agentlas 1.0.65 → 1.0.67

package/engine/cli-output.cjs

@@ -67,12 +67,23 @@ function textOf(value) {
   return JSON.stringify(value);
 }
 
+function terminalTextOf(value, maxLength = Number.POSITIVE_INFINITY) {
+  const text = textOf(value);
+  if (typeof text !== "string") return "";
+  return text
+    .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "")
+    .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/\u001b[@-_]/g, "")
+    .replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, " ")
+    .slice(0, maxLength);
+}
+
 /**
  * 표시 폭 — ANSI 를 벗기고, CJK 전각을 2칸으로 센다.
  * 한글 표가 어긋나던 이유가 이것이다(폭을 문자 수로 세면 열이 밀린다).
  */
 function displayWidth(value) {
-  const plain = String(value).replace(/\[[0-9;]*m/g, "");
+  const plain = terminalTextOf(value);
   let width = 0;
   for (const char of plain) {
     const code = char.codePointAt(0) ?? 0;
@@ -102,7 +113,7 @@ function padTo(value, width, align) {
 function renderQuiet(result) {
   const idField = result.schema.idField;
   return rowsOf(result)
-    .map((item) => textOf(readField(item, idField)))
+    .map((item) => terminalTextOf(readField(item, idField)))
     .filter((line) => line.length > 0)
     .join("\n");
 }
@@ -122,31 +133,65 @@ function renderYaml(result) {
     if (value === null || value === undefined) return "null";
     if (typeof value === "number" || typeof value === "boolean") return String(value);
     const text = textOf(value);
-    return /^[\w./:@-]+$/.test(text) ? text : JSON.stringify(text);
+    // YAML implicitly retypes unquoted strings such as yes/null/001/dates.
+    // Machine output must round-trip the command result without changing a
+    // string into a boolean, null, number, or timestamp. Conservatively leave
+    // only unambiguous word/path-like strings plain; JSON quoting is valid YAML.
+    const ambiguousWord = /^(?:~|null|true|false|yes|no|on|off|[-+]?\.?(?:inf|nan))$/i.test(text);
+    return /^[A-Za-z_./][\w./:@-]*$/.test(text) && !ambiguousWord ? text : JSON.stringify(text);
+  };
+  const isObject = (value) => value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+  const assertBoundedTree = (root) => {
+    let nodes = 0;
+    const visit = (value, ancestors, depth) => {
+      if ((!isObject(value) && !Array.isArray(value)) || value instanceof Date) return;
+      if (depth > 64) throw new TypeError("YAML output exceeds the maximum nesting depth");
+      if (ancestors.has(value)) throw new TypeError("YAML output contains a circular reference");
+      nodes += 1;
+      if (nodes > 100_000) throw new TypeError("YAML output contains too many nodes");
+      const next = new Set(ancestors);
+      next.add(value);
+      for (const child of Array.isArray(value) ? value : Object.values(value)) visit(child, next, depth + 1);
+    };
+    visit(root, new Set(), 0);
   };
   const objectLines = (object, indent) => {
     const pad = " ".repeat(indent);
-    return Object.entries(object).map(([key, value]) => {
-      if (value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)) {
-        return `${pad}${key}:\n${objectLines(value, indent + 2).join("\n")}`;
+    const entries = Object.entries(object);
+    if (!entries.length) return [`${pad}{}`];
+    return entries.flatMap(([key, value]) => {
+      const renderedKey = scalar(key);
+      if (isObject(value) || Array.isArray(value)) {
+        const nested = value.length === 0 ? [`${pad}  ${Array.isArray(value) ? "[]" : "{}"}`] : valueLines(value, indent + 2);
+        if (nested.length === 1 && /^(?:\{\}|\[\])$/.test(nested[0].trim())) return [`${pad}${renderedKey}: ${nested[0].trim()}`];
+        return [`${pad}${renderedKey}:`, ...nested];
       }
-      if (Array.isArray(value)) {
-        if (value.length === 0) return `${pad}${key}: []`;
-        return `${pad}${key}:\n${value.map((entry) => `${pad}  - ${scalar(entry)}`).join("\n")}`;
-      }
-      return `${pad}${key}: ${scalar(value)}`;
+      return [`${pad}${renderedKey}: ${scalar(value)}`];
     });
   };
-  if (result.type === "list") {
-    if (result.data.length === 0) return "[]";
-    return result.data
-      .map((item) => {
-        const lines = objectLines(project(item), 2);
-        return `- ${lines.join("\n").trimStart()}`;
-      })
-      .join("\n");
-  }
-  return objectLines(project(result.data), 0).join("\n");
+  const valueLines = (value, indent) => {
+    const pad = " ".repeat(indent);
+    if (Array.isArray(value)) {
+      if (!value.length) return [`${pad}[]`];
+      return value.flatMap((entry) => {
+        if (isObject(entry)) {
+          const nested = objectLines(entry, indent + 2);
+          return [`${pad}- ${nested[0].trimStart()}`, ...nested.slice(1)];
+        }
+        if (Array.isArray(entry)) {
+          const nested = valueLines(entry, indent + 2);
+          return [`${pad}-`, ...nested];
+        }
+        return [`${pad}- ${scalar(entry)}`];
+      });
+    }
+    if (isObject(value)) return objectLines(value, indent);
+    return [`${pad}${scalar(value)}`];
+  };
+  const payload = result.type === "list" ? result.data.map(project) : project(result.data);
+  assertBoundedTree(payload);
+  if (result.type === "list" && result.data.length === 0) return "[]";
+  return valueLines(payload, 0).join("\n");
 }
 
