@crewhaus/tool-lifecycle 0.8.0 → 0.8.1

package/README.md

@@ -140,7 +140,12 @@ verified.
   logs, the tool results the runtime saved to a file, or its proof bundles,
   as `to: .crewhaus` would — with no override and in every permission mode
   (0.8.0). The provability gate and `continuity.proof` read that record as
-  evidence, so a migration onto it could rewrite the evidence;
+  evidence, so a migration onto it could rewrite the evidence. A copy that
+  would land in the files that control the run (its run files, settings, gate
+  records, environment files, compiled bundle and dependencies, Hangar's
+  directory), which decide what the agent
+  may do next, is refused the
+  same way;
 - a `targetVersion` different from the source's, and any `targetVersion` at all
   against a store with no version stamp. See below.
 

package/dist/index.js

@@ -50,7 +50,7 @@ import { existsSync, lstatSync, readdirSync, statSync } from "node:fs";
 import * as path from "node:path";
 import { AUDIT_CHAIN_EXCLUSION_REASON, InvalidRetentionDateError, KNOWLEDGE_MARKER_RELPATH, RETENTION_CONFIG_RELPATH, RETIREMENT_LOG_FILENAME, RetentionConfigError, RetireError, SHARED_DIR_DEFAULT, applyPull, applyPush, buildRetirementPlan, formatPlan, fragmentContentHash, harnessOptedIn, openHarnessRecordStore, parseRetentionDate, planPull, planPush, readHarnessGraders, readHarnessMemories, readHarnessPrompts, runRetentionExport, runRetentionPurge, runRetentionSweep, runRetirement, } from "@crewhaus/harness-lifecycle";
 import { buildTool } from "@crewhaus/tool-builder";
-import { protectedRootHolding, protectedRootsOf, protectedWriteRefusal, } from "@crewhaus/tool-safety/fs";
+import { protectedRootBeneath, protectedRootsOf, protectedWriteRefusal, } from "@crewhaus/tool-safety/fs";
 import { z } from "zod";
 import { NO_PII_PASS_REASON, PULLED_MEMORIES_RELPATH, SHARED_MANIFEST_RELPATH, SHARED_MEMORIES_RELPATH, auditHarnessMemoryFiles, auditSharedFragments, auditSharedMemories, harnessMemoryHashes, landedSharedGraderHashes, makeRedactor, pulledFragmentRelPath, sharedFragmentRelPath, } from "./lib/knowledge";
 import { COVERED_STORE_DIRS, EXPORT_MANIFEST_FILENAME, RECEIPT_FILENAME, RECORD_SHAPE_MIGRATION_UNAVAILABLE, inspectDestination, plannedPaths, readStoreVersion, uncoveredStateEntries, writeReceipt, writtenPaths, } from "./lib/migrate";
@@ -189,7 +189,7 @@ export const harnessRetire = buildTool({
     }),
     destructive: true,
     requireJustification: true,
-    execute: async (input) => {
+    execute: async (input, ctx) => {
         const tool = "HarnessRetire";
         const dryRun = input.dryRun ?? true;
         if (!specNameIsSafe(input.spec)) {
@@ -206,6 +206,11 @@ export const harnessRetire = buildTool({
         if (!registry.ok)
             return refusal(tool, registry.code, registry.reason);
         const stateDir = path.join(harness.value.real, STATE_RELDIR);
+        // Retiring moves the state directory away, so a run cannot retire the harness
+        // it runs in. Refused for a preview too: it says what a real run would do.
+        if (protectedRootBeneath(stateDir, protectedRootsOf(ctx)) !== undefined) {
+            return protectedWriteRefusal(tool, `retiring ${dirRel}`);
+        }
         if (overlaps(archive.value.real, stateDir)) {
             return refusal(tool, "refused", `the archive directory and the state directory ${STATE_RELDIR} overlap — archiving a directory into itself would destroy it`);
         }
@@ -248,11 +253,7 @@ export const harnessRetire = buildTool({
         // symlink named like one of these would send the retirement log or the
         // fingerprint manifest out of the workspace — the two files that are the
