@cortexkit/claustrum-client 0.6.0 → 0.6.2

package/README.md

@@ -23,6 +23,11 @@ credential caching, refresh, account scheduling, and retry policy.
   as a version older than every real one.
 • Unknown server error classes are bounded to `transient`; callers must retry them
   rather than treating a forward-compatible class as permanent.
+• `listScoped` rows always carry `providerIds` (a required field since 0.6.0, so code
+  that builds rows by hand, such as test fixtures, must set it). An empty array means
+  no provider ids are set. Since 0.6.2 a daemon too old to send the field decodes the
+  same way, so a newer client still lists against an older daemon. `authMethod` stays
+  optional.
 
 The client sends `consumerIdentity: null` for every managed request so inherited
 `SUBC_MODULE_ID` and `SUBC_LAUNCH_NONCE` cannot impersonate a supervising host.

package/dist/ancestor-permissions.d.ts

@@ -0,0 +1,20 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export type AncestorIdentity = {
+    euid: number | undefined;
+    egid: number | undefined;
+    passwdPath: string;
+    groupPath: string;
+};
+export declare const ancestorIdentityContext: AsyncLocalStorage<AncestorIdentity>;
+/**
+ * Debian OpenSSH's user-group-modes rule: ancestors without group/world-write, or with sticky, are safe.
+ * Without sticky, group-write requires effective uid/gid ownership and local passwd/group
+ * files proving the group contains only this user, with no other primary-group users.
+ * World-write never qualifies; anything the local account files cannot prove refuses.
+ * The twin accepts_ancestor in opencode_files.rs must keep the identical permission rule.
+ */
+export declare function acceptsAncestor(metadata: {
+    mode: number;
+    uid?: number;
+    gid?: number;
+}, identity?: AncestorIdentity): Promise<boolean>;

package/dist/ancestor-permissions.js

@@ -0,0 +1,44 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { readFile } from 'node:fs/promises';
+export const ancestorIdentityContext = new AsyncLocalStorage();
+function records(source, count) {
+    return source.split('\n').filter((line) => line.trim() !== '' && !line.trimStart().startsWith('#')).map((line) => {
+        const fields = line.split(':');
+        if (fields.length !== count || !fields[0] || /\s/.test(fields[0]) || !/^\d+$/.test(fields[2]) || !Number.isSafeInteger(Number(fields[2])) || Number(fields[2]) > 0xffffffff || (count === 7 && (!/^\d+$/.test(fields[3]) || !Number.isSafeInteger(Number(fields[3])) || Number(fields[3]) > 0xffffffff))) {
+            throw new Error('malformed account record');
+        }
+        if (count === 4 && fields[3] !== '' && fields[3].split(',').some((name) => name === '' || /\s/.test(name)))
+            throw new Error('malformed group members');
+        return fields;
+    });
+}
+/**
+ * Debian OpenSSH's user-group-modes rule: ancestors without group/world-write, or with sticky, are safe.
+ * Without sticky, group-write requires effective uid/gid ownership and local passwd/group
+ * files proving the group contains only this user, with no other primary-group users.
+ * World-write never qualifies; anything the local account files cannot prove refuses.
+ * The twin accepts_ancestor in opencode_files.rs must keep the identical permission rule.
+ */
+export async function acceptsAncestor(metadata, identity = ancestorIdentityContext.getStore() ?? {
+    euid: process.geteuid?.(), egid: process.getegid?.(), passwdPath: '/etc/passwd', groupPath: '/etc/group',
+}) {
+    if ((metadata.mode & 0o022) === 0 || (metadata.mode & 0o1000) !== 0)
+        return true;
+    if ((metadata.mode & 0o002) !== 0 || identity.euid === undefined || identity.egid === undefined || metadata.uid !== identity.euid || metadata.gid !== identity.egid)
+        return false;
+    try {
+        const passwd = records(new TextDecoder('utf-8', { fatal: true }).decode(await readFile(identity.passwdPath)), 7);
+        const groups = records(new TextDecoder('utf-8', { fatal: true }).decode(await readFile(identity.groupPath)), 4);
+        const users = passwd.filter((entry) => Number(entry[2]) === identity.euid);
+        const matchingGroups = groups.filter((entry) => Number(entry[2]) === identity.egid);
+        if (users.length !== 1 || matchingGroups.length !== 1)
+            return false;
+        const name = users[0][0];
+        return (matchingGroups[0][3] === '' || matchingGroups[0][3].split(',').every((member) => member === name)) &&
+            !passwd.some((entry) => Number(entry[2]) !== identity.euid && Number(entry[3]) === identity.egid);
+    }
+    catch {
+        // Local files must prove exclusivity; unavailable or malformed NSS data cannot grant an exception.
+        return false;
+    }
+}

