {
-    const req = parseRequestArgv(['http://localhost:3000/api']);
-    expect(req.url).toBe('http://localhost:3000/api');
-    expect(req.method).toBe('GET');
-    expect(req.headers).toEqual([]);
-    expect(req.data).toBeNull();
-  });
-
-  test('--method, repeated --header, and --data all parse', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/api',
-      '--method',
-      'post',
-      '--header',
-      'Content-Type: application/json',
-      '--header',
-      'X-Test: 1',
-      '--data',
-      '{"a":1}',
-    ]);
-    expect(req.method).toBe('POST'); // uppercased
-    expect(req.headers).toEqual(['Content-Type: application/json', 'X-Test: 1']);
-    expect(req.data).toBe('{"a":1}');
-  });
-
-  test('boolean flags (--insecure/--include/--verbose) parse with no value consumed', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/',
-      '--insecure',
-      '--include',
-      '--verbose',
-    ]);
-    expect(req.insecure).toBe(true);
-    expect(req.include).toBe(true);
-    expect(req.verbose).toBe(true);
-  });
-
-  test('rejects an unrecognized method', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--method', 'TRACE'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a malformed header (must look like "Name: value")', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--header', 'not-a-header'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a non-positive --max-time', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--max-time', '0'])).toThrow(
-      CurlLocalArgvError
-    );
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--max-time', 'nope'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a non-http(s) URL scheme', () => {
-    expect(() => parseRequestArgv(['file:///etc/passwd'])).toThrow(CurlLocalArgvError);
-  });
-
-  test('rejects a value-taking flag with no value', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--header'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects more than one positional argument', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', 'http://localhost:4000/'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects when no URL is given at all', () => {
-    expect(() => parseRequestArgv(['--method', 'GET'])).toThrow(CurlLocalArgvError);
-  });
-
-  // ── Round-2 security addendum: these are exactly the argv forms that
-  // bypassed the PREVIOUS raw-curl-argv allowlist. None of them are
-  // "rejected flags" here — they're simply not part of this file's flag
-  // vocabulary at all, so they fall through to the generic
-  // "unrecognized flag" / "unexpected extra argument" path.
-  test('rejects the concatenated -K<path> config-file-smuggling PoC verbatim (round-2 finding #1)', () => {
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '-Kevil.conf'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a caller-supplied --noproxy override verbatim (round-2 finding #2)', () => {
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '--noproxy', ''])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects the concatenated -x<url>/-T<path> short forms (round-2 finding #3)', () => {
-    expect(() => parseRequestArgv(['-xhttp://evil.example', 'http://127.0.0.1:1/'])).toThrow(
-      CurlLocalArgvError
-    );
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '-T/etc/passwd'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects the original --resolve/--connect-to target-override PoC verbatim', () => {
-    expect(() =>
-      parseRequestArgv(['--resolve', 'localhost:80:203.0.113.5', 'http://localhost/'])
-    ).toThrow(CurlLocalArgvError);
-  });
-
-  test('a value containing curl-flag-shaped text is inert data, not a flag — no injection via --data', () => {
-    // "@/etc/passwd" as a --data value must never be treated as curl's
-    // "read a file" shorthand (that's -d/--data's behavior, not
-    // --data-raw's, which buildCurlArgs always uses — see the live
-    // end-to-end test below for the full round-trip proof).
-    const req = parseRequestArgv([
-      'http://localhost:3000/',
-      '--data',
-      '@/etc/passwd; -K evil.conf',
-    ]);
-    expect(req.data).toBe('@/etc/passwd; -K evil.conf');
-  });
-});
-
-describe("buildCurlArgs — every flag name is one of THIS file's own hardcoded literals", () => {
-  test('a bare GET pins the connection and forces the safety flags', () => {
-    const req = parseRequestArgv(['http://localhost:3000/']);
-    const args = buildCurlArgs(req, '127.0.0.1', 3000);
-    expect(args).toContain('--resolve');
-    expect(args[args.indexOf('--resolve') + 1]).toBe('localhost:3000:127.0.0.1');
-    expect(args).toContain('--noproxy');
-    expect(args).toContain('-q'); // curlrc disabled
-    expect(args).toEqual(expect.arrayContaining(['--max-redirs', '0']));
-    expect(args.at(-1)).toBe('http://localhost:3000/'); // the URL, always last, after `--`
-    expect(args.at(-2)).toBe('--');
-  });
-
-  test('POST + headers + data map to -X/-H/--data-raw (never -d, which treats a leading @ as a file path)', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/api',
-      '--method',
-      'POST',
-      '--header',
-      'Content-Type: application/json',
-      '--data',
-      '@/etc/passwd',
-    ]);
-    const args = buildCurlArgs(req, '127.0.0.1', 3000);
-    expect(args).toContain('-X');
-    expect(args[args.indexOf('-X') + 1]).toBe('POST');
-    expect(args).toContain('-H');
-    expect(args[args.indexOf('-H') + 1]).toBe('Content-Type: application/json');
-    expect(args).toContain('--data-raw');
-    expect(args).not.toContain('-d');
-    expect(args[args.indexOf('--data-raw') + 1]).toBe('@/etc/passwd');
-  });
-});

package/apps/studio/bin/_pw-launch.test.mjs

@@ -1,90 +0,0 @@
-// _pw-launch.test.mjs — the pure, security-relevant helpers shared by the
-// multi-artboard export shims (_png/_pdf-playwright.mjs). Regression coverage
-// for the arbitrary-file-write finding fixed in the print-artboards dogfood
-// pass (DDR-182 addendum): a `data-dc-screen` id is DDR-054 untrusted canvas
-// content, and used to be trusted verbatim as a `path.join` segment.
