@glassmkr/crucible 0.13.15 → 0.13.17

package/dist/lib/__tests__/capability.test.js

@@ -1,56 +1,68 @@
 import { describe, it, expect } from "vitest";
-import { detectIpmiCapability, formatCapabilityLine } from "../capability.js";
+import { detectIpmiCapability, formatCapabilityLine, isIpmitoolVersionVulnerable, } from "../capability.js";
+describe("isIpmitoolVersionVulnerable (CVE-2020-5208, fixed in 1.8.19)", () => {
+    it("flags versions strictly below 1.8.19", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.18")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.8.11")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.7.99")).toBe(true);
+    });
+    it("clears 1.8.19 and above", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.19")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("1.8.20")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("1.9.0")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("2.0.0")).toBe(false);
+    });
+    it("does not gate an unknown/unparseable version (fail-open on identification)", () => {
+        expect(isIpmitoolVersionVulnerable(null)).toBe(false);
+        expect(isIpmitoolVersionVulnerable("")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("unknown")).toBe(false);
+    });
+    it("tolerates distro version suffixes", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.18-11ubuntu2")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.8.19-4")).toBe(false);
+    });
+});
 describe("detectIpmiCapability", () => {
     it("returns no_ipmitool_binary when neither device nor binary exist (Pi)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
             runIpmitool: async () => { const e = new Error("not found"); e.code = "ENOENT"; throw e; },
+            probeSensor: async () => null,
         });
         expect(cap).toEqual({ available: false, reason: "no_ipmitool_binary" });
     });
-    it("returns available when /dev/ipmi0 exists and ipmitool runs", async () => {
+    it("available when the WRAPPED sensor probe returns BMC data (CVE-safe version)", async () => {
+        // §2.1: availability comes from the wrapper (runs as root), not a direct
+        // /dev/ipmi0 stat the unprivileged service user can't do.
         const cap = await detectIpmiCapability({
-            statDevice: async (p) => p === "/dev/ipmi0" ? "ok" : "enoent",
-            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18\n", stderr: "" }),
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
-        expect(cap).toEqual({ available: true, method: "ipmitool_in_band", ipmitool_version: "1.8.18" });
+        expect(cap).toEqual({ available: true, method: "ipmitool_in_band", ipmitool_version: "1.8.19" });
     });
-    it("returns no_bmc_device when ipmitool exists but device is missing AND sensor probe fails", async () => {
+    it("disables IPMI when ipmitool is below 1.8.19 even if the BMC answers (CVE-2020-5208)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
-            runIpmitool: async (args) => {
-                if (args[0] === "-V")
-                    return { stdout: "ipmitool version 1.8.18", stderr: "" };
-                const e = new Error("Could not open device");
-                e.stderr = "Could not open device at /dev/ipmi0: No such file or directory";
-                throw e;
-            },
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
         expect(cap.available).toBe(false);
-        if (!cap.available)
-            expect(cap.reason).toBe("no_bmc_device");
+        if (!cap.available) {
+            expect(cap.reason).toBe("ipmitool_cve_2020_5208");
+            expect(cap.detail).toContain("1.8.18");
+        }
     });
-    it("returns permission_denied on EACCES", async () => {
+    it("no_bmc_device when the wrapped sensor probe returns nothing (no BMC / VM)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "eacces",
-            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18", stderr: "" }),
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19", stderr: "" }),
+            probeSensor: async () => null,
         });
         expect(cap.available).toBe(false);
-        if (!cap.available) {
-            expect(cap.reason).toBe("permission_denied");
-            expect(cap.detail).toContain("ipmi");
-        }
+        if (!cap.available)
+            expect(cap.reason).toBe("no_bmc_device");
     });
-    it("VM with ipmitool installed but no virtual BMC: no_bmc_device", async () => {
+    it("no_bmc_device on empty (whitespace-only) sensor output", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
-            runIpmitool: async (args) => {
-                if (args[0] === "-V")
-                    return { stdout: "ipmitool version 1.8.19", stderr: "" };
