@crewhaus/event-log 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/event-log",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Append-only JSONL transcript log per session",
   "main": "src/index.ts",
@@ -12,13 +12,14 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.1"
+    "@crewhaus/errors": "0.1.3",
+    "@crewhaus/tenancy": "0.1.3"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -30,12 +31,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -2,6 +2,7 @@ import { afterAll, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { TenancyError, buildTenant, withTenant } from "@crewhaus/tenancy";
 import { type Event, openEventLog } from "./index";
 
 const TMP_ROOTS: string[] = [];
@@ -170,3 +171,92 @@ describe("event-log — T7 load", () => {
     expect(readMs).toBeLessThan(5_000);
   }, 30_000);
 });
+
+describe("event-log — cross-tenant fencing (CWE-1230)", () => {
+  test("inside tenantA, a log rooted under tenantB fails closed", async () => {
+    const tenantsRoot = newTempRoot();
+    const tenantA = buildTenant("tenant-a", { tenantsRoot });
+    const tenantB = buildTenant("tenant-b", { tenantsRoot });
+    // Opening a log rooted under tenantB while tenantA is active resolves a
+    // path outside tenantA's sessionRoot, so it fails closed.
+    await expect(
+      withTenant(tenantA, () => openEventLog(TEST_ID, { rootDir: tenantB.sessionRoot })),
+    ).rejects.toThrow(TenancyError);
+  });
+
+  test("inside tenantA, a log rooted under tenantA round-trips", async () => {
+    const tenantsRoot = newTempRoot();
+    const tenantA = buildTenant("tenant-a", { tenantsRoot });
+    await withTenant(tenantA, async () => {
+      const log = await openEventLog(TEST_ID, { rootDir: tenantA.sessionRoot });
+      await log.append({ kind: "user_message", payload: { ok: true } });
+      const all = await collect(log.read());
+      expect(all.length).toBe(1);
+    });
+  });
+
+  test("no active tenant — behaviour is unchanged (no fencing)", async () => {
+    const rootDir = newTempRoot();
+    const log = await openEventLog(TEST_ID, { rootDir });
+    await log.append({ kind: "user_message", payload: { ok: true } });
+    const all = await collect(log.read());
+    expect(all.length).toBe(1);
+  });
+});
+
+describe("event-log — security invariants", () => {
+  // The header documents owner-only (0o600) append semantics, mirroring the
+  // claude-code sessionStorage precedent. Pin it down so a regression that
+  // drops `{ mode: 0o600 }` (widening the transcript to group/other) fails.
+  test("the JSONL file is created without group/other access", async () => {
+    const rootDir = newTempRoot();
+    const log = await openEventLog(TEST_ID, { rootDir });
+    await log.append({ kind: "user_message", payload: { secret: "transcript" } });
+    const mode = statSync(join(rootDir, `${TEST_ID}.jsonl`)).mode & 0o777;
+    // No bits set for group (0o070) or other (0o007).
+    expect(mode & 0o077).toBe(0);
+  });
+
+  // A hostile/corrupt log line carrying a `__proto__` key must round-trip as
+  // plain data and must NOT pollute Object.prototype (CWE-1321). readEvents
+  // only `JSON.parse`s + yields; it never merges into an existing object, so
+  // there is no pollution sink — this guards against a future refactor adding
+  // one.
+  test("a __proto__ payload does not pollute Object.prototype", async () => {
+    const rootDir = newTempRoot();
+    const log = await openEventLog(TEST_ID, { rootDir });
+    await log.append({ kind: "user_message", payload: {} });
+    writeFileSync(
+      join(rootDir, `${TEST_ID}.jsonl`),
+      `${JSON.stringify({
+        ts: 1,
+        version: 1,
+        kind: "user_message",
+        payload: JSON.parse('{"__proto__":{"polluted":true}}'),
+      })}\n`,
+    );
+    const all = await collect(log.read());
+    expect(all.length).toBe(1);
+    // The global prototype must remain unpolluted for everyone else.
+    expect(({} as Record<string, unknown>)["polluted"]).toBeUndefined();
+    expect((Object.prototype as Record<string, unknown>)["polluted"]).toBeUndefined();
+  });
+
+  // The sessionId becomes part of the on-disk path; only `sess_<16 hex>` is
+  // accepted, so traversal / absolute-path / NUL injection in the id can never
+  // reach the filesystem (CWE-22).
+  test("rejects traversal, separators, and NUL in the session id", async () => {
+    const rootDir = newTempRoot();
+    for (const bad of [
+      "sess_../../etc/passwd",
+      "sess_0123456789abcde/", // 15 hex + slash
+      "sess_0123456789abcdeg", // non-hex char
+      "sess_0123456789ABCDEF", // uppercase hex not allowed
+      "sess_0123456789abcdef0", // 17 hex (too long)
+      "sess_000000000000",
+      "../escape",
+    ]) {
+      await expect(openEventLog(bad, { rootDir })).rejects.toThrow(/invalid sessionId/);
+    }
+  });
+});

package/src/index.ts

@@ -25,9 +25,10 @@
  * `AI-Harness-Systems.md` §append-only event history.
  */
 import { appendFileSync, createReadStream, existsSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { RuntimeError } from "@crewhaus/errors";
+import { assertSamePath, currentTenantContext, requireTenant } from "@crewhaus/tenancy";
 
 export const DEFAULT_ROOT_DIR = ".crewhaus/sessions";
 const ID_REGEX = /^sess_[0-9a-f]{16}$/;
@@ -98,11 +99,22 @@ export async function openEventLog(
   validateId(sessionId);
   const rootDir = opts.rootDir ?? DEFAULT_ROOT_DIR;
   const now = opts.now ?? (() => Date.now());
-  const fullPath = join(rootDir, `${sessionId}.jsonl`);
+  const fullPath = resolve(rootDir, `${sessionId}.jsonl`);
   mkdirSync(rootDir, { recursive: true });
 
+  // When a tenant context is active, fail closed on a resolved path that
+  // escapes the tenant's sessionRoot (CWE-1230). Outside a tenant scope (the
+  // common CLI case) this is a no-op so non-tenant behaviour is unchanged.
+  function fence(): void {
+    if (currentTenantContext() !== undefined) {
+      assertSamePath(fullPath, requireTenant().sessionRoot);
+    }
+  }
+  fence();
+
   return {
     async append(event: AppendEvent): Promise<void> {
+      fence();
       const wire: Event = {
         ts: now(),
         version: 1,
@@ -114,6 +126,7 @@ export async function openEventLog(
     },
 
     read(readOpts: { since?: number; until?: number } = {}): AsyncIterable<Event> {
+      fence();
       return readEvents(fullPath, readOpts);
     },