agents-bridge 0.3.12 → 0.3.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agents/windows-model-control-security.d.ts +1 -0
- package/dist/agents/windows-model-control-security.d.ts.map +1 -1
- package/dist/agents/windows-model-control-security.js +20 -15
- package/dist/agents/windows-model-control-security.js.map +1 -1
- package/package.json +3 -2
- package/scripts/windows-acl-json-smoke.mjs +54 -0
- package/scripts/windows-smoke.mjs +17 -1
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
export declare const WINDOWS_ACL_BATCH_PROTOCOL = "\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)\n# Windows PowerShell5.1 preserves a JSON array as one pipeline object.\n# Assignment lets foreach enumerate its elements; @() would add a nested array.\n$requests = ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS\n$results = @(foreach ($request in $requests) {\n try {\n $snapshot = Inspect-ControlAcl $request.path $request.kind $request.privateDirectory\n @{ index = $request.index; ok = $true; snapshot = $snapshot }\n } catch {\n # Only the Node side's fixed marker allowlist may reach logs.\n @{ index = $request.index; ok = $false; error = $_.Exception.Message }\n }\n})\nConvertTo-Json -InputObject $results -Depth 8 -Compress\n";
|
|
1
2
|
export declare function sameWindowsModelControlPath(left: string, right: string): boolean;
|
|
2
3
|
export declare function validateWindowsModelControlAcl(value: unknown, kind?: 'directory' | 'file'): void;
|
|
3
4
|
type AclTarget = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"windows-model-control-security.d.ts","sourceRoot":"","sources":["../../src/agents/windows-model-control-security.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"windows-model-control-security.d.ts","sourceRoot":"","sources":["../../src/agents/windows-model-control-security.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,0BAA0B,wyBAiBtC,CAAA;AA8FD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhF;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,WAAW,GAAG,MAAe,GAAG,IAAI,CA+BxG;AAED,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAAA;AAiBxF,gFAAgF;AAChF,wBAAgB,iCAAiC,CAAC,QAAQ,GAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,OAAO,CAAC,OAAO,CAAgB,IAsC3G,MAAM,MAAM,EAAE,OAAM,WAAW,GAAG,MAAe,EAAE,0BAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAQpG;AAED,eAAO,MAAM,iCAAiC,SAV9B,MAAM,SAAQ,WAAW,GAAG,MAAM,iCAAsC,OAAO,CAAC,IAAI,CAUhB,CAAA"}
|
|
@@ -3,6 +3,25 @@ import { win32 } from 'node:path';
|
|
|
3
3
|
import { promisify } from 'node:util';
|
|
4
4
|
const execute = promisify(execFile);
|
|
5
5
|
const TRUSTED_SYSTEM_SIDS = new Set(['S-1-5-18', 'S-1-5-32-544']); // SYSTEM, Administrators
|
|
6
|
+
// Shared with the native PowerShell5.1 wire-format regression.
|
|
7
|
+
export const WINDOWS_ACL_BATCH_PROTOCOL = `
|
|
8
|
+
$ErrorActionPreference = 'Stop'
|
|
9
|
+
$ProgressPreference = 'SilentlyContinue'
|
|
10
|
+
[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
|
|
11
|
+
# Windows PowerShell5.1 preserves a JSON array as one pipeline object.
|
|
12
|
+
# Assignment lets foreach enumerate its elements; @() would add a nested array.
|
|
13
|
+
$requests = ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS
|
|
14
|
+
$results = @(foreach ($request in $requests) {
|
|
15
|
+
try {
|
|
16
|
+
$snapshot = Inspect-ControlAcl $request.path $request.kind $request.privateDirectory
|
|
17
|
+
@{ index = $request.index; ok = $true; snapshot = $snapshot }
|
|
18
|
+
} catch {
|
|
19
|
+
# Only the Node side's fixed marker allowlist may reach logs.
|
|
20
|
+
@{ index = $request.index; ok = $false; error = $_.Exception.Message }
|
|
21
|
+
}
|
|
22
|
+
})
|
|
23
|
+
ConvertTo-Json -InputObject $results -Depth 8 -Compress
|
|
24
|
+
`;
|
|
6
25
|
// Use SIDs rather than localized account names. Inspect inherited ACEs too; a
|
|
7
26
|
// Unix mode returned by stat on Windows says nothing about the actual DACL.
