akm-cli 0.10.261012-beta → 0.10.261013-beta

package/dist/core/activation-policy.js

@@ -1,67 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * `EDITOR`/`VISUAL`/`PAGER` are flagged by `isDangerousEnvKey` for a
- * documented RCE vector (many tools invoke them to launch an editor/pager),
- * but env-key-rules.ts's own module doc calls out their "high FP rate" in
- * the same breath — an installed bundle's env file can supply a value, but
- * nothing in akm's own env-injection path ever *invokes* EDITOR/VISUAL/PAGER
- * with that value, so the RCE vector these three describe cannot fire from
- * an injected env the way LD_PRELOAD or GIT_SSH_COMMAND can. Blocking a
- * third-party install over them protects nothing while making "the operator
- * legitimately wants to set their editor" the common case that eats the
- * refusal. Kept as a name-level literal set (not an import of
- * `commands/lint/env-key-rules.ts`) so this module stays the pure leaf its
- * own doc comment promises — no new import edges into the rest of the tree.
- */
-const INTERACTIVE_TOOL_ENV_KEYS = new Set(["EDITOR", "VISUAL", "PAGER"]);
-/**
- * Decide whether injecting an env with the given dangerous keys is allowed,
- * warned, or blocked. Third-party (registry-installed) stashes hard-block a
- * genuine RCE-class key; first-party stashes warn. The interactive-tool
- * group (see {@link INTERACTIVE_TOOL_ENV_KEYS}) only ever warns, since akm's
- * own env-injection path never invokes those keys as a command. An explicit
- * `--allow-dangerous-env-keys` (threaded through by the caller, same override
- * `decideDangerousKeyInstall`'s `"warn-allow"` already honors for rule 2)
- * downgrades a remaining block to a warning too — the operator is not racing
- * themselves. See rule 1 above.
- *
- * @param dangerousKeys The subset of injected keys flagged as process-hijacking
- *   (already filtered by the caller via `isDangerousEnvKey`).
- * @param thirdParty `true` when the env's source is a third-party stash — i.e.
- *   its origin carries a `registryId`.
- * @param allowDangerousEnvKeys `true` when the operator passed `--allow-dangerous-env-keys` (or
- *   its equivalent) for this injection. Defaults to `false`.
- */
-export function decideDangerousEnvInjection(input) {
-    if (input.dangerousKeys.length === 0)
-        return "allow";
-    if (!input.thirdParty)
-        return "warn";
-    if (input.allowDangerousEnvKeys)
-        return "warn";
-    const onlyInteractiveTool = input.dangerousKeys.every((key) => INTERACTIVE_TOOL_ENV_KEYS.has(key));
-    return onlyInteractiveTool ? "warn" : "block";
-}
-/**
- * Decide the baseline install stance for a freshly-installed stash's
- * dangerous-key scan. The interactive confirm / rollback UX is applied by the
- * caller on top of the `"gate"` stance — this predicate only fixes the policy.
- * See rule 2 above.
- */
-export function decideDangerousKeyInstall(input) {
-    if (!input.findingsPresent)
-        return "allow";
-    return input.allowDangerousEnvKeys ? "warn-allow" : "gate";
-}
-// ── Rule 3: write activation (search-source.ts, installations.ts) ────────────
-/**
- * Whether a resolved source is write-activated. Only the primary stash and
- * sources explicitly marked `writable: true` are writable; registry-cached
- * (installed, read-only) sources are never written in place because
- * `akm update` overwrites them. See rule 3 above.
- */
-export function isSourceWriteActivated(source) {
-    return source.writable === true;
-}

