akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/commands/sources/add-cli.js

@@ -1,16 +1,12 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import fs from "node:fs";
-import path from "node:path";
-import * as p from "../../cli/clack.js";
 import { getStringArg, parsePositiveIntFlag } from "../../cli/parse-args.js";
 import { defineJsonCommand, output } from "../../cli/shared.js";
-import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
-import { sanitizeString } from "../../sources/providers/provider-utils.js";
+import { auditStashForDangerousKeys } from "./dangerous-env-audit.js";
 import { akmRemove } from "./installed-stashes.js";
 import { akmAdd } from "./source-add.js";
 import { addStash } from "./source-manage.js";
@@ -39,185 +35,30 @@ export function shouldWarnOnPlainHttp(ref) {
         return true;
     }
 }
-/**
- * Recursively enumerate every real env FILE under `rootDir` (a stash's
- * `env/` directory). "Real env file" is the SAME test used everywhere else
- * in akm decides what `akm env run` / `akm env list` / the indexer will
- * actually load as environment variables — `fileName === ".env" ||
- * fileName.endsWith(".env")` — see `src/indexer/walk/matchers.ts` and
- * `listEnvsRecursive` in `src/commands/env/env-cli.ts`. Reusing that exact
- * rule here (rather than inventing a second, possibly-divergent one) is what
- * closes the nested-directory bypass: `env/nested/inner.env` IS loaded by
- * `akm env run` today via that same recursive walk, so it must be scanned
- * too (previously only a flat, non-recursive `env/*.env` listing was
- * scanned).
- *
- * Deliberately excludes files that do NOT end in `.env` (e.g.
- * `env/notes.txt`). Such a file is never sourced as environment variables by
- * any akm codepath, so a dangerous key sitting in its contents cannot hijack
- * process execution via `akm env run` — there is no live attack through this
- * gate for it. Residual gap: this scanner does not protect against an
- * operator later renaming/copying that file to a `*.env` name, or feeding it
- * into `akm env run` through some other mechanism outside akm; closing that
- * would mean content-sniffing every byte of every file in the stash (README,
- * lockfiles, binaries, …) for a vector that requires a subsequent human
- * action to become live, which is a materially different and much more
- * expensive check than "is this a file `akm` will actually source".
- */
-function collectEnvFilePathsRecursive(rootDir) {
-    const results = [];
-    const walk = (dir) => {
-        let entries;
-        try {
-            entries = fs.readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                walk(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            if (entry.name !== ".env" && !entry.name.endsWith(".env"))
-                continue;
-            results.push(full);
-        }
-    };
-    walk(rootDir);
-    return results;
-}
-/** Scan every real env file (recursively, see {@link collectEnvFilePathsRecursive}) in the freshly-installed stash for dangerous env keys. */
-function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys) {
-    const allFindings = [];
-    const subdir = "env";
-    const prefix = "env";
-    const dir = path.join(installedStashRoot, subdir);
-    if (!fs.existsSync(dir))
-        return allFindings;
-    for (const envPath of collectEnvFilePathsRecursive(dir)) {
-        const relToEnvDir = path.relative(dir, envPath);
-        // Only the LAST path segment carries the ".env" suffix / dotfile-default
-        // naming rule; intermediate directory segments pass through unchanged.
-        // e.g. "nested/inner.env" -> "nested/inner", "nested/.env" ->
-        // "nested/default" (not "nested/", which is what naively stripping the
-        // suffix from the whole relative path would produce).
-        const segments = relToEnvDir.split(path.sep);
-        const lastSegment = segments[segments.length - 1] ?? "";
-        const lastSegmentBase = lastSegment.endsWith(".env") ? lastSegment.slice(0, -".env".length) : lastSegment;
-        const refSegments = [...segments.slice(0, -1), lastSegmentBase === "" ? "default" : lastSegmentBase];
-        const envRef = `${prefix}/${refSegments.join("/")}`;
-        const relPath = path.join(subdir, relToEnvDir);
-        const findings = checkEnvForDangerousKeys(envPath, relPath, envRef);
-        for (const finding of findings) {
-            // Extract the key name from the detail string for the summary line.
-            const keyMatch = finding.detail.match(/Env key `([^`]+)`/);
-            const keyName = keyMatch ? keyMatch[1] : finding.file;
-            allFindings.push({ envRef, keyName, relPath });
-        }
-    }
-    return allFindings;
-}
 /**
  * Audit a freshly-installed stash for dangerous env keys and decide whether the
- * install must be blocked. Returns a typed decision instead of calling
- * `process.exit`, so the abort cannot be lost to a swallowed exception. See the
- * block comment above for the security rationale.
+ * install must be blocked. The scanner and decision policy are shared with
+ * `bundle update` in dangerous-env-audit.ts.
  */
 export async function auditInstalledStashForDangerousKeys(opts) {
