@zaip-ai/cli 6.3.0 → 7.6.0

package/templates/.agents/tools/infisical-policy.mjs

@@ -0,0 +1,134 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+export const fail = (code) => {
+  const error = new Error(code);
+  error.safeCode = code;
+  throw error;
+};
+export const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export const object = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+export const keyName = (value) =>
+  typeof value === "string" && /^[A-Z][A-Z0-9_]{0,127}$/.test(value);
+const forbiddenEnv =
+  /^(?:INFISICAL_|NODE_|LD_|DYLD_|PYTHON|BASH|ENV$|PATH$|PATHEXT$|COMSPEC$|SYSTEMROOT$|WINDIR$|HOME$|USERPROFILE$|TEMP$|TMP$)/i;
+export const safeEnv = (value) => keyName(value) && !forbiddenEnv.test(value);
+
+export function origin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    fail("invalid_origin");
+  }
+  if (
+    url.protocol !== "https:" ||
+    url.origin !== value ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  )
+    fail("invalid_origin");
+  return url.origin;
+}
+
+export function validateContract(c) {
+  if (!object(c) || c.version !== 1 || c.provider !== "infisical-self-hosted")
+    fail("invalid_contract");
+  origin(c.origin);
+  if (
+    c.authorization?.approved !== true ||
+    typeof c.authorization.reference !== "string" ||
+    !c.authorization.reference.trim()
+  )
+    fail("authorization_missing");
+  if (
+    !Array.isArray(c.authorization.operations) ||
+    c.authorization.operations.some((x) => !["inspect", "create", "run"].includes(x))
+  )
+    fail("invalid_operations");
+  if (
+    typeof c.projectId !== "string" ||
+    typeof c.environment !== "string" ||
+    !/^[a-zA-Z0-9_-]{1,128}$/.test(c.projectId) ||
+    !/^[a-z0-9_-]{1,64}$/.test(c.environment)
+  )
+    fail("invalid_target");
+  if (
+    typeof c.secretPath !== "string" ||
+    !/^\/(?:[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)*)?$/.test(c.secretPath)
+  )
+    fail("invalid_target");
+  if (!object(c.secrets) || !Object.keys(c.secrets).length || Object.keys(c.secrets).length > 32)
+    fail("invalid_secrets");
+  for (const [name, entry] of Object.entries(c.secrets)) {
+    if (
+      !keyName(name) ||
+      !object(entry) ||
+      !Array.isArray(entry.operations) ||
+      entry.operations.some((x) => !["inspect", "create", "run"].includes(x))
+    )
+      fail("invalid_secrets");
+    if (entry.env !== undefined && !safeEnv(entry.env)) fail("unsafe_environment_name");
+    if (entry.create !== undefined && !["generate", "file"].includes(entry.create?.source))
+      fail("invalid_creation_source");
+    if (
+      entry.create?.source === "generate" &&
+      (!Number.isInteger(entry.create.bytes) || entry.create.bytes < 32 || entry.create.bytes > 128)
+    )
+      fail("invalid_generation_size");
+    if (entry.create?.source === "file" && typeof entry.create.path !== "string")
+      fail("invalid_creation_source");
+  }
+  if (!object(c.auth) || !["process-env", "dotenv"].includes(c.auth.source))
+    fail("invalid_auth_source");
+  if (c.auth.source === "dotenv" && typeof c.auth.path !== "string") fail("invalid_auth_source");
+  return c;
+}
+
+/** Every component is checked; no symlinks, hardlinks or outside-project credential reads. */
+export async function localFile(root, path, { secret = false, max = 1048576 } = {}) {
+  if (
+    typeof path !== "string" ||
+    isAbsolute(path) ||
+    path.includes("\\") ||
+    path.split("/").some((p) => !p || p === "." || p === "..")
