@principles/pd-cli 1.135.0 → 1.135.1

package/tests/resolve-workspace.test.ts

@@ -172,4 +172,25 @@ describe('resolveWorkspaceDir', () => {
     mockDiscover.mockReturnValue(null);
     expect(() => resolveWorkspaceDir()).toThrow('workspace.default');
   });
+
+  // 12. CWE-22 boundary guard: parent traversal is rejected
+  it('rejects parent-traversal workspace paths', () => {
+    mockDiscover.mockReturnValue(null);
+    expect(() => resolveWorkspaceDir('../evil')).toThrow('parent traversal');
+    expect(() => resolveWorkspaceDir('a/../../b')).toThrow('parent traversal');
+  });
+
+  // 13. CWE-22 boundary guard: filesystem root is rejected
+  it('rejects filesystem-root workspace paths', () => {
+    mockDiscover.mockReturnValue(null);
+    expect(() => resolveWorkspaceDir('/')).toThrow('filesystem root');
+  });
+
+  // 14. Platform-agnostic: a Windows-style path is accepted everywhere.
+  // On POSIX runners "Z:\\work" is not absolute; the boundary guard must
+  // NOT treat that as invalid (regression for CI failure on Linux).
+  it('accepts Windows-style workspace paths (platform-agnostic)', () => {
+    mockDiscover.mockReturnValue(null);
+    expect(resolveWorkspaceDir('Z:\\pd-nonexistent-workspace-12345')).toBe('Z:\\pd-nonexistent-workspace-12345');
+  });
 });

package/tests/services/console-launcher.test.ts

@@ -0,0 +1,114 @@
+/**
+ * Tests for console-launcher openBrowser command-injection hardening (PRI-547).
+ *
+ * The win32 opener must never route the URL through a shell
+ * (`cmd.exe /c start "" <url>`). It must use a parameterized spawn of
+ * `explorer.exe` with an argument array, and the URL must be validated as
+ * http(s) before any spawn.
+ *
+ * Covers:
+ * - http(s) URLs accepted
+ * - non-http(s) schemes rejected before spawn (no child process created)
+ * - shell metacharacters cannot reach a shell (spawn called with arg array)
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const launcherPath = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+  '..',
+  'src',
+  'services',
+  'console-launcher.js',
+);
+
+describe('openBrowser URL validation and no-shell spawn', () => {
+  let spawnMock: ReturnType<typeof vi.fn>;
+  let platformSpy: ReturnType<typeof vi.spyOn>;
+
+  const fakeChild = () => {
+    const child: any = { on: vi.fn(), unref: vi.fn() };
+    return child;
+  };
+
+  beforeEach(() => {
+    spawnMock = vi.fn(() => fakeChild());
+    vi.doMock('child_process', () => ({ spawn: spawnMock, execFile: vi.fn(), execFileSync: vi.fn() }));
+    platformSpy = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32' as any);
+  });
+
+  afterEach(() => {
+    vi.doUnmock('child_process');
+    platformSpy.mockRestore();
+    vi.resetModules();
+  });
+
+  async function loadOpenBrowser() {
+    const mod = await import(launcherPath);
+    return mod.openBrowser as (url: string) => Promise<{ opened: boolean; reason?: string; nextAction?: string }>;
+  }
+
+  it('opens an https URL via parameterized explorer.exe spawn (no shell)', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const result = await openBrowser('https://localhost:8123');
+
+    expect(result.opened).toBe(true);
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    const [cmd, args, opts] = spawnMock.mock.calls[0];
+    expect(cmd).toBe('explorer.exe');
+    // Argument array — never a shell command string
+    expect(Array.isArray(args)).toBe(true);
+    expect(args).toEqual(['https://localhost:8123/']);
+    // No shell option
+    expect(opts.shell).not.toBeDefined();
+  });
+
+  it('accepts http URL on localhost (legitimate local console)', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const result = await openBrowser('http://127.0.0.1:8123');
+
+    expect(result.opened).toBe(true);
+    expect(spawnMock.mock.calls[0][1]).toEqual(['http://127.0.0.1:8123/']);
+  });
+
+  it('rejects javascript: scheme without spawning', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const result = await openBrowser('javascript:alert(1)');
+
+    expect(result.opened).toBe(false);
+    expect(result.reason).toContain('protocol');
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  it('rejects file: scheme without spawning', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const result = await openBrowser('file:///etc/passwd');
+
+    expect(result.opened).toBe(false);
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  it('rejects empty URL without spawning', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const result = await openBrowser('');
+
+    expect(result.opened).toBe(false);
+    expect(result.reason).toContain('empty');
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  it('shell metacharacters in a valid http URL stay as data (arg array, not shell)', async () => {
+    const openBrowser = await loadOpenBrowser();
+    const sneaky = 'http://localhost:8123/path?a=1&b=2;calc.exe';
+    const result = await openBrowser(sneaky);
+
+    expect(result.opened).toBe(true);
+    const args = spawnMock.mock.calls[0][1] as string[];
+    expect(args.length).toBe(1);
+    // The whole URL is a single argument — the spawn call has no shell so
+    // metacharacters cannot be interpreted as commands.
+    expect(args[0]).toContain(';calc.exe');
+  });
+});

