@vellumai/assistant 0.7.1 → 0.7.2

package/src/runtime/migrations/__tests__/vbundle-symlink-tar.test.ts

@@ -0,0 +1,437 @@
+/**
+ * In-memory tar emit / parse / validate coverage for the typeflag-2 symlink
+ * entry shape introduced in the vbundle-symlinks plan (PR 2).
+ *
+ * These tests exercise the round-trip through `buildVBundle` →
+ * `validateVBundle` plus three negative paths: traversal rejection, a
+ * tampered `link_target` field, and a tampered `sha256` digest.
+ */
+
+import { createHash, randomUUID } from "node:crypto";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { describe, expect, test } from "bun:test";
+
+import { buildVBundle } from "../vbundle-builder.js";
+import {
+  canonicalizeJson,
+  computeManifestChecksum,
+  validateVBundle,
+} from "../vbundle-validator.js";
+import { defaultV1Options } from "./v1-test-helpers.js";
+
+function sha256Hex(data: Uint8Array | string): string {
+  return createHash("sha256").update(data).digest("hex");
+}
+
+/**
+ * Decode the manifest from a built archive, run the supplied mutator, recompute
+ * the manifest checksum, and rebuild the archive. Mirrors the
+ * `dropFromManifestAndRepack` pattern from `vbundle-streaming-importer.test.ts`.
+ *
+ * Assumes the manifest is the first tar entry and has no PAX prefix.
+ */
+function mutateManifestAndRepack(
+  archive: Uint8Array,
+  mutate: (
+    contents: Array<{
+      path: string;
+      sha256: string;
+      size_bytes: number;
+      link_target?: string;
+    }>,
+  ) => void,
+): Uint8Array {
+  const raw = gunzipSync(archive);
+  const sizeStr = new TextDecoder()
+    .decode(raw.subarray(124, 136))
+    .replace(/\0.*$/, "")
+    .trim();
+  const origSize = parseInt(sizeStr, 8);
+  const manifestJson = new TextDecoder().decode(
+    raw.subarray(512, 512 + origSize),
+  );
+  const manifest = JSON.parse(manifestJson) as {
+    contents: Array<{
+      path: string;
+      sha256: string;
+      size_bytes: number;
+      link_target?: string;
+    }>;
+    checksum: string;
+    [k: string]: unknown;
+  };
+
+  mutate(manifest.contents);
+
+  // Recompute the v1 checksum: empty-string placeholder, then canonicalize.
+  const withEmptyChecksum: Record<string, unknown> = {
+    ...manifest,
+    checksum: "",
+  };
+  manifest.checksum = sha256Hex(canonicalizeJson(withEmptyChecksum));
+
+  const newJson = JSON.stringify(manifest);
+  const newBytes = new TextEncoder().encode(newJson);
+
+  const header = new Uint8Array(512);
+  header.set(raw.subarray(0, 512), 0);
+  const newSizeOctal = newBytes.length.toString(8).padStart(11, "0");
+  for (let i = 0; i < 11; i++) {
+    header[124 + i] = newSizeOctal.charCodeAt(i);
+  }
+  header[135] = 0;
+  for (let i = 148; i < 156; i++) header[i] = 0x20;
+  let sum = 0;
+  for (let i = 0; i < 512; i++) sum += header[i];
+  const cksum = sum.toString(8).padStart(6, "0");
+  for (let i = 0; i < 6; i++) header[148 + i] = cksum.charCodeAt(i);
+  header[154] = 0;
+  header[155] = 0x20;
+
+  const oldPaddedLen = 512 + Math.ceil(origSize / 512) * 512;
+  const newPadded = Math.ceil(newBytes.length / 512) * 512;
+  const out = new Uint8Array(
+    header.length + newPadded + (raw.length - oldPaddedLen),
+  );
+  out.set(header, 0);
+  out.set(newBytes, 512);
+  out.set(raw.subarray(oldPaddedLen), 512 + newPadded);
+  return gzipSync(out);
+}
+
+describe("vbundle symlink tar — emit / parse / validate", () => {
+  test("round-trip: regular files and a typeflag-2 symlink validate cleanly", () => {
+    const files = [
+      {
+        path: "workspace/skills/bar.md",
+        data: new TextEncoder().encode("hello"),
+      },
+      {
+        path: "workspace/skills/foo.md",
+        data: new Uint8Array(0),
+        linkTarget: "bar.md",
+      },
+      {
+        path: "workspace/data/db/assistant.db",
+        data: new TextEncoder().encode("db-bytes"),
+      },
+    ];
+
+    const { archive, manifest } = buildVBundle({
+      files,
+      ...defaultV1Options(),
+    });
+    const result = validateVBundle(archive);
+
+    expect(result.is_valid).toBe(true);
+    expect(result.errors).toEqual([]);
+
+    const symlinkEntry = result.entries!.get("workspace/skills/foo.md");
+    expect(symlinkEntry).toBeDefined();
+    expect(symlinkEntry!.linkname).toBe("bar.md");
+    expect(symlinkEntry!.size).toBe(0);
+
+    const symlinkContent = manifest.contents.find(
+      (c) => c.path === "workspace/skills/foo.md",
+    )!;
+    expect(symlinkContent.link_target).toBe("bar.md");
+    expect(symlinkContent.size_bytes).toBe(0);
+    expect(symlinkContent.sha256).toBe(sha256Hex("bar.md"));
+
+    // Regular file entries should NOT carry a linkname.
