@praxso/attested 0.1.0 → 0.1.1

package/dist/assemble.js

@@ -1,34 +1,79 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { mkdirSync, rmSync, statSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { buildPacket, serializePacket } from './packet.js';
-import { buildReceipt, testResultFromCtrf, toolInfo } from './receipt.js';
-import { AttestedError, classify, info, relPath, runUrl, sha256File, walk } from './util.js';
+import { buildReceipt, testResultFromCtrf, toolInfo, validateCtrf } from './receipt.js';
+import { clean } from './redact.js';
+import { AttestedError, checkInside, classify, info, readInside, relPath, runUrl, sha256File, walk, writeOutput } from './util.js';
+// Largest ctrf.json that is parsed. CTRF for tens of thousands of tests is a few MB.
+export const MAX_CTRF_BYTES = 32 * 1024 * 1024;
+const SUMMARY_FIELDS = ['tests', 'passed', 'failed', 'skipped', 'pending', 'other', 'flaky', 'start', 'stop', 'duration'];
+// The CTRF metadata copied into the receipt: allowlisted fields only, strings redacted and bounded, counts numeric.
+// The ctrf.json subject itself is never rewritten; only these copies are.
+export function ctrfMeta(ctrf) {
+    const str = (v, max) => (typeof v === 'string' ? clean(v, max) : null);
+    const t = ctrf.results.tool;
+    const tool = t && typeof t === 'object' ? { name: str(t.name, 100), version: str(t.version, 50) } : null;
+    const s = ctrf.results.summary;
+    let summary = null;
+    if (s && typeof s === 'object') {
+        summary = {};
+        for (const k of SUMMARY_FIELDS) {
+            const v = s[k];
+            if (typeof v === 'number' && Number.isFinite(v))
+                summary[k] = v;
+        }
+    }
+    return { specVersion: str(ctrf.specVersion, 32), tool, summary };
+}
+// Longest file path or configuration name written into the signed predicate.
+const MAX_PUBLIC_PATH = 1000;
+// A path as it is written into the signed, public predicate. Paths must stay exact so the evidence can be checked
+// against them, so a path that redaction would change (it looks like it holds a secret or an email) or that is too
+// long is refused rather than rewritten.
+export function publicPath(root, file, who) {
+    const path = relPath(root, file);
+    if (clean(path, MAX_PUBLIC_PATH) !== path)
+        throw new AttestedError(`${who}: refusing to publish the path ${clean(path, 200)}: it is over ${MAX_PUBLIC_PATH} characters or looks like it contains a secret or an email; rename it`);
+    return path;
+}
 // Everything the receipt says about the run, computed from files under `root` only: the CTRF report, the output dir,
 // and the test config. Used by `attested run` (root = the project) and by `attested attest --from-results`
 // (root = a downloaded results directory, which is treated strictly as data).
 export function assemble(root, o) {
     const ctrfPath = resolve(root, o.ctrf);
-    if (!existsSync(ctrfPath))
+    if (!checkInside(root, ctrfPath, 'CTRF report'))
         throw new AttestedError(`${o.who}: CTRF report not found at ${o.ctrf} (configure the CTRF reporter or pass --ctrf)`);
+    const size = statSync(ctrfPath).size;
+    if (size > MAX_CTRF_BYTES)
+        throw new AttestedError(`${o.who}: ${o.ctrf} is ${size} bytes, over the ${MAX_CTRF_BYTES}-byte limit for CTRF reports`);
+    // One descriptor: the bytes parsed are the bytes hashed into the subject, whatever happens to the path meanwhile.
+    const bytes = readInside(root, ctrfPath, MAX_CTRF_BYTES, 'CTRF report');
+    if (!bytes)
+        throw new AttestedError(`${o.who}: CTRF report not found at ${o.ctrf}`);
     let ctrf;
     try {
-        ctrf = JSON.parse(readFileSync(ctrfPath, 'utf8'));
+        ctrf = JSON.parse(bytes.toString('utf8'));
     }
     catch {
         throw new AttestedError(`${o.who}: ${o.ctrf} is not valid JSON`);
     }
-    if (!ctrf || typeof ctrf !== 'object' || !ctrf.results)
-        throw new AttestedError(`${o.who}: ${o.ctrf} is not a CTRF report (missing "results")`);
-    const subject = sha256File(ctrfPath);
-    const artifacts = [{ path: relPath(root, ctrfPath), ...subject, kind: 'report' }];
-    for (const file of walk(resolve(root, o.outputDir)))
-        artifacts.push({ path: relPath(root, file), ...sha256File(file), kind: classify(file) });
+    const invalid = validateCtrf(ctrf);
+    if (invalid)
+        throw new AttestedError(`${o.who}: ${o.ctrf} is not a CTRF report (${invalid})`);
+    const subject = { sha256: createHash('sha256').update(bytes).digest('hex'), bytes: bytes.length };
+    const artifacts = [{ path: publicPath(root, ctrfPath, o.who), ...subject, kind: 'report' }];
+    const outputDir = resolve(root, o.outputDir);
+    if (checkInside(root, outputDir, 'output directory')) {
+        for (const file of walk(outputDir))
+            artifacts.push({ path: publicPath(root, file, o.who), ...sha256File(file), kind: classify(file) });
+    }
     const configuration = [];
-    const configPath = o.config ?? ['playwright.config.ts', 'playwright.config.js', 'playwright.config.mjs'].find((p) => existsSync(resolve(root, p))) ?? null;
-    if (configPath && existsSync(resolve(root, configPath)))
-        configuration.push({ name: configPath, digest: { sha256: sha256File(resolve(root, configPath)).sha256 } });
+    const configPath = o.config ?? ['playwright.config.ts', 'playwright.config.js', 'playwright.config.mjs'].find((p) => checkInside(root, resolve(root, p), 'test config')) ?? null;
+    if (configPath && checkInside(root, resolve(root, configPath), 'test config'))
+        configuration.push({ name: publicPath(root, resolve(root, configPath), o.who), digest: { sha256: sha256File(resolve(root, configPath)).sha256 } });
     if (process.env.GITHUB_WORKFLOW_REF)
-        configuration.push({ name: process.env.GITHUB_WORKFLOW_REF, digest: { gitCommit: process.env.GITHUB_SHA ?? '' } });
+        configuration.push({ name: clean(process.env.GITHUB_WORKFLOW_REF, MAX_PUBLIC_PATH), digest: { gitCommit: process.env.GITHUB_SHA ?? '' } });
     const testResult = testResultFromCtrf(ctrf, configuration, runUrl());
     const packet = testResult.result === 'FAILED' ? buildPacket(ctrf, artifacts, root, o.rerun) : null;
     return { ctrf, subject, artifacts, testResult, packet };
@@ -39,7 +84,7 @@ export function writeReceipt(a, out, rest) {
     rmSync(out.packet, { force: true });
     if (a.packet) {
         mkdirSync(dirname(out.packet), { recursive: true });
-        writeFileSync(out.packet, serializePacket(a.packet));
+        writeOutput(out.packet, serializePacket(a.packet));
         // The packet's digest sits next to the evidence it points at.
         artifacts.push({ path: out.packetArtifactPath, ...sha256File(out.packet), kind: 'packet' });
         info(`failure packet: ${out.packetArtifactPath} (${a.packet.failingTests.length} failure groups${a.packet.truncated ? ', truncated' : ''})`);
@@ -50,15 +95,15 @@ export function writeReceipt(a, out, rest) {
         target: rest.target,
         artifacts,
         tool: toolInfo(),
-        ctrf: { specVersion: a.ctrf.specVersion ?? null, tool: a.ctrf.results.tool ?? null, summary: a.ctrf.results.summary ?? null },
+        ctrf: ctrfMeta(a.ctrf),
         createdAt: rest.createdAt,
     };
     const receipt = buildReceipt(a.subject.sha256, predicate);
     mkdirSync(dirname(out.receipt), { recursive: true });
-    writeFileSync(out.receipt, JSON.stringify(receipt, null, 2) + '\n');
-    writeFileSync(out.predicate, JSON.stringify(predicate, null, 2) + '\n');
+    writeOutput(out.receipt, JSON.stringify(receipt, null, 2) + '\n');
+    writeOutput(out.predicate, JSON.stringify(predicate, null, 2) + '\n');
     // Second, pure in-toto Test Result statement for interoperability.
-    writeFileSync(out.testResultPredicate, JSON.stringify(a.testResult, null, 2) + '\n');
+    writeOutput(out.testResultPredicate, JSON.stringify(a.testResult, null, 2) + '\n');
     const tr = a.testResult;
     info(`receipt: ${relPath(process.cwd(), out.receipt)} (${tr.result}, ${tr.passedTests.length} passed, ${tr.failedTests.length} failed, ${artifacts.length} artifacts)`);
     if (tr.failedTests.length)

