@kinlab/kin 0.6.5 → 0.6.6

package/lib/provision.mjs

@@ -386,9 +386,40 @@ function windowsSystemTarPath(env) {
   return path.win32.join(systemRoot, 'System32', 'tar.exe');
 }
 
-function archiveExtraction(platform, env, file) {
+// Where a Unix system tool is allowed to come from.
+//
+// `spawnSync('tar', ...)` resolves through PATH, and PATH belongs to whoever
+// started this process. A `tar` planted earlier in it unpacks the archive
+// whose SHA-256 was just verified, so the integrity check ends up protecting
+// bytes that somebody else's program reads. These directories are root-owned
+// on macOS and Linux and SIP-protected on macOS. The Windows arm has named its
+// extractor absolutely since it was written; this is the same rule on Unix.
+const UNIX_TOOL_DIRECTORIES = ['/usr/bin', '/bin'];
+
+// The absolute path of a Unix system tool, refused when it is in none of the
+// trusted directories.
+//
+// Refusing rather than falling back to PATH: a fallback makes the guard
+// advisory, and provision already reports an extractor that will not run.
+function unixSystemToolPath(name) {
+  for (const directory of UNIX_TOOL_DIRECTORIES) {
+    const candidate = path.posix.join(directory, name);
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  throw new Error(
+    `${name} was not found in ${UNIX_TOOL_DIRECTORIES.join(' or ')}; refusing to resolve it ` +
+      'through PATH, where a planted binary would run in its place',
+  );
+}
+
+// The archive layout comes from the TARGET, the extractor from the HOST, and
+// conflating the two is what broke the native Windows leg once already: a
+// Windows host has no /usr/bin, and the cross-target tests unpack a darwin
+// archive on it. `host` is a parameter rather than a read of `process.platform`
+// so every combination is testable from one machine.
+export function archiveExtraction(platform, env, file, host = process.platform) {
   if (platform === 'win32') {
-    if (process.platform === 'win32') {
+    if (host === 'win32') {
       return {
         executable: windowsSystemTarPath(env),
         args: ['-xf', file, '-C', '.'],
@@ -402,7 +433,14 @@ function archiveExtraction(platform, env, file) {
       args: ['-q', file, '-d', '.'],
     };
   }
-  return { executable: 'tar', args: ['-xf', file, '-C', '.'] };
+  // A Unix archive. On a Unix host that is the absolute system tar; on a
+  // Windows host, which only ever happens under a cross-target test, it is the
+  // same System32 bsdtar the Windows arm above uses, and bsdtar reads .tar.gz.
+  // Either way the extractor is named absolutely rather than found on PATH.
+  return {
+    executable: host === 'win32' ? windowsSystemTarPath(env) : unixSystemToolPath('tar'),
+    args: ['-xf', file, '-C', '.'],
+  };
 }
 
 /**
@@ -493,9 +531,10 @@ export async function provision(version, opts = {}) {
 
     const toolEnv = mergeEnvironment(process.env, env);
     const extraction = archiveExtraction(platform, toolEnv, file);
-    // Windows authority is the absolute System32 bsdtar, never a Git/MSYS or
-    // user-provided `tar` found through PATH. Relative operands also avoid the
-    // GNU remote-host interpretation of `C:\\...` paths.
+    // The extractor is named absolutely on both platforms: System32 bsdtar on
+    // Windows, never a Git/MSYS `tar` earlier in PATH, and /usr/bin/tar or
+    // /bin/tar on Unix. Relative operands also avoid the GNU remote-host
+    // interpretation of `C:\\...` paths.
     const extracted = spawnSync(extraction.executable, extraction.args, {
       cwd: tmp,
       encoding: 'utf8',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinlab/kin",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "Canonical installer and launcher for Kin, the system of record for AI-written software. Provisions and runs the managed kin + kin-daemon release. MCP is one included mode (kin mcp start).",
   "license": "Apache-2.0",
   "type": "module",