@crouton-kit/crouter 0.3.32 → 0.3.33

package/dist/hearth/wake-proxy/__tests__/source-bridge-gate.test.js

@@ -0,0 +1,455 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { linkSync, mkdtempSync, mkdirSync, realpathSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { test } from 'node:test';
+import { PUBLIC_SOURCE_FILE_READ_SCRIPT, handlePublicSourceRequest } from '../public-source-gate.js';
+import { guestEnv } from '../../../core/hearth/guest-env.js';
+import { routeRequest } from '../server.js';
+const ownerToken = 'owner-secret-token';
+const ownerTokenHash = createHash('sha256').update(ownerToken, 'utf8').digest('hex');
+const publicOrigin = 'https://hearth.example';
+const guestHome = '/home/agent';
+const tenantId = 'tenant-source-gate';
+const nodeId = 'mqt64sus-e71caa94';
+function makeRuntime(statePath) {
+    return {
+        proxy: {
+            host: '127.0.0.1',
+            port: 7878,
+            publicOrigin,
+            statePath,
+            m0RegistryPath: join(statePath, 'homes.json'),
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            ownerTokenHash,
+            idlePauseMs: 60_000,
+            wakeTimeoutMs: 30_000,
+            readyTimeoutMs: 2_000,
+            cookieSecure: true,
+            seedHome: null,
+        },
+        m0: {
+            providerName: 'none',
+            registryPath: join(statePath, 'homes.json'),
+            guestUser: 'agent',
+            guestHome,
+            guestCodePath: '/opt/crouter',
+            webPort: 7878,
+            nodeKind: 'general',
+            piPackages: [],
+            piAuthJson: null,
+            relayToken: null,
+        },
+    };
+}
+function writeState(statePath) {
+    writeFileSync(statePath, `${JSON.stringify({
+        version: 1,
+        owner: {
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            tokenHash: ownerTokenHash,
+            createdAt: '2026-06-26T00:00:00.000Z',
+        },
+        tenants: {},
+    }, null, 2)}\n`, 'utf8');
+}
+function makeRequest(method, url, headers = {}, body = '') {
+    const req = new Readable({ read() { } });
+    req.method = method;
+    req.url = url;
+    req.headers = headers;
+    process.nextTick(() => {
+        if (body !== '')
+            req.push(body);
+        req.push(null);
+    });
+    return req;
+}
+function makeResponse() {
+    return {
+        statusCode: 200,
+        headersSent: false,
+        headers: {},
+        body: '',
+        writeHead(statusCode, headers) {
+            this.statusCode = statusCode;
+            this.headers = { ...this.headers, ...headers };
+            this.headersSent = true;
+            return this;
+        },
+        setHeader(name, value) {
+            this.headers[name.toLowerCase()] = value;
+        },
+        end(chunk) {
+            if (chunk !== undefined)
+                this.body += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk;
+            this.headersSent = true;
+            return this;
+        },
+        destroy() {
+            this.headersSent = true;
+        },
+    };
+}
+function parseBody(res) {
+    return JSON.parse(res.body);
+}
+function helperResult(input) {
+    const parsed = JSON.parse(String(input));
+    return parsed;
+}
+function runArtifactHelper(canvasHomePath, piAgentDirPath, artifactPath) {
+    const proc = spawnSync(process.execPath, ['--input-type=module', '-e', PUBLIC_SOURCE_FILE_READ_SCRIPT], {
+        input: JSON.stringify({ canvasHome: canvasHomePath, piAgentDir: piAgentDirPath, path: artifactPath }),
+        encoding: 'utf8',
+    });
+    return {
+        status: proc.status,
+        stdout: proc.stdout,
+        stderr: proc.stderr,
+    };
+}
+test('regression: public source gate allows stdin only on crtr node new/msg writes (fixes MAJOR 1)', async () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-gate-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath);
+    const runtime = makeRuntime(statePath);
+    const calls = [];
+    const allowedExecCases = [
