auxilo-mcp 0.9.13 → 0.9.14

package/bin/auxilo-cli.js

@@ -167,7 +167,7 @@ const CONSENT_TEXT = `
     • SCRUBS it locally (sensitivity filter: API keys, tokens, emails, PII
       are redacted first),
     • EXTRACTS reusable learnings locally through the first model client you
-      have installed (Claude Code, then Codex) or, when neither is
+      are signed in to (Claude Code, then Codex) or, when neither is
       available, a provider key you set yourself. For this step your
       scrubbed transcript goes only to that provider, under your own
       account with them, and any use is charged to that account, never to
@@ -1402,10 +1402,13 @@ async function cmdProvider(flags) {
     return;
   }
 
-  // writeByoConfig throws ONLY on an unresolved home directory (GOV-3 item
-  // 13) — caught here so that reaches a clean reason + exit(1), never a raw
-  // stack (should-fix item 10), matching the fail-closed contract every
-  // other providers.json entry point in this file now follows.
+  // writeByoConfig throws on an unresolved home directory (GOV-3 item 13)
+  // OR, since EXTRACTION-LOW-FOLLOWUPS item 4, on an existing providers.json
+  // path that is not a regular file owned by this account (a symlink or a
+  // foreign owner) — both caught here so they reach a clean reason +
+  // exit(1), never a raw stack (should-fix item 10), matching the
+  // fail-closed contract every other providers.json entry point in this
+  // file now follows.
   let written;
   try {
     written = byoKeyProvider.writeByoConfig({
@@ -1419,6 +1422,10 @@ async function cmdProvider(flags) {
       console.error(`auxilo provider set could not resolve your home directory (reasonCode: provider-home-unresolved). ${err.message}`);
       process.exit(1);
     }
+    if (err && err.reasonCode === 'provider-state-target-unsafe') {
+      console.error(`auxilo provider set refuses to continue: ${err.message} (reasonCode: provider-state-target-unsafe). Remove or replace it, then try again.`);
+      process.exit(1);
+    }
     throw err;
   }
   console.log(`\n✓ Saved to ${written} (mode 0600). This machine will use your own ${vendor} key for extraction when no earlier provider in the order is available.`);

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.13' },
+  { name: 'auxilo', version: '0.9.14' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.13",
+  "version": "0.9.14",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/extract-local.js

@@ -401,13 +401,24 @@ function judgeUsage(usage, prompt, completion) {
 /**
  * PART C — resolve the extraction_model identity for a runModel result.
  * Prefers the additive `identity` field a provider's runModel result may
- * carry (byo-key.js always sets one: {provider:'byo-key', model, version,
- * vendor}). claude-code.js/codex-cli.js shipped (PART A/B) before this stamp
- * existed and don't set one — rather than touch those provider modules
- * (outside this part's disjoint file scope, AGENTS.md's one-build rule),
- * this falls back to the resolved provider id alone (model/version/vendor
- * null) so every provider gets SOME stamp, never silently none. Best-effort:
- * a resolution failure here must never block extraction itself.
+ * carry. Current state (post Gate-A item a): byo-key.js always sets one
+ * ({provider:'byo-key', model, version:null, vendor}); codex-cli.js sets one
+ * on success ({provider:'codex-cli', model:null, version:<codex --version>,
+ * vendor:null} — its result also carries the same object under the
+ * deprecated `extraction_model` alias, kept for one release only for
+ * test/codex-cli-provider.test.js). claude-code.js is the one provider that
+ * still sets no `identity` on its result — that's the case this function's
+ * fallback exists for: it re-resolves via providers.resolveProvider() and
+ * stamps {provider: resolved.id, model: null, version: null, vendor: null},
+ * so every provider gets SOME stamp, never silently none. That re-resolution
+ * walks scripts/providers/index.js's PROVIDER_ORDER (claude-code →
+ * codex-cli → byo-key); resolveProvider/runModel there fall through from one
+ * provider to the next only on a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode
+ * (unauthenticated, not installed, a billing helper configured, an
+ * unconfigured BYO key, or an unsafe providers.json mode) — a provider that
+ * merely failed once (a timeout, a model error) is not retried under a
+ * different one. Best-effort throughout: a resolution failure here must
+ * never block extraction itself.
  */
 async function resolveExtractionModelIdentity(runModelResult, opts) {
   if (runModelResult && runModelResult.identity && typeof runModelResult.identity === 'object') {

package/scripts/providers/byo-key.js

@@ -70,6 +70,33 @@ function isHomeUnresolved(target) {
   return typeof target !== 'string' || !target || !path.isAbsolute(target);
 }
 