package/tests/services/pd-config-loader.test.ts

@@ -38,7 +38,14 @@ function rmTmpDir(dir: string): void {
 }
 
 function writeConfig(workspaceDir: string, content: string): void {
-  const configDir = path.join(workspaceDir, PD_CONFIG_DIR);
+  // CWE-22 boundary guard for test helpers: every config path is derived
+  // from an mkdtemp dir under os.tmpdir(); verify that invariant before IO.
+  const tmpRoot = path.resolve(os.tmpdir());
+  const wsRoot = path.resolve(workspaceDir);
+  if (!wsRoot.startsWith(tmpRoot + path.sep)) {
+    throw new Error(`Test helper refuses non-tmpdir workspace: ${workspaceDir}`);
+  }
+  const configDir = path.join(wsRoot, PD_CONFIG_DIR);
   fs.mkdirSync(configDir, { recursive: true });
   fs.writeFileSync(path.join(configDir, PD_CONFIG_FILENAME), content, 'utf8');
 }

package/tests/services/quality-scorecard/strong-model-gate.test.ts

@@ -0,0 +1,133 @@
+/**
+ * Tests for strong-model-gate URL validation (PRI-361 / PRI-547).
+ *
+ * Threat model: OPENAI_BASE_URL is operator configuration (trusted), so
+ * local/private OpenAI-compatible endpoints must work. What stays blocked:
+ * non-http(s) schemes, malformed URLs, embedded credentials.
+ *
+ * Covers:
+ * - Public HTTPS endpoint allowed
+ * - Explicit local HTTP endpoint allowed (localhost / 127.0.0.1 / private LAN)
+ * - Non-http(s) schemes rejected (file:, javascript:, data:)
+ * - Malformed URL rejected
+ * - Embedded credentials rejected
+ * - Endpoint derivation appends /chat/completions correctly
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { assertSafeLlmBaseUrl } from '../../../src/services/quality-scorecard/strong-model-gate.js';
+
+// ── assertSafeLlmBaseUrl ────────────────────────────────────────────────────
+
+describe('assertSafeLlmBaseUrl — operator-configured provider URLs', () => {
+  it('allows public HTTPS endpoint', () => {
+    const url = assertSafeLlmBaseUrl('https://api.openai.com/v1');
+    expect(url.protocol).toBe('https:');
+    expect(url.hostname).toBe('api.openai.com');
+  });
+
+  it('allows public HTTP endpoint (operator choice)', () => {
+    const url = assertSafeLlmBaseUrl('http://model.example.com/v1');
+    expect(url.protocol).toBe('http:');
+  });
+
+  it('allows localhost local LLM endpoint (llama.cpp / LM Studio)', () => {
+    const url = assertSafeLlmBaseUrl('http://localhost:1234/v1');
+    expect(url.hostname).toBe('localhost');
+    expect(url.port).toBe('1234');
+  });
+
+  it('allows 127.0.0.1 loopback local LLM endpoint', () => {
+    const url = assertSafeLlmBaseUrl('http://127.0.0.1:8080/v1');
+    expect(url.hostname).toBe('127.0.0.1');
+  });
+
+  it('allows private LAN OpenAI-compatible endpoint', () => {
+    const url = assertSafeLlmBaseUrl('http://192.168.1.50:8000/v1');
+    expect(url.hostname).toBe('192.168.1.50');
+  });
+
+  it('allows 10.x private endpoint', () => {
+    const url = assertSafeLlmBaseUrl('http://10.0.0.5:9000/v1');
+    expect(url.hostname).toBe('10.0.0.5');
+  });
+
+  it('rejects file: scheme', () => {
+    expect(() => assertSafeLlmBaseUrl('file:///tmp/foo')).toThrow(/protocol must be http or https/);
+  });
+
+  it('rejects javascript: scheme', () => {
+    expect(() => assertSafeLlmBaseUrl('javascript:alert(1)')).toThrow(/protocol must be http or https/);
+  });
+
+  it('rejects data: scheme', () => {
+    expect(() => assertSafeLlmBaseUrl('data:text/plain,hello')).toThrow(/protocol must be http or https/);
+  });
+
+  it('rejects malformed URL', () => {
+    expect(() => assertSafeLlmBaseUrl('not a url at all')).toThrow(/not a valid URL/);
+    expect(() => assertSafeLlmBaseUrl('http://')).toThrow(/not a valid URL/);
+  });
+
+  it('rejects embedded credentials in URL', () => {
+    expect(() => assertSafeLlmBaseUrl('https://user:pass@api.openai.com/v1')).toThrow(
+      /credentials must not be embedded/,
+    );
+  });
+
+  it('rejects empty string', () => {
+    expect(() => assertSafeLlmBaseUrl('')).toThrow(/not a valid URL/);
+  });
+});
+
+// ── Endpoint derivation (integration via adjudicate) ────────────────────────
+
+describe('strong-model-gate adjudicate endpoint derivation', () => {
+  const origEnv = { ...process.env };
+
+  beforeEach(() => {
+    vi.resetModules();
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  afterEach(() => {
+    process.env = { ...origEnv };
+    vi.unstubAllGlobals();
+  });
+
+  it('derives /chat/completions from a local base URL with trailing slash', async () => {
+    process.env.OPENAI_BASE_URL = 'http://localhost:1234/v1/';
+    process.env.OPENAI_API_KEY = 'test-key';
+
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        choices: [{ message: { content: '{"scores":{"G1":2,"G2":2,"G3":2,"G4":2,"G5":2,"G6":2,"G7":2},"rationale":"ok","verdict":"pass"}' } }],
+      }),
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const { adjudicate } = await import('../../../src/services/quality-scorecard/strong-model-gate.js');
+    const result = await adjudicate(
+      {
+        episodeId: 'ep-1',
+        source: 'tool_failure',
+        score: 80,
+        severity: 'high',
+        summary: 'test episode',
+        evolutionTaskResolution: null,
+        linkedPrinciples: [],
+      } as any,
+      {
+        model: 'local',
+        dimensionScores: { G1: 2, G2: 2, G3: 2, G4: 2, G5: 2, G6: 2, G7: 2 },
+        dimensionRationales: {},
+        flags: [],
+      } as any,
+      { modelId: 'gpt-test', log: () => {} },
+    );
+
+    const calledUrl = fetchMock.mock.calls[0][0] as string;
+    expect(calledUrl).toBe('http://localhost:1234/v1/chat/completions');
+    expect(result.adjudicationStatus).toBe('pass');
+  });
+});

