@inflexa-ai/harness 0.2.0 → 0.4.0

package/dist/workspace/filesystem.js

@@ -28,8 +28,8 @@
  * OUTSIDE `tryFs`, so only the discrete `fs.open` / `fs.read` / `fs.readFile`
  * calls become `err`.
  */
-import { open as fsOpen, readFile as fsReadFile, readdir as fsReaddir, stat as fsStat } from "node:fs/promises";
-import { createReadStream } from "node:fs";
+import { lstat as fsLstat, open as fsOpen, readdir as fsReaddir, stat as fsStat } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
 import { createInterface } from "node:readline";
 import { join } from "node:path";
 import { ResultAsync, err, errAsync, ok } from "neverthrow";
@@ -123,10 +123,20 @@ export function createWorkspaceFilesystem(deps) {
                     return okAsync({ kind: "out_of_scope" });
                 }
                 const absolute = resolved.absolute;
-                return tryFs("workspace.list", () => fsReaddir(absolute, { withFileTypes: true }), { path: absolute, onAbsent: () => ({ notFound: true }) }).andThen((dirents) => {
-                    if ("notFound" in dirents)
-                        return okAsync({ kind: "not_found" });
-                    return collectEntries(absolute, dirents).map((entries) => ({ kind: "ok", entries }));
+                // `lstat` first so a symlinked directory leaf is refused, not
+                // followed: a plain `readdir` would list the target's entries,
+                // and a leaf swapped to an escaping symlink after the realpath
+                // check would leak an off-tree directory's names. Node has no
+                // fd-based readdir, so this narrows (does not fully close) the
+                // readdir race — the atomic guarantee is on the content reads.
+                return safeLstat(absolute).andThen((s) => {
+                    if (s?.isSymbolicLink())
+                        return okAsync({ kind: "out_of_scope" });
+                    return tryFs("workspace.list", () => fsReaddir(absolute, { withFileTypes: true }), { path: absolute, onAbsent: () => ({ notFound: true }) }).andThen((dirents) => {
+                        if ("notFound" in dirents)
+                            return okAsync({ kind: "not_found" });
+                        return collectEntries(absolute, dirents).map((entries) => ({ kind: "ok", entries }));
+                    });
                 });
             });
         },
@@ -135,9 +145,16 @@ export function createWorkspaceFilesystem(deps) {
                 if (resolved.kind === "out_of_scope") {
                     return okAsync({ kind: "out_of_scope" });
                 }
-                return safeStat(resolved.absolute).map((s) => {
+                // `lstat`, not `stat`: a leaf symlink is refused rather than
+                // followed — same policy as the read open's `O_NOFOLLOW`.
+                // Reporting a followed target's type/size would re-open the
+                // metadata side of the confused-deputy leak, and it is atomic
+                // (a single non-following syscall, no check/use gap).
+                return safeLstat(resolved.absolute).map((s) => {
                     if (!s)
                         return { kind: "not_found" };
+                    if (s.isSymbolicLink())
+                        return { kind: "out_of_scope" };
                     return {
                         kind: "ok",
                         type: s.isDirectory() ? "directory" : "file",
@@ -160,29 +177,89 @@ function safeStat(absolute) {
         onAbsent: () => null,
     });
 }
-/** Stat each directory entry to attach a size; absence/I/O failures degrade to no size. */
+/** Like {@link safeStat} but NEVER follows a leaf symlink (`lstat`) — the seam's
+ *  read-side no-follow policy for the `stat`/`list` metadata surface. */
+function safeLstat(absolute) {
+    return tryFs("workspace.lstat", () => fsLstat(absolute), {
+        path: absolute,
+        onAbsent: () => null,
+    });
+}
+/** Lstat each directory entry to attach a size; absence/I/O failures degrade to
+ *  no size. `lstat` (not `stat`) so a symlink entry reports its own size, never
+ *  its target's — a followed target could be off-tree. `d.isDirectory()` comes
+ *  from the dirent, which does not follow, so a symlink is a plain `file` entry. */
 function collectEntries(dir, dirents) {
     return ResultAsync.combine(dirents.map((d) => {
         if (d.isDirectory())
             return okAsync({ name: d.name, type: "directory" });
-        return safeStat(join(dir, d.name)).map((s) => ({ name: d.name, type: "file", size: s?.size ?? undefined }));
+        return safeLstat(join(dir, d.name)).map((s) => ({ name: d.name, type: "file", size: s?.size ?? undefined }));
     }));
 }
+/**
+ * Read-only open flags that REFUSE to follow a final-component symlink.
