@procedures/restic 0.27.8 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # @procedures/restic
 
+## 0.28.1
+
+### Patch Changes
+
+- 497e32f: New configuration paths for the five breaks of the second code audit (roadmap O55, decision D35). Each old input keeps working, with a deprecation notice.
+  
+  PATCH: new options and exports, and deprecation notices. No input that works today gets an error. Each notice is a `DeprecationWarning` of Node, one time in each process, and it names the new path.
+  
+  - `@procedures/tailscale` adds `createTailscaleModule({ executable })` and `createTailscaleProcedures({ executable })`. The order of the program is the input `executable`, then the option, then `TAILSCALE_EXE`, then the Windows install folder, then `tailscale`. The input `executable` is `@deprecated`, with the notice `PROCEDURES_TAILSCALE_EXECUTABLE_INPUT`.
+  - `@procedures/restic` adds the option `executable` of `createResticModule()` and `createResticProcedures()`. The input `executable` of `restic.run` wins over it, as before. The input is `@deprecated`, with the notice `PROCEDURES_RESTIC_EXECUTABLE_INPUT`.
+  - `@procedures/mail` exports `MAIL_PASSWORD_ENV`, the pattern of the names of `passwordEnv`: `IMAP_` or `MAIL_` and more. Another name still works, with the notice `PROCEDURES_MAIL_PASSWORD_ENV`.
+  - `@procedures/notify` exports `NOTIFY_TOKEN_ENV`, the pattern of the names of `tokenEnv`: `NTFY_` or `NOTIFY_` and more. Another name still works, with the notice `PROCEDURES_NOTIFY_TOKEN_ENV`.
+  
+  The breaks that come next. Each break is its own MINOR, and the group is released after each one.
+  
+  1. 0.29.0, the host fetch policy: `weather.forecast` and the `mcpHostModules` of `geo` and `ics` refuse a loopback, private or link-local host with `FORBIDDEN`. The option `warnOnRefusal` of `createHostFetch()` goes away.
+     - The site, MiniMongo and Graph: no change. They do not call these procedures through a registry of Node.
+     - jarvis: no change. `packages/pipeline` calls the function `geocode()` of `@procedures/geo`, not the procedure.
+     - Another host with a private server gives `createWeatherModule({ fetch: createHostFetch({ allow: [...] }) })`, or the same for `createGeoModule()` and `createIcsModule()`, before the bundle.
+  2. 0.30.0, `tailscale.run` (#182): the input `executable` gets a validation error.
+     - jarvis: `packages/instance/src/remote.ts` sends `executable: bin`. Make the caller from `createTailscaleModule({ executable: bin })` in place of `tailscaleModule`, and remove `executable` from the input. Or set `TAILSCALE_EXE` from `JARVIS_TAILSCALE_BIN`.
+     - The site, MiniMongo and Graph: no change. They do not call `tailscale.run`.
+  3. 0.31.0, `restic.run` (#183): the input `executable` gets a validation error.
+     - jarvis: no change. It calls `runRestic()` with the result of `findRestic()`, not `restic.run`.
+     - The site, MiniMongo and Graph: no change. They do not call `restic.run`.
+     - Another host gives the program to `createResticModule({ executable })`, or sets `RESTIC_EXE`.
+  4. 0.32.0, `mail.headers` (#184): a `passwordEnv` without the prefix `IMAP_` or `MAIL_` gets a validation error.
+     - The site, MiniMongo, Graph and jarvis: no change. They do not call `mail.headers`.
+     - Another host renames the variable, for example `GMAIL_APP_PASSWORD` to `IMAP_GMAIL_PASSWORD`, and gives the new name in `passwordEnv`.
+  5. 0.33.0, `notify.send` (#185): a `tokenEnv` without the prefix `NTFY_` or `NOTIFY_` gets a validation error.
+     - The site, MiniMongo, Graph and jarvis: no change. They do not give `tokenEnv`.
+     - Another host renames the variable, for example `PHONE_TOKEN` to `NTFY_TOKEN`, and gives the new name in `tokenEnv`.
+  
+  Migration now: a host that gets a notice changes to the new path that the notice names. The notice then stops, and the next break does not change the host.
+- 21dc858: Fixes for the security findings of the second code audit (roadmap O55).
+  
+  PATCH: bug fixes and additive options. Each fix refuses only an input that the documentation does not give. A caller that uses the documented behavior sees no change. A request to a loopback, private or link-local host still works, with a deprecation notice. Version 0.29.0 refuses it (decision D35).
+  
+  - `procedure.delete` and `procedure.define` of `@procedures/client` obey the expose rule of the host, as `procedure.get` does (R17). `procedure.delete` does not find a hidden procedure, and `procedure.define` refuses to replace one with `NOT_EXPOSED`. A new procedure at a free path stays possible, as before. Before, a caller could remove or replace a hidden procedure that the host defined.
+  - The task store of `@procedures/mcp-server` keeps a task without a session (stdio, an SDK transport) apart from the HTTP sessions, both ways. Before, each HTTP session could list, read and cancel such a task.
+  - `restic.run` of `@procedures/restic` refuses each input that lets the caller choose a program for restic to start: `--from-password-command`, `--password-command2`, an extended option that sets `sftp.command`, `sftp.args`, `rclone.program` or `rclone.args` (each spelling), an sftp or rclone repository whose host or remote starts with `-`, and a positional argument that starts with `-` after a last flag without a value. Before, only `--password-command` was refused.
+  - `@procedures/http` exports `createHostFetch(options)`: a `fetch` for GET requests through the host policy, with the options of `createHttpModule()`. It also exports `httpSettings(options)`. The deprecated option `warnOnRefusal` keeps a refused host working: the process gets one `DeprecationWarning`, and the request goes through the global `fetch`.
+  - `weather.forecast` of `@procedures/weather` sends its request through `createHostFetch()` with `warnOnRefusal`. A `baseUrl` on a loopback, private or link-local address still works, with the warning `PROCEDURES_WEATHER_PRIVATE_HOST`. `createWeatherModule({ fetch })` gives another `fetch`, for a server of the host on such an address.
+  - `@procedures/geo` and `@procedures/ics` add `createGeoModule({ fetch })` and `createIcsModule({ fetch })`. Their default stays the global `fetch`, because their roots run in a browser. A refusal of the host policy keeps its code and its reason. The refusal of `ics.fetch` does not name the feed address.
+  - `@procedures/bundle-assistant` exports `mcpHostModules`: the modules of `geo` and `ics` with `createHostFetch()` and `warnOnRefusal`. A refused host gets the warning `PROCEDURES_GEO_PRIVATE_HOST` or `PROCEDURES_ICS_PRIVATE_HOST`. The bundle keeps the default modules, so `mark` and the site load it next to `geo` and `ics` as before.
+  - The dev-tools server of `@procedures/mcp-dev-tools` gives the `mcpHostModules` of each bundle to `createRegistry()` before the bundles. In one call, the first module of a name counts. Thus `geo.geocode`, `geo.route`, `weather.forecast` and `ics.fetch` of the dev-tools server go through the default host policy.
+  
+  A host that sends `weather.forecast`, or the bundle's `geo` tools, to a server on a private address can remove the warning now. It gives a `fetch` that allows the server: `createWeatherModule({ fetch: createHostFetch({ allow: ["10.0.0.5:8080"] }) })`. This `fetch` refuses each other private host now, as 0.29.0 does by default.
+- Updated dependencies [345c740]
+- Updated dependencies [984c13b]
+- Updated dependencies [21dc858]
+  - @procedures/client@0.28.1
+  - @procedures/shell@0.28.1
+
+## 0.28.0
+
+### Patch Changes
+
+- Updated dependencies [06694d7]
+  - @procedures/client@0.28.0
+  - @procedures/shell@0.28.0
+
 ## 0.27.8
 
