cool-workflow 0.2.4 → 0.2.6

package/dist/shell/run-export.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportRun = exportRun;
 exports.importRun = importRun;
+exports.restoreRunAtomically = restoreRunAtomically;
 exports.verifyImportedRun = verifyImportedRun;
 exports.inspectArchive = inspectArchive;
 exports.importManifestPath = importManifestPath;
@@ -98,12 +99,15 @@ function exportRun(run, outputPath, options = {}) {
 }
 /** Import a run from a portable JSON file into a target directory. */
 function importRun(exportPath, targetDir) {
-    const raw = (0, fs_atomic_1.readJson)(exportPath);
+    const limits = archiveIntakeLimits();
+    const archiveBytes = readArchiveBytes(exportPath, limits);
+    const raw = JSON.parse(archiveBytes.toString("utf8"));
     if (raw.schemaVersion !== 1)
         throw new Error(`Unsupported export schema version: ${raw.schemaVersion}`);
-    const archiveSha256 = (0, hash_1.sha256Bytes)(fs.readFileSync(exportPath));
+    const archiveSha256 = (0, hash_1.sha256Bytes)(archiveBytes);
     const files = normalizeArchiveFiles(raw);
-    verifyArchiveFileDigests(files, raw.integrity);
+    validateArchiveIntake(files, limits);
+    verifyArchiveFileDigests(files, raw.integrity, limits);
     if (!raw.run || typeof raw.run !== "object") {
         throw new Error("Invalid run export: missing run object");
     }
@@ -113,10 +117,21 @@ function importRun(exportPath, targetDir) {
     if (!(0, fs_atomic_1.isContainedPath)(runDir, runsRoot)) {
         throw new Error(`Run id escapes the runs directory: ${JSON.stringify(raw.run.id)}`);
     }
+    // Validate the run shape BEFORE the deref and before any dir/file is written.
+    // A truncated archive can be missing run.paths (or carry non-string
+    // runDir/cwd); without this guard the deref throws a raw TypeError, or a
+    // present-but-shapeless paths half-restores the run dir with a broken rebase.
+    // Fail closed as an invalid archive instead.
+    if (!raw.run.paths ||
+        typeof raw.run.paths !== "object" ||
+        typeof raw.run.paths.runDir !== "string" ||
+        typeof raw.run.cwd !== "string") {
+        throw new Error("Invalid run export: run.paths.runDir and run.cwd must be strings");
+    }
     const oldRunDir = raw.run.paths.runDir;
     const oldCwd = raw.run.cwd;
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    (0, run_store_1.ensureRunDirs)(paths);
     for (const file of files) {
         const destination = path.join(runDir, file.relativePath);
         if (!(0, fs_atomic_1.isContainedPath)(destination, runDir)) {
@@ -153,6 +168,66 @@ function importRun(exportPath, targetDir) {
         verification,
     };
 }
+/** Restore through a same-disk staging tree, then publish the checked run with
+ *  one rename. Low-level import keeps its old report-only chain behavior. */
+function restoreRunAtomically(exportPath, targetDir) {
+    const physicalTarget = path.resolve(targetDir);
+    fs.mkdirSync(physicalTarget, { recursive: true });
+    const stageRoot = fs.mkdtempSync(path.join(physicalTarget, ".cw-restore-"));
+    let publishedRunDir;
+    try {
+        const staged = importRun(exportPath, stageRoot);
+        const finalRunDir = path.join(targetDir, ".cw", "runs", staged.run.id);
+        const physicalFinalRunDir = path.resolve(finalRunDir);
+        const stagedVerification = rebaseVerificationPaths(staged.verification, staged.run.paths.runDir, finalRunDir);
+        if (!staged.verification.ok)
+            return { imported: null, verification: stagedVerification };
+        if (fs.existsSync(physicalFinalRunDir)) {
+            throw new Error(`Refusing to overwrite existing restored run: ${staged.run.id}`);
+        }
+        const finalPaths = (0, run_paths_1.createRunPaths)(finalRunDir);
+        const finalRun = rebaseRun(staged.run, {
+            oldRunDir: staged.run.paths.runDir,
+            newRunDir: finalRunDir,
+            oldCwd: stageRoot,
+            newCwd: targetDir,
+            paths: finalPaths,
+        });
+        (0, fs_atomic_1.writeJson)(staged.run.paths.state, finalRun, { durable: true });
+        const stateCheck = (0, run_store_1.checkRunStateFile)(staged.run.paths.state);
+        if (stateCheck.report.status === "unsupported") {
+            throw new Error(`Restore state validation failed: ${stateCheck.report.errors.join("; ") || "unsupported run state"}`);
+        }
+        fs.mkdirSync(path.dirname(physicalFinalRunDir), { recursive: true });
+        fs.renameSync(path.resolve(staged.run.paths.runDir), physicalFinalRunDir);
+        publishedRunDir = physicalFinalRunDir;
+        const verification = verifyImportedRun(finalRun);
+        if (!verification.ok) {
+            fs.rmSync(physicalFinalRunDir, { recursive: true, force: true });
+            publishedRunDir = undefined;
+            return { imported: null, verification };
+        }
+        return {
+            imported: {
+                run: finalRun,
+                runDir: finalRunDir,
+                statePath: finalPaths.state,
+                manifestPath: importManifestPath(finalRun),
+                verifyCommand: `cw run verify-import ${finalRun.id} --cwd ${targetDir} --json`,
+                verification,
+            },
+            verification,
+        };
+    }
+    catch (error) {
+        if (publishedRunDir)
+            fs.rmSync(publishedRunDir, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        fs.rmSync(stageRoot, { recursive: true, force: true });
+    }
+}
 /** Verify an imported run against its restore manifest and telemetry
  *  chain. */
 function verifyImportedRun(run) {
@@ -228,12 +303,21 @@ function inspectArchive(archivePath) {
         archiveSha256: null,
         checks: [],
     };
+    let limits;
+    try {
+        limits = archiveIntakeLimits();
+    }
+    catch (error) {
+        return { ...base, checks: [{ name: "archive-limit", pass: false, code: "archive-limit-invalid", actual: messageOf(error) }] };
+    }
     let bytes;
     try {
-        bytes = fs.readFileSync(archivePath);
+        bytes = readArchiveBytes(archivePath, limits);
     }
     catch (error) {
-        return { ...base, checks: [{ name: "archive", pass: false, code: "archive-unreadable", path: archivePath, actual: messageOf(error) }] };
+        const message = messageOf(error);
+        const limited = message.startsWith("Archive raw byte limit exceeded:");
+        return { ...base, checks: [{ name: limited ? "archive-limit" : "archive", pass: false, code: limited ? "archive-limit-raw-bytes" : "archive-unreadable", path: archivePath, actual: message }] };
     }
     base.archiveSha256 = (0, hash_1.sha256Bytes)(bytes);
     let raw;
@@ -252,7 +336,23 @@ function inspectArchive(archivePath) {
     }
     try {
         const files = normalizeArchiveFiles(raw);
-        const { checks } = collectArchiveDigestChecks(files, raw.integrity);
+        try {
+            validateArchiveIntake(files, limits);
+        }
+        catch (error) {
+            return {
+                schemaVersion: 1,
+                archivePath,
+                ok: false,
+                schemaSupported: true,
+                runId: raw.run && raw.run.id ? raw.run.id : null,
+                fileCount: files.length,
+                manifestSha256: raw.integrity ? digestManifest(files) : null,
+                archiveSha256: base.archiveSha256,
+                checks: [archiveLimitCheck(error)],
+            };
+        }
+        const checks = collectArchiveDigestChecks(files, raw.integrity, limits).checks;
         if (!raw.integrity && /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_ARCHIVE_INTEGRITY || "")) {
             checks.push({ name: "archive-integrity", pass: false, code: "archive-integrity-required" });
         }
@@ -293,7 +393,7 @@ function reportSectionEmbedsResult(reportMd, taskId, expected) {
  *  (with the bundle's embedded public key) the ed25519 signatures.