+ * `classifyWithinRoot` validated a snapshot of the path; a symlink swapped into
+ * the leaf between that check and the open here would otherwise be followed
+ * off-tree, re-opening the read-exfiltration hole for the length of the race
+ * (CWE-367). `O_NOFOLLOW` makes the leaf open atomic — a symlinked final
+ * component fails `ELOOP` in the same syscall that opens it, so there is no
+ * check/use gap. `?? 0` keeps the mask valid on a platform that lacks the flag.
+ *
+ * This refuses EVERY leaf symlink, including an in-tree one the persistent check
+ * would allow: pure Node cannot express "follow only if it stays in-tree" (that
+ * needs `openat2(RESOLVE_BENEATH)`), so the atomic, race-free choice is to not
+ * follow the leaf at all. Hard-linked staged inputs are unaffected — a hard link
+ * is not a symlink. An intermediate-directory symlink is beyond this guard (Node
+ * exposes no `openat2`); the upstream realpath check still rejects the
+ * persistent case of that.
+ */
+const READ_NO_FOLLOW = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0);
+/**
+ * Open a workspace file read-only without following a leaf symlink (see
+ * {@link READ_NO_FOLLOW}). A symlinked final component surfaces as `out_of_scope`
+ * — the same verdict a persistent escape gets — never as off-tree bytes. Every
+ * content read (`readWithCap`, `readHeadLines`, `readTailLines`) opens through
+ * here so the bytes it streams come from a non-symlink leaf. Absence /
+ * permission / other I/O throws flow the `FsError` channel unchanged.
+ */
+function openReadNoFollow(absolute) {
+    return tryFs("workspace.openNoFollow", async () => {
+        try {
+            return { kind: "ok", fh: await fsOpen(absolute, READ_NO_FOLLOW) };
+        }
+        catch (cause) {
+            if (cause.code === "ELOOP")
+                return { kind: "out_of_scope" };
+            throw cause;
+        }
+    }, { path: absolute });
+}
 function readWithCap(absolute, totalSize, maxBytes) {
-    if (maxBytes !== undefined && totalSize > maxBytes) {
-        return tryFs("workspace.readCapped", async () => {
-            const fh = await fsOpen(absolute, "r");
+    return openReadNoFollow(absolute).andThen((opened) => {
+        if (opened.kind === "out_of_scope")
+            return okAsync({ kind: "out_of_scope" });
+        const fh = opened.fh;
+        if (maxBytes !== undefined && totalSize > maxBytes) {
+            return tryFs("workspace.readCapped", async () => {
+                try {
+                    const buf = Buffer.alloc(maxBytes);
+                    await fh.read(buf, 0, maxBytes, 0);
+                    return { kind: "truncated", content: buf, totalSize };
+                }
+                finally {
+                    await fh.close();
+                }
+            }, { path: absolute });
+        }
+        return tryFs("workspace.readFile", async () => {
             try {
-                const buf = Buffer.alloc(maxBytes);
-                await fh.read(buf, 0, maxBytes, 0);
-                return { kind: "truncated", content: buf, totalSize };
+                return { kind: "ok", content: await fh.readFile(), truncated: false };
             }
             finally {
                 await fh.close();
             }
         }, { path: absolute });
-    }
-    return tryFs("workspace.readFile", async () => ({ kind: "ok", content: await fsReadFile(absolute), truncated: false }), { path: absolute });
+    });
 }
 function capBuffer(content, maxBytes) {
     if (maxBytes !== undefined && content.length > maxBytes) {
@@ -204,43 +281,51 @@ function capBuffer(content, maxBytes) {
  * follow-up `safeStat` (a discrete `fs` call) flows the `FsError` channel.