package/dist/execution/directory-identity.js

@@ -1,78 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import fs from "node:fs";
-import path from "node:path";
-import { UsageError } from "../core/errors.js";
-export function captureFrozenDirectoryIdentity(rootInput, relativeCwd) {
-    const requestedRoot = path.resolve(rootInput);
-    const requestedCwd = path.resolve(requestedRoot, relativeCwd ?? ".");
-    requireContained(requestedRoot, requestedCwd);
-    const realRoot = fs.realpathSync(requestedRoot);
-    const realCwd = fs.realpathSync(requestedCwd);
-    requireContained(realRoot, realCwd);
-    const rootStat = fs.statSync(realRoot, { bigint: true });
-    const cwdStat = fs.statSync(realCwd, { bigint: true });
-    if (!rootStat.isDirectory() || !cwdStat.isDirectory()) {
-        throw new UsageError("Execution root and cwd must both be directories.", "INVALID_FLAG_VALUE");
-    }
-    return Object.freeze({
-        requestedRoot,
-        realRoot,
-        rootDevice: rootStat.dev.toString(),
-        rootInode: rootStat.ino.toString(),
-        requestedCwd,
-        realCwd,
-        cwdDevice: cwdStat.dev.toString(),
-        cwdInode: cwdStat.ino.toString(),
-    });
-}
-/**
- * Re-verify, immediately before spawn, that a frozen cwd still resolves
- * inside its execution root — path containment and resolved-path identity,
- * NOT device/inode identity. Unlike the removed assertFrozenDirectoryIdentity,
- * this does not compare device/inode numbers against the frozen snapshot: a
- * remount, an rsync, or a container rebuild that leaves the same real
- * content at the same real PATH must not abort a dispatch. What still
- * throws is anything that changes the resolved real PATH itself — a
- * symlink swap, an ancestor swap, a file replacing the directory, or the
- * root itself being replaced by a symlink elsewhere (root-vs-cwd
- * containment alone can't catch that last one, since both resolve together
- * under the new root; comparing the root's own resolved path to its frozen
- * value catches it).
- */
-export function assertFrozenDirectoryContained(identity) {
-    let realRoot;
-    let realCwd;
-    try {
-        realRoot = fs.realpathSync(identity.requestedRoot);
-        realCwd = fs.realpathSync(identity.requestedCwd);
-    }
-    catch {
-        throw changed(identity.requestedCwd);
-    }
-    if (realRoot !== identity.realRoot)
-        throw changed(identity.requestedCwd);
-    const relative = path.relative(realRoot, realCwd);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
-        throw changed(identity.requestedCwd);
-    }
-    let cwdStat;
-    try {
-        cwdStat = fs.statSync(realCwd, { bigint: true });
-    }
-    catch {
-        throw changed(identity.requestedCwd);
-    }
-    if (!cwdStat.isDirectory())
-        throw changed(identity.requestedCwd);
-}
-function changed(cwd) {
-    return new UsageError(`Frozen execution cwd ${cwd} changed and no longer resolves inside its root.`, "PATH_ESCAPE_VIOLATION");
-}
-function requireContained(root, candidate) {
-    const relative = path.relative(root, candidate);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
-        throw new UsageError(`${candidate} escapes its execution root.`, "PATH_ESCAPE_VIOLATION");
-    }
-}

package/dist/workflows/authoring/scope-key.js

@@ -1,79 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { isWithin, resolveStashDir, safeRealpath, toPosix } from "../../core/common.js";
-const PROJECT_CONFIG_RELATIVE_PATH = path.join(".akm", "config.json");
-export function getCurrentWorkflowScopeKey() {
-    const anchor = resolveWorkflowScopeAnchor(process.cwd());
-    const normalized = normalizeScopePath(anchor);
-    const digest = createHash("sha256").update(normalized).digest("hex");
-    return `dir:v1:${digest}`;
-}
-export function resolveWorkflowScopeAnchor(startDir) {
-    const cwd = safeRealpath(startDir);
-    const projectRoot = findNearestProjectConfigRoot(cwd);
-    if (projectRoot)
-        return projectRoot;
-    const gitRoot = findNearestGitRoot(cwd);
-    if (gitRoot)
-        return gitRoot;
-    try {
-        const stashDir = safeRealpath(resolveStashDir());
-        if (isWithin(cwd, stashDir))
-            return stashDir;
-    }
-    catch {
-        // Ignore stash resolution failures and fall back to cwd.
-    }
-    return cwd;
-}
-function findNearestProjectConfigRoot(startDir) {
-    let currentDir = startDir;
-    while (true) {
-        const configPath = path.join(currentDir, PROJECT_CONFIG_RELATIVE_PATH);
-        if (isFile(configPath)) {
-            return safeRealpath(currentDir);
-        }
-        const parentDir = path.dirname(currentDir);
-        if (parentDir === currentDir)
-            return null;
-        currentDir = parentDir;
-    }
-}
-function findNearestGitRoot(startDir) {
-    let currentDir = startDir;
-    while (true) {
-        const gitPath = path.join(currentDir, ".git");
-        if (exists(gitPath)) {
-            return safeRealpath(currentDir);
-        }
-        const parentDir = path.dirname(currentDir);
-        if (parentDir === currentDir)
-            return null;
-        currentDir = parentDir;
-    }
-}
-function exists(candidate) {
-    try {
-        fs.accessSync(candidate, fs.constants.F_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function isFile(candidate) {
-    try {
-        return fs.statSync(candidate).isFile();
-    }
-    catch {
-        return false;
-    }
-}
-function normalizeScopePath(value) {
-    const posix = toPosix(value);
-    return process.platform === "win32" ? posix.toLowerCase() : posix;
-}