         // whole evidence of the decommission.
-        const archiveEscapes = containWritePaths(tool, archive.value, [
-            STATE_MANIFEST_FILENAME,
-            RETIREMENT_LOG_FILENAME,
-            ARCHIVED_STATE_DIRNAME,
-        ]);
+        const archiveEscapes = containWritePaths(tool, archive.value, [STATE_MANIFEST_FILENAME, RETIREMENT_LOG_FILENAME, ARCHIVED_STATE_DIRNAME], protectedRootsOf(ctx));
         if (archiveEscapes !== undefined) {
             return refusal(tool, archiveEscapes.code, archiveEscapes.reason);
         }
@@ -529,20 +530,14 @@ export const storeMigrate = buildTool({
         // the workspace — and a DANGLING one does not even register as a
         // conflict. Checked on the preview too, so the refusal is visible before
         // the run that would have written through it.
-        const escaping = containWritePaths(tool, dest.value, written);
-        if (escaping !== undefined)
-            return refusal(tool, escaping.code, escaping.reason);
+        //
         // 0.8.0 — no copy lands in the run's own record (`RuntimeBridge
         // .protectedRoots`): a destination of `.crewhaus` would write
         // `.crewhaus/sessions/<id>.jsonl` over the live session log. Refused in
         // every mode, as StateImport and CopyPath refuse.
-        const protectedRoots = protectedRootsOf(ctx);
-        if (protectedRoots.length > 0) {
-            const into = written.find((rel) => protectedRootHolding(path.join(dest.value.real, rel), protectedRoots) !== undefined);
-            if (into !== undefined) {
-                return protectedWriteRefusal(tool, `migrating onto ${input.to} (${into})`);
-            }
-        }
+        const escaping = containWritePaths(tool, dest.value, written, protectedRootsOf(ctx));
+        if (escaping !== undefined)
+            return refusal(tool, escaping.code, escaping.reason);
         const destState = inspectDestination(dest.value.real, written);
         if (!destState.ok)
             return refusal(tool, destState.code, destState.reason);
@@ -958,9 +953,10 @@ export const knowledgeSync = buildTool({
     }),
     destructive: true,
     requireJustification: true,
-    execute: async (input) => {
+    execute: async (input, ctx) => {
         const tool = "KnowledgeSync";
         const dryRun = input.dryRun ?? true;
+        const protectedRoots = protectedRootsOf(ctx);
         const maxArtifacts = input.maxArtifacts ?? DEFAULT_MAX_ARTIFACTS;
         const harnessDir = containExistingDir(tool, input.dir ?? ".");
         if (!harnessDir.ok)
@@ -1080,7 +1076,7 @@ export const knowledgeSync = buildTool({
                 SHARED_MANIFEST_RELPATH,
                 ...plan.fragments.map(sharedFragmentRelPath),
             ];
-            const pushEscapes = containWritePaths(tool, shared.value, pushWrites);
+            const pushEscapes = containWritePaths(tool, shared.value, pushWrites, protectedRoots);
             if (pushEscapes !== undefined) {
                 return refusal(tool, pushEscapes.code, pushEscapes.reason, { ...common, plan: planReport });
             }
@@ -1180,7 +1176,7 @@ export const knowledgeSync = buildTool({
             ...(plan.memories.length > 0 ? [PULLED_MEMORIES_RELPATH] : []),
             ...plan.fragments.map(pulledFragmentRelPath),
         ];
-        const pullEscapes = containWritePaths(tool, harnessDir.value, pullWrites);
+        const pullEscapes = containWritePaths(tool, harnessDir.value, pullWrites, protectedRoots);
         if (pullEscapes !== undefined) {
             return refusal(tool, pullEscapes.code, pullEscapes.reason, { ...common, plan: planReport });
         }

