@pugi/cli 0.1.0-beta.100 → 0.1.0-beta.101

package/dist/core/eval/v1/verifier.js

@@ -0,0 +1,176 @@
+/**
+ * Verification check executor for pugi-eval-v1.
+ *
+ * Each check kind has a pure implementation. The runner calls
+ * `runVerifications` after the CLI subprocess exits, passing the
+ * post-run workspace root + the final stdout text the engine emitted.
+ *
+ * Path safety: `file_exists` and `file_contains` resolve the path
+ * relative to the workspace root and refuse anything that escapes the
+ * root (`..` traversal, absolute paths, symlinks). A task spec that
+ * tries to peek outside the workspace fails the check rather than
+ * leaking host state.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, relative, resolve } from 'node:path';
+const DEFAULT_COMMAND_TIMEOUT_MS = 60_000;
+function withinRoot(rootReal, candidateReal) {
+    if (candidateReal === rootReal)
+        return true;
+    const rel = relative(rootReal, candidateReal);
+    return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+}
+/**
+ * Resolve `workspaceRoot` to its realpath once so symlinked tmp dirs
+ * (macOS `/tmp` -> `/private/tmp`) compare correctly against any
+ * resolved child path. Falls back к the raw root when the directory
+ * does not yet exist (defensive - production callers always create
+ * the tmp dir before invoking).
+ */
+function realRoot(workspaceRoot) {
+    try {
+        return realpathSync(workspaceRoot);
+    }
+    catch {
+        return workspaceRoot;
+    }
+}
+function resolveWorkspacePath(workspaceRoot, path) {
+    if (isAbsolute(path)) {
+        return { ok: false, reason: `absolute paths refused (${path})` };
+    }
+    if (path.split(/[\\/]/).includes('..')) {
+        return { ok: false, reason: `path traversal refused (${path})` };
+    }
+    const root = realRoot(workspaceRoot);
+    const absolute = resolve(root, path);
+    if (!withinRoot(root, absolute)) {
+        return { ok: false, reason: `path escapes workspace root (${path})` };
+    }
+    // realpath check: if the file exists, the realpath must also be
+    // inside the workspace root - symlinks that point outside are a
+    // refusal even when the entry itself is inside.
+    if (existsSync(absolute)) {
+        try {
+            const real = realpathSync(absolute);
+            if (!withinRoot(root, real)) {
+                return {
+                    ok: false,
+                    reason: `symlink target escapes workspace root (${path})`,
+                };
+            }
+        }
+        catch {
+            // Stat failure during realpath: surface as missing rather than
+            // throwing - the file_exists check will record the failure.
+        }
+    }
+    return { ok: true, absolute };
+}
+function matches(haystack, pattern, mode) {
+    if (mode === 'regex') {
+        let re;
+        try {
+            re = new RegExp(pattern);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                reason: `invalid regex ${pattern}: ${err.message}`,
+            };
+        }
+        return re.test(haystack)
+            ? { ok: true, reason: '' }
+            : { ok: false, reason: `regex ${pattern} did not match` };
+    }
+    return haystack.includes(pattern)
+        ? { ok: true, reason: '' }
+        : { ok: false, reason: `literal ${JSON.stringify(pattern)} not found` };
+}
+export function runVerification(check, ctx) {
+    switch (check.kind) {
+        case 'file_exists': {
+            const r = resolveWorkspacePath(ctx.workspaceRoot, check.path);
+            if (!r.ok)
+                return { kind: check.kind, passed: false, detail: r.reason };
+            try {
+                const stat = statSync(r.absolute);
+                if (!stat.isFile()) {
+                    return {
+                        kind: check.kind,
+                        passed: false,
+                        detail: `${check.path} exists but is not a regular file`,
+                    };
+                }
+                return { kind: check.kind, passed: true, detail: '' };
+            }
+            catch {
+                return {
+                    kind: check.kind,
+                    passed: false,
+                    detail: `${check.path} not found`,
+                };
+            }
+        }
+        case 'file_contains': {
+            const r = resolveWorkspacePath(ctx.workspaceRoot, check.path);
+            if (!r.ok)
+                return { kind: check.kind, passed: false, detail: r.reason };
+            let body;
+            try {
+                body = readFileSync(r.absolute, 'utf8');
+            }
+            catch {
+                return {
+                    kind: check.kind,
+                    passed: false,
+                    detail: `${check.path} not readable`,
+                };
+            }
+            const m = matches(body, check.pattern, check.mode);
+            return {
+                kind: check.kind,
+                passed: m.ok,
+                detail: m.ok ? '' : `${check.path}: ${m.reason}`,
+            };
+        }
+        case 'output_contains': {
+            const m = matches(ctx.finalText, check.pattern, check.mode);
+            return {
+                kind: check.kind,
+                passed: m.ok,
+                detail: m.ok ? '' : `final output: ${m.reason}`,
+            };
+        }
+        case 'command_exit_code': {
+            const timeout = check.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+            const result = spawnSync('bash', ['-lc', check.command], {
+                cwd: ctx.workspaceRoot,
+                timeout,
+                encoding: 'utf8',
+                env: { ...process.env, CI: '1' },
+            });
+            if (result.error) {
+                return {
+                    kind: check.kind,
+                    passed: false,
+                    detail: `${check.command}: ${result.error.message}`,
+                };
+            }
+            const exit = result.status ?? -1;
+            if (exit !== check.expectedExitCode) {
+                return {
+                    kind: check.kind,
+                    passed: false,
+                    detail: `${check.command}: exit ${exit} expected ${check.expectedExitCode}`,
+                };
+            }
+            return { kind: check.kind, passed: true, detail: '' };
+        }
+    }
+}
+export function runVerifications(checks, ctx) {
+    return checks.map((c) => runVerification(c, ctx));
+}
+//# sourceMappingURL=verifier.js.map

package/dist/core/eval/v1/yaml-parser.js

@@ -0,0 +1,250 @@
+/**
+ * Minimal YAML parser for pugi-eval-v1 task files.
