@vellumai/assistant 0.8.9-staging.1 → 0.8.9-staging.2

package/src/acp/auto-install.test.ts

@@ -1,13 +1,19 @@
 /**
- * Tests for the silent ACP adapter auto-installer.
+ * Tests for the sandboxed ACP adapter auto-installer.
  *
  * `execFile` is stubbed via the shared `installExecFileStub` helper: a
  * process-global `mock.module("node:child_process", ...)` driven by per-call
- * scripted responses keyed on `${command} ${args[0]}`. The
- * `resolveAgentWithAutoInstall` ordering suite additionally stubs the ACP
- * config and `Bun.which` so it can flip bun / adapter-binary presence.
+ * scripted responses keyed on `${command} ${args[0]}`. `Bun.which` is stubbed
+ * via `installWhichStub` so each test controls whether `bun` is on PATH and
+ * whether the adapter binary resolves after the install.
+ *
+ * The security-critical assertions live here: the installer must be `bun`
+ * (never `npm`), run in a fresh temp dir (NOT the task cwd), with the ACP
+ * secrets stripped from its env and the registry pinned to the public npm
+ * registry.
  */
 
+import { tmpdir } from "node:os";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { installAcpConfigStub } from "./__tests__/helpers/acp-config-stub.js";
@@ -18,6 +24,11 @@ const { execScripts, execFileMock, reset } = installExecFileStub();
 const config = await installAcpConfigStub();
 const which = installWhichStub();
 
+/** Fixed resolved `bun` path so script keys are predictable. */
+const BUN_BIN = "/usr/local/bin/bun";
+/** Key the exec stub uses for the global install. */
+const BUN_ADD_KEY = `${BUN_BIN} add`;
+
 afterAll(() => {
   which.restore();
 });
@@ -40,31 +51,75 @@ const {
   _resetAdapterInstallCacheForTests,
 } = await import("./auto-install.js");
 
+/** Latest call's execFile options ({ cwd, env, ... }). */
+function lastInstallOptions(): { cwd?: string; env?: NodeJS.ProcessEnv } {
+  const call = execFileMock.mock.calls.at(-1)!;
+  return call[2] as { cwd?: string; env?: NodeJS.ProcessEnv };
+}
+
 beforeEach(() => {
   reset();
   _resetAdapterInstallCacheForTests();
   config.setConfig({ agents: {} });
-  which.setWhich({});
+  // Default: bun on PATH, nothing else.
+  which.setWhich({ bun: BUN_BIN });
 });
 
 describe("ensureAdapterInstalled", () => {
-  test("known command: runs `npm i -g <pkg>` and reports installed", async () => {
-    execScripts.set("npm i", { stdout: "" });
+  test("known command: runs `bun add --global <pkg>` and reports installed", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
 
     const result = await ensureAdapterInstalled("claude-agent-acp");
 
     expect(result).toEqual({ installed: true });
     expect(execFileMock).toHaveBeenCalledTimes(1);
     const [command, args] = execFileMock.mock.calls[0];
-    expect(command).toBe("npm");
+    expect(command).toBe(BUN_BIN);
     expect(args).toEqual([
-      "i",
-      "-g",
+      "add",
+      "--global",
       "@agentclientprotocol/claude-agent-acp",
     ]);
   });
 
-  test("unknown command: never invokes npm (security allowlist)", async () => {
+  test("installer never invokes npm", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    await ensureAdapterInstalled("claude-agent-acp");
+
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
+  });
+
+  test("runs in a fresh temp dir (NOT the task cwd), token-free env, public registry", async () => {
+    // Seed the secrets on the ambient env so we can assert they are stripped.
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "should-not-leak";
+    process.env.GEMINI_API_KEY = "should-not-leak-either";
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
+
+    try {
+      await ensureAdapterInstalled("claude-agent-acp");
+    } finally {
+      delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      delete process.env.GEMINI_API_KEY;
+    }
+
+    const { cwd, env } = lastInstallOptions();
+    // Sandboxed cwd: a temp dir under the OS temp root, never the process cwd.
+    expect(cwd).toBeDefined();
+    expect(cwd!.startsWith(tmpdir())).toBe(true);
+    expect(cwd).not.toBe(process.cwd());
+    expect(cwd).toContain("vellum-acp-install-");
+
+    // Secrets stripped, registry pinned.
+    expect(env).toBeDefined();
+    expect(env!.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(env!.GEMINI_API_KEY).toBeUndefined();
+    expect(env!.BUN_CONFIG_REGISTRY).toBe("https://registry.npmjs.org/");
+  });
+
+  test("unknown command: never invokes a package manager (security allowlist)", async () => {
     const result = await ensureAdapterInstalled("some-arbitrary-binary");
 
     expect(result.installed).toBe(false);
@@ -72,8 +127,18 @@ describe("ensureAdapterInstalled", () => {
     expect(execFileMock).not.toHaveBeenCalled();
   });
 
