@appsforgood/agent-kit-runtime 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @appsforgood/agent-kit-runtime
 
+## 0.1.3
+
+### Patch Changes
+
+- Canonicalize Windows paths with the native filesystem resolver before enforcing instruction, tool, and worktree containment.
+
+## 0.1.2
+
+### Patch Changes
+
+- Verify Git top-level roots through repository context so Windows long and short temp-path forms do not reject valid runtime worktrees.
+
 ## 0.1.1
 
 ### Patch Changes

package/dist/index.js

@@ -1324,9 +1324,51 @@ var ModelRouter = class {
 };
 
 // src/roster.ts
-import { readFileSync as readFileSync3, realpathSync } from "fs";
-import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join3, resolve as resolve3 } from "path";
 import { z as z4 } from "zod";
+
+// src/security/paths.ts
+import { realpathSync } from "fs";
+import { resolve as resolve2 } from "path";
+function isSensitiveRelativePath(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "");
+  const segments = normalized.split("/").filter(Boolean);
+  const lower = segments.map((segment) => segment.toLowerCase());
+  const basename2 = lower.at(-1) ?? "";
+  if (lower.includes(".git")) return true;
+  if (lower[0] === ".agent-kit" && lower[1] === "runtime" && basename2 !== ".gitignore") return true;
+  if (basename2 === ".npmrc" || basename2 === ".pypirc" || basename2 === ".netrc") return true;
+  if (["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"].includes(basename2)) return true;
+  if (/\.(?:pem|key|p12|pfx)$/.test(basename2)) return true;
+  if (basename2 === ".env" || basename2.startsWith(".env.")) {
+    return !/\.(?:example|sample|template)$/.test(basename2);
+  }
+  return false;
+}
+function pathIdentity(value, caseInsensitive = process.platform === "win32") {
+  const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "") || "/";
+  return caseInsensitive ? normalized.toLowerCase() : normalized;
+}
+function canonicalPath(value) {
+  return realpathSync.native(resolve2(value));
+}
+function pathsEqual(left, right, caseInsensitive = process.platform === "win32") {
+  return pathIdentity(left, caseInsensitive) === pathIdentity(right, caseInsensitive);
+}
+function isPathWithin(root, candidate, caseInsensitive = process.platform === "win32") {
+  const rootIdentity = pathIdentity(root, caseInsensitive);
+  const candidateIdentity = pathIdentity(candidate, caseInsensitive);
+  const prefix = rootIdentity.endsWith("/") ? rootIdentity : `${rootIdentity}/`;
+  return candidateIdentity === rootIdentity || candidateIdentity.startsWith(prefix);
+}
+function assertSafeToolPath(value) {
+  const segments = value.replace(/\\/g, "/").split("/");
+  if (segments.includes("..")) throw new Error(`Path traversal is not available to runtime tools: ${value}`);
+  if (isSensitiveRelativePath(value)) throw new Error(`Sensitive path is not available to runtime tools: ${value}`);
+}
+
+// src/roster.ts
 var AgentContract = z4.object({
   id: z4.string().min(1),
   name: z4.string().optional(),
@@ -1416,11 +1458,12 @@ function validateWorkflowBounds(workflow, config) {
 }
 function readAgentInstructions(cwd, agent) {
   if (!agent.file) return `${agent.name ?? agent.id}. Skills: ${agent.skills.join(", ")}.`;
-  if (resolve2(agent.file) === agent.file) throw new Error(`Agent instruction paths must be relative: ${agent.file}`);
-  const root = realpathSync(resolve2(cwd));
-  const candidate = resolve2(root, agent.file);
-  const parent = realpathSync(dirname2(candidate));
-  if (parent !== root && !parent.startsWith(`${root}/`)) throw new Error(`Agent instruction path escapes the project: ${agent.file}`);
+  if (resolve3(agent.file) === agent.file) throw new Error(`Agent instruction paths must be relative: ${agent.file}`);
+  const root = canonicalPath(cwd);
+  const candidate = resolve3(root, agent.file);
+  if (!isPathWithin(root, candidate)) throw new Error(`Agent instruction path escapes the project: ${agent.file}`);
+  const parent = canonicalPath(dirname2(candidate));
+  if (!isPathWithin(root, parent)) throw new Error(`Agent instruction path escapes the project: ${agent.file}`);
   return readFileSync3(candidate, "utf8").slice(0, 2e5);
 }
 