+        { kind: 'exec', bin: 'crtr', args: ['canvas', 'snapshot', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'inspect', 'show', nodeId, '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'snapshot', nodeId, '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'new', '--kind', 'developer', '--cwd', '/home/agent/project', '--name', 'spawned-child', '--model', 'claude-sonnet-4', '--parent', nodeId, '--json'], stdin: 'spawn prompt body' },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'msg', nodeId, '--json'], stdin: 'ping the node body' },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'msg', nodeId, '--tier', 'urgent', '--json'], stdin: 'ping the node with tier' },
+        { kind: 'exec', bin: 'crtr', args: ['canvas', 'revive', nodeId, '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['canvas', 'revive', nodeId, '--fresh', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'close', '--node', nodeId, '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] },
+    ];
+    const guestSource = async (_tenantId, request) => {
+        calls.push({ tenantId: _tenantId, request });
+        const typed = request;
+        if (typed.kind === 'exec' && typed.bin === 'node' && Array.isArray(typed.args) && typed.args.includes(PUBLIC_SOURCE_FILE_READ_SCRIPT)) {
+            const payload = JSON.parse(typed.stdin ?? '{}');
+            const fileContent = payload.path?.endsWith('/reports/report.md') ? 'reports artifact contents' : 'context artifact contents';
+            return {
+                ok: true,
+                exitCode: 0,
+                stdout: JSON.stringify({ ok: true, stdout: fileContent }),
+                stderr: '',
+            };
+        }
+        return {
+            ok: true,
+            exitCode: 0,
+            stdout: 'allowed exec ok',
+            stderr: '',
+        };
+    };
+    for (const request of allowedExecCases) {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify(request)), res, runtime, { guestSource });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+        assert.deepEqual(parseBody(res), {
+            ok: true,
+            exitCode: 0,
+            stdout: 'allowed exec ok',
+            stderr: '',
+        });
+    }
+    const env = guestEnv(runtime.m0);
+    const contextPath = `${env.CRTR_HOME}/nodes/${nodeId}/context/note.md`;
+    const reportsPath = `${env.CRTR_HOME}/nodes/${nodeId}/reports/report.md`;
+    for (const filePath of [contextPath, reportsPath]) {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ kind: 'file', path: filePath })), res, runtime, { guestSource });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+        assert.deepEqual(parseBody(res), {
+            ok: true,
+            stdout: filePath.endsWith('/reports/report.md') ? 'reports artifact contents' : 'context artifact contents',
+            stderr: '',
+            exitCode: 0,
+        });
+    }
+    const helperCall = calls.find((call) => {
+        const request = call.request;
+        return request.kind === 'exec' && request.bin === 'node' && Array.isArray(request.args) && request.args.includes(PUBLIC_SOURCE_FILE_READ_SCRIPT);
+    });
+    assert.ok(helperCall);
+    const helperRequest = helperCall?.request;
+    assert.ok(helperRequest.stdin);
+    const helperPayload = JSON.parse(helperRequest.stdin ?? '{}');
+    assert.equal(helperPayload.canvasHome, env.CRTR_HOME);
+    assert.equal(helperPayload.piAgentDir, env.PI_CODING_AGENT_DIR);
+    assert.ok(helperPayload.path?.startsWith(`${env.CRTR_HOME}/nodes/${nodeId}/`));
+    const invalidRequests = [
+        { kind: 'exec', bin: 'node', args: ['-v'], stdin: 'browser-supplied stdin' },
+        { kind: 'exec', bin: 'sh', args: ['-c', 'pwd'] },
+        { kind: 'exec', bin: 'git', args: ['status', '--json'], stdin: 'browser-supplied stdin' },
+        { kind: 'exec', bin: 'gh', args: ['issue', 'list', '--json'] },
+        { kind: 'exec', bin: 'capture', args: ['shot', '--json'] },
+        { kind: 'exec', bin: 'tmux', args: ['list-sessions', '--json'] },