package/tests/utils/path-security.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Tests for path-security primitives (isPathInside, assertSafeDirectoryRoot, canonicalPath).
+ *
+ * Covers:
+ * - Relative workspace containment (regression: startsWith on relative root)
+ * - Absolute path containment
+ * - Sibling-prefix attack (/work/foo vs /work/foobar)
+ * - Traversal escape rejection
+ * - Filesystem root rejection
+ * - Empty path rejection
+ * - Windows path cross-platform semantics
+ * - POSIX path cross-platform semantics
+ */
+import { describe, it, expect } from 'vitest';
+import * as path from 'node:path';
+import { isPathInside, assertSafeDirectoryRoot, canonicalPath } from '../../src/utils/path-security.js';
+
+// ── canonicalPath ───────────────────────────────────────────────────────────
+
+describe('canonicalPath', () => {
+  it('resolves relative paths to absolute', () => {
+    const result = canonicalPath('./relative/path');
+    expect(path.isAbsolute(result)).toBe(true);
+    expect(result).toContain('relative');
+  });
+
+  it('keeps absolute paths unchanged in effect', () => {
+    const result = canonicalPath('/tmp/workspace');
+    expect(path.isAbsolute(result)).toBe(true);
+  });
+
+  it('collapses parent traversal', () => {
+    const result = canonicalPath('/tmp/a/../b');
+    // After resolve, /tmp/a/../b = /tmp/b
+    expect(result).toBe(path.resolve('/tmp/b'));
+  });
+
+  it('handles empty string as cwd', () => {
+    const result = canonicalPath('');
+    expect(result).toBe(path.resolve(''));
+  });
+});
+
+// ── isPathInside ────────────────────────────────────────────────────────────
+
+describe('isPathInside', () => {
+  it('returns true for a file inside parent (relative parent)', () => {
+    // Regression: relative parent, absolute child
+    const parent = './relative-workspace';
+    const child = path.resolve('./relative-workspace/memory/logs/SYSTEM_2026-06-08.log');
+    expect(isPathInside(parent, child)).toBe(true);
+  });
+
+  it('returns true for a file inside parent (absolute parent)', () => {
+    const parent = '/tmp/workspace';
+    const child = '/tmp/workspace/memory/logs/X.log';
+    expect(isPathInside(parent, child)).toBe(true);
+  });
+
+  it('returns true for a nested subdirectory', () => {
+    const parent = '/tmp/workspace';
+    const child = '/tmp/workspace/sub/dir/file.txt';
+    expect(isPathInside(parent, child)).toBe(true);
+  });
+
+  it('returns false when candidate === parent (strict containment)', () => {
+    const parent = '/tmp/workspace';
+    const child = parent;
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('returns false for sibling-prefix attack', () => {
+    // /work/foo should NOT contain /work/foobar
+    const parent = '/tmp/work/foo';
+    const child = '/tmp/work/foobar/evil.txt';
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('returns false for upward traversal', () => {
+    const parent = '/tmp/workspace';
+    const child = '/tmp/workspace/../../etc/passwd';
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('returns false for paths outside parent', () => {
+    const parent = '/tmp/workspace';
+    const child = '/tmp/other/file.txt';
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('returns false for sibling in parallel directory', () => {
+    const parent = '/tmp/workspace/a';
+    const child = '/tmp/workspace/b/file.txt';