+    const regularEntry = result.entries!.get("workspace/skills/bar.md");
+    expect(regularEntry!.linkname).toBeUndefined();
+  });
+
+  test("symlink target that escapes the archive root is rejected", () => {
+    const files = [
+      {
+        path: "workspace/skills/foo.md",
+        data: new Uint8Array(0),
+        linkTarget: "../../../etc/passwd",
+      },
+      {
+        path: "workspace/data/db/assistant.db",
+        data: new TextEncoder().encode("db-bytes"),
+      },
+    ];
+
+    const { archive } = buildVBundle({ files, ...defaultV1Options() });
+    const result = validateVBundle(archive);
+
+    expect(result.is_valid).toBe(false);
+    const traversal = result.errors.find(
+      (e) => e.code === "SYMLINK_TARGET_ESCAPES_ARCHIVE",
+    );
+    expect(traversal).toBeDefined();
+    expect(traversal!.path).toBe("workspace/skills/foo.md");
+  });
+
+  test("absolute symlink target is rejected as escaping the archive root", () => {
+    // An absolute target like "/etc/passwd" is unconstrained by the bundle
+    // root: the prior `posix.normalize(posix.join(dirname, target))` guard
+    // returns "/etc/passwd" unchanged, which does not start with "../" and
+    // would otherwise pass. The validator must catch absolute targets up
+    // front and surface them with the same SYMLINK_TARGET_ESCAPES_ARCHIVE
+    // code as `..`-based escapes.
+    const files = [
+      {
+        path: "workspace/skills/foo.md",
+        data: new Uint8Array(0),
+        linkTarget: "/etc/passwd",
+      },
+      {
+        path: "workspace/data/db/assistant.db",
+        data: new TextEncoder().encode("db-bytes"),
+      },
+    ];
+
+    const { archive } = buildVBundle({ files, ...defaultV1Options() });
+    const result = validateVBundle(archive);
+
+    expect(result.is_valid).toBe(false);
+    const traversal = result.errors.find(
+      (e) => e.code === "SYMLINK_TARGET_ESCAPES_ARCHIVE",
+    );
+    expect(traversal).toBeDefined();
+    expect(traversal!.path).toBe("workspace/skills/foo.md");
+  });
+
+  test("manifest link_target tampered to a different value surfaces LINK_TARGET_MISMATCH", () => {
+    const files = [
+      {
+        path: "workspace/skills/bar.md",
+        data: new TextEncoder().encode("hello"),
+      },
+      {
+        path: "workspace/skills/foo.md",
+        data: new Uint8Array(0),
+        linkTarget: "bar.md",
+      },
+      {
+        path: "workspace/data/db/assistant.db",
+        data: new TextEncoder().encode("db-bytes"),
+      },
+    ];
+
+    const { archive } = buildVBundle({ files, ...defaultV1Options() });
+
+    // Mutate the manifest entry so it points at a different target than the
+    // one carried in the tar header. Recompute sha256 over the new target so
+    // the checksum check passes and we exercise the linkname-mismatch branch.
