@zaip-ai/cli 6.2.0 → 7.5.0

package/templates/.agents/tools/infisical-runner.test.mjs

@@ -0,0 +1,266 @@
+import assert from "node:assert/strict";
+import { link, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { argumentsFor, hash, localFile, validateContract } from "./infisical-policy.mjs";
+import { diagnostic, run } from "./infisical-runner.mjs";
+
+const value = "fixture-secret-never-disclosed";
+const env = {
+  INFISICAL_CLIENT_ID: "fixture-id",
+  INFISICAL_CLIENT_SECRET: "fixture-zero",
+  NODE_OPTIONS: "forbidden",
+  PATH: "forbidden",
+  UNRELATED_SECRET: "forbidden",
+};
+const contract = () => ({
+  version: 1,
+  provider: "infisical-self-hosted",
+  origin: "https://vault.example.test",
+  projectId: "project-fixture",
+  environment: "dev",
+  secretPath: "/backend",
+  authorization: {
+    approved: true,
+    reference: "offline test",
+    operations: ["inspect", "create", "run"],
+  },
+  auth: { source: "process-env" },
+  secrets: {
+    APP_KEY: {
+      operations: ["inspect", "create", "run"],
+      env: "APP_KEY",
+      create: { source: "generate", bytes: 32 },
+    },
+  },
+});
+const response = (body, status = 200) => new Response(JSON.stringify(body), { status });
+const secret = (c, v = value) => ({
+  secret: {
+    secretKey: "APP_KEY",
+    secretValue: v,
+    version: 1,
+    workspace: c.projectId,
+    environment: c.environment,
+    secretPath: c.secretPath,
+    type: "shared",
+  },
+});
+async function fixture(t) {
+  const root = await mkdtemp(join(tmpdir(), "zaip-infisical-runner-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const c = contract();
+  const save = () => writeFile(join(root, "contract.json"), JSON.stringify(c));
+  await save();
+  const calls = [];
+  let handler = () => response(secret(c));
+  const fetch = async (url, options) => {
+    calls.push({ url, options });
+    assert.equal(options.redirect, "error");
+    assert.equal(new URL(url).origin, c.origin);
+    if (url.endsWith("/login")) return response({ accessToken: "fixture-token", expiresIn: 60 });
+    assert.equal(options.headers.Authorization, "Bearer fixture-token");
+    return handler(url, options);
+  };
+  return {
+    root,
+    c,
+    save,
+    calls,
+    setHandler(fn) {
+      handler = fn;
+    },
+    invoke: (operation, extra = {}, injected = {}) =>
+      run({ contract: "contract.json", operation, ...extra }, { root, fetch, env, ...injected }),
+  };
+}
+test("offline validation requires explicit HTTPS target and authorization", async (t) => {
+  const f = await fixture(t);
+  assert.equal((await f.invoke("validate")).ok, true);
+  assert.equal(f.calls.length, 0);
+  for (const patch of [
+    { projectId: undefined },
+    { environment: undefined },
+    { origin: "http://vault.example.test" },
+    { origin: "https://vault.example.test/path" },
+    { authorization: { approved: false } },
+  ]) {
+    assert.throws(() => validateContract({ ...f.c, ...patch }));
+  }
+  assert.throws(() => argumentsFor(["--contract", "a", "--contract", "b"], ["contract"]));
+  assert.throws(() => argumentsFor(["--token", "value"], ["contract"]));
+});
+test("inspect never returns values even if provider ignores metadata-only request", async (t) => {
+  const f = await fixture(t);
+  assert.deepEqual(await f.invoke("inspect", { secret: "APP_KEY" }), {
+    ok: true,
+    operation: "inspect",