@@ -1577,45 +1620,8 @@ var DockerSandbox = class {
 
 // src/tools.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, isAbsolute, join as join4, relative, resolve as resolve3 } from "path";
-
-// src/security/paths.ts
-function isSensitiveRelativePath(value) {
-  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "");
-  const segments = normalized.split("/").filter(Boolean);
-  const lower = segments.map((segment) => segment.toLowerCase());
-  const basename2 = lower.at(-1) ?? "";
-  if (lower.includes(".git")) return true;
-  if (lower[0] === ".agent-kit" && lower[1] === "runtime" && basename2 !== ".gitignore") return true;
-  if (basename2 === ".npmrc" || basename2 === ".pypirc" || basename2 === ".netrc") return true;
-  if (["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"].includes(basename2)) return true;
-  if (/\.(?:pem|key|p12|pfx)$/.test(basename2)) return true;
-  if (basename2 === ".env" || basename2.startsWith(".env.")) {
-    return !/\.(?:example|sample|template)$/.test(basename2);
-  }
-  return false;
-}
-function pathIdentity(value, caseInsensitive = process.platform === "win32") {
-  const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "") || "/";
-  return caseInsensitive ? normalized.toLowerCase() : normalized;
-}
-function pathsEqual(left, right, caseInsensitive = process.platform === "win32") {
-  return pathIdentity(left, caseInsensitive) === pathIdentity(right, caseInsensitive);
-}
-function isPathWithin(root, candidate, caseInsensitive = process.platform === "win32") {
-  const rootIdentity = pathIdentity(root, caseInsensitive);
-  const candidateIdentity = pathIdentity(candidate, caseInsensitive);
-  const prefix = rootIdentity.endsWith("/") ? rootIdentity : `${rootIdentity}/`;
-  return candidateIdentity === rootIdentity || candidateIdentity.startsWith(prefix);
-}
-function assertSafeToolPath(value) {
-  const segments = value.replace(/\\/g, "/").split("/");
-  if (segments.includes("..")) throw new Error(`Path traversal is not available to runtime tools: ${value}`);
-  if (isSensitiveRelativePath(value)) throw new Error(`Sensitive path is not available to runtime tools: ${value}`);
-}
-
-// src/tools.ts
+import { existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync as readdirSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, isAbsolute, join as join4, relative, resolve as resolve4 } from "path";
 var READ_TOOLS = [
   {
     name: "read_file",
@@ -1779,13 +1785,13 @@ ${result.stderr}` : ""}`.trim(),
   }
 };
 function safeRoot(root) {
-  return realpathSync2(resolve3(root));
+  return canonicalPath(root);
 }
 function safeExistingPath(root, requested) {
   if (!requested || isAbsolute(requested)) throw new Error("Tool paths must be non-empty and relative.");
   assertSafeToolPath(requested);
   const rootPath = safeRoot(root);
-  const candidate = realpathSync2(resolve3(rootPath, requested));
+  const candidate = canonicalPath(resolve4(rootPath, requested));
   if (!isPathWithin(rootPath, candidate)) throw new Error(`Path escapes the worktree: ${requested}`);
   return candidate;
 }
@@ -1793,11 +1799,11 @@ function safeNewPath(root, requested) {
   if (!requested || isAbsolute(requested)) throw new Error("Tool paths must be non-empty and relative.");
   assertSafeToolPath(requested);
   const rootPath = safeRoot(root);
-  const candidate = resolve3(rootPath, requested);
+  const candidate = resolve4(rootPath, requested);
   if (!isPathWithin(rootPath, candidate)) throw new Error(`Path escapes the worktree: ${requested}`);
   let parent = dirname3(candidate);
   while (!existsSync2(parent) && !pathsEqual(parent, rootPath)) parent = dirname3(parent);
-  const realParent = realpathSync2(parent);
+  const realParent = canonicalPath(parent);
   if (!isPathWithin(rootPath, realParent)) throw new Error(`Path parent escapes the worktree: ${requested}`);
   return candidate;
 }
@@ -2032,9 +2038,9 @@ function compileCouncilGraph(dependencies) {
 
 // src/worktree.ts
 import { execFile } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, realpathSync as realpathSync3, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync3 } from "fs";
 import { homedir, platform } from "os";
-import { basename, join as join5, resolve as resolve4 } from "path";
+import { basename, join as join5 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 function cacheRoot() {
@@ -2055,11 +2061,12 @@ async function git(cwd, args) {
 var WorktreeManager = class {
   sourceRoot;
   constructor(sourceRoot) {
-    this.sourceRoot = realpathSync3(resolve4(sourceRoot));
+    this.sourceRoot = canonicalPath(sourceRoot);
   }
   async inspect() {
     const root = await git(this.sourceRoot, ["rev-parse", "--show-toplevel"]);
-    if (!pathsEqual(realpathSync3(root), this.sourceRoot)) throw new Error(`Runtime source root must be the Git repository root: ${root}`);
+    const prefix = await git(this.sourceRoot, ["rev-parse", "--show-prefix"]);
+    if (prefix) throw new Error(`Runtime source root must be the Git repository root: ${root}`);
     const baseCommit = await git(this.sourceRoot, ["rev-parse", "HEAD"]);
     const status = await git(this.sourceRoot, ["status", "--porcelain=v1", "--untracked-files=all"]);
     const tracked = await git(this.sourceRoot, ["ls-files"]);