@akira-tl/forgerelay 0.2.0 → 0.2.2

package/docs/security.md

@@ -17,8 +17,16 @@ Example:
 Do not use your entire home directory unless that is intentionally the access
 boundary you want.
 
-Filesystem-oriented tools validate workspace-relative paths and reject paths
-that escape the opened workspace or configured roots.
+Opening a workspace still requires the path to be inside the configured allowed
+roots. File and search tools additionally accept paths inside the operating
+system temporary directory (for example `/tmp` on Linux) without treating that
+directory as an allowed workspace root. Workspace paths remain confined to the
+opened workspace, and shell working directories are not expanded by this temp
+access.
+
+Filesystem-oriented tools canonicalize existing path segments before access so
+symlinks inside either the workspace or OS temp directory cannot escape to
+arbitrary filesystem locations.
 
 ## Owner-password OAuth
 
@@ -137,15 +145,18 @@ as owner-only files. See [Native File Download](artifact-exchange.md).
 
 ## Logging
 
-ForgeRelay logs requests/tool calls by default. Shell command previews are off
-unless explicitly enabled:
+ForgeRelay's default human-facing `pretty` logs focus on tool and Hook
+operations; HTTP request records are off by default. Pretty mode includes a
+truncated shell command preview so local operators can see what the Agent ran.
+Command arguments can contain secrets, so disable previews when necessary:
 
 ```bash
-FORGERELAY_LOG_SHELL_COMMANDS=1
+FORGERELAY_LOG_SHELL_COMMANDS=0
 ```
 
-Command arguments can contain secrets, so only enable command-preview logging
-when necessary.
+Explicit `json` mode is intended for machine collection. Its default preserves
+HTTP request records and omits shell command previews unless those settings are
+overridden explicitly.
 
 ## Package provenance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -41,7 +41,7 @@
     "debug:accept": "node scripts/debug/accept.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "tsx src/config.test.ts && tsx src/hooks.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/request-meta.test.ts && tsx src/incoming-artifacts.test.ts && tsx src/artifact-download.test.ts && tsx src/ui/card-types.test.ts && tsx src/ui/patch-display.test.ts && tsx src/ui/tool-display.test.ts && tsx src/apply-patch.test.ts && tsx src/process-platform.test.ts && tsx src/process-sessions.test.ts && tsx src/mcp-sessions.test.ts && tsx src/server-shutdown.test.ts && tsx src/local-agent-runtime.test.ts && tsx src/local-agent-adapters.test.ts && tsx src/local-agent-availability.test.ts && tsx src/local-agent-profiles.test.ts && tsx src/local-agent-targets.test.ts && tsx src/local-agent-store.test.ts && tsx src/roots.test.ts && tsx src/skills.test.ts && tsx src/workspaces.test.ts && tsx src/workspace-conversation.test.ts && tsx src/review-checkpoints.test.ts && tsx src/server.test.ts && tsx src/oauth-store.test.ts && tsx src/cli.test.ts",
+    "test": "tsx src/config.test.ts && tsx src/logger.test.ts && tsx src/hooks.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/request-meta.test.ts && tsx src/incoming-artifacts.test.ts && tsx src/artifact-download.test.ts && tsx src/ui/card-types.test.ts && tsx src/ui/patch-display.test.ts && tsx src/ui/tool-display.test.ts && tsx src/apply-patch.test.ts && tsx src/process-platform.test.ts && tsx src/process-sessions.test.ts && tsx src/mcp-sessions.test.ts && tsx src/server-shutdown.test.ts && tsx src/local-agent-runtime.test.ts && tsx src/local-agent-adapters.test.ts && tsx src/local-agent-availability.test.ts && tsx src/local-agent-profiles.test.ts && tsx src/local-agent-targets.test.ts && tsx src/local-agent-store.test.ts && tsx src/roots.test.ts && tsx src/file-mutations.test.ts && tsx src/skills.test.ts && tsx src/workspaces.test.ts && tsx src/workspace-conversation.test.ts && tsx src/review-checkpoints.test.ts && tsx src/server.test.ts && tsx src/oauth-store.test.ts && tsx src/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",

package/scripts/debug/accept.mjs

@@ -10,6 +10,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import {
@@ -30,6 +31,7 @@ const gitProject = resolve(acceptanceRoot, "git-project");
 const releaseProject = resolve(acceptanceRoot, "release-project");
 const releaseRemote = resolve(acceptanceRoot, "release-remote.git");
 const ownerToken = randomBytes(32).toString("base64url");
+const tempAcceptanceRoot = resolve(tmpdir(), `forgerelay-debug-acceptance-${randomUUID()}`);
 