     const { installedStashRoot, ref, allowDangerousKeys, rollbackTarget, isTTY } = opts;
-    // Best-effort scan: if collecting findings itself throws (corrupt env file,
-    // fs error) there is nothing concrete to block on, so fail soft. Crucially,
-    // this soft path runs BEFORE any findings exist — it can never re-open an
-    // already-detected dangerous install.
-    let allFindings;
-    try {
-        const { checkEnvForDangerousKeys } = await import("../lint/env-key-rules.js");
-        allFindings = collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys);
-    }
-    catch {
-        return { blocked: false };
-    }
-    // The workspace activation policy fixes the baseline stance; the interactive
-    // confirm / rollback below is layered on top of the `"gate"` stance only.
-    const stance = decideDangerousKeyInstall({
-        findingsPresent: allFindings.length > 0,
-        allowInsecure: allowDangerousKeys,
-    });
-    if (stance === "allow")
-        return { blocked: false };
-    if (stance === "warn-allow") {
-        // Operator has explicitly accepted the risk — warn and continue.
-        for (const f of allFindings) {
-            warn(`[dangerous-env-key] ${f.relPath}: key \`${f.keyName}\` in ${f.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
-        }
-        return { blocked: false };
-    }
-    // Helper: roll the install back before aborting. Rollback is best-effort; a
-    // failed rollback never UN-blocks the install — we still abort, just with a
-    // warning telling the operator to remove the stash manually.
-    async function rollback() {
-        try {
-            await akmRemove({ target: rollbackTarget });
-            return undefined;
-        }
-        catch (_rollbackErr) {
-            return (`Rollback failed — stash may still be installed at ${installedStashRoot}. ` +
-                `Remove it manually with: akm bundle remove ${rollbackTarget}`);
-        }
-    }
-    if (isTTY) {
-        // Interactive path: show findings and ask the user to confirm.
-        // Guard on stdin (not stdout) because p.confirm() reads from stdin;
-        // stdout may be a TTY while stdin is piped, which would cause a hang.
-        const stashLabel = ref;
-        const groupedByEnv = new Map();
-        for (const f of allFindings) {
-            const existing = groupedByEnv.get(f.envRef) ?? [];
-            existing.push(f.keyName);
-            groupedByEnv.set(f.envRef, existing);
-        }
-        for (const [envRef, keys] of groupedByEnv) {
-            // envRef and keys come from filenames and KEY names inside a downloaded or
-            // cloned bundle, i.e. attacker-controllable. Tar validation rejects NUL but
-            // not ESC/CSI, and git checkout allows them in filenames on Linux/macOS —
-            // so printing them raw let a crafted bundle rewrite this security prompt
-            // with terminal escapes right before an "Install anyway?" confirmation.
-            warn(`[warn] Env "${sanitizeString(envRef)}" in stash "${sanitizeString(stashLabel)}" contains potentially dangerous keys:`);
-            for (const key of keys) {
-                warn(`  - ${sanitizeString(key)}: can hijack process execution via \`akm env run\``);
+    return auditStashForDangerousKeys({
+        stashRoot: installedStashRoot,
+        ref,
+        allowDangerousKeys,
+        isTTY,
+        operation: "install",
+        rollback: async () => {
+            try {
+                await akmRemove({ target: rollbackTarget });
+                return undefined;
             }
-        }
-        const confirmed = await p.confirm({
-            message: "Install anyway?",
-            initialValue: false,
-        });
-        if (p.isCancel(confirmed) || confirmed !== true) {
-            const rollbackWarning = await rollback();
-            console.error(JSON.stringify({
-                ok: false,
-                error: "Install aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-insecure to bypass.",
-                code: "DANGEROUS_ENV_KEY",
-                ...(rollbackWarning ? { rollbackWarning } : {}),
-            }, null, 2));
-            return { blocked: true, exitCode: 1 };
-        }
-        // Operator confirmed at the prompt — allow the install to proceed.
-        return { blocked: false };
-    }
-    // Non-interactive path without bypass flag: fail hard.
-    const rollbackWarning = await rollback();
-    const keyList = allFindings.map((f) => `  - ${f.keyName} (${f.envRef})`).join("\n");
-    console.error(JSON.stringify({
-        ok: false,
-        error: `Install blocked: stash "${ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-insecure to bypass this check after reviewing the env file.`,
-        code: "DANGEROUS_ENV_KEY",
-        ...(rollbackWarning ? { rollbackWarning } : {}),
-    }, null, 2));
-    return { blocked: true, exitCode: 1 };
+            catch {
+                return (`Rollback failed — stash may still be installed at ${installedStashRoot}. ` +
+                    `Remove it manually with: akm bundle remove ${rollbackTarget}`);
+            }
+        },
+    });
 }
 // ── Command definition ────────────────────────────────────────────────────────
 export const addCommand = defineJsonCommand({

