agents-bridge 0.3.11 → 0.3.13

package/scripts/windows-smoke.mjs

@@ -1,3 +1,4 @@
+import { checkWindowsAclBatchProtocol } from './windows-acl-json-smoke.mjs'
 // Run against the built/installed package on native Windows. No real model,
 // registry request, production account, or current Bridge configuration is used.
 import assert from 'node:assert/strict'
@@ -9,7 +10,9 @@ import { tmpdir } from 'node:os'
 import { join, win32 } from 'node:path'
 import { once } from 'node:events'
 import { spawn } from '../dist/agents/platform-spawn.js'
+import { ensureWindowsModelControlSecurity, WINDOWS_ACL_BATCH_PROTOCOL } from '../dist/agents/windows-model-control-security.js'
 import { createModelControlFileAccess } from '../dist/agents/model-control-files.js'
+import { agentStatePath } from '../dist/config/paths.js'
 import { automaticModelControl } from '../dist/agents/model-auto-binding.js'
 import { DefaultCodexAppServerConnection } from '../dist/agents/codex-app-server-runtime.js'
 import { terminateProcess } from '../dist/agents/process-tree.js'
@@ -23,31 +26,78 @@ if (process.platform !== 'win32') {
 }
 const execute = promisify(execFile)
 const powershell = win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe')
-const ps = async (script, path) => (await execute(powershell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from("$ErrorActionPreference='Stop';" + script, 'utf16le').toString('base64')], { env: { ...process.env, WMC01_TEST_PATH: path }, windowsHide: true, timeout: 15_000 })).stdout.trim()
-const grant = rights => `$p=$env:WMC01_TEST_PATH; $a=Get-Acl -LiteralPath $p; $sid=[Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'); $r=[Security.AccessControl.FileSystemAccessRule]::new($sid,[Security.AccessControl.FileSystemRights]::${rights},[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow); $a.AddAccessRule($r); Set-Acl -LiteralPath $p -AclObject $a;`
-const fixture = async t => {
+// Persist a fresh Access-only object through .NET so fixture preparation also
+// works without SeSecurityPrivilege on an already protected DACL.
+const accessOnlyFixtureScript = `
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
+function Set-TestAccess($path, $acl) {
+  $item = Get-Item -LiteralPath $path -Force
+  if ($item -is [IO.DirectoryInfo]) { $accessOnly = [Security.AccessControl.DirectorySecurity]::new() }
+  else { $accessOnly = [Security.AccessControl.FileSecurity]::new() }
+  $section = [Security.AccessControl.AccessControlSections]::Access
+  $accessOnly.SetSecurityDescriptorSddlForm($acl.GetSecurityDescriptorSddlForm($section), $section)
+  $item.SetAccessControl($accessOnly)
+}
+`
+const ps = async (script, path) => (await execute(powershell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(accessOnlyFixtureScript + script, 'utf16le').toString('base64')], { env: { ...process.env, WMC01_TEST_PATH: path }, windowsHide: true, timeout: 15_000 })).stdout.trim()
+const grant = rights => `$p=$env:WMC01_TEST_PATH; $a=Get-Acl -LiteralPath $p; $sid=[Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'); $r=[Security.AccessControl.FileSystemAccessRule]::new($sid,[Security.AccessControl.FileSystemRights]::${rights},[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow); $a.AddAccessRule($r); Set-TestAccess $p $a;`
+const fixture = async (t, waitForOperations = async () => {}) => {
   const root = await mkdtemp(join(await realpath(tmpdir()), 'Bridge Win (中文) '))
-  t.after(() => rm(root, { recursive: true, force: true }))
+  t.after(async () => { await waitForOperations(); await rm(root, { recursive: true, force: true }) })
+  // Establish a private DACL on this newly created fixture only. Host TEMP
+  // directories may grant Modify to another local account or domain group.
+  await ps(`$p=$env:WMC01_TEST_PATH; $a=[Security.AccessControl.DirectorySecurity]::new(); $a.SetAccessRuleProtection($true,$false); $current=[Security.Principal.WindowsIdentity]::GetCurrent().User; foreach($sid in @($current.Value,'S-1-5-18','S-1-5-32-544')) { $identity=[Security.Principal.SecurityIdentifier]::new($sid); $r=[Security.AccessControl.FileSystemAccessRule]::new($identity,[Security.AccessControl.FileSystemRights]::FullControl,[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow); [void]$a.AddAccessRule($r) }; Set-TestAccess $p $a`, root)
   return root
 }
 const logger = { info() {}, warn() {}, debug() {}, error() {} }
+// Direct TAP comments flush while a test is running; t.diagnostic may buffer.