+        { kind: 'exec', bin: 'pwd', args: ['--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['canvas', 'status', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['canvas', 'snapshot', '--extra', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'inspect', 'show', nodeId, '--extra', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'new', '--kind', 'developer', '--json'], stdin: 'x'.repeat(16 * 1024 + 1) },
+        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--extra', '--json'] },
+        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'], cwd: '/tmp' },
+        { kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'], stdin: 'browser-supplied stdin' },
+        { kind: 'exec', bin: 'crtr', args: ['node', 'close', '--node', nodeId] },
+        { kind: 'http', method: 'GET', url: 'https://example.invalid' },
+        { kind: 'file', path: `${env.PI_CODING_AGENT_DIR}/auth.json` },
+        { kind: 'file', path: '/etc/passwd' },
+        { kind: 'file', path: `${env.CRTR_HOME}/nodes/${nodeId}/context/../reports/report.md` },
+        { kind: 'file', path: `${env.CRTR_HOME}/nodes/${nodeId}/secret/x.md` },
+        { kind: 'file', path: `${env.CRTR_HOME}\\nodes\\${nodeId}\\context\\note.md` },
+    ];
+    for (const request of invalidRequests) {
+        const res = makeResponse();
+        let called = 0;
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify(request)), res, runtime, {
+            guestSource: async () => {
+                called += 1;
+                throw new Error('guest should not run for rejected source requests');
+            },
+        });
+        assert.equal(handled, true);
+        assert.equal(called, 0);
+        assert.equal(res.statusCode, 403);
+    }
+});
+test('routeRequest dispatches source and model-auth before proxy fallback', async () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-route-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath);
+    const runtime = makeRuntime(statePath);
+    let sourceCalls = 0;
+    const sourceRes = makeResponse();
+    await routeRequest(makeRequest('POST', '/__crtr/source', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), sourceRes, runtime, {
+        sourceGate: {
+            guestSource: async () => {
+                sourceCalls += 1;
+                return { ok: true, exitCode: 0, stdout: 'source routed', stderr: '' };
+            },
+        },
+    });
+    assert.equal(sourceCalls, 1);
+    assert.equal(sourceRes.statusCode, 200);
+    assert.deepEqual(parseBody(sourceRes), {
+        ok: true,
+        exitCode: 0,
+        stdout: 'source routed',
+        stderr: ''
+    });
+    let modelCalls = 0;
+    const modelRes = makeResponse();
+    await routeRequest(makeRequest('GET', '/__hearth/model-auth/anthropic/status', { authorization: `Bearer ${ownerToken}` }), modelRes, runtime, {
+        modelAuth: {
+            guestSource: async () => {
+                modelCalls += 1;
+                return {
+                    ok: true,
+                    exitCode: 0,
+                    stdout: JSON.stringify({ storedOauth: false, expiresAt: null, adapterConfigured: true }),
+                    stderr: '',
+                };
+            },
+        },
+    });
+    assert.equal(modelCalls, 1);
+    assert.equal(modelRes.statusCode, 200);
+    assert.deepEqual(parseBody(modelRes), {
+        storedOauth: false,
+        expiresAt: null,
+        adapterConfigured: true,
+    });
+});
+test('public source gate enforces owner write auth and leaves non-source chat routes alone', async () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-auth-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath);
+    const runtime = makeRuntime(statePath);
+    let rejectedGuestCalls = 0;
+    const rejectingGuestSource = async () => {
+        rejectedGuestCalls += 1;
+        return { ok: true, exitCode: 0, stdout: 'ok', stderr: '' };
+    };
+    {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source?token=' + encodeURIComponent(ownerToken), {}, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: rejectingGuestSource });