-                const e = new Error("could not open");
-                e.stderr = "Could not open device";
-                throw e;
-            },
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19", stderr: "" }),
+            probeSensor: async () => "   \n  ",
         });
         expect(cap.available).toBe(false);
         if (!cap.available)
@@ -58,8 +70,8 @@ describe("detectIpmiCapability", () => {
     });
     it("captures ipmitool version when present", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async (p) => p === "/dev/ipmi0" ? "ok" : "enoent",
             runIpmitool: async () => ({ stdout: "ipmitool version 1.8.21-rc1\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
         expect(cap.available).toBe(true);
         if (cap.available)

package/dist/lib/__tests__/capability.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/capability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAChG,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC/E,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAClD,CAAC,CAAC,MAAM,GAAG,gEAAgE,CAAC;gBAC5E,MAAM,CAAC,CAAC;YACV,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC/E,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC3C,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC;gBACnC,MAAM,CAAC,CAAC;YACV,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;aACtG,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC7E,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;aACxE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;aAC/G,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"capability.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/capability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/F,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC9E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC9E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAClF,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;aACtG,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC7E,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;aACxE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;aAC/G,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/privileged.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/__tests__/privileged.test.js

@@ -0,0 +1,110 @@
+import { describe, it, expect } from "vitest";
+import { isAllowedSmartDevice, isAllowedIface, WRAPPER_SCRIPT, SUDOERS_CONTENT, WRAPPER_PATH, SUDOERS_PATH, SERVICE_USER, } from "../privileged.js";
+import { setupPrivilegeSeparation } from "../../init.js";
+function mockDeps(execImpl) {
+    const files = new Map();
+    const warns = [];
+    const deps = {
+        fs: {
+            existsSync: (p) => files.has(p),
+            mkdirSync: () => { },
+            writeFileSync: (p, data, o) => { files.set(p, { data, mode: o?.mode ?? 0o644 }); },
+            chmodSync: (p, mode) => { const f = files.get(p); if (f)
+                f.mode = mode; },
+            renameSync: (from, to) => {
+                const f = files.get(from);
+                if (!f)
+                    throw new Error(`ENOENT: ${from}`);
+                files.set(to, f);
+                files.delete(from);
+            },
+        },
+        exec: execImpl,
+        hostname: () => "h", log: () => { }, warn: (m) => warns.push(m), error: () => { },
+        fetch: async () => ({ status: 200 }), readStdin: async () => "",
+    };
+    return { deps, files, warns };
+}
+// A fresh box: `id glassmkr` fails (user absent), everything else succeeds.
+const okExec = (cmd) => cmd === "id"
+    ? { stdout: "", status: 1 }
+    : { stdout: "", status: 0 };
+describe("setupPrivilegeSeparation", () => {
+    it("succeeds on a clean box: creates user, installs wrapper 0755 + sudoers 0440", () => {
+        const { deps, files } = mockDeps(okExec);
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(true);
+        expect(files.get(WRAPPER_PATH)?.mode).toBe(0o755);
+        expect(files.get(SUDOERS_PATH)?.mode).toBe(0o440);
+        expect(files.has(`${SUDOERS_PATH}.tmp`)).toBe(false); // renamed, not left behind
+    });
+    it("fail-safe: visudo rejection returns false and never installs the sudoers file", () => {
+        const { deps, files } = mockDeps((cmd) => cmd === "id" ? { stdout: "", status: 1 } :
+            cmd === "visudo" ? { stdout: "", status: 1 } :
+                { stdout: "", status: 0 });
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(false);
+        expect(files.has(SUDOERS_PATH)).toBe(false);
+    });
+    it("fail-safe: useradd failure returns false (caller keeps User=root)", () => {
+        const { deps } = mockDeps((cmd) => cmd === "id" ? { stdout: "", status: 1 } :
