@opengsd/gsd-core 1.10.0 → 1.12.0

package/gsd-core/bin/lib/capability-source.cjs

@@ -96,8 +96,100 @@ function _setHttpsGetImpl(fn) {
 // ---------------------------------------------------------------------------
 // Injectable HTTP transport (test seam)
 // ---------------------------------------------------------------------------
+/**
+ * #3514 (epic #1900 F21): pre-transport fetch gate. Runs BEFORE any bytes leave and before the
+ * (possibly injected) transport is invoked:
+ *
+ *  - Non-`https` URLs are refused with a NAMED, actionable reason. parseSpec still CLASSIFIES an
+ *    `http://` tarball URL as tarball (no parse-time hard reject — internal-mirror classification
+ *    flows stay intact, the adopted split decision on the epic); the https-only transport then
+ *    fails clearly instead of with a raw ERR_INVALID_PROTOCOL.
+ *  - Loopback / link-local / metadata / unspecified hosts and `localhost`-form names are denied
+ *    unconditionally — no legitimate capability install fetches them. RFC1918 private ranges are
+ *    deliberately ALLOWED (internal mirrors are the legitimate use this leaves room for); the
+ *    denylist is not an allowlist.
+ *
+ * Known limit (disclosed): the check is on the URL's HOST LITERAL. A public hostname that
+ * RESOLVES via DNS to a denied range (rebinding) is out of scope — `https.get` resolves
+ * internally and this gate does not double-resolve.
+ */
+function assertFetchableUrl(rawUrl) {
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`invalid capability source URL: "${rawUrl}"`);
+    }
+    if (u.protocol !== 'https:') {
+        throw new Error(`capability source fetch requires https — refusing "${u.protocol}" URL (host "${u.hostname}"). ` +
+            'The transport never fetches plaintext http; for an internal mirror use an https URL or a local path source.');
+    }
+    // Node's URL.hostname KEEPS the brackets on IPv6 literals ('[::1]') — strip them so the
+    // v6 checks below see the bare address. A single trailing dot is FQDN syntax ('localhost.'
+    // is the same name as 'localhost'; some resolvers synthesize loopback for it) — strip it.
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    const deniedHost = () => new Error(`refusing to fetch capability source from internal host "${host}" (loopback/link-local/metadata denylist)`);
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        throw deniedHost();
+    }
+    // IPv4 literal: 127/8 loopback, 0/8 unspecified, 169.254/16 link-local (contains the cloud
+    // metadata IPs). Malformed literals that match no range simply fall through to a failed
+    // resolution downstream — denying is not needed for safety there.
+    const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const a = Number(v4[1]);
+        const b = Number(v4[2]);
+        if (a === 127 || a === 0 || (a === 169 && b === 254))
+            throw deniedHost();
+        return;
+    }
+    // IPv6-literal checks. A registered domain NEVER contains ':' after bracket-strip, while every
+    // IPv6 literal does — that colon is the guard. Without it, the fe80::/10 prefix test below
+    // would deny legitimate domains like 'feather.internal' or 'february.example.com' (isolated
+    // review finding — a domain-shaped host must never reach the v6 branch).
+    if (!host.includes(':')) {
+        return;
+    }
+    // An IPv4-mapped address re-checks as IPv4 — in EITHER spelling, because the URL parser may
+    // preserve the dotted form ('::ffff:127.0.0.1') or normalize to hex hextets ('::ffff:7f00:1').
+    // Otherwise deny ::1 (loopback), :: (unspecified), and fe80::/10 (link-local, hex prefix range
+    // fe80–febf).
+    if (host.startsWith('::ffff:')) {
+        const suffix = host.slice('::ffff:'.length);
+        let v4str = null;
+        if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(suffix)) {
+            v4str = suffix;
+        }
+        else {
+            const hextets = suffix.split(':');
+            if (hextets.length === 2 && /^[\da-f]{1,4}$/.test(hextets[0]) && /^[\da-f]{1,4}$/.test(hextets[1])) {
+                const hi = parseInt(hextets[0], 16);
+                const lo = parseInt(hextets[1], 16);
+                v4str = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+            }
+        }
+        if (v4str) {
+            assertFetchableUrl(`https://${v4str}/`);
+            return;
+        }
+    }
+    // fe80::/10 = hex prefix fe80..febf, i.e. /^fe[89ab]/ (third nibble 8-b has top two bits set).
+    if (host === '::1' || host === '::' || /^fe[89ab]/.test(host)) {
+        throw deniedHost();
+    }
+}
 function realHttpsGet(url) {
     return new Promise((resolve, reject) => {
+        // #3514: gate BEFORE the transport — scheme + host denylist refuse with named errors and
+        // never invoke the (possibly injected) transport. A throw inside the executor rejects.
+        try {
+            assertFetchableUrl(url);
+        }
+        catch (err) {
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+        }
         const req = _httpsGetImpl(url, { headers: { 'User-Agent': 'gsd-core-capability-source/1.0' } }, (res) => {
             // DOS-1: reject early if the server ADVERTISES a body over the cap — no bytes buffered.
             const contentLength = Number(res.headers?.['content-length']);

package/gsd-core/bin/lib/capability-state.cjs

@@ -45,7 +45,7 @@ const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const installProfilesMod = require("./install-profiles.cjs");
-const { readActiveProfile, loadSkillsManifest, resolveProfile, parseRequires, parseCallsAgents } = installProfilesMod;
+const { readActiveProfile, loadSkillsManifest, resolveProfile, parseRequires, parseCallsAgents, workflowAgentRefs } = installProfilesMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const surfaceMod = require("./surface.cjs");
 const { resolveSurface } = surfaceMod;
@@ -299,7 +299,17 @@ function _loadInstalledSkillsManifest(configDir) {
  * no gsd-*.md files (so _resolveManifest can use size>0 as the "flat layout
  * present" signal and fall through to the installed-skills branch otherwise).
  */
-function _loadFlatCommandsGsdManifest(commandsParentDir) {
+function _loadFlatCommandsGsdManifest(commandsParentDir, workflowsDir) {
+    // #3798: derive agents from the command body PLUS the workflow files it
+    // references, exactly like loadSkillsManifest does for the nested layout —
+    // the flat (#1858) layout retained the original defect otherwise, and the
+    // parity test in tests/capability-state.test.cjs asserts the two loaders
+    // produce identical _calls_agents_* sets. Default: <pkg>/gsd-core/workflows
+    // one level above the commands dir — the shape of both the repo checkout
+    // (<repo>/commands/) and a flat runtime install (the runtime config dir's
+    // commands/ with the package's gsd-core/ beside it).
+    const flatWorkflowsDir = workflowsDir
+        || node_path_1.default.resolve(commandsParentDir, '..', 'gsd-core', 'workflows');
     const manifest = new Map();
     let entries;
     try {
@@ -327,7 +337,12 @@ function _loadFlatCommandsGsdManifest(commandsParentDir) {
         try {
             const content = node_fs_1.default.readFileSync(node_path_1.default.join(commandsParentDir, entry.name), 'utf8');
             manifest.set(stem, parseRequires(content));
-            manifest.set(`_calls_agents_${stem}`, parseCallsAgents(content));
+            manifest.set(`_calls_agents_${stem}`, [
+                ...new Set([
+                    ...parseCallsAgents(content),
+                    ...workflowAgentRefs(content, flatWorkflowsDir),
+                ]),
+            ]);
         }
         catch {
             manifest.set(stem, []);