@dharma-ai-labs/agent-fabric 0.2.142 → 0.2.144

package/dist/repositoryLaunchers.test.js

@@ -0,0 +1,92 @@
+import assert from 'node:assert/strict';
+import { chmod, copyFile, mkdir, mkdtemp, readFile, realpath, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+test('a recorded pinned directory is accepted only for the identical protected Node binary', async () => {
+    const { stableRepositoryLauncherContents, verifyRecordedRepositoryLaunchers } = await import('./repositoryLaunchers.js');
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'dharma-recorded-node-')));
+    const current = join(root, 'current'), prior = join(root, "prior ' node");
+    await mkdir(current);
+    await mkdir(prior);
+    const name = process.platform === 'win32' ? 'node.exe' : 'node';
+    const nodePath = join(current, name), recorded = join(prior, name);
+    await writeFile(nodePath, 'qualified synthetic binary', { mode: 0o700 });
+    await copyFile(nodePath, recorded);
+    await chmod(recorded, 0o700);
+    const runtime = { platform: process.platform, nodePath };
+    const launchers = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: prior });
+    assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', launchers, runtime), true);
+    for (const changed of [
+        { ...launchers, shell: launchers.shell + 'echo extra\n' },
+        { ...launchers, windows: launchers.windows + 'echo extra\r\n' },
+        { ...launchers, shell: launchers.shell.replace('0.2.138', '0.2.139') },
+        { ...launchers, shell: launchers.shell.replace('npm exec', 'sh exec') },
+    ])
+        assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', changed, runtime), false);
+    assert.equal(await verifyRecordedRepositoryLaunchers('invalid;command', launchers, runtime), false);
+    await writeFile(recorded, 'unqualified synthetic data');
+    assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', launchers, runtime), false);
+    assert.equal(await readFile(nodePath, 'utf8'), 'qualified synthetic binary');
+});
+test('recorded binary protection, canonical paths and availability remain required', async () => {
+    const { stableRepositoryLauncherContents, verifyRecordedRepositoryLaunchers } = await import('./repositoryLaunchers.js');
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'dharma-recorded-node-')));
+    const nodePath = join(root, process.platform === 'win32' ? 'node.exe' : 'node');
+    await writeFile(nodePath, 'qualified synthetic binary', { mode: 0o700 });
+    const runtime = { platform: process.platform, nodePath };
+    const absent = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: join(root, 'absent') });
+    assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', absent, runtime), false);
+    const alias = join(root, 'alias');
+    await symlink(root, alias, process.platform === 'win32' ? 'junction' : 'dir');
+    const aliased = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: alias });
+    assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', aliased, runtime), false);
+    if (process.platform !== 'win32') {
+        const linkDirectory = join(root, 'linked');
+        await mkdir(linkDirectory);
+        await symlink(nodePath, join(linkDirectory, 'node'));
+        const linked = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: linkDirectory });
+        assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', linked, runtime), false);
+        await chmod(nodePath, 0o722);
+        const writable = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: root });
+        assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', writable, runtime), false);
+    }
+});
+test('a changed Node binary with identical size is not a trusted runtime', async () => {
+    const { stableRepositoryLauncherContents, verifyRecordedRepositoryLaunchers } = await import('./repositoryLaunchers.js');
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'dharma-recorded-node-')));
+    const prior = join(root, 'prior');
+    await mkdir(prior);
+    const name = process.platform === 'win32' ? 'node.exe' : 'node';
+    const nodePath = join(root, name);
+    await writeFile(nodePath, Buffer.alloc(128, 1), { mode: 0o700 });
+    await writeFile(join(prior, name), Buffer.alloc(128, 2), { mode: 0o700 });
+    const launchers = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: prior });
+    assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', launchers, { platform: process.platform, nodePath }), false);
+});
+test('an alternate Node directory cannot shadow npm or other startup executables', async () => {
+    const { stableRepositoryLauncherContents, verifyRecordedRepositoryLaunchers } = await import('./repositoryLaunchers.js');
+    for (const injected of ['npm', 'npm.cmd', 'sh', 'unapproved']) {
+        const root = await realpath(await mkdtemp(join(tmpdir(), 'dharma-recorded-node-')));
+        const prior = join(root, 'prior');
+        await mkdir(prior);
+        const name = process.platform === 'win32' ? 'node.exe' : 'node', nodePath = join(root, name);
+        await writeFile(nodePath, 'qualified synthetic binary', { mode: 0o700 });
+        await copyFile(nodePath, join(prior, name));
+        await chmod(join(prior, name), 0o700);
+        await writeFile(join(prior, injected), 'unapproved PATH entry');
+        const launchers = stableRepositoryLauncherContents('0.2.138', { platform: process.platform, nodeDirectory: prior });
+        assert.equal(await verifyRecordedRepositoryLaunchers('0.2.138', launchers, { platform: process.platform, nodePath }), false);
+    }
+});
+test('pinned runtime grammar round trips POSIX quotes and Windows percent characters', async () => {
+    const { stableRepositoryLauncherContents, recordedRepositoryNodeDirectory } = await import('./repositoryLaunchers.js');
+    for (const runtime of [{ platform: 'linux', nodeDirectory: "/approved/a ' b/bin" },
+        { platform: 'win32', nodeDirectory: 'C:\\approved\\%pinned%\\bin' }]) {
+        const contents = stableRepositoryLauncherContents('0.2.138', runtime);
+        assert.equal(recordedRepositoryNodeDirectory('0.2.138', contents, runtime.platform), runtime.nodeDirectory);
+        assert.equal(recordedRepositoryNodeDirectory('0.2.139', contents, runtime.platform), undefined);
+        assert.equal(recordedRepositoryNodeDirectory('0.2.138', { ...contents, windows: contents.windows + 'extra' }, runtime.platform), undefined);
+    }
+});
+//# sourceMappingURL=repositoryLaunchers.test.js.map