+            cmd === "useradd" ? { stdout: "", status: 1 } :
+                { stdout: "", status: 0 });
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(false);
+    });
+});
+describe("isAllowedSmartDevice", () => {
+    it("accepts real block/nvme device nodes", () => {
+        for (const d of ["/dev/sda", "/dev/sdb", "/dev/sdaa", "/dev/hda", "/dev/nvme0n1", "/dev/nvme12n3", "/dev/nvme0", "/dev/bus/0"]) {
+            expect(isAllowedSmartDevice(d)).toBe(true);
+        }
+    });
+    it("rejects traversal, injection, and non-device paths", () => {
+        for (const d of ["/etc/shadow", "/dev/../etc/shadow", "/dev/sda; rm -rf /", "/dev/sda foo", "", "sda", "/dev/sda\n/dev/sdb", "/dev/mapper/x"]) {
+            expect(isAllowedSmartDevice(d)).toBe(false);
+        }
+    });
+});
+describe("isAllowedIface", () => {
+    it("accepts real interface names", () => {
+        for (const i of ["eth0", "enp1s0", "eno1", "bond0", "bond0.100", "br-lan", "en_p0"]) {
+            expect(isAllowedIface(i)).toBe(true);
+        }
+    });
+    it("rejects empty, over-long, spaced, and injection-y names", () => {
+        for (const i of ["", "a".repeat(16), "eth0 x", "eth0;rm", "../eth0", "eth0|cat", "$(id)"]) {
+            expect(isAllowedIface(i)).toBe(false);
+        }
+    });
+});
+describe("WRAPPER_SCRIPT (the sudo facade)", () => {
+    it("is POSIX sh with strict mode", () => {
+        expect(WRAPPER_SCRIPT.startsWith("#!/bin/sh")).toBe(true);
+        expect(WRAPPER_SCRIPT).toContain("set -eu");
+    });
+    it("has no argument passthrough sink ($@ / $* into a command)", () => {
+        // The only $-expansions should be the validated $dev / $ifc / $action /
+        // ${#1}. A bare exec of "$@" or "$*" would be a passthrough hole.
+        expect(WRAPPER_SCRIPT).not.toMatch(/exec[^\n]*"\$@"/);
+        expect(WRAPPER_SCRIPT).not.toMatch(/exec[^\n]*\$\*/);
+    });
+    it("validates the two parameterised actions before exec", () => {
+        expect(WRAPPER_SCRIPT).toContain("valid_device");
+        expect(WRAPPER_SCRIPT).toContain("valid_iface");
+    });
+    it("hard-codes the expected privileged commands", () => {
+        expect(WRAPPER_SCRIPT).toContain("exec ipmitool sensor");
+        expect(WRAPPER_SCRIPT).toContain("exec smartctl --json --all");
+        expect(WRAPPER_SCRIPT).toContain("exec zpool status");
+        expect(WRAPPER_SCRIPT).toContain("exec iptables -L -n");
+    });
+});
+describe("SUDOERS_CONTENT", () => {
+    it("grants only the wrapper, NOPASSWD, to the service user", () => {
+        expect(SUDOERS_CONTENT).toContain(`${SERVICE_USER} ALL=(root) NOPASSWD: ${WRAPPER_PATH}`);
+    });
+    it("contains no wildcard and resets the environment", () => {
+        expect(SUDOERS_CONTENT).not.toContain("*");
+        expect(SUDOERS_CONTENT).toContain("env_reset");
+        expect(SUDOERS_CONTENT).toContain("secure_path");
+    });
+});
+//# sourceMappingURL=privileged.test.js.map

package/dist/lib/__tests__/privileged.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/privileged.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAiB,MAAM,eAAe,CAAC;AAIxE,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAa;QACrB,EAAE,EAAE;YACF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;YACnB,aAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAClF,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YACzE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBACtE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;SACF;QACD,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QAC/E,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;KAChE,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,MAAM,GAAa,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI;IAC5C,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;IAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAE9B,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,2BAA2B;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CACvC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAChC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/C,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/H,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAE,CAAC;YAC9I,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,GAAG,YAAY,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/run-privileged.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/__tests__/run-privileged.test.js

@@ -0,0 +1,50 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+// Mock the fs existsSync (wrapper presence) and the exec run() so we can
+// exercise runPrivileged's wrapper-vs-root-direct branching without touching
+// the real filesystem or spawning processes. Keep the rest of each module real.