|
|
8
27
|
const INSPECT_ACL = `
|
|
@@ -93,21 +112,7 @@ $rules = @($acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentif
|
|
|
93
112
|
repairAttempted = $repairAttempted
|
|
94
113
|
}
|
|
95
114
|
}
|
|
96
|
-
|
|
97
|
-
$ProgressPreference = 'SilentlyContinue'
|
|
98
|
-
[Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
|
|
99
|
-
$requests = @(ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS)
|
|
100
|
-
$results = @(foreach ($request in $requests) {
|
|
101
|
-
try {
|
|
102
|
-
$snapshot = Inspect-ControlAcl $request.path $request.kind $request.privateDirectory
|
|
103
|
-
@{ index = $request.index; ok = $true; snapshot = $snapshot }
|
|
104
|
-
} catch {
|
|
105
|
-
# Only the Node side's fixed marker allowlist may reach logs.
|
|
106
|
-
@{ index = $request.index; ok = $false; error = $_.Exception.Message }
|
|
107
|
-
}
|
|
108
|
-
})
|
|
109
|
-
ConvertTo-Json -InputObject $results -Depth 8 -Compress
|
|
110
|
-
`;
|
|
115
|
+
` + WINDOWS_ACL_BATCH_PROTOCOL;
|
|
111
116
|
export function sameWindowsModelControlPath(left, right) {
|
|
112
117
|
return win32.normalize(left).toLowerCase() === win32.normalize(right).toLowerCase();
|
|
113
118
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"windows-model-control-security.js","sourceRoot":"","sources":["../../src/agents/windows-model-control-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AACnC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAA,CAAC,yBAAyB;AAE3F,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,WAAW,GAAG
|
|
1
|
+
{"version":3,"file":"windows-model-control-security.js","sourceRoot":"","sources":["../../src/agents/windows-model-control-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AACnC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAA,CAAC,yBAAyB;AAE3F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;CAiBzC,CAAA;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwFnB,GAAG,0BAA0B,CAAA;AAE9B,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,KAAa;IACrE,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;AACrF,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc,EAAE,OAA6B,MAAM;IAChG,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,uCAAuC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAA;IACpH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAA;IACxD,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;WAC7E,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAA;IACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,CAAC,mBAAmB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChF,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,KAAgC,CAAA;QAC7C,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;eAC5D,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;eACxE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU;YAAE,MAAM,OAAO,EAAE,CAAA;QACnH,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC9C,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,yEAAyE;YACzE,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAA;YAC3D,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,iBAAiB,KAAK,CAAC,CAAC;gBAAE,MAAM,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACxI,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,cAAc,GAAG,IAAI,CAAA;IAC9C,CAAC;IACD,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAA;AACtC,CAAC;AAID,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAA;AACtH,MAAM,YAAY,GAAG,CAAC,yCAAyC,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,iCAAiC,CAAC,CAAA;AAEnK,KAAK,UAAU,YAAY,CAAC,OAAoB;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACjI,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;QAC3C,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACtH,EAAE;QACD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3H,wEAAwE;QACxE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI;KAC3E,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