package/dist/repositoryLaunchers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositoryLaunchers.test.js","sourceRoot":"","sources":["../src/repositoryLaunchers.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3G,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,SAAS,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3F,KAAK,MAAM,OAAO,IAAI;QACpB,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,GAAG,cAAc,EAAE;QACzD,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,GAAG,gBAAgB,EAAE;QAC/D,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE;QACtE,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE;KACxE;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACpG,MAAM,SAAS,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChI,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3B,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QACzH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,MAAM,EAAE,gCAAgC,EAAE,iCAAiC,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzH,KAAK,MAAM,QAAQ,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7F,MAAM,SAAS,CAAC,QAAQ,EAAE,4BAA4B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,KAAK,CAAC,MAAM,iCAAiC,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/H,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACvH,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE;QACzF,EAAE,QAAQ,EAAE,OAAgB,EAAE,aAAa,EAAE,6BAA6B,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,gCAAgC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5G,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9I,CAAC;AACH,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dharma-ai-labs/agent-fabric",
-  "version": "0.2.142",
+  "version": "0.2.144",
   "description": "Local-first CLI for connecting coding agents to Dharma evaluation, orchestration, and signed Skill delivery",
   "license": "MIT",
   "homepage": "https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/cli#readme",
@@ -36,7 +36,7 @@
   "dependencies": {
     "@dharma-ai-labs/agent-fabric-contracts": "0.1.14",
     "@dharma-ai-labs/agent-fabric-evidence-reduction": "0.2.28",
-    "@dharma-ai-labs/agent-fabric-local-vault": "0.1.26",
+    "@dharma-ai-labs/agent-fabric-local-vault": "0.1.27",
     "@dharma-ai-labs/agent-fabric-policy": "0.1.4",
     "@dharma-ai-labs/agent-fabric-provider-adapters": "0.1.29",
     "@dharma-ai-labs/agent-fabric-relay-client": "0.2.29",