+vi.mock("fs", async (orig) => ({ ...(await orig()), existsSync: vi.fn() }));
+vi.mock("../exec.js", async (orig) => ({ ...(await orig()), run: vi.fn() }));
+import { existsSync } from "fs";
+import { run } from "../exec.js";
+import { runPrivileged, WRAPPER_PATH } from "../privileged.js";
+const existsMock = existsSync;
+const runMock = run;
+describe("runPrivileged: wrapper vs root-direct fallback", () => {
+    beforeEach(() => {
+        existsMock.mockReset();
+        runMock.mockReset();
+        runMock.mockResolvedValue("output");
+    });
+    it("uses the sudo wrapper when it is installed", async () => {
+        existsMock.mockReturnValue(true);
+        await runPrivileged("ipmi-sensor");
+        expect(runMock).toHaveBeenCalledWith("sudo", ["-n", WRAPPER_PATH, "ipmi-sensor"], expect.any(Number));
+    });
+    it("falls back to the direct command when the wrapper is absent and we are root", async () => {
+        existsMock.mockReturnValue(false);
+        const getuid = vi.spyOn(process, "getuid").mockReturnValue(0);
+        await runPrivileged("ipmi-sensor");
+        expect(runMock).toHaveBeenCalledWith("ipmitool", ["sensor"], expect.any(Number));
+        getuid.mockRestore();
+    });
+    it("validates the smart device path on the direct fallback", async () => {
+        existsMock.mockReturnValue(false);
+        const getuid = vi.spyOn(process, "getuid").mockReturnValue(0);
+        await runPrivileged("smart", ["/dev/sda"]);
+        expect(runMock).toHaveBeenCalledWith("smartctl", ["--json", "--all", "/dev/sda"], expect.any(Number));
+        runMock.mockClear();
+        const rejected = await runPrivileged("smart", ["/etc/shadow"]);
+        expect(rejected).toBeNull();
+        expect(runMock).not.toHaveBeenCalled();
+        getuid.mockRestore();
+    });
+    it("returns null when the wrapper is absent and we are NOT root (no escalation)", async () => {
+        existsMock.mockReturnValue(false);
+        const getuid = vi.spyOn(process, "getuid").mockReturnValue(1000);
+        const r = await runPrivileged("ipmi-sensor");
+        expect(r).toBeNull();
+        expect(runMock).not.toHaveBeenCalled();
+        getuid.mockRestore();
+    });
+});
+//# sourceMappingURL=run-privileged.test.js.map

package/dist/lib/__tests__/run-privileged.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-privileged.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/run-privileged.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,yEAAyE;AACzE,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAuB,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAA+B,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1G,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE/D,MAAM,UAAU,GAAG,UAAiD,CAAC;AACrE,MAAM,OAAO,GAAG,GAA0C,CAAC;AAE3D,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,UAAU,CAAC,GAAG,EAAE;QACd,UAAU,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/capability.d.ts

@@ -4,17 +4,32 @@ export type IpmiCapability = {
     ipmitool_version: string | null;
 } | {
     available: false;
-    reason: "no_ipmitool_binary" | "no_bmc_device" | "execution_failed" | "permission_denied";
+    reason: "no_ipmitool_binary" | "no_bmc_device" | "execution_failed" | "permission_denied" | "ipmitool_cve_2020_5208";
     detail?: string;
 };
+export declare const MIN_SAFE_IPMITOOL_VERSION = "1.8.19";
+/**
+ * True iff `version` is a parseable ipmitool version strictly below
+ * MIN_SAFE_IPMITOOL_VERSION. Unknown/unparseable versions return false
+ * (we do not disable a capability we cannot positively identify as
+ * vulnerable). Pure; unit-tested.
