@agentconnect.md/daemon 1.41.0-rc.35 → 1.41.0-rc.36

package/dist/shim/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { accessSync, constants, readFileSync, statSync } from "node:fs";
-import { spawn } from "node:child_process";
-import { delimiter, isAbsolute, join, resolve } from "node:path";
+import { accessSync, chmodSync, constants, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { execFile, spawn } from "node:child_process";
+import { delimiter, dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -8562,6 +8562,279 @@ var ShimClient = class {
 	}
 };
 //#endregion
+//#region src/shim/file-sink.ts
+/** Relative path segments, rejecting anything that could escape the root. */
+const SinkRelPathSchema = array(string().min(1).max(255)).min(1).max(8).refine((segments) => segments.every((segment) => segment !== "." && segment !== ".." && !segment.includes("/") && !segment.includes("\\")), { message: "path segments must be plain names" });
+const FileSinkPayloadSchema = discriminatedUnion("op", [object({
+	op: literal("write"),
+	root: string().min(1),
+	relPath: SinkRelPathSchema,
+	content: string()
+}), object({
+	op: literal("clear"),
+	root: string().min(1)
+})]);
+/** Resolve a sink path and refuse anything that leaves the root, whichever side runs it. */
+function resolveSinkPath(root, relPath) {
+	if (!isAbsolute(root)) throw new Error(`sink root must be absolute: ${root}`);
+	const base = resolve(root);
+	const target = normalize(join(base, ...relPath));
+	if (target !== base && !target.startsWith(base + sep)) throw new Error("sink path escapes its root");
+	return target;
+}
+function mkdirPrivate(dir) {
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(dir, 448);
+	} catch {}
+}
+/** Today's behaviour: write the daemon's own disk. */
+var LocalFileSink = class {
+	async clear(root) {
+		const dir = resolve(root);
+		try {
+			for (const entry of readdirSync(dir)) rmSync(join(dir, entry), {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			if (err.code === "ENOENT") return void 0;
+			return `config files could not be cleared (${err.message})`;
+		}
+	}
+	async write(root, relPath, content) {
+		const file = resolveSinkPath(root, relPath);
+		const dir = resolve(root);
+		if (dirname(file) !== dir) mkdirPrivate(dirname(file));
+		else mkdirPrivate(dir);
+		writeFileSync(file, content, { mode: 384 });
+		try {
+			chmodSync(file, 384);
+		} catch {}
+	}
+};
+/**
+* Apply a sink operation inside the sandbox. The shim re-validates the path itself rather
+* than trusting that the daemon already did: a check on the other side of a channel is not
+* a check on this side, and the shim is the half that touches the filesystem.
+*/
+async function applyFileSinkPayload(payload, sink = new LocalFileSink()) {
+	const parsed = FileSinkPayloadSchema.parse(payload);
+	if (parsed.op === "clear") {
+		const error = await sink.clear(parsed.root);
+		if (error) throw new Error(error);
+		return;
+	}
+	resolveSinkPath(parsed.root, parsed.relPath);
+	await sink.write(parsed.root, parsed.relPath, parsed.content);
+}
+//#endregion
+//#region src/shim/git-exec.ts
+/**
+* The `exec` payload for a git invocation inside the sandbox.
+*
+* argv only, never a composed shell string: the arguments are assembled from workspace
+* configuration that a repository can influence, and a shell would turn that into an
+* injection surface. `cwd` is validated on the shim side too — a daemon-side check says
+* nothing about the filesystem the shim is standing on.
+*/
+const GitExecPayloadSchema = object({
+	tool: literal("git"),
+	cwd: string().min(1).optional(),
+	args: array(string()).min(1).max(64),
+	/** How long the caller will wait, so the sandbox kills the child before the request is
+	*  abandoned — otherwise a slow git keeps running (and keeps index.lock) past the point
+	*  anything is listening for its result. Bounded again on the shim side. */
+	timeoutMs: number().int().min(1e3).max(9e5).optional(),
+	/** The COMPLETE environment for this invocation, replacing rather than extending whatever
+	*  the sandbox has. Callers build it by sanitizing (stripping host GIT_CONFIG_*, protocol
+	*  allowances and so on), so merging would defeat that; the shim must apply it as given.