+        assert.equal(handled, true);
+        assert.equal(rejectedGuestCalls, 0);
+        assert.equal(res.statusCode, 401);
+    }
+    {
+        rejectedGuestCalls = 0;
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
+            cookie: `hearth_owner=${encodeURIComponent(ownerToken)}`,
+        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: rejectingGuestSource });
+        assert.equal(handled, true);
+        assert.equal(rejectedGuestCalls, 0);
+        assert.equal(res.statusCode, 403);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
+            cookie: `hearth_owner=${encodeURIComponent(ownerToken)}`,
+            origin: publicOrigin,
+        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('POST', '/__crtr/source', {
+            authorization: `Bearer ${ownerToken}`,
+        }, JSON.stringify({ kind: 'exec', bin: 'crtr', args: ['view', 'list', '--json'] })), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handlePublicSourceRequest(makeRequest('GET', '/node/' + nodeId, { authorization: `Bearer ${ownerToken}` }), res, runtime, { guestSource: async () => ({ ok: true, exitCode: 0, stdout: 'ok', stderr: '' }) });
+        assert.equal(handled, false);
+        assert.equal(res.headersSent, false);
+    }
+});
+test('the guest artifact helper enforces realpath containment before reading', () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-'));
+    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
+    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
+    mkdirSync(canvasHomePath, { recursive: true });
+    mkdirSync(piAgentDirPath, { recursive: true });
+    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
+    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
+    const contextDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'context');
+    const reportsDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'reports');
+    mkdirSync(contextDir, { recursive: true });
+    mkdirSync(reportsDir, { recursive: true });
+    const contextFile = join(contextDir, 'note.md');
+    const reportsFile = join(reportsDir, 'report.md');
+    writeFileSync(contextFile, 'context artifact contents', 'utf8');
+    writeFileSync(reportsFile, 'reports artifact contents', 'utf8');
+    const outsideFile = join(tempDir, 'outside.txt');
+    writeFileSync(outsideFile, 'sensitive contents', 'utf8');
+    const leakLink = join(contextDir, 'leak.md');
+    symlinkSync(outsideFile, leakLink);
+    const contextRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, contextFile);
+    assert.equal(contextRun.status, 0);
+    const contextResult = helperResult(contextRun.stdout.trim());
+    assert.equal(contextResult.ok, true);
+    assert.equal(contextResult.stdout, 'context artifact contents');
+    const reportsRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, reportsFile);
+    assert.equal(reportsRun.status, 0);
+    const reportsResult = helperResult(reportsRun.stdout.trim());
+    assert.equal(reportsResult.ok, true);
+    assert.equal(reportsResult.stdout, 'reports artifact contents');
+    const mixedSeparatorPath = `${canonicalCanvasHomePath}/nodes\\${nodeId}\\context\\note.md`;
+    const mixedSeparatorRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, mixedSeparatorPath);
+    assert.equal(mixedSeparatorRun.status, 0);
+    const mixedSeparatorResult = helperResult(mixedSeparatorRun.stdout.trim());
+    assert.equal(mixedSeparatorResult.ok, false);
+    assert.equal(mixedSeparatorResult.status, 403);
+    const leakRun = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, leakLink);
+    assert.equal(leakRun.status, 0);
+    const leakResult = helperResult(leakRun.stdout.trim());
+    assert.equal(leakResult.ok, false);
+    assert.equal(leakResult.status, 403);
+    assert.ok(!leakResult.error?.includes('sensitive'));
+});
+test('the guest artifact helper rejects hard-linked aliases to secrets under an allowed artifact root', () => {
+    // Regression for the hard-link alias bypass found in the public source gate.
