@piagent/platform 1.2.0 → 1.2.2

package/packages/piagent-core/capabilities/capability-core.js

@@ -238,8 +238,13 @@ export function validateCapabilityPack(document, options = {}) {
 
     if (rejectUnknownKeys(spec.activation, new Set(["mode", "profiles", "triggers"]), `${source}.spec.activation`, errors)) {
       if (!ACTIVATION_MODES.has(spec.activation.mode)) pushError(errors, `${source}.spec.activation.mode`, "must be explicit, profile, or trigger");
-      validateStringArray(spec.activation.profiles ?? [], `${source}.spec.activation.profiles`, errors, { maxItems: 64, pattern: NAME_PATTERN });
+      const profiles = validateStringArray(spec.activation.profiles ?? [], `${source}.spec.activation.profiles`, errors, { maxItems: 64, pattern: NAME_PATTERN });
       const triggers = validateStringArray(spec.activation.triggers ?? [], `${source}.spec.activation.triggers`, errors, { maxItems: 64 });
+      // Both modes name the thing that switches them on, so both are checked for
+      // it. Only `trigger` was, which let a pack declare profile activation and
+      // list no profiles: resolution then read `.includes` off an absent array
+      // and died with a TypeError where it should have refused with a reason.
+      if (spec.activation.mode === "profile" && profiles.length === 0) pushError(errors, `${source}.spec.activation.profiles`, "must not be empty for profile activation");
       if (spec.activation.mode === "trigger" && triggers.length === 0) pushError(errors, `${source}.spec.activation.triggers`, "must not be empty for trigger activation");
     }
 
@@ -859,7 +864,10 @@ export function resolveCapabilityProfileDocument(root, profile, options = {}) {
     const key = `${selector.name}@${selector.version}`;
     const directPack = byKey.get(key);
     if (!directPack) throw new CapabilityValidationError(`profile selects unknown capability pack ${key}`);
-    if (directPack.activation.mode === "profile" && !directPack.activation.profiles.includes(profile.mode)) throw new CapabilityValidationError(`${key} is not enabled for profile mode ${profile.mode}`);
+    // Defaulted rather than assumed present. The validator now requires the list
+    // for this mode, but this line runs against whatever is on disk, and reading
+    // through to a TypeError would turn a refusal into a crash.
+    if (directPack.activation.mode === "profile" && !(directPack.activation.profiles ?? []).includes(profile.mode)) throw new CapabilityValidationError(`${key} is not enabled for profile mode ${profile.mode}`);
     select(key);
   }
 
@@ -995,22 +1003,51 @@ export function resolveCapabilityProfile(root, profilePath, options = {}) {
 const GRANTING_PERMISSIONS = ["capabilities", "filesystemRead", "filesystemWrite", "networkDomains", "externalActions"];
 const RESTRICTING_PERMISSIONS = ["protectedPaths", "readOnlyPaths", "shellProtectedPaths"];
 
+// Everything above is about artifacts the platform ships. A pack vendored from
+// somewhere else is a different question, and gets a different answer.
+//
+// None of the reasons for leaving artifact content on the build side apply to
+// it. Its bytes change when that source decides they change, not when this
+// project updates. The manifest digest pins which artifacts a pack declares, not
+// what is in them, so a rewritten prompt or policy file keeps the same manifest.
+// And the argument that the platform can rewrite its own verifier is an argument
+// about the platform: an external source cannot, which is exactly why its
+// content is worth pinning. Prompts and policy files are what a hostile source
+// would edit, and it would rather not be asked again.
+//
+// `workspace` is the platform's own origin and is a reserved source name, so a
+// vendored source cannot claim it.
+function externalArtifacts(document) {
+  const external = new Set(
+    (document?.packs ?? [])
+      .filter((pack) => pack?.origin && pack.origin !== "workspace")
+      .map((pack) => `${pack.name}@${pack.version}`)
+  );
+  if (external.size === 0) return undefined;
+  return (document?.artifacts ?? []).filter((artifact) => external.has(artifact?.pack));
+}
+
 function consentedShape(document) {
   return {
     schemaVersion: document?.schemaVersion,
     apiVersion: document?.core?.apiVersion,
     packageSource: document?.core?.packageSource,
     profile: document?.profile,
-    packs: document?.packs
+    packs: document?.packs,
+    externalArtifacts: externalArtifacts(document)
   };
 }
 
+const CONSENT_DRIFT_REASONS = {
+  externalArtifacts: "an artifact shipped by a vendored capability source changed content"
+};
+
 function consentDrift(expected, actual) {
   const before = consentedShape(actual);
   const after = consentedShape(expected);
   return Object.keys(after)
     .filter((key) => stableJson(after[key]) !== stableJson(before[key]))
-    .map((key) => `${key} no longer matches the locked value`);
+    .map((key) => CONSENT_DRIFT_REASONS[key] ?? `${key} no longer matches the locked value`);
 }
 
 function permissionDrift(expected, actual) {

package/packages/piagent-core/capabilities/capability-sources.js

@@ -110,6 +110,39 @@ function assertContainedDirectory(projectRoot, target, label) {
   return targetReal;
 }
 