-  test("npm failure: reports the error and does not install", async () => {
-    execScripts.set("npm i", {
+  test("bun absent: no install attempted, reports not installed", async () => {
+    which.setWhich({}); // bun not on PATH
+
+    const result = await ensureAdapterInstalled("claude-agent-acp");
+
+    expect(result.installed).toBe(false);
+    expect(result.error).toBeUndefined();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  test("install failure: reports the error and does not install", async () => {
+    execScripts.set(BUN_ADD_KEY, {
       error: new Error("EACCES: permission denied"),
     });
 
@@ -84,18 +149,18 @@ describe("ensureAdapterInstalled", () => {
   });
 
   test("failed install is retried on the next call", async () => {
-    execScripts.set("npm i", { error: new Error("network down") });
+    execScripts.set(BUN_ADD_KEY, { error: new Error("network down") });
     const first = await ensureAdapterInstalled("claude-agent-acp");
     expect(first.installed).toBe(false);
 
-    execScripts.set("npm i", { stdout: "" });
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
     const second = await ensureAdapterInstalled("claude-agent-acp");
     expect(second.installed).toBe(true);
     expect(execFileMock).toHaveBeenCalledTimes(2);
   });
 
   test("successful install is cached for the process lifetime", async () => {
-    execScripts.set("npm i", { stdout: "" });
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
 
     await ensureAdapterInstalled("claude-agent-acp");
     await ensureAdapterInstalled("claude-agent-acp");
@@ -103,8 +168,8 @@ describe("ensureAdapterInstalled", () => {
     expect(execFileMock).toHaveBeenCalledTimes(1);
   });
 
-  test("concurrent calls dedupe to exactly one `npm i -g`", async () => {
-    execScripts.set("npm i", { stdout: "" });
+  test("concurrent calls dedupe to exactly one install", async () => {
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
 
     const [a, b, c] = await Promise.all([
       ensureAdapterInstalled("claude-agent-acp"),
@@ -119,7 +184,7 @@ describe("ensureAdapterInstalled", () => {
   });
 
   test("different commands install independently", async () => {
-    execScripts.set("npm i", { stdout: "" });
+    execScripts.set(BUN_ADD_KEY, { stdout: "" });
 
     const [claude, codex] = await Promise.all([
       ensureAdapterInstalled("claude-agent-acp"),
@@ -140,28 +205,16 @@ describe("ensureAdapterInstalled", () => {
 });
 
 describe("resolveAgentWithAutoInstall - resolution order", () => {
-  test("binary missing + bun present: resolves via bunx without invoking npm", async () => {
-    which.setWhich({ bun: "/usr/local/bin/bun" });
-
-    const result = await resolveAgentWithAutoInstall("claude");
-
-    expect(result.resolved.ok).toBe(true);
-    if (!result.resolved.ok) return;
-    expect(result.resolved.agent.command).toBe("bun");
-    expect(result.resolved.agent.adapterCommand).toBe("claude-agent-acp");
-    expect(result.autoInstalledPackage).toBeUndefined();
-    expect(result.failureMessage).toBeUndefined();
-    expect(execFileMock).not.toHaveBeenCalled();
-  });
-
-  test("binary + bun missing, npm install succeeds: falls back to the npm flow", async () => {
+  test("binary missing + bun present: installs then resolves to the real binary", async () => {
     let installed = false;
-    which.setWhich((cmd) =>
-      installed && cmd === "claude-agent-acp"
-        ? "/usr/local/bin/claude-agent-acp"
-        : null,
-    );
-    execScripts.set("npm i", {
+    which.setWhich((cmd) => {
+      if (cmd === "bun") return BUN_BIN;
+      if (cmd === "claude-agent-acp" && installed) {
+        return "/usr/local/bin/claude-agent-acp";
+      }
+      return null;
+    });
+    execScripts.set(BUN_ADD_KEY, {
       stdout: "",
       onCall: () => {
         installed = true;
@@ -172,25 +225,56 @@ describe("resolveAgentWithAutoInstall - resolution order", () => {
 
     expect(result.resolved.ok).toBe(true);
     if (!result.resolved.ok) return;
+    // The resolved command is the REAL binary, not a `bun x` wrapper.
     expect(result.resolved.agent.command).toBe("claude-agent-acp");
     expect(result.autoInstalledPackage).toBe(
       "@agentclientprotocol/claude-agent-acp",
     );
+    expect(result.failureMessage).toBeUndefined();
     expect(execFileMock).toHaveBeenCalledTimes(1);
+    expect(execFileMock.mock.calls[0][0]).toBe(BUN_BIN);
   });
 