+ */
+export declare function isIpmitoolVersionVulnerable(version: string | null): boolean;
 interface DetectDeps {
-    /** Override for tests. Returns "ok" | "enoent" | "eacces" per path. */
-    statDevice?: (path: string) => Promise<"ok" | "enoent" | "eacces">;
-    /** Override for tests. Returns stdout or throws with err.code. */
+    /** Override for tests. Runs `ipmitool -V` (direct; works unprivileged).
+     *  Returns stdout or throws with err.code. Used only for the version /
+     *  CVE gate. */
     runIpmitool?: (args: string[]) => Promise<{
         stdout: string;
         stderr: string;
     }>;
+    /** Override for tests. The WRAPPED sensor probe (`sudo crucible-collect
+     *  ipmi-sensor`). Returns stdout, or null on any failure. This is the
+     *  availability signal: under the §2.1 unprivileged model the agent user
+     *  cannot stat /dev/ipmi0 or run ipmitool directly, so a direct
+     *  device-node probe is meaningless; the wrapper (which runs as root) is
+     *  the real reachability test. */
+    probeSensor?: () => Promise<string | null>;
 }
 export declare function detectIpmiCapability(deps?: DetectDeps): Promise<IpmiCapability>;
 export declare function formatCapabilityLine(cap: IpmiCapability): string;

package/dist/lib/capability.js

@@ -8,50 +8,49 @@
 //
 // This module probes once at startup and caches the result. collectIpmi()
 // reads the cached capability and short-circuits when unavailable.
-import { promises as fs } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { runPrivileged } from "./privileged.js";
 const execFileAsync = promisify(execFile);
-const DEVICE_CANDIDATES = ["/dev/ipmi0", "/dev/ipmi/0", "/dev/ipmidev/0"];
-async function defaultStatDevice(path) {
-    try {
-        await fs.access(path, fs.constants.R_OK);
-        return "ok";
-    }
-    catch (err) {
-        if (err.code === "EACCES" || err.code === "EPERM")
-            return "eacces";
-        return "enoent";
+// CVE-2020-5208 (GHSA-g659-9qxw-p7cp): heap overflow in ipmitool's
+// read_fru_area_section and related parsers when handling data received
+// from a remote LAN party (a malicious or compromised BMC). Fixed in
+// ipmitool 1.8.19. The agent runs ipmitool in-band against the host BMC,
+// so a compromised BMC parsing path is a real local-blast-radius primitive
+// (audit §2.1 / catalog T-202). Below the fix version we mark IPMI
+// unavailable rather than feed BMC output to a vulnerable parser.
+export const MIN_SAFE_IPMITOOL_VERSION = "1.8.19";
+/**
+ * True iff `version` is a parseable ipmitool version strictly below
+ * MIN_SAFE_IPMITOOL_VERSION. Unknown/unparseable versions return false
+ * (we do not disable a capability we cannot positively identify as
+ * vulnerable). Pure; unit-tested.
+ */
+export function isIpmitoolVersionVulnerable(version) {
+    if (!version)
+        return false;
+    const min = [1, 8, 19];
+    const parts = version.split(/[.\-+]/).map((p) => parseInt(p, 10));
+    if (parts.length === 0 || Number.isNaN(parts[0]))
+        return false; // unparseable
+    for (let i = 0; i < min.length; i++) {
+        const p = Number.isNaN(parts[i]) ? 0 : (parts[i] ?? 0);
+        if (p < min[i])
+            return true;
+        if (p > min[i])
+            return false;
     }
+    return false; // equal or greater
 }
 async function defaultRunIpmitool(args) {
     const { stdout, stderr } = await execFileAsync("ipmitool", args, { timeout: 2000 });
     return { stdout, stderr };
 }
 export async function detectIpmiCapability(deps = {}) {
-    const statDevice = deps.statDevice ?? defaultStatDevice;
     const runIpmitool = deps.runIpmitool ?? defaultRunIpmitool;
-    // Step 1: probe /dev/ipmi* device nodes.