+/**
+ * Verify a path this code is about to create, empty or write sits inside the
+ * project, without requiring it to exist yet.
+ *
+ * The read path can lstat its target and be done with it. A write path cannot:
+ * the destination is normally absent, and the failure that matters is an
+ * *ancestor* leading somewhere else. A repository shipping `.pi` as a symlink is
+ * the whole attack — `mkdir -p` follows it, the directory that appears below is
+ * a real directory, so a check on the immediate parent sees nothing wrong, and
+ * the recursive delete that comes next lands outside the project.
+ *
+ * @param {string} rootReal a project root already through realpath
+ * @param {string} target
+ * @param {string} label
+ */
+function assertContainedWritePath(rootReal, target, label) {
+  const relative = path.relative(rootReal, path.resolve(rootReal, target));
+  if (relative.startsWith("..") || path.isAbsolute(relative)) fail(`${label} resolves outside the project`);
+  let current = rootReal;
+  for (const segment of relative.split(path.sep)) {
+    if (!segment) continue;
+    current = path.join(current, segment);
+    let stat;
+    try {
+      stat = fs.lstatSync(current);
+    } catch {
+      // Absent from here down, so there is nothing further to follow.
+      return;
+    }
+    if (stat.isSymbolicLink()) fail(`${label} must not resolve through a symbolic link (${segment})`);
+  }
+}
+
 function assertNoSymbolicLinks(root, label, budget = { remaining: MAX_VENDOR_ENTRIES }) {
   for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
     if (budget.remaining-- <= 0) fail(`${label} contains more than ${MAX_VENDOR_ENTRIES} entries`);
@@ -212,27 +245,55 @@ export function vendorRemoteSource(projectRoot, entry) {
   const [validated] = validateCapabilitySources([entry]);
   if (!validated.source) fail(`capability source ${validated.name} is a local path and does not need vendoring`);
 
-  const destination = vendorDirectoryFor(projectRoot, validated.name);
+  // Resolved the same way the read path resolves it, so the containment check
+  // below compares two paths of the same form.
+  const rootReal = fs.realpathSync(projectRoot);
+  const destination = vendorDirectoryFor(rootReal, validated.name);
+  const label = `capability source ${validated.name}`;
+
+  // Before anything is created and well before anything is removed: every call
+  // after this line writes or deletes, and the point of the check is to have
+  // happened first.
+  assertContainedWritePath(rootReal, destination, label);
   const parent = path.dirname(destination);
   fs.mkdirSync(parent, { recursive: true, mode: 0o755 });
-  if (fs.lstatSync(parent).isSymbolicLink()) fail(`${parent} must not be a symbolic link`);
-  fs.rmSync(destination, { recursive: true, force: true });
-  fs.mkdirSync(destination, { mode: 0o755 });
+  // Re-checked after the directories exist. The first pass ran against a path
+  // that was mostly absent, so it proved nothing about the components this call
+  // just created or about one swapped underneath in between.
+  assertContainedWritePath(rootReal, destination, label);
+
+  // Fetched beside the destination and moved into place at the end, so a fetch
+  // that fails leaves the reviewed tree that was already there. Emptying the
+  // destination first meant a network error or a hostile archive destroyed a
+  // working vendor directory and left the project with neither version.
+  const staging = `${destination}.incoming.${process.pid}`;
+  assertContainedWritePath(rootReal, staging, label);
+  for (const sibling of fs.readdirSync(parent)) {
+    // Debris from a run that died between creating this and moving it.
+    if (sibling.startsWith(`${validated.name}.incoming.`)) fs.rmSync(path.join(parent, sibling), { recursive: true, force: true });
+  }
+  fs.mkdirSync(staging, { mode: 0o755 });
 
   try {
-    if (validated.source.startsWith("npm:")) fetchNpmSource(validated.source.slice("npm:".length), destination);
-    else fetchGitSource(validated.source, destination);
+    if (validated.source.startsWith("npm:")) fetchNpmSource(validated.source.slice("npm:".length), staging);
+    else fetchGitSource(validated.source, staging);
 
     // The fetched tree is untrusted until this passes. Checking here means a
-    // hostile archive is rejected before anything reads a manifest out of it.
-    assertNoSymbolicLinks(destination, `capability source ${validated.name}`);
-    if (!fs.existsSync(path.join(destination, "packs"))) {
+    // hostile archive is rejected before anything reads a manifest out of it,
+    // and before it can replace the tree already in place.
+    assertNoSymbolicLinks(staging, `capability source ${validated.name}`);
+    if (!fs.existsSync(path.join(staging, "packs"))) {
       fail(`capability source ${validated.name} provides no packs directory`);
     }
-  } catch (error) {
-    // A half-written vendor directory would resolve on the next run and hide
-    // the failure, so remove it.
+
+    // Everything above succeeded, so the old tree can go.
     fs.rmSync(destination, { recursive: true, force: true });
+    fs.renameSync(staging, destination);
+  } catch (error) {
+    // Only the half-written fetch is removed. The destination is either
+    // untouched, because the failure happened before the swap, or already
+    // replaced by a tree that passed every check.
+    fs.rmSync(staging, { recursive: true, force: true });
     throw error;
   }