@sleep2agi/commhub-server 0.9.0-preview.2 → 0.9.0-preview.21

package/src/shared/probe-host-allowlist.ts

@@ -0,0 +1,128 @@
+// RFC-028 P1 §4.4 — shared probe SSRF guards.
+// Host allowlist + private IP block + validateBaseUrl.
+//
+// MUST be byte-identical between hub (server/src/shared/) and daemon
+// (agent-node/src/shared/). Enforced by probe-host-allowlist-drift.test.ts
+// (same pattern as reserved-env.ts G9 drift guard, RFC-026 §4.4.7).
+//
+// Why mirror not symlink: hub and daemon are separate npm packages
+// installed independently on different machines. A drift-checked source
+// copy survives `npm pack` + global install; a symlink does not.
+//
+// Threat model the daemon re-check defends against:
+//   - Compromised hub records a malicious base_url in providers/spec
+//   - Hub bypassed validateBaseUrl (regression / different code path)
+//   - On-wire injection between hub→daemon SSE
+// Daemon trusts process.execPath + this file's content, NOT what
+// `get_probe_request` claims. If hub-side check is identical, daemon
+// re-check is a no-op; if hub-side ever loosens, daemon stays strict.
+
+export class ProbeValidationError extends Error {
+  constructor(public code: string, public detail?: Record<string, unknown>) {
+    super(`${code}${detail ? ` ${JSON.stringify(detail)}` : ""}`);
+    this.name = "ProbeValidationError";
+  }
+}
+
+// ── §4.4.1 per-vendor host allowlist ──────────────────────────────
+// `anthropic` vendor accepts Anthropic + curated 3rd-party Anthropic-
+// compatible endpoints that Vincent / N站马 ship live providers
+// against (DeepSeek + MiniMax both expose `/v1/messages` with the
+// Anthropic protocol surface). Whitelist semantics preserved — NOT
+// allow-any. New entries land here via PR with security review
+// (network-admin-configurable allowlist is backlog: needs strong
+// IP-range / shape guard before admins can edit).
+//
+// Per 通信龙 (RFC-028 P1.5+): the host whitelist is defense layer 1;
+// layer 2 is the DNS-resolved IP block (FORBIDDEN_IPV{4,6}_RE below),
+// applied AFTER allowlist passes. Any new host gets BOTH layers
+// automatically — host in allowlist + DNS resolves to private/metadata
+// IP still surfaces `probe_resolve_unsafe_ip`.
+//
+// P2 will add vendors (openai/zai/openrouter/qwen) as separate keys.
+export const VENDOR_HOST_ALLOWLIST: Record<string, ReadonlyArray<RegExp>> = {
+  anthropic:  [
+    /^api\.anthropic\.com$/,
+    /^api\.deepseek\.com$/,     // Anthropic-compatible /v1/messages
+    /^api\.minimax\.chat$/,     // MiniMax legacy domain
+    /^api\.minimax\.io$/,       // MiniMax new domain (Vincent live use)
+  ],
+  // P2:
+  // openai:     [/^api\.openai\.com$/],
+  // zai:        [/^api\.z\.ai$/, /^open\.bigmodel\.cn$/],
+  // openrouter: [/^openrouter\.ai$/],
+  // qwen:       [/^dashscope(-intl)?\.aliyuncs\.com$/],
+};
+export const SUPPORTED_VENDORS = Object.keys(VENDOR_HOST_ALLOWLIST);
+
+// ── §4.4.2 private/reserved IP block (anti SSRF) ──────────────────
+export const FORBIDDEN_IPV4_RE: ReadonlyArray<RegExp> = [
+  /^10\./,
+  /^127\./,
+  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
+  /^192\.168\./,
+  /^169\.254\./,           // link-local + 169.254.169.254 cloud metadata
+  /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./,  // CGNAT
+  /^0\./,
+  /^22[4-9]\./, /^23[0-9]\./,  // multicast
+  /^24[0-9]\./, /^25[0-5]\./,  // experimental
+];
+export const FORBIDDEN_IPV6_RE: ReadonlyArray<RegExp> = [
+  /^::1$/,
+  /^::$/,
+  /^fe80:/i, /^fc00:/i, /^fd00:/i,
+];
+
+export function isLoopbackHost(host: string): boolean {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+
+export function isForbiddenIp(ip: string): boolean {
+  // IPv4-mapped IPv6: ::ffff:10.0.0.1 — recurse on inner v4
+  if (ip.toLowerCase().startsWith("::ffff:")) {
+    return isForbiddenIp(ip.slice(7));
+  }
+  // Simple v4/v6 distinction by presence of '.' / ':'
+  if (ip.includes(":") && !ip.includes(".")) {
+    return FORBIDDEN_IPV6_RE.some(re => re.test(ip));
+  }
+  return FORBIDDEN_IPV4_RE.some(re => re.test(ip));
+}
+
+// ── §4.4.3 validateBaseUrl — boot/pre-fetch URL+host+vendor check ─
+/** Pure, no I/O. Called by hub (upsert_provider write path) AND
+ *  daemon (handleProbeDoorbell re-check after get_probe_request).
+ *  allowLoopback: dev-only opt-in honoring http://localhost / 127.0.0.1.
+ *  Production daemon MUST NOT set allowLoopback=true. */
+export function validateBaseUrl(
+  vendor: string,
+  baseUrl: string,
+  opts: { allowLoopback?: boolean } = {},
+): void {
+  let u: URL;
+  try { u = new URL(baseUrl); }
+  catch {
+    throw new ProbeValidationError("probe_base_url_invalid", {
+      reason: "not a valid URL", baseUrl: baseUrl.slice(0, 100),
+    });
+  }
+
+  if (u.protocol !== "https:") {
+    if (!opts.allowLoopback || !isLoopbackHost(u.hostname) || u.protocol !== "http:") {
+      throw new ProbeValidationError("probe_base_url_invalid", {
+        reason: "must be https (or http+loopback with dev opt-in)",
+      });
+    }
+  }
+  const allowed = VENDOR_HOST_ALLOWLIST[vendor];
+  if (!allowed) {
+    throw new ProbeValidationError("vendor_not_supported", {
+      vendor, supported: SUPPORTED_VENDORS,
+    });
+  }
+  if (!allowed.some(re => re.test(u.hostname))) {
+    throw new ProbeValidationError("probe_target_forbidden", {
+      vendor, host: u.hostname, allowed: allowed.map(r => r.source),
+    });
+  }
+}

