@gajae-code/coding-agent 0.16.3 → 0.16.6

package/src/extensibility/gjc-plugins/mcp-policy.ts

@@ -158,69 +158,98 @@ export interface StdioPolicyContext {
 	pluginRoot: string;
 }
 
-// Node/Bun flags that can execute or load code outside the bundled script.
-const DANGEROUS_LAUNCHER_FLAGS = [
-	"-e",
-	"--eval",
-	"-p",
-	"--print",
-	"-r",
-	"--require",
-	"--import",
-	"--loader",
-	"--experimental-loader",
-	"--input-type",
-];
+export interface StdioInvocationTarget {
+	kind: "launcher";
+	launcher: "node" | "bun";
+	entrypoint: string;
+	executablePath: string;
+	ownedRelativePath: string;
+	ownedRelativePaths: string[];
+	cwd: string;
+}
 
-/** stdio launcher/path confinement policy. */
-export function assertStdioAllowed(entry: GjcPluginMcpManifestEntry, ctx: StdioPolicyContext): void {
+function isWithinOrEqual(root: string, candidate: string): boolean {
+	return candidate === root || pathIsWithin(root, candidate);
+}
+
+function isCrossPlatformAbsolute(value: string): boolean {
+	return path.posix.isAbsolute(value) || path.win32.isAbsolute(value) || /^[A-Za-z]:/.test(value);
+}
+
+function resolveManifestRelative(base: string, value: string, label: string): string {
+	if (isCrossPlatformAbsolute(value)) fail(`${label} must be relative`);
+	const portable = path.posix.normalize(value.replaceAll("\\", "/"));
+	return path.resolve(base, ...portable.split("/"));
+}
+
+function isFileLikeArgument(value: string): boolean {
+	return value.startsWith(".") || value.includes("/") || value.includes("\\") || isCrossPlatformAbsolute(value);
+}
+
+/**
+ * Resolve the exact executable file selected by the supported stdio grammar.
+ * Bare Node/Bun launchers accept a direct bundled entrypoint as argv[0]; no
+ * manifest-controlled runtime options or subcommands precede it. Path-qualified
+ * commands are unsupported because they bypass the verified module wrapper.
+ */
+export function classifyStdioInvocation(
+	entry: GjcPluginMcpManifestEntry,
+	ctx: StdioPolicyContext,
+): StdioInvocationTarget {
 	const command = entry.command ?? "";
 	if (!command) fail(`MCP "${entry.name}": stdio requires a command`);
 	const root = path.resolve(ctx.pluginRoot);
-	const base = path.basename(command);
-	const isBareLauncher = !command.includes("/") && ALLOWED_STDIO_LAUNCHERS.has(base);
-	const isRootConfinedExecutable = command.includes("/") && pathIsWithin(root, path.resolve(root, command));
-	// Absolute or relative paths must stay inside the plugin root; bare launchers
-	// must be in the allowlist. An absolute /bin/node is rejected (outside root).
-	if (!isBareLauncher && !isRootConfinedExecutable) {
-		fail(`MCP "${entry.name}": stdio command not allowed: ${command}`);
-	}
-	const usesNodeLauncher = isBareLauncher || ALLOWED_STDIO_LAUNCHERS.has(base);
-	const args = entry.args ?? [];
-	// Reject code-eval/loader flags for node/bun launchers.
-	if (usesNodeLauncher) {
-		for (const arg of args) {
-			const flag = arg.split("=")[0];
-			if (DANGEROUS_LAUNCHER_FLAGS.includes(flag)) {
-				fail(`MCP "${entry.name}": stdio launcher flag not allowed: ${arg}`);
-			}
-		}
-		// Require a root-confined script as the first non-flag argument.
