@gethmy/harness 1.2.1 → 1.4.0

package/src/confine-to-repo.test.ts

@@ -1,5 +1,16 @@
-import { describe, expect, it } from "vitest";
 import {
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  CONFINED_READ_TOOLS,
+  CONFINED_WRITE_TOOLS,
   confineToRepo,
   decideConfinedTool,
   isInsideTree,
@@ -111,6 +122,77 @@ describe("decideConfinedTool", () => {
     });
   });
 
+  it("denies a Glob PATTERN that escapes, not only a Glob path", () => {
+    // `Glob.path` is optional, so a pattern-only call used to fall through the
+    // path loop and be allowed — while node-glob honours an absolute pattern
+    // and a leading `../` regardless of cwd. That enumerated the operator's
+    // credential directory into the branch being pushed (security review of
+    // #1015), and it is exactly the "pinned, therefore looks complete" gap the
+    // `**/*.ts` case above created.
+    expect(decide("Glob", { pattern: "/Users/dev/.claude/**" }).behavior).toBe(
+      "deny",
+    );
+    expect(decide("Glob", { pattern: "../../**/*.json" }).behavior).toBe(
+      "deny",
+    );
+    expect(decide("Glob", { pattern: "~/.ssh/*" }).behavior).toBe("deny");
+    // Grep's `glob` filter is the same shape and gets the same treatment.
+    expect(decide("Grep", { pattern: "x", glob: "/etc/**" }).behavior).toBe(
+      "deny",
+    );
+  });
+
+  it("denies the glob SPELLINGS of `..`, not only the literal one", () => {
+    // The first version rejected an absolute pattern and a literal `..`
+    // segment, and the security review walked past it: brace expansion and
+    // character classes spell the same traversal while reading as ordinary
+    // segments. A probe using `{..,x}/` returned 43 files from `~/.claude`.
+    // The rule is now an allowlist of syntax — `* ** ? /` and literals — so a
+    // NEW spelling cannot reopen it, because the syntax that would carry it is
+    // refused outright.
+    for (const pattern of [
+      "{..,x}/y",
+      "[.][.]/*",
+      "{..,x}/{..,x}/Users/me/.claude/*",
+      "@(..)/x",
+      "!(a)/../x",
+      "+(.)./x",
+    ]) {
+      expect(
+        decide("Glob", { pattern }).behavior,
+        `Glob must refuse ${pattern}`,
+      ).toBe("deny");
+    }
+  });
+
+  it("still allows the plain glob syntax a repair actually needs", () => {
+    for (const pattern of [
+      "**/*.ts",
+      "src/**/*.test.ts",
+      "src/a?.ts",
+      "*.md",
+    ]) {
+      expect(decide("Glob", { pattern }), pattern).toEqual({
+        behavior: "allow",
+      });
+    }
+  });
+
+  it("does not mistake an ordinary name for traversal", () => {
+    // `..` must match a SEGMENT. A file called `a..b` or `..rc` is not an
+    // escape, and denying it would make the guard read as broken.
+    expect(decide("Glob", { pattern: "src/**/a..b.ts" })).toEqual({
+      behavior: "allow",
+    });
+    expect(decide("Glob", { pattern: "**/..eslintrc" })).toEqual({
+      behavior: "allow",
+    });
+    // `Grep.pattern` is a REGEX, never a path — `..` there is "any two chars".
+    expect(decide("Grep", { pattern: "foo..bar" })).toEqual({
+      behavior: "allow",
+    });
+  });
+
   it("ignores a non-string or empty path rather than crashing", () => {
     expect(decide("Read", { file_path: 42 })).toEqual({ behavior: "allow" });
     expect(decide("Read", { file_path: "" })).toEqual({ behavior: "allow" });
@@ -142,3 +224,244 @@ describe("confineToRepo", () => {
     ).resolves.toMatchObject({ behavior: "deny" });
   });
 });
+
+// --- the write surface (#1015) ---
+
+describe("write mode", () => {
+  const w = (tool: string, input: Record<string, unknown>) =>
+    decideConfinedTool(ROOT, tool, input, "write");
+
+  it("confines every write tool to the tree", () => {
+    for (const tool of ["Write", "Edit", "MultiEdit"]) {
+      expect(w(tool, { file_path: `${ROOT}/src/a.ts` })).toEqual({
+        behavior: "allow",
+      });
+      expect(w(tool, { file_path: "/etc/cron.d/x" }).behavior).toBe("deny");
+      expect(w(tool, { file_path: `${ROOT}/../elsewhere/x` }).behavior).toBe(
+        "deny",
+      );
+    }
+    expect(w("NotebookEdit", { notebook_path: `${ROOT}/n.ipynb` })).toEqual({
+      behavior: "allow",
+    });
+    expect(w("NotebookEdit", { notebook_path: "/tmp/n.ipynb" }).behavior).toBe(
+      "deny",
+    );
+  });
+
+  it("says WRITE in the refusal, so a denied write is not read as a denied read", () => {
+    const d = w("Write", { file_path: "/etc/passwd" });
+    expect(d).toMatchObject({ behavior: "deny" });
+    if (d.behavior === "deny") expect(d.message).toContain("write");
+  });
+
+  it("still denies the shell and the network tools", () => {
+    // Write mode widens the FILE surface and nothing else. `Bash` is not a
+    // path-carrying tool that got confined; it is absent from the map, which is
+    // a denial.