-
-import { describe, expect, test } from 'bun:test';
-import { assertRenderOutputSizeOk, safeArtboardFilename } from './_pw-launch.mjs';
-
-describe('safeArtboardFilename', () => {
-  test('passes a well-formed id through unchanged', () => {
-    expect(safeArtboardFilename('ak-alpha', 0, 'pdf')).toBe('ak-alpha.pdf');
-    expect(safeArtboardFilename('Beta_2', 3, 'png')).toBe('Beta_2.png');
-  });
-
-  test('falls back to the positional name for a path-traversal id', () => {
-    expect(safeArtboardFilename('../../../../tmp/pwned', 2, 'pdf')).toBe('artboard-3.pdf');
-    expect(safeArtboardFilename('/etc/passwd', 0, 'png')).toBe('artboard-1.png');
-    expect(safeArtboardFilename('..', 1, 'pdf')).toBe('artboard-2.pdf');
-  });
-
-  test('falls back for null/undefined/empty/non-string ids', () => {
-    expect(safeArtboardFilename(null, 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename(undefined, 4, 'png')).toBe('artboard-5.png');
-    expect(safeArtboardFilename('', 1, 'pdf')).toBe('artboard-2.pdf');
-  });
-
-  test('falls back for an id starting with a digit or containing unsafe chars', () => {
-    expect(safeArtboardFilename('1abc', 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename('a/b', 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename('a b', 0, 'pdf')).toBe('artboard-1.pdf');
-  });
-
-  test('falls back for an id over the 64-char cap', () => {
-    expect(safeArtboardFilename(`a${'x'.repeat(64)}`, 0, 'pdf')).toBe('artboard-1.pdf');
-  });
-});
-
-describe('assertRenderOutputSizeOk', () => {
-  test('does not exit for a reasonable A4-at-300dpi request', () => {
-    const origExit = process.exit;
-    let exited = false;
-    process.exit = () => {
-      exited = true;
-    };
-    try {
-      assertRenderOutputSizeOk(818, 1146, 3.125, '_test');
-    } finally {
-      process.exit = origExit;
-    }
-    expect(exited).toBe(false);
-  });
-
-  test('exits when the requested output exceeds the max side guard', () => {
-    const origExit = process.exit;
-    const origError = console.error;
-    let exitCode;
-    process.exit = (code) => {
-      exitCode = code;
-      throw new Error('exit'); // stop the (test-only) function from continuing past exit
-    };
-    console.error = () => {};
-    try {
-      expect(() => assertRenderOutputSizeOk(20000, 20000, 1, '_test')).toThrow();
-    } finally {
-      process.exit = origExit;
-      console.error = origError;
-    }
-    expect(exitCode).toBe(1);
-  });
-
-  test('exits when the requested output exceeds the byte-size guard even under the side cap', () => {
-    const origExit = process.exit;
-    const origError = console.error;
-    let exitCode;
-    process.exit = (code) => {
-      exitCode = code;
-      throw new Error('exit');
-    };
-    console.error = () => {};
-    try {
-      // 15000×15000 stays under the 16000px side cap but blows the ~600MB estimate.
-      expect(() => assertRenderOutputSizeOk(15000, 15000, 1, '_test')).toThrow();
-    } finally {
-      process.exit = origExit;
-      console.error = origError;
-    }
-    expect(exitCode).toBe(1);
-  });
-});