 function renderTable(result, options) {
@@ -154,11 +199,11 @@ function renderTable(result, options) {
   const rows = rowsOf(result);
   if (rows.length === 0) return "";
   const cells = rows.map((item) =>
-    columns.map((column) => textOf(readField(item, column.field))),
+    columns.map((column) => terminalTextOf(readField(item, column.field))),
   );
   const widths = columns.map((column, index) =>
     Math.max(
-      options.noHeaders ? 0 : displayWidth(column.header),
+      options.noHeaders ? 0 : displayWidth(terminalTextOf(column.header)),
       ...cells.map((row) => displayWidth(row[index] ?? "")),
     ),
   );
@@ -166,7 +211,7 @@ function renderTable(result, options) {
   if (!options.noHeaders) {
     lines.push(
       columns
-        .map((column, index) => padTo(column.header.toUpperCase(), widths[index], column.align))
+        .map((column, index) => padTo(terminalTextOf(column.header).toUpperCase(), widths[index], column.align))
         .join("  ")
         .trimEnd(),
     );
@@ -212,12 +257,13 @@ function renderError(error, options = {}) {
   const commandError = toCommandError(error);
   if (opts.format === "json") return JSON.stringify({ error: commandError }, null, 2);
   if (opts.format === "yaml") {
-    return ["error:", `  code: ${commandError.code}`, `  message: ${JSON.stringify(commandError.message)}`].join("\n");
+    return ["error:", `  code: ${JSON.stringify(commandError.code)}`, `  message: ${JSON.stringify(commandError.message)}`].join("\n");
   }
   const prefix = opts.noColor ? "Error: " : "Error: ";
+  const safeMessage = terminalTextOf(commandError.message, 8192);
   return commandError.details && typeof commandError.details === "string" && opts.format === "table"
-    ? `${prefix}${commandError.message}`
-    : `${prefix}${commandError.message}`;
+    ? `${prefix}${safeMessage}`
+    : `${prefix}${safeMessage}`;
 }
 