+    const tampered = mutateManifestAndRepack(archive, (contents) => {
+      const entry = contents.find((c) => c.path === "workspace/skills/foo.md")!;
+      const newTarget = "different.md";
+      entry.link_target = newTarget;
+      entry.sha256 = sha256Hex(newTarget);
+    });
+
+    const result = validateVBundle(tampered);
+    expect(result.is_valid).toBe(false);
+    const mismatch = result.errors.find(
+      (e) => e.code === "LINK_TARGET_MISMATCH",
+    );
+    expect(mismatch).toBeDefined();
+    expect(mismatch!.path).toBe("workspace/skills/foo.md");
+  });
+
+  test("typeflag-2 entry whose tar header declares a non-zero size surfaces FILE_SIZE_MISMATCH", () => {
+    // Hand-craft a bundle so we can violate an invariant the buildVBundle
+    // emit path enforces: a symlink header that lies about its size.
+    //
+    // The validator's downstream check `archiveEntry.size !== 0` only fires
+    // if `parseTar` propagates the tar-declared size for typeflag-2 entries
+    // — not if it forces 0. This regression test pins that contract.
+    //
+    // Layout:
+    //   - manifest.json header + body
+    //   - foo.md symlink header (typeflag '2', linkname=bar.md, size=0o123)
+    //   - end-of-archive (two zero blocks)
+
+    const BLOCK = 512;
+    const enc = new TextEncoder();
+
+    function buildHeader(opts: {
+      name: string;
+      size: number;
+      typeflag: string;
+      linkname?: string;
+    }): Uint8Array {
+      const h = new Uint8Array(BLOCK);
+      const nameBytes = enc.encode(opts.name);
+      h.set(nameBytes.subarray(0, 100), 0);
+      const writeOctal = (off: number, len: number, value: number) => {
+        const s = value.toString(8).padStart(len - 1, "0");
+        for (let i = 0; i < s.length; i++) h[off + i] = s.charCodeAt(i);
+        h[off + len - 1] = 0;
+      };
+      writeOctal(100, 8, 0o644);
+      writeOctal(108, 8, 0);
+      writeOctal(116, 8, 0);
+      writeOctal(124, 12, opts.size);
+      writeOctal(136, 12, Math.floor(Date.now() / 1000));
+      h[156] = opts.typeflag.charCodeAt(0);
+      if (opts.linkname) {
+        const lk = enc.encode(opts.linkname);
+        h.set(lk.subarray(0, 100), 157);
+      }
+      const magic = enc.encode("ustar\0");
+      h.set(magic, 257);
+      h[263] = "0".charCodeAt(0);
+      h[264] = "0".charCodeAt(0);
+      // Checksum field starts as eight spaces per spec
+      for (let i = 148; i < 156; i++) h[i] = 0x20;
+      let sum = 0;
+      for (let i = 0; i < BLOCK; i++) sum += h[i];
+      const cksum = sum.toString(8).padStart(6, "0");
+      for (let i = 0; i < 6; i++) h[148 + i] = cksum.charCodeAt(i);
+      h[154] = 0;
+      h[155] = 0x20;
+      return h;
+    }
+
+    function padBlock(data: Uint8Array): Uint8Array {
+      const rem = data.length % BLOCK;
+      if (rem === 0) return data;
+      const padded = new Uint8Array(data.length + (BLOCK - rem));
+      padded.set(data);
+      return padded;
+    }
+
+    // Build manifest declaring foo.md as a symlink with size_bytes 0,
+    // sha256 over the link target string. That matches what buildVBundle
+    // would emit; the discrepancy lives in the tar header alone.
