@indigoai-us/hq-cli 5.32.0 → 5.33.1

package/dist/utils/vault-api.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1ca2b83-1de0-5000-ab66-f573000a579b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bdd04f0a-8d43-5072-916d-a801a2f25731")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 import { Sentry } from '../sentry.js';
 export async function vaultApiFetch(opts) {
@@ -35,6 +35,43 @@ export async function vaultApiFetch(opts) {
     }
     return response;
 }
+/**
+ * Public (NONE-auth) GET against the vault API — no bearer token. The
+ * marketplace browse endpoints (`GET /v1/listings`, `GET /v1/listings/{id}`)
+ * from US-005 are public so a logged-out user can resolve + download an
+ * approved pack. Distinct from `vaultApiFetch`, which always attaches a
+ * bearer token.
+ */
+export async function vaultApiFetchPublic(opts) {
+    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+    if (opts.query) {
+        for (const [k, v] of Object.entries(opts.query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    const safeUrl = url.search
+        ? `${url.origin}${url.pathname}?<redacted>`
+        : `${url.origin}${url.pathname}`;
+    Sentry.addBreadcrumb({
+        category: 'http',
+        message: `GET ${opts.path}`,
+        level: 'info',
+        data: { url: safeUrl, method: 'GET' },
+    });
+    const response = await fetch(url.toString(), {
+        method: 'GET',
+        headers: { 'Content-Type': 'application/json' },
+    });
+    if (!response.ok) {
+        Sentry.addBreadcrumb({
+            category: 'http',
+            message: `GET ${opts.path} → ${response.status}`,
+            level: 'warning',
+            data: { url: safeUrl, status: response.status },
+        });
+    }
+    return response;
+}
 async function resolveCompanyUid(token, slug) {
     const res = await vaultApiFetch({
         token,
@@ -106,4 +143,4 @@ export async function getEntityUid(token, opts) {
     return getCompanyUid(token, opts.companySlug);
 }
 //# sourceMappingURL=vault-api.js.map
-//# debugId=e1ca2b83-1de0-5000-ab66-f573000a579b
+//# debugId=bdd04f0a-8d43-5072-916d-a801a2f25731

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.32.0",
+  "version": "5.33.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "~5.44.0",
+    "@indigoai-us/hq-cloud": "~5.47.0",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/__fixtures__/make-tar.ts