 /**
@@ -230,14 +276,33 @@ function renderError(error, options = {}) {
 function parseOutputFlags(argv, env = process.env, isTty = Boolean(process.stdout.isTTY)) {
   const rest = [];
   const options = { ...DEFAULT_OPTIONS };
-  for (const token of argv) {
-    if (token === "--json") options.format = "json";
-    else if (token === "--yaml") options.format = "yaml";
+  let sawJson = false;
+  let sawYaml = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--") {
+      rest.push(...argv.slice(index + 1));
+      break;
+    }
+    if (token === "--json") {
+      sawJson = true;
+      options.format = "json";
+    }
+    else if (token === "--yaml") {
+      sawYaml = true;
+      options.format = "yaml";
+    }
     else if (token === "--quiet" || token === "-q") options.quiet = true;
     else if (token === "--no-headers") options.noHeaders = true;
     else if (token === "--no-color") options.noColor = true;
     else rest.push(token);
   }
+  if (sawJson && sawYaml) {
+    const error = new Error("--json and --yaml cannot be used together");
+    error.code = "INVALID_ARGUMENT";
+    error.details = { flags: ["--json", "--yaml"] };
+    throw error;
+  }
   if (env && (env.NO_COLOR || env.AGENTLAS_NO_COLOR)) options.noColor = true;
   if (!isTty) options.noColor = true;
   return { options, rest };
@@ -259,4 +324,5 @@ module.exports = {
   parseOutputFlags,
   isRichUi,
   displayWidth,
+  terminalTextOf,
 };

package/engine/cloud/auth.cjs

@@ -23,6 +23,95 @@ const { userDataDir } = require("../core/paths.cjs");
 const LOGIN_CALLBACK_PATH = "/callback";
 const LOGIN_TIMEOUT_MS = 180_000;
 const MAX_LOGIN_SESSION_BYTES = 16 * 1024;
+const MAX_LOGIN_SESSION_FILE_BYTES = MAX_LOGIN_SESSION_BYTES * 2;
+const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+
+function sameFileIdentity(left, right) {
+  return !!left && !!right
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.nlink === right.nlink;
+}
+
+function sameDirectoryIdentity(info) {
+  try {
+    const current = fs.lstatSync(info.path);
+    return current.isDirectory()
+      && !current.isSymbolicLink()
+      && current.dev === info.stat.dev
+      && current.ino === info.stat.ino;
+  } catch {
+    return false;
+  }
+}
+
+function ensureRealDirectory(directory, { create = false } = {}) {
+  const resolved = path.resolve(String(directory || ""));
+  if (create) fs.mkdirSync(resolved, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(resolved);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error("Refusing to use a symbolic-link Agentlas session directory.");
+  }
+  return { path: resolved, stat, realpath: fs.realpathSync.native(resolved) };
+}
+
+function ensureAuthDirectory({ create = false } = {}) {
+  const root = ensureRealDirectory(userDataDir(), { create });
+  const info = ensureRealDirectory(path.join(root.path, "auth"), { create });
+  // The auth directory must be a child of the configured user-data directory,
+  // not a mounted/symlinked redirect that merely passes the final lstat.
+  if (path.dirname(info.realpath) !== root.realpath) {
+    throw new Error("Refusing to use a redirected Agentlas session directory.");
+  }
+  return info;
+}
+
+function readBoundedFd(fd, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  while (total <= maxBytes) {
+    const want = Math.min(8192, maxBytes - total + 1);
+    const buffer = Buffer.allocUnsafe(want);
+    const count = fs.readSync(fd, buffer, 0, want, null);
+    if (!count) break;
+    total += count;
+    if (total > maxBytes) return null;
+    chunks.push(buffer.subarray(0, count));
+  }
+  return Buffer.concat(chunks, total);
+}
+
+function readPrivateBoundedFile(filePath, maxBytes) {
+  let before;
+  let fd = null;
+  try {
+    before = fs.lstatSync(filePath);
+    if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1 || before.size > maxBytes) return null;
+    fd = fs.openSync(filePath, fs.constants.O_RDONLY | O_NOFOLLOW);
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.nlink !== 1
+      || opened.size > maxBytes || !sameFileIdentity(before, opened)) return null;
+    const contents = readBoundedFd(fd, maxBytes);
+    const after = fs.fstatSync(fd);
+    if (
+      contents === null || !after.isFile() || after.nlink !== 1 || !sameFileIdentity(opened, after) ||
+      after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs ||
+      after.size !== contents.length
+    ) return null;
+    return contents.toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try { fs.closeSync(fd); } catch { /* ignore */ }
+    }
+  }
+}
+
+function writeAll(fd, buffer) {
+  let offset = 0;
+  while (offset < buffer.length) offset += fs.writeSync(fd, buffer, offset, buffer.length - offset);
+}
 