+/**
+ * true iff something already sits at `target` and it is NOT a plain regular
+ * file owned by this process's own uid (EXTRACTION-LOW-FOLLOWUPS item 4).
+ * Guards the pre-rename chmod below: chmod follows symlinks, so a planted
+ * symlink at `target` (pointing at, say, another account's file, or a
+ * device node) would previously get its chmod(0600) applied to whatever it
+ * points at, not to providers.json itself — same-uid threat model only
+ * (matches item 2's TOCTOU acceptance above), but a fail-closed lstat is a
+ * one-line guard against it. ENOENT (nothing there yet) is safe — the write
+ * below creates it fresh with O_EXCL. Any other stat failure, a non-file
+ * (symlink/dir/fifo/device), or a foreign owner all fail CLOSED (refuse),
+ * never silently proceed.
+ */
+function isUnsafeExistingTarget(target, opts = {}) {
+  const lstatSyncImpl = typeof opts.lstatSyncImpl === 'function' ? opts.lstatSyncImpl : fs.lstatSync;
+  let stat;
+  try {
+    stat = lstatSyncImpl(target);
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return false; // nothing there — nothing to protect
+    return true; // cannot verify what's there — fail closed
+  }
+  if (!stat.isFile()) return true; // symlink, directory, fifo, device, … — never chmod/rename onto it
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) return true; // foreign owner
+  return false;
+}
+
 /**
  * ONE writer for every providers.json write (EXTRACT-PER-CLIENT W1 FIX
  * GOV-3 item 1 + should-fix item 9) — writeByoConfig, clearProvidersFile,
@@ -78,14 +105,19 @@ function isHomeUnresolved(target) {
  * right instead of three independent (and, before this fix, drifted) copies
  * of it. Discipline, in order:
  *   1. mkdir the parent dir 0700 (idempotent).
- *   2. If a file already sits at `target`, chmod it 0600 BEFORE the
+ *   2. lstat whatever already sits at `target` and refuse (reasonCode
+ *      'provider-state-target-unsafe') if it exists and is not a regular
+ *      file owned by this uid (EXTRACTION-LOW-FOLLOWUPS item 4) — checked
+ *      BEFORE the chmod below, which would otherwise follow a planted
+ *      symlink.
+ *   3. If a file already sits at `target`, chmod it 0600 BEFORE the
  *      rename lands (belt-and-suspenders — the post-rename chmod below is
  *      the one that actually matters for a stale `.tmp`).
- *   3. Unlink any leftover `${target}.tmp` first (a crashed prior run, or a
+ *   4. Unlink any leftover `${target}.tmp` first (a crashed prior run, or a
  *      planted symlink), THEN create it fresh with `flag:'wx'` (O_EXCL) —
  *      refuses to silently reuse or follow anything already at that path.
- *   4. Atomic rename tmp -> target.
- *   5. chmodSync(target, 0o600) AFTER the rename. This is the literal fix
+ *   5. Atomic rename tmp -> target.
+ *   6. chmodSync(target, 0o600) AFTER the rename. This is the literal fix
  *      for GOV-3 finding 1: writeFileSync's `mode` option only applies on
  *      CREATION, so a stale `.tmp` that survived a crash at 0644 would
  *      rename onto `target` and KEEP 0644, silently falsifying the
@@ -93,7 +125,8 @@ function isHomeUnresolved(target) {
  *      `persistSelected` (scripts/providers/index.js) had this exact gap;