-  test("binary, bun, and npm all missing: failure message carries the hint and install error", async () => {
-    execScripts.set("npm i", { error: new Error("spawn npm ENOENT") });
+  test("binary missing + bun absent: no install, plain failure with the hint", async () => {
+    which.setWhich({}); // neither bun nor the adapter on PATH
 
     const result = await resolveAgentWithAutoInstall("claude");
 
     expect(result.resolved.ok).toBe(false);
+    expect(result.autoInstalledPackage).toBeUndefined();
+    // No augmented failure message (the plain binary_not_found hint is
+    // surfaced by the caller via formatResolveFailure).
+    expect(result.failureMessage).toBeUndefined();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  test("install fails: failure message carries the hint and install error, never npm", async () => {
+    which.setWhich({ bun: BUN_BIN });
+    execScripts.set(BUN_ADD_KEY, { error: new Error("network is down") });
+
+    const result = await resolveAgentWithAutoInstall("claude");
+
+    expect(result.resolved.ok).toBe(false);
+    expect(result.failureMessage).toContain("claude-agent-acp is not on PATH");
     expect(result.failureMessage).toContain(
-      "claude-agent-acp is not on PATH",
+      "bun add -g @agentclientprotocol/claude-agent-acp",
     );
-    expect(result.failureMessage).toContain(
-      "npm i -g @agentclientprotocol/claude-agent-acp",
+    expect(result.failureMessage).toContain("network is down");
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
+  });
+
+  test("codex unaffected: already on PATH resolves with no install", async () => {
+    which.setWhich((cmd) =>
+      cmd === "codex-acp" ? "/usr/local/bin/codex-acp" : null,
     );
-    expect(result.failureMessage).toContain("ENOENT");
+
+    const result = await resolveAgentWithAutoInstall("codex");
+
+    expect(result.resolved.ok).toBe(true);
+    if (!result.resolved.ok) return;
+    expect(result.resolved.agent.command).toBe("codex-acp");
+    expect(execFileMock).not.toHaveBeenCalled();
   });
 });

package/src/acp/auto-install.ts

@@ -1,22 +1,35 @@
 /**
- * Silent auto-install for known ACP adapter binaries.
+ * Sandboxed auto-install for known ACP adapter binaries.
  *
- * Fallback path: the resolver (`resolve-agent.ts`) already rewrites missing
- * allowlisted adapters to run via `bun x` when `bun` is on PATH, so
- * `binary_not_found` only reaches this module when bun is absent (or the
- * command has no package mapping). When a spawn does fail preflight with
- * `binary_not_found`, callers (the `acp_spawn` tool and the `/v1/acp/spawn`
- * route) call `resolveAgentWithAutoInstall(agentId)`, which tries a global
- * npm install of the mapped adapter package, then re-resolves and continues.
- * On failure they fall back to the existing actionable install hint.
+ * When a spawn fails preflight with `binary_not_found`, callers (the
+ * `acp_spawn` tool and the `/v1/acp/spawn` route) call
+ * `resolveAgentWithAutoInstall(agentId)`, which performs a ONE-TIME global
+ * install of the mapped adapter package via `bun`, then re-resolves and
+ * continues. After the install the adapter is a normal trusted binary on
+ * PATH, and the session manager spawns it the usual way (project cwd, token
+ * injected only at spawn).
  *
- * Security boundary: only commands present in `DEFAULT_AGENT_NPM_PACKAGES`
- * are ever installed. The package names are vendored constants, NOT user
- * input: an arbitrary command from user config must never be turned into
- * an `npm i -g <attacker-controlled-name>` execution.
+ * Security boundaries (this is the ATL-808 fix):
+ *  - Only commands present in `DEFAULT_AGENT_NPM_PACKAGES` are ever
+ *    installed. The package names are vendored constants, NOT user input.
+ *  - The install runs `bun` with cwd = a FRESH empty daemon-owned temp dir,
+ *    never the untrusted task project dir. A clean cwd has no project-local
+ *    `node_modules/.bin`, `bunfig.toml`, or `.npmrc`, so none of the
+ *    cwd-based package-resolution hijacks apply.
+ *  - The installer env is a SANITIZED copy of `process.env` with
+ *    `CLAUDE_CODE_OAUTH_TOKEN` and `GEMINI_API_KEY` stripped, so the secret
+ *    is never in scope during package resolution, and `BUN_CONFIG_REGISTRY`
+ *    forced to the public npm registry so a redirected registry cannot serve
+ *    a malicious package.
+ *  - The token is injected ONLY later, at spawn time, on the real installed
+ *    binary (see `prepare-agent-env.ts`). `prepareAgentEnv` is never called
+ *    here.
  */
 
