@crewhaus/target-onchain-game 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/target-onchain-game",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "description": "Codegen for the §47 `onchain-game` perceive-act-perceive loop. Emits a daemon that reads game state, asks the model for a move, broadcasts the move, awaits confirmation, and repeats.",
   "main": "src/index.ts",
@@ -12,15 +12,15 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.0.0",
-    "@crewhaus/infra-utils": "0.0.0",
-    "@crewhaus/ir": "0.0.0"
+    "@crewhaus/errors": "0.1.2",
+    "@crewhaus/infra-utils": "0.1.2",
+    "@crewhaus/ir": "0.1.2"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -32,12 +32,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -79,6 +79,31 @@ describe("emitOnchainGame — happy path", () => {
     expect(c).toContain('"allowedContracts":["tictactoe"]');
     expect(c).toContain('"simulationRequired":true');
   });
+
+  // #151 activation — the single game contract is resolved into the policy's
+  // contractId -> address map so the wallet-engine binds tx.to.
+  test("populates transaction_policy.contractAddresses from the game contract", () => {
+    const bundle = emitOnchainGame(baseIr());
+    const c = bundle.files[0]?.content ?? "";
+    expect(c).toContain('"contractAddresses":{"tictactoe":"0xgame"}');
+  });
+
+  // #159 (CWE-798) — a kms:// / hsm:// key handle is a permitted literal.
+  test("renders a kms:// keyRef handle verbatim", () => {
+    const bundle = emitOnchainGame(
+      baseIr({
+        wallet: {
+          id: "player",
+          chainId: "base-sepolia",
+          custody: "kms",
+          signingPolicy: "automated",
+          keyRef: { kind: "literal", value: "kms://aws/player-key" },
+        },
+      }),
+    );
+    const c = bundle.files[0]?.content ?? "";
+    expect(c).toContain('"kms://aws/player-key"');
+  });
 });
 
 describe("emitOnchainGame — validation", () => {
@@ -120,4 +145,35 @@ describe("emitOnchainGame — validation", () => {
       }),
     ).toThrow(/moveTimeoutMs/);
   });
+
+  // #159 (CWE-798) — a literal (raw hex private key) wallet keyRef must not be
+  // baked into the emitted artifact.
+  test("rejects a literal (hex private key) wallet keyRef", () => {
+    expect(() =>
+      emitOnchainGame(
+        baseIr({
+          wallet: {
+            id: "player",
+            chainId: "base-sepolia",
+            custody: "local",
+            signingPolicy: "automated",
+            keyRef: {
+              kind: "literal",
+              value: "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d",
+            },
+          },
+        }),
+      ),
+    ).toThrow(TargetEmitError);
+  });
+});
+
+describe("emitOnchainGame — spec-name codegen injection (#147)", () => {
+  test("a crafted name cannot break out of the header comment", () => {
+    const evil = "safe */ globalThis.__PWNED_GAME__ = 1; /*\nmore";
+    const content = emitOnchainGame(baseIr({ name: evil })).files[0]?.content ?? "";
+    expect(content).toMatch(/^\/\/ Compiled from spec:/m);
+    expect(content).not.toMatch(/^globalThis\.__PWNED_GAME__/m);
+    expect(content).not.toContain("*/\nglobalThis");
+  });
 });

package/src/index.ts

@@ -49,6 +49,24 @@ function renderSecretRef(ref: IrSecretRef): string {
   )}); })()`;
 }
 
+/**
+ * #159 (CWE-798) — a wallet signing key must never be a bare literal in
+ * the emitted DO-NOT-EDIT artifact. The compiler's `lowerWalletKeyRef`
+ * already rejects literal keyRefs at lower time; this is the
+ * defense-in-depth guard at the emit boundary (e.g. for a hand-built IR
+ * that bypassed the lowerer). Env refs pass; only `kms://` / `hsm://`
+ * key handles are permitted as literals.
+ */
+const KEY_HANDLE_RE = /^(kms|hsm):\/\/.+/;
+function renderWalletKeyRef(walletId: string, ref: IrSecretRef): string {
+  if (ref.kind === "literal" && !KEY_HANDLE_RE.test(ref.value)) {
+    throw new TargetEmitError(
+      `wallet "${walletId}" keyRef is a literal signing key; refusing to embed it in the generated bundle. Use an environment reference or a kms:// / hsm:// handle.`,
+    );
+  }
+  return renderSecretRef(ref);
+}
+
 export function emitOnchainGame(ir: IrChainGameV0): Bundle {
   if (ir.chain.id !== ir.wallet.chainId) {
     throw new TargetEmitError(
@@ -73,15 +91,26 @@ export function emitOnchainGame(ir: IrChainGameV0): Bundle {
       : `{ kind: ${JSON.stringify(ir.chain.finality.kind)} }`;
 
   const policy = ir.transactionPolicy;
+  // #151 — resolve the declared game contract (id -> address) into the policy
+  // so the wallet-engine can bind `tx.to` to the address registered for the
+  // claimed contractId. A game is single-contract, so the map carries exactly
+  // the one entry the move-broadcast flow can target.
+  const contractAddresses: Record<string, string> = {
+    [ir.game.contract.id]: ir.game.contract.address,
+  };
   const policyLiteral = JSON.stringify({
     defaultWriteApproval: policy.defaultWriteApproval,
     allowedContracts: policy.allowedContracts,
     simulationRequired: policy.simulationRequired,
     ...(policy.maxValueUsd !== undefined ? { maxValueUsd: policy.maxValueUsd } : {}),
+    ...(policy.maxValueWei !== undefined ? { maxValueWei: policy.maxValueWei } : {}),
+    contractAddresses,
   });
 
   const walletKeyRef =
-    ir.wallet.keyRef !== undefined ? `, keyRef: ${renderSecretRef(ir.wallet.keyRef)}` : "";
+    ir.wallet.keyRef !== undefined
+      ? `, keyRef: ${renderWalletKeyRef(ir.wallet.id, ir.wallet.keyRef)}`
+      : "";
 
   const objectiveField =
     ir.game.objective !== undefined ? `\n  objective: ${escapeJsonString(ir.game.objective)},` : "";
@@ -95,11 +124,12 @@ export function emitOnchainGame(ir: IrChainGameV0): Bundle {
   const instructions = escapeJsonString(ir.agent.instructions);
   const name = escapeJsonString(ir.name);
 
-  const content = `/**
- * Generated by @crewhaus/target-onchain-game (§47 onchain-game).
- * Compiled from spec: ${ir.name}
- * DO NOT EDIT — re-run \`crewhaus compile\` to regenerate.
- */
+  // Header is a `//` line comment using the JSON-escaped name: a raw ir.name in
+  // a block comment lets a crafted spec.name containing `*/` (or a newline) break
+  // out of the comment and inject top-level code — RCE on build/run (#147).
+  const content = `// Generated by @crewhaus/target-onchain-game (§47 onchain-game).
+// Compiled from spec: ${name}
+// DO NOT EDIT — re-run \`crewhaus compile\` to regenerate.
 import { classifyBoundary } from "@crewhaus/boundary-classifier";
 import { createEvmAdapter } from "@crewhaus/chain-adapter-evm";