+  )
+    fail("unsafe_path");
+  if (secret && !path.startsWith(".agents/private/state/credentials/"))
+    fail("unsafe_credential_path");
+  const base = await realpath(root);
+  const absolute = resolve(base, path);
+  const rel = relative(base, absolute);
+  if (!rel || rel.startsWith(`..${sep}`) || isAbsolute(rel)) fail("unsafe_path");
+  let cursor = base;
+  for (const part of path.split("/")) {
+    cursor = resolve(cursor, part);
+    if ((await lstat(cursor)).isSymbolicLink()) fail("linked_path");
+  }
+  const info = await lstat(absolute);
+  if (!info.isFile() || info.nlink !== 1 || info.size > max) fail("unsafe_file");
+  if (secret && process.platform !== "win32" && info.mode & 0o077) fail("unsafe_file_permissions");
+  if ((await realpath(absolute)) !== absolute) fail("linked_path");
+  return { absolute, bytes: await readFile(absolute) };
+}
+
+export function argumentsFor(values, allowed) {
+  const result = {};
+  for (let i = 0; i < values.length; i += 2) {
+    const name = values[i]?.replace(/^--/, "");
+    if (
+      !values[i]?.startsWith("--") ||
+      !allowed.includes(name) ||
+      result[name] !== undefined ||
+      !values[i + 1] ||
+      values[i + 1].startsWith("--")
+    )
+      fail("invalid_arguments");
+    result[name] = values[i + 1];
+  }
+  return result;
+}

package/templates/.agents/tools/infisical-runner.mjs

@@ -0,0 +1,349 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseEnv } from "node:util";
+import {
+  argumentsFor,
+  fail,
+  hash,
+  localFile,
+  object,
+  safeEnv,
+  validateContract,
+} from "./infisical-policy.mjs";
+
+const root = resolve(import.meta.dirname, "../..");
+const safeCodes = new Set([
+  "invalid_arguments",
+  "invalid_contract",
+  "invalid_origin",
+  "authorization_missing",
+  "invalid_operations",
+  "invalid_target",
+  "invalid_secrets",
+  "unsafe_environment_name",
+  "invalid_creation_source",
+  "invalid_generation_size",
+  "invalid_auth_source",
+  "unsafe_path",
+  "unsafe_credential_path",
+  "linked_path",
+  "unsafe_file",
+  "unsafe_file_permissions",
+  "operation_denied",
+  "credential_missing",
+  "authentication_failed",
+  "permission_denied",
+  "not_found",
+  "provider_error",
+  "invalid_response",
+  "network_error",
+  "write_uncertain",
+  "already_exists",
+  "verification_failed",
+  "invalid_value",
+  "command_not_authorized",
+  "command_integrity_failed",
+  "command_failed",
+]);
+export function diagnostic(error) {
+  return { ok: false, code: safeCodes.has(error?.safeCode) ? error.safeCode : "operation_failed" };
+}
+
+async function request(origin, path, { token, body, method = "GET" } = {}, fetcher) {
+  const writing = method !== "GET" && path !== "/api/v1/auth/universal-auth/login";
+  try {
+    const response = await fetcher(`${origin}${path}`, {
+      method,
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "Content-Type": "application/json",
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    });
+    if (!response.ok) {
+      if (writing && response.status >= 500) fail("write_uncertain");
+      fail(
+        {
+          401: "authentication_failed",
+          403: "permission_denied",
+          404: "not_found",
+          409: "already_exists",
+        }[response.status] ?? "provider_error",
+      );
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.length;
+        if (size > 1048576) fail("invalid_response");
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch (error) {
+    if (writing && error.safeCode === "invalid_response") fail("write_uncertain");
+    if (error.safeCode) throw error;
+    fail(writing ? "write_uncertain" : "network_error");
+  }
+}
+
+function secretResponse(body, c, name, needsValue) {
+  const s = body?.secret;
+  if (
+    !object(s) ||
+    s.secretKey !== name ||
+    s.environment !== c.environment ||
+    s.workspace !== c.projectId ||
+    s.type !== "shared" ||