package/dist/attest.js

@@ -1,8 +1,8 @@
-import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { assemble, writeReceipt } from './assemble.js';
 import { DEFAULTS, PREDICATE_TYPE, TEST_RESULT_PREDICATE_TYPE } from './constants.js';
-import { AttestedError, inActions, info, readEvent, relPath, sha256File, warn } from './util.js';
+import { AttestedError, inActions, info, readEvent, relPath, sha256File, warn, writeOutput } from './util.js';
 export function defaultAttestOptions() {
     return {
         receipt: DEFAULTS.receipt, ctrf: DEFAULTS.ctrf, predicate: DEFAULTS.predicate, testResultPredicate: DEFAULTS.testResultPredicate,
@@ -22,8 +22,12 @@ function emitOutputs(subjectPath, sha256, predicatePath, testResultPath) {
 // and hashed here. Everything about the source comes from the event context of this job, never from those files.
 export function attestFromResults(opts) {
     const root = resolve(opts.fromResults);
-    if (!existsSync(root) || !statSync(root).isDirectory())
+    if (!existsSync(root) && !isSymlink(root))
         throw new AttestedError(`attested attest: results directory ${opts.fromResults} not found`);
+    if (isSymlink(root))
+        throw new AttestedError(`attested attest: results directory ${opts.fromResults} is a symlink; refusing to read it`);
+    if (!statSync(root).isDirectory())
+        throw new AttestedError(`attested attest: results directory ${opts.fromResults} is not a directory`);
     const commit = process.env.GITHUB_SHA;
     if (!commit)
         throw new AttestedError('attested attest: --from-results needs GITHUB_SHA (the commit the test job checked out) from the workflow context');
@@ -45,6 +49,14 @@ export function attestFromResults(opts) {
     emitOutputs(subjectPath, a.subject.sha256, paths.predicate, paths.testResultPredicate);
     return 0;
 }
+function isSymlink(p) {
+    try {
+        return lstatSync(p).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
 function setOutput(name, value) {
     const file = process.env.GITHUB_OUTPUT;
     if (file)
@@ -75,8 +87,8 @@ export function attest(opts) {
     }
     // In Actions, signing is delegated to the actions/attest step that follows.
     // The predicate file was written by `attested run`; we re-emit it from the receipt so the two cannot drift.
-    writeFileSync(resolve(cwd, opts.predicate), JSON.stringify(receipt.predicate, null, 2) + '\n');
-    writeFileSync(resolve(cwd, opts.testResultPredicate), JSON.stringify(receipt.predicate.testResult, null, 2) + '\n');
+    writeOutput(resolve(cwd, opts.predicate), JSON.stringify(receipt.predicate, null, 2) + '\n');
+    writeOutput(resolve(cwd, opts.testResultPredicate), JSON.stringify(receipt.predicate.testResult, null, 2) + '\n');
     emitOutputs(ctrfPath, actual, resolve(cwd, opts.predicate), resolve(cwd, opts.testResultPredicate));
     return 0;
 }