+    for (const tool of ["Bash", "WebFetch", "WebSearch", "Task", "Agent"]) {
+      expect(w(tool, { command: "id", url: "https://x" }).behavior).toBe(
+        "deny",
+      );
+    }
+  });
+
+  it("does NOT let read mode write — the default is the read-only surface", () => {
+    // The sizing preflight depends on this: it calls `confineToRepo(cwd)` with
+    // no mode, and must not acquire `Write` because this module learned how to
+    // confine one.
+    expect(
+      decideConfinedTool(ROOT, "Write", { file_path: `${ROOT}/a` }),
+    ).toMatchObject({ behavior: "deny" });
+    expect(CONFINED_READ_TOOLS).not.toContain("Write");
+    expect(CONFINED_WRITE_TOOLS).toEqual(
+      expect.arrayContaining(["Read", "Glob", "Grep", "Write", "Edit"]),
+    );
+  });
+});
+
+describe("git metadata", () => {
+  // The host-RCE the previous comment declared impossible. A linked worktree's
+  // `.git` is a regular FILE, so nothing traverses THROUGH it — and the file is
+  // still inside the tree, writable, and holds the pointer to git's config.
+  // Rewrite it to `gitdir: ./g`, write `[core] fsmonitor = ./payload.sh` there,
+  // and the diff gate's own `git status` runs the payload on the daemon host.
+  // No shell, no network tool, no subagent, no sandbox involved.
+  const w = (tool: string, input: Record<string, unknown>) =>
+    decideConfinedTool(ROOT, tool, input, "write");
+
+  it("denies WRITING the worktree's .git pointer", () => {
+    expect(w("Write", { file_path: `${ROOT}/.git` }).behavior).toBe("deny");
+    expect(w("Write", { file_path: ".git" }).behavior).toBe("deny");
+  });
+
+  it("denies anything UNDER a .git directory, at any depth", () => {
+    for (const p of [
+      `${ROOT}/.git/config`,
+      `${ROOT}/.git/hooks/pre-push`,
+      `${ROOT}/sub/.git/config`,
+      "sub/.git/config",
+    ]) {
+      expect(w("Write", { file_path: p }).behavior, p).toBe("deny");
+      expect(decide("Read", { file_path: p }).behavior, p).toBe("deny");
+    }
+  });
+
+  it("denies it in ANY case — the daemon's filesystem is case-insensitive", () => {
+    // macOS and Windows treat `.GIT` and `.git` as the same file, so a
+    // case-sensitive check let a write to `.GIT` through every guard and land
+    // on the real gitdir pointer. Proven to reach host code execution in
+    // review round 5 of #1015, via a `filter` driver in the redirected config.
+    for (const name of [".GIT", ".Git", ".gIt"]) {
+      expect(w("Write", { file_path: `${ROOT}/${name}` }).behavior, name).toBe(
+        "deny",
+      );
+      expect(
+        w("Write", { file_path: `${ROOT}/sub/${name}/config` }).behavior,
+        name,
+      ).toBe("deny");
+    }
+  });
+
+  it("leaves ordinary dot-git-PREFIXED files alone", () => {
+    // Matched as a segment, so these are unaffected — denying them would make
+    // the guard read as broken and invite someone to loosen it.
+    for (const p of [".gitignore", "src/.gitkeep", ".github/CODEOWNERS"]) {
+      expect(w("Write", { file_path: `${ROOT}/${p}` }), p).toEqual({
+        behavior: "allow",
+      });
+    }
+  });
+});
+
+describe("symlinks", () => {
+  // The escape a purely lexical check cannot see: a link INSIDE the tree whose
+  // target is outside it. Every path under `<tree>/escape` is inside the tree by
+  // string comparison and outside it in fact — and the repair spawn can both
+  // create such a link's contents and write through one that a branch already
+  // carries.
