agentxchain 2.155.73 → 2.156.0

package/src/lib/verification-replay.js

@@ -8,7 +8,7 @@ import { isOperationalPath } from './repo-observer.js';
 
 export const DEFAULT_VERIFICATION_REPLAY_TIMEOUT_MS = 30_000;
 
-export function replayVerificationMachineEvidence({ root, verification, timeoutMs = DEFAULT_VERIFICATION_REPLAY_TIMEOUT_MS }) {
+export function replayVerificationMachineEvidence({ root, verification, timeoutMs = DEFAULT_VERIFICATION_REPLAY_TIMEOUT_MS, allowCommandExecution = false }) {
   const verifiedAt = new Date().toISOString();
   const machineEvidence = Array.isArray(verification?.machine_evidence)
     ? verification.machine_evidence
@@ -28,6 +28,27 @@ export function replayVerificationMachineEvidence({ root, verification, timeoutM
     return payload;
   }
 
+  // SECURITY (verification-replay hardening): agent-declared machine_evidence
+  // commands are UNTRUSTED. Fail-safe default — they are recorded but NOT executed
+  // unless the operator has explicitly opted in (allowCommandExecution). When
+  // executed, they never run through a shell (see replayEvidenceCommand).
+  if (!allowCommandExecution) {
+    payload.overall = 'not_executed';
+    payload.reason = 'Command replay disabled: agent-declared verification commands are not executed unless explicitly enabled by the operator.';
+    payload.commands = machineEvidence.map((entry, index) => ({
+      index,
+      command: entry?.command ?? null,
+      declared_exit_code: entry?.exit_code,
+      actual_exit_code: null,
+      matched: false,
+      executed: false,
+      timed_out: false,
+      signal: null,
+      error: null,
+    }));
+    return payload;
+  }
+
   const workspaceGuard = createReplayWorkspaceGuard(root);
   try {
     payload.commands = machineEvidence.map((entry, index) => replayEvidenceCommand(root, entry, index, timeoutMs));
@@ -41,11 +62,33 @@ export function replayVerificationMachineEvidence({ root, verification, timeoutM
   return payload;
 }
 
+// SECURITY: agent-declared commands are NEVER run through a shell. The command is
+// resolved to an argv vector and executed with shell:false, so shell metacharacters
+// (; | && $() backticks globs) cannot chain, pipe, expand, or substitute. (A single
+// declared binary still runs on the host — that is gated by the explicit
+// allowCommandExecution opt-in upstream; a future sandbox/allowlist can constrain
+// which binaries are permitted.)
 export function replayEvidenceCommand(root, entry, index, timeoutMs = DEFAULT_VERIFICATION_REPLAY_TIMEOUT_MS) {
-  const result = spawnSync(entry.command, {
+  const argv = resolveEvidenceArgv(entry);
+  if (argv.length === 0) {
+    return {
+      index,
+      command: entry?.command ?? null,
+      declared_exit_code: entry?.exit_code,
+      actual_exit_code: null,
+      matched: false,
+      executed: false,
+      timed_out: false,
+      signal: null,
+      error: 'No executable command or argv vector could be resolved for this evidence entry.',
+    };
+  }
+
+  const [file, ...args] = argv;
+  const result = spawnSync(file, args, {
     cwd: root,
     encoding: 'utf8',
-    shell: true,
+    shell: false,
     timeout: timeoutMs,
     maxBuffer: 1024 * 1024,
   });
@@ -56,16 +99,94 @@ export function replayEvidenceCommand(root, entry, index, timeoutMs = DEFAULT_VE
 
   return {
     index,
-    command: entry.command,
+    command: entry.command ?? argv.join(' '),
     declared_exit_code: entry.exit_code,
     actual_exit_code: actualExitCode,
     matched: actualExitCode === entry.exit_code,
+    executed: true,
     timed_out: timedOut,
     signal: result.signal || null,
     error: errorMessage,
   };
 }
 