package/dist/check.js

@@ -3,7 +3,14 @@ import { resolve } from 'node:path';
 import { DEFAULTS, PREDICATE_TYPE, TOOL_NAME } from './constants.js';
 import { AttestedError, info, readEvent, runUrl, signerWorkflow } from './util.js';
 export function defaultCheckOptions() {
-    return { receipt: DEFAULTS.receipt, packet: DEFAULTS.packet, artifactUrl: null, artifactName: null, attestationUrl: null };
+    return { receipt: DEFAULTS.receipt, packet: DEFAULTS.packet, artifactUrl: null, artifactName: null, evidenceName: null, attestationUrl: null };
+}
+// Selects the statement `attested verify` accepts from `gh attestation verify --format json`: the certificate names
+// this run and ref, and the predicate's commit or PR head is the head the check is attached to. Null (jq -e fails) when none.
+const STATEMENT_JQ = `[.[].verificationResult | select(.signature.certificate.sourceRepositoryRef == $ref and ((.signature.certificate.runInvocationURI // "") | test("/actions/runs/" + $run + "(/attempts/[0-9]+)?$"))) | .statement | select(.predicateType == "${PREDICATE_TYPE}" and (.predicate.source.commit == $head or .predicate.source.headCommit == $head))] | first`;
+const SUM_LINE = '"\\(.sha256)  \\(.path)"';
+function shellQuote(s) {
+    return /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
 }
 export function conclusionFor(result) {
     if (result === 'PASSED')
@@ -49,10 +56,36 @@ export function buildSummary(receipt, packet, opts) {
         lines.push(`| Run | ${url} |`);
     lines.push('', 'Verify this receipt yourself:', '', '```bash');
     const runId = process.env.GITHUB_RUN_ID;
+    const ref = process.env.GITHUB_REF;
+    const headSha = checkHeadSha();
     if (runId && opts.artifactName)
         lines.push(`gh run download ${runId} --repo ${repo} --name ${opts.artifactName} --dir attested-receipt`);
-    lines.push(`gh attestation verify attested-receipt/attested/ctrf.json --repo ${repo} --predicate-type ${PREDICATE_TYPE} --signer-workflow ${signer}`);
+    const verify = `gh attestation verify attested-receipt/attested/ctrf.json --repo ${repo} --predicate-type ${PREDICATE_TYPE} --signer-workflow ${signer}`;
+    // The accepted statement is the one `attested verify` would accept: signed in this run, on this ref, for this head.
+    // Every later check reads the statement, never the downloaded receipt.json, which is unsigned.
+    const pinned = Boolean(runId && ref && headSha);
+    if (pinned) {
+        lines.push(`${verify} --format json > attested-verify.json`);
+        lines.push(`jq -e --arg run ${runId} --arg ref ${shellQuote(ref)} --arg head ${headSha} '${STATEMENT_JQ}' attested-verify.json > attested-statement.json`);
+    }
+    else {
+        lines.push(verify);
+    }
     lines.push('```');
+    // The evidence travels in its own artifact. Its name defaults to the bundled workflow's (results-<sha> beside
+    // attested-<sha>), as the signer workflow above defaults to the bundled attested.yml.
+    const evidence = opts.evidenceName ?? (opts.artifactName?.startsWith('attested-') ? `results-${opts.artifactName.slice('attested-'.length)}` : null);
+    if (pinned && evidence) {
+        lines.push('', 'Get the evidence (screenshots, videos, traces) and check each file against the fingerprints in the signed statement:', '', '```bash');
+        lines.push(`gh run download ${runId} --repo ${repo} --name ${evidence} --dir attested-evidence`);
+        // The sign job writes the failure packet into the receipt artifact, so packet entries are checked there.
+        lines.push(`(cd attested-evidence && jq -r '.predicate.artifacts[] | select(.kind != "packet") | ${SUM_LINE}' ../attested-statement.json | shasum -a 256 -c)`);
+        if (p.artifacts?.some((a) => a.kind === 'packet')) {
+            lines.push(`(cd attested-receipt && jq -r '.predicate.artifacts[] | select(.kind == "packet") | ${SUM_LINE}' ../attested-statement.json | shasum -a 256 -c)`);
+        }
+        lines.push('```');
+        lines.push('', "Artifacts follow this repository's artifact retention (90 days by default); the receipt's digests and signature outlast them.");
+    }
     if (tr.failedTests.length && packet) {
         lines.push('', 'Failure packet (`attested/packet.json`):', '', '```json', packet.trimEnd(), '```');
     }
@@ -97,7 +130,7 @@ export async function check(opts) {
         status: 'completed',
         conclusion,
         details_url: runUrl() ?? undefined,
-        // Text only. The `images` field is never used: evidence stays in the repo-private workflow artifact (PixelLeak rule).
+        // Text only. The `images` field is never used: evidence stays in the workflow artifact, as visible as the repository's Actions artifacts (PixelLeak rule).
         output: { title, summary },
     };
     const res = await fetch(`${api}/repos/${repo}/check-runs`, {

package/dist/constants.js

@@ -1,6 +1,7 @@
 // Single place to rename the project or move the predicate URI.
 export const TOOL_NAME = 'attested';
-export const TOOL_VERSION = '0.1.0';
+// Must equal packages/cli/package.json version; test/version.test.mjs enforces it.
+export const TOOL_VERSION = '0.1.1';
 export const PREDICATE_TYPE = 'https://praxso.ai/attested/v0.1';
 export const TEST_RESULT_PREDICATE_TYPE = 'https://in-toto.io/attestation/test-result/v0.1';
 export const STATEMENT_TYPE = 'https://in-toto.io/Statement/v1';