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-hardlink-'));
+    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
+    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
+    mkdirSync(canvasHomePath, { recursive: true });
+    mkdirSync(piAgentDirPath, { recursive: true });
+    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
+    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
+    const contextDir = join(canonicalCanvasHomePath, 'nodes', nodeId, 'context');
+    mkdirSync(contextDir, { recursive: true });
+    const secretPath = join(piAgentDirPath, 'auth.json');
+    writeFileSync(secretPath, 'super-secret-token', 'utf8');
+    const hardLinkPath = join(contextDir, 'auth.json');
+    linkSync(secretPath, hardLinkPath);
+    const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, hardLinkPath);
+    assert.equal(run.status, 0);
+    const result = helperResult(run.stdout.trim());
+    assert.equal(result.ok, false);
+    assert.equal(result.status, 403);
+    assert.ok(!result.error?.includes('super-secret-token'));
+});
+test('the guest artifact helper rejects a symlinked nodesBase root', () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-nodes-base-'));
+    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
+    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
+    mkdirSync(canvasHomePath, { recursive: true });
+    mkdirSync(piAgentDirPath, { recursive: true });
+    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
+    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
+    const nodesDir = join(canonicalCanvasHomePath, 'nodes');
+    mkdirSync(canonicalCanvasHomePath, { recursive: true });
+    const outsideNodes = join(tempDir, 'outside-nodes');
+    const canonicalNodeId = 'evil-node';
+    mkdirSync(join(outsideNodes, canonicalNodeId, 'context'), { recursive: true });
+    writeFileSync(join(outsideNodes, canonicalNodeId, 'context', 'note.md'), 'sensitive nodesBase contents', 'utf8');
+    symlinkSync(outsideNodes, nodesDir);
+    const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, join(nodesDir, canonicalNodeId, 'context', 'note.md'));
+    assert.equal(run.status, 0);
+    const result = helperResult(run.stdout.trim());
+    assert.equal(result.ok, false);
+    assert.equal(result.status, 403);
+    assert.ok(!result.error?.includes('sensitive'));
+});
+test('the guest artifact helper rejects symlinked roots, ancestor subdirectories, and symlinked node directories that escape the canonical nodes tree', () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-source-helper-symlink-'));
+    const canvasHomePath = join(tempDir, '.crtr-local', 'canvas');
+    const piAgentDirPath = join(tempDir, '.crtr-local', 'pi', 'agent');
+    mkdirSync(canvasHomePath, { recursive: true });
+    mkdirSync(piAgentDirPath, { recursive: true });
+    const canonicalCanvasHomePath = realpathSync(canvasHomePath);
+    const canonicalPiAgentDirPath = realpathSync(piAgentDirPath);
+    const nodesDir = join(canonicalCanvasHomePath, 'nodes');
+    const canonicalNodeId = 'evil-node';
+    const canonicalNodeDir = join(nodesDir, canonicalNodeId);
+    mkdirSync(canonicalNodeDir, { recursive: true });
+    const assertBlockedArtifact = (artifactPath) => {
+        const run = runArtifactHelper(canonicalCanvasHomePath, canonicalPiAgentDirPath, artifactPath);
+        assert.equal(run.status, 0);
+        const result = helperResult(run.stdout.trim());
+        assert.equal(result.ok, false);
+        assert.equal(result.status, 403);
+        assert.ok(!result.error?.includes('sensitive'));
+    };
+    const contextOutside = join(tempDir, 'outside-context');
+    mkdirSync(contextOutside, { recursive: true });
+    writeFileSync(join(contextOutside, 'note.md'), 'sensitive context contents', 'utf8');
+    symlinkSync(contextOutside, join(canonicalNodeDir, 'context'));
+    assertBlockedArtifact(join(canonicalNodeDir, 'context', 'note.md'));
+    const contextSubOutside = join(tempDir, 'outside-context-sub');
+    mkdirSync(contextSubOutside, { recursive: true });
+    writeFileSync(join(contextSubOutside, 'file'), 'sensitive ancestor subdir contents', 'utf8');
+    symlinkSync(contextSubOutside, join(canonicalNodeDir, 'context', 'sub'));
+    assertBlockedArtifact(join(canonicalNodeDir, 'context', 'sub', 'file'));
+    const reportsOutside = join(tempDir, 'outside-reports');
+    mkdirSync(reportsOutside, { recursive: true });
+    writeFileSync(join(reportsOutside, 'report.md'), 'sensitive reports contents', 'utf8');
+    symlinkSync(reportsOutside, join(canonicalNodeDir, 'reports'));
