@opengsd/gsd-core 1.10.0 → 1.12.0

package/gsd-core/bin/lib/capability-lifecycle.cjs

@@ -42,6 +42,15 @@ const semverMod = require('./semver-compare.cjs');
 // ---------------------------------------------------------------------------
 /** Stamp written onto every capability-owned shared-config entry, for surgical removal. */
 const CAP_MARKER = '_gsdCapability';
+const GIT_SHA_PIN_RE = /^sha:[0-9a-f]{7,40}$/i;
+function resolveIntegrityPin(integrity, parsed) {
+    if (typeof integrity === 'string' && integrity.length > 0)
+        return 'sha512';
+    if (parsed.kind === 'git' && typeof parsed.ref === 'string' && GIT_SHA_PIN_RE.test(parsed.ref)) {
+        return 'git-commit';
+    }
+    return 'none';
+}
 /** Keys that must never be used as object indices (prototype-pollution guard). */
 function isUnsafeKey(k) {
     return k === '__proto__' || k === 'constructor' || k === 'prototype';
@@ -253,6 +262,28 @@ function confinedSharedFile(runtimeDir, relFile) {
 // isSafeHookScriptPath; see confinedBundleScript for why). Only [A-Za-z0-9._/-], no leading
 // `-` segment, no `..`, not absolute.
 const SAFE_HOOK_SCRIPT_RE = /^[A-Za-z0-9._/-]+$/;
+// #3631 (defense-in-depth, mirrors capability-validator.cjs — KEEP BOTH IN SYNC): a declared script
+// path must not point into the space bundleContentHash (capability-consent.cts) excludes from the
+// consent-binding digest. A file whose basename ends `.pyc`/`.pyo` can contain perfectly valid
+// JavaScript and would be executed by `node` regardless of extension, and a `__pycache__`/
+// `.pytest_cache` segment marks a directory whose digest marker is suppressed — so a MANIFEST-DECLARED
+// executable surface must never be able to reach either, or the exclusion becomes reachable from a
+// path an attacker fully controls at declare-time rather than only via post-consent tamper.
+// Regex asymmetry is DELIBERATE, KEEP BOTH RULES IN SYNC WITH capability-validator.cjs (byte-identical
+// text, verified by the isSafeHookScriptPath parity test in tests/capability-registry.test.cjs):
+//   (i)   PYCACHE_SUFFIX_RE is case-INSENSITIVE (`/i`) on purpose — a validator should be STRICTER than
+//         the digest it defends, so it rejects `x.PYC` too even though bundleContentHash's own suffix
+//         match (hasPycacheFileSuffix, capability-consent.cts) is byte-exact and would still hash it.
+//   (ii)  The __pycache__/.pytest_cache SEGMENT match is case-SENSITIVE to match the digest's own
+//         byte-exact, case-sensitive directory-basename comparison (CPython always writes a lowercase
+//         `__pycache__`) — a validator segment match looser than the digest here would reject paths the
+//         digest would still hash, which is over-strict in the wrong direction for a defense-in-depth
+//         check layered on top of an already-correct digest.
+//   (iii) The `[/\\]` backslash alternations in both regexes are defensive/UNREACHABLE in practice:
+//         SAFE_HOOK_SCRIPT_RE (above) already rejects any backslash character outright, so a script
+//         string containing `\` never reaches either PYCACHE_*_RE check.
+const PYCACHE_SEGMENT_RE = /(?:^|[/\\])(__pycache__|\.pytest_cache)(?:[/\\]|$)/;
+const PYCACHE_SUFFIX_RE = /\.(pyc|pyo)$/i;
 function isSafeHookScriptPath(script) {
     if (typeof script !== 'string' || script.length === 0)
         return false;
@@ -267,6 +298,10 @@ function isSafeHookScriptPath(script) {
         if (seg.startsWith('-'))
             return false;
     }
+    if (PYCACHE_SEGMENT_RE.test(script))
+        return false;
+    if (PYCACHE_SUFFIX_RE.test(node_path_1.default.basename(script)))
+        return false;
     return true;
 }
 /**
@@ -504,6 +539,14 @@ function applyCapabilitySharedEdits(args) {
             settings['hooks'] = hooksObj;
         }
         if (mcpEntries.length > 0) {
+            // #3515 (epic #1900 F20): the MCP config below is written VERBATIM — command/args/env/cwd
+            // are NOT confined to the bundle the way hook scripts are (confinedBundleScript, D5 rule 5).
+            // This asymmetry is INTENTIONAL: most real MCP servers legitimately resolve command/args/cwd
+            // to global or npx installs outside the capability bundle, so confinement would break them.
+            // The compensating controls are disclosure + re-consent: the consent prompt renders an
+            // explicit "not confined to the bundle" notice for every spawned server (summarizeDisclosure,
+            // capability-trust.cts), and disclosureSignature folds command/args/env/cwd + the FULL
+            // rawConfig as stable-sorted JSON (#1459 finding 5), so ANY config change forces re-consent.
             const mcpObj = (typeof settings['mcpServers'] === 'object' && settings['mcpServers'] !== null && !Array.isArray(settings['mcpServers']))
                 ? settings['mcpServers']
                 : {};
@@ -846,6 +889,7 @@ async function installCapability(spec, opts) {
             stagedDir,
             strictKnownRegistries,
             hostVersion,
+            integrityPin: resolveIntegrityPin(opts.integrity, parsedPre),
         });
         if (!verdict.allowed) {
             return { status: 'blocked', disclosure: verdict.disclosure, blockReasons: verdict.blockReasons };
@@ -1038,6 +1082,7 @@ async function upgradeCapability(spec, opts) {
             stagedDir,
             strictKnownRegistries,
             hostVersion,
+            integrityPin: resolveIntegrityPin(opts.integrity, parsedPre),
         });
         if (!verdict.allowed) {
             return { status: 'blocked', disclosure: verdict.disclosure, blockReasons: verdict.blockReasons };

package/gsd-core/bin/lib/capability-lock.cjs

@@ -350,10 +350,16 @@ function lockBodyToken(body) {
  * and the whole thing is a BOUNDED iterative loop.
  */
 function acquireLock(lockPath, opts) {
-    try {
-        node_fs_1.default.mkdirSync(node_path_1.default.dirname(lockPath), { recursive: true });
-    }
-    catch { /* best-effort */ }
+    // A genuine failure here (EACCES/ENOSPC/EROFS) MUST surface immediately, matching the #1884
+    // fix (0c43d853e / PR #3472) for withPlanningLock's identical shape. The prior
+    // `catch { /* best-effort */ }` swallowed it, and the subsequent `fs.openSync(lockPath, 'wx')`
+    // below then failed with ENOENT (parent dir missing) — which is NOT 'EEXIST', so the
+    // `if (code !== 'EEXIST') return null;` branch laundered a fatal filesystem error into an
+    // ordinary "lock unavailable" (null) result, indistinguishable from another live process
+    // legitimately holding the lock (#3987). `mkdirSync(recursive:true)` does not throw when the
+    // directory already exists, so the normal path (dir already present) is unaffected; only real
+    // creation failures propagate.
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(lockPath), { recursive: true });
     const maxAttempts = (opts && Number.isInteger(opts.maxAttempts) && opts.maxAttempts > 0)
         ? opts.maxAttempts
         : LOCK_MAX_ATTEMPTS;