+ *
+ * Same rationale as `core/recipes/schema.ts`: pulling in `js-yaml`
+ * is ~70 KB of installed weight for a schema we control. The shape
+ * here is intentionally narrow:
+ *
+ *  - Top-level scalars (string / number / boolean).
+ *  - Block sequences of scalars (e.g. plain string lists).
+ *  - Block sequences of maps (verification entries).
+ *  - Nested block maps (fixture file map).
+ *  - Multi-line block scalars via `|` (literal) and `>` (folded).
+ *  - `#` line comments.
+ *
+ * Unsupported YAML features: flow collections, anchors, tags,
+ * directives, document separators. The parser throws on anything
+ * outside the supported subset so a malformed task file fails fast
+ * with a clear line number.
+ *
+ * The parsed value is `unknown`; downstream loader code applies a Zod
+ * schema to narrow it. The parser deliberately does NOT do schema
+ * validation - it only enforces YAML well-formedness.
+ */
+export class TaskYamlParseError extends Error {
+    line;
+    constructor(message, line) {
+        super(`task YAML parse error at line ${line}: ${message}`);
+        this.line = line;
+        this.name = 'TaskYamlParseError';
+    }
+}
+/**
+ * Tokenise the source into non-blank, non-comment lines + their
+ * indentation. Tab characters are rejected (YAML spec) so the indent
+ * count is unambiguous.
+ */
+function tokenise(source) {
+    const physical = source.split(/\r?\n/);
+    const out = [];
+    for (let i = 0; i < physical.length; i += 1) {
+        const raw = physical[i] ?? '';
+        const lineNo = i + 1;
+        if (raw.includes('\t')) {
+            throw new TaskYamlParseError('tab characters are not allowed; use spaces for indentation', lineNo);
+        }
+        const stripped = raw.replace(/\s*#.*$/, '');
+        if (stripped.trim() === '')
+            continue;
+        const indent = stripped.length - stripped.replace(/^ +/, '').length;
+        out.push({ lineNo, indent, body: stripped.slice(indent) });
+    }
+    return out;
+}
+/**
+ * Convert a literal scalar (after the `:` or after a `-` marker) into
+ * a JS value. Recognises `true`/`false`, integers, floats, single-
+ * and double-quoted strings; everything else is returned verbatim as
+ * an unquoted string.
+ */
+function coerceScalar(raw, lineNo) {
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return '';
+    if (trimmed === 'true')
+        return true;
+    if (trimmed === 'false')
+        return false;
+    if (trimmed === 'null' || trimmed === '~')
+        return '';
+    if (/^-?\d+$/.test(trimmed))
+        return Number(trimmed);
+    if (/^-?\d+\.\d+$/.test(trimmed))
+        return Number(trimmed);
+    const doubleQuoted = /^"((?:\\.|[^"\\])*)"$/.exec(trimmed);
+    if (doubleQuoted) {
+        // Decode common escape sequences. This subset matches what the
+        // task spec needs (newlines inside regex patterns, escaped
+        // backslashes).
+        return doubleQuoted[1].replace(/\\(.)/g, (_, c) => {
+            if (c === 'n')
+                return '\n';
+            if (c === 't')
+                return '\t';
+            if (c === 'r')
+                return '\r';
+            if (c === '"')
+                return '"';
+            if (c === '\\')
+                return '\\';
+            throw new TaskYamlParseError(`unknown escape \\${c} in double-quoted string`, lineNo);
+        });
+    }
+    const singleQuoted = /^'((?:''|[^'])*)'$/.exec(trimmed);
+    if (singleQuoted) {
+        return singleQuoted[1].replace(/''/g, "'");
+    }
+    return trimmed;
+}
+/**
+ * Block scalar reader for `|` (literal, preserves newlines) and `>`
+ * (folded, newlines collapse to spaces). Joins continuation lines
+ * whose indent is strictly greater than the parent map's indent.
