@broberg/lens-daemon 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/lens-daemon",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "The Lens module of the cardmem daemon (flows, critic, coverage, capture sessions, the /lens/* routes and the cardmem-lens MCP) as a package. The daemon mounts createLensRouter(deps) + createLensMcpRouter(deps). Bun runtime.",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,8 @@
     "sharp": "^0.33.5",
     "turndown": "^7.2.4",
     "zod": "^3.23.8",
-    "@broberg/lens-engine": "0.10.2",
-    "@broberg/lens-svg": "0.1.0"
+    "@broberg/lens-svg": "0.1.0",
+    "@broberg/lens-engine": "0.10.2"
   },
   "devDependencies": {
     "@happy-dom/global-registrator": "^20.10.6",

package/src/flow.ts

@@ -1667,7 +1667,7 @@ async function sampleMotion(
 const MOTION_SAMPLE_MS = 250;
 
 
-async function execStep(page: Page, step: FlowStep, base: string, vars: Record<string, unknown>, critic: CriticMode, localPath?: string, sink?: CriticSink, pwSink?: FilledPassword[], readySink?: NotListeningFinding[]): Promise<Buffer | null | { __inspect: string } | { __via: string; __build?: string; __redirect?: string }> {
+async function execStep(page: Page, step: FlowStep, base: string, vars: Record<string, unknown>, critic: CriticMode, localPath?: string, sink?: CriticSink, pwSink?: FilledPassword[], readySink?: NotListeningFinding[], secretRoot?: string): Promise<Buffer | null | { __inspect: string } | { __via: string; __build?: string; __redirect?: string }> {
   switch (step.type) {
     case 'goto': {
       const p = subst(step.path, vars);
@@ -1706,7 +1706,7 @@ async function execStep(page: Page, step: FlowStep, base: string, vars: Record<s
       // used to pass as success, which is the half of the fleet save-rule this
       // instrument could not perform.
       if (step.valueFrom) {
-        await fillSecret(loc, step.valueFrom, localPath, remaining, pwSink, anchorOf(step));
+        await fillSecret(loc, step.valueFrom, secretRoot, remaining, pwSink, anchorOf(step));
         return via ? { __via: via } : null;
       }
       const filledValue = subst(step.value ?? '', vars);
@@ -2207,6 +2207,12 @@ export interface RunFlowOptions {
   /** F213.6 — repo root for resolving an uploadFile step's fixture path. The
    *  path is sandboxed to this dir (no `../` escape). Absent → only data: URIs. */
   localPath?: string;
+  /** F009.121 — the repo root a `fill valueFrom {path}` may read from, ALREADY
+   *  checked against the daemon sandbox by the caller. Absent → only {env} works.
+   *  Kept apart from localPath on purpose: a secret file is typed into whatever
+   *  page the caller named, so an unsandboxed root would let a flow post any file
+   *  the daemon can read to any URL. */
+  secretRoot?: string;
   /** F255.5 — record the whole driven run to a .webm, returned as FlowResult.video.
    *  Off by default: recording costs disk + a little time on every run, and most flows
    *  only need the per-step stills. */
@@ -2468,7 +2474,7 @@ export async function runFlow(flow: Flow, env: AuthEnv, opts: RunFlowOptions = {
       // matter most, and a sink scoped to the try is unreachable from the catch.
       const sink: CriticSink = { critic: null };
       try {
-        const out = await execStep(page, step, base, vars, opts.critic ?? 'off', opts.localPath, sink, filledPasswords, notListening);
+        const out = await execStep(page, step, base, vars, opts.critic ?? 'off', opts.localPath, sink, filledPasswords, notListening, opts.secretRoot);
         const obj = out !== null && !Buffer.isBuffer(out) && typeof out === 'object' ? out : null;
         const inspect = obj && '__inspect' in obj ? (obj as { __inspect: string }).__inspect : null;
         const via = obj && '__via' in obj ? (obj as { __via: string }).__via : null;