package/dist/index.js

@@ -31,6 +31,8 @@ attest options:
 check options (posts the "attested" check run; needs GITHUB_TOKEN with checks: write):
   --artifact-url <url>       link to the uploaded workflow artifact
   --artifact-name <name>     workflow artifact name, for the paste-able verify command
+  --evidence-name <name>     artifact holding the traces, videos and screenshots, for the paste-able download
+                             command (default: results-<sha> when --artifact-name is attested-<sha>)
   --attestation-url <url>    link to the receipt attestation
   --receipt <path>, --packet <path>
 `;
@@ -124,6 +126,8 @@ async function main(argv) {
                 o.artifactUrl = optValue(rest, i++, a);
             else if (a === '--artifact-name')
                 o.artifactName = optValue(rest, i++, a);
+            else if (a === '--evidence-name')
+                o.evidenceName = optValue(rest, i++, a);
             else if (a === '--attestation-url')
                 o.attestationUrl = optValue(rest, i++, a);
             else

package/dist/packet.js

@@ -1,41 +1,36 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { inflateRawSync } from 'node:zlib';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { TOOL_NAME } from './constants.js';
 import { testNameOf } from './receipt.js';
-import { relPath } from './util.js';
+import { ANSI, clean, clip, stripUrl } from './redact.js';
+import { relPath, warn } from './util.js';
+export { redact, stripUrl } from './redact.js';
 // The failure packet: deterministic, model-free, at most 12 KB. Written on red so an agent can fix without opening traces.
 export const PACKET_MAX_BYTES = 12 * 1024;
 const MAX_FRAMES = 20;
 const MAX_MESSAGE = 1500;
-// --- redaction ---------------------------------------------------------------------------------
-const ANSI = /\u001b\[[0-9;?]*[ -\/]*[@-~]/g;
-const SECRET_PATTERNS = [
-    [/\b(bearer|basic|token)\s+[A-Za-z0-9\-._~+\/]{8,}=*/gi, '$1 [REDACTED]'],
-    [/\b(gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/g, '[REDACTED]'],
-    [/\b([A-Za-z0-9_-]*(?:key|token|secret|password|passwd|auth|session|signature|credential)[A-Za-z0-9_-]*)(["']?\s*[=:]\s*["']?)(?!(?:bearer|basic|token)\s)[^\s"'&,;)}\]]+/gi, '$1$2[REDACTED]'],
-    [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '[EMAIL]'],
-];
-const URL_RE = /\b(https?|wss?):\/\/[^\s"'<>)\]]+/gi;
-// Drop the query string and fragment of a URL.
-export function stripUrl(u) {
-    return u.replace(/[?#].*$/, '');
-}
-// Strip ANSI, URL queries and fragments, and anything shaped like a secret or an email.
-export function redact(text) {
-    let out = text.replace(ANSI, '').replace(URL_RE, (u) => stripUrl(u));
-    for (const [re, rep] of SECRET_PATTERNS)
-        out = out.replace(re, rep);
-    return out;
-}
-function clip(text, max) {
-    return text.length > max ? `${text.slice(0, max)}… [${text.length - max} chars cut]` : text;
-}
+// Bounds on every other string in the packet, so that after capPacket drops every list entry the rest always fits.
+const MAX_NAME = 300;
+const MAX_PATH = 300;
+const MAX_FRAME = 300;
+const MAX_METHOD = 16;
+const MAX_RERUN = 500;
+const MAX_EVIDENCE = 10;
+// Trace zips come from an untrusted results directory: bound what is read and what is inflated.
+export const MAX_TRACE_ZIP_BYTES = 256 * 1024 * 1024;
+export const MAX_TRACE_ENTRY_BYTES = 32 * 1024 * 1024;
+export const MAX_TRACE_TOTAL_BYTES = 128 * 1024 * 1024;
 // --- minimal zip reader (Playwright trace.zip), stored and deflate entries only --------------
-export function readZip(path, want) {
+// `budget.left` is the number of inflated bytes still allowed across all traces; entries past it are skipped with a warning.
+export function readZip(path, want, budget = { left: MAX_TRACE_TOTAL_BYTES }) {
     const out = new Map();
     let buf;
     try {
+        if (statSync(path).size > MAX_TRACE_ZIP_BYTES) {
+            warn(`trace ${path} is larger than ${MAX_TRACE_ZIP_BYTES} bytes; skipped`);
+            return out;
+        }
         buf = readFileSync(path);
     }
     catch {
@@ -64,13 +59,33 @@ export function readZip(path, want) {
             continue;
         const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
         const data = buf.subarray(start, start + csize);
+        // Once the shared budget is spent, the remaining entries are not inflated at all.
+        if (budget.left <= 0) {
+            warn(`trace ${path}: the ${MAX_TRACE_TOTAL_BYTES}-byte budget across all traces is spent; remaining entries skipped`);
+            break;
+        }
+        const limit = Math.min(MAX_TRACE_ENTRY_BYTES, budget.left);
         try {
+            let text;
             if (method === 0)
-                out.set(name, data.toString('utf8'));
+                text = data;
             else if (method === 8)
-                out.set(name, inflateRawSync(data).toString('utf8'));
+                text = inflateRawSync(data, { maxOutputLength: limit + 1 });
+            else
+                continue;
+            if (text.length > limit)
+                throw new RangeError('limit');
+            budget.left -= text.length;
+            out.set(name, text.toString('utf8'));
+        }
+        catch (err) {
+            // Over the limit (zlib reports ERR_BUFFER_TOO_LARGE) or unreadable: skip the entry.
+            // A rejected entry may have been inflated up to limit + 1 bytes before it was refused: charge that work too.
+            budget.left = Math.max(0, budget.left - (limit + 1));
+            if (err instanceof RangeError || err.code === 'ERR_BUFFER_TOO_LARGE') {
+                warn(`trace ${path}: entry ${clean(name, MAX_PATH)} inflates past ${limit} bytes (per entry ${MAX_TRACE_ENTRY_BYTES}, all traces ${MAX_TRACE_TOTAL_BYTES}); skipped`);
+            }
         }
-        catch { /* unreadable entry: skip */ }
     }
     return out;
 }
@@ -91,11 +106,14 @@ export function readTraces(paths) {
     const cons = new Map();
     const net = new Map();
     let seq = 0;
+    const budget = { left: MAX_TRACE_TOTAL_BYTES };
     for (const path of paths) {
+        if (budget.left <= 0)
+            break;
         let files;
         // Trace zips can come from an untrusted results artifact: a malformed one is skipped, never fatal.
         try {
-            files = readZip(path, (n) => n.endsWith('.trace') || n.endsWith('.network'));
+            files = readZip(path, (n) => n.endsWith('.trace') || n.endsWith('.network'), budget);
         }
         catch {
             continue;
@@ -105,7 +123,7 @@ export function readTraces(paths) {
                 seq++;
                 if (ev.type === 'console' && (ev.messageType === 'error' || ev.messageType === 'warning')) {