-    let deviceFound = false;
-    let permissionDenied = false;
-    for (const path of DEVICE_CANDIDATES) {
-        const result = await statDevice(path);
-        if (result === "ok") {
-            deviceFound = true;
-            break;
-        }
-        if (result === "eacces") {
-            permissionDenied = true;
-        }
-    }
-    if (permissionDenied && !deviceFound) {
-        return {
-            available: false,
-            reason: "permission_denied",
-            detail: "/dev/ipmi0 exists but is not readable; run as root or add user to ipmi group",
-        };
-    }
-    // Step 2: probe ipmitool binary.
+    const probeSensor = deps.probeSensor ?? (() => runPrivileged("ipmi-sensor"));
+    // Step 1: probe the ipmitool binary + version. `ipmitool -V` needs no BMC
+    // access, so it works even as the unprivileged service user.
     let ipmitoolVersion = null;
     try {
         const { stdout } = await runIpmitool(["-V"]);
@@ -68,26 +67,28 @@ export async function detectIpmiCapability(deps = {}) {
             detail: String(err?.stderr ?? err?.message ?? err).split("\n")[0]?.slice(0, 200),
         };
     }
-    // Step 3: device + binary present → assume capable.
-    if (deviceFound) {
-        return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
+    // Step 2: version gate (CVE-2020-5208): refuse to feed BMC output to a
+    // vulnerable ipmitool parser. Fail-closed for the IPMI capability only;
+    // every other collector is unaffected. Skipped when the version could
+    // not be parsed (we do not disable a capability we cannot positively
+    // identify as vulnerable).
+    if (isIpmitoolVersionVulnerable(ipmitoolVersion)) {
+        return {
+            available: false,
+            reason: "ipmitool_cve_2020_5208",
+            detail: `ipmitool ${ipmitoolVersion} < ${MIN_SAFE_IPMITOOL_VERSION}; upgrade to close CVE-2020-5208`,
+        };
     }
-    // Step 4: binary present but no device node — try one sensor probe to
-    // disambiguate (some kernels expose IPMI through unconventional paths).
+    // Step 3: reachability via the WRAPPED sensor probe. Non-empty output means
+    // the BMC answered; empty/failure means no usable BMC on this host.
     try {
-        const { stdout, stderr } = await runIpmitool(["sensor"]);
-        const out = stdout || "";
-        const errOut = (stderr || "").toLowerCase();
-        if (out.trim().length > 0 && !errOut.includes("could not open")) {
+        const out = await probeSensor();
+        if (out && out.trim().length > 0) {
             return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
         }
         return { available: false, reason: "no_bmc_device" };
     }
     catch (err) {
-        const stderr = String(err?.stderr ?? "").toLowerCase();
-        if (stderr.includes("could not open")) {
-            return { available: false, reason: "no_bmc_device" };
-        }
         return {
             available: false,
             reason: "execution_failed",
@@ -105,6 +106,7 @@ export function formatCapabilityLine(cap) {
         case "no_bmc_device": return "IPMI: not available (no /dev/ipmi*, BMC not detected)";
         case "permission_denied": return `IPMI: not available (${cap.detail ?? "permission denied"})`;
         case "execution_failed": return `IPMI: not available (execution failed${cap.detail ? `: ${cap.detail}` : ""})`;
+        case "ipmitool_cve_2020_5208": return `IPMI: disabled (${cap.detail ?? "ipmitool too old (CVE-2020-5208)"})`;
     }
 }
 //# sourceMappingURL=capability.js.map