+    assertBlockedArtifact(join(canonicalNodeDir, 'reports', 'report.md'));
+    const symlinkedNodeId = 'evil-node-link';
+    const outsideNodeDir = join(tempDir, 'outside-node');
+    mkdirSync(join(outsideNodeDir, 'context'), { recursive: true });
+    writeFileSync(join(outsideNodeDir, 'context', 'note.md'), 'sensitive node contents', 'utf8');
+    symlinkSync(outsideNodeDir, join(nodesDir, symlinkedNodeId));
+    assertBlockedArtifact(join(nodesDir, symlinkedNodeId, 'context', 'note.md'));
+});

package/dist/hearth/wake-proxy/__tests__/static-asset-allowlist.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hearth/wake-proxy/__tests__/static-asset-allowlist.test.js

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { isPublicStaticAssetPath } from '../proxy.js';
+test('wake proxy treats SPA bundle and shell assets as public', () => {
+    assert.equal(isPublicStaticAssetPath('/assets/index-1234abcd.js'), true);
+    assert.equal(isPublicStaticAssetPath('/assets/style-1234abcd.css'), true);
+    assert.equal(isPublicStaticAssetPath('/favicon.ico'), true);
+    assert.equal(isPublicStaticAssetPath('/vite.svg'), true);
+});
+test('wake proxy keeps app routes behind auth', () => {
+    assert.equal(isPublicStaticAssetPath('/'), false);
+    assert.equal(isPublicStaticAssetPath('/views/chat'), false);
+    assert.equal(isPublicStaticAssetPath('/__crtr/events'), false);
+    assert.equal(isPublicStaticAssetPath('/node/mqt64sus-e71caa94'), false);
+});

package/dist/hearth/wake-proxy/__tests__/warm-path-concurrency.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hearth/wake-proxy/__tests__/warm-path-concurrency.test.js

@@ -0,0 +1,141 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { ensureAwake, configureWakeProxyRuntime, wakeProxyInternals } from '../home.js';
+// Regression for the live soak stall (REPORT.md): every HTTP forward and WS connect funneled through
+// the per-tenant serial wake lock, so a reconnect/SSE/asset burst queued behind each other for up to
+// the 150s wake timeout while the home was directly healthy (<0.4s). The warm read path must NOT run
+// N serial slow probes and must NOT wait behind a stale slow wake when a fresh warm verdict exists.
+const tenantId = 'silas';
+const machineId = 'igd2fkrn1y1ol3vw5i6mt';
+const nodeId = 'mqt64sus-e71caa94';
+const routeUrl = 'https://7878-igd2fkrn1y1ol3vw5i6mt.example.dev';
+const now = '2026-06-25T00:00:00.000Z';
+function makeHome(overrides = {}) {
+    return {
+        tenantId,
+        providerName: 'none',
+        machineId,
+        homeStorage: {
+            kind: 'volume',
+            durability: 'durable-volume',
+            longTermContract: true,
+            ownerMachineId: machineId,
+            guestHome: '/home/agent',
+            volumeId: '48b59d07-8cc9-46f9-bdfd-ac99a55dff40',
+            mountPath: '/home/agent',
+        },
+        state: 'running',
+        nodeId,
+        relayToken: 'relay-token',
+        webRoute: {
+            routeId: '7878-igd2fkrn1y1ol3vw5i6mt.example.dev',
+            machineId,
+            targetPort: 7878,
+            url: routeUrl,
+            concreteUrl: routeUrl,
+            concreteUrlSource: 'provider',
+            createdAt: now,
+            raw: null,
+        },
+        createdAt: now,
+        updatedAt: now,
+        ...overrides,
+    };
+}
+function makeRuntime(registryPath, statePath) {
+    return {
+        proxy: {
+            host: '127.0.0.1',
+            port: 7878,
+            publicOrigin: 'https://hearth-wake-proxy.fly.dev',
+            statePath,
+            m0RegistryPath: registryPath,
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            ownerTokenHash: 'hash',
+            idlePauseMs: 0,
+            wakeTimeoutMs: 30_000,
+            readyTimeoutMs: 2_000,
+            cookieSecure: true,
+            seedHome: null,
+        },
+        m0: {
+            providerName: 'none',
+            registryPath,
+            guestUser: 'agent',
+            guestHome: '/home/agent',
+            guestCodePath: '/opt/crouter',
+            webPort: 7878,
+            nodeKind: 'general',
+            piPackages: [],
+            piAuthJson: null,
+            relayToken: null,
+        },
+    };
+}
+function setup() {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-hearth-warm-'));
+    const registryPath = join(tempDir, 'homes.json');
+    const statePath = join(tempDir, 'state.json');
+    writeFileSync(registryPath, `${JSON.stringify({ [tenantId]: makeHome() }, null, 2)}\n`, 'utf8');
+    // configureWakeProxyRuntime resets the warm-verdict/in-flight caches, isolating each test.