+const progress = text => process.stdout.write(`# WMC01_SMOKE ${text}\n`)
 
 test('native ACL: Users read directory, private controls, 12 Agent secret reuse, unsafe writes refused', { timeout: 300_000 }, async t => {
-  const root = await fixture(t)
+  const operations = [], started = Date.now()
+  const root = await fixture(t, () => Promise.allSettled(operations))
   await ps(grant('ReadAndExecute'), root)
   const directoryAcl = await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', root)
   const ids = Array.from({ length: 12 }, (_, i) => 'test-agent-' + i)
   const config = { agents: { defaults: { model: { primary: 'claude-cli/sonnet' } }, list: ids.map((id, i) => ({ id, default: i === 0 })) }, channels: { botlink: { accounts: Object.fromEntries(ids.map(id => [id, { gateway_url: 'https://example.invalid', bot_token: 'dummy-' + id }])) } }, bindings: ids.map(id => ({ agentId: id, match: { channel: 'botlink', accountId: id } })) }
   const before = JSON.stringify(config), secrets = new Set()
   const files = createModelControlFileAccess()
-  for (const id of ids) {
-    const path = join(root, id, 'state.json')
-    const first = await automaticModelControl(config, id, path, logger)
-    const second = await automaticModelControl(config, id, path, logger)
-    assert.ok(first); assert.equal(first.deviceSecret, second.deviceSecret); secrets.add(first.deviceSecret)
-    await files.writeSecureModelControlFile(path, 'state-one')
-    await files.writeSecureModelControlFile(path, 'state-two')
-    assert.equal(await files.readSecureModelControlFile(path), 'state-two')
+  // Independent paths only: at most three real ACL/IO lifecycles at once.
+  // allSettled plus the fixture cleanup hook drain active work on failure or
+  // cancellation instead of allowing timed-out background tests to keep going.
+  for (let offset = 0; offset < ids.length; offset += 3) {
+    t.signal.throwIfAborted()
+    progress(`ACL batch ${offset / 3 + 1}/4 starting; elapsed_ms=${Date.now() - started}`)
+    const batch = ids.slice(offset, offset + 3).map(async id => {
+      t.signal.throwIfAborted()
+      const path = join(root, id, 'state.json')
+      const first = await automaticModelControl(config, id, path, logger)
+      t.signal.throwIfAborted()
+      assert.ok(first)
+      if (id === ids[0]) {
+        // Windows PowerShell can write UTF-16; decoding must retain exactly
+        // the same device identity and leave the existing bytes untouched.
+        await writeFile(path + '.device', Buffer.from('\ufeff' + first.deviceSecret + '\r\n', 'utf16le'))
+      }
+      const bytesBeforeRestart = await readFile(path + '.device')
+      const second = await automaticModelControl(config, id, path, logger)
+      t.signal.throwIfAborted()
+      assert.ok(second); assert.equal(first.deviceSecret, second.deviceSecret); secrets.add(first.deviceSecret)
+      assert.deepEqual(await readFile(path + '.device'), bytesBeforeRestart)
+      if (id === ids[0]) {
+        await files.writeSecureModelControlFile(path, 'state-one')
+        t.signal.throwIfAborted()
+        await files.writeSecureModelControlFile(path, 'state-two')
+        t.signal.throwIfAborted()
+        assert.equal(await files.readSecureModelControlFile(path), 'state-two')
+      }
+      progress(`ACL completed ${id}; elapsed_ms=${Date.now() - started}`)
+    })
+    operations.push(...batch)
+    const results = await Promise.allSettled(batch)
+    for (const result of results) if (result.status === 'rejected') throw result.reason
   }
   assert.equal(secrets.size, 12); assert.equal(JSON.stringify(config), before)
   assert.equal(await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', root), directoryAcl)
@@ -96,3 +146,82 @@ test('native attachment handoff does not call Unix chown, and owned descendant p
   const closed = once(child, 'close'); await terminateProcess(child.pid); await closed
   assert.throws(() => process.kill(descendant, 0), { code: 'ESRCH' })
 })
+
+
+test('native inherited Modify is repaired only on owned Agent state directory, preserving secrets, parent ACL and denies', { timeout: 180_000 }, async t => {
+  const root = await fixture(t), previous = process.env.AGENT_BRIDGE_HOME