package/dist/lib/capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAS1E,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,yCAAyC;IACzC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAAC,WAAW,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAAC,gBAAgB,GAAG,IAAI,CAAC;QAAC,CAAC;IACvD,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC5F,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,oBAAoB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,oBAAoB,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACjF,KAAK,eAAe,CAAC,CAAM,OAAO,uDAAuD,CAAC;QAC1F,KAAK,mBAAmB,CAAC,CAAE,OAAO,wBAAwB,GAAG,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC;QAC/F,KAAK,kBAAkB,CAAC,CAAG,OAAO,wCAAwC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACnH,CAAC;AACH,CAAC"}
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,mEAAmE;AACnE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAsB;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,cAAc;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,mBAAmB;AACnC,CAAC;AAgBD,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,2BAA2B;IAC3B,IAAI,2BAA2B,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,YAAY,eAAe,MAAM,yBAAyB,kCAAkC;SACrG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,oBAAoB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,oBAAoB,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACjF,KAAK,eAAe,CAAC,CAAM,OAAO,uDAAuD,CAAC;QAC1F,KAAK,mBAAmB,CAAC,CAAE,OAAO,wBAAwB,GAAG,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC;QAC/F,KAAK,kBAAkB,CAAC,CAAG,OAAO,wCAAwC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACjH,KAAK,wBAAwB,CAAC,CAAC,OAAO,mBAAmB,GAAG,CAAC,MAAM,IAAI,kCAAkC,GAAG,CAAC;IAC/G,CAAC;AACH,CAAC"}

package/dist/lib/privileged.d.ts

@@ -0,0 +1,31 @@
+export declare const SERVICE_USER = "glassmkr";
+export declare const WRAPPER_PATH = "/usr/local/sbin/crucible-collect";
+export declare const SUDOERS_PATH = "/etc/sudoers.d/glassmkr-crucible";
+export type PrivilegedAction = "ipmi-sensor" | "ipmi-sel-info" | "ipmi-sel-elist" | "ipmi-fan" | "smart" | "zpool" | "raid-perccli" | "raid-storcli" | "raid-ssacli" | "raid-arcconf" | "dmesg-errcrit" | "dmesg-io" | "iptables" | "nft" | "ufw" | "firewall-cmd" | "pve-firewall" | "sshd" | "lvs" | "ethtool" | "last";
+/** SMART device paths the wrapper accepts. Mirrors the sh `valid_device`
+ *  case in WRAPPER_SCRIPT; kept in TS so it is unit-testable. Blocks path
+ *  traversal / arbitrary-file reads via `smartctl -a <path>`. */
+export declare function isAllowedSmartDevice(dev: string): boolean;
+/** ethtool interface names the wrapper accepts. Linux ifnames are <=15
+ *  chars from a restricted set; no slashes/spaces so no arg injection. */
+export declare function isAllowedIface(name: string): boolean;
+/**
+ * Invoke a privileged collection action. Preferred path is the fixed-argv
+ * sudo wrapper (the unprivileged `glassmkr` service user escalates only
+ * through it). Returns the command stdout, or null on any failure - callers
+ * treat null as "capability unavailable", so a missing tool degrades
+ * gracefully rather than crashing.
+ *
+ * Root fallback: if the wrapper is NOT installed (e.g. an upgrade via
+ * `npm i -g` without re-running `init`, or a host still on User=root that
+ * never migrated) AND we are running as root, run the underlying command
+ * directly. As root that is exactly what the wrapper would exec, so it
+ * restores collection instead of silently returning null for every
+ * hardware/security probe. This honors init.ts's documented "User=root
+ * never loses collection" invariant, which the wrapper-only path (audit
+ * §2.1) had regressed on wrapper-less root hosts. A non-root agent without
+ * the wrapper still gets null (it cannot and must not escalate).
