@sayknow-cli/coding-agent 0.4.6 → 0.5.0

package/src/extensibility/plugins/marketplace/fetcher.ts

@@ -5,10 +5,14 @@
  */
 
 import * as fs from "node:fs/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { isEnoent, logger } from "@sayknow-cli/utils";
 import * as git from "../../../utils/git";
+import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../../../web/insane/url-guard";
 
 import type { MarketplaceCatalog, MarketplaceSourceType } from "./types";
 import { isValidNameSegment } from "./types";
@@ -194,6 +198,192 @@ export function parseMarketplaceCatalog(content: string, filePath: string): Mark
 
 /** Relative path from a marketplace root to its catalog file. */
 const CATALOG_RELATIVE_PATH = path.join(".claude-plugin", "marketplace.json");
+const URL_FETCH_TIMEOUT_MS = 60_000;
+const URL_FETCH_MAX_REDIRECTS = 5;
+const URL_FETCH_MAX_HEADER_BYTES = 16 * 1024;
+/** Direct JSON catalogs are metadata; 2 MiB leaves ample room without permitting unbounded buffering. */
+const URL_FETCH_MAX_BYTES = 2 * 1024 * 1024;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+function withAbortSignal<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+	if (signal.aborted) return Promise.reject(signal.reason);
+	const deferred = Promise.withResolvers<T>();
+	const abort = () => deferred.reject(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	operation.then(deferred.resolve, deferred.reject).finally(() => signal.removeEventListener("abort", abort));
+	return deferred.promise;
+}
+
+function normalizePeerAddress(address: string): string {
+	const normalized = address.toLowerCase();
+	return normalized.startsWith("::ffff:") ? normalized.slice(7) : normalized;
+}
+
+function normalizeUrlHostname(hostname: string): string {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+
+async function validateCatalogUrl(rawUrl: string, signal: AbortSignal) {
+	const url = new URL(rawUrl);
+	const hostname = normalizeUrlHostname(url.hostname);
+	// URL.hostname retains IPv6 brackets in Node/Bun, while net.isIP expects the bare literal.
+	if (net.isIP(hostname) === 6) {
+		if (url.protocol !== "http:" && url.protocol !== "https:")
+			return { ok: false as const, reason: `unsupported scheme ${url.protocol}` };
+		if (url.username || url.password) return { ok: false as const, reason: "URL credentials are not allowed" };
+		if (isPrivateOrSpecialAddress(hostname))
+			return { ok: false as const, reason: "private, loopback, link-local, or reserved IP literal" };
+		return { ok: true as const, url, addresses: [hostname] };
+	}
+	return withAbortSignal(validatePublicHttpUrl(rawUrl), signal);
+}
+
+function openCatalogResponse(url: URL, addresses: string[], signal: AbortSignal): Promise<http.IncomingMessage> {
+	const hostname = normalizeUrlHostname(url.hostname);
+	const approved = addresses.map(address => ({ address, family: net.isIP(address) }));
+	const approvedPeers = new Set(approved.map(record => normalizePeerAddress(record.address)));
+	const lookup: net.LookupFunction = (requestedHostname, options, callback) => {
+		const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : (options.family ?? 0);
+		const matching = approved.filter(record => requestedFamily === 0 || record.family === requestedFamily);
+		if (normalizeUrlHostname(requestedHostname) !== hostname || matching.length === 0) {
+			const error = Object.assign(new Error("No approved address for marketplace host"), { code: "ENOTFOUND" });
+			callback(error, options.all ? [] : "", 0);
+			return;
+		}
+		if (options.all) callback(null, matching);
+		else callback(null, matching[0].address, matching[0].family);
+	};
+	const deferred = Promise.withResolvers<http.IncomingMessage>();
+	const options: https.RequestOptions = {
+		protocol: url.protocol,
+		hostname,
+		port: url.port || undefined,
+		path: `${url.pathname}${url.search}`,
+		method: "GET",
+		headers: { Accept: "application/json", "Accept-Encoding": "identity", Connection: "close", Host: url.host },
+		agent: false,
+		insecureHTTPParser: false,
+		lookup,
+		maxHeaderSize: URL_FETCH_MAX_HEADER_BYTES,
+		signal,
+		...(url.protocol === "https:"
+			? { rejectUnauthorized: true, servername: net.isIP(hostname) === 0 ? hostname : undefined }
+			: {}),
+	};
+	const requestFn = url.protocol === "https:" ? https.request : http.request;