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('handles Windows-style paths (cross-platform, resolve-based)', () => {
+    // On Windows, path.resolve('C:\\workspace') works; on POSIX it's a relative path.
+    // Either way, the comparison is canonical-vs-canonical.
+    const parent = 'C:\\workspace';
+    const child = path.resolve('C:\\workspace\\memory\\logs\\X.log');
+    // On POSIX, both resolve to cwd-based paths; the containment should still
+    // be consistent: child must be inside parent after canonicalization.
+    // This test verifies no crash and consistent behavior.
+    expect(() => isPathInside(parent, child)).not.toThrow();
+  });
+
+  it('requires parent to be a path prefix of child (not reverse)', () => {
+    const parent = '/tmp/workspace/sub';
+    const child = '/tmp/workspace';
+    expect(isPathInside(parent, child)).toBe(false);
+  });
+
+  it('handles dot as current directory', () => {
+    const parent = '.';
+    const child = path.resolve('./some-file.txt');
+    expect(isPathInside(parent, child)).toBe(true);
+  });
+});
+
+// ── assertSafeDirectoryRoot ─────────────────────────────────────────────────
+
+describe('assertSafeDirectoryRoot', () => {
+  it('returns canonical path for a valid relative root', () => {
+    const result = assertSafeDirectoryRoot('./relative-workspace', 'test');
+    expect(path.isAbsolute(result)).toBe(true);
+    expect(result).toContain('relative-workspace');
+  });
+
+  it('returns canonical path for a valid absolute root', () => {
+    const result = assertSafeDirectoryRoot('/tmp/workspace', 'test');
+    expect(path.isAbsolute(result)).toBe(true);
+  });
+
+  it('throws for empty path', () => {
+    expect(() => assertSafeDirectoryRoot('', 'test')).toThrow('path is empty');
+  });
+
+  it('throws for whitespace-only path', () => {
+    expect(() => assertSafeDirectoryRoot('   ', 'test')).toThrow('path is empty');
+  });
+
+  it('throws for parent traversal', () => {
+    expect(() => assertSafeDirectoryRoot('../etc/passwd', 'test')).toThrow('parent traversal');
+  });
+
+  it('throws for deep parent traversal', () => {
+    expect(() => assertSafeDirectoryRoot('a/../../b', 'test')).toThrow('parent traversal');
+  });
+
+  it('throws for filesystem root (POSIX)', () => {
+    // Skip on Windows where this is a drive letter
+    expect(() => assertSafeDirectoryRoot('/', 'test')).toThrow('filesystem root');
+  });
+
+  it('throws for filesystem root (Windows drive)', () => {
+    // On Windows, 'C:\\' is a root; on POSIX, it resolves to cwd/C:\ which is not root.
+    // The test validates no crash and consistent behavior.
+    expect(() => {
+      try {
+        assertSafeDirectoryRoot('C:\\', 'test');
+        // On some platforms C:\ might resolve to a non-root path, so no throw
+      } catch (e) {
+        expect((e as Error).message).toMatch(/root|traversal/i);
+      }
+    }).not.toThrow();
+  });
+
+  it('allows sibling-level paths (not traversal)', () => {
+    // a/../b becomes 'b' after normalize (foldable), then resolves to cwd/b
+    // This is safe because it resolves inside cwd, no traversal.
+    const result = assertSafeDirectoryRoot('a/../b', 'test');
+    expect(path.isAbsolute(result)).toBe(true);
+  });
+
+  it('allows a workspace path with dots in name', () => {
+    const result = assertSafeDirectoryRoot('./my.project/v1', 'test');
+    expect(result).toContain('my.project');
+  });
+});