+	*  Scoped to the request, so a runtime cannot read the credential pointers back out of its
+	*  own process environment afterwards. */
+	env: record(string(), string()).optional()
+});
+object({
+	code: number().int(),
+	stdout: string(),
+	stderr: string()
+});
+//#endregion
+//#region src/shim/exec-handler.ts
+/**
+* The git subcommands a sandbox will run, enforced HERE.
+*
+* The daemon declares a closed inventory, but a declaration on the sending side is not a
+* control: this process is the one that spawns git, so this is where the list has to be
+* checked. Anything else and a compromised daemon — or a bug in one — reaches arbitrary git,
+* which through `-c`, hooks and `--upload-pack` reaches arbitrary execution.
+*/
+const ALLOWED_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
+	"check-ref-format",
+	"clean",
+	"clone",
+	"config",
+	"diff",
+	"fetch",
+	"log",
+	"pull",
+	"remote",
+	"reset",
+	"rev-list",
+	"rev-parse",
+	"status",
+	"update-ref",
+	"worktree"
+]);
+/**
+* Argument forms refused regardless of subcommand: each turns a git invocation into an
+* arbitrary-execution primitive, so no member of the inventory above may carry one.
+*
+* Matched as PREFIXES, never as exact tokens. Every one of these has at least three accepted
+* spellings — separated (`-c k=v`), attached (`-ck=v`) and long-with-equals (`--config=k=v`) —
+* all measured against git 2.43, and an exact-token list catches only the first. `-c` in
+* particular is not just a global option: `git clone -c` is clone's OWN option, which is how
+* `-cprotocol.ext.allow=always ext::<helper>` reaches a helper the caller names.
+*
+* No argv the daemon sends starts with `-c` or `--config` (`--count` does not match `/^-c/`,
+* whose second character is `c`), so the width costs nothing real.
+*/
+const REFUSED_ARGUMENT = [
+	/^-c/,
+	/^--config/,
+	/^--exec-path/,
+	/^--upload-pack/,
+	/^--receive-pack/
+];
+/**
+* Options that reach execution for ONE subcommand, where the same spelling is ordinary
+* elsewhere — so the check has to be subcommand-aware rather than a blanket ban.
+*
+* `git clone -u <program>` is `--upload-pack` and runs the program, attached spelling included
+* (`-u<program>`); measured, not assumed. Meanwhile `status -u` is `--untracked-files` and
+* `fetch -u` is `--update-head-ok`, and the daemon sends both — a blanket `-u` refusal would
+* break every status call. `git config -e` opens `GIT_EDITOR`, also measured, and no call site
+* edits config.
+*/
+const REFUSED_SUBCOMMAND_ARGUMENT = {
+	clone: [/^-u/],
+	config: [/^-e$/, /^--edit/]
+};
+/**
+* Per-stream raw ceiling — a cheap first bound, NOT the authoritative one.
+*
+* The result travels as ONE shim frame, and `MAX_FRAME_BYTES` is 256 KiB, so a 32 MiB buffer did
+* not mean "large results are allowed": it meant a large result was assembled and then dropped
+* by the transport, taking the channel with it.
+*/
+const MAX_STREAM_BYTES = 64 * 1024;
+const MAX_RESPONSE_BYTES = MAX_FRAME_BYTES - 4 * 1024;
+/** Shell convention for a signalled child, so a killed git is never mistaken for exit 0. */
+const SIGNAL_EXIT_BASE = 128;
+const SIGNAL_NUMBERS = {
+	SIGTERM: 15,
+	SIGKILL: 9,
+	SIGINT: 2,
+	SIGHUP: 1
+};
+/** Applied when the caller names no deadline; the ceiling bounds one that is too generous. */
+const DEFAULT_TIMEOUT_MS = 12e4;
+const MAX_TIMEOUT_MS = 15 * 6e4;
+var ExecRefusedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExecRefusedError";
+	}
+};
+/** Resolve symlinks before comparing: a lexical prefix check passes for `<root>/link` even when
+*  the link points outside, so containment has to be decided on canonical paths. */
+function canonical(path) {
+	try {
+		return realpathSync(normalize(resolve(path)));
+	} catch {
+		throw new ExecRefusedError(`cwd does not resolve: ${path}`);
+	}
+}
+/** Refuse a cwd that escapes the workspace root, whatever the daemon asked for. */
+function resolveCwd(root, requested) {
+	const base = canonical(root);
+	if (!requested) return base;
+	if (!isAbsolute(requested)) throw new ExecRefusedError("cwd must be absolute");
+	const target = canonical(requested);
+	if (target !== base && !target.startsWith(base + sep)) throw new ExecRefusedError("cwd escapes the workspace root");
+	return target;
+}
+/**
+* Serve the shim's non-ACP capabilities inside the sandbox.