+ */
+function readBlockScalar(marker, parentIndent, lines, cursor) {
+    const collected = [];
+    let baseIndent = -1;
+    while (cursor.i < lines.length) {
+        const next = lines[cursor.i];
+        if (next.indent <= parentIndent)
+            break;
+        if (baseIndent < 0)
+            baseIndent = next.indent;
+        const slice = ' '.repeat(Math.max(0, next.indent - baseIndent)) + next.body;
+        collected.push(slice);
+        cursor.i += 1;
+    }
+    if (marker === '|')
+        return collected.join('\n');
+    return collected.join(' ');
+}
+/**
+ * Recursively parse a block beginning at `cursor.i` whose body lives
+ * strictly deeper than `parentIndent`. The return value is either a
+ * map (object) or a sequence (array); the caller decides which based
+ * on the first child line.
+ */
+function parseBlock(lines, cursor, parentIndent) {
+    if (cursor.i >= lines.length)
+        return {};
+    const first = lines[cursor.i];
+    if (first.indent <= parentIndent)
+        return {};
+    const blockIndent = first.indent;
+    const isSequence = first.body.startsWith('- ') || first.body === '-';
+    if (isSequence) {
+        const arr = [];
+        while (cursor.i < lines.length) {
+            const line = lines[cursor.i];
+            if (line.indent < blockIndent)
+                break;
+            if (line.indent > blockIndent) {
+                throw new TaskYamlParseError(`unexpected indent ${line.indent} in sequence (expected ${blockIndent})`, line.lineNo);
+            }
+            if (!line.body.startsWith('-')) {
+                throw new TaskYamlParseError(`expected sequence marker '-' but found ${line.body.slice(0, 10)}`, line.lineNo);
+            }
+            const after = line.body.replace(/^-\s*/, '');
+            cursor.i += 1;
+            if (after === '') {
+                arr.push(parseBlock(lines, cursor, blockIndent));
+                continue;
+            }
+            // Inline `- key: value` first entry; treat the rest of the line
+            // as a single-key map entry, then continue collecting deeper
+            // siblings into the same map.
+            const colonIdx = after.indexOf(':');
+            if (colonIdx === -1) {
+                arr.push(coerceScalar(after, line.lineNo));
+                continue;
+            }
+            const key = after.slice(0, colonIdx).trim();
+            const valRaw = after.slice(colonIdx + 1).trim();
+            const entry = {};
+            if (valRaw === '' || valRaw === '|' || valRaw === '>') {
+                if (valRaw === '|' || valRaw === '>') {
+                    entry[key] = readBlockScalar(valRaw, blockIndent, lines, cursor);
+                }
+                else {
+                    entry[key] = parseBlock(lines, cursor, blockIndent);
+                }
+            }
+            else {
+                entry[key] = coerceScalar(valRaw, line.lineNo);
+            }
+            // Continue absorbing deeper siblings of this synthetic map.
+            while (cursor.i < lines.length) {
+                const sibling = lines[cursor.i];
+                // Sibling map keys live at the same indent as the inline
+                // `key: value` text (which is at `blockIndent + 2` relative to
+                // the `-` marker). Anything at blockIndent or shallower
+                // belongs to the parent.