 import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
 import { DEFAULT_AGENT_NPM_PACKAGES } from "../config/acp-defaults.js";
 import { getLogger } from "../util/logger.js";
@@ -27,8 +40,15 @@ import {
 
 const log = getLogger("acp:auto-install");
 
-/** Per-install timeout for `npm i -g`. Generous: cold npm caches are slow. */
-const NPM_INSTALL_TIMEOUT_MS = 120_000;
+/** Per-install timeout for the global install. Generous: cold caches are slow. */
+const BUN_INSTALL_TIMEOUT_MS = 120_000;
+
+/**
+ * The trusted public npm registry. Forced via `BUN_CONFIG_REGISTRY` on the
+ * installer env so a stray `.npmrc`/`bunfig.toml` in the ambient environment
+ * cannot redirect package downloads to an attacker-controlled registry.
+ */
+const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
 
 export interface AdapterInstallResult {
   installed: boolean;
@@ -37,21 +57,22 @@ export interface AdapterInstallResult {
 
 /**
  * Per-command install promises. Concurrent spawns for the same missing
- * binary dedupe to a single `npm i -g`; successful results are cached for
+ * binary dedupe to a single global install; successful results are cached for
  * the process lifetime. Failed installs are evicted so a later spawn can
- * retry (e.g. after the user fixes network or npm permissions).
+ * retry (e.g. after the user fixes network or install permissions).
  */
 const installPromises = new Map<string, Promise<AdapterInstallResult>>();
 
 /**
  * Run `execFile` with an AbortController-driven timeout. Returns the stdout
- * on success; throws on error or timeout. Shared by the adapter installer
- * here and the version probes in `tools/acp/spawn.ts`.
+ * on success; throws on error or timeout. The optional `cwd`/`env` let the
+ * installer run in a sandboxed working directory with a sanitized env.
  */
-export function execFileWithTimeout(
+function execFileWithTimeout(
   command: string,
   args: string[],
   timeoutMs: number,
+  options?: { cwd?: string; env?: NodeJS.ProcessEnv },
 ): Promise<string> {
   return new Promise((resolve, reject) => {
     const controller = new AbortController();
@@ -59,7 +80,12 @@ export function execFileWithTimeout(
     execFile(
       command,
       args,
-      { signal: controller.signal, encoding: "utf8" },
+      {
+        signal: controller.signal,
+        encoding: "utf8",
+        cwd: options?.cwd,
+        env: options?.env,
+      },
       (err, stdout) => {
         clearTimeout(timer);
         if (err) {
@@ -73,10 +99,24 @@ export function execFileWithTimeout(
 }
 
 /**
- * Install the npm package mapped to `command` if (and only if) the command
- * is a known adapter binary. Unknown commands resolve to
- * `{ installed: false }` without ever invoking npm (see the security
- * boundary note in the module doc).
+ * A copy of `process.env` safe to hand to the package installer: the ACP
+ * secrets are stripped so they can never leak into a resolved package's
+ * lifecycle/runtime, and the registry is pinned to the trusted public one.
+ */
+function sanitizedInstallEnv(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  delete env.GEMINI_API_KEY;
+  env.BUN_CONFIG_REGISTRY = PUBLIC_NPM_REGISTRY;
+  return env;
+}
+
+/**
+ * Install the npm-registry package mapped to `command` via a sandboxed `bun`
+ * global install, if (and only if) the command is a known adapter binary and
+ * `bun` is on PATH. Unknown commands, or hosts without `bun`, resolve to
+ * `{ installed: false }` without ever invoking a package manager (see the
+ * security boundary note in the module doc).
  */
 export function ensureAdapterInstalled(
   command: string,
@@ -86,10 +126,15 @@ export function ensureAdapterInstalled(
     return Promise.resolve({ installed: false });
   }
 
+  const bunPath = Bun.which("bun");
+  if (!bunPath) {
+    return Promise.resolve({ installed: false });
+  }
+
   const inFlight = installPromises.get(command);
   if (inFlight) return inFlight;
 