+*
+* Every check here duplicates one the daemon already made, deliberately. The daemon is the
+* trusted half and this is the half holding the filesystem: a check that only runs on the far
+* side of a channel protects nothing on this side.
+*/
+function createExecHandler(deps) {
+	return async (capability, payload) => {
+		if (capability === "materialize") {
+			await applyFileSinkPayload(payload);
+			return null;
+		}
+		if (capability === "exec") return runGit(payload, deps);
+		throw new ExecRefusedError(`capability ${capability} is not served by this handler`);
+	};
+}
+async function runGit(payload, deps) {
+	const parsed = GitExecPayloadSchema.parse(payload);
+	const [subcommand, ...rest] = parsed.args;
+	if (!subcommand || !ALLOWED_GIT_SUBCOMMANDS.has(subcommand)) throw new ExecRefusedError(`git ${subcommand ?? "(none)"} is not in the permitted inventory`);
+	const perSubcommand = REFUSED_SUBCOMMAND_ARGUMENT[subcommand] ?? [];
+	for (const argument of parsed.args) if (REFUSED_ARGUMENT.some((pattern) => pattern.test(argument))) throw new ExecRefusedError(`argument ${argument} is refused`);
+	for (const argument of rest) if (perSubcommand.some((pattern) => pattern.test(argument))) throw new ExecRefusedError(`argument ${argument} is refused for git ${subcommand}`);
+	const cwd = resolveCwd(deps.workspaceRoot, parsed.cwd);
+	const timeoutMs = Math.min(parsed.timeoutMs ?? DEFAULT_TIMEOUT_MS, deps.timeoutMs ?? MAX_TIMEOUT_MS);
+	return await new Promise((resolvePromise, reject) => {
+		execFile("git", parsed.args, {
+			cwd,
+			...parsed.env ? { env: parsed.env } : {},
+			timeout: timeoutMs,
+			killSignal: "SIGTERM",
+			maxBuffer: MAX_STREAM_BYTES
+		}, (error, stdout, stderr) => {
+			const failure = error;
+			if (failure?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+				reject(new ExecRefusedError(`git ${subcommand} produced more than ${MAX_STREAM_BYTES} bytes on one stream, which does not fit a shim frame`));
+				return;
+			}
+			const deliver = (result) => {
+				const serialized = Buffer.byteLength(JSON.stringify(result), "utf8");
+				if (serialized > MAX_RESPONSE_BYTES) {
+					reject(new ExecRefusedError(`git ${subcommand} result is ${serialized} bytes once encoded, over the ${MAX_RESPONSE_BYTES} a shim frame can carry`));
+					return;
+				}
+				resolvePromise(result);
+			};
+			if (failure && (failure.killed === true || typeof failure.signal === "string")) {
+				const signal = failure.signal ?? "";
+				deliver({
+					code: SIGNAL_EXIT_BASE + (SIGNAL_NUMBERS[signal] ?? 0),
+					stdout: String(stdout),
+					stderr: `${String(stderr)}\ngit ${subcommand} was terminated${signal ? ` by ${signal}` : ""} after ${timeoutMs}ms`
+				});
+				return;
+			}
+			if (failure && typeof failure.code === "string") {
+				reject(new ExecRefusedError(`git could not be run: ${failure.message}`));
+				return;
+			}
+			deliver({
+				code: typeof failure?.code === "number" ? failure.code : 0,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+//#endregion
 //#region src/shim/path-resolve.ts
 /**
 * Resolve a command in THIS filesystem, which inside a sandbox is the only one that counts.
@@ -8609,6 +8882,10 @@ async function main() {
 			path: opts.path
 		}),
 		resolveCommand: resolveCommandInPath,
+		handle: createExecHandler({
+			workspaceRoot: process.env["AC_SHIM_WORKSPACE_ROOT"] ?? "/agent",
+			log
+		}),
 		log
 	});
 	for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => {