@crewhaus/tool-task 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-task",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Task(description, prompt, subagent_type?) tool — spawns a sub-agent and returns its final message (Section 13)",
   "main": "src/index.ts",
@@ -12,24 +12,24 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/agent-context-isolation": "0.1.1",
-    "@crewhaus/errors": "0.1.1",
-    "@crewhaus/sub-agent-permission-inheritance": "0.1.1",
-    "@crewhaus/tool-builder": "0.1.1",
-    "@crewhaus/tool-catalog": "0.1.1",
+    "@crewhaus/agent-context-isolation": "0.1.3",
+    "@crewhaus/errors": "0.1.3",
+    "@crewhaus/sub-agent-permission-inheritance": "0.1.3",
+    "@crewhaus/tool-builder": "0.1.3",
+    "@crewhaus/tool-catalog": "0.1.3",
     "yaml": "^2.6.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@crewhaus/event-log": "0.1.1",
-    "@crewhaus/permission-engine": "0.1.1",
-    "@crewhaus/run-context": "0.1.1"
+    "@crewhaus/event-log": "0.1.3",
+    "@crewhaus/permission-engine": "0.1.3",
+    "@crewhaus/run-context": "0.1.3"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -41,12 +41,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
-  },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+    "access": "public"
+  },
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -177,6 +177,46 @@ disk instructions`,
       resolveSubAgentDefinition("nonexistent", { subAgentDir: "/tmp/does-not-exist-xyz" }),
     ).toThrow(/unknown subagent_type/);
   });
+
+  // SECURITY: subagent_type is model-filled and becomes `join(dir, name+".md")`,
+  // so an unsanitized `..`/separator escapes the sub-agent dir and loads an
+  // arbitrary host .md as a sub-agent definition. Must be rejected.
+  test.each([
+    "../../../../etc/passwd",
+    "../sibling",
+    "foo/bar",
+    "foo\\bar",
+    "..",
+    ".",
+    "a/../../b",
+  ])("rejects path-traversal subagent_type %p", (evil) => {
+    expect(() =>
+      resolveSubAgentDefinition(evil, { subAgentDir: "/tmp/does-not-exist-xyz" }),
+    ).toThrow(/invalid subagent_type/);
+  });
+
+  test("path-traversal is rejected even when an inline map is present (disk path is the sink)", () => {
+    expect(() =>
+      resolveSubAgentDefinition("../../tmp/evil", {
+        subAgents: new Map(),
+        subAgentDir: "/tmp/does-not-exist-xyz",
+      }),
+    ).toThrow(/invalid subagent_type/);
+  });
+
+  test("ordinary names with dots that are not traversal still resolve via disk", () => {
+    const dir = newTempDir();
+    try {
+      writeFileSync(
+        join(dir, "my.agent.md"),
+        "---\nname: my.agent\ndescription: d\n---\ndo the thing\n",
+      );
+      const out = resolveSubAgentDefinition("my.agent", { subAgentDir: dir });
+      expect(out.name).toBe("my.agent");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("createTaskTool — execute round-trip", () => {

package/src/index.ts

@@ -143,6 +143,27 @@ function loadSubAgentFromDisk(name: string, dir: string): SubAgentDefinition | n
   return parseSubAgentFile(content, name);
 }
 
+/**
+ * `subagent_type` is a model-filled tool argument and model output is
+ * attacker-steerable (via any untrusted input). It becomes a filesystem path
+ * segment in `loadSubAgentFromDisk` (`join(dir, `${name}.md`)`), and `join`
+ * resolves `..` and path separators — so an unsanitized name like
+ * `../../../tmp/evil` reads an arbitrary `.md` on the host and loads it as a
+ * sub-agent definition. Reject anything that isn't a single safe path
+ * component before it reaches the disk lookup. Inline spec-supplied names are
+ * exact-key map lookups that never touch the filesystem, so they are resolved
+ * first (above) and are unaffected.
+ */
+function isUnsafeSubAgentName(name: string): boolean {
+  return (
+    name.includes("/") ||
+    name.includes("\\") ||
+    name.includes("\0") ||
+    name === "." ||
+    name === ".."
+  );
+}
+
 export type CreateTaskToolOptions = {
   /** Inline spec-supplied sub-agent definitions (highest priority). */
   readonly subAgents?: ReadonlyMap<string, SubAgentDefinition>;
@@ -160,6 +181,13 @@ export function resolveSubAgentDefinition(
     const inline = opts.subAgents.get(resolveName);
     if (inline !== undefined) return inline;
   }
+  // Guard the disk lookup against path traversal (the inline map above is an
+  // exact-key lookup and is intentionally not gated).
+  if (isUnsafeSubAgentName(resolveName)) {
+    throw new SubAgentResolutionError(
+      `invalid subagent_type "${resolveName}" — must not contain path separators, "..", ".", or NUL bytes`,
+    );
+  }
   const dir = opts.subAgentDir ?? join(process.cwd(), ".crewhaus", "sub-agents");
   const onDisk = loadSubAgentFromDisk(resolveName, dir);
   if (onDisk !== null) return onDisk;