+    configureWakeProxyRuntime(makeRuntime(registryPath, statePath));
+}
+const awakened = { tenantId, nodeId, routeUrl, relayToken: 'relay-token', machineId, webPort: 7878 };
+test('concurrent ensureAwake calls coalesce onto ONE slow probe instead of N serial probes', async (t) => {
+    setup();
+    let releaseProbe;
+    const probeGate = new Promise((resolve) => {
+        releaseProbe = resolve;
+    });
+    const probe = t.mock.method(wakeProxyInternals, 'probeRelayServing', async () => {
+        await probeGate;
+        return true;
+    });
+    t.mock.method(wakeProxyInternals, 'touchTenantWake', async () => undefined);
+    t.mock.method(wakeProxyInternals, 'captureAwakeHome', async () => awakened);
+    const wake = t.mock.method(wakeProxyInternals, 'wakeHome', async () => {
+        throw new Error('wakeHome should not run on the warm path');
+    });
+    // Fire five concurrent callers while the (slow) probe is still gated. They must all share the
+    // single in-flight wake — only one probe runs, not five serialized behind the lock.
+    const calls = [
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+    ];
+    // The lock dispatches runEnsureAwake on a microtask, so let that settle before counting; the
+    // probe is gated so it stays at exactly one in-flight call.
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    const probeCallsWhileGated = probe.mock.callCount();
+    releaseProbe();
+    const results = await Promise.all(calls);
+    assert.equal(probeCallsWhileGated, 1);
+    assert.equal(probe.mock.callCount(), 1);
+    assert.equal(wake.mock.callCount(), 0);
+    for (const result of results)
+        assert.equal(result.routeUrl, routeUrl);
+});
+test('a fresh warm verdict serves concurrent reads WITHOUT re-probing or waiting on the slow path', async (t) => {
+    setup();
+    // Freeze time so the verdict stays inside its TTL across the test.
+    t.mock.method(wakeProxyInternals, 'now', () => 1_000);
+    const probe = t.mock.method(wakeProxyInternals, 'probeRelayServing', async () => true);
+    t.mock.method(wakeProxyInternals, 'touchTenantWake', async () => undefined);
+    t.mock.method(wakeProxyInternals, 'captureAwakeHome', async () => awakened);
+    // Prime: first call probes once and records the warm verdict.
+    await ensureAwake(tenantId);
+    assert.equal(probe.mock.callCount(), 1);
+    // Concurrent reads inside the TTL must resolve purely from the warm verdict — no extra probe,
+    // no re-entering the slow wake path. A regression that dropped back into the lock would bump the
+    // probe count past 1 here.
+    const results = await Promise.all([ensureAwake(tenantId), ensureAwake(tenantId), ensureAwake(tenantId)]);
+    assert.equal(probe.mock.callCount(), 1);
+    for (const result of results)
+        assert.equal(result.routeUrl, routeUrl);
+});

package/dist/hearth/wake-proxy/__tests__/ws-teardown-accounting.test.d.ts

@@ -0,0 +1 @@
+export {};