@animalabs/agent-framework 0.18.0 → 0.20.0

package/dist/test/mcpl-child-env.test.js

@@ -0,0 +1,69 @@
+/**
+ * Stdio MCPL children must not inherit the host's secrets. They get a small
+ * operating allowlist (PATH, HOME, LC_*, ...) plus their declared `env`;
+ * `inheritEnv: true` restores full inheritance.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildChildEnv, StdioTransport } from '../src/mcpl/transport.js';
+const HOST_ENV = {
+    PATH: '/usr/bin:/bin',
+    HOME: '/home/resident',
+    LANG: 'en_US.UTF-8',
+    LC_CTYPE: 'UTF-8',
+    TMPDIR: '/tmp/x',
+    ANTHROPIC_AUTH_TOKEN: 'host-anthropic-secret',
+    DISCORD_TOKEN: 'host-discord-secret',
+    OPENAI_API_KEY: 'host-openai-secret',
+};
+test('drops host secrets, keeps operating vars and LC_*', () => {
+    const env = buildChildEnv({}, HOST_ENV);
+    assert.deepEqual(env, {
+        PATH: '/usr/bin:/bin',
+        HOME: '/home/resident',
+        LANG: 'en_US.UTF-8',
+        LC_CTYPE: 'UTF-8',
+        TMPDIR: '/tmp/x',
+    });
+});
+test('declared env is passed through and wins over allowlisted host vars', () => {
+    const env = buildChildEnv({ env: { DISCORD_TOKEN: 'declared-token', PATH: '/opt/bin' } }, HOST_ENV);
+    assert.equal(env.DISCORD_TOKEN, 'declared-token');
+    assert.equal(env.PATH, '/opt/bin');
+    assert.equal(env.HOME, '/home/resident');
+    assert.equal(env.ANTHROPIC_AUTH_TOKEN, undefined);
+    assert.equal(env.OPENAI_API_KEY, undefined);
+});
+test('inheritEnv: true passes the whole host env, declared env on top', () => {
+    const env = buildChildEnv({ inheritEnv: true, env: { EXTRA: '1' } }, HOST_ENV);
+    assert.equal(env.ANTHROPIC_AUTH_TOKEN, 'host-anthropic-secret');
+    assert.equal(env.EXTRA, '1');
+});
+test('a real spawned stdio child sees only allowlist + declared env', async () => {
+    const secretKey = 'MCPL_ENV_TEST_HOST_SECRET';
+    process.env[secretKey] = 'must-not-leak';
+    try {
+        const transport = StdioTransport.spawn({
+            id: 'env-probe',
+            command: process.execPath,
+            args: ['-e', 'console.log(JSON.stringify(process.env))'],
+            env: { DECLARED_VAR: 'declared-value' },
+        });
+        const line = await new Promise((resolve, reject) => {
+            transport.once('line', resolve);
+            transport.once('error', reject);
+        });
+        await transport.close();
+        const childEnv = JSON.parse(line);
+        assert.equal(childEnv[secretKey], undefined);
+        assert.equal(childEnv.DECLARED_VAR, 'declared-value');
+        if (process.env.PATH)
+            assert.equal(childEnv.PATH, process.env.PATH);
+        if (process.env.HOME)
+            assert.equal(childEnv.HOME, process.env.HOME);
+    }
+    finally {
+        delete process.env[secretKey];
+    }
+});
+//# sourceMappingURL=mcpl-child-env.test.js.map

package/dist/test/mcpl-child-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpl-child-env.test.js","sourceRoot":"","sources":["../../test/mcpl-child-env.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,QAAQ,GAAG;IACf,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,uBAAuB;IAC7C,aAAa,EAAE,qBAAqB;IACpC,cAAc,EAAE,oBAAoB;CACrC,CAAC;AAEF,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;QACpB,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,GAAG,GAAG,aAAa,CACvB,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAC9D,QAAQ,CACT,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,eAAe,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC;YACrC,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,IAAI,EAAE,CAAC,IAAI,EAAE,0CAA0C,CAAC;YACxD,GAAG,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/test/mcpl-coalescing.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcpl-coalescing.test.d.ts.map

package/dist/test/mcpl-coalescing.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpl-coalescing.test.d.ts","sourceRoot":"","sources":["../../test/mcpl-coalescing.test.ts"],"names":[],"mappings":""}