 function validLoginSessionValue(value) {
   return typeof value === "string" && value.length > 0 &&
@@ -230,9 +319,11 @@ function cliSessionPath() {
 function readCliSessionValue() {
   try {
     const p = cliSessionPath();
-    const stat = fs.lstatSync(p);
-    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > MAX_LOGIN_SESSION_BYTES * 2) return null;
-    const j = JSON.parse(fs.readFileSync(p, "utf8"));
+    const authDir = ensureAuthDirectory();
+    const raw = readPrivateBoundedFile(p, MAX_LOGIN_SESSION_FILE_BYTES);
+    if (raw === null) return null;
+    if (!sameDirectoryIdentity(authDir)) return null;
+    const j = JSON.parse(raw);
     return j && validLoginSessionValue(j.value) ? j.value : null;
   } catch {
     return null;
@@ -243,29 +334,56 @@ function saveCliSession(value) {
   if (!validLoginSessionValue(value)) throw new Error("Refusing to save an invalid Agentlas login session value.");
   const p = cliSessionPath();
   // 디렉터리 0700 + 파일 0600 — 기본 umask(0644)로 세션이 world-readable 이 되는 것을 막는다.
-  const dir = path.dirname(p);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const authDir = ensureAuthDirectory({ create: true });
+  const dir = authDir.path;
   try { fs.chmodSync(dir, 0o700); } catch { /* win32 */ }
   const temp = path.join(dir, `.cli-session.${process.pid}.${crypto.randomUUID()}.tmp`);
+  const payload = Buffer.from(JSON.stringify({ version: 1, value, updatedAt: new Date().toISOString() }, null, 2) + "\n", "utf8");
+  if (payload.length > MAX_LOGIN_SESSION_FILE_BYTES) throw new Error("Refusing to save an oversized Agentlas login session.");
+  let fd = null;
   try {
-    fs.writeFileSync(temp, JSON.stringify({ version: 1, value, updatedAt: new Date().toISOString() }, null, 2) + "\n", {
-      encoding: "utf8",
-      mode: 0o600,
-      flag: "wx",
-    });
+    fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | O_NOFOLLOW, 0o600);
+    const created = fs.fstatSync(fd);
+    if (!created.isFile() || created.nlink !== 1) throw new Error("Refusing to create an unsafe Agentlas login session file.");
+    writeAll(fd, payload);
+    fs.fsyncSync(fd);
+    const written = fs.fstatSync(fd);
+    if (!sameFileIdentity(created, written) || written.size !== payload.length) throw new Error("Agentlas login session changed while saving.");
+    fs.closeSync(fd);
+    fd = null;
+    if (!sameDirectoryIdentity(authDir)) throw new Error("Agentlas login session directory changed while saving.");
     fs.renameSync(temp, p);
+    const installed = fs.lstatSync(p);
+    if (installed.isSymbolicLink() || !installed.isFile() || installed.nlink !== 1) throw new Error("Refusing to install an unsafe Agentlas login session file.");
   } catch (error) {
+    if (fd !== null) {
+      try { fs.closeSync(fd); } catch { /* preserve original */ }
+    }
     try { fs.rmSync(temp, { force: true }); } catch { /* preserve original */ }
     throw error;
   }
-  try { fs.chmodSync(p, 0o600); } catch { /* win32 */ }
   return p;
 }
 
