agentwheel 0.20.20 → 0.21.2

package/dist/run-as-worker.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+
+// src/transport/run-as-worker.ts
+import { lstat, readdir as readdir2, readFile as readFile2, realpath } from "fs/promises";
+import { isAbsolute, join as join2, parse, relative as relative2, resolve, sep } from "path";
+
+// src/utils/fs.ts
+import { createHash } from "crypto";
+import {
+  copyFile,
+  cp,
+  mkdir,
+  readdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile
+} from "fs/promises";
+import { dirname, join, relative } from "path";
+var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", "__pycache__", ".DS_Store"]);
+var IGNORED_SUFFIXES = [".pyc", ".pyo"];
+async function hashPath(path) {
+  const stats = await stat(path);
+  if (stats.isFile()) {
+    const content = await readFile(path);
+    return createHash("sha256").update("file\0").update(content).digest("hex");
+  }
+  if (!stats.isDirectory()) {
+    throw new Error(`Unsupported path kind: ${path}`);
+  }
+  const hash = createHash("sha256").update("dir\0");
+  const files = await listFiles(path);
+  for (const file of files) {
+    hash.update(relative(path, file).replaceAll("\\", "/")).update("\0");
+    hash.update(await hashPath(file)).update("\0");
+  }
+  return hash.digest("hex");
+}
+async function listFiles(root) {
+  const out = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      if (isIgnoredGeneratedEntry(entry.name)) continue;
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+      } else if (entry.isFile()) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(root);
+  return out;
+}
+function isIgnoredGeneratedEntry(name) {
+  return IGNORED_ENTRY_NAMES.has(name) || IGNORED_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
+// src/transport/run-as-worker.ts
+async function containedReadPath(root, requested) {
+  if (!isAbsolute(root) || resolve(root) !== root || !requested || requested.includes("\0") || requested.includes("\\") || isAbsolute(requested) || requested !== "." && requested.split(sep).some((part) => part === ".." || part === "." || part === "")) {
+    throw new Error("Run-as read path is not a contained relative path.");
+  }
+  let current = parse(root).root;
+  for (const part of root.slice(current.length).split(sep).filter(Boolean)) {
+    current = join2(current, part);
+    if ((await lstat(current)).isSymbolicLink()) throw new Error("Run-as root contains a symlink.");
+  }
+  if (await realpath(root) !== root) throw new Error("Run-as root changed.");
+  if (requested === ".") return root;
+  current = root;
+  for (const part of requested.split(sep)) {
+    current = join2(current, part);
+    try {
+      if ((await lstat(current)).isSymbolicLink()) throw new Error("Run-as path contains a symlink.");
+    } catch (error) {
+      if (error.code === "ENOENT") break;
+      throw error;
+    }
+  }
+  const rel = relative2(root, current);
+  if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error("Run-as path escapes target root.");
+  return current;
+}
+async function rejectNestedLinks(path) {
+  const stat2 = await lstat(path);
+  if (stat2.isSymbolicLink()) throw new Error("Run-as read path contains a symlink.");
+  if (!stat2.isDirectory()) return;
+  for (const entry of await readdir2(path)) await rejectNestedLinks(join2(path, entry));
+}
+async function executeRead(root, request) {
+  if (request.version !== 1 || !["pathExists", "hashPath", "readFile", "listDir"].includes(request.operation)) {
+    throw new Error("Unsupported run-as read protocol request.");
+  }
+  const path = await containedReadPath(root, request.path);
+  let exists = true;
+  try {
+    await lstat(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    exists = false;
+  }
+  if (request.operation === "pathExists") return exists;
+  if (request.operation === "listDir" && !exists) return [];
+  if (!exists) throw new Error("Run-as target path does not exist.");
+  if (request.operation === "hashPath") {
+    await rejectNestedLinks(path);
+    return hashPath(path);
+  }
+  if (request.operation === "readFile") {
+    if (!(await lstat(path)).isFile()) throw new Error("Run-as readFile requires a regular file.");
+    return readFile2(path, "utf8");
+  }
+  return readdir2(path);
+}
+async function main() {
+  const [flagRoot, root, flagUid, rawUid, flagGid, rawGid] = process.argv.slice(2);
+  if (flagRoot !== "--root" || flagUid !== "--uid" || flagGid !== "--gid" || !root || !rawUid || !rawGid || process.argv.length !== 8) {
+    throw new Error("Invalid run-as worker arguments.");
+  }
+  const uid = Number(rawUid);
+  const gid = Number(rawGid);
+  if (!Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid < 0 || process.getuid?.() !== uid || process.getgid?.() !== gid || (await lstat(root)).uid !== uid) {
+    throw new Error("Run-as worker UID or root ownership mismatch.");
+  }
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    if (size > 65536) throw new Error("Run-as request exceeds 64 KiB.");
+    chunks.push(chunk);
+  }
+  const request = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  const result = await executeRead(root, request);
+  process.stdout.write(`${JSON.stringify({ version: 1, result })}
+`);
+}
+if (process.argv[1] && /run-as-worker\.(?:js|mjs|ts)$/.test(process.argv[1])) {
+  main().catch((error) => {
+    process.stderr.write(`run-as worker: ${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  });
+}
+export {
+  containedReadPath,
+  executeRead
+};

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.20.20",
+  "version": "0.21.2",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.20.20",
+  "version": "0.21.2",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.20"
+  version: "0.21.2"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.20"
+  version: "0.21.2"
 ---
 
 # Agentwheel Discovery

package/dist/apply-Z5GVCPA4.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-import {
-  applyCombinedInstallPlan,
-  applyInstallPlan,
-  commitManifestMetadataJournal,
-  recoverPendingApply,
-  uninstall
-} from "./chunk-45WVSUJA.js";
-import "./chunk-FGFPAZ4J.js";
-import "./chunk-BNIF3FUR.js";
-export {
-  applyCombinedInstallPlan,
-  applyInstallPlan,
-  commitManifestMetadataJournal,
-  recoverPendingApply,
-  uninstall
-};