+    name: "APP_KEY",
+    present: true,
+    version: 1,
+  });
+  assert.equal(new URL(f.calls[1].url).searchParams.get("viewSecretValue"), "false");
+  assert.equal(new URL(f.calls[1].url).searchParams.get("includeImports"), "false");
+  assert.equal(new URL(f.calls[1].url).searchParams.get("expandSecretReferences"), "false");
+});
+test("denied operations and unsafe environment names stop before network", async (t) => {
+  const f = await fixture(t);
+  f.c.authorization.operations = ["inspect"];
+  await f.save();
+  await assert.rejects(f.invoke("create", { secret: "APP_KEY" }), { safeCode: "operation_denied" });
+  assert.equal(f.calls.length, 0);
+  f.c.secrets.APP_KEY.env = "NODE_OPTIONS";
+  await f.save();
+  await assert.rejects(f.invoke("validate"), { safeCode: "unsafe_environment_name" });
+});
+test("mixed project, environment, path, type and key responses fail closed", async (t) => {
+  const f = await fixture(t);
+  for (const patch of [
+    { workspace: "other" },
+    { environment: "prod" },
+    { secretPath: "/other" },
+    { type: "personal" },
+    { secretKey: "OTHER" },
+  ]) {
+    f.setHandler(() => response({ secret: { ...secret(f.c).secret, ...patch } }));
+    await assert.rejects(f.invoke("inspect", { secret: "APP_KEY" }), {
+      safeCode: "invalid_response",
+    });
+  }
+});
+test("create generates and verifies a value without returning it", async (t) => {
+  const f = await fixture(t);
+  let stored;
+  f.setHandler((_url, opts) => {
+    if (opts.method === "POST") {
+      stored = JSON.parse(opts.body).secretValue;
+      return response({});
+    }
+    return stored ? response(secret(f.c, stored)) : response({}, 404);
+  });
+  const result = await f.invoke("create", { secret: "APP_KEY" });
+  assert.equal(Buffer.from(stored, "base64url").length, 32);
+  assert.deepEqual(result, { ok: true, operation: "create", name: "APP_KEY", verified: true });
+  assert.equal(JSON.stringify(result).includes(stored), false);
+  assert.equal(f.calls.filter((c) => c.options.method === "POST").length, 2);
+});
+test("existing credentials are never overwritten", async (t) => {
+  const f = await fixture(t);
+  await assert.rejects(f.invoke("create", { secret: "APP_KEY" }), { safeCode: "already_exists" });
+  assert.equal(f.calls.length, 2);
+});
+test("ambiguous writes are not retried; errors never expose upstream body", async (t) => {
+  const f = await fixture(t);
+  for (const mode of ["network", "oversized", "invalid-json", "server", "readback"]) {
+    let posts = 0;
+    f.setHandler((_url, opts) => {
+      if (opts.method === "GET") return posts ? response({}, 403) : response({}, 404);
+      posts++;
+      if (mode === "network") throw new Error(value);
+      if (mode === "oversized") return new Response("x".repeat(1048577));
+      if (mode === "invalid-json") return new Response(value);
+      if (mode === "server") return response({ error: value }, 500);
+      return response({});
+    });
+    await assert.rejects(f.invoke("create", { secret: "APP_KEY" }), {
+      safeCode: "write_uncertain",
+    });
+    assert.equal(posts, 1);
+  }
+  assert.deepEqual(diagnostic(new Error(value)), { ok: false, code: "operation_failed" });
+});
+test("credentials imported only from local protected files with no path escape/hardlinks", async (t) => {
+  const f = await fixture(t);