  *      this writer closes it everywhere at once.
  * Throws (does not swallow) when the home directory could not be resolved
- * (isHomeUnresolved) — callers decide how to surface that; see
+ * (isHomeUnresolved) or the existing target is unsafe (reasonCode
+ * 'provider-state-target-unsafe') — callers decide how to surface that; see
  * writeByoConfig/clearProvidersFile below and cmdProvider in
  * bin/auxilo-cli.js, which catches this rather than let a raw stack out
  * (should-fix item 10).
@@ -106,6 +139,11 @@ function writeProvidersStateAtomic(state, opts = {}) {
     throw err;
   }
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  if (isUnsafeExistingTarget(target, opts)) {
+    const err = new Error('refusing to write ~/.auxilo/providers.json — an existing entry at that path is not a regular file owned by this account (possible symlink or foreign owner)');
+    err.reasonCode = 'provider-state-target-unsafe';
+    throw err;
+  }
   if (fs.existsSync(target)) fs.chmodSync(target, 0o600);
   const tmp = `${target}.tmp`;
   try { fs.unlinkSync(tmp); } catch { /* nothing there, or already gone — fine either way */ }
@@ -150,6 +188,12 @@ function readByoConfig(opts = {}) {
  * source discipline; the discipline itself — chmod-then-tmp-write-then-
  * rename, both 0600 — is copied, not the code).
  *
+ * Throws a tagged error (writeProvidersStateAtomic) on 'provider-home-
+ * unresolved' OR, since EXTRACTION-LOW-FOLLOWUPS item 4, on
+ * 'provider-state-target-unsafe' (an existing entry at the target path is
+ * a symlink or owned by a different uid) — cmdProvider in bin/auxilo-cli.js
+ * catches both rather than let a raw stack out.
+ *
  * @param {{provider:string, base_url?:string|null, model:string, api_key:string}} byoConfig
  */
 function writeByoConfig(byoConfig, opts = {}) {
@@ -182,7 +226,11 @@ function writeByoConfig(byoConfig, opts = {}) {
  * rather than guess a location to read/write. A stat/read failure other
  * than ENOENT (e.g. EACCES) returns 'unreadable' rather than rethrow — this
  * function's contract really is "never throws" now (should-fix item 10; the
- * old rethrow on non-ENOENT contradicted this same docblock).
+ * old rethrow on non-ENOENT contradicted this same docblock). The rewrite
+ * path below can now also throw (writeProvidersStateAtomic's
+ * 'provider-state-target-unsafe', EXTRACTION-LOW-FOLLOWUPS item 4) — caught
+ * here too, folded into 'unreadable', so this function's own "never throws"
+ * contract holds regardless of what writeProvidersStateAtomic does.
  *
  * @returns {'removed-file'|'removed-byo'|'noop'|'unreadable'|'unresolved'}
  *   'noop' covers both "no file" and "a file with no `byo` key to clear".
@@ -209,10 +257,18 @@ function clearProvidersFile(opts = {}) {
   }
   delete state.byo;
   if (Object.keys(state).length === 0) {
-    fs.unlinkSync(target);
+    try {
+      fs.unlinkSync(target);
+    } catch {
+      return 'unreadable'; // cannot remove it either — never throws (contract)
+    }
     return 'removed-file';
   }
-  writeProvidersStateAtomic(state, opts);
+  try {
+    writeProvidersStateAtomic(state, opts);
+  } catch {
+    return 'unreadable'; // e.g. provider-state-target-unsafe — never throws (contract)
+  }
   return 'removed-byo';
 }
 