+    const linkTarget = "bar.md";
+    const symlinkSha = sha256Hex(linkTarget);
+    const manifest = {
+      schema_version: 1,
+      bundle_id: randomUUID(),
+      created_at: new Date().toISOString(),
+      assistant: { id: "self", name: "Test", runtime_version: "0.0.0-test" },
+      origin: { mode: "self-hosted-local" },
+      compatibility: {
+        min_runtime_version: "0.0.0-test",
+        max_runtime_version: null,
+      },
+      contents: [
+        {
+          path: "workspace/skills/foo.md",
+          sha256: symlinkSha,
+          size_bytes: 0,
+          link_target: linkTarget,
+        },
+        {
+          path: "workspace/data/db/assistant.db",
+          sha256: sha256Hex(enc.encode("db-bytes")),
+          size_bytes: 8,
+        },
+      ],
+      checksum: "",
+      secrets_redacted: false,
+      export_options: {
+        include_logs: false,
+        include_browser_state: false,
+        include_memory_vectors: false,
+      },
+    };
+    manifest.checksum = computeManifestChecksum(manifest);
+
+    const manifestBytes = enc.encode(JSON.stringify(manifest));
+    const manifestHeader = buildHeader({
+      name: "manifest.json",
+      size: manifestBytes.length,
+      typeflag: "0",
+    });
+    const manifestPart = new Uint8Array(BLOCK + padBlock(manifestBytes).length);
+    manifestPart.set(manifestHeader, 0);
+    manifestPart.set(padBlock(manifestBytes), BLOCK);
+
+    // Symlink header: declares size=0o123 (= 83 decimal). parseTar must
+    // propagate this 83 so the FILE_SIZE_MISMATCH check fires; if it forces
+    // 0, the bug is silent. We pad one block of zero body bytes after the
+    // header (the `Math.ceil(83/512) = 1` blocks parseTar will skip) so the
+    // following DB entry header lands at the correct block boundary.
+    const symlinkHeader = buildHeader({
+      name: "workspace/skills/foo.md",
+      size: 0o123,
+      typeflag: "2",
+      linkname: linkTarget,
+    });
+    const symlinkBodyPadding = new Uint8Array(BLOCK);
+    const symlinkPart = new Uint8Array(
+      symlinkHeader.length + symlinkBodyPadding.length,
+    );
+    symlinkPart.set(symlinkHeader, 0);
+    symlinkPart.set(symlinkBodyPadding, symlinkHeader.length);
+
+    // Regular file body for the DB entry so the manifest's required-DB
+    // refine is satisfied.
+    const dbBytes = enc.encode("db-bytes");
+    const dbHeader = buildHeader({
+      name: "workspace/data/db/assistant.db",
+      size: dbBytes.length,
+      typeflag: "0",
+    });
+    const dbPart = new Uint8Array(BLOCK + padBlock(dbBytes).length);
+    dbPart.set(dbHeader, 0);
+    dbPart.set(padBlock(dbBytes), BLOCK);
+
+    const eoa = new Uint8Array(BLOCK * 2);
+
+    const total =
+      manifestPart.length + symlinkPart.length + dbPart.length + eoa.length;
+    const tar = new Uint8Array(total);
+    let off = 0;
+    tar.set(manifestPart, off);
+    off += manifestPart.length;
+    tar.set(symlinkPart, off);
+    off += symlinkPart.length;
+    tar.set(dbPart, off);
+    off += dbPart.length;
+    tar.set(eoa, off);
+
+    const archive = gzipSync(tar);
+    const result = validateVBundle(archive);
+
+    expect(result.is_valid).toBe(false);
+    const sizeMismatch = result.errors.find(
+      (e) =>
+        e.code === "FILE_SIZE_MISMATCH" && e.path === "workspace/skills/foo.md",
+    );
+    expect(sizeMismatch).toBeDefined();
+  });
+
+  test("manifest sha256 tampered for a symlink entry surfaces FILE_CHECKSUM_MISMATCH", () => {
+    const files = [
+      {
+        path: "workspace/skills/bar.md",
+        data: new TextEncoder().encode("hello"),
+      },
+      {
+        path: "workspace/skills/foo.md",
+        data: new Uint8Array(0),
+        linkTarget: "bar.md",
+      },
+      {
+        path: "workspace/data/db/assistant.db",
+        data: new TextEncoder().encode("db-bytes"),
+      },
+    ];
+
+    const { archive } = buildVBundle({ files, ...defaultV1Options() });
+
+    const wrongDigest = "0".repeat(64);
+    const tampered = mutateManifestAndRepack(archive, (contents) => {
+      const entry = contents.find((c) => c.path === "workspace/skills/foo.md")!;
+      entry.sha256 = wrongDigest;
+    });
+
+    const result = validateVBundle(tampered);
+    expect(result.is_valid).toBe(false);
+    const checksum = result.errors.find(
+      (e) => e.code === "FILE_CHECKSUM_MISMATCH",
+    );
+    expect(checksum).toBeDefined();
+    expect(checksum!.path).toBe("workspace/skills/foo.md");
+  });
+});