+  await mkdir(join(f.root, ".agents/private/state/credentials"), { recursive: true });
+  await writeFile(join(f.root, ".agents/private/state/credentials/key"), value, { mode: 0o600 });
+  await link(join(f.root, ".agents/private/state/credentials/key"), join(f.root, "linked"));
+  await assert.rejects(
+    localFile(f.root, ".agents/private/state/credentials/key", { secret: true }),
+    {
+      safeCode: "unsafe_file",
+    },
+  );
+  await rm(join(f.root, "linked"));
+  for (const path of [
+    "../escape",
+    "C:/escape",
+    ".local/../escape",
+    ".local\\credentials\\key",
+    "outside/key",
+  ])
+    await assert.rejects(localFile(f.root, path, { secret: true }));
+  f.c.secrets.APP_KEY.create = { source: "file", path: ".agents/private/state/credentials/key" };
+  await f.save();
+  let stored;
+  f.setHandler((_url, opts) => {
+    if (opts.method === "POST") {
+      stored = JSON.parse(opts.body).secretValue;
+      return response({});
+    }
+    return stored ? response(secret(f.c, stored)) : response({}, 404);
+  });
+  await f.invoke("create", { secret: "APP_KEY" });
+  assert.equal(stored, value);
+});
+async function command(f) {
+  await writeFile(join(f.root, "consumer.mjs"), "process.exit(0);\n");
+  f.c.commands = {
+    verify: {
+      executable: process.execPath,
+      executableSha256: hash(await readFile(process.execPath)),
+      args: ["consumer.mjs"],
+      files: { "consumer.mjs": hash(await readFile(join(f.root, "consumer.mjs"))) },
+      secrets: ["APP_KEY"],
+      timeoutMs: 1000,
+    },
+  };
+  await f.save();
+}
+test("run injects only selected credentials and clears the child environment", async (t) => {
+  const f = await fixture(t);
+  await command(f);
+  let delivered;
+  const result = await f.invoke(
+    "run",
+    { command: "verify" },
+    {
+      execute: async (_, childEnv) => {
+        assert.deepEqual(childEnv, { APP_KEY: value });
+        delivered = childEnv;
+      },
+    },
+  );
+  assert.equal(result.exitCode, 0);
+  assert.deepEqual(delivered, {});
+  assert.equal(JSON.stringify(result).includes(value), false);
+});
+test("tampered consumer fails before authentication", async (t) => {
+  const f = await fixture(t);
+  await command(f);
+  await writeFile(join(f.root, "consumer.mjs"), "changed");
+  await assert.rejects(f.invoke("run", { command: "verify" }), {
+    safeCode: "command_integrity_failed",
+  });
+  assert.equal(f.calls.length, 0);
+});
+test("hidden, empty and unresolved reference values never reach child", async (t) => {
+  const f = await fixture(t);
+  await command(f);
+  for (const v of ["", `\${prod.KEY}`, "bad\0value"]) {
+    f.setHandler(() => response(secret(f.c, v)));
+    await assert.rejects(
+      f.invoke("run", { command: "verify" }, { execute: () => assert.fail("must not execute") }),
+      { safeCode: "invalid_value" },
+    );
+  }
+});
+test("actual subprocess succeeds and nonzero exits are sanitized", async (t) => {
+  const f = await fixture(t);
+  await command(f);
+  assert.equal((await f.invoke("run", { command: "verify" })).ok, true);
+  await writeFile(join(f.root, "consumer.mjs"), "process.exit(2);\n");
+  f.c.commands.verify.files["consumer.mjs"] = hash(await readFile(join(f.root, "consumer.mjs")));
+  await f.save();
+  await assert.rejects(f.invoke("run", { command: "verify" }), { safeCode: "command_failed" });
+});