+  let tree: string;
+  let outside: string;
+
+  beforeAll(() => {
+    const base = mkdtempSync(join(tmpdir(), "confine-"));
+    tree = join(base, "repo");
+    outside = join(base, "secrets");
+    mkdirSync(tree);
+    mkdirSync(outside);
+    writeFileSync(join(outside, "credentials.json"), "{}");
+    symlinkSync(outside, join(tree, "escape"));
+    symlinkSync(join(outside, "credentials.json"), join(tree, "creds.json"));
+  });
+
+  afterAll(() => {
+    rmSync(tree, { recursive: true, force: true });
+    rmSync(outside, { recursive: true, force: true });
+  });
+
+  it("denies a read THROUGH a symlink that points out of the tree", () => {
+    expect(
+      decideConfinedTool(tree, "Read", {
+        file_path: join(tree, "creds.json"),
+      }).behavior,
+    ).toBe("deny");
+    expect(
+      decideConfinedTool(tree, "Read", {
+        file_path: join(tree, "escape", "credentials.json"),
+      }).behavior,
+    ).toBe("deny");
+  });
+
+  it("denies a WRITE through one too — the exfiltration direction", () => {
+    expect(
+      decideConfinedTool(
+        tree,
+        "Write",
+        { file_path: join(tree, "escape", "planted.sh") },
+        "write",
+      ).behavior,
+    ).toBe("deny");
+  });
+
+  it("still allows an ordinary path, and one that does not exist yet", () => {
+    // A `Write` creating a new file is the ordinary case, and it must not be
+    // denied merely because `realpath` cannot resolve a file that is not there.
+    expect(
+      decideConfinedTool(
+        tree,
+        "Write",
+        { file_path: join(tree, "src", "brand", "new.ts") },
+        "write",
+      ),
+    ).toEqual({ behavior: "allow" });
+    expect(
+      decideConfinedTool(tree, "Read", { file_path: join(tree, "any.ts") }),
+    ).toEqual({ behavior: "allow" });
+  });
+
+  it("denies `<in-tree symlink>/../X`, which a lexical check reads as inside", () => {
+    // The escape a resolve()-then-realpath check cannot see, found in the
+    // security review of #1015. `path.resolve` removes `..` TEXTUALLY, folding
+    // `escape/../STOLEN` to `<tree>/STOLEN` — inside the tree. The kernel
+    // removes it only AFTER following `escape`, landing on `<outside>/STOLEN`.
+    // A package install routinely creates such links, so this is ordinary.
+    // Built as a raw string, NOT with `join`: `path.join` normalises `..` away
+    // lexically, which is the very bug under test — it would hand the checker
+    // an already-collapsed path and prove nothing.
+    const through = `${tree}/escape/../STOLEN.txt`;
+    for (const tool of ["Read", "Grep", "Glob"]) {
+      const key = tool === "Read" ? "file_path" : "path";
+      expect(
+        decideConfinedTool(tree, tool, { [key]: through }).behavior,
+        `${tool} must not be fooled by a symlink followed by ..`,
+      ).toBe("deny");
+    }
+    expect(
+      decideConfinedTool(
+        tree,
+        "Write",
+        { file_path: `${tree}/escape/../planted.sh` },
+        "write",
+      ).behavior,
+    ).toBe("deny");
+  });
+
+  it("denies a RELATIVE path through the same symlink", () => {
+    // The half the first fix missed: the absolute branch walked the path
+    // correctly while the relative branch still called `resolve()`, folding
+    // `..` textually. `Grep`/`Glob` `path` naturally take relative values, so
+    // this was the reachable half — and the guard read as closed.
+    for (const tool of ["Read", "Grep", "Glob"]) {
+      const key = tool === "Read" ? "file_path" : "path";
+      expect(
+        decideConfinedTool(tree, tool, { [key]: "escape/../STOLEN.txt" })
+          .behavior,
+        `${tool} must resolve a RELATIVE path the same way`,
+      ).toBe("deny");
+    }
+    expect(
+      decideConfinedTool(
+        tree,
+        "Write",
+        { file_path: "escape/../planted.sh" },
+        "write",
+      ).behavior,
+    ).toBe("deny");
+  });
+
+  it("still allows an ordinary `..` that stays inside the tree", () => {
+    // The fix must not deny legitimate traversal, or it denies everything.
+    expect(
+      decideConfinedTool(tree, "Read", {
+        file_path: `${tree}/src/../a.ts`,
+      }),
+    ).toEqual({ behavior: "allow" });
+  });
+
+  it("does not deny everything when the ROOT itself is reached by a symlink", () => {
+    // The other direction, and the one that would break the feature silently:
+    // on macOS `/tmp` is a symlink to `/private/tmp`, so a worktree path handed
+    // in one form and a tool argument in the other must still compare equal.
+    expect(isInsideTree(tree, join(tree, "a.ts"))).toBe(true);
+  });
+});