@nowcrew/daemon 0.6.88-beta.28 → 0.6.88-beta.29

package/dist/workspace-fs.js

@@ -3,21 +3,31 @@
  *
  * 安全铁律:
  *  - 所有路径都 resolve 后必须仍落在 agent 根内 (防 `..` / 符号链接逃逸)。
- *  - 隐藏内部目录与点文件 (.crew / .git / 任何 . 开头)。
+ *  - 列表隐藏点文件；内部环境快照始终不可列出或读取，包括链接别名。
  *  - 只回文本文件,二进制拒绝;单文件大小上限,超出截断。
  *  - 仅 list / read,无写删。
  */
-import { realpath, readdir, readFile, stat } from "node:fs/promises";
-import { join, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { realpath, readdir, lstat, open, stat } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
 export class FsError extends Error {
 }
 const MAX_FILE_BYTES = 256 * 1024; // 单文件查看上限 256KB
 const HIDDEN = new Set([".crew", ".git", ".slock"]);
 const isHidden = (name) => name.startsWith(".") || HIDDEN.has(name);
+/** 该命名空间包含完整机器环境，只允许本地执行 harness 使用。 */
+export const isInternalEnvironmentPath = (path) => path.split(/[\\/]/u)
+    .some((part) => part.toLowerCase().startsWith(".environment-"));
+const assertViewablePath = (path) => {
+    if (isInternalEnvironmentPath(path))
+        throw new FsError("file_not_viewable");
+};
 /** 把相对路径安全解析到 root 内的绝对路径;越界抛错。realpath 兜底符号链接逃逸。 */
 async function safeResolve(root, rel) {
+    assertViewablePath(rel);
     const rootResolved = await realpath(root);
     const target = resolve(rootResolved, rel.replace(/^\/+/, ""));
+    assertViewablePath(target);
     const withSep = rootResolved.endsWith(sep) ? rootResolved : rootResolved + sep;
     if (target !== rootResolved && !target.startsWith(withSep)) {
         throw new FsError("path escapes workspace");
@@ -33,6 +43,7 @@ async function safeResolve(root, rel) {
     if (real !== rootResolved && !real.startsWith(withSep)) {
         throw new FsError("path escapes workspace (symlink)");
     }
+    assertViewablePath(real);
     return real;
 }
 /** 列出某目录 (相对 root)。隐藏点文件/内部目录;目录在前、按名排序。 */
@@ -51,13 +62,15 @@ export async function listWorkspace(root, rel) {
     for (const name of names) {
         if (isHidden(name))
             continue;
-        const full = join(dir, name);
+        const full = await safeResolve(root, relative(rootResolved, join(dir, name))).catch(() => null);
+        if (full === null)
+            continue;
         const s = await stat(full).catch(() => null);
         if (!s)
             continue;
         if (s.isDirectory())
             entries.push({ name, type: "dir" });
-        else if (s.isFile())
+        else if (s.isFile() && s.nlink === 1)
             entries.push({ name, type: "file", size: s.size });
     }
     entries.sort((a, b) => a.type !== b.type ? (a.type === "dir" ? -1 : 1) : a.name.localeCompare(b.name));
@@ -66,15 +79,53 @@ export async function listWorkspace(root, rel) {
 /** 读取某文本文件 (相对 root)。二进制/超大拒绝或截断。 */
 export async function readWorkspaceFile(root, rel) {
     const file = await safeResolve(root, rel);
-    const s = await stat(file).catch(() => null);
-    if (!s || !s.isFile())
+    const before = await lstat(file, { bigint: true }).catch(() => null);
+    if (!before?.isFile())
         throw new FsError("not a file");
-    const buf = await readFile(file);
-    // 二进制探测:含 NUL 即视为二进制
-    const sample = buf.subarray(0, Math.min(buf.length, 8192));
-    if (sample.includes(0))
-        throw new FsError("binary file not viewable");
-    const truncated = buf.length > MAX_FILE_BYTES;
-    const content = buf.subarray(0, MAX_FILE_BYTES).toString("utf8");
-    return { path: rel.replace(/^\/+/, ""), content, truncated, size: buf.length };
+    // 真实路径不能辨认硬链接的私有来源，因此拒绝多链接文件。
+    if (before.nlink !== 1n)
+        throw new FsError("file_not_viewable");
+    // macOS 原子拒绝父目录链接；Linux 在打开后额外核对句柄的真实路径。
+    const noFollow = process.platform === "darwin" ? 0x20000000 : (constants.O_NOFOLLOW ?? 0);
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | noFollow)
+        .catch(() => { throw new FsError("file_not_viewable"); });
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== before.dev || opened.ino !== before.ino)
+            throw new FsError("file_changed");
+        if (process.platform === "linux") {
+            const actual = await realpath(`/proc/self/fd/${handle.fd}`);
+            assertViewablePath(actual);
+            if (actual !== file)
+                throw new FsError("file_changed");
+        }
+        if (await safeResolve(root, rel) !== file)
+            throw new FsError("file_changed");
+        const buffer = Buffer.alloc(MAX_FILE_BYTES);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const after = await handle.stat({ bigint: true });
+        const current = await lstat(file, { bigint: true });
+        if (await safeResolve(root, rel) !== file || !current.isFile() || current.nlink !== 1n
+            || current.dev !== opened.dev || current.ino !== opened.ino || after.nlink !== 1n
+            || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs)
+            throw new FsError("file_changed");
+        const bytes = buffer.subarray(0, length);
+        if (bytes.subarray(0, Math.min(length, 8192)).includes(0))
+            throw new FsError("binary file not viewable");
+        return { path: rel.replace(/^\/+/, ""), content: bytes.toString("utf8"), truncated: opened.size > BigInt(length), size: Number(opened.size) };
+    }
+    catch (error) {
+        if (error instanceof FsError)
+            throw error;
+        throw new FsError("file_changed");
+    }
+    finally {
+        await handle.close();
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nowcrew/daemon",
-  "version": "0.6.88-beta.28",
+  "version": "0.6.88-beta.29",
   "type": "module",
   "description": "crew daemon — 运行在用户机器:拉起/管理 agent 进程,注入 crew CLI,归一化 runtime 事件",
   "license": "Apache-2.0",
@@ -16,16 +16,9 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "pnpm build && node ../scripts/daemon-release-artifact.mjs --strict-registry",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.2.1",
-    "@nowcrew/cli": "0.4.14",
+    "@nowcrew/cli": "0.4.17",
     "cross-spawn": "^7.0.6",
     "semver": "7.8.5",
     "ws": "^8",
@@ -43,5 +36,11 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "daemon": "pnpm --filter @nowcrew/cli build && tsx src/main.ts",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}