+                const childIndent = blockIndent + 2;
+                if (sibling.indent < childIndent)
+                    break;
+                if (sibling.indent > childIndent) {
+                    throw new TaskYamlParseError(`unexpected indent ${sibling.indent} (expected ${childIndent})`, sibling.lineNo);
+                }
+                const sibColon = sibling.body.indexOf(':');
+                if (sibColon === -1) {
+                    throw new TaskYamlParseError(`expected key:value in map but found ${sibling.body.slice(0, 20)}`, sibling.lineNo);
+                }
+                const sibKey = sibling.body.slice(0, sibColon).trim();
+                const sibVal = sibling.body.slice(sibColon + 1).trim();
+                cursor.i += 1;
+                if (sibVal === '' || sibVal === '|' || sibVal === '>') {
+                    if (sibVal === '|' || sibVal === '>') {
+                        entry[sibKey] = readBlockScalar(sibVal, childIndent, lines, cursor);
+                    }
+                    else {
+                        entry[sibKey] = parseBlock(lines, cursor, childIndent);
+                    }
+                }
+                else {
+                    entry[sibKey] = coerceScalar(sibVal, sibling.lineNo);
+                }
+            }
+            arr.push(entry);
+        }
+        return arr;
+    }
+    const map = {};
+    while (cursor.i < lines.length) {
+        const line = lines[cursor.i];
+        if (line.indent < blockIndent)
+            break;
+        if (line.indent > blockIndent) {
+            throw new TaskYamlParseError(`unexpected indent ${line.indent} (expected ${blockIndent})`, line.lineNo);
+        }
+        const colonIdx = line.body.indexOf(':');
+        if (colonIdx === -1) {
+            throw new TaskYamlParseError(`expected key:value but found ${line.body.slice(0, 20)}`, line.lineNo);
+        }
+        const key = line.body.slice(0, colonIdx).trim();
+        const valRaw = line.body.slice(colonIdx + 1).trim();
+        cursor.i += 1;
+        if (valRaw === '') {
+            map[key] = parseBlock(lines, cursor, blockIndent);
+            continue;
+        }
+        if (valRaw === '|' || valRaw === '>') {
+            map[key] = readBlockScalar(valRaw, blockIndent, lines, cursor);
+            continue;
+        }
+        map[key] = coerceScalar(valRaw, line.lineNo);
+    }
+    return map;
+}
+export function parseTaskYaml(source) {
+    const lines = tokenise(source);
+    if (lines.length === 0)
+        return {};
+    const cursor = { i: 0 };
+    const result = parseBlock(lines, cursor, -1);
+    if (cursor.i !== lines.length) {
+        const stray = lines[cursor.i];
+        throw new TaskYamlParseError(`stray content after document body`, stray.lineNo);
+    }
+    return result;
+}
+//# sourceMappingURL=yaml-parser.js.map

package/dist/core/sandboxing/adapter.js

@@ -1,25 +1,39 @@
 /**
- * Bash sandbox adapter interface (Trust Sprint item 6).
+ * Bash sandbox adapter interface (Trust Sprint item 6 + Phase 1 #302).
  *
- * Adapter pattern so the bash tool stays unchanged: a runner wraps the
- * spawn invocation with an OS-level sandbox primitive. Today's variants:
+ * Adapter pattern: a runner wraps the spawn invocation with an
+ * OS-level sandbox primitive. Today's variants:
  *
- *   - none           — passthrough (existing behaviour).
- *   - macOS-seatbelt — /usr/bin/sandbox-exec with a workspace-scoped
- *                      write allowlist, read-anywhere, network-allow
- *                      profile.
- *   - docker         — Linux fallback. Throws at boot (deferred to a
- *                      follow-up PR; schema accepts the keyword so
- *                      operators can see it documented).
+ *   - none           - passthrough (legacy behaviour, default).
+ *   - macOS-seatbelt - /usr/bin/sandbox-exec with a workspace-scoped
+ *                      write allowlist + secret-dir deny list +
+ *                      posture-conditional network rule.
+ *   - bubblewrap     - Linux `bwrap` user-namespace jail with a
+ *                      read-only bind of /usr, /lib, /etc, a tmpfs at
+ *                      /tmp, and a writable bind for workspaceRoot.
+ *                      Posture toggles `--share-net`.
+ *   - docker         - Windows fallback (not shipped in this PR;
+ *                      schema accepts the keyword so a forward-rolled
+ *                      settings.json does not error).
  *
- * The CLI bash tool itself is owned by a parallel agent (PUGI-VERIFY-
- * GATE). We intentionally do NOT modify `tools/bash.ts` here. Instead
- * the sandbox sits as an indirection layer between higher-level
- * callers (`runtime/cli.ts`, `core/bash-runner.ts` if introduced
- * later) and the existing bash entry-point.
+ * Mechanism x posture matrix:
  *
- * Future: replace this with native landlock bindings on Linux and
- * job-object on Windows. The interface is stable, the adapters
+ *   | mechanism       | strict                              | lenient                           | off          |
+ *   | --------------- | ----------------------------------- | --------------------------------- | ------------ |
+ *   | none            | passthrough (mode wins)             | passthrough (mode wins)           | passthrough  |
+ *   | macOS-seatbelt  | workspace writes + deny network     | workspace writes + allow network  | passthrough  |
+ *   | bubblewrap      | workspace bind + deny network       | workspace bind + allow network    | passthrough  |
+ *   | docker          | (not shipped)                       | (not shipped)                     | passthrough  |
+ *
+ * Wired into `tools/bash.ts` at the `spawn`/`spawnSync` call sites
+ * (foreground async, foreground sync, background). The wrap fires
+ * AFTER the permission gate so a refused command never reaches the
+ * sandbox layer; if the adapter probe returns `armed=false` and the
+ * configured mechanism is non-`none`, the bash tool refuses
+ * fail-closed instead of silently degrading.
+ *
+ * Future: replace bubblewrap with native landlock bindings on Linux
+ * + job-object on Windows. The interface is stable, the adapters
  * change.
  */
 export {};