package/templates/.agents/tools/mcp/infra/cloudflare/README.md

@@ -1,21 +1,7 @@
 # Cloudflare
 
-Exemplo MCP desabilitado para `cloudflare`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
+MCP oficial em https://mcp.cloudflare.com/mcp, Streamable HTTP com OAuth; exemplo desativado por padrão. O manifest descreve a política desejada, não limita as ferramentas remotas do Code Mode nem comprova autenticação.
 
-## Capacidades
+Leia [setup do agente](../../../../skills/zaip-skill-hostinger-cloudflare-terraform/references/cloudflare-agent-setup.md) antes de instalar ou conectar e [contrato DNS](../../../../skills/zaip-skill-hostinger-cloudflare-terraform/references/cloudflare-dns.md) antes de operar. Descubra integrações existentes e preserve configurações alheias. Tokens de CI/runner são separados do OAuth.
 
-- `dns.read`
-- `workers.read`
-- `dns.write`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `CLOUDFLARE_API_TOKEN`
-- `CLOUDFLARE_ACCOUNT_ID`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.
+Operações de conta só podem ser habilitadas quando a integração verificar autorização, conta/zona, operação e dono do recurso. Até lá, DNS usa o runner delimitado e Terraform mantém propriedade exclusiva dos seus registros. Instalação, login, leitura e escrita são provas distintas; nenhuma ocorre ao gerar este manifest.

package/templates/.agents/tools/mcp/infra/cloudflare/manifest.yaml

@@ -5,19 +5,15 @@ type: mcp
 category: infra
 status: example
 enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
+transport: streamable-http
+url: https://mcp.cloudflare.com/mcp
 authentication:
-  source: environment
-  required_variables:
-    - CLOUDFLARE_API_TOKEN
-    - CLOUDFLARE_ACCOUNT_ID
+  source: oauth
+policy:
+  preferred_access: read-only
+  enforcement: requires-scoped-integration
 capabilities:
   - dns.read
-  - dns.write
 security:
   default_access: read-only
   write_requires_approval: true

package/templates/.agents/tools/repository-cloud-boundary.test.mjs

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { runOnboarding } from "./cloud-onboarding.mjs";
+
+test("repository domain denies cloud before process, credentials or network", async () => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-cloud-boundary-"));
+  let effects = 0;
+  const effect = async () => {
+    effects++;
+    throw Error("effect forbidden in fixture");
+  };
+  try {
+    await mkdir(join(root, ".agents/config"), { recursive: true });
+    await writeFile(
+      join(root, ".agents/config/repository-policy.json"),
+      JSON.stringify({ schema_version: 1, profile: "backend", write_paths: ["services/**"] }),
+    );
+    await assert.rejects(
+      runOnboarding({ operation: "vps:configure" }, { root, exec: effect, http: effect }),
+      /outside declared responsibility/,
+    );
+    assert.equal(effects, 0);
+    await writeFile(
+      join(root, ".agents/config/repository-policy.json"),
+      JSON.stringify({ schema_version: 1, profile: "infra", write_paths: ["infra/**"] }),
+    );
+    await assert.rejects(
+      runOnboarding(
+        { operation: "vps:containers:configure" },
+        { root, exec: effect, http: effect },
+      ),
+      /typed_remote_configuration/,
+    );
+    assert.equal(effects, 0);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/templates/.agents/tools/repository-policy.mjs