package/src/shared/reserved-env-drift.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  RESERVED_ENV_KEYS_EXACT as HUB_EXACT,
+  RESERVED_ENV_PREFIXES as HUB_PREFIXES,
+} from "./reserved-env.js";
+
+// RFC-026 v4 §4.4.7 G9 drift guard — denylist MUST be hub-and-daemon
+// identical, or attacker walks the looser layer. Two enforcement modes:
+//
+//   1. byte-identical source files (this test)
+//   2. runtime set-equality of the imported constants
+//
+// We assert both. If a future contributor edits one side without the
+// other, this test breaks the merge.
+
+const HUB_PATH = join(import.meta.dir, "reserved-env.ts");
+const DAEMON_PATH = join(import.meta.dir, "..", "..", "..", "agent-node", "src", "shared", "reserved-env.ts");
+
+describe("RFC-026 v4 §4.4.7 G9 — hub/daemon reserved-env drift guard", () => {
+  test("byte-identical source files", () => {
+    const hub = readFileSync(HUB_PATH, "utf-8");
+    const daemon = readFileSync(DAEMON_PATH, "utf-8");
+    expect(daemon).toBe(hub);
+  });
+
+  test("imported constants are set-equal at runtime", async () => {
+    // Use a dynamic file import path so this test breaks if the file
+    // moves but still references the daemon copy.
+    const daemonMod = await import(DAEMON_PATH);
+    const daemonExact = daemonMod.RESERVED_ENV_KEYS_EXACT as Set<string>;
+    const daemonPrefixes = daemonMod.RESERVED_ENV_PREFIXES as ReadonlyArray<string>;
+
+    // EXACT set equality
+    expect(daemonExact.size).toBe(HUB_EXACT.size);
+    for (const k of HUB_EXACT) expect(daemonExact.has(k)).toBe(true);
+    for (const k of daemonExact) expect(HUB_EXACT.has(k)).toBe(true);
+
+    // PREFIX array order-independent equality
+    expect(new Set(daemonPrefixes)).toEqual(new Set(HUB_PREFIXES));
+  });
+});

package/src/shared/reserved-env.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { RESERVED_ENV_KEYS_EXACT, RESERVED_ENV_PREFIXES, isReservedEnvKey } from "./reserved-env.js";
+
+describe("RFC-026 v4 §4.4.7 reserved env denylist (B1)", () => {
+  test("exact PATH/HOME/LANG/NODE_OPTIONS blocked", () => {
+    for (const k of ["PATH", "HOME", "LANG", "LC_ALL", "SHELL", "USER", "LOGNAME", "NODE_OPTIONS", "IFS", "TMPDIR"]) {
+      expect(isReservedEnvKey(k)).toBe(true);
+    }
+  });
+  test("LD_ prefix family blocked (Linux dynamic loader)", () => {
+    for (const k of ["LD_PRELOAD", "LD_LIBRARY_PATH", "LD_AUDIT", "LD_"]) {
+      expect(isReservedEnvKey(k)).toBe(true);
+    }
+  });
+  test("DYLD_ prefix blocked (macOS)", () => {
+    expect(isReservedEnvKey("DYLD_INSERT_LIBRARIES")).toBe(true);
+    expect(isReservedEnvKey("DYLD_LIBRARY_PATH")).toBe(true);
+  });
+  test("BUN_/NPM_/NPM_CONFIG_/NODE_ prefix blocked", () => {
+    expect(isReservedEnvKey("BUN_INSTALL")).toBe(true);
+    expect(isReservedEnvKey("NPM_TOKEN")).toBe(true);
+    expect(isReservedEnvKey("NPM_CONFIG_REGISTRY")).toBe(true);
+    expect(isReservedEnvKey("NODE_PATH")).toBe(true);
+    expect(isReservedEnvKey("NODE_TLS_REJECT_UNAUTHORIZED")).toBe(true);
+  });
+  test("legitimate API key style is NOT blocked", () => {
+    for (const k of ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "TELEGRAM_BOT_TOKEN", "DEEPSEEK_API_KEY", "MY_APP_CONFIG"]) {
+      expect(isReservedEnvKey(k)).toBe(false);
+    }
+  });
+  test("set shape sanity — both EXACT and PREFIX non-empty + frozen-ish", () => {
+    expect(RESERVED_ENV_KEYS_EXACT.size).toBeGreaterThan(10);
+    expect(RESERVED_ENV_PREFIXES.length).toBeGreaterThan(3);
+  });
+});

package/src/shared/reserved-env.ts

@@ -0,0 +1,31 @@
+// RFC-026 v4 §4.4.7 B1 — reserved env-key denylist (single source of
+// truth for hub + daemon).
+//
+// Scope: env_refs naming a system/process-model sensitive key (PATH /
+// LD_PRELOAD / NODE_OPTIONS / BUN_* / NPM_* / ...) MUST be rejected
+// before the secret value ever reaches fork(), because such a key in
+// the child env is effectively arbitrary code execution.
+//
+// G9 (drift guard): this module is the ONE source. Daemon-side runtime
+// imports the same constants. A divergence between hub and daemon would
+// let attacker target the looser layer; CI test asserts set equality.
+
+export const RESERVED_ENV_KEYS_EXACT = new Set<string>([
+  "PATH", "HOME", "LANG", "LC_ALL", "SHELL", "USER", "LOGNAME",
+  "NODE_OPTIONS", "IFS", "PS1", "PS4", "ENV", "BASH_ENV",
+  "CDPATH", "PROMPT_COMMAND", "TMPDIR",
+]);
+
+// Prefix-match denied. Order matters only for clarity (LD_ catches
+// LD_PRELOAD / LD_LIBRARY_PATH / LD_AUDIT; DYLD_ catches DYLD_INSERT_
+// LIBRARIES; BUN_ / NPM_ / NPM_CONFIG_ / NODE_ catch ecosystem-level
+// runtime config).
+export const RESERVED_ENV_PREFIXES: ReadonlyArray<string> = [
+  "LD_", "DYLD_", "BUN_", "NPM_", "NPM_CONFIG_", "NODE_",
+];
+
+export function isReservedEnvKey(k: string): boolean {
+  if (RESERVED_ENV_KEYS_EXACT.has(k)) return true;
+  for (const p of RESERVED_ENV_PREFIXES) if (k.startsWith(p)) return true;
+  return false;
+}