  *  Never throws — every failure is a structured check and a false `ok`.
  *
- *  Key precedence is bundle > argument > environment. */
+ *  Key precedence is argument > bundle > environment. */
 function verifyReportBundle(archivePath, options = {}) {
     const inspect = inspectArchive(archivePath);
     const failedChecks = inspect.checks.filter((check) => !check.pass).map((check) => ({ name: check.name, code: check.code }));
@@ -314,12 +414,12 @@ function verifyReportBundle(archivePath, options = {}) {
         reportFindingsVerified: false,
         failedChecks,
     };
-    if (!inspect.schemaSupported)
+    if (!inspect.schemaSupported || inspect.checks.some((check) => check.code?.startsWith("archive-limit-")))
         return base;
     let bundleKey;
     let reportContent;
     try {
-        const raw = JSON.parse(fs.readFileSync(archivePath, "utf8"));
+        const raw = JSON.parse(readArchiveBytes(archivePath, archiveIntakeLimits()).toString("utf8"));
         bundleKey = raw.trust?.publicKeyPem;
         if (options.extractReportTo) {
             const reportFile = (raw.files || []).find((file) => file.relativePath === "report.md");
@@ -333,8 +433,39 @@ function verifyReportBundle(archivePath, options = {}) {
     catch {
         /* inspect already recorded the parse failure; treat key as absent */
     }
-    const trustKeySource = bundleKey ? "bundle" : options.pubkey ? "argument" : process.env.CW_AGENT_ATTEST_PUBKEY ? "environment" : "none";
-    const trustKey = (0, telemetry_attestation_1.resolveTrustPublicKey)(bundleKey || options.pubkey || process.env.CW_AGENT_ATTEST_PUBKEY);
+    // Key precedence: an explicit operator --pubkey/options.pubkey WINS over a
+    // bundle-embedded key. A bundle carries its own key so it verifies OFFLINE,
+    // but that key must never OVERRIDE a key the operator pinned by hand — else a
+    // bundle re-signed with an attacker's OWN key (and embedding that key) would
+    // verify green against itself. When the operator pins a key AND the bundle
+    // embeds a DIFFERENT one, fail closed with a clear trust-key-mismatch rather
+    // than silently trusting the bundle's own key.
+    const resolvedArg = (0, telemetry_attestation_1.resolveTrustPublicKey)(options.pubkey);
+    const resolvedBundle = (0, telemetry_attestation_1.resolveTrustPublicKey)(bundleKey);
+    const resolvedEnv = (0, telemetry_attestation_1.resolveTrustPublicKey)(process.env.CW_AGENT_ATTEST_PUBKEY);
+    let trustKey;
+    let trustKeySource;
+    let trustKeyConflict = false;
+    if (options.pubkey) {
+        trustKey = resolvedArg;
+        trustKeySource = "argument";
+        if (resolvedArg && resolvedBundle && normalizePem(resolvedArg) !== normalizePem(resolvedBundle)) {
+            trustKeyConflict = true;
+            failedChecks.push({ name: "trust-key", code: "trust-key-mismatch" });
+        }
+    }
+    else if (bundleKey) {
+        trustKey = resolvedBundle;
+        trustKeySource = "bundle";
+    }
+    else if (process.env.CW_AGENT_ATTEST_PUBKEY) {
+        trustKey = resolvedEnv;
+        trustKeySource = "environment";
+    }
+    else {
+        trustKey = undefined;
+        trustKeySource = "none";
+    }
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "cw-verify-bundle-"));
     let telemetryVerified = false;
     let trustAuditVerified = false;
@@ -421,7 +552,7 @@ function verifyReportBundle(archivePath, options = {}) {
         schemaVersion: 1,
         archivePath,
         runId: inspect.runId,
-        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && reportFindingsOk && !strictShortfall && !extractShortfall && !unsignedShortfall,
+        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && reportFindingsOk && !strictShortfall && !extractShortfall && !unsignedShortfall && !trustKeyConflict,
         archiveOk: inspect.ok,
         telemetryVerified,
         trustAuditVerified,
@@ -523,28 +654,133 @@ function roleForRelativePath(relativePath) {