iCAAiC,CAAC,WAAuD,YAAY;IAEnH,MAAM,KAAK,GAAc,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,UAAU,KAAK;QAClB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;YACjF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC/G,iEAAiE;gBACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAClF,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS;oBAChE,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;oBAAE,MAAM,WAAW,EAAE,CAAA;gBACtE,MAAM,OAAO,GAAG,GAAoB,CAAA;gBACpC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;oBAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;oBAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;wBACzD,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC;wBAAC,8BAA8B,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;wBAAC,MAAM,CAAC,OAAO,EAAE,CAAA;oBAAC,CAAC;oBACtF,OAAO,KAAK,EAAE,CAAC;wBACb,MAAM,SAAS,GAAI,MAAM,CAAC,QAAiD,EAAE,eAAe,KAAK,IAAI,CAAA;wBACrG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAI,KAAe,CAAC,OAAO,sBAAsB,MAAM,CAAC,gBAAgB,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAA;oBACnI,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;IACD,OAAO,CAAC,IAAY,EAAE,OAA6B,MAAM,EAAE,gBAAgB,GAAG,KAAK,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAA;YACf,2DAA2D;YAC3D,YAAY,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,iCAAiC,EAAE,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agents-bridge",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.13",
|
|
4
4
|
"description": "Local Agent Gateway for botlink platform",
|
|
5
5
|
"homepage": "http://git.51baiwang.com/sk-spec-driven/agent-bridge",
|
|
6
6
|
"repository": {
|
|
@@ -36,7 +36,8 @@
|
|
|
36
36
|
"config.multi-agent.example.json",
|
|
37
37
|
".env.example",
|
|
38
38
|
"scripts/windows-smoke.mjs",
|
|
39
|
-
"scripts/inspect-model-device-secret.mjs"
|
|
39
|
+
"scripts/inspect-model-device-secret.mjs",
|
|
40
|
+
"scripts/windows-acl-json-smoke.mjs"
|
|
40
41
|
],
|
|
41
42
|
"scripts": {
|
|
42
43
|
"build": "node ./scripts/build.mjs",
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
// No filesystem, ACL, account, configuration or network access in the probe.
|
|
2
|
+
// Run the exact production batch protocol under Windows PowerShell5.1, with
|
|
3
|
+
// an in-memory inspection fixture so this can run before the full ACL suite.
|
|
4
|
+
import assert from 'node:assert/strict'
|
|
5
|
+
import { execFile } from 'node:child_process'
|
|
6
|
+
import { promisify } from 'node:util'
|
|
7
|
+
import { resolve, win32 } from 'node:path'
|
|
8
|
+
import { fileURLToPath } from 'node:url'
|
|
9
|
+
import { WINDOWS_ACL_BATCH_PROTOCOL } from '../dist/agents/windows-model-control-security.js'
|
|
10
|
+
|
|
11
|
+
export async function checkWindowsAclBatchProtocol(protocol = WINDOWS_ACL_BATCH_PROTOCOL) {
|
|
12
|
+
if (process.platform !== 'win32') throw new Error('WINDOWS_NATIVE_REQUIRED: run with native Windows PowerShell5.1')
|
|
13
|
+
const cases = [1, 2, 3].map(count => Array.from({ length: count }, (_, index) => ({
|
|
14
|
+
index, path: `C:\\fixture (中文)\\Agent & ${index}`, kind: index % 2 ? 'file' : 'directory', privateDirectory: index === 0,
|
|
15
|
+
})))
|
|
16
|
+
const script = `
|
|
17
|
+
$ErrorActionPreference='Stop'
|
|
18
|
+
$ProgressPreference='SilentlyContinue'
|
|
19
|
+
[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
|
|
20
|
+
if ($PSVersionTable.PSVersion.Major -ne 5 -or $PSVersionTable.PSVersion.Minor -ne 1) { throw 'WINDOWS_POWERSHELL_5_1_REQUIRED' }
|
|
21
|
+
function Inspect-ControlAcl($target, $kind, $privateDirectory) {
|
|
22
|
+
@{ target=$target; kind=$kind; privateDirectory=$privateDirectory }
|
|
23
|
+
}
|
|
24
|
+
$payloads = ConvertFrom-Json -InputObject $env:WMC01_JSON_CASES
|
|
25
|
+
foreach ($payload in $payloads) {
|
|
26
|
+
$env:AGENTS_BRIDGE_ACL_REQUESTS = $payload
|
|
27
|
+
${protocol}
|
|
28
|
+
}
|
|
29
|
+
`
