@vellumai/cli 0.10.5-dev.202607022329.d89bf2f → 0.10.5-dev.202607030140.c8c2585

package/node_modules/@vellumai/local-mode/src/__tests__/upgrade.test.ts

@@ -0,0 +1,128 @@
+import { afterEach, beforeAll, describe, expect, mock, test } from "bun:test";
+import { EventEmitter } from "node:events";
+
+import type { CliInvocation } from "../util";
+
+class FakeChild extends EventEmitter {
+  stdout = new EventEmitter();
+  stderr = new EventEmitter();
+  kill = mock(() => true);
+}
+
+let lastChild: FakeChild;
+const spawnArgs: Array<
+  [string, string[], { env?: NodeJS.ProcessEnv; stdio?: unknown }]
+> = [];
+const spawnMock = mock(
+  (
+    command: string,
+    args: string[],
+    options: { env?: NodeJS.ProcessEnv; stdio?: unknown },
+  ) => {
+    spawnArgs.push([command, args, options]);
+    lastChild = new FakeChild();
+    return lastChild;
+  },
+);
+
+mock.module("node:child_process", () => ({ spawn: spawnMock }));
+
+let runUpgrade: typeof import("../upgrade").runUpgrade;
+let isValidReleaseVersion: typeof import("../upgrade").isValidReleaseVersion;
+
+beforeAll(async () => {
+  ({ runUpgrade, isValidReleaseVersion } = await import("../upgrade"));
+});
+
+afterEach(() => {
+  spawnArgs.length = 0;
+  spawnMock.mockClear();
+});
+
+const invocation: CliInvocation = { command: "bun", baseArgs: ["run", "cli"] };
+
+describe("isValidReleaseVersion", () => {
+  test("accepts release tags, staying lenient about semver shape", () => {
+    for (const version of [
+      "latest",
+      "v1.2.3",
+      "V1.2.3", // uppercase prefix
+      "1.2.3",
+      "1.2", // two-part
+      "1.2.3.4", // four-part
+      "0.6.0-staging.5",
+      "1.2.3-rc.1+build.7",
+    ]) {
+      expect(isValidReleaseVersion(version)).toBe(true);
+    }
+  });
+
+  test("rejects package specs and path-traversal input", () => {
+    for (const version of [
+      "npm:@attacker/evil@1.0.0",
+      "https://evil.example/x.tgz",
+      "git+https://evil.example/x.git",
+      "github:attacker/vellum",
+      "file:/tmp/evil",
+      "../../../../tmp/evil",
+      "1.2.3-..", // no consecutive dots (would be a traversal segment)
+      "1.2.3-a..b",
+      "..",
+      "",
+      "vellum@1.2.3",
+    ]) {
+      expect(isValidReleaseVersion(version)).toBe(false);
+    }
+  });
+});
+
+describe("runUpgrade", () => {
+  test("spawns the CLI upgrade command for a release tag", async () => {
+    const pending = runUpgrade(invocation, "asst-42", { version: "v1.2.3" });
+    lastChild.emit("close", 0);
+
+    expect(await pending).toEqual({ ok: true });
+    expect(spawnArgs[0]).toEqual([
+      "bun",
+      ["run", "cli", "upgrade", "asst-42", "--version", "v1.2.3"],
+      { stdio: ["ignore", "pipe", "pipe"] },
+    ]);
+  });
+
+  test("spawns the CLI upgrade command for --latest", async () => {
+    const pending = runUpgrade(invocation, "asst-42", { latest: true });
+    lastChild.emit("close", 0);
+
+    expect(await pending).toEqual({ ok: true });
+    expect(spawnArgs[0]?.[1]).toEqual([
+      "run",
+      "cli",
+      "upgrade",
+      "asst-42",
+      "--latest",
+    ]);
+  });
+
+  test("rejects a malicious version without spawning", async () => {
+    const result = await runUpgrade(invocation, "asst-42", {
+      version: "npm:@attacker/evil@1.0.0",
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      status: 400,
+      error:
+        "Invalid upgrade version 'npm:@attacker/evil@1.0.0': expected a release tag like v1.2.3 or 'latest'.",
+    });
+    expect(spawnArgs.length).toBe(0);
+  });
+
+  test("rejects a path-traversal version without spawning", async () => {
+    const result = await runUpgrade(invocation, "asst-42", {
+      version: "../../../../tmp/evil",
+    });
+
+    expect(result.ok).toBe(false);
+    expect(spawnArgs.length).toBe(0);
+  });
+});

package/node_modules/@vellumai/local-mode/src/index.ts

@@ -48,7 +48,7 @@ export { runSleep } from "./sleep";
 export type { SleepResult } from "./sleep";
 export { runWake } from "./wake";
 export type { WakeOptions, WakeResult } from "./wake";
-export { runUpgrade } from "./upgrade";
+export { runUpgrade, isValidReleaseVersion } from "./upgrade";
 export type { UpgradeOptions, UpgradeResult } from "./upgrade";
 export { getLocalAssistantStatus } from "./status";
 export type {