package/src/secret-fill.ts

@@ -4,7 +4,7 @@
 // login form with a test account, and the only way before was the plaintext
 // password in the manuscript.
 import { readFile } from 'node:fs/promises';
-import { isAbsolute, join } from 'node:path';
+import { resolve, sep } from 'node:path';
 import type { Locator } from 'playwright';
 import { fillAndVerify } from './fill.ts';
 import type { FilledPassword } from './password-in-url.ts';
@@ -13,7 +13,7 @@ import type { ValueFrom } from './flow.ts';
 /** Read the secret. Every error names WHERE it looked and never WHAT it found. */
 export async function readSecret(
   vf: ValueFrom,
-  localPath: string | undefined,
+  secretRoot: string | undefined,
   env: Record<string, string | undefined> = process.env,
 ): Promise<string> {
   if ('env' in vf) {
@@ -21,15 +21,17 @@ export async function readSecret(
     if (!v) throw new Error(`fill valueFrom: env ${vf.env} is not set in the daemon`);
     return v;
   }
-  let p = vf.path;
-  if (!isAbsolute(p)) {
-    // The F009.22 lesson: a relative path resolved against the daemon's own cwd
-    // reads some other repo's file. Relative means "relative to local_path" or
-    // nothing.
-    if (!localPath) {
-      throw new Error(`fill valueFrom: relative path "${p}" needs local_path — it is never resolved against the daemon's own directory`);
-    }
-    p = join(localPath, p);
+  // The file is typed into whatever page the caller named, so it must live
+  // inside a repo the daemon sandbox allows (secretRoot is checked by the
+  // caller) — never anywhere else the daemon user can read. Same containment
+  // rule as an uploadFile fixture.
+  if (!secretRoot) {
+    throw new Error('fill valueFrom {path} needs local_path inside the daemon sandbox — the secret file must live in that repo (use {env} otherwise)');
+  }
+  const root = resolve(secretRoot);
+  const p = resolve(root, vf.path);
+  if (p !== root && !p.startsWith(root + sep)) {
+    throw new Error(`fill valueFrom: path escapes the repo root: ${vf.path}`);
   }
   let raw: string;
   try {
@@ -50,7 +52,7 @@ export async function readSecret(
 export async function fillSecret(
   loc: Locator,
   vf: ValueFrom,
-  localPath: string | undefined,
+  secretRoot: string | undefined,
   timeout: number,
   pwSink: FilledPassword[] | undefined,
   anchor: string,
@@ -64,7 +66,7 @@ export async function fillSecret(
   if (!isPassword) {
     throw new Error('fill valueFrom only fills a password input (type="password") — any other field would show the secret in every later screenshot');
   }
-  const secret = await readSecret(vf, localPath, env);
+  const secret = await readSecret(vf, secretRoot, env);
   try {
     await fillAndVerify(loc, secret, timeout);
   } catch {

package/src/service.ts

@@ -8,6 +8,7 @@
 // dashboard + cc point <img>/links at the daemon, the same way the rest of
 // the SPA already talks to 127.0.0.1:7475.
 
+import { resolveSandboxedPath } from './sandbox.ts';
 import { randomUUID } from 'node:crypto';
 import sharp from 'sharp';
 import { durabilityOf } from './durability.ts';
@@ -299,6 +300,19 @@ function projectLocale(deps: LensDeps, project: string): { locale?: string; time
   return row?.local_path ? manifestLocale(row.local_path, deps.sandboxRoots) : null;
 }
 
+/** F009.121 — the root a `fill valueFrom {path}` may read under: the caller's
+ *  local_path, but only once the daemon sandbox has accepted it. Outside the
+ *  sandbox (or absent) there is no root, so only {env} works — a secret file is
+ *  typed into a page the caller chose, and must not be any file the daemon can read. */
+export function secretRootOf(localPath: string | undefined, sandboxRoots: string[]): string | undefined {
+  if (!localPath) return undefined;
+  try {
+    return resolveSandboxedPath(localPath, sandboxRoots);
+  } catch {
+    return undefined; // refused by the sandbox; fill reports "needs local_path inside the daemon sandbox"
+  }
+}
+
 export function resolveVerifyAuth(
   deps: LensDeps,
   project: string,
@@ -926,6 +940,7 @@ export async function lensRunFlow(deps: LensDeps, input: RunFlowInput) {
     viewport: coerceViewport(input.viewport, input.device),
     critic: input.critic,
     localPath: input.local_path, // F213.6 — sandbox root for uploadFile fixture paths
+    secretRoot: secretRootOf(input.local_path, deps.sandboxRoots), // F009.121
     record: input.record === true, // F255.5 — opt-in .webm of the whole run
     storage: coerceStorageSeed(input.storage), // F074.97 — seed saved client state
   });
@@ -988,6 +1003,7 @@ export async function lensRunManuscript(deps: LensDeps, input: RunManuscriptInpu
     reducedMotion: input.reduced_motion,
     viewport: coerceViewport(input.viewport, input.device), // F252.2 — mobile-only UI E2E in manuscripts
     localPath: input.local_path, // F213.6 — uploadFile fixture root
+    secretRoot: secretRootOf(input.local_path, deps.sandboxRoots), // F009.121
     record: input.record === true, // F255.5 — opt-in .webm of the whole run
     storage: coerceStorageSeed(input.storage), // F074.97 — seed saved client state
   });