+    (s.secretPath !== undefined && s.secretPath !== c.secretPath)
+  )
+    fail("invalid_response");
+  if (
+    needsValue &&
+    (s.secretValueHidden === true ||
+      typeof s.secretValue !== "string" ||
+      !s.secretValue ||
+      s.secretValue.includes("\0") ||
+      s.secretValue.includes("${"))
+  )
+    fail("invalid_value");
+  return s;
+}
+
+async function commandFor(c, alias, rootPath) {
+  const command = c.commands?.[alias];
+  if (
+    !object(command) ||
+    !isAbsolute(command.executable ?? "") ||
+    !/^[a-f0-9]{64}$/.test(command.executableSha256 ?? "") ||
+    !Array.isArray(command.secrets) ||
+    !command.secrets.length ||
+    new Set(command.secrets).size !== command.secrets.length
+  )
+    fail("command_not_authorized");
+  if (
+    !Number.isInteger(command.timeoutMs) ||
+    command.timeoutMs < 1000 ||
+    command.timeoutMs > 3600000
+  )
+    fail("command_not_authorized");
+  if (
+    !Array.isArray(command.args) ||
+    command.args.some((a) => typeof a !== "string" || a.includes("\0")) ||
+    !object(command.files) ||
+    !Object.keys(command.files).length
+  )
+    fail("command_not_authorized");
+  const executable = await realpath(command.executable);
+  const info = await lstat(command.executable);
+  if (
+    info.isSymbolicLink() ||
+    !info.isFile() ||
+    hash(await readFile(executable)) !== command.executableSha256
+  )
+    fail("command_integrity_failed");
+  for (const [path, expected] of Object.entries(command.files)) {
+    const file = await localFile(rootPath, path);
+    if (!/^[a-f0-9]{64}$/.test(expected) || hash(file.bytes) !== expected)
+      fail("command_integrity_failed");
+  }
+  const names = new Set();
+  for (const name of command.secrets) {
+    const entry = c.secrets[name];
+    if (!entry?.operations.includes("run") || !safeEnv(entry.env) || names.has(entry.env))
+      fail("command_not_authorized");
+    names.add(entry.env);
+  }
+  return { ...command, executable };
+}
+
+async function execute(command, env, rootPath) {
+  return new Promise((done, reject) => {
+    const child = spawn(command.executable, command.args, {
+      cwd: rootPath,
+      env,
+      shell: false,
+      windowsHide: true,
+      stdio: "ignore",
+    });
+    const timer = setTimeout(() => child.kill("SIGKILL"), command.timeoutMs);
+    child.once("error", () => {
+      clearTimeout(timer);
+      reject(Object.assign(new Error(), { safeCode: "command_failed" }));
+    });
+    child.once("close", (code, signal) => {
+      clearTimeout(timer);
+      code === 0 && !signal
+        ? done()
+        : reject(Object.assign(new Error(), { safeCode: "command_failed" }));
+    });
+  });
+}
+
+/** No value leaves this boundary except through the explicitly authorized child's environment. */
+export async function run(args, injected = {}) {
+  const base = injected.root ?? root;
+  const fetcher = injected.fetch ?? fetch;
+  const processEnv = injected.env ?? process.env;
+  if (!args.contract || !["validate", "inspect", "create", "run"].includes(args.operation))
+    fail("invalid_arguments");
+  const c = validateContract(
+    JSON.parse((await localFile(base, args.contract)).bytes.toString("utf8")),
+  );
+  if (args.operation === "validate") {
+    if (args.secret || args.command) fail("invalid_arguments");
+    return {
+      ok: true,
+      operation: "validate",
+      projectId: c.projectId,
+      environment: c.environment,
+      secretPath: c.secretPath,
+    };
+  }
+  if (!c.authorization.operations.includes(args.operation)) fail("operation_denied");
+  const name = args.secret;
+  const entry = c.secrets[name];
+  if (args.operation !== "run" && (!entry?.operations.includes(args.operation) || args.command))
+    fail("operation_denied");
+  if (args.operation === "run" && (args.secret || !args.command)) fail("invalid_arguments");
+  const command = args.operation === "run" ? await commandFor(c, args.command, base) : null;