-		const firstScript = args.find(a => !a.startsWith("-"));
-		if (!firstScript) {
-			fail(`MCP "${entry.name}": node/bun stdio launcher requires a bundled script argument`);
-		}
-		if (!pathIsWithin(root, path.resolve(root, firstScript))) {
-			fail(`MCP "${entry.name}": stdio script escapes plugin root: ${firstScript}`);
-		}
-	}
-	// cwd must resolve within the plugin root.
-	const cwd = entry.cwd ? path.resolve(root, entry.cwd) : root;
-	if (!pathIsWithin(root, cwd) && cwd !== root) {
+	const cwd = entry.cwd ? resolveManifestRelative(root, entry.cwd, `MCP "${entry.name}": stdio cwd`) : root;
+	if (!isWithinOrEqual(root, cwd)) {
 		fail(`MCP "${entry.name}": stdio cwd escapes plugin root: ${entry.cwd}`);
 	}
-	// File-like args must resolve within the plugin root; reject env-expansion.
+	const args = entry.args ?? [];
 	for (const arg of args) {
 		if (/\$\{?[A-Za-z_]/.test(arg) || arg.includes("`") || arg.includes("$(")) {
 			fail(`MCP "${entry.name}": stdio arg expansion not allowed: ${arg}`);
 		}
-		if (arg.startsWith("-")) continue;
-		if (!arg.startsWith(".") && !arg.includes("/")) continue;
-		const resolvedArg = path.resolve(root, arg);
-		if (!pathIsWithin(root, resolvedArg)) {
-			fail(`MCP "${entry.name}": stdio arg escapes plugin root: ${arg}`);
-		}
 	}
+
+	if (!ALLOWED_STDIO_LAUNCHERS.has(command)) {
+		fail(`MCP "${entry.name}": stdio command not allowed (expected bare node or bun): ${command}`);
+	}
+	const entrypoint = args[0];
+	if (!entrypoint) {
+		fail(`MCP "${entry.name}": node/bun stdio launcher requires a bundled script argument`);
+	}
+	if (entrypoint.startsWith("-")) {
+		fail(`MCP "${entry.name}": stdio launcher options before the bundled entrypoint are not allowed`);
+	}
+	const executablePath = resolveManifestRelative(cwd, entrypoint, `MCP "${entry.name}": stdio launcher entrypoint`);
+	if (!pathIsWithin(root, executablePath)) {
+		fail(`MCP "${entry.name}": stdio script escapes plugin root: ${entrypoint}`);
+	}
+	const extension = path.extname(executablePath).toLowerCase();
+	const allowedExtensions = command === "node" ? new Set([".mjs"]) : new Set([".mjs", ".ts", ".jsx", ".tsx"]);
+	if (!allowedExtensions.has(extension)) {
+		fail(`MCP "${entry.name}": unsupported ${command} entrypoint extension: ${extension || "<none>"}`);
+	}
+	const ownedRelativePaths = [path.relative(root, executablePath)];
+	for (const arg of args.slice(1)) {
+		if (arg.startsWith("-") || !isFileLikeArgument(arg)) continue;
+		const resolvedArg = resolveManifestRelative(cwd, arg, `MCP "${entry.name}": stdio arg`);
+		if (!pathIsWithin(root, resolvedArg)) fail(`MCP "${entry.name}": stdio arg escapes plugin root: ${arg}`);
+		ownedRelativePaths.push(path.relative(root, resolvedArg));
+	}
+	return {
+		kind: "launcher",
+		launcher: command as "node" | "bun",
+		entrypoint,
+		executablePath,
+		ownedRelativePath: ownedRelativePaths[0] as string,
+		ownedRelativePaths,
+		cwd,
+	};
+}
+
+/** stdio launcher/path confinement policy. */
+export function assertStdioAllowed(entry: GjcPluginMcpManifestEntry, ctx: StdioPolicyContext): void {
+	classifyStdioInvocation(entry, ctx);
 }
 