package/dist/enrollment.d.ts

@@ -5,8 +5,8 @@ export type EnrollmentTokenFile = {
 /**
  * Atomically replace a consumer's enrollment credential.
  *
- * The file is always mode 0600 and every canonical ancestor is rejected when it is
- * group- or world-writable without sticky. This is the same rule implemented by the
+ * The file is always mode 0600. Writable canonical ancestors require sticky or a
+ * proven user-private group. This is the same rule implemented by the
  * shipped `refuse_writable_ancestor` symbol in `opencode_files.rs`.
  */
 export declare function writeEnrollmentTokenFile(path: string, value: EnrollmentTokenFile): Promise<void>;

package/dist/enrollment.js

@@ -1,3 +1,4 @@
+import { acceptsAncestor } from './ancestor-permissions.js';
 import { randomBytes } from 'node:crypto';
 import { chmod, mkdir, open, realpath, rename, stat, unlink } from 'node:fs/promises';
 import { basename, dirname, join } from 'node:path';
@@ -23,7 +24,7 @@ async function refuseWritableAncestor(parent) {
         const metadata = await stat(component).catch(() => undefined);
         // Canonicalisation already traversed this component. If a later stat races with a
         // rename, let the create/rename operation below report the concrete failure.
-        if (metadata && (metadata.mode & 0o022) !== 0 && (metadata.mode & 0o1000) === 0) {
+        if (metadata && !(await acceptsAncestor(metadata))) {
             throw new Error(`enrollment token ancestor ${component} is group- or world-writable without sticky bit`);
         }
         const next = dirname(component);
@@ -35,8 +36,8 @@ async function refuseWritableAncestor(parent) {
 /**
  * Atomically replace a consumer's enrollment credential.
  *
- * The file is always mode 0600 and every canonical ancestor is rejected when it is
- * group- or world-writable without sticky. This is the same rule implemented by the
+ * The file is always mode 0600. Writable canonical ancestors require sticky or a
+ * proven user-private group. This is the same rule implemented by the
  * shipped `refuse_writable_ancestor` symbol in `opencode_files.rs`.
  */
 export async function writeEnrollmentTokenFile(path, value) {

package/dist/handles.d.ts

@@ -33,6 +33,7 @@ type HandleFileStat = {
     isSymbolicLink?(): boolean;
     mode: number;
     size?: number;
+    gid?: number;
     uid?: number;
     mtimeMs?: number;
 };