                     const level = ev.messageType;
-                    const message = clip(redact(String(ev.text ?? '')), 300);
+                    const message = clean(ev.text ?? '', 300);
                     const key = `${level}\u0000${message}`;
                     const e = cons.get(key) ?? { level, message, count: 0, lastSeen: 0 };
                     e.count++;
@@ -114,7 +132,7 @@ export function readTraces(paths) {
                 }
                 else if (ev.type === 'event' && ev.method === 'pageError') {
                     const err = ev.params?.error?.error ?? ev.params?.error ?? {};
-                    const message = clip(redact(`${err.name ?? 'Error'}: ${err.message ?? ''}`), 300);
+                    const message = clean(`${err.name ?? 'Error'}: ${err.message ?? ''}`, 300);
                     const key = `error\u0000${message}`;
                     const e = cons.get(key) ?? { level: 'error', message, count: 0, lastSeen: 0 };
                     e.count++;
@@ -122,7 +140,8 @@ export function readTraces(paths) {
                     cons.set(key, e);
                 }
                 else if (ev.type === 'resource-snapshot' && ev.snapshot?.request) {
-                    const status = Number(ev.snapshot.response?.status ?? -1);
+                    const raw = Number(ev.snapshot.response?.status ?? -1);
+                    const status = Number.isInteger(raw) && raw >= -1 && raw < 1000 ? raw : -1;
                     const failed = status >= 400 || status <= 0 || Boolean(ev.snapshot.response?._failureText);
                     if (!failed)
                         continue;
@@ -133,8 +152,8 @@ export function readTraces(paths) {
                     catch {
                         path = stripUrl(path);
                     }
-                    const method = String(ev.snapshot.request.method ?? 'GET');
-                    path = redact(path);
+                    const method = clean(ev.snapshot.request.method ?? 'GET', MAX_METHOD);
+                    path = clean(path, MAX_PATH);
                     const key = `${method} ${path} ${status}`;
                     const e = net.get(key) ?? { method, path, status, count: 0, lastSeen: 0 };
                     e.count++;
@@ -151,20 +170,24 @@ function shellQuote(a) {
     return /^[A-Za-z0-9_\/.,:=@%+-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
 }
 export function rerunCommand(argv) {
-    return ['attested', ...argv].map(shellQuote).join(' ');
+    return clean(['attested', ...argv].map(shellQuote).join(' '), MAX_RERUN);
 }
 function lineOf(t, file, stack) {
     if (typeof t.line === 'number')
-        return t.line;
+        return Number.isInteger(t.line) && t.line >= 0 && t.line < 1e9 ? t.line : null;
     if (!file)
         return null;
     for (const f of stack) {
-        const m = f.includes(file) ? /:(\d+):\d+\)?$/.exec(f) : null;
+        const m = f.includes(file) ? /:(\d{1,9}):\d+\)?$/.exec(f) : null;
         if (m)
             return Number(m[1]);
     }
     return null;
 }
+// Attachments with a string path; anything else in an untrusted CTRF report is ignored.
+function attachmentsOf(t) {
+    return Array.isArray(t.attachments) ? t.attachments.filter((a) => typeof a?.path === 'string' && a.path !== '') : [];
+}
 export function buildPacket(ctrf, artifacts, cwd, rerun) {
     const tests = (ctrf.results.tests ?? []).filter((t) => t.status === 'failed');
     const byPath = new Map(artifacts.map((a) => [a.path, a]));
@@ -174,9 +197,7 @@ export function buildPacket(ctrf, artifacts, cwd, rerun) {
     const lookup = (p) => byPath.get(rel(p)) ?? artifacts.find((a) => p.split('\\').join('/').endsWith('/' + a.path));
     let srcRoot = cwd;
     find: for (const t of tests) {
-        for (const a of t.attachments ?? []) {
-            if (!a.path)
-                continue;
+        for (const a of attachmentsOf(t)) {
             if (!byPath.has(rel(a.path))) {
                 const art = lookup(a.path);
                 if (art)
@@ -188,23 +209,22 @@ export function buildPacket(ctrf, artifacts, cwd, rerun) {
     const traces = [];
     const groups = new Map();
     for (const t of tests) {
-        const raw = (t.trace ?? t.message ?? '').replace(ANSI, '');
+        const raw = String(t.trace ?? t.message ?? '').replace(ANSI, '');
         const stack = raw.split('\n').map((l) => l.trim()).filter((l) => l.startsWith('at ')).slice(0, MAX_FRAMES)
-            .map((f) => redact(f.split(srcRoot + '/').join('')));
-        const message = clip(redact((t.message ?? '').replace(ANSI, '')), MAX_MESSAGE);
-        const file = t.filePath ? relative(srcRoot, t.filePath).split('\\').join('/') : null;
+            .map((f) => clean(f.split(srcRoot + '/').join(''), MAX_FRAME));
+        const message = clean(t.message ?? '', MAX_MESSAGE, true);
+        const file = typeof t.filePath === 'string' && t.filePath ? clean(relative(srcRoot, t.filePath).split('\\').join('/'), MAX_PATH) : null;
         const evidence = [];
-        for (const a of t.attachments ?? []) {
-            if (!a.path)
-                continue;
+        for (const a of attachmentsOf(t)) {
             const art = lookup(a.path);
             if (!art || !['trace', 'video', 'screenshot'].includes(art.kind))
                 continue;
-            evidence.push({ kind: art.kind, path: art.path, sha256: art.sha256 });
+            if (evidence.length < MAX_EVIDENCE)
+                evidence.push({ kind: art.kind, path: clean(art.path, MAX_PATH), sha256: art.sha256 });
             if (art.kind === 'trace' && existsSync(resolve(cwd, art.path)))
                 traces.push(resolve(cwd, art.path));
         }
-        const name = testNameOf(t);
+        const name = clean(testNameOf(t), MAX_NAME);
         // Identical failures (same file, line, and message) collapse into one entry with a count.
         const key = `${file}\u0000${lineOf(t, file, stack)}\u0000${message}`;
         const g = groups.get(key);
@@ -222,7 +242,7 @@ export function buildPacket(ctrf, artifacts, cwd, rerun) {
         failingTests: [...groups.values()].sort((a, b) => a.name.localeCompare(b.name)),
         console: byRecent(cons),
         network: byRecent(network),
-        rerun,
+        rerun: clean(rerun, MAX_RERUN),
         truncated: false,
     };
     return capPacket(packet);
@@ -250,5 +270,8 @@ export function capPacket(p) {
         list.pop();
         cut[name]++;
     }
+    // Every remaining field is bounded above, so this only trims the rerun command if a caller passed an unbounded one.
+    if (Buffer.byteLength(serializePacket(p)) > PACKET_MAX_BYTES)
+        p.rerun = clip(p.rerun, 200);
     return p;
 }