  */
 function readHeadLines(absolute, headLines, maxBytes) {
-    return new ResultAsync((async () => {
-        const stream = createReadStream(absolute, { highWaterMark: 16 * 1024 });
-        const rl = createInterface({ input: stream, crlfDelay: Infinity });
-        const collected = [];
-        let bytes = 0;
-        let truncated = false;
-        try {
-            for await (const line of rl) {
-                const lineBytes = Buffer.byteLength(line, "utf8") + 1;
-                if (maxBytes !== undefined && bytes + lineBytes > maxBytes) {
-                    truncated = true;
-                    break;
+    return openReadNoFollow(absolute).andThen((opened) => {
+        if (opened.kind === "out_of_scope")
+            return okAsync({ kind: "out_of_scope" });
+        const fh = opened.fh;
+        return new ResultAsync((async () => {
+            // `autoClose: false` keeps the FileHandle ours to close — destroying
+            // the stream must not race a close against our own `fh.close()`.
+            const stream = fh.createReadStream({ highWaterMark: 16 * 1024, autoClose: false });
+            const rl = createInterface({ input: stream, crlfDelay: Infinity });
+            const collected = [];
+            let bytes = 0;
+            let truncated = false;
+            try {
+                for await (const line of rl) {
+                    const lineBytes = Buffer.byteLength(line, "utf8") + 1;
+                    if (maxBytes !== undefined && bytes + lineBytes > maxBytes) {
+                        truncated = true;
+                        break;
+                    }
+                    collected.push(line);
+                    bytes += lineBytes;
+                    if (collected.length >= headLines)
+                        break;
                 }
-                collected.push(line);
-                bytes += lineBytes;
-                if (collected.length >= headLines)
-                    break;
             }
-        }
-        finally {
-            rl.close();
-            stream.destroy();
-        }
-        const content = Buffer.from(collected.join("\n"));
-        if (truncated) {
-            // Total size is unknown without a full stat; report it as a separate read.
-            return (await safeStat(absolute)).map((s) => ({
-                kind: "truncated",
-                content,
-                totalSize: s?.size ?? content.length,
-            }));
-        }
-        // Whether the loop exhausted the file or hit the line cap, the agent asked
-        // for exactly this window, so this is `ok` not `truncated`. The tool layer
-        // reports `mode: "head"` so the agent knows it's a window.
-        return ok({ kind: "ok", content, truncated: false });
-    })());
+            finally {
+                rl.close();
+                stream.destroy();
+                await fh.close();
+            }
+            const content = Buffer.from(collected.join("\n"));
+            if (truncated) {
+                // Total size is unknown without a full stat; report it as a separate read.
+                return (await safeStat(absolute)).map((s) => ({
+                    kind: "truncated",
+                    content,
+                    totalSize: s?.size ?? content.length,
+                }));
+            }
+            // Whether the loop exhausted the file or hit the line cap, the agent asked
+            // for exactly this window, so this is `ok` not `truncated`. The tool layer
+            // reports `mode: "head"` so the agent knows it's a window.
+            return ok({ kind: "ok", content, truncated: false });
+        })());
+    });
 }
 /**
  * Read the last `tailLines` lines via a windowed read from the end. The
@@ -252,30 +337,34 @@ function readHeadLines(absolute, headLines, maxBytes) {
  * slicing is pure and runs inside the same `fn`.
  */
 function readTailLines(absolute, totalSize, tailLines, maxBytes) {
-    return tryFs("workspace.readTail", async () => {
-        const windowSize = Math.min(totalSize, maxBytes ?? totalSize);
-        const offset = totalSize - windowSize;
-        const fh = await fsOpen(absolute, "r");
-        try {
-            const buf = Buffer.alloc(windowSize);
-            if (windowSize > 0) {
-                await fh.read(buf, 0, windowSize, offset);
+    return openReadNoFollow(absolute).andThen((opened) => {
+        if (opened.kind === "out_of_scope")
+            return okAsync({ kind: "out_of_scope" });
+        const fh = opened.fh;
+        return tryFs("workspace.readTail", async () => {
+            try {
+                const windowSize = Math.min(totalSize, maxBytes ?? totalSize);
+                const offset = totalSize - windowSize;
+                const buf = Buffer.alloc(windowSize);
+                if (windowSize > 0) {
+                    await fh.read(buf, 0, windowSize, offset);
+                }
+                const allLines = buf.toString("utf8").split(/\r?\n/);
+                // Drop the partial leading line if the window doesn't cover the file start.