 function deleteCliSession() {
   const p = cliSessionPath();
-  if (!fs.existsSync(p)) return { existed: false, path: p };
-  fs.rmSync(p);
+  let authDir;
+  try { authDir = ensureAuthDirectory(); } catch (error) {
+    if (error?.code === "ENOENT") return { existed: false, path: p };
+    throw error;
+  }
+  let stat;
+  try { stat = fs.lstatSync(p); } catch (error) {
+    if (error?.code === "ENOENT") return { existed: false, path: p };
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {
+    throw new Error("Refusing to delete an unsafe Agentlas login session file.");
+  }
+  if (!sameDirectoryIdentity(authDir)) throw new Error("Agentlas login session directory changed while deleting.");
+  const current = fs.lstatSync(p);
+  if (!sameFileIdentity(stat, current)) throw new Error("Agentlas login session changed while deleting.");
+  fs.unlinkSync(p);
   return { existed: true, path: p };
 }
 

package/engine/cloud/hub-client.cjs

@@ -8,9 +8,9 @@
  *  - 업스트림 AbortSignal 전파
  * 세션 쿠키 해석 순서: AGENTLAS_SESSION env → auth/cli-session.v1.json → (레거시) keytar.
  */
-const fs = require("node:fs");
 const path = require("node:path");
 const { userDataDir } = require("../core/paths.cjs");
+const { readJsonFile } = require("../mcp/contract.cjs");
 
 const HUB_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
 const HUB_TIMEOUT_DEFAULTS = Object.freeze({ connectMs: 15_000, idleMs: 30_000, totalMs: 180_000 });
@@ -69,6 +69,7 @@ async function fetchHub(url, init = {}, options = {}) {
   let idleTimer = null;
   let totalTimer = null;
   let reader = null;
+  let iterator = null;
   let terminalError = null;
   let rejectTerminal;
   const terminal = new Promise((_, reject) => { rejectTerminal = reject; });
@@ -106,27 +107,46 @@ async function fetchHub(url, init = {}, options = {}) {
     const chunks = [];
     let bytes = 0;
     armIdle();
+    const acceptChunk = (value) => {
+      armIdle();
+      const chunk = Buffer.from(value || []);
+      bytes += chunk.length;
+      if (bytes > HUB_RESPONSE_MAX_BYTES) {
+        const error = new Error(`Hub 응답이 허용 크기(${HUB_RESPONSE_MAX_BYTES} bytes)를 초과했습니다.`);
+        error.code = "AGENTLAS_HUB_RESPONSE_TOO_LARGE";
+        stop(error);
+        throw error;
+      }
+      chunks.push(chunk);
+    };
     if (response.body && typeof response.body.getReader === "function") {
       reader = response.body.getReader();
       while (true) {
         const part = await Promise.race([reader.read(), terminal]);
         if (part.done) break;
-        armIdle();
-        const chunk = Buffer.from(part.value || []);
-        bytes += chunk.length;
-        if (bytes > HUB_RESPONSE_MAX_BYTES) {
-          const error = new Error(`Hub 응답이 허용 크기(${HUB_RESPONSE_MAX_BYTES} bytes)를 초과했습니다.`);
-          error.code = "AGENTLAS_HUB_RESPONSE_TOO_LARGE";
-          stop(error);
-          throw error;
-        }
-        chunks.push(chunk);
+        acceptChunk(part.value);
       }
+    } else if (response.body && typeof response.body[Symbol.asyncIterator] === "function") {
+      iterator = response.body[Symbol.asyncIterator]();
+      while (true) {
+        // Node streams and test adapters can expose only an async iterator. A
+        // plain `for await` leaves us stuck inside next() after idle/total expiry,
+        // even though the request's AbortController has already fired.
+        const part = await Promise.race([
+          Promise.resolve().then(() => iterator.next()),
+          terminal,
+        ]);
+        if (part.done) break;
+        acceptChunk(part.value);
+      }
+    } else if (response.body == null) {
+      // Standards-compliant empty/HEAD/204 response. There is no body to read.
     } else {
-      const raw = Buffer.from(await Promise.race([response.arrayBuffer(), terminal]));
-      bytes = raw.length;
-      if (bytes > HUB_RESPONSE_MAX_BYTES) throw new Error(`Hub response exceeds the allowed size (${HUB_RESPONSE_MAX_BYTES} bytes).`);
-      chunks.push(raw);
+      // arrayBuffer()/text() allocates the complete attacker-controlled body
+      // before a size check can run, defeating the 16 MiB contract.
+      const error = new Error("Hub response body is not stream-readable; refusing an unbounded buffered read.");
+      error.code = "AGENTLAS_HUB_RESPONSE_NOT_STREAMABLE";
+      throw error;
     }
     if (idleTimer) clearTimeout(idleTimer);
     idleTimer = null;
@@ -143,6 +163,11 @@ async function fetchHub(url, init = {}, options = {}) {
     if (reader && terminalError) {
       try { await reader.cancel(terminalError); } catch { /* ignore */ }
     }
+    if (iterator && terminalError && typeof iterator.return === "function") {
+      // Do not await an untrusted iterator's cleanup hook: the timeout must
+      // remain a hard upper bound even when return() itself never settles.
+      Promise.resolve().then(() => iterator.return()).catch(() => {});
+    }
   }
 }
 