package/dist/receipt.js

@@ -1,17 +1,48 @@
 import { PREDICATE_TYPE, STATEMENT_TYPE, SUBJECT_NAME, TOOL_NAME, TOOL_VERSION } from './constants.js';
+import { clean } from './redact.js';
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+// Why `ctrf` cannot be judged, or null when it can. `results` must be an object with a `tests` array whose entries all
+// carry a string name and status, and `summary`, when present, must be an object. An empty `tests` array is valid.
+export function validateCtrf(ctrf) {
+    if (!isObject(ctrf) || !isObject(ctrf.results))
+        return 'missing "results"';
+    const { tests, summary } = ctrf.results;
+    if (!Array.isArray(tests))
+        return '"results.tests" is not an array';
+    const bad = tests.findIndex((t) => !isObject(t) || typeof t.name !== 'string' || typeof t.status !== 'string');
+    if (bad >= 0)
+        return `"results.tests[${bad}]" has no string name and status`;
+    if (summary !== undefined && !isObject(summary))
+        return '"results.summary" is not an object';
+    return null;
+}
 export function testNameOf(t) {
     const prefix = t.suite ?? t.filePath;
     return prefix ? `${prefix} > ${t.name}` : t.name;
 }
+// Test names in the receipt are signed and public with the repository: redacted and bounded like the packet's.
+const MAX_TEST_NAME = 300;
+const nameOf = (t) => clean(testNameOf(t), MAX_TEST_NAME);
 export function testResultFromCtrf(ctrf, configuration, url) {
-    const tests = ctrf.results.tests ?? [];
-    const passedTests = tests.filter((t) => t.status === 'passed').map(testNameOf);
-    const failedTests = tests.filter((t) => t.status === 'failed').map(testNameOf);
+    const tests = Array.isArray(ctrf.results.tests) ? ctrf.results.tests.filter((t) => t && typeof t === 'object') : [];
+    // A passed test that CTRF marks flaky (passed on a retry) is warned, not passed.
+    const flaky = (t) => t.status === 'passed' && t.flaky === true;
+    const passedTests = tests.filter((t) => t.status === 'passed' && !flaky(t)).map(nameOf);
+    // CTRF's statuses are passed, failed, skipped, pending and other. Anything else (a reporter's own "timedOut" or
+    // "interrupted", or garbage) is counted as a failure rather than waved through as a warning.
+    const known = new Set(['passed', 'failed', 'skipped', 'pending', 'other']);
+    const failedTests = tests.filter((t) => t.status === 'failed' || !known.has(t.status)).map(nameOf);
     // CTRF has no "warned" status; flaky/other/skipped/pending land here so nothing is silently dropped.
-    const warnedTests = tests.filter((t) => !['passed', 'failed'].includes(t.status)).map((t) => `${testNameOf(t)} [${t.status}]`);
+    const warnedTests = tests.filter((t) => known.has(t.status) && t.status !== 'failed' && (t.status !== 'passed' || flaky(t)))
+        .map((t) => `${nameOf(t)} [${flaky(t) ? 'flaky' : clean(t.status, 20)}]`);
     const summary = ctrf.results.summary ?? {};
-    const failed = (summary.failed ?? failedTests.length) > 0;
-    const result = failed ? 'FAILED' : warnedTests.length > 0 ? 'WARNED' : 'PASSED';
+    const summaryFlaky = typeof summary.flaky === 'number' && summary.flaky > 0;
+    // FAILED if either the summary or any individual test reports a failure. A summary failed count that is present but
+    // not the number 0 counts as a failure, so a malformed summary cannot hide one.
+    // A run in which no test passed (an empty report, a crashed reporter, everything skipped) is not evidence that
+    // anything works, so it is FAILED, not PASSED or WARNED.
+    const failed = failedTests.length > 0 || (summary.failed !== undefined && summary.failed !== 0) || tests.every((t) => t.status !== 'passed');
+    const result = failed ? 'FAILED' : warnedTests.length > 0 || summaryFlaky ? 'WARNED' : 'PASSED';
     const tr = { result, configuration, passedTests, warnedTests, failedTests };
     if (url)
         tr.url = url;