+	const request = requestFn(options, response => {
+		const peer = response.socket.remoteAddress;
+		if (!peer || isPrivateOrSpecialAddress(peer) || !approvedPeers.has(normalizePeerAddress(peer))) {
+			response.destroy();
+			deferred.reject(
+				new Error(`Refusing marketplace catalog response from unapproved connected peer ${peer ?? "unknown"}`),
+			);
+			return;
+		}
+		deferred.resolve(response);
+	});
+	request.once("error", deferred.reject);
+	const abort = () => {
+		request.destroy(signal.reason);
+		deferred.reject(signal.reason);
+	};
+	if (signal.aborted) abort();
+	else signal.addEventListener("abort", abort, { once: true });
+	request.once("close", () => signal.removeEventListener("abort", abort));
+	request.end();
+	return deferred.promise;
+}
+
+async function readCatalogResponse(
+	response: http.IncomingMessage,
+	source: string,
+	signal: AbortSignal,
+): Promise<string> {
+	const rawContentLengths: string[] = [];
+	let hasTransferEncoding = false;
+	for (let index = 0; index < response.rawHeaders.length; index += 2) {
+		const name = response.rawHeaders[index]?.toLowerCase();
+		if (name === "content-length") rawContentLengths.push(response.rawHeaders[index + 1] ?? "");
+		if (name === "transfer-encoding") hasTransferEncoding = true;
+	}
+	if (rawContentLengths.length > 1 || (rawContentLengths.length > 0 && hasTransferEncoding)) {
+		response.destroy();
+		throw new Error(`Marketplace catalog from ${source} has ambiguous response framing`);
+	}
+	const contentLength = response.headers["content-length"];
+	if (contentLength !== undefined) {
+		const declaredBytes =
+			typeof contentLength === "string" && /^\d+$/.test(contentLength) ? Number(contentLength) : NaN;
+		if (!Number.isSafeInteger(declaredBytes)) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} has an invalid Content-Length`);
+		}
+		if (declaredBytes > URL_FETCH_MAX_BYTES) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+		}
+	}
+
+	const abort = () => response.destroy(signal.reason);
+	if (signal.aborted) {
+		abort();
+		throw signal.reason;
+	}
+	signal.addEventListener("abort", abort, { once: true });
+	const chunks: Buffer[] = [];
+	let receivedBytes = 0;
+	try {
+		for await (const chunk of response) {
+			const bytes = Buffer.from(chunk);
+			receivedBytes += bytes.byteLength;
+			if (receivedBytes > URL_FETCH_MAX_BYTES) {
+				response.destroy();
+				throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+			}
+			chunks.push(bytes);
+		}
+		return Buffer.concat(chunks, receivedBytes).toString("utf8");
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+
+async function fetchMarketplaceCatalogUrl(source: string): Promise<string> {
+	const deadline = AbortSignal.timeout(URL_FETCH_TIMEOUT_MS);
+	let currentUrl = source;
+	try {
+		for (let redirectCount = 0; ; redirectCount++) {
+			const guard = await validateCatalogUrl(currentUrl, deadline);
+			if (!guard.ok) {
+				throw new Error(`Refusing marketplace catalog URL: target URL is not public HTTP(S): ${guard.reason}`);
+			}
+			const response = await openCatalogResponse(guard.url, guard.addresses, deadline);
+			const status = response.statusCode ?? 0;
+			if (REDIRECT_STATUSES.has(status)) {
+				if (redirectCount >= URL_FETCH_MAX_REDIRECTS) {
+					response.destroy();
+					throw new Error(`Too many redirects fetching marketplace catalog from ${source}`);
+				}
+				const location = response.headers.location;
+				response.destroy();
+				if (!location)
+					throw new Error(`Marketplace catalog redirect from ${currentUrl} is missing a Location header`);
+				currentUrl = new URL(location, guard.url).toString();
+				continue;
+			}
+			if (status < 200 || status >= 300) {
+				response.destroy();
+				throw new Error(
+					`Failed to fetch marketplace catalog from ${currentUrl}: HTTP ${status} ${response.statusMessage ?? ""}`,
+				);
+			}
+			return await readCatalogResponse(response, currentUrl, deadline);
+		}
+	} catch (err) {
+		if (deadline.aborted) throw new Error(`Timed out fetching marketplace catalog from ${source}`);
+		throw err;
+	}
+}
 
 /**
  * Expand a `~/...` path to an absolute path using os.homedir().
@@ -249,13 +439,7 @@ export async function fetchMarketplace(source: string, cacheDir: string): Promis
 	}
 