 ### Patch Changes

package/README.md

@@ -27,7 +27,14 @@ const { json } = await client.exec(["restic", "run"], { path: ["snapshots"] });
 
 ## Secrets
 
-restic reads the repository and its keys from the environment (`RESTIC_REPOSITORY`, `RESTIC_PASSWORD`, `B2_ACCOUNT_ID`, `AWS_ACCESS_KEY_ID` and the others), so no secret is an input. `restic.run` refuses `--password-command`, because that flag starts a program.
+restic reads the repository and its keys from the environment (`RESTIC_REPOSITORY`, `RESTIC_PASSWORD`, `B2_ACCOUNT_ID`, `AWS_ACCESS_KEY_ID` and the others), so no secret is an input.
+
+`restic.run` refuses each input that lets the caller choose a program for restic to start:
+
+- The flags `--password-command`, `--from-password-command` and `--password-command2`.
+- An extended option (`--option`) that sets `sftp.command`, `sftp.args`, `rclone.program` or `rclone.args`, in each spelling that restic reads.
+- An sftp or rclone repository whose host or remote starts with `-`, in `repository`, `--repo`, `--from-repo` or `--repo2`. `ssh` and `rclone` read such a value as an option.
+- A positional argument that starts with `-` after a last flag without a value. Put a flag with a value last, or start the argument with `./`.
 
 A host can give the secrets only to the restic process, with the `env` option of `createResticModule()` or `runRestic()`:
 
@@ -50,13 +57,15 @@ The package root exports the functions that `restic.run` uses:
 | `runRestic(command, options)` | Starts a restic command with argv, and reads its JSON output. |
 | `findRestic(options)` | Finds the restic program. |
 | `resticArgv(command)` | Gives the argv of a restic command. |
-| `createResticModule(options)` | Gives the module with the settings of the host: `env` and `run`. |
+| `createResticModule(options)` | Gives the module with the settings of the host: `executable`, `env` and `run`. |
 
 - `command` has `path`, `positional`, `args`, `repository` and `json`. `json` is true when the command does not set it, as in `restic.run`.
 - `options` of `runRestic` has `executable`, `env`, `cwd`, `timeout`, `signal` and `run`.
 - `runRestic` throws when restic does not start. A failed command gives `success: false`, with `exitCode` and `stderr`.
 - `run` replaces the function that starts restic. A test gives a fake runner.
 - `findRestic` gives `RESTIC_EXE` when it is set. On Windows, it then looks for the `restic*.exe` of a WinGet package. Then it gives `restic`, and the `PATH` gives the program.
+- The program of `restic.run` comes from the host: the `executable` option of `createResticModule()`, then `RESTIC_EXE`, then `restic`.
+- The input `executable` of `restic.run` is deprecated. In 0.28 it still names the program, and the process gets one `DeprecationWarning` with the code `PROCEDURES_RESTIC_EXECUTABLE_INPUT`. Version 0.31.0 refuses it.
 
 ```ts
 const executable = await findRestic();