package/dist/redact.js

@@ -0,0 +1,48 @@
+// Redaction and bounds for every string that leaves the machine in a receipt, packet, or check summary.
+// Kept separate from packet.ts so receipt.ts can use it without an import cycle.
+export const ANSI = /\u001b\[[0-9;?]*[ -\/]*[@-~]/g;
+const SECRET_PATTERNS = [
+    // PEM / OpenSSH private keys, including a block cut off before its END line.
+    [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g, '[REDACTED PRIVATE KEY]'],
+    // Credentials in any URL's userinfo (postgres://u:pw@, redis://:pw@, https://u:pw@), before the email pattern sees them.
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s\/@"'<>]*:[^\s\/@"'<>]*@/gi, '$1[REDACTED]@'],
+    // Webhook URLs whose path is the secret.
+    [/\bhttps?:\/\/(?:hooks\.slack\.com\/services|(?:discord|discordapp)\.com\/api\/webhooks)\/[^\s"'<>)\]]+/gi, '[REDACTED WEBHOOK]'],
+    [/\b(set-cookie|cookie)(\s*:\s*)[^\r\n]+/gi, '$1$2[REDACTED]'],
+    [/\b(bearer|basic|token)\s+[A-Za-z0-9\-._~+\/]{8,}=*/gi, '$1 [REDACTED]'],
+    [/\b(gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9_-]{16,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/g, '[REDACTED]'],
+    [/\b([A-Za-z0-9_-]*(?:key|token|secret|password|passwd|pwd|auth|session|signature|credential)[A-Za-z0-9_-]*)(["']?\s*[=:]\s*["']?)(?!(?:bearer|basic|token)\s|\[REDACTED)[^\s"'&,;)}\]]+/gi, '$1$2[REDACTED]'],
+    [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '[EMAIL]'],
+];
+// Control characters (newlines included) would let an untrusted string start a new log line, and with it a GitHub
+// Actions workflow command such as ::add-mask:: or ::warning::. Every bounded string is one line.
+const CONTROL = /[\u0000-\u001f\u007f]+/g;
+// The one exception: a failure message keeps its newlines (an expected/received diff), because it is only ever
+// serialized as JSON, never printed to a log.
+const CONTROL_EXCEPT_NEWLINE = /[\u0000-\u0009\u000b-\u001f\u007f]+/g;
+const URL_RE = /\b(https?|wss?):\/\/[^\s"'<>)\]]+/gi;
+// Drop the query string and fragment of a URL.
+export function stripUrl(u) {
+    return u.replace(/[?#].*$/, '');
+}
+// Strip ANSI, URL queries and fragments, and anything shaped like a secret or an email.
+export function redact(text) {
+    let out = text.replace(ANSI, '');
+    // Private keys span lines, so they go before URL stripping and the line-bounded patterns.
+    out = out.replace(SECRET_PATTERNS[0][0], SECRET_PATTERNS[0][1]).replace(URL_RE, (u) => stripUrl(u));
+    for (const [re, rep] of SECRET_PATTERNS.slice(1))
+        out = out.replace(re, rep);
+    return out;
+}
+export function clip(text, max) {
+    return text.length > max ? `${text.slice(0, max)}… [${text.length - max} chars cut]` : text;
+}
+// Redact, then clip: the bounded form of an untrusted string. A huge input is cut to a little over `max` before the
+// patterns run, so their cost stays bounded; everything past `max` is dropped either way.
+export function clean(text, max, keepNewlines = false) {
+    const s = String(text ?? '');
+    const line = (t) => t.replace(keepNewlines ? CONTROL_EXCEPT_NEWLINE : CONTROL, ' ');
+    if (s.length <= max + 256)
+        return clip(line(redact(s)), max);
+    return `${line(redact(s.slice(0, max + 256))).slice(0, max)}… [${s.length - max} chars cut]`;
+}

package/dist/run.js

@@ -3,6 +3,7 @@ import { mkdirSync, rmSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { DEFAULTS } from './constants.js';
 import { assemble, writeReceipt } from './assemble.js';
+import { clean, stripUrl } from './redact.js';
 import { rerunCommand } from './packet.js';
 import { AttestedError, gitDirty, gitHead, gitRef, info, readEvent, relPath } from './util.js';
 export function defaultRunOptions() {
@@ -22,9 +23,16 @@ export function defaultRunOptions() {
         argv: [],
     };
 }
+// A target URL as written into the receipt: no credentials, query, or fragment; redacted and bounded.
+export function publicUrl(u) {
+    return clean(stripUrl(u).replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/@]*@/i, '$1'), 300);
+}
 // Probe <url><healthPath> and require a `sha` field equal to expectedSha. Any failure is fatal:
 // a receipt must not claim tests ran against a deployment it cannot identify.
 async function probeTarget(url, healthPath, expectedSha) {
+    // A path only: `new URL('https://other.host/x', url)` would send the probe to another host.
+    if (!healthPath.startsWith('/') || healthPath.startsWith('//'))
+        throw new AttestedError(`attested: --health-path must be a path starting with "/", got ${clean(healthPath, 200)}`);
     const target = new URL(healthPath, url).toString();
     let res;
     let text;
@@ -49,7 +57,8 @@ async function probeTarget(url, healthPath, expectedSha) {
     if (buildSha !== expectedSha) {
         throw new AttestedError(`attested run: target ${target} is built from ${buildSha}, expected ${expectedSha}; refusing to run tests`);
     }
-    return { buildSha, url, health: { probed: target, status: res.status, body } };
+    // Allowlisted fields only: the health body can carry anything, so it is never copied into the receipt.
+    return { buildSha, url: publicUrl(url), health: { probed: publicUrl(target), status: res.status } };
 }
 export async function run(opts) {
     const cwd = process.cwd();