 	// type === "url"
-	const response = await fetch(source, { signal: AbortSignal.timeout(60_000) });
-	if (!response.ok) {
-		throw new Error(
-			`Failed to fetch marketplace catalog from ${source}: HTTP ${response.status} ${response.statusText}`,
-		);
-	}
-	const text = await response.text();
+	const text = await fetchMarketplaceCatalogUrl(source);
 	const catalog = parseMarketplaceCatalog(text, source);
 
 	const catalogDir = path.join(cacheDir, catalog.name);

package/src/extensibility/shared-events.ts

@@ -38,6 +38,9 @@ export interface SessionBeforeSwitchEvent {
 	targetSessionFile?: string;
 }
 
+/** Origin used when an interactive session selector resumes a session. */
+export const INTERACTIVE_SELECTOR_RESUME_ORIGIN = "interactive_selector_resume";
+
 /** Fired after switching to another session */
 export interface SessionSwitchEvent {
 	type: "session_switch";
@@ -45,6 +48,8 @@ export interface SessionSwitchEvent {
 	reason: "new" | "resume" | "fork";
 	/** Session file we came from */
 	previousSessionFile: string | undefined;
+	/** Optional provenance for this session transition. */
+	transition?: { origin: string };
 }
 
 /** Fired before branching a session (can be cancelled) */

package/src/extensibility/skc-plugins/runtime-adapters.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { bindPluginMcpToPublicNetwork } from "../../runtime-mcp/plugin-network-boundary";
 import { loadCustomTools } from "../custom-tools/loader";
 import type { CustomTool } from "../custom-tools/types";
 import { loadEffectiveSkcPluginRegistry, registryPathForScope } from "./registry";
@@ -330,7 +331,7 @@ export async function buildPluginMcpConfigs(input: { cwd: string }): Promise<{
 					// resolution path expands ${env:...}/shell templates, which would let
 					// a third-party bundle exfiltrate host secrets. Plugin-bundle MCP
 					// servers connect without bundle-declared headers.
-					configs[m.name] = { type: cfg.transport, url: cfg.url };
+					configs[m.name] = bindPluginMcpToPublicNetwork({ type: cfg.transport, url: url.toString() });
 				}
 			} catch (error) {
 				quarantine.push({

package/src/hooks/native-skill-hook.ts

@@ -1,6 +1,6 @@
 import { appendFile, mkdir, stat } from "node:fs/promises";
-import * as os from "node:os";
 import * as path from "node:path";
+import { getAgentDir, getConfigDirName } from "@sayknow-cli/utils";
 import { YAML } from "bun";
 import type { SkillDiscoverySettings } from "../config/skill-settings-defaults";
 import { DEFAULT_DISABLED_EXTENSIONS, DEFAULT_SKILL_DISCOVERY_SETTINGS } from "../config/skill-settings-defaults";
@@ -153,11 +153,24 @@ async function readRawConfig(filePath: string): Promise<Record<string, unknown>
 	}
 }
 
+/**
+ * Config files that decide skill discovery, resolved through the trusted helpers.
+ *
+ * These paths pick the `config.yml` whose `skills.customDirectories` the agent
+ * then loads skills from, so the directory they are built from is a trust
+ * boundary. Bun loads `cwd/.env` into `process.env` before any module runs, so
+ * reading `SKC_CODING_AGENT_DIR` / `SKC_CONFIG_DIR` directly let a repository
+ * point this at a directory it ships and inject its own skill directories.
+ *
+ * `getAgentDir()` and `getConfigDirName()` apply the escalation guards that
+ * already exist for exactly this (`trustedAgentDirOverride`,
+ * `trustedConfigDirName`), and resolve to the same locations this used to build
+ * by hand: `dirs.agentDir` is `path.join(os.homedir(), getConfigDirName(), "agent")`
+ * when no trusted override is present.
+ */
 function resolveConfigPaths(cwd: string, override?: string[]): string[] {
 	if (override) return override;
-	const configDirName = process.env.SKC_CONFIG_DIR ?? process.env.PI_CONFIG_DIR ?? ".skc";
-	const userAgentDir = process.env.SKC_CODING_AGENT_DIR ?? path.join(os.homedir(), configDirName, "agent");
-	return [path.join(userAgentDir, "config.yml"), path.join(cwd, configDirName, "config.yml")];
+	return [path.join(getAgentDir(), "config.yml"), path.join(cwd, getConfigDirName(), "config.yml")];
 }
 
 async function resolveEffectiveSkillConfig(