package/node_modules/@vellumai/local-mode/src/upgrade.ts

@@ -14,6 +14,37 @@ export interface UpgradeOptions {
   force?: boolean;
 }
 
+// A trusted release version is the literal `latest` dist-tag, or a
+// version-shaped string: an optional `v`/`V` prefix, then a leading digit,
+// then any run of `[0-9A-Za-z.+-]`. This is intentionally lenient about the
+// *shape* of the version (2-, 3-, or 4-part, arbitrary pre-release/build
+// identifiers, uppercase `V`) so we never reject a legitimate release tag.
+//
+// Security does not depend on the shape — it depends on the CHARSET. The
+// allowed set excludes `/`, `\`, `:`, `@`, `#` and whitespace, so the value can
+// never be interpreted by `bun install` as a package-manager spec (npm alias,
+// tarball/git URL, `file:`/`github:` ref) — all of which require one of those
+// characters. The mandatory leading digit means the value can never be a bare
+// `.`/`..` path segment, and `..` is rejected outright, so the version is safe
+// to use as the runtime-install directory name.
+const RELEASE_VERSION_PATTERN = /^(?:latest|[vV]?\d[0-9A-Za-z.+-]*)$/;
+
+/**
+ * Whether `version` is a trusted release identifier: the literal `latest`, or a
+ * version-shaped tag like `v1.2.3` / `1.2.3` / `0.6.0-staging.5`. Rejects
+ * package-manager specifiers (npm aliases, tarball or git URLs) and any
+ * path-traversal-like input, while staying permissive about semver shape.
+ *
+ * Defined once here and reused by both the host-bridge boundary guard
+ * (`runUpgrade`, in the shared library backing the Electron host and the web
+ * dev-server middleware) and the CLI's runtime-install sink
+ * (`ensureLocalRuntime`), so the security boundary can never drift between the
+ * two call sites.
+ */
+export function isValidReleaseVersion(version: string): boolean {
+  return RELEASE_VERSION_PATTERN.test(version) && !version.includes("..");
+}
+
 function extractVersion(output: string): string | undefined {
   const versionPattern = "(v?[0-9]+(?:\\.[0-9]+)*(?:[-+][\\w.-]+)?)";
   const upgraded = output.match(
@@ -35,6 +66,18 @@ export function runUpgrade(
   options?: UpgradeOptions,
 ): Promise<UpgradeResult> {
   return new Promise((resolve) => {
+    // Reject an untrusted `--version` at the host boundary before spawning the
+    // CLI. `latest` (or the `--latest` flag) is always allowed; an explicit
+    // version must be a release tag. Preserves the never-reject contract.
+    if (options?.version && !isValidReleaseVersion(options.version)) {
+      resolve({
+        ok: false,
+        status: 400,
+        error: `Invalid upgrade version '${options.version}': expected a release tag like v1.2.3 or 'latest'.`,
+      });
+      return;
+    }
+
     const args = [...invocation.baseArgs, "upgrade", assistantId];
     if (options?.latest) {
       args.push("--latest");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.5-dev.202607022329.d89bf2f",
+  "version": "0.10.5-dev.202607030140.c8c2585",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/local-runtime-version.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from "bun:test";
+
+import { isValidReleaseVersion } from "@vellumai/local-mode";
+
+import type { LocalInstanceResources } from "../lib/assistant-config.js";
+import { ensureLocalRuntime } from "../lib/local.js";
+
+// Only `instanceDir` is read, and only after the validation guard passes —
+// invalid versions throw before any filesystem access, so a minimal stub is
+// sufficient for the rejection cases.
+const resources = {
+  instanceDir: "/tmp/vellum-nonexistent-instance",
+} as unknown as LocalInstanceResources;
+
+const VALID_VERSIONS = ["latest", "v1.2.3", "1.2.3", "0.6.0-staging.5"];
+const MALICIOUS_VERSIONS = [
+  "npm:@attacker/evil@1.0.0",
+  "https://evil.example/x.tgz",
+  "git+https://evil.example/x.git",
+  "../../../../tmp/evil",
+  "1.2.3-..",
+  "1.2.3-a..b",
+];
+
+describe("ensureLocalRuntime version guard", () => {
+  test("shares the trusted-release validator with the host boundary", () => {
+    for (const version of VALID_VERSIONS) {
+      expect(isValidReleaseVersion(version)).toBe(true);
+    }
+    for (const version of MALICIOUS_VERSIONS) {
+      expect(isValidReleaseVersion(version)).toBe(false);
+    }
+  });
+
+  test("throws before any install for untrusted versions", () => {
+    for (const version of MALICIOUS_VERSIONS) {
+      expect(() => ensureLocalRuntime(resources, version)).toThrow(
+        `Invalid runtime version '${version}'`,
+      );
+    }
+  });
+});

package/src/lib/local.ts

@@ -11,6 +11,8 @@ import { createRequire } from "module";
 import { homedir, networkInterfaces, platform, tmpdir } from "os";
 import { basename, dirname, join } from "path";
 
+import { isValidReleaseVersion } from "@vellumai/local-mode";
+
 import {
   getDaemonPidPath,
   type LocalInstanceResources,
@@ -148,6 +150,18 @@ export function ensureLocalRuntime(
   version: string,
   options: { force?: boolean } = {},
 ): LocalRuntimeInstall {
+  // Reject anything that is not a trusted release identifier BEFORE it becomes
+  // a filesystem path segment or a `bun install` dependency spec. Without this,
+  // a package-manager spec (npm alias, tarball/git URL) or a `../`-laden string
+  // reaching this sink would install and then execute arbitrary attacker code
+  // as the local assistant runtime. Shares the validator with the host-bridge
+  // boundary guard (`runUpgrade`) so the two can never drift.
+  if (!isValidReleaseVersion(version)) {
+    throw new Error(
+      `Invalid runtime version '${version}': expected a release tag like v1.2.3 or 'latest'.`,
+    );
+  }
+
   const normalizedVersion = normalizeRuntimeVersion(version);
   const displayVersion =
     normalizedVersion === "latest" ? "latest" : `v${normalizedVersion}`;