|
|
30
|
+
const executable = win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
|
|
31
|
+
const { stdout } = await promisify(execFile)(executable, [
|
|
32
|
+
'-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64'),
|
|
33
|
+
], { env: { ...process.env, WMC01_JSON_CASES: JSON.stringify(cases.map(entries => JSON.stringify(entries))) }, windowsHide: true, timeout: 30_000, maxBuffer: 64 * 1024 })
|
|
34
|
+
const replies = stdout.replace(/^\uFEFF/, '').trim().split(/\r?\n/).map(line => JSON.parse(line))
|
|
35
|
+
assert.equal(replies.length, cases.length)
|
|
36
|
+
replies.forEach((reply, caseIndex) => {
|
|
37
|
+
assert.ok(Array.isArray(reply)); assert.equal(reply.length, cases[caseIndex].length)
|
|
38
|
+
reply.forEach((entry, index) => {
|
|
39
|
+
assert.equal(entry.index, index); assert.equal(entry.ok, true)
|
|
40
|
+
const expected = cases[caseIndex][index]
|
|
41
|
+
assert.deepEqual(entry.snapshot, { target: expected.path, kind: expected.kind, privateDirectory: expected.privateDirectory })
|
|
42
|
+
})
|
|
43
|
+
})
|
|
44
|
+
return { status: 'PASSED', host: 'Windows PowerShell5.1', requestCounts: [1, 2, 3], stateOrAclChanges: false, networkCalls: 0 }
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
|
48
|
+
if (process.platform !== 'win32') {
|
|
49
|
+
console.error('WINDOWS_NATIVE_REQUIRED: run with native Windows PowerShell5.1')
|
|
50
|
+
process.exitCode = 2
|
|
51
|
+
} else {
|
|
52
|
+
console.log(JSON.stringify(await checkWindowsAclBatchProtocol()))
|
|
53
|
+
}
|
|
54
|
+
}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { checkWindowsAclBatchProtocol } from './windows-acl-json-smoke.mjs'
|
|
1
2
|
// Run against the built/installed package on native Windows. No real model,
|
|
2
3
|
// registry request, production account, or current Bridge configuration is used.
|
|
3
4
|
import assert from 'node:assert/strict'
|
|
@@ -9,7 +10,7 @@ import { tmpdir } from 'node:os'
|
|
|
9
10
|
import { join, win32 } from 'node:path'
|
|
10
11
|
import { once } from 'node:events'
|
|
11
12
|
import { spawn } from '../dist/agents/platform-spawn.js'
|
|
12
|
-
import { ensureWindowsModelControlSecurity } from '../dist/agents/windows-model-control-security.js'
|
|
13
|
+
import { ensureWindowsModelControlSecurity, WINDOWS_ACL_BATCH_PROTOCOL } from '../dist/agents/windows-model-control-security.js'
|
|
13
14
|
import { createModelControlFileAccess } from '../dist/agents/model-control-files.js'
|
|
14
15
|
import { agentStatePath } from '../dist/config/paths.js'
|
|
15
16
|
import { automaticModelControl } from '../dist/agents/model-auto-binding.js'
|
|
@@ -209,3 +210,18 @@ test('native batched ACL isolates rejected target and preserves healthy peers',
|
|
|
209
210
|
await ensureWindowsModelControlSecurity(root, 'directory')
|
|
210
211
|
progress('batched ACL failure isolation and subsequent check completed')
|
|
211
212
|
})
|
|
213
|
+
|
|
214
|
+
|
|
215
|
+
test('native Windows PowerShell5.1 production batch protocol enumerates1/2/3requests with scalar indexes', { timeout: 60_000 }, async () => {
|
|
216
|
+
const nested = WINDOWS_ACL_BATCH_PROTOCOL.replace(
|
|
217
|
+
'$requests = ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS',
|
|
218
|
+
'$requests = @(ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS)',
|
|
219
|
+
)
|
|
220
|
+
assert.notEqual(nested, WINDOWS_ACL_BATCH_PROTOCOL)
|
|
221
|
+
// Execute the prior broken protocol too: only an actual shape assertion
|
|
222
|
+
// failure is accepted, never a missing host/process or script error.
|
|
223
|
+
await assert.rejects(checkWindowsAclBatchProtocol(nested), { code: 'ERR_ASSERTION' })
|
|
224
|
+
const result = await checkWindowsAclBatchProtocol()
|
|
225
|
+
assert.deepEqual(result.requestCounts, [1, 2, 3])
|
|
226
|
+
progress('Windows PowerShell5.1 production batch JSON shapes passed1/2/3requests')
|
|
227
|
+
})
|