package/dist/handles.js

@@ -3,6 +3,7 @@ import { constants } from 'node:fs';
 import { lstat as nodeLstat, open as nodeOpen, readFile, realpath, stat as nodeStat } from 'node:fs/promises';
 import { userInfo } from 'node:os';
 import { dirname, join } from 'node:path';
+import { acceptsAncestor } from './ancestor-permissions.js';
 export const HANDLE_FILE_CONTRACT = {
     maxBytes: 256 * 1024,
     mode: 0o600,
@@ -200,16 +201,14 @@ async function readHandleSnapshot(path = defaultHandleFilePath(), io = {}) {
         if (expectedUid !== undefined && parent.uid !== undefined && parent.uid !== expectedUid) {
             invalid('handle file parent is not owned by the current uid');
         }
-        // GROUP-WRITABLE COUNTS, NOT ONLY WORLD-WRITABLE. Directory write permission governs
-        // unlink and create, so anyone who can write the parent can replace a mode-0600 file
-        // wholesale however tightly the file itself is locked. The owner check above does not
-        // close it: a directory I own can still be 0770, and then any other uid in that group
-        // can swap the handle file for one of theirs. A cross-uid attacker is not conceded by
-        // this threat model the way a same-uid one is.
-        //
-        // Sticky exempts both bits for one reason: with it set, a writer may only unlink files
-        // they own. Mirrors the Rust check in opencode_files.rs; the two must not drift.
-        if ((parent.mode & 0o022) !== 0 && (parent.mode & 0o1000) === 0) {
+        // Group-write counts as well as world-write: a directory writer can unlink and
+        // replace a mode-0600 file regardless of its file permissions or owner. Owning
+        // the directory does not exclude other group members. Sticky exempts both bits
+        // because a writer may unlink only files they own. Without sticky, group-write
+        // is safe only when local account files prove a user-private effective group;
+        // world-write is never exempt. Keep this rule identical to Rust's accepts_ancestor
+        // and parent check in opencode_files.rs.
+        if (!(await acceptsAncestor(parent))) {
             invalid('handle file parent is group- or world-writable without sticky bit');
         }
         // EVERY ANCESTOR, NOT JUST THIS ONE, OR THE GUARANTEE DOES NOT COMPOSE. The immediate
@@ -244,7 +243,7 @@ async function readHandleSnapshot(path = defaultHandleFilePath(), io = {}) {
                 catch {
                     ancestor = undefined;
                 }
-                if (ancestor && (ancestor.mode & 0o022) !== 0 && (ancestor.mode & 0o1000) === 0) {
+                if (ancestor && !(await acceptsAncestor(ancestor))) {
                     invalid(`handle file ancestor ${component} is group- or world-writable without sticky bit`);
                 }
                 const next = dirname(component);

package/dist/manifest-lock.js

@@ -1,3 +1,4 @@
+import { acceptsAncestor } from './ancestor-permissions.js';
 import { constants as fsConstants } from 'node:fs';
 import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, unlink } from 'node:fs/promises';
 import { randomBytes, randomInt } from 'node:crypto';
@@ -263,7 +264,7 @@ async function refuseWritableAncestors(parent) {
     }
     for (;;) {
         const metadata = await stat(component);
-        if ((metadata.mode & 0o022) !== 0 && (metadata.mode & 0o1000) === 0)
+        if (!(await acceptsAncestor(metadata)))
             throw new Error('handle file ancestor is group- or world-writable without sticky bit');
         const next = dirname(component);
         if (next === component)

package/dist/wire.d.ts

@@ -206,7 +206,11 @@ export interface ScopedInventoryRow {
     readonly categories: readonly string[];
     readonly credentialType: string;
     readonly serves: readonly string[];
-    /** Operator-assigned catalog ids, always present, including an empty set. */
+    /**
+     * Operator-assigned catalog ids; empty when none are set. Always present on this type.
+     * A daemon older than the field omits it from the wire, and that decodes as empty,
+     * which is also what an unmapped credential reports.
+     */
     readonly providerIds: readonly string[];
     readonly authMethod?: 'apikey' | 'chatgpt' | 'antigravity' | 'oauth';
     /**

package/dist/wire.js

@@ -418,7 +418,11 @@ export function decodeScopedInventory(response, logUnknownClass) {
             categories: strings(row.categories),
             credentialType: row.type,
             serves: strings(row.serves),
-            providerIds: strings(row.provider_ids),
+            // ABSENT DECODES AS EMPTY, PRESENT MUST BE AN ARRAY. Daemons before provider ids
+            // existed omit the key, and refusing that would fail the whole listing against a
+            // still-supported daemon. Absent and empty mean the same thing to every consumer:
+            // no ids set. A present non-array is a malformed reply and still refuses.
+            providerIds: row.provider_ids === undefined ? [] : strings(row.provider_ids),
             authMethod,
             state: row.state,
             refreshAdapter: row.refresh_adapter,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/claustrum-client",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "license": "MIT",
   "repository": {
     "type": "git",