+  t.after(() => { if (previous === undefined) delete process.env.AGENT_BRIDGE_HOME; else process.env.AGENT_BRIDGE_HOME = previous })
+  process.env.AGENT_BRIDGE_HOME = join(root, 'bridge-home')
+  await mkdir(process.env.AGENT_BRIDGE_HOME)
+  await ps(grant('Modify'), process.env.AGENT_BRIDGE_HOME)
+  await ps("$p=$env:WMC01_TEST_PATH; $a=Get-Acl -LiteralPath $p; $sid=[Security.Principal.SecurityIdentifier]::new('S-1-5-21-111-222-333-1003'); $r=[Security.AccessControl.FileSystemAccessRule]::new($sid,[Security.AccessControl.FileSystemRights]::Read,[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Deny); [void]$a.AddAccessRule($r); Set-TestAccess $p $a;", process.env.AGENT_BRIDGE_HOME)
+  const parentAcl = await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', process.env.AGENT_BRIDGE_HOME)
+  const directory = agentStatePath('finopdev'); await mkdir(directory, { recursive: true })
+  const path = join(directory, 'cli-sessions.json.model-control.json.device'), session = join(directory, 'cli-sessions.json')
+  await writeFile(path, 'original-device-secret'); await writeFile(session, 'existing-session')
+  // Retain an explicit deny for a foreign SID when converting inherited ACEs.
+  await ps("$p=$env:WMC01_TEST_PATH; $a=Get-Acl -LiteralPath $p; $s=[Security.Principal.SecurityIdentifier]::new('S-1-5-21-111-222-333-1002'); $r=[Security.AccessControl.FileSystemAccessRule]::new($s,[Security.AccessControl.FileSystemRights]::Read,[Security.AccessControl.AccessControlType]::Deny); [void]$a.AddAccessRule($r); Set-TestAccess $p $a;", directory)
+  const beforeRepair = JSON.parse(await ps("$a=Get-Acl -LiteralPath $env:WMC01_TEST_PATH; @{inheritedModify=@($a.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{$_.IsInherited -and $_.IdentityReference.Value -eq 'S-1-5-32-545' -and $_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow -and ([long]$_.FileSystemRights -band 2) -ne 0}).Count; inheritedDenies=@($a.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{$_.IsInherited -and $_.IdentityReference.Value -eq 'S-1-5-21-111-222-333-1003' -and $_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Deny}).Count}|ConvertTo-Json -Compress", directory))
+  assert.ok(beforeRepair.inheritedModify > 0, 'fixture must contain inherited Users Modify before repair')
+  assert.ok(beforeRepair.inheritedDenies > 0, 'fixture must contain inherited Deny before repair')
+  const files = createModelControlFileAccess()
+  assert.equal(await files.readSecureModelControlFile(path), 'original-device-secret')
+  await files.writeSecureModelControlFile(path, 'same-identity')
+  assert.equal(await files.readSecureModelControlFile(path), 'same-identity')
+  assert.equal(await readFile(session, 'utf8'), 'existing-session')
+  assert.equal(await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', process.env.AGENT_BRIDGE_HOME), parentAcl)
+  const snapshot = JSON.parse(await ps("$a=Get-Acl -LiteralPath $env:WMC01_TEST_PATH; @{protected=$a.AreAccessRulesProtected; rules=@($a.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|ForEach-Object{@{sid=$_.IdentityReference.Value;allow=($_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow); inherited=$_.IsInherited}}); current=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value}|ConvertTo-Json -Depth 4 -Compress", directory))
+  assert.equal(snapshot.protected, true)
+  assert.ok(snapshot.rules.some(r => !r.allow && r.sid === 'S-1-5-21-111-222-333-1002'))
+  assert.ok(snapshot.rules.some(r => !r.allow && !r.inherited && r.sid === 'S-1-5-21-111-222-333-1003'))
+  assert.ok(snapshot.rules.every(r => !r.inherited), 'replacement DACL must contain only explicit rules')
+  assert.ok(snapshot.rules.filter(r => r.allow).every(r => [snapshot.current, 'S-1-5-18', 'S-1-5-32-544'].includes(r.sid)))
+  const privateAcl = await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', directory)
+  await files.ensureSecureModelControlDirectory(directory)
+  assert.equal(await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', directory), privateAcl)
+  // Exercise file privatization too: remove an explicit foreign reader while
+  // retaining both inherited and explicit Deny masks and owner/group metadata.
