agents-bridge 0.3.12 → 0.3.14

package/scripts/windows-acl-json-smoke.mjs

@@ -0,0 +1,54 @@
+// No filesystem, ACL, account, configuration or network access in the probe.
+// Run the exact production batch protocol under Windows PowerShell5.1, with
+// an in-memory inspection fixture so this can run before the full ACL suite.
+import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { resolve, win32 } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { WINDOWS_ACL_BATCH_PROTOCOL } from '../dist/agents/windows-model-control-security.js'
+
+export async function checkWindowsAclBatchProtocol(protocol = WINDOWS_ACL_BATCH_PROTOCOL) {
+  if (process.platform !== 'win32') throw new Error('WINDOWS_NATIVE_REQUIRED: run with native Windows PowerShell5.1')
+  const cases = [1, 2, 3].map(count => Array.from({ length: count }, (_, index) => ({
+    index, path: `C:\\fixture (中文)\\Agent & ${index}`, kind: index % 2 ? 'file' : 'directory', privateDirectory: index === 0,
+  })))
+  const script = `
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+if ($PSVersionTable.PSVersion.Major -ne 5 -or $PSVersionTable.PSVersion.Minor -ne 1) { throw 'WINDOWS_POWERSHELL_5_1_REQUIRED' }
+function Inspect-ControlAcl($target, $kind, $privateDirectory) {
+  @{ target=$target; kind=$kind; privateDirectory=$privateDirectory }
+}
+$payloads = ConvertFrom-Json -InputObject $env:WMC01_JSON_CASES
+foreach ($payload in $payloads) {
+  $env:AGENTS_BRIDGE_ACL_REQUESTS = $payload
+  ${protocol}
+}
+`
+  const executable = win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+  const { stdout } = await promisify(execFile)(executable, [
+    '-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64'),
+  ], { env: { ...process.env, WMC01_JSON_CASES: JSON.stringify(cases.map(entries => JSON.stringify(entries))) }, windowsHide: true, timeout: 30_000, maxBuffer: 64 * 1024 })
+  const replies = stdout.replace(/^\uFEFF/, '').trim().split(/\r?\n/).map(line => JSON.parse(line))
+  assert.equal(replies.length, cases.length)
+  replies.forEach((reply, caseIndex) => {
+    assert.ok(Array.isArray(reply)); assert.equal(reply.length, cases[caseIndex].length)
+    reply.forEach((entry, index) => {
+      assert.equal(entry.index, index); assert.equal(entry.ok, true)
+      const expected = cases[caseIndex][index]
+      assert.deepEqual(entry.snapshot, { target: expected.path, kind: expected.kind, privateDirectory: expected.privateDirectory })
+    })
+  })
+  return { status: 'PASSED', host: 'Windows PowerShell5.1', requestCounts: [1, 2, 3], stateOrAclChanges: false, networkCalls: 0 }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  if (process.platform !== 'win32') {
+    console.error('WINDOWS_NATIVE_REQUIRED: run with native Windows PowerShell5.1')
+    process.exitCode = 2
+  } else {
+    console.log(JSON.stringify(await checkWindowsAclBatchProtocol()))
+  }
+}

package/scripts/windows-log-diagnostics.mjs

@@ -0,0 +1,23 @@
+// Read-only diagnostic: no locale changes, no repair/re-encoding of existing logs.
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+const [mode, path] = process.argv.slice(2)
+if (!path || !['--inspect', '--fixture'].includes(mode)) {
+  console.error('Usage: node scripts/windows-log-diagnostics.mjs --inspect FILE | --fixture NEW_FILE')
+  process.exit(2)
+}
+if (mode === '--fixture') {
+  writeFileSync(path, JSON.stringify({ msg: '中文日志 😀 mixed English 日本語', marker: 'WEM01' }) + '\n', { encoding: 'utf8', flag: 'wx' })
+}
+const bytes = readFileSync(path)
+let text
+try { text = new TextDecoder('utf-8', { fatal: true }).decode(bytes) }
+catch { console.log(JSON.stringify({ validUtf8: false, bytes: bytes.length, diagnosis: 'Not valid UTF-8; preserve source bytes and check writer/redirection encoding.' })); process.exit(1) }
+let invalidJsonLines = 0
+const lines = text.split(/\r?\n/).filter(Boolean)
+for (const line of lines) { try { JSON.parse(line) } catch { invalidJsonLines++ } }
+console.log(JSON.stringify({ platform: process.platform, node: process.version, validUtf8: true,
+  bytes: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'),
+  lines: lines.length, invalidJsonLines, replacementCharacters: [...text].filter(c => c === '\ufffd').length,
+  diagnosis: 'Valid UTF-8 does not prove source text is correct. Compare original source; explicitly read as UTF-8 in the viewer.' }))
+if (invalidJsonLines) process.exitCode = 1

package/scripts/windows-smoke.mjs

@@ -1,3 +1,4 @@
+import { checkWindowsAclBatchProtocol } from './windows-acl-json-smoke.mjs'
 // Run against the built/installed package on native Windows. No real model,
 // registry request, production account, or current Bridge configuration is used.
 import assert from 'node:assert/strict'
@@ -9,7 +10,7 @@ import { tmpdir } from 'node:os'
 import { join, win32 } from 'node:path'
 import { once } from 'node:events'
 import { spawn } from '../dist/agents/platform-spawn.js'
-import { ensureWindowsModelControlSecurity } from '../dist/agents/windows-model-control-security.js'
+import { ensureWindowsModelControlSecurity, WINDOWS_ACL_BATCH_PROTOCOL } from '../dist/agents/windows-model-control-security.js'
 import { createModelControlFileAccess } from '../dist/agents/model-control-files.js'
 import { agentStatePath } from '../dist/config/paths.js'
 import { automaticModelControl } from '../dist/agents/model-auto-binding.js'
@@ -209,3 +210,18 @@ test('native batched ACL isolates rejected target and preserves healthy peers',
   await ensureWindowsModelControlSecurity(root, 'directory')
   progress('batched ACL failure isolation and subsequent check completed')
 })
+
+
+test('native Windows PowerShell5.1 production batch protocol enumerates1/2/3requests with scalar indexes', { timeout: 60_000 }, async () => {
+  const nested = WINDOWS_ACL_BATCH_PROTOCOL.replace(
+    '$requests = ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS',
+    '$requests = @(ConvertFrom-Json -InputObject $env:AGENTS_BRIDGE_ACL_REQUESTS)',
+  )
+  assert.notEqual(nested, WINDOWS_ACL_BATCH_PROTOCOL)
+  // Execute the prior broken protocol too: only an actual shape assertion
+  // failure is accepted, never a missing host/process or script error.
+  await assert.rejects(checkWindowsAclBatchProtocol(nested), { code: 'ERR_ASSERTION' })
+  const result = await checkWindowsAclBatchProtocol()
+  assert.deepEqual(result.requestCounts, [1, 2, 3])
+  progress('Windows PowerShell5.1 production batch JSON shapes passed1/2/3requests')
+})