+ */
+export declare function runPrivileged(action: PrivilegedAction, args?: string[], timeoutMs?: number): Promise<string | null>;
+export declare const WRAPPER_SCRIPT = "#!/bin/sh\n# Glassmkr Crucible privileged-collection facade (audit \u00A72.1).\n# Installed root:root 0755. The sole sudo grant for the unprivileged\n# 'glassmkr' service user. Fixed action -> fixed argv; no passthrough.\n# Managed by glassmkr-crucible init; do not edit by hand.\nset -eu\n\naction=\"${1:-}\"\n[ -n \"$action\" ] || { echo \"crucible-collect: missing action\" >&2; exit 64; }\nshift 2>/dev/null || true\n\nvalid_device() {\n  case \"$1\" in\n    /dev/sd[a-z]|/dev/sd[a-z][a-z]|/dev/hd[a-z]|/dev/hd[a-z][a-z]) return 0 ;;\n    /dev/nvme[0-9]*n[0-9]*|/dev/nvme[0-9]*) return 0 ;;\n    /dev/bus/[0-9]*) return 0 ;;\n    *) return 1 ;;\n  esac\n}\nvalid_iface() {\n  case \"$1\" in\n    \"\" | *[!A-Za-z0-9._:-]*) return 1 ;;\n    *) [ \"${#1}\" -le 15 ] ;;\n  esac\n}\n\ncase \"$action\" in\n  ipmi-sensor)    exec ipmitool sensor ;;\n  ipmi-sel-info)  exec ipmitool sel info ;;\n  ipmi-sel-elist) exec ipmitool sel elist ;;\n  ipmi-fan)       exec ipmitool sdr type Fan ;;\n  smart)\n    dev=\"${1:-}\"\n    valid_device \"$dev\" || { echo \"crucible-collect: rejected device: $dev\" >&2; exit 65; }\n    exec smartctl --json --all \"$dev\" ;;\n  zpool)          exec zpool status ;;\n  raid-perccli)   exec perccli /c0 show all J ;;\n  raid-storcli)   exec storcli /call show all J ;;\n  raid-ssacli)    exec ssacli ctrl all show status ;;\n  raid-arcconf)   exec arcconf list ;;\n  dmesg-errcrit)  exec dmesg --level=err,crit --since \"5 min ago\" ;;\n  dmesg-io)       exec sh -c 'dmesg -T --since \"10 minutes ago\" 2>/dev/null | grep -i \"I/O error\\\\|Buffer I/O error\\\\|blk_update_request.*error\"' ;;\n  iptables)       exec iptables -L -n ;;\n  nft)            exec nft list ruleset ;;\n  ufw)            exec ufw status ;;\n  firewall-cmd)   exec firewall-cmd --state ;;\n  pve-firewall)   exec pve-firewall status ;;\n  sshd)           exec sshd -T ;;\n  lvs)            exec lvs --reportformat=json --options=lv_name,vg_name,lv_attr,data_percent,metadata_percent --units=b --noheadings ;;\n  ethtool)\n    ifc=\"${1:-}\"\n    valid_iface \"$ifc\" || { echo \"crucible-collect: rejected iface: $ifc\" >&2; exit 65; }\n    exec ethtool \"$ifc\" ;;\n  last)           exec last -x -F ;;\n  *) echo \"crucible-collect: unknown action: $action\" >&2; exit 64 ;;\nesac\n";
+export declare const SUDOERS_CONTENT = "# Glassmkr Crucible (audit \u00A72.1). Managed by glassmkr-crucible init.\n# The service user may run ONLY the fixed-argv collection facade as root.\nDefaults!/usr/local/sbin/crucible-collect env_reset\nDefaults!/usr/local/sbin/crucible-collect secure_path=\"/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin\"\nglassmkr ALL=(root) NOPASSWD: /usr/local/sbin/crucible-collect\n";