+// Resolve an evidence entry to an argv vector for shell-free execution.
+// Prefers a structured `argv` string array; falls back to safe-tokenizing `command`.
+export function resolveEvidenceArgv(entry) {
+  if (Array.isArray(entry?.argv) && entry.argv.length > 0 && entry.argv.every((a) => typeof a === 'string')) {
+    return entry.argv.slice();
+  }
+  if (typeof entry?.command === 'string' && entry.command.trim()) {
+    return tokenizeCommand(entry.command.trim());
+  }
+  return [];
+}
+
+// Minimal SAFE tokenizer: splits on whitespace, honoring single and double quotes
+// and backslash escapes (so e.g. `node -e "{\"ok\":true}"` keeps its escaped quotes).
+// Performs NO shell expansion — variables, globs, pipes, chaining, and command
+// substitution are preserved as literal characters, never interpreted.
+export function tokenizeCommand(command) {
+  if (typeof command !== 'string') {
+    return [];
+  }
+  const tokens = [];
+  let current = '';
+  let hasToken = false;
+  let i = 0;
+  const n = command.length;
+  while (i < n) {
+    const ch = command[i];
+    if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+      if (hasToken) {
+        tokens.push(current);
+        current = '';
+        hasToken = false;
+      }
+      i += 1;
+      continue;
+    }
+    hasToken = true;
+    if (ch === "'") {
+      // Single-quoted: literal run until the next single quote (no escapes, POSIX-style).
+      i += 1;
+      while (i < n && command[i] !== "'") {
+        current += command[i];
+        i += 1;
+      }
+      i += 1; // consume closing quote (or run off the end)
+      continue;
+    }
+    if (ch === '"') {
+      // Double-quoted: backslash escapes only the structural `"` and `\` characters.
+      i += 1;
+      while (i < n && command[i] !== '"') {
+        if (command[i] === '\\' && i + 1 < n && (command[i + 1] === '"' || command[i + 1] === '\\')) {
+          current += command[i + 1];
+          i += 2;
+        } else {
+          current += command[i];
+          i += 1;
+        }
+      }
+      i += 1; // consume closing quote (or run off the end)
+      continue;
+    }
+    if (ch === '\\' && i + 1 < n) {
+      // Bare backslash escape: take the next character literally.
+      current += command[i + 1];
+      i += 2;
+      continue;
+    }
+    current += ch;
+    i += 1;
+  }
+  if (hasToken) {
+    tokens.push(current);
+  }
+  return tokens;
+}
+
 export function summarizeVerificationReplay(payload) {
   if (!payload) {
     return null;

package/src/lib/vision-reader.js

@@ -16,6 +16,11 @@ import { join, resolve as pathResolve, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
 
 const ROADMAP_TRACKING_ANNOTATION_PATTERN = /<!--\s*tracking\s*:[\s\S]*?-->/i;
+// RB-3: a milestone left unchecked but annotated as delivered/done/shipped is
+// already-built work — skip it so the loop derives genuinely undelivered work
+// instead of re-picking finished items. Distinct from generic comments like
+// `<!-- owner: dev -->`, which stay actionable.
+const ROADMAP_DELIVERED_ANNOTATION_PATTERN = /<!--[^>]*\b(delivered|shipped|implemented|completed|done)\b[^>]*-->/i;
 
 export function stripRoadmapTrackingAnnotations(text) {
   if (typeof text !== 'string') return '';
@@ -266,7 +271,7 @@ export function deriveRoadmapCandidates(root, roadmapPath = '.planning/ROADMAP.m
 
     const uncheckedMatch = line.match(/^\s*[-*]\s+\[\s\]\s+(.+?)\s*$/);
     if (!uncheckedMatch || !currentMilestone) continue;
-    if (ROADMAP_TRACKING_ANNOTATION_PATTERN.test(line)) continue;
+    if (ROADMAP_TRACKING_ANNOTATION_PATTERN.test(line) || ROADMAP_DELIVERED_ANNOTATION_PATTERN.test(line)) continue;
 
     const goal = stripRoadmapTrackingAnnotations(uncheckedMatch[1]);
     if (!goal) continue;
@@ -493,7 +498,7 @@ export function detectRoadmapExhaustedVisionOpen(root, visionPath, roadmapPath =
       continue;
     }
     if (currentMilestone && /^\s*[-*]\s+\[\s\]/.test(line)) {
-      if (ROADMAP_TRACKING_ANNOTATION_PATTERN.test(line)) continue;
+      if (ROADMAP_TRACKING_ANNOTATION_PATTERN.test(line) || ROADMAP_DELIVERED_ANNOTATION_PATTERN.test(line)) continue;
       hasUnchecked = true;
     }
   }