+  await ps("$p=$env:WMC01_TEST_PATH; $a=Get-Acl -LiteralPath $p; $s=[Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'); $r=[Security.AccessControl.FileSystemAccessRule]::new($s,[Security.AccessControl.FileSystemRights]::Read,[Security.AccessControl.AccessControlType]::Allow); [void]$a.AddAccessRule($r); $s=[Security.Principal.SecurityIdentifier]::new('S-1-5-21-111-222-333-1004'); $r=[Security.AccessControl.FileSystemAccessRule]::new($s,[Security.AccessControl.FileSystemRights]::Read,[Security.AccessControl.AccessControlType]::Deny); [void]$a.AddAccessRule($r); Set-TestAccess $p $a;", path)
+  const fileAcl = async () => JSON.parse(await ps("$a=Get-Acl -LiteralPath $env:WMC01_TEST_PATH; @{owner=$a.GetOwner([Security.Principal.SecurityIdentifier]).Value;group=$a.GetGroup([Security.Principal.SecurityIdentifier]).Value;protected=$a.AreAccessRulesProtected;denies=@($a.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{$_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Deny}|ForEach-Object{($_.IdentityReference.Value + ':' + [long]$_.FileSystemRights + ':' + [int]$_.InheritanceFlags + ':' + [int]$_.PropagationFlags)}|Sort-Object);foreignAllows=@($a.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|Where-Object{$_.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow -and $_.IdentityReference.Value -notin @([Security.Principal.WindowsIdentity]::GetCurrent().User.Value,'S-1-5-18','S-1-5-32-544')}).Count}|ConvertTo-Json -Depth 4 -Compress", path))
+  const fileBefore = await fileAcl(); assert.ok(fileBefore.foreignAllows > 0)
+  assert.equal(await files.readSecureModelControlFile(path), 'same-identity')
+  const fileAfter = await fileAcl()
+  assert.equal(fileAfter.foreignAllows, 0); assert.equal(fileAfter.protected, true)
+  assert.equal(fileAfter.owner, fileBefore.owner); assert.equal(fileAfter.group, fileBefore.group)
+  assert.deepEqual(fileAfter.denies, fileBefore.denies)
+  const workspace = join(root, 'workspace'); await mkdir(workspace); await ps(grant('Modify'), workspace)
+  const workspaceAcl = await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', workspace)
+  await assert.rejects(files.createSecureModelControlFile(join(workspace, 'control'), 'never-written'), /directory: unsafe allow/)
+  assert.equal(await ps('(Get-Acl -LiteralPath $env:WMC01_TEST_PATH).Sddl', workspace), workspaceAcl)
+})
+
+
+test('native batched ACL isolates rejected target and preserves healthy peers', { timeout: 90_000 }, async t => {
+  const root = await fixture(t)
+  const checks = await Promise.allSettled([
+    ensureWindowsModelControlSecurity(root, 'directory'),
+    ensureWindowsModelControlSecurity(root, 'file'),
+    ensureWindowsModelControlSecurity(root, 'directory'),
+  ])
+  assert.equal(checks[0].status, 'fulfilled')
+  assert.equal(checks[2].status, 'fulfilled')
+  assert.equal(checks[1].status, 'rejected')
+  assert.match(checks[1].reason.message, /MODEL_CONTROL_UNTRUSTED_OWNER/)
+  await ensureWindowsModelControlSecurity(root, 'directory')
+  progress('batched ACL failure isolation and subsequent check completed')
+})
+
+
+test('native Windows PowerShell5.1 production batch protocol enumerates1/2/3requests with scalar indexes', { timeout: 60_000 }, async () => {
+  const nested = WINDOWS_ACL_BATCH_PROTOCOL.replace(
+    '$requests = ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS',
+    '$requests = @(ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS)',
+  )
+  assert.notEqual(nested, WINDOWS_ACL_BATCH_PROTOCOL)
+  // Execute the prior broken protocol too: only an actual shape assertion
+  // failure is accepted, never a missing host/process or script error.
+  await assert.rejects(checkWindowsAclBatchProtocol(nested), { code: 'ERR_ASSERTION' })
+  const result = await checkWindowsAclBatchProtocol()
+  assert.deepEqual(result.requestCounts, [1, 2, 3])
+  progress('Windows PowerShell5.1 production batch JSON shapes passed1/2/3requests')
+})