package/dist/commands/sources/bundle-cli.js

@@ -118,11 +118,16 @@ const removeCommand = defineJsonCommand({
     },
 });
 const updateCommand = defineJsonCommand({
-    meta: { name: "update", description: "Update one or all managed bundles" },
+    meta: { name: "update", description: "Refresh one or all configured bundles and reconcile their index" },
     args: {
         target: { type: "positional", description: "Bundle to update (id or ref)", required: false },
-        all: { type: "boolean", description: "Update all installed entries", default: false },
+        all: { type: "boolean", description: "Update all configured bundles and report each outcome", default: false },
         force: { type: "boolean", description: "Force fresh download even if version is unchanged", default: false },
+        "allow-insecure": {
+            type: "boolean",
+            description: "Allow an update containing dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the staged bundle.",
+            default: false,
+        },
         // F1/R-058: gates ONLY the rare branch where the resolved content
         // directory moves and the previous `localRoot` is deleted — a normal
         // refresh (the overwhelming majority of updates) deletes nothing and
@@ -135,13 +140,20 @@ const updateCommand = defineJsonCommand({
         },
     },
     async run({ args }) {
-        const result = await akmUpdate({ target: args.target, all: args.all, force: args.force, yes: args.yes });
+        const result = await akmUpdate({
+            target: args.target,
+            all: args.all,
+            force: args.force,
+            yes: args.yes,
+            allowInsecure: args["allow-insecure"],
+        });
         appendEvent({
             eventType: "update",
             metadata: {
                 target: args.target ?? null,
                 all: args.all === true,
                 force: args.force === true,
+                allowInsecure: args["allow-insecure"] === true,
                 processed: Array.isArray(result.processed)
                     ? result.processed.length
                     : 0,