+                const candidateLines = offset > 0 ? allLines.slice(1) : allLines;
+                const sliced = candidateLines.length > tailLines ? candidateLines.slice(-tailLines) : candidateLines;
+                const content = Buffer.from(sliced.join("\n"));
+                const gotEnoughLines = sliced.length >= tailLines || offset === 0;
+                if (!gotEnoughLines) {
+                    return { kind: "truncated", content, totalSize };
+                }
+                return { kind: "ok", content, truncated: false };
             }
-            const allLines = buf.toString("utf8").split(/\r?\n/);
-            // Drop the partial leading line if the window doesn't cover the file start.
-            const candidateLines = offset > 0 ? allLines.slice(1) : allLines;
-            const sliced = candidateLines.length > tailLines ? candidateLines.slice(-tailLines) : candidateLines;
-            const content = Buffer.from(sliced.join("\n"));
-            const gotEnoughLines = sliced.length >= tailLines || offset === 0;
-            if (!gotEnoughLines) {
-                return { kind: "truncated", content, totalSize };
+            finally {
+                await fh.close();
             }
-            return { kind: "ok", content, truncated: false };
-        }
-        finally {
-            await fh.close();
-        }
-    }, { path: absolute });
+        }, { path: absolute });
+    });
 }
 function sliceHeadLines(content, headLines, maxBytes) {
     const capped = maxBytes !== undefined && content.length > maxBytes ? content.subarray(0, maxBytes) : content;

package/package.json

@@ -1,101 +1,100 @@
 {
-  "name": "@inflexa-ai/harness",
-  "version": "0.2.0",
-  "description": "Host-agnostic bioinformatics agent harness — hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
-  "license": "Apache-2.0",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+    "name": "@inflexa-ai/harness",
+    "version": "0.4.0",
+    "description": "Host-agnostic bioinformatics agent harness \u2014 hand-rolled agent loop, DBOS-durable workflows, sandboxed compute.",
+    "license": "Apache-2.0",
+    "type": "module",
+    "main": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.js"
+        },
+        "./*.js": {
+            "types": "./dist/*.d.ts",
+            "import": "./dist/*.js"
+        },
+        "./*": {
+            "types": "./dist/*.d.ts",
+            "import": "./dist/*.js"
+        }
     },
-    "./*.js": {
-      "types": "./dist/*.d.ts",
-      "import": "./dist/*.js"
+    "files": [
+        "dist",
+        "NOTICE"
+    ],
+    "engines": {
+        "node": ">=24"
     },
-    "./*": {
-      "types": "./dist/*.d.ts",
-      "import": "./dist/*.js"
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/inflexa-ai/inflexa.git",
+        "directory": "harness"
+    },
+    "scripts": {
+        "build": "tsc -p tsconfig.json",
+        "format": "prettier --write src/",
+        "format:file": "prettier --write",
+        "lint": "eslint .",
+        "prepare": "tsc -p tsconfig.json",
+        "prepublishOnly": "bun run build && bun run smoke",
+        "smoke": "node scripts/smoke.mjs",
+        "typecheck": "tsc --noEmit"
+    },
+    "dependencies": {
+        "@ai-sdk/anthropic": "^4.0.15",
+        "@ai-sdk/openai-compatible": "^3.0.10",
+        "@ai-sdk/provider": "^4.0.3",
+        "@anthropic-ai/sdk": "^0.107.0",
+        "@dbos-inc/dbos-sdk": "^4.23.6",
+        "@kubernetes/client-node": "^1.4.0",
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/core": "^2.9.0",
+        "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
