@crewhaus/tool-result-store 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-result-store",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "description": "Persist large tool results to disk and return a preview the model can re-read",
   "main": "src/index.ts",
@@ -12,15 +12,16 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.0.0",
-    "@crewhaus/tool-catalog": "0.0.0",
-    "@crewhaus/tool-executor": "0.0.0"
+    "@crewhaus/errors": "0.1.2",
+    "@crewhaus/tenancy": "0.1.2",
+    "@crewhaus/tool-catalog": "0.1.2",
+    "@crewhaus/tool-executor": "0.1.2"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -32,12 +33,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -2,10 +2,13 @@ import { afterAll, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { RuntimeError } from "@crewhaus/errors";
+import { TenancyError, buildTenant, withTenant } from "@crewhaus/tenancy";
 import type { ToolResult } from "@crewhaus/tool-executor";
 import {
   DEFAULT_PREVIEW_LINES,
   DEFAULT_THRESHOLD_BYTES,
+  assertUnderRoot,
   resolveStoragePath,
   storeAndPreview,
 } from "./index";
@@ -53,6 +56,60 @@ describe("storeAndPreview — under threshold", () => {
   });
 });
 
+describe("storeAndPreview — non-string content", () => {
+  test("image content-block array bypasses persistence and is forwarded verbatim", async () => {
+    const rootDir = newTempRoot();
+    // A large base64 payload that would blow past the byte threshold if it
+    // were a string — confirms the array short-circuits before any sizing.
+    const blocks: ToolResult["content"] = [
+      {
+        type: "image",
+        source: {
+          type: "base64",
+          media_type: "image/png",
+          data: "Q".repeat(DEFAULT_THRESHOLD_BYTES + 10),
+        },
+      },
+    ];
+    const out = await storeAndPreview(
+      { toolUseId: "tu_img", content: blocks, isError: false },
+      {
+        runId: "run_img",
+        toolUseId: "tu_img",
+        rootDir,
+      },
+    );
+    expect(out.persisted).toBe(false);
+    expect(out.fullPath).toBeNull();
+    // Same reference forwarded unchanged — no copy, no preview wrapping.
+    expect(out.previewContent).toBe(blocks);
+    // Nothing was written under the run directory.
+    expect(() => statSync(join(rootDir, "run_img"))).toThrow();
+  });
+
+  test("mixed text + image blocks are also forwarded as-is", async () => {
+    const rootDir = newTempRoot();
+    const blocks: ToolResult["content"] = [
+      { type: "text", text: "caption" },
+      {
+        type: "image",
+        source: { type: "base64", media_type: "image/jpeg", data: "AAAA" },
+      },
+    ];
+    const out = await storeAndPreview(
+      { toolUseId: "tu_mix", content: blocks, isError: false },
+      {
+        runId: "run_mix",
+        toolUseId: "tu_mix",
+        rootDir,
+      },
+    );
+    expect(out.persisted).toBe(false);
+    expect(out.fullPath).toBeNull();
+    expect(out.previewContent).toEqual(blocks);
+  });
+});
+
 describe("storeAndPreview — over threshold", () => {
   test("large content is persisted; preview shows first N lines + marker", async () => {
     const rootDir = newTempRoot();
@@ -180,4 +237,63 @@ describe("storeAndPreview — path traversal guard", () => {
     const path = resolveStoragePath("run_x", "tu_y", "/tmp/cr-test");
     expect(path).toContain("/tmp/cr-test/run_x/tu_y.txt");
   });
+
+  test("assertUnderRoot accepts a path strictly under root", () => {
+    expect(() => assertUnderRoot("/tmp/cr-root/run/file.txt", "/tmp/cr-root")).not.toThrow();
+  });
+
+  test("assertUnderRoot rejects a path that escapes root (defence-in-depth throw)", () => {
+    // Exercises the boundary check directly: a resolved path that does NOT
+    // sit under root must throw, even though rejectUnsafeSegment normally
+    // makes this unreachable from resolveStoragePath.
+    expect(() => assertUnderRoot("/etc/passwd", "/tmp/cr-root")).toThrow(RuntimeError);
+    expect(() => assertUnderRoot("/tmp/cr-root-sibling/x", "/tmp/cr-root")).toThrow(
+      /escapes rootDir/,
+    );
+  });
+});
+
+describe("storeAndPreview — cross-tenant fencing (CWE-1230)", () => {
+  const big = "x".repeat(DEFAULT_THRESHOLD_BYTES + 10);
+
+  test("inside tenantA, a store rooted under tenantB fails closed", async () => {
+    const tenantsRoot = newTempRoot();
+    const tenantA = buildTenant("tenant-a", { tenantsRoot });
+    const tenantB = buildTenant("tenant-b", { tenantsRoot });
+    // Persisting under tenantB's toolResultRoot while tenantA is active
+    // resolves a path outside tenantA's root, so it fails closed.
+    await withTenant(tenantA, async () => {
+      await expect(
+        storeAndPreview(makeResult(big), {
+          runId: "run_x",
+          toolUseId: "tu_x",
+          rootDir: tenantB.toolResultRoot,
+        }),
+      ).rejects.toThrow(TenancyError);
+    });
+  });
+
+  test("inside tenantA, a store rooted under tenantA persists", async () => {
+    const tenantsRoot = newTempRoot();
+    const tenantA = buildTenant("tenant-a", { tenantsRoot });
+    await withTenant(tenantA, async () => {
+      const out = await storeAndPreview(makeResult(big), {
+        runId: "run_x",
+        toolUseId: "tu_x",
+        rootDir: tenantA.toolResultRoot,
+      });
+      expect(out.persisted).toBe(true);
+      expect(out.fullPath).toContain(tenantA.toolResultRoot);
+    });
+  });
+
+  test("no active tenant — behaviour is unchanged (no fencing)", async () => {
+    const rootDir = newTempRoot();
+    const out = await storeAndPreview(makeResult(big), {
+      runId: "run_x",
+      toolUseId: "tu_x",
+      rootDir,
+    });
+    expect(out.persisted).toBe(true);
+  });
 });