package/dist/lib/result.d.ts

@@ -62,8 +62,12 @@ export declare function contain(toolName: string, rel: string): Loaded<SafePath>
  * through — symlink-aware, dangling links followed by hand — rather than a
  * second symlink walker written here. Returns the refusal, or `undefined`
  * when every write path stays inside the workspace.
+ *
+ * With `protectedRoots` (`RuntimeBridge.protectedRoots`, for a call that writes
+ * these paths), a path also has to land outside each of them. The landing place
+ * is the one `resolveSafe` worked out, which a dangling link's target counts in.
  */
-export declare function containWritePaths(toolName: string, root: SafePath, rels: ReadonlyArray<string>): Failure | undefined;
+export declare function containWritePaths(toolName: string, root: SafePath, rels: ReadonlyArray<string>, protectedRoots?: readonly string[]): Failure | undefined;
 /** Resolve a directory that must already exist. */
 export declare function containExistingDir(toolName: string, rel: string): Loaded<SafePath>;
 /** True when `candidate` is `parent` or lives underneath it (both absolute). */

package/dist/lib/result.js

@@ -12,6 +12,7 @@
  */
 import { statSync } from "node:fs";
 import * as path from "node:path";
+import { protectedRootHolding, protectedWriteRefusal } from "@crewhaus/tool-safety/fs";
 import { MAX_PATH_CHARS, ToolPermissionError, resolveSafe } from "../paths";
 /** Compact JSON — the reader is a model, and every byte is context. */
 export const json = (value) => JSON.stringify(value);
@@ -94,17 +95,25 @@ export function contain(toolName, rel) {
  * through — symlink-aware, dangling links followed by hand — rather than a
  * second symlink walker written here. Returns the refusal, or `undefined`
  * when every write path stays inside the workspace.
+ *
+ * With `protectedRoots` (`RuntimeBridge.protectedRoots`, for a call that writes
+ * these paths), a path also has to land outside each of them. The landing place
+ * is the one `resolveSafe` worked out, which a dangling link's target counts in.
  */
-export function containWritePaths(toolName, root, rels) {
+export function containWritePaths(toolName, root, rels, protectedRoots = []) {
     const shownRoot = root.rel === "" ? "." : root.rel;
     for (const rel of rels) {
         const under = root.rel === "" ? rel : `${root.rel}/${rel}`;
         // Too long to open or create: it leads nowhere, so it is no escape.
         if (pastPathLimit(under))
             continue;
-        if (!contain(toolName, under).ok) {
+        const resolved = contain(toolName, under);
+        if (!resolved.ok) {
             return fail("refused", `"${renderPath(rel)}" under "${renderPath(shownRoot)}" resolves outside the workspace root — a symlink on that path leads out, so the write would land on the link's target rather than inside "${renderPath(shownRoot)}". Remove the link and run again; there is no flag for writing through it.`);
         }
+        if (protectedRootHolding(resolved.value.real, protectedRoots) !== undefined) {
+            return fail("refused", protectedWriteRefusal(toolName, `"${renderPath(rel)}" under "${renderPath(shownRoot)}"`));
+        }
     }
     return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-lifecycle",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "Deterministic harness lifecycle: retirement, store migration, retention enforcement and knowledge sync",
   "main": "dist/index.js",
@@ -16,11 +16,11 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.8.0",
-    "@crewhaus/harness-lifecycle": "0.8.0",
-    "@crewhaus/tool-builder": "0.8.0",
-    "@crewhaus/tool-catalog": "0.8.0",
-    "@crewhaus/tool-safety": "0.8.0",
+    "@crewhaus/errors": "0.8.1",
+    "@crewhaus/harness-lifecycle": "0.8.1",
+    "@crewhaus/tool-builder": "0.8.1",
+    "@crewhaus/tool-catalog": "0.8.1",
+    "@crewhaus/tool-safety": "0.8.1",
     "zod": "^3.23.8"
   },
   "devDependencies": {