+        "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
+        "@opentelemetry/resources": "^2.9.0",
+        "@opentelemetry/sdk-metrics": "^2.9.0",
+        "@opentelemetry/sdk-trace-base": "^2.9.0",
+        "@opentelemetry/sdk-trace-node": "^2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.43.0",
+        "ai": "^7.0.28",
+        "cheerio": "^1.2.0",
+        "dockerode": "^4.0.12",
+        "fast-xml-parser": "^5.10.0",
+        "hono": "^4.12.30",
+        "js-tiktoken": "^1.0.21",
+        "mime": "^4.1.0",
+        "nanoid": "^5.1.16",
+        "neverthrow": "^8.2.0",
+        "nunjucks": "^3.2.4",
+        "openai": "^4.104.0",
+        "pdf-parse": "^2.4.5",
+        "pg": "^8.22.0",
+        "puppeteer-core": "^23.11.1",
+        "zod": "^4.4.3"
+    },
+    "devDependencies": {
+        "@eslint/js": "^10.0.1",
+        "@types/bun": "latest",
+        "@types/dockerode": "^3.3.47",
+        "@types/node": "^24.13.3",
+        "@types/nunjucks": "^3.2.6",
+        "@types/pdf-parse": "^1.1.5",
+        "@types/pg": "^8.20.0",
+        "eslint": "^10.7.0",
+        "eslint-plugin-neverthrow": "^1.1.4",
+        "globals": "^17.7.0",
+        "prettier": "^3.9.5",
+        "testcontainers": "^10.28.0",
+        "typescript": "^6.0.3",
+        "typescript-eslint": "^8.64.0"
+    },
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org"
+    },
+    "patchedDependencies": {
+        "eslint-plugin-neverthrow@1.1.4": "patches/eslint-plugin-neverthrow@1.1.4.patch"
     }
-  },
-  "files": [
-    "dist",
-    "NOTICE"
-  ],
-  "engines": {
-    "node": ">=24"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/inflexa-ai/inflexa.git",
-    "directory": "harness"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "format": "prettier --write src/",
-    "format:file": "prettier --write",
-    "lint": "eslint .",
-    "prepare": "tsc -p tsconfig.json",
-    "prepublishOnly": "bun run build && bun run smoke",
-    "smoke": "node scripts/smoke.mjs",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@ai-sdk/anthropic": "^4.0.15",
-    "@ai-sdk/openai-compatible": "^3.0.10",
-    "@ai-sdk/provider": "^4.0.3",
-    "@anthropic-ai/sdk": "^0.107.0",
-    "@dbos-inc/dbos-sdk": "^4.23.6",
-    "@kubernetes/client-node": "^1.4.0",
-    "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/core": "^2.9.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
-    "@opentelemetry/resources": "^2.9.0",
-    "@opentelemetry/sdk-metrics": "^2.9.0",
-    "@opentelemetry/sdk-trace-base": "^2.9.0",
-    "@opentelemetry/sdk-trace-node": "^2.9.0",
-    "@opentelemetry/semantic-conventions": "^1.43.0",
-    "ai": "^7.0.28",
-    "cheerio": "^1.2.0",
-    "dockerode": "^4.0.12",
-    "fast-xml-parser": "^5.10.0",
-    "hono": "^4.12.30",
-    "js-tiktoken": "^1.0.21",
-    "mime": "^4.1.0",
-    "nanoid": "^5.1.16",
-    "neverthrow": "^8.2.0",
-    "nunjucks": "^3.2.4",
-    "openai": "^4.104.0",
-    "pdf-parse": "^2.4.5",
-    "pg": "^8.22.0",
-    "pino": "^10.3.1",
-    "puppeteer-core": "^23.11.1",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/bun": "latest",
-    "@types/dockerode": "^3.3.47",
-    "@types/node": "^24.13.3",
-    "@types/nunjucks": "^3.2.6",
-    "@types/pdf-parse": "^1.1.5",
-    "@types/pg": "^8.20.0",
-    "eslint": "^10.7.0",
-    "eslint-plugin-neverthrow": "^1.1.4",
-    "globals": "^17.7.0",
-    "prettier": "^3.9.5",
-    "testcontainers": "^10.28.0",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.64.0"
-  },
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  },
-  "patchedDependencies": {
-    "eslint-plugin-neverthrow@1.1.4": "patches/eslint-plugin-neverthrow@1.1.4.patch"
-  }
 }