@@ -161,7 +186,7 @@ function cliSessionPath() {
 
 function readCliSessionValue() {
   try {
-    const j = JSON.parse(fs.readFileSync(cliSessionPath(), "utf8"));
+    const { value: j } = readJsonFile(cliSessionPath(), "Agentlas CLI session");
     return (j && typeof j.value === "string" && j.value) || null;
   } catch {
     return null;

package/engine/cloud-assets/cas.cjs

@@ -224,18 +224,27 @@ async function deleteCloudAgent(slug, options = {}) {
   ) {
     throw new Error("Agentlas Cloud delete returned an invalid or mismatched deletion receipt.");
   }
-  const stateValue = state.readCloudAssetState();
   const key = state.cloudDescriptorKey(descriptor);
-  const roots = stateValue.assets[key]?.sourceRoots || [];
+  // The server delete used this exact observed descriptor. Keep its roots even
+  // if another local process advances the same key before the local journal
+  // update; tombstones authenticate the deleted revision, not a later one.
+  const roots = [...(localEntry.sourceRoots || [])];
   const warnings = [];
-  for (const rootPath of roots) {
-    // 톰스톤: 삭제된 베이스는 재저장 시 절대 If-Match 베이스로 재사용되지 않는다.
-    stateValue.deletedBases.push({ rootPath, slug: descriptor.slug, scope: descriptor.scope, cloudId: descriptor.cloudId, revision: descriptor.revision });
-  }
-  delete stateValue.assets[key];
-  stateValue.deletedBases = stateValue.deletedBases.slice(-256);
   try {
-    state.writeCloudAssetState(stateValue);
+    state.updateCloudAssetState((stateValue) => {
+      for (const rootPath of roots) {
+        // 톰스톤: 삭제된 베이스는 재저장 시 절대 If-Match 베이스로 재사용되지 않는다.
+        stateValue.deletedBases.push({ rootPath, slug: descriptor.slug, scope: descriptor.scope, cloudId: descriptor.cloudId, revision: descriptor.revision });
+      }
+      const current = stateValue.assets[key];
+      if (
+        current && current.descriptor.cloudId === descriptor.cloudId &&
+        current.descriptor.revision === descriptor.revision
+      ) {
+        delete stateValue.assets[key];
+      }
+      stateValue.deletedBases = stateValue.deletedBases.slice(-256);
+    });
   } catch (error) {
     const stateError = new Error(
       `Cloud delete committed on the server, but this machine could not persist the deletion tombstone. ` +