@@ -0,0 +1,126 @@
+/**
+ * Deterministic, platform-independent malicious-tar fixture builder.
+ *
+ * WHY THIS EXISTS (cross-platform zip-slip coverage). The adversarial
+ * safe-extract / marketplace-security suites need archives that GENUINELY carry
+ * hostile entries — a `../` traversal name, an absolute path, an escaping
+ * symlink/hardlink. The obvious approach (shell out to the system `tar` to
+ * CREATE the archive) is NOT portable: GNU tar (Linux / CI / prod Lambdas)
+ * STRIPS the leading `../` and absolute `/` when it WRITES an archive, so the
+ * resulting "malicious" fixture contains a benign `evil-escape` entry and the
+ * guard has nothing to reject — the test passes on macOS bsdtar (which
+ * preserves them) but fails on Linux. The guard itself is correct; only the
+ * fixture construction was platform-dependent.
+ *
+ * Fix: WRITE THE TAR BYTES DIRECTLY here. A tar archive is just a sequence of
+ * 512-byte ustar headers, each optionally followed by the file's content padded
+ * to a 512-byte boundary, terminated by two zero blocks. By emitting the bytes
+ * ourselves we control the recorded entry names verbatim — `../evil-escape`,
+ * `/tmp/evil`, a symlink with linkname `../../etc/passwd` — identically on every
+ * platform, with no create-time stripping. The reading side (`tar -tvf`, which
+ * safeExtractTarball's pre-flight uses) does NOT strip anything; it faithfully
+ * lists whatever bytes we wrote, so the guard sees the real attack everywhere.
+ */
+
+import { gzipSync } from 'node:zlib';
+import * as fs from 'node:fs';
+
+const BLOCK = 512;
+
+/** ustar typeflag values we use. */
+export type TarType = 'file' | 'symlink' | 'hardlink';
+
+const TYPEFLAG: Record<TarType, string> = {
+  file: '0', // regular file
+  symlink: '2', // symbolic link
+  hardlink: '1', // hard link
+};
+
+export interface TarEntrySpec {
+  /** Recorded entry name — written VERBATIM (may contain `..`, be absolute…). */
+  name: string;
+  type?: TarType; // default 'file'
+  /** For sym/hardlinks: the recorded link target (also written verbatim). */
+  linkname?: string;
+  /** File content (regular files only). */
+  content?: string | Buffer;
+}
+
+/** Write an ASCII string into a fixed-width field at `offset`, NUL-padded. */
+function writeField(buf: Buffer, offset: number, width: number, value: string): void {
+  // Truncate defensively; ustar fields are fixed-width.
+  const s = value.slice(0, width);
+  buf.write(s, offset, 'ascii');
+  // Remaining bytes are already 0 from Buffer.alloc.
+}
+
+/** Write an octal numeric field: `width-1` octal digits, space-or-NUL terminated. */
+function writeOctal(buf: Buffer, offset: number, width: number, value: number): void {
+  // Classic ustar numeric field: zero-padded octal in (width-1) chars + NUL.
+  const digits = width - 1;
+  const oct = value.toString(8).padStart(digits, '0').slice(-digits);
+  buf.write(oct, offset, 'ascii');
+  buf[offset + digits] = 0; // NUL terminator
+}
+
+/**
+ * Build one 512-byte ustar header (plus content blocks for regular files) for a
+ * single entry. The header checksum is computed exactly per spec: sum every
+ * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
+ * write that sum as 6 octal digits + NUL + space.
+ */
+export function makeTarEntry(spec: TarEntrySpec): Buffer {
+  const type = spec.type ?? 'file';
+  const content =
+    type === 'file'
+      ? Buffer.isBuffer(spec.content)
+        ? spec.content
+        : Buffer.from(spec.content ?? '', 'utf-8')
+      : Buffer.alloc(0); // links carry no content payload
+
+  const header = Buffer.alloc(BLOCK); // zero-filled
+
+  writeField(header, 0, 100, spec.name); // name
+  writeOctal(header, 100, 8, 0o644); // mode
+  writeOctal(header, 108, 8, 0); // uid
+  writeOctal(header, 116, 8, 0); // gid
+  writeOctal(header, 124, 12, content.length); // size (0 for links)
+  writeOctal(header, 136, 12, 0); // mtime (deterministic: epoch)
+  // checksum field (148, 8) — filled below; start as spaces for the sum.
+  header.fill(' '.charCodeAt(0), 148, 156);
+  writeField(header, 156, 1, TYPEFLAG[type]); // typeflag
+  if (spec.linkname !== undefined) {
+    writeField(header, 157, 100, spec.linkname); // linkname (verbatim)
+  }
+  writeField(header, 257, 6, 'ustar'); // magic "ustar\0"
+  writeField(header, 263, 2, '00'); // version "00"
+  // uname/gname left empty; devmajor/devminor zero (already NUL).
+
+  // Header checksum: unsigned sum of all 512 bytes (with the checksum field as
+  // spaces, which we set above). Written as 6 octal digits, NUL, space.
+  let sum = 0;
+  for (let i = 0; i < BLOCK; i++) sum += header[i];
+  const cksum = sum.toString(8).padStart(6, '0').slice(-6);
+  header.write(cksum, 148, 'ascii');
+  header[154] = 0; // NUL
+  header[155] = ' '.charCodeAt(0); // space
+
+  if (type !== 'file' || content.length === 0) return header;
+
+  // Content padded up to a 512-byte boundary.
+  const pad = (BLOCK - (content.length % BLOCK)) % BLOCK;
+  return Buffer.concat([header, content, Buffer.alloc(pad)]);
+}
+
+/** Concatenate entries and append the two zero blocks that end every tar. */
+export function makeTar(entries: TarEntrySpec[]): Buffer {
+  const blocks = entries.map(makeTarEntry);
+  blocks.push(Buffer.alloc(BLOCK * 2)); // end-of-archive marker
+  return Buffer.concat(blocks);
+}
+
+/** Build the tar, gzip it, and write it to `outPath`. Returns `outPath`. */
+export function writeMaliciousTarGz(outPath: string, entries: TarEntrySpec[]): string {
+  fs.writeFileSync(outPath, gzipSync(makeTar(entries)));
+  return outPath;
+}