package/dist/workflows/source-semantics.js

@@ -1,110 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/** Semantic checks for the Markdown workflow grammar (`parser.ts`). */
-import fs from "node:fs";
-import path from "node:path";
-export class WorkflowSourceSemanticError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = "WorkflowSourceSemanticError";
-    }
-}
-export function canonicalizeWorkflowWorkingDirectory(value, workspaceRoot) {
-    if (hasControlCharacter(value)) {
-        throw new WorkflowSourceSemanticError("working-directory-control-character", "working-directory may not contain NUL or control characters.");
-    }
-    if (value === "" || value.trim() === "") {
-        throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory must be a non-empty relative contained path.");
-    }
-    const portable = value.replaceAll("\\", "/");
-    const segments = portable.split("/");
-    if (path.posix.isAbsolute(portable) ||
-        path.win32.isAbsolute(value) ||
-        portable.startsWith("~") ||
-        segments.some((segment) => segment === "" || segment === "..")) {
-        throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory must be relative and contained.");
-    }
-    const withoutDots = segments.filter((segment) => segment !== ".");
-    const canonical = withoutDots.length === 0 ? "." : withoutDots.join("/");
-    if (workspaceRoot !== undefined)
-        verifyPhysicalContainment(workspaceRoot, canonical);
-    return canonical;
-}
-function hasControlCharacter(value) {
-    for (const character of value) {
-        const codePoint = character.codePointAt(0) ?? 0;
-        if (codePoint <= 0x1f || codePoint === 0x7f)
-            return true;
-    }
-    return false;
-}
-function verifyPhysicalContainment(workspaceRoot, relative) {
-    let root;
-    try {
-        root = fs.realpathSync(workspaceRoot);
-    }
-    catch {
-        throw new WorkflowSourceSemanticError("working-directory-unverifiable", "Workspace root cannot be physically verified.");
-    }
-    const candidate = path.resolve(root, ...relative.split("/"));
-    if (!contained(root, candidate)) {
-        throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory escapes the workspace.");
-    }
-    let current = root;
-    for (const segment of relative === "." ? [] : relative.split("/")) {
-        current = path.join(current, segment);
-        try {
-            const entry = fs.lstatSync(current);
-            if (entry.isSymbolicLink()) {
-                let physical;
-                try {
-                    physical = fs.realpathSync(current);
-                }
-                catch {
-                    throw new WorkflowSourceSemanticError("working-directory-unverifiable", "working-directory contains a dangling or unresolvable symlink.");
-                }
-                if (!contained(root, physical)) {
-                    throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory resolves through a symlink outside the workspace.");
-                }
-                let target;
-                try {
-                    target = fs.statSync(current);
-                }
-                catch {
-                    throw new WorkflowSourceSemanticError("working-directory-unverifiable", "working-directory symlink target cannot be physically verified.");
-                }
-                if (!target.isDirectory()) {
-                    throw new WorkflowSourceSemanticError("working-directory-unverifiable", "working-directory must resolve through directories.");
-                }
-                continue;
-            }
-            if (!entry.isDirectory()) {
-                throw new WorkflowSourceSemanticError("working-directory-unverifiable", "working-directory must resolve through directories.");
-            }
-            const physical = fs.realpathSync(current);
-            if (!contained(root, physical)) {
-                throw new WorkflowSourceSemanticError("working-directory-escape", "working-directory resolves through a symlink outside the workspace.");
-            }
-        }
-        catch (cause) {
-            if (cause instanceof WorkflowSourceSemanticError)
-                throw cause;
-            const code = cause?.code;
-            if (code === "ENOENT") {
-                // A genuinely absent lexical component is allowed at source time; the
-                // runtime dispatch boundary revalidates containment when it appears.
-                // `lstat` distinguishes this from a dangling symlink, which fails
-                // closed above even before its target can appear.
-                return;
-            }
-            throw new WorkflowSourceSemanticError("working-directory-unverifiable", "working-directory cannot be physically verified.");
-        }
-    }
-}
-function contained(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
-}