@@ -0,0 +1,257 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep, win32 } from "node:path";
+
+const profiles = ["general", "infra", "database", "frontend", "backend", "fullstack"];
+const domains = ["infra", "database", "frontend", "backend"];
+const protectedRoots = [".git", ".codex", ".claude", ".agents", ".local"];
+const policyPath = ".agents/config/repository-policy.json";
+const maximumBytes = 64 * 1024;
+const fail = (message) => {
+  throw new Error(`Repository policy: ${message}`);
+};
+const object = (value) =>
+  value !== null &&
+  typeof value === "object" &&
+  !Array.isArray(value) &&
+  [Object.prototype, null].includes(Object.getPrototypeOf(value));
+const identity = (value) => (process.platform === "win32" ? value.toLowerCase() : value);
+
+function keys(value, allowed) {
+  if (!object(value) || Object.keys(value).some((key) => !allowed.includes(key)))
+    fail("unknown fields or invalid object");
+}
+
+function literalPath(value) {
+  if (
+    typeof value !== "string" ||
+    !value ||
+    value.length > 1024 ||
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Reject control bytes in repository paths.
+    /[\\:\x00-\x1f\x7f*?<>|]/.test(value) ||
+    value.startsWith("/")
+  )
+    fail("expected a portable relative literal path");
+  const parts = value.split("/");
+  if (
+    parts.some(
+      (part) =>
+        !part ||
+        part === "." ||
+        part === ".." ||
+        /[. ]$/.test(part) ||
+        /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part),
+    )
+  )
+    fail("unsafe path segment");
+  return value;
+}
+
+function pathList(value) {
+  if (!Array.isArray(value) || value.length > 256) fail("invalid path list");
+  const result = value.map((entry) => {
+    if (typeof entry !== "string") fail("invalid path pattern");
+    literalPath(entry.endsWith("/**") ? entry.slice(0, -3) : entry);
+    return entry;
+  });
+  if (new Set(result.map(identity)).size !== result.length) fail("duplicate path pattern");
+  return Object.freeze(result);
+}
+
+function references(value) {
+  if (!object(value) || Object.keys(value).length > 64) fail("invalid related repositories");
+  const result = {};
+  for (const [alias, entry] of Object.entries(value)) {
+    if (
+      !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(alias) ||
+      ["constructor", "prototype", "__proto__"].includes(alias)
+    )
+      fail("invalid repository alias");
+    keys(entry, ["reference", "access"]);
+    const ref = entry.reference;
+    if (
+      entry.access !== "read_only" ||
+      typeof ref !== "string" ||
+      !ref ||
+      ref.length > 512 ||
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: Reject control bytes and credentials in repository references.
+      /[\x00-\x20\x7f]|(?:password|token|secret|api[_-]?key)\s*[:=]|(?:ghp_|github_pat_|sk-)[a-zA-Z0-9]/i.test(
+        ref,
+      )
+    )
+      fail("repository references must be credential-free and read_only");
+    if (ref.startsWith("https://")) {
+      const url = new URL(ref);
+      if (url.username || url.password || url.search || url.hash || !url.hostname)
+        fail("repository URL contains credentials or parameters");
+    } else if (!/^[a-zA-Z0-9._/-]+$/.test(ref)) fail("invalid repository reference");
+    result[alias] = Object.freeze({ reference: ref, access: "read_only" });
+  }
+  return Object.freeze(result);
+}
+
+/** A responsibility policy only restricts existing authority; it never grants it. */
+export function parseRepositoryPolicy(value = null) {
+  if (value === null)
+    return Object.freeze({
+      schema_version: 1,
+      profile: "general",
+      deny_paths: Object.freeze([]),
+      external_repository_writes: false,
+      container_source_writes: false,
+      related_repositories: Object.freeze({}),
+    });
+  keys(value, [
+    "schema_version",
+    "profile",
+    "write_paths",
+    "deny_paths",
+    "external_repository_writes",
+    "container_source_writes",
+    "related_repositories",
+  ]);
+  if (
+    !Object.hasOwn(value, "schema_version") ||
+    !Object.hasOwn(value, "profile") ||
+    value.schema_version !== 1 ||
+    !profiles.includes(value.profile)
+  )
+    fail("invalid schema or profile");
+  for (const flag of ["external_repository_writes", "container_source_writes"])
+    if (Object.hasOwn(value, flag) && value[flag] !== false) fail(`${flag} must be false`);
+  return Object.freeze({
+    schema_version: 1,
+    profile: value.profile,
+    ...(Object.hasOwn(value, "write_paths") ? { write_paths: pathList(value.write_paths) } : {}),
+    deny_paths: pathList(Object.hasOwn(value, "deny_paths") ? value.deny_paths : []),