     return "run-file";
 }
 function normalizeArchiveFiles(raw) {
-    const modern = raw.files || [];
+    const modernValue = raw.files;
+    if (modernValue !== undefined && !Array.isArray(modernValue)) {
+        throw new Error("Invalid run export: files must be an array");
+    }
+    const modern = (modernValue || []);
     if (modern.length) {
-        return modern.map((file) => ({
-            relativePath: cleanArchiveRelativePath(file.relativePath),
-            role: file.role,
-            contentBase64: file.contentBase64,
-            sha256: file.sha256,
-            sizeBytes: file.sizeBytes,
-            sourcePath: file.sourcePath,
-        }));
-    }
-    return (raw.artifacts || []).map((artifact) => {
+        return validateArchiveFileTable(modern.map(normalizeModernArchiveFile));
+    }
+    const legacyValue = raw.artifacts;
+    if (legacyValue !== undefined && !Array.isArray(legacyValue)) {
+        throw new Error("Invalid run export: artifacts must be an array");
+    }
+    const legacy = (legacyValue || []).map((value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error("Invalid run export: every artifact must be an object");
+        }
+        const artifact = value;
+        if (typeof artifact.path !== "string")
+            throw new Error("Invalid run export: artifact path must be a string");
         const contentBase64 = artifact.contentBase64 || Buffer.from("", "utf8").toString("base64");
+        if (typeof contentBase64 !== "string")
+            throw new Error(`Invalid run export: contentBase64 must be a string for ${artifact.path}`);
         const bytes = Buffer.from(contentBase64, "base64");
         return {
             relativePath: cleanArchiveRelativePath(artifact.path),
             role: "artifact",
             contentBase64,
-            sha256: artifact.sha256 || (0, hash_1.sha256Bytes)(bytes),
-            sizeBytes: artifact.sizeBytes ?? bytes.length,
+            sha256: typeof artifact.sha256 === "string" ? artifact.sha256 : (0, hash_1.sha256Bytes)(bytes),
+            sizeBytes: artifact.sizeBytes === undefined ? bytes.length : artifact.sizeBytes,
         };
     });
+    return validateArchiveFileTable(legacy);
+}
+function archiveIntakeLimits() {
+    return {
+        rawBytes: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_BYTES"),
+        fileCount: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_FILES"),
+        contentBytes: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_CONTENT_BYTES"),
+    };
+}
+function archiveLimitFromEnvironment(name) {
+    const value = process.env[name];
+    if (value === undefined)
+        return undefined;
+    if (!/^[1-9][0-9]*$/.test(value))
+        throw new Error(`Invalid ${name}: expected a positive safe integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed))
+        throw new Error(`Invalid ${name}: expected a positive safe integer`);
+    return parsed;
+}
+/** Read the archive only after its operator-set raw-byte limit has passed. */
+function readArchiveBytes(archivePath, limits) {
+    if (limits.rawBytes !== undefined) {
+        const size = fs.statSync(archivePath).size;
+        if (size > limits.rawBytes)
+            throw new Error(`Archive raw byte limit exceeded: max ${limits.rawBytes}, got ${size}`);
+    }
+    return fs.readFileSync(archivePath);
+}
+function validateArchiveIntake(files, limits) {
+    if (limits.fileCount !== undefined && files.length > limits.fileCount) {
+        throw new Error(`Archive file count limit exceeded: max ${limits.fileCount}, got ${files.length}`);
+    }
+    if (limits.contentBytes === undefined)
+        return;
+    let total = 0;
+    for (const file of files) {
+        if (file.sizeBytes > limits.contentBytes - total) {
+            throw new Error(`Archive content byte limit exceeded: max ${limits.contentBytes}, got more than ${limits.contentBytes}`);
+        }
