@theokit/agents 9.1.0 → 9.1.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @theokit/agents
 
+## 9.1.1
+
+### Patch Changes
+
+- **`readSecureJson` passa a recusar um store que outro usuario local pode ESCREVER.**
+
+  `ensureSecureDir` segurava o diretorio em owner-only e a leitura entao abria o arquivo sem olhar o
+  modo dele. Um `hook-approvals.json` deixado group- ou world-writable — por uma versao antiga, por um
+  umask ruim, por quem tivesse acesso de escrita — era lido como autoritativo. Esse arquivo decide
+  quais linhas de comando chegam ao `spawn(cmd, { shell: true })`.
+
+  Falha FECHADA e reporta, em vez de lancar: um store ilegivel ja significa "nada aprovado", o turno
+  do chamador nao deve terminar por causa disso, e `lastReadError` e como o operador descobre que as
+  aprovacoes dele pararam de valer. Silencio tornaria um store adulterado indistinguivel de um vazio.
+
+  Recusado em vez de reparado: apertar o modo em silencio esconderia que algo o mudou, que e o fato
+  que importa saber.
+
+  Achado por um teste do consumidor (B-019) falhando enquanto ele migrava para este helper.
+
 ## 9.1.0
 
 ### Minor Changes

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";

package/dist/{chunk-AJIQS3WB.js → chunk-QXGSF6WX.js}

@@ -34,6 +34,13 @@ function readSecureJson(filePath, parse, empty) {
       value: empty
     };
   }
+  const fileMode = statSync(filePath).mode & 511;
+  if ((fileMode & FORBIDDEN_WRITE_BITS) !== 0) {
+    return {
+      value: empty,
+      error: new Error(`${filePath} is mode ${fileMode.toString(8)} \u2014 group or world writable, so another local user can decide what it says. It is being treated as empty: every entry in it has stopped applying. Fix with \`chmod 600 ${filePath}\`.`)
+    };
+  }
   if (raw.trim().length === 0) return {
     value: empty
   };
@@ -70,4 +77,4 @@ export {
   readSecureJson,
   writeSecureJson
 };
-//# sourceMappingURL=chunk-AJIQS3WB.js.map
+//# sourceMappingURL=chunk-QXGSF6WX.js.map

package/dist/chunk-QXGSF6WX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAUA,QAAMI,WAAWX,SAASN,QAAAA,EAAUK,OAAO;AAC3C,OAAKY,WAAWrB,0BAA0B,GAAG;AAC3C,WAAO;MACLoB,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,YAAoBiB,SAASP,SAAS,CAAA,CAAA,8KAEGV,QAAAA,KAAa;IAE7D;EACF;AAGA,MAAIc,IAAIK,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEJ,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASO,OAAO;AACd,WAAO;MACLL,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,kIACiDqB,iBAAiBZ,QAAQY,MAAMC,UAAUC,OAAOF,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AAhDgBV;AAiET,SAASa,YAAYxB,UAAgB;AAC1C,SAAOyB,KAAKvB,QAAQF,QAAAA,GAAW,IAAI0B,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB3B,UAAkB4B,WAAuB;AACvE7B,kBAAgBC,QAAAA;AAChB,QAAM6B,MAAML,YAAYxB,QAAAA;AAExB8B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQ1B,MAAMP;EAAU,CAAA;AAEpEkC,aAAWH,KAAK7B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB6B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","fileMode","error","trim","length","cause","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}

package/dist/config.js

@@ -1,6 +1,6 @@
 import {
   ensureSecureDir
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";

package/dist/hooks.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   hooksPlugin,
   inheritHooks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "9.1.0",
+  "version": "9.1.1",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "license": "Apache-2.0",
   "type": "module",

package/dist/chunk-AJIQS3WB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAGA,MAAIC,IAAIG,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEF,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASK,OAAO;AACd,WAAO;MACLH,OAAOH;MACPO,OAAO,IAAIX,MACT,GAAGT,QAAAA,kIACiDmB,iBAAiBV,QAAQU,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AA5BgBR;AA6CT,SAASY,YAAYvB,UAAgB;AAC1C,SAAOwB,KAAKtB,QAAQF,QAAAA,GAAW,IAAIyB,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB1B,UAAkB2B,WAAuB;AACvE5B,kBAAgBC,QAAAA;AAChB,QAAM4B,MAAML,YAAYvB,QAAAA;AAExB6B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQzB,MAAMP;EAAU,CAAA;AAEpEiC,aAAWH,KAAK5B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB4B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","trim","length","cause","error","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}