+  const auth =
+    c.auth.source === "dotenv"
+      ? parseEnv(
+          (await localFile(base, c.auth.path, { secret: true, max: 65536 })).bytes.toString("utf8"),
+        )
+      : processEnv;
+  if (!auth.INFISICAL_CLIENT_ID || !auth.INFISICAL_CLIENT_SECRET) fail("credential_missing");
+  const login = await request(
+    c.origin,
+    "/api/v1/auth/universal-auth/login",
+    {
+      method: "POST",
+      body: { clientId: auth.INFISICAL_CLIENT_ID, clientSecret: auth.INFISICAL_CLIENT_SECRET },
+    },
+    fetcher,
+  );
+  if (
+    typeof login.accessToken !== "string" ||
+    !login.accessToken ||
+    !Number.isFinite(login.expiresIn) ||
+    login.expiresIn <= 0
+  )
+    fail("invalid_response");
+  let token = login.accessToken;
+  const get = async (key, value = false) => {
+    const params = new URLSearchParams({
+      projectId: c.projectId,
+      environment: c.environment,
+      secretPath: c.secretPath,
+      type: "shared",
+      includeImports: "false",
+      expandSecretReferences: "false",
+      viewSecretValue: String(value),
+    });
+    return secretResponse(
+      await request(
+        c.origin,
+        `/api/v4/secrets/${encodeURIComponent(key)}?${params}`,
+        { token },
+        fetcher,
+      ),
+      c,
+      key,
+      value,
+    );
+  };
+  try {
+    if (args.operation === "inspect") {
+      const observed = await get(name);
+      return {
+        ok: true,
+        operation: "inspect",
+        name,
+        present: true,
+        version: Number.isInteger(observed.version) ? observed.version : null,
+      };
+    }
+    if (args.operation === "create") {
+      if (!entry.create) fail("invalid_creation_source");
+      try {
+        await get(name);
+        fail("already_exists");
+      } catch (error) {
+        if (error.safeCode !== "not_found") throw error;
+      }
+      let value =
+        entry.create.source === "generate"
+          ? randomBytes(entry.create.bytes).toString("base64url")
+          : (await localFile(base, entry.create.path, { secret: true, max: 65536 })).bytes.toString(
+              "utf8",
+            );
+      if (!value || value.includes("\0") || value.includes("${")) fail("invalid_value");
+      await request(
+        c.origin,
+        `/api/v4/secrets/${encodeURIComponent(name)}`,
+        {
+          token,
+          method: "POST",
+          body: {
+            projectId: c.projectId,
+            environment: c.environment,
+            secretPath: c.secretPath,
+            type: "shared",
+            secretValue: value,
+            skipMultilineEncoding: true,
+          },
+        },
+        fetcher,
+      );
+      try {
+        if ((await get(name, true)).secretValue !== value) fail("verification_failed");
+      } catch {
+        fail("write_uncertain");
+      } finally {
+        value = undefined;
+      }
+      return { ok: true, operation: "create", name, verified: true };
+    }
+    const env = {};
+    for (const key of ["SystemRoot", "WINDIR", "TEMP", "TMP", "TMPDIR", "LANG"])
+      if (processEnv[key]) env[key] = processEnv[key];
+    try {
+      for (const key of command.secrets)
+        env[c.secrets[key].env] = (await get(key, true)).secretValue;
+      await (injected.execute ?? execute)(command, env, base);
+    } finally {
+      for (const key of Object.keys(env)) delete env[key];
+    }
+    return { ok: true, operation: "run", command: args.command, exitCode: 0 };
+  } finally {
+    token = undefined;
+    login.accessToken = undefined;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  try {
+    console.log(
+      JSON.stringify(
+        await run(
+          argumentsFor(process.argv.slice(2), ["contract", "operation", "secret", "command"]),
+        ),
+      ),
+    );
+  } catch (error) {
+    console.error(JSON.stringify(diagnostic(error)));
+    process.exitCode = 1;
+  }
+}