package/src/index.ts

@@ -26,9 +26,19 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { RuntimeError } from "@crewhaus/errors";
+import { assertSamePath, currentTenantContext, requireTenant } from "@crewhaus/tenancy";
 import type { ToolExecuteResult } from "@crewhaus/tool-catalog";
 import type { ToolResult } from "@crewhaus/tool-executor";
 
+// When a tenant context is active, fail closed on a resolved storage path that
+// escapes the tenant's toolResultRoot (CWE-1230). Outside a tenant scope (the
+// common CLI case) this is a no-op so non-tenant behaviour is unchanged.
+function fence(absPath: string): void {
+  if (currentTenantContext() !== undefined) {
+    assertSamePath(absPath, requireTenant().toolResultRoot);
+  }
+}
+
 export type StoreOptions = {
   readonly runId: string;
   readonly toolUseId: string;
@@ -79,6 +89,7 @@ export async function storeAndPreview(
   rejectUnsafeSegment("toolUseId", opts.toolUseId);
 
   const fullPath = join(rootDir, opts.runId, `${opts.toolUseId}.txt`);
+  fence(resolve(fullPath));
   await mkdir(dirname(fullPath), { recursive: true });
   try {
     await writeFile(fullPath, result.content, { flag: "wx" });
@@ -112,6 +123,19 @@ function rejectUnsafeSegment(label: string, value: string): void {
   }
 }
 
+/**
+ * Defence-in-depth boundary check: assert that a resolved absolute path lives
+ * strictly under `root`. Redundant with `rejectUnsafeSegment` on the normal
+ * code path (which already strips separators and `..`), but kept — and exported
+ * so it can be exercised directly — so a future caller that resolves a path
+ * some other way can't silently escape the storage root.
+ */
+export function assertUnderRoot(abs: string, root: string): void {
+  if (!abs.startsWith(`${root}${sep}`)) {
+    throw new RuntimeError("tool-result-store: resolved path escapes rootDir");
+  }
+}
+
 /**
  * Used by tests to confirm the resolved storage location for a given
  * runId/toolUseId pair. Performs the same traversal rejection as
@@ -126,9 +150,7 @@ export function resolveStoragePath(
   rejectUnsafeSegment("toolUseId", toolUseId);
   const abs = resolve(rootDir, runId, `${toolUseId}.txt`);
   // Sanity: the resolved path must still live under rootDir.
-  const root = resolve(rootDir);
-  if (!abs.startsWith(`${root}${sep}`)) {
-    throw new RuntimeError("tool-result-store: resolved path escapes rootDir");
-  }
+  assertUnderRoot(abs, resolve(rootDir));
+  fence(abs);
   return abs;
 }