-  const promise = runInstall(command, packageName).then((result) => {
+  const promise = runInstall(bunPath, command, packageName).then((result) => {
     if (!result.installed) installPromises.delete(command);
     return result;
   });
@@ -98,15 +143,23 @@ export function ensureAdapterInstalled(
 }
 
 async function runInstall(
+  bunPath: string,
   command: string,
   packageName: string,
 ): Promise<AdapterInstallResult> {
   log.info({ command, packageName }, "Auto-installing missing ACP adapter");
+  // Fresh empty dir guaranteed to have no project-local node_modules,
+  // bunfig.toml, or .npmrc - this neutralizes the cwd-based resolution
+  // hijacks the untrusted task dir would otherwise enable.
+  const installDir = await mkdtemp(join(tmpdir(), "vellum-acp-install-"));
   try {
     await execFileWithTimeout(
-      "npm",
-      ["i", "-g", packageName],
-      NPM_INSTALL_TIMEOUT_MS,
+      bunPath,
+      // `bun add --global` installs AND links the package bin into bun's
+      // global bin dir (on PATH in every image).
+      ["add", "--global", packageName],
+      BUN_INSTALL_TIMEOUT_MS,
+      { cwd: installDir, env: sanitizedInstallEnv() },
     );
     log.info({ command, packageName }, "ACP adapter auto-install succeeded");
     return { installed: true };
@@ -117,17 +170,19 @@ async function runInstall(
       "ACP adapter auto-install failed (falling back to install hint)",
     );
     return { installed: false, error };
+  } finally {
+    await rm(installDir, { recursive: true, force: true }).catch(() => {});
   }
 }
 
 export interface ResolveWithAutoInstallResult {
   /** The final resolver outcome (post-install re-resolve when applicable). */
   resolved: ResolveAcpAgentResult;
-  /** Set when a missing adapter binary was silently installed via npm. */
+  /** Set when a missing adapter binary was silently installed via bun. */
   autoInstalledPackage?: string;
   /**
    * Set when the auto-install itself failed: the original install hint
-   * augmented with the npm failure reason. Callers should surface this
+   * augmented with the install failure reason. Callers should surface this
    * instead of re-deriving a message from `resolved`.
    */
   failureMessage?: string;

package/src/acp/prepare-agent-env.ts

@@ -20,6 +20,8 @@
  * owns the plaintext read boundary.
  */
 
+import { basename } from "node:path";
+
 import { FailedDependencyError } from "../runtime/routes/errors.js";
 import { credentialBroker } from "../tools/credentials/broker.js";
 import {
@@ -27,7 +29,6 @@ import {
   upsertCredentialMetadata,
 } from "../tools/credentials/metadata-store.js";
 import { getLogger } from "../util/logger.js";
-import { adapterCommandOf } from "./resolve-agent.js";
 import type { AcpAgentConfig } from "./types.js";
 
 const log = getLogger("acp:prepare-agent-env");
@@ -98,13 +99,11 @@ async function injectCredential(
  * credential is missing from both the user-supplied env override and the
  * secure store.
  *
- * Gating is keyed off the canonical adapter identity (`adapterCommand` set
- * by the resolver, falling back to the command basename for plain configs),
- * not the user-facing agent id. A custom `acp.agents.my-claude = { command:
- * "claude-agent-acp", ... }` alias still gets the env it needs, and so does
- * the bunx-rewritten claude adapter (whose `command` is "bun"). Without
- * the adapterCommand gate, bunx-resolved spawns would start with no auth
- * and die as zombies on the first prompt.
+ * Gating is keyed off the resolved command basename, not the user-facing
+ * agent id. A custom `acp.agents.my-claude = { command: "claude-agent-acp",
+ * ... }` alias (or a full path like `/opt/bin/claude-agent-acp`) still gets
+ * the env it needs. Because resolution always yields the real adapter binary
+ * (never a `bun x` wrapper), the basename is the canonical adapter identity.
  *
  * For `claude-agent-acp` the only required env var is
  * `CLAUDE_CODE_OAUTH_TOKEN`. Two provisioning routes converge on it, with
@@ -132,7 +131,7 @@ export async function prepareAgentEnv(
   // agent reference. The local `env` binding sidesteps TS narrowing
   // limitations on the optional `AcpAgentConfig.env` field.
   const env: Record<string, string> = { ...(agentConfig.env ?? {}) };
-  const adapterCommand = adapterCommandOf(agentConfig);
+  const adapterCommand = basename(agentConfig.command);
 
   if (adapterCommand === "claude-agent-acp") {
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {