@proagentstore/cli 0.4.155 → 0.4.156

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { confineWorkDir } from "./workdir-guard.js";
 import { actDigest } from "./input-ledger.js";
 import { parkRestore, parkSnapshot } from "./park-snapshot.js";
 import { runObjective } from "./run-objective.js";
@@ -84,21 +85,26 @@ export class CodingRuntime {
      * workDir (authoritative even for managed clone dirs); fall back to an explicit path
      * (the cloud passes the D1 `repo.workdir` when the session map is empty after a runner
      * restart). Expands a leading `~` the same way start() does.
+     *
+     * An explicit path is CONFINED (#1165): never the home folder or above it, never inside a
+     * credential directory — so `{ workDir: "~", path: ".ssh/id_ed25519" }` is refused rather
+     * than a confined read of a private key. See `workdir-guard.ts`.
      */
     resolveWorkDir(input) {
         if (input.sessionId) {
             const s = this.sessions.get(input.sessionId);
+            // The session's own folder answers to the same rule: a session started in `~` must not reopen it.
             if (s)
-                return s.config.workDir;
+                return confineWorkDir(s.config.workDir, { allow: [this.reposBaseDir] });
         }
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         throw new InspectError("no session or workDir to inspect");
     }
     /** Where a parked run's checkout is (#1077): its declared folder, else the managed clone dir `start()` uses. */
     parkWorkDir(input) {
         if (input.workDir)
-            return resolve(input.workDir.replace(/^~(?=$|\/)/, homedir()));
+            return confineWorkDir(input.workDir, { allow: [this.reposBaseDir] });
         if (input.repoId)
             return join(this.reposBaseDir, sanitizeSessionName(input.repoId));
         throw new InspectError("no workDir or repoId for the parked checkout");

package/dist/browser-runner/coding/secret-file.js

@@ -1,7 +1,8 @@
-import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { RunnerInputError } from "../errors.js";
+import { isWithin, realPathOf } from "./workdir-guard.js";
 /**
  * The runner's half of the machine-to-machine secret handoff (#918): read a secret file so the
  * cloud can encrypt it, and write one back from the cloud's decrypted copy.
@@ -18,23 +19,44 @@ import { RunnerInputError } from "../errors.js";
  */
 /** Big enough for any `.env`, key file or credentials JSON; small enough that this is not a file-transfer tool. */
 export const SECRET_MAX_BYTES = 64 * 1024;
-/** `~` expanded; a relative path resolves against the home directory, which is where `pags up` users name things from. */
-function resolvePath(raw) {
+/**
+ * The ONE folder the secret handoff reads from and writes to (#1165).
+ *
+ * It used to take any path the owner's account could reach: `/secure/read` would hand over
+ * `~/.ssh/id_ed25519`, and `/secure/write` with `overwrite: true` could replace `~/.ssh/authorized_keys`.
+ * Now a relative path is relative to this folder, and an absolute or `~/…` path must already be inside
+ * it, resolved through symlinks, so a link planted in it cannot point back out. Moving a delivered
+ * file to where it is used is the operator's step, in the open.
+ */
+export function secureFilesDir(home = homedir()) {
+    return join(home, ".config", "proagentstore", "secure-files");
+}
+/** `~` expanded; relative to {@link secureFilesDir}; refused unless it stays inside that folder. */
+function resolvePath(raw, home = homedir()) {
     const p = String(raw ?? "").trim();
     if (!p)
         throw new RunnerInputError("A `path` is required.");
-    const expanded = p.replace(/^~(?=$|\/)/, homedir());
-    return isAbsolute(expanded) ? resolve(expanded) : resolve(homedir(), expanded);
+    const root = secureFilesDir(home);
+    const expanded = p.replace(/^~(?=$|\/)/, home);
+    const path = isAbsolute(expanded) ? resolve(expanded) : resolve(root, expanded);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    if (path === root || !isWithin(realPathOf(path, home), realPathOf(root, home))) {
+        throw new RunnerInputError(`${p} is outside ${root}. The secret handoff reads and writes only inside that folder — name a file there, e.g. \`app.env\`.`);
+    }
+    return path;
 }
-export function readSecretFile(input) {
-    const path = resolvePath(input.path);
+export function readSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     let st;
     try {
-        st = statSync(path);
+        st = lstatSync(path);
     }
     catch {
         throw new RunnerInputError(`No file at ${path}.`);
     }
+    // Not followed (#1165): a symlink in the folder would read whatever it points at.
+    if (st.isSymbolicLink())
+        throw new RunnerInputError(`${path} is a symbolic link; the secret handoff reads regular files only.`);
     if (!st.isFile())
         throw new RunnerInputError(`${path} is not a regular file.`);
     if (st.size === 0)
@@ -63,8 +85,8 @@ function parseMode(raw) {
         throw new RunnerInputError(`mode ${s} is group/world-writable or executable; a secret file must not be.`);
     return mode;
 }
-export function writeSecretFile(input) {
-    const path = resolvePath(input.path);
+export function writeSecretFile(input, home = homedir()) {
+    const path = resolvePath(input.path, home);
     if (typeof input.value !== "string" || !input.value)
         throw new RunnerInputError("Nothing to write.");
     const mode = parseMode(input.mode);