package/dist/commands/sources/dangerous-env-audit.js

@@ -0,0 +1,135 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import fs from "node:fs";
+import path from "node:path";
+import * as p from "../../cli/clack.js";
+import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
+import { ConfigError } from "../../core/errors.js";
+import { warn } from "../../core/warn.js";
+import { sanitizeString } from "../../sources/providers/provider-utils.js";
+import { scanEnvKeyNames } from "../env/env.js";
+import { isDangerousEnvKey } from "../lint/env-key-rules.js";
+let scannerOverride;
+/** TEST-ONLY. Inject a scanner fault at the audit boundary; undefined restores. */
+export function _setDangerousKeyScannerForTests(scanner) {
+    scannerOverride = scanner;
+}
+function collectEnvFilePathsRecursive(rootDir) {
+    const results = [];
+    const walk = (dir) => {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (entry.name !== ".env" && !entry.name.endsWith(".env"))
+                continue;
+            results.push(full);
+        }
+    };
+    walk(rootDir);
+    return results;
+}
+function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys) {
+    const allFindings = [];
+    if (!fs.statSync(installedStashRoot).isDirectory()) {
+        throw new Error(`Expected ${installedStashRoot} to be a directory.`);
+    }
+    const dir = path.join(installedStashRoot, "env");
+    try {
+        if (!fs.statSync(dir).isDirectory()) {
+            throw new Error(`Expected ${dir} to be a directory.`);
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return allFindings;
+        throw error;
+    }
+    for (const envPath of collectEnvFilePathsRecursive(dir)) {
+        const relToEnvDir = path.relative(dir, envPath);
+        const segments = relToEnvDir.split(path.sep);
+        const lastSegment = segments[segments.length - 1] ?? "";
+        const lastSegmentBase = lastSegment.endsWith(".env") ? lastSegment.slice(0, -".env".length) : lastSegment;
+        const refSegments = [...segments.slice(0, -1), lastSegmentBase === "" ? "default" : lastSegmentBase];
+        const envRef = `env/${refSegments.join("/")}`;
+        const relPath = path.join("env", relToEnvDir);
+        for (const finding of checkEnvForDangerousKeys(envPath, relPath, envRef)) {
+            const keyMatch = finding.detail.match(/Env key `([^`]+)`/);
+            allFindings.push({ envRef, keyName: keyMatch?.[1] ?? finding.file, relPath });
+        }
+    }
+    return allFindings;
+}
+/** Scan only; callers that already obtained approval use this for a final materialization fence. */
+export function scanStashForDangerousKeys(installedStashRoot) {
+    const scanner = scannerOverride ??
+        ((envPath, relPath) => scanEnvKeyNames(fs.readFileSync(envPath, "utf8"))
+            .filter(isDangerousEnvKey)
+            .map((key) => ({ file: relPath, detail: `Env key \`${key}\`` })));
+    return collectDangerousKeyFindings(installedStashRoot, scanner);
+}
+export async function auditStashForDangerousKeys(opts) {
+    let allFindings;
+    try {
+        allFindings = scanStashForDangerousKeys(opts.stashRoot);
+    }
+    catch (error) {
+        const rollbackWarning = await opts.rollback?.();
+        throw new ConfigError(`Dangerous environment-key audit failed for "${opts.ref}"; refusing to ${opts.operation} unverified content. ${error instanceof Error ? error.message : String(error)}${rollbackWarning ? ` ${rollbackWarning}` : ""}`, "DANGEROUS_ENV_AUDIT_FAILED");
+    }
+    const stance = decideDangerousKeyInstall({
+        findingsPresent: allFindings.length > 0,
+        allowInsecure: opts.allowDangerousKeys,
+    });
+    if (stance === "allow")
+        return { blocked: false, findings: allFindings };
+    if (stance === "warn-allow") {
+        for (const finding of allFindings) {
+            warn(`[dangerous-env-key] ${finding.relPath}: key \`${finding.keyName}\` in ${finding.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
+        }
+        return { blocked: false, findings: allFindings };
+    }
+    const operationTitle = opts.operation === "install" ? "Install" : "Update";
+    const operationPast = opts.operation === "install" ? "installed" : "updated";
+    let error;
+    if (opts.isTTY) {
+        const groupedByEnv = new Map();
+        for (const finding of allFindings) {
+            const existing = groupedByEnv.get(finding.envRef) ?? [];
+            existing.push(finding.keyName);
+            groupedByEnv.set(finding.envRef, existing);
+        }
+        for (const [envRef, keys] of groupedByEnv) {
+            warn(`[warn] Env "${sanitizeString(envRef)}" in stash "${sanitizeString(opts.ref)}" contains potentially dangerous keys:`);
+            for (const key of keys)
+                warn(`  - ${sanitizeString(key)}: can hijack process execution via \`akm env run\``);
+        }
+        const confirmed = await p.confirm({ message: `${operationTitle} anyway?`, initialValue: false });
+        if (!p.isCancel(confirmed) && confirmed === true)
+            return { blocked: false, findings: allFindings };
+        error = `${operationTitle} aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-insecure to bypass.`;
+    }
+    else {
+        const keyList = allFindings.map((finding) => `  - ${finding.keyName} (${finding.envRef})`).join("\n");
+        error = `${operationTitle} blocked: stash "${opts.ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-insecure to bypass this check after reviewing the env file.`;
+    }
+    const rollbackWarning = await opts.rollback?.();
+    if (opts.renderBlockedError !== false) {
+        console.error(JSON.stringify({
+            ok: false,
+            error,
+            code: "DANGEROUS_ENV_KEY",
+            ...(rollbackWarning ? { rollbackWarning } : {}),
+        }, null, 2));
+    }
+    if (rollbackWarning) {
+        warn(`The blocked ${opts.operation} could not be fully rolled back after content was ${operationPast}: ${rollbackWarning}`);
+    }
+    return { blocked: true, exitCode: 1, code: "DANGEROUS_ENV_KEY", error, findings: allFindings };
+}

package/dist/commands/sources/info.js

@@ -6,6 +6,7 @@ import { resolveStashDir } from "../../core/common.js";
 import { getSources, loadConfig } from "../../core/config/config.js";
 import { classifyPathAccess, describeInaccessiblePath } from "../../core/path-access.js";
 import { getDbPath } from "../../core/paths.js";
+import { formatRegistryUrl } from "../../core/registry-url.js";
 import { error } from "../../core/warn.js";
 import { getEffectiveSemanticStatus, readSemanticStatus } from "../../indexer/search/semantic-status.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
@@ -37,7 +38,7 @@ export function assembleInfo(options) {
     }
     // Registries (strip sensitive fields like apiKey from options)
     const registries = (config.registries ?? []).map((r) => ({
-        url: r.url,
+        url: formatRegistryUrl(r.url),
         ...(r.name ? { name: r.name } : {}),
         ...(r.provider ? { provider: r.provider } : {}),
         ...(r.enabled !== undefined ? { enabled: r.enabled } : {}),