package/src/commands/artifact-verify.test.ts

@@ -0,0 +1,177 @@
+/**
+ * Marketplace artifact verification (US-021, INSTALL side) tests.
+ *
+ * Proves the install-time guarantee: the bytes we install are EXACTLY the bytes
+ * a moderator approved. Covers the two E2E behaviors required by the story:
+ *   - an approved artifact whose S3 object is mutated → hash mismatch → REFUSE.
+ *   - signature verification against the platform Ed25519 PUBLIC key.
+ *
+ * SHARED CONTRACT mirror — we reproduce the publish-side signing here with an
+ * ephemeral in-test keypair (no key material in the repo) to prove both sides
+ * agree byte-for-byte.
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  generateKeyPairSync,
+  createHash,
+  sign as cryptoSign,
+} from 'node:crypto';
+import {
+  verifyArtifact,
+  computeArtifactHash,
+  ArtifactVerificationError,
+  ARTIFACT_HASH_ALG,
+} from './pack-install.js';
+
+// Ephemeral platform keypair (regenerated each run — never committed).
+const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+
+/** Reproduce the hq-pro publish-side: sha256 hex hash + Ed25519 over the hash. */
+function publishSide(bytes: Buffer): { contentHash: string; signature: string } {
+  const contentHash = createHash('sha256').update(bytes).digest('hex');
+  const signature = cryptoSign(
+    null,
+    Buffer.from(contentHash, 'utf-8'),
+    privateKey,
+  ).toString('base64');
+  return { contentHash, signature };
+}
+
+const APPROVED_BYTES = Buffer.from('the-approved-pack.tar.gz-bytes');
+
+describe('computeArtifactHash', () => {
+  it('matches a lowercase-hex sha256 (shared contract with publish)', () => {
+    const expected = createHash('sha256').update(APPROVED_BYTES).digest('hex');
+    expect(computeArtifactHash(APPROVED_BYTES)).toBe(expected);
+    expect(ARTIFACT_HASH_ALG).toBe('sha256');
+  });
+});
+
+describe('verifyArtifact — integrity (hash)', () => {
+  it('passes when the downloaded bytes match the pinned hash + valid signature', () => {
+    const { contentHash, signature } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        signature,
+        publicKey: publicKeyPem,
+        requireSignature: true,
+      }),
+    ).not.toThrow();
+  });
+
+  it('E2E: a MUTATED S3 object → hash mismatch → REFUSES', () => {
+    // Publish/approval pinned the hash of APPROVED_BYTES…
+    const { contentHash, signature } = publishSide(APPROVED_BYTES);
+    // …but the bytes we actually downloaded were swapped by an attacker.
+    const mutatedBytes = Buffer.from('EVIL-swapped-pack.tar.gz-bytes');
+
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: mutatedBytes,
+        expectedHash: contentHash,
+        signature,
+        publicKey: publicKeyPem,
+      }),
+    ).toThrow(ArtifactVerificationError);
+
+    try {
+      verifyArtifact({
+        tarballBytes: mutatedBytes,
+        expectedHash: contentHash,
+      });
+    } catch (e) {
+      expect((e as Error).message).toMatch(/hash mismatch/i);
+    }
+  });
+
+  it('refuses when the listing provides no valid hash', () => {
+    expect(() =>
+      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: '' }),
+    ).toThrow(/valid sha256 content hash/i);
+    expect(() =>
+      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: 'not-a-hash' }),
+    ).toThrow(ArtifactVerificationError);
+  });
+});
+
+describe('verifyArtifact — authenticity (signature)', () => {
+  it('refuses a hash-valid artifact whose signature was forged by a different key', () => {
+    const { contentHash } = publishSide(APPROVED_BYTES);
+    // Attacker signs the (correct) hash with their OWN key.
+    const { privateKey: evilKey } = generateKeyPairSync('ed25519');
+    const forged = cryptoSign(
+      null,
+      Buffer.from(contentHash, 'utf-8'),
+      evilKey,
+    ).toString('base64');
+
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        signature: forged,
+        publicKey: publicKeyPem, // platform key — won't validate the forgery
+      }),
+    ).toThrow(/signature is invalid/i);
+  });
+
+  it('refuses on a corrupt/garbage signature', () => {
+    const { contentHash } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        signature: 'not-base64-or-a-real-sig!!!',
+        publicKey: publicKeyPem,
+      }),
+    ).toThrow(ArtifactVerificationError);
+  });
+
+  it('refuses on an invalid public key', () => {
+    const { contentHash, signature } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        signature,
+        publicKey: 'not a real pem',
+      }),
+    ).toThrow(/public key/i);
+  });
+});
+
+describe('verifyArtifact — deferred-key window', () => {
+  it('hash-verifies but skips signature when none provided (requireSignature=false)', () => {
+    const { contentHash } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: contentHash }),
+    ).not.toThrow();
+  });
+
+  it('refuses an unsigned artifact when requireSignature=true', () => {
+    const { contentHash } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        requireSignature: true,
+      }),
+    ).toThrow(/unsigned/i);
+  });
+
+  it('refuses when a signature is present but no public key is available (requireSignature=true)', () => {
+    const { contentHash, signature } = publishSide(APPROVED_BYTES);
+    expect(() =>
+      verifyArtifact({
+        tarballBytes: APPROVED_BYTES,
+        expectedHash: contentHash,
+        signature,
+        requireSignature: true,
+      }),
+    ).toThrow(/public key/i);
+  });
+});