 /**

package/src/extensibility/gjc-plugins/paths.ts

@@ -11,6 +11,19 @@ export function gjcPluginProjectRoot(cwd: string): string {
 	return path.join(cwd, ".gjc", "gjc-plugins");
 }
 
+export function gjcPluginSafeDirectoryName(name: string): string {
+	const segment = name.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "");
+	if (!segment || segment === "." || segment === "..") {
+		throw new GjcPluginLoadError("invalid_manifest", `GJC plugin name is not a safe directory segment: ${name}`);
+	}
+	return segment;
+}
+
+export function gjcPluginInstallRoot(scope: "user" | "project", cwd: string, name: string): string {
+	const root = scope === "user" ? gjcPluginUserRoot() : gjcPluginProjectRoot(cwd);
+	return path.join(root, gjcPluginSafeDirectoryName(name));
+}
+
 function isEnoent(error: unknown): boolean {
 	return (error as NodeJS.ErrnoException).code === "ENOENT";
 }

package/src/extensibility/gjc-plugins/registry.ts

@@ -27,6 +27,117 @@ function isEnoent(error: unknown): boolean {
 	return (error as NodeJS.ErrnoException)?.code === "ENOENT";
 }
 
+function registryRecord(value: unknown, field: string): Record<string, unknown> {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		throw new GjcPluginLoadError("invalid_manifest", `Invalid GJC plugin registry field ${field}`);
+	}
+	return value as Record<string, unknown>;
+}
+
+function rejectRegistryKeys(value: Record<string, unknown>, allowed: readonly string[], field: string): void {
+	const allowedSet = new Set(allowed);
+	for (const key of Object.keys(value)) {
+		if (!allowedSet.has(key)) {
+			throw new GjcPluginLoadError("invalid_manifest", `Unknown GJC plugin registry field ${field}.${key}`);
+		}
+	}
+}
+
+function validateRegistryEntryShape(value: unknown, field: string): void {
+	const entry = registryRecord(value, field);
+	rejectRegistryKeys(
+		entry,
+		[
+			"name",
+			"version",
+			"scope",
+			"enabled",
+			"pluginRoot",
+			"manifestPath",
+			"manifestHash",
+			"source",
+			"installedAt",
+			"updatedAt",
+			"copiedFiles",
+			"surfaces",
+			"disabledSurfaceIds",
+			"quarantine",
+			"migration",
+		],
+		field,
+	);
+	const source = registryRecord(entry.source, `${field}.source`);
+	rejectRegistryKeys(source, ["kind", "uri", "ref", "sha", "resolvedAt"], `${field}.source`);
+	const surfaces = registryRecord(entry.surfaces, `${field}.surfaces`);
+	rejectRegistryKeys(
+		surfaces,
+		["subskills", "tools", "hooks", "mcps", "systemAppendices", "agentAppendices"],
+		`${field}.surfaces`,
+	);
+	const surfaceKeys: Record<string, readonly string[]> = {
+		subskills: [
+			"extensionId",
+			"name",
+			"description",
+			"parent",
+			"phase",
+			"activationArg",
+			"relativePath",
+			"sha256",
+			"toolRefs",
+		],
+		tools: [
+			"extensionId",
+			"name",
+			"relativePath",
+			"sha256",
+			"description",
+			"schema",
+			"schemaHash",
+			"implementationHash",
+			"presentationHash",
+			"metadataVersion",
+		],
+		hooks: [
+			"extensionId",
+			"name",
+			"event",
+			"target",
+			"phase",
+			"relativePath",
+			"sha256",
+			"implementationHash",
+			"capabilities",
+			"networkDestinations",
+			"filesystemRoots",
+			"capabilityHash",
+			"functionHook",
+		],
+		mcps: ["extensionId", "name", "transport", "configHash", "config"],
+		systemAppendices: ["extensionId", "name", "relativePath", "content", "contentHash", "bytes"],
+		agentAppendices: ["extensionId", "name", "relativePath", "content", "contentHash", "bytes", "agent"],
+	};
+	for (const [surfaceName, allowed] of Object.entries(surfaceKeys)) {
+		const items = surfaces[surfaceName];
+		if (!Array.isArray(items))
+			throw new GjcPluginLoadError("invalid_manifest", `Invalid ${field}.surfaces.${surfaceName}`);
+		for (let index = 0; index < items.length; index += 1) {
+			const item = registryRecord(items[index], `${field}.surfaces.${surfaceName}[${index}]`);
+			rejectRegistryKeys(item, allowed, `${field}.surfaces.${surfaceName}[${index}]`);
+		}
+	}
+	if (!Array.isArray(entry.copiedFiles) || !Array.isArray(entry.disabledSurfaceIds)) {
+		throw new GjcPluginLoadError("invalid_manifest", `Invalid GJC plugin registry arrays at ${field}`);
+	}
+	if (entry.quarantine !== undefined && !Array.isArray(entry.quarantine)) {
+		throw new GjcPluginLoadError("invalid_manifest", `Invalid ${field}.quarantine`);
+	}
+	if (entry.migration !== undefined) {
+		const migration = registryRecord(entry.migration, `${field}.migration`);
+		rejectRegistryKeys(migration, ["status", "metadataVersion", "migratedAt", "failure"], `${field}.migration`);
+	}
+}
+
 /**
  * Deterministic ordering: scope (user before project) -> normalized name ->
  * resolved plugin root. Collisions are errors elsewhere; order only controls
@@ -69,8 +180,9 @@ async function readRegistryRaw(scope: GjcPluginScope, cwd: string): Promise<GjcP
 		);
 	if (
 		!Array.isArray(registry.plugins) ||
-		registry.plugins.some(plugin => {
+		registry.plugins.some((plugin, index) => {
 			if (!plugin || typeof plugin !== "object") return true;
+			validateRegistryEntryShape(plugin, `plugins[${index}]`);
 			const entry = plugin as GjcPluginRegistryEntry;
 			return (
 				entry.scope !== scope ||