 assertCurlAvailable();
 await assertDebugPortFree();
@@ -101,7 +103,7 @@ try {
     params: {},
   }).message.result.tools;
   const toolNames = tools.map((tool) => tool.name);
-  for (const expected of ["open_workspace", "close_worktree", "read", "write", "edit", "grep", "glob", "ls", "bash"]) {
+  for (const expected of ["open_workspace", "close_worktree", "read", "write", "edit", "rename", "delete", "grep", "glob", "ls", "bash"]) {
     assert.ok(toolNames.includes(expected), `missing debug tool ${expected}`);
   }
   pass("MCP tools/list", `${toolNames.length} tools: ${toolNames.join(", ")}`);
@@ -144,6 +146,67 @@ try {
   assert.equal(failedEdit.isError, true);
   pass("failed tool path", "edit returned isError=true and triggered AfterToolFailure");
 
+  const renamedWorkspaceFile = callTool(oauth.accessToken, sessionId, 74, "rename", {
+    workspaceId,
+    path: "acceptance.txt",
+    newPath: "renamed-acceptance.txt",
+  });
+  assert.equal(renamedWorkspaceFile.isError, undefined);
+  assert.equal(readFileSync(join(checkoutWorkspace, "renamed-acceptance.txt"), "utf8"), "forgerelay 7677 acceptance\n");
+  const deletedWorkspaceFile = callTool(oauth.accessToken, sessionId, 75, "delete", {
+    workspaceId,
+    path: "renamed-acceptance.txt",
+  });
+  assert.equal(deletedWorkspaceFile.isError, undefined);
+  assert.equal(existsSync(join(checkoutWorkspace, "renamed-acceptance.txt")), false);
+  pass("rename + delete", "workspace file renamed and deleted through MCP");
+
+  mkdirSync(tempAcceptanceRoot, { recursive: true });
+  const tempFile = join(tempAcceptanceRoot, "mcp-temp.txt");
+  const tempWritten = callTool(oauth.accessToken, sessionId, 70, "write", {
+    workspaceId,
+    path: tempFile,
+    content: "forgerelay temp before edit\n",
+  });
+  assert.equal(tempWritten.isError, undefined);
+
+  const tempRead = callTool(oauth.accessToken, sessionId, 71, "read", {
+    workspaceId,
+    path: tempFile,
+  });
+  assert.match(tempRead.structuredContent.result, /forgerelay temp before edit/);
+
+  const tempEdited = callTool(oauth.accessToken, sessionId, 72, "edit", {
+    workspaceId,
+    path: tempFile,
+    edits: [{ oldText: "before edit", newText: "after edit" }],
+  });
+  assert.equal(tempEdited.isError, undefined);
+  assert.equal(readFileSync(tempFile, "utf8"), "forgerelay temp after edit\n");
+
+  const renamedTempFile = join(tempAcceptanceRoot, "mcp-temp-renamed.txt");
+  const tempRenamed = callTool(oauth.accessToken, sessionId, 76, "rename", {
+    workspaceId,
+    path: tempFile,
+    newPath: renamedTempFile,
+  });
+  assert.equal(tempRenamed.isError, undefined);
+  assert.equal(readFileSync(renamedTempFile, "utf8"), "forgerelay temp after edit\n");
+  const tempDeleted = callTool(oauth.accessToken, sessionId, 77, "delete", {
+    workspaceId,
+    path: renamedTempFile,
+  });
+  assert.equal(tempDeleted.isError, undefined);
+  assert.equal(existsSync(renamedTempFile), false);
+
+  const outsideRoots = callTool(oauth.accessToken, sessionId, 73, "read", {
+    workspaceId,
+    path: join(homedir(), "forgerelay-debug-outside-roots.txt"),
+  });
+  assert.equal(outsideRoots.isError, true);
+  assert.match(toolText(outsideRoots), /outside allowed roots/i);
+  pass("OS temp file tools", "write + read + edit + rename + delete passed; arbitrary home path rejected");
+
   setupGitProject(gitProject);
   const worktreeOpened = callTool(oauth.accessToken, sessionId, 8, "open_workspace", {
     path: gitProject,
@@ -211,6 +274,7 @@ try {
   console.error("\nForgeRelay 7677 acceptance failed.");
   throw error;
 } finally {
+  rmSync(tempAcceptanceRoot, { recursive: true, force: true });
   await stopServer(server);
 }