package/dist/util.js

@@ -1,12 +1,129 @@
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
-import { join, relative, extname } from 'node:path';
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, extname, sep } from 'node:path';
 import { execFileSync } from 'node:child_process';
 export class AttestedError extends Error {
 }
-export function sha256File(path) {
-    const buf = readFileSync(path);
-    return { sha256: createHash('sha256').update(buf).digest('hex'), bytes: buf.length };
+// Largest evidence file (trace, video, screenshot, report) that is hashed into a receipt.
+export const MAX_EVIDENCE_BYTES = 512 * 1024 * 1024;
+// Opens a regular file without following a symlink in its last component.
+function openFile(path, what = 'file') {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (err) {
+        if (err.code === 'ELOOP')
+            throw new AttestedError(`attested: ${what} ${path} is a symlink; refusing to read it`);
+        throw err;
+    }
+    if (!fstatSync(fd).isFile()) {
+        closeSync(fd);
+        throw new AttestedError(`attested: ${what} ${path} is not a regular file; refusing to read it`);
+    }
+    return fd;
+}
+// Writes an output file without following a symlink: a committed `attested/receipt.json -> ../elsewhere` (or a
+// symlinked output directory) would otherwise make a run overwrite a file outside the project. The data goes to a
+// fresh temp file in the same directory, then rename() replaces the target itself, never what a link points at.
+export function writeOutput(path, data) {
+    const dir = dirname(path);
+    if (isLink(dir))
+        throw new AttestedError(`attested: output directory ${dir} is a symlink; refusing to write through it`);
+    if (isLink(path))
+        throw new AttestedError(`attested: output ${path} is a symlink; refusing to write through it`);
+    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(tmp, data, { flag: 'wx' });
+        renameSync(tmp, path);
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+}
+function isLink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+// Hashes in chunks, so a large evidence file is never held in memory; refuses files over `max` bytes.
+export function sha256File(path, max = MAX_EVIDENCE_BYTES) {
+    const fd = openFile(path);
+    try {
+        const size = fstatSync(fd).size;
+        if (size > max)
+            throw new AttestedError(`attested: ${path} is ${size} bytes, over the ${max}-byte limit for evidence files`);
+        const hash = createHash('sha256');
+        const chunk = Buffer.alloc(1024 * 1024);
+        let bytes = 0;
+        for (let n; (n = readSync(fd, chunk, 0, chunk.length, null)) > 0;) {
+            bytes += n;
+            if (bytes > max)
+                throw new AttestedError(`attested: ${path} grew past the ${max}-byte limit for evidence files while hashing`);
+            hash.update(chunk.subarray(0, n));
+        }
+        return { sha256: hash.digest('hex'), bytes };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+// `path` (a file or directory under `root`) must not be a symlink and must resolve inside `root`, including through
+// symlinked parent directories. Returns false when it does not exist; throws when it escapes.
+export function checkInside(root, path, what) {
+    let st;
+    try {
+        st = lstatSync(path);
+    }
+    catch {
+        return false;
+    }
+    if (st.isSymbolicLink())
+        throw new AttestedError(`attested: ${what} ${path} is a symlink; refusing to read it`);
+    const rel = relative(realpathSync(root), realpathSync(path));
+    if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel))
+        throw new AttestedError(`attested: ${what} ${path} resolves outside ${root}; refusing to read it`);
+    return true;
+}
+// Reads `path` (under `root`) through one descriptor: opened first, then checked with checkInside and required to be the
+// same file the path names now, and read with `max` enforced on the bytes actually read. What is checked, read, and
+// hashed is one object, even if the path is replaced or the file grows meanwhile. Returns null when it does not exist.
+// `afterOpen` is a test seam for changing the file between opening and validation.
+export function readInside(root, path, max, what, afterOpen) {
+    let fd;
+    try {
+        fd = openFile(path, what);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    try {
+        afterOpen?.();
+        if (!checkInside(root, path, what))
+            throw new AttestedError(`attested: ${what} ${path} was removed while being read; refusing to read it`);
+        const st = fstatSync(fd);
+        const now = lstatSync(path);
+        if (st.dev !== now.dev || st.ino !== now.ino)
+            throw new AttestedError(`attested: ${what} ${path} was replaced while being read; refusing to read it`);
+        const chunks = [];
+        const chunk = Buffer.alloc(1024 * 1024);
+        let bytes = 0;
+        for (let n; (n = readSync(fd, chunk, 0, chunk.length, null)) > 0;) {
+            bytes += n;
+            if (bytes > max)
+                throw new AttestedError(`attested: ${what} ${path} is over the ${max}-byte limit`);
+            chunks.push(Buffer.from(chunk.subarray(0, n)));
+        }
+        return Buffer.concat(chunks);
+    }
+    finally {
+        closeSync(fd);
+    }
 }
 export function walk(dir) {
     let out = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxso/attested",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Signed, verifiable test receipts for agent-authored pull requests: wraps Playwright or any CTRF test run into an in-toto receipt signed with Sigstore via GitHub artifact attestations.",
   "keywords": [
     "attestation",
@@ -34,7 +34,8 @@
   "files": [
     "bin",
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "engines": {
     "node": ">=22"