+        total += file.sizeBytes;
+    }
+}
+function archiveLimitCheck(error) {
+    const actual = messageOf(error);
+    const code = actual.startsWith("Archive file count limit exceeded:")
+        ? "archive-limit-file-count"
+        : actual.startsWith("Archive content byte limit exceeded:")
+            ? "archive-limit-content-bytes"
+            : "archive-limit-invalid";
+    return { name: "archive-limit", pass: false, code, actual };
+}
+function normalizeModernArchiveFile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid run export: every file entry must be an object");
+    }
+    const file = value;
+    if (typeof file.relativePath !== "string")
+        throw new Error("Invalid run export: file relativePath must be a string");
+    if (typeof file.contentBase64 !== "string")
+        throw new Error(`Invalid run export: contentBase64 must be a string for ${file.relativePath}`);
+    if (typeof file.sha256 !== "string")
+        throw new Error(`Invalid run export: sha256 must be a string for ${file.relativePath}`);
+    if (file.sourcePath !== undefined && typeof file.sourcePath !== "string") {
+        throw new Error(`Invalid run export: sourcePath must be a string for ${file.relativePath}`);
+    }
+    return {
+        relativePath: cleanArchiveRelativePath(file.relativePath),
+        role: file.role,
+        contentBase64: file.contentBase64,
+        sha256: file.sha256,
+        sizeBytes: file.sizeBytes,
+        sourcePath: file.sourcePath,
+    };
+}
+/** Make one canonical, unique archive file table before any caller writes.
+ *  Digest and base64 checks run next, but shape and path faults stop here. */
+function validateArchiveFileTable(files) {
+    const roles = new Set(["artifact", "audit", "telemetry", "run-file"]);
+    const seen = new Set();
+    for (const file of files) {
+        if (!roles.has(file.role))
+            throw new Error(`Invalid archive file role for ${file.relativePath}: ${String(file.role)}`);
+        if (!/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error(`Invalid archive sha256 for ${file.relativePath}`);
+        if (!Number.isSafeInteger(file.sizeBytes) || file.sizeBytes < 0) {
+            throw new Error(`Invalid archive size for ${file.relativePath}: ${String(file.sizeBytes)}`);
+        }
+        if (file.relativePath === "state.json" || file.relativePath === "import-manifest.json" || file.relativePath.endsWith(".lock")) {
+            throw new Error(`Reserved archive relative path: ${file.relativePath}`);
+        }
+        if (seen.has(file.relativePath))
+            throw new Error(`Duplicate archive relative path: ${file.relativePath}`);
+        seen.add(file.relativePath);
+    }
+    return files;
 }
 function decodeBase64StrictResult(value, relativePath) {
     if (typeof value !== "string") {
@@ -568,8 +804,9 @@ function decodeBase64Strict(value, relativePath) {
         throw new Error(archiveCheckMessage(decoded.check));
     return decoded.bytes;
 }
-function collectArchiveDigestChecks(files, integrity) {
+function collectArchiveDigestChecks(files, integrity, limits = {}) {
     const checks = [];
+    let decodedTotal = 0;
     for (const file of files) {
         const decoded = decodeBase64StrictResult(file.contentBase64, file.relativePath);
         if (!decoded.ok) {
@@ -577,6 +814,12 @@ function collectArchiveDigestChecks(files, integrity) {
             continue;
         }
         const bytes = decoded.bytes;
+        if (limits.contentBytes !== undefined && bytes.length > limits.contentBytes - decodedTotal) {
+            checks.push({ name: "archive-limit", pass: false, code: "archive-limit-content-bytes", path: file.relativePath, expected: String(limits.contentBytes), actual: `more than ${limits.contentBytes}` });
+        }
+        else {
+            decodedTotal += bytes.length;
+        }
         const actual = (0, hash_1.sha256Bytes)(bytes);
         const digestOk = actual === file.sha256;