package/dist/browser-runner/coding/workdir-guard.js

@@ -0,0 +1,80 @@
+/**
+ * What a caller-supplied `workDir` may be (#1165).
+ *
+ * The read-only inspection routes (`read-file`, `tree`, `search`, `git`) confine every PATH to the
+ * `workDir` — but took the `workDir` itself from the request. `{ workDir: "~", path: ".ssh/id_ed25519" }`
+ * was a perfectly confined read of a private key. The cloud sends the owner's registered repo folder
+ * (`coding_repos.workdir`), and registration accepts any local path, `~` included; this runner has no
+ * copy of that registry to check against. So it refuses what can never be a repository it should
+ * read inside, whoever asked:
+ *
+ *   • the filesystem root, the home folder, or any folder ABOVE the home folder — a root that holds
+ *     everything the owner has;
+ *   • a folder inside a credential directory ({@link CREDENTIAL_DIRS}) — `~/.ssh`, `~/.gnupg`, the
+ *     cloud CLIs' config, and ProAgentStore's own (`~/.config/proagentstore`, which holds the account
+ *     session), except the managed clones the runner itself makes there.
+ *
+ * Resolved through symlinks first (the nearest existing ancestor, for a folder a clone will create), so
+ * `~/dev/innocent -> ~/.ssh` is the credential directory it points at.
+ */
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { InspectError } from "./inspect.js";
+/** Folders under the home folder whose contents are credentials, never a repository to read. */
+export const CREDENTIAL_DIRS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".docker",
+    ".password-store",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/proagentstore",
+    "Library/Keychains",
+];
+/** `~` expanded; resolved through symlinks as far as the path exists. */
+export function realPathOf(raw, home = homedir()) {
+    const expanded = raw.trim().replace(/^~(?=$|[\\/])/, home);
+    let p = resolve(isAbsolute(expanded) ? expanded : join(home, expanded));
+    const tail = [];
+    while (!existsSync(p)) {
+        const up = dirname(p);
+        if (up === p)
+            break;
+        tail.unshift(basename(p));
+        p = up;
+    }
+    let real = p;
+    try {
+        real = realpathSync(p);
+    }
+    catch {
+        // Unreadable: judge the path as written.
+    }
+    return tail.length ? join(real, ...tail) : real;
+}
+/** Is `child` the same as `parent` or inside it? */
+export function isWithin(child, parent) {
+    const rel = relative(parent, child);
+    return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+/**
+ * The `workDir` a request may name, or an {@link InspectError} saying why not. `allow` lists folders the
+ * runner itself manages inside a credential directory — the managed clone root — which stay usable.
+ */
+export function confineWorkDir(raw, opts = {}) {
+    const home = realPathOf(opts.home ?? homedir(), opts.home ?? homedir());
+    const path = realPathOf(raw, opts.home ?? homedir());
+    if (isWithin(home, path)) {
+        throw new InspectError(`"${raw}" is ${path === home ? "the home folder" : "a folder that contains the home folder"}, not a repository — register the repository's own folder.`);
+    }
+    if ((opts.allow ?? []).some((a) => isWithin(path, realPathOf(a, home))))
+        return path;
+    const credential = CREDENTIAL_DIRS.find((d) => isWithin(path, realPathOf(join(home, d), home)));
+    if (credential)
+        throw new InspectError(`"${raw}" is inside ~/${credential}, which holds credentials — it cannot be read as a repository.`);
+    return path;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.155",
+  "version": "0.4.156",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",