+    external_repository_writes: false,
+    container_source_writes: false,
+    related_repositories: references(
+      Object.hasOwn(value, "related_repositories") ? value.related_repositories : {},
+    ),
+  });
+}
+
+function matches(pattern, path) {
+  const p = identity(pattern),
+    candidate = identity(path);
+  return p.endsWith("/**")
+    ? candidate === p.slice(0, -3) || candidate.startsWith(`${p.slice(0, -3)}/`)
+    : candidate === p;
+}
+
+async function checkedRoot(root) {
+  if (typeof root !== "string" || !isAbsolute(root)) fail("root must be absolute");
+  const absolute = resolve(root),
+    info = await lstat(absolute);
+  if (
+    !info.isDirectory() ||
+    info.isSymbolicLink() ||
+    identity(await realpath(absolute)) !== identity(absolute)
+  )
+    fail("root must be a physical directory without links");
+  return absolute;
+}
+
+async function checkedPath(root, path) {
+  let current = root;
+  for (const part of path.split("/")) {
+    current = resolve(current, part);
+    let info;
+    try {
+      info = await lstat(current);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (
+      info.isSymbolicLink() ||
+      (!info.isFile() && !info.isDirectory()) ||
+      (info.isFile() && info.nlink !== 1) ||
+      identity(await realpath(current)) !== identity(current)
+    )
+      fail("path traverses a link or alias");
+    if (current !== resolve(root, path) && !info.isDirectory()) fail("parent is not a directory");
+  }
+}
+
+/** Check immediately before the caller's guarded write; this is not an atomic filesystem writer. */
+export async function assertRepositoryWrite(policy, root, path) {
+  const parsed = parseRepositoryPolicy(policy),
+    absoluteRoot = await checkedRoot(root);
+  if (typeof path !== "string") fail("invalid write path");
+  let local = path;
+  if (isAbsolute(path)) {
+    if (path.split(/[\\/]/).includes("..")) fail("path traversal");
+    local = relative(absoluteRoot, resolve(path)).split(sep).join("/");
+  } else if (win32.isAbsolute(path)) fail("foreign absolute path");
+  literalPath(local);
+  if (protectedRoots.includes(local.split("/")[0].toLowerCase())) fail("protected authority path");
+  if (parsed.deny_paths.some((pattern) => matches(pattern, local))) fail("write denied");
+  if (
+    parsed.write_paths
+      ? !parsed.write_paths.some((pattern) => matches(pattern, local))
+      : parsed.profile !== "general"
+  )
+    fail("write is outside declared responsibility");
+  await checkedPath(absoluteRoot, local);
+}
+
+export function assertRepositoryOperation(policy, domain) {
+  const parsed = parseRepositoryPolicy(policy);
+  if (!domains.includes(domain)) fail("unknown operation domain");
+  if (
+    parsed.profile !== "general" &&
+    parsed.profile !== domain &&
+    !(parsed.profile === "fullstack" && ["frontend", "backend"].includes(domain))
+  )
+    fail("operation is outside declared responsibility");
+}
+
+export async function loadRepositoryPolicy(root) {
+  const absolute = await checkedRoot(root);
+  await checkedPath(absolute, policyPath);
+  let handle;
+  try {
+    handle = await open(
+      resolve(absolute, policyPath),
+      constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0),
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return parseRepositoryPolicy();
+    throw error;
+  }
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.nlink !== 1 || before.size > maximumBytes)
+      fail("invalid policy file or size");
+    await checkedPath(absolute, policyPath);
+    const opened = await lstat(resolve(absolute, policyPath));
+    if (before.dev !== opened.dev || before.ino !== opened.ino)
+      fail("policy changed before reading");
+    const bytes = Buffer.alloc(maximumBytes + 1);
+    let size = 0;
+    while (size < bytes.length) {
+      const chunk = await handle.read(bytes, size, bytes.length - size, size);
+      if (!chunk.bytesRead) break;
+      size += chunk.bytesRead;
+    }
+    if (size > maximumBytes) fail("policy exceeds 64 KiB");
+    await checkedPath(absolute, policyPath);
+    const after = await lstat(resolve(absolute, policyPath));
+    if (
+      before.dev !== after.dev ||
+      before.ino !== after.ino ||
+      before.size !== after.size ||
+      before.mtimeMs !== after.mtimeMs
+    )
+      fail("policy changed while reading");
+    const value = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)),
+    );
+    if (value === null) fail("configured policy must declare its profile");
+    return parseRepositoryPolicy(value);
+  } finally {
+    await handle.close();
+  }
+}