@maintainabilityai/research-runner 0.1.45 → 0.1.47

package/dist/runner/skills.js

@@ -1338,6 +1338,27 @@ const handleKnowledgeCode = async (input) => {
         // Workflow gate consumes this to validate cited paths.
         inventory_paths: inventoryPaths,
     };
+    // Bug-R / R6 + Bug-S / S6 (Codex round-4 hardening) — persist
+    // inventory to the clone cache so knowledge-code-read can strict-
+    // mode validate requested paths against the same list that lands
+    // in the audit chain. Round-3 caught the inventory-persist write
+    // being non-fatal; round-4 flagged that as fail-open — without
+    // a written inventory, knowledge-code-read's path-not-in-inventory
+    // check silently falls through (the file just isn't there to
+    // check against). S6 fix: persist failure is now FATAL. The
+    // brownfield grounding contract requires the inventory to exist;
+    // a skill_call that succeeded without writing it is a coverage lie.
+    try {
+        fs.writeFileSync(path.join(cloneTarget, '.knowledge-code-inventory.json'), JSON.stringify({ inventory_paths: inventoryPaths, sha, cachedAt: new Date().toISOString() }), 'utf8');
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: `inventory-persist-failed: ${err instanceof Error ? err.message : String(err)}`,
+            repo: repoSlug,
+            remediation: "knowledge-code MUST persist its file inventory so knowledge-code-read can strict-mode validate file reads against it. Check tmpdir permissions and disk space.",
+        };
+    }
     return {
         ok: true,
         mode: 'brownfield',
@@ -1407,9 +1428,26 @@ const handleKnowledgeCodeRead = async (input) => {
     if (normalized.startsWith('..') || normalized === '..' || normalized.includes(`${path.sep}..${path.sep}`)) {
         return { ok: false, reason: `path-rejected: path-traversal segments forbidden (${filePath} -> ${normalized})` };
     }
-    // Reuse the cached clone from knowledge-code; clone fresh if missing
-    // (e.g. agent called knowledge-code-read without calling knowledge-
-    // code first — supported but slower).
+    // Bug-R / R6 (Codex round-3) — auth tightening. A prior knowledge-
+    // code call for this (runId, owner, name) MUST have populated the
+    // cache before knowledge-code-read can return content. Closes two
+    // gaps Codex flagged: (1) skill could read any public GitHub repo
+    // by URL alone, (2) audit chain didn't prove the standard
+    // brownfield-grounding pipeline ran before the file read. Test
+    // mode (KNOWLEDGE_CODE_READ_ALLOW_UNCACHED=1) bypasses this for
+    // unit tests that drive the skill directly.
+    const cacheDir = knowledgeCodeCacheDir(runId, gh.owner, gh.name);
+    const metaPath = path.join(cacheDir, '.cache-meta.json');
+    const allowUncached = process.env.KNOWLEDGE_CODE_READ_ALLOW_UNCACHED === '1';
+    if (!allowUncached && !fs.existsSync(metaPath)) {
+        return {
+            ok: false,
+            reason: `no-prior-knowledge-code: knowledge-code-read requires a prior knowledge-code call for ${gh.owner}/${gh.name} in run ${runId}. Call knowledge-code first to clone + classify the repo, then knowledge-code-read can return file contents from the cached clone.`,
+            remediation: "Call `knowledge-code` with the same repoUrl + runId before invoking knowledge-code-read. The audit chain then proves the agent went through brownfield grounding before reading files.",
+        };
+    }
+    // Reuse the cached clone from knowledge-code; clone fresh only in
+    // test mode (allowUncached).
     const cloneResult = ensureClone(runId, repoUrl, ref ?? 'HEAD', gh.owner, gh.name);
     if (!cloneResult.ok) {
         return {
@@ -1419,6 +1457,49 @@ const handleKnowledgeCodeRead = async (input) => {
             remediation: `Could not access clone for ${repoUrl}. Underlying error: ${cloneResult.error ?? 'unknown'}`,
         };
     }
+    // Bug-R / R6 + Bug-S / S6 (Codex round-4 hardening) — validate
+    // the requested path against the inventory persisted by knowledge-
+    // code. Only paths knowledge-code advertised in `inventory_paths`
+    // are readable. Round-3 left missing/malformed inventory as a
+    // fall-through (silent pass); round-4 caught that as fail-open.
+    // S6: missing inventory file or malformed JSON is now a HARD
+    // FAILURE in non-test mode. The cache exists (we passed the
+    // earlier no-cache check), so the inventory file MUST exist —
+    // its absence means knowledge-code didn't complete normally.
+    if (!allowUncached) {
+        const inventoryPath = path.join(cloneResult.path, '.knowledge-code-inventory.json');
+        if (!fs.existsSync(inventoryPath)) {
+            return {
+                ok: false,
+                reason: `inventory-missing: ${gh.owner}/${gh.name}'s clone exists but .knowledge-code-inventory.json is absent. knowledge-code did not complete normally — re-run it before invoking knowledge-code-read.`,
+            };
+        }
+        let inv;
+        try {
+            inv = JSON.parse(fs.readFileSync(inventoryPath, 'utf8'));
+        }
+        catch (err) {
+            return {
+                ok: false,
+                reason: `inventory-malformed: .knowledge-code-inventory.json could not be parsed: ${err instanceof Error ? err.message : String(err)}`,
+                remediation: "Re-run knowledge-code to regenerate the inventory.",
+            };
+        }
+        const allowed = new Set(inv.inventory_paths ?? []);
+        if (allowed.size === 0) {
+            return {
+                ok: false,
+                reason: `inventory-empty: .knowledge-code-inventory.json carries no inventory_paths. knowledge-code likely walked zero files (empty repo? maxFiles=0?). Cannot validate file reads.`,
+            };
+        }
+        if (!allowed.has(normalized)) {
+            return {
+                ok: false,
+                reason: `path-not-in-inventory: ${normalized} is not in the knowledge-code inventory_paths for ${gh.owner}/${gh.name}. The agent can only read files knowledge-code advertised in the chain.`,
+                remediation: "If the file is real but missed by the bounded walk (default maxFiles=200), call knowledge-code with a higher maxFiles before retrying.",
+            };
+        }
+    }
     const absPath = path.join(cloneResult.path, normalized);
     // Final paranoia check — resolve the real path and verify it's still
     // a child of the clone root. Defends against symlink-shaped escapes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainabilityai/research-runner",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Research + PRD agent runner — orchestrates the Archeologist and PRD pipelines for the MaintainabilityAI governance mesh",
   "license": "MIT",
   "author": "MaintainabilityAI",