@@ -244,6 +300,8 @@ function baseUrlFor(vendor, configured) {
  * throws.
  */
 function isProvidersFileModeUnsafe(opts = {}) {
+  // EXTRACTION-LOW-FOLLOWUPS item 2 (TOCTOU, accepted on the record): a
+  // window exists between this check and readByoConfig()'s read below; only the same uid could win that race, and that uid already owns the key on disk, so it is accepted rather than replaced with an fd-based check-then-read.
   const target = statePath(opts);
   if (isHomeUnresolved(target)) return true; // can't even name the file — fail closed
   const statSyncImpl = typeof opts.statSyncImpl === 'function' ? opts.statSyncImpl : fs.statSync;
@@ -627,5 +685,7 @@ module.exports = {
   isHomeUnresolved,
   isBaseUrlInsecure,
   writeProvidersStateAtomic,
+  // Exported for direct unit coverage (EXTRACTION-LOW-FOLLOWUPS item 4).
+  isUnsafeExistingTarget,
   MAX_RESPONSE_BYTES,
 };

package/scripts/providers/claude-code.js

@@ -154,7 +154,19 @@ function managedSettingsPathForPlatform(opts) {
   // otherwise names a fixed, real, OS-level location no test should touch).
   if (typeof opts.managedSettingsPath === 'string') return opts.managedSettingsPath;
   const platform = typeof opts.platform === 'string' ? opts.platform : process.platform;
-  return MANAGED_SETTINGS_PATH_BY_PLATFORM[platform] || MANAGED_SETTINGS_PATH_BY_PLATFORM.linux;
+  // EXTRACTION-LOW-FOLLOWUPS item 1: a raw `[platform]` index is reachable
+  // (only via the test seam opts.platform, per the row) with a prototype key
+  // ('constructor', 'toString', '__proto__', …) and would return a truthy
+  // Object.prototype value instead of falling through to the Linux default —
+  // fails OPEN with a bogus path silently in place of the real managed-
+  // settings check. hasOwnProperty scopes the lookup to the object's own
+  // enumerable keys, mirroring the guard at scripts/providers/index.js:139,
+  // so an unknown or prototype-polluting key falls CLOSED to the Linux path
+  // exactly like any other unrecognized platform string does today.
+  if (Object.prototype.hasOwnProperty.call(MANAGED_SETTINGS_PATH_BY_PLATFORM, platform)) {
+    return MANAGED_SETTINGS_PATH_BY_PLATFORM[platform];
+  }
+  return MANAGED_SETTINGS_PATH_BY_PLATFORM.linux;
 }
 
 /**
@@ -167,7 +179,7 @@ function managedSettingsPathForPlatform(opts) {
  * that matches Claude Code's own behavior for those files, which this
  * managed path does not share.)
  */
-function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileSyncImpl) {
+function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileSyncImpl, log) {
   let exists;
   try {
     exists = existsSyncImpl(filePath);
@@ -176,7 +188,17 @@ function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileS
   }
   if (!exists) return false;
   const parsed = readJsonSafe(filePath, readFileSyncImpl);
-  if (parsed === null) return true; // present but unreadable/unparseable — fail closed
+  if (parsed === null) {
+    // EXTRACTION-LOW-FOLLOWUPS item 3: this fail-closed branch silently
+    // switches the builder away from claude-code (reasonCode
+    // 'cli-billing-helper-configured', same as a real detected helper) with
+    // no visible signal that the cause was an UNVERIFIABLE managed-settings
+    // file rather than an actual foreign-billing helper. One stderr line
+    // naming the reason code — never the file's contents or any key
+    // material, both of which stay out of every log call in this module.
+    log('[providers] managed-settings.json is present but unreadable/unparseable; failing closed and switching away from claude-code (reasonCode cli-billing-helper-configured)');
+    return true; // present but unreadable/unparseable — fail closed
+  }
   return settingsHasBillingHelper(parsed);
 }
 
@@ -195,8 +217,9 @@ function detectBillingHelperConfigured(opts = {}) {
   const existsSyncImpl = typeof opts.existsSyncImpl === 'function' ? opts.existsSyncImpl : fs.existsSync;
   const homeDir = typeof opts.homeDir === 'string' ? opts.homeDir : os.homedir();
   const cwd = typeof opts.cwd === 'string' ? opts.cwd : process.cwd();
+  const log = typeof opts.log === 'function' ? opts.log : console.error;
 
-  if (managedSettingsBlocksOrUnverifiable(managedSettingsPathForPlatform(opts), existsSyncImpl, readFileSyncImpl)) {
+  if (managedSettingsBlocksOrUnverifiable(managedSettingsPathForPlatform(opts), existsSyncImpl, readFileSyncImpl, log)) {
     return true;
   }