         checks.push(digestOk ? { name: "archive-file", pass: true, path: file.relativePath } : { name: "archive-file", pass: false, code: "digest-mismatch", path: file.relativePath, expected: file.sha256, actual });
@@ -608,11 +851,11 @@ function archiveCheckMessage(check) {
             return `Archive verification failed: ${check.name}`;
     }
 }
-function verifyArchiveFileDigests(files, integrity) {
+function verifyArchiveFileDigests(files, integrity, limits = {}) {
     if (!integrity && /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_ARCHIVE_INTEGRITY || "")) {
         throw new Error("Archive integrity block required but absent (CW_REQUIRE_ARCHIVE_INTEGRITY=1)");
     }
-    const failed = collectArchiveDigestChecks(files, integrity).checks.find((c) => !c.pass);
+    const failed = collectArchiveDigestChecks(files, integrity, limits).checks.find((c) => !c.pass);
     if (failed)
         throw new Error(archiveCheckMessage(failed));
 }
@@ -637,6 +880,16 @@ function rebaseRun(source, context) {
         : cloned.audit;
     return cloned;
 }
+function rebaseVerificationPaths(result, oldRunDir, newRunDir) {
+    const replace = (value) => value === oldRunDir || value.startsWith(oldRunDir + path.sep)
+        ? newRunDir + value.slice(oldRunDir.length)
+        : value;
+    return {
+        ...result,
+        manifestPath: replace(result.manifestPath),
+        checks: result.checks.map((check) => ({ ...check, ...(check.path ? { path: replace(check.path) } : {}) })),
+    };
+}
 function deepRebase(value, context) {
     if (typeof value === "string")
         return rebaseString(value, context);
@@ -663,10 +916,13 @@ function rebaseString(value, context) {
     return value;
 }
 function cleanArchiveRelativePath(value) {
-    const cleaned = toArchivePath(value).replace(/^\/+/, "");
-    if (!cleaned || cleaned === "." || cleaned.startsWith("../") || cleaned.includes("/../")) {
+    const portable = value.replace(/\\/g, "/");
+    if (portable.startsWith("/") || /^[A-Za-z]:\//.test(portable) || /(^|\/)\.\.(\/|$)/.test(portable) || /[\u0000-\u001f\u007f]/.test(portable)) {
         throw new Error(`Invalid archive relative path: ${value}`);
     }
+    const cleaned = path.posix.normalize(portable);
+    if (!cleaned || cleaned === "." || cleaned.startsWith("../") || cleaned.includes("/../"))
+        throw new Error(`Invalid archive relative path: ${value}`);
     return cleaned;
 }
 function toArchivePath(value) {
@@ -675,6 +931,12 @@ function toArchivePath(value) {
 function safeArchiveBasename(value) {
     return value.replace(/[^A-Za-z0-9._-]/g, "_") || "artifact";
 }
+/** Compare two PEM public keys byte-for-byte after dropping whitespace, so a
+ *  benign line-wrap or trailing-newline difference does not read as a key
+ *  change, but a truly different key (different base64 body) does. */
+function normalizePem(pem) {
+    return (pem || "").replace(/\s+/g, "");
+}
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/shell/run-registry-io.js

@@ -1048,6 +1048,14 @@ function formatResume(result) {
         `Resume ${result.runId} [${result.lifecycle}] loopStage=${result.loopStage} (resolved from ${result.resolvedFrom}, ${result.freshness})`,
         `  resumable=${result.resumable} nextTasks=${result.nextTasks.length}`,
     ];
+    if (result.drive) {
+        lines.push(`  drive=${result.drive.status} workers=${result.drive.completedWorkers}/${result.drive.plannedWorkers} parked=${result.drive.parkedWorkers}`);
+        for (const step of result.drive.steps) {
+            lines.push(`  step ${step.action} [${step.status}]${step.taskId ? ` task=${step.taskId}` : ""}${step.reason ? ` reason=${step.reason}` : ""}`);
+        }
+        if (result.drive.commitId)
+            lines.push(`  commit=${result.drive.commitId}`);
+    }
     for (const action of result.nextActions)
         lines.push(`  -> ${action.command}\n     ${action.reason}`);
     return lines.join("\n");