devrites 3.2.16 → 3.2.17

package/engine/internal/devritespaths/paths.go

@@ -93,6 +93,86 @@ func FeatureDir(root, slug string) string {
 	return work
 }
 
+// ExistingFeatureDirChecked resolves an existing canonical feature workspace
+// without following a work/<slug> or features/<slug> symlink. Mutating
+// control-plane commands use this instead of FeatureDir so an attacker cannot
+// redirect archive/removal operations outside the selected DevRites root.
+func ExistingFeatureDirChecked(root, slug string) (string, error) {
+	if !validSlug(slug) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
+	}
+	if ws, err := WorkspaceOverrideChecked(root, slug); err != nil {
+		return "", err
+	} else if ws != "" {
+		return ws, nil
+	}
+	for _, parent := range []string{"work", "features"} {
+		candidate := filepath.Join(root, parent, slug)
+		resolved, err := checkedCanonicalDir(root, candidate, parent, slug)
+		if err == nil {
+			return resolved, nil
+		}
+		if !errors.Is(err, os.ErrNotExist) {
+			return "", err
+		}
+	}
+	return "", os.ErrNotExist
+}
+
+// ArchiveDirChecked resolves (or safely prepares) the canonical archive
+// directory. Existing symlinked archive components are rejected before a
+// close-out can move a workspace through them.
+func ArchiveDirChecked(root string) (string, error) {
+	return checkedCanonicalDir(root, filepath.Join(root, "archive"), "archive", "")
+}
+
+func checkedCanonicalDir(root, candidate, parent, slug string) (string, error) {
+	resolvedRoot, err := safepath.ResolveExisting(root)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
+	}
+	info, err := os.Lstat(candidate)
+	if err != nil {
+		if !os.IsNotExist(err) || parent != "archive" {
+			return "", err
+		}
+		resolved, resolveErr := safepath.ResolveExisting(candidate)
+		if resolveErr != nil {
+			return "", fmt.Errorf("DRV-ARCHIVE-INVALID: resolve archive %q: %w", candidate, resolveErr)
+		}
+		if !safepath.WithinResolved(resolved, resolvedRoot) {
+			return "", fmt.Errorf("DRV-ARCHIVE-OUTSIDE-ROOT: archive %q escapes %q", candidate, root)
+		}
+		rel, relErr := filepath.Rel(resolvedRoot, resolved)
+		if relErr != nil || filepath.Clean(rel) != "archive" {
+			return "", fmt.Errorf("DRV-ARCHIVE-INVALID: archive %q is not the canonical archive directory", candidate)
+		}
+		return filepath.Clean(candidate), nil
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return "", fmt.Errorf("DRV-WORKSPACE-SYMLINK: canonical directory %q must not be a symlink", candidate)
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: canonical directory %q is not a directory", candidate)
+	}
+	resolved, err := safepath.ResolveExisting(candidate)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve canonical directory %q: %w", candidate, err)
+	}
+	if !safepath.WithinResolved(resolved, resolvedRoot) {
+		return "", fmt.Errorf("DRV-WORKSPACE-OUTSIDE-ROOT: canonical directory %q escapes %q", candidate, root)
+	}
+	want := parent
+	if slug != "" {
+		want = filepath.Join(parent, slug)
+	}
+	rel, err := filepath.Rel(resolvedRoot, resolved)
+	if err != nil || filepath.Clean(rel) != filepath.Clean(want) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: canonical directory %q resolves to unexpected path %q", candidate, resolved)
+	}
+	return filepath.Clean(candidate), nil
+}
+
 // ActiveSlug reads and trims the active-feature pointer. A missing pointer file
 // is not an error; it yields the empty slug.
 func ActiveSlug(root string) (string, error) {

package/engine/internal/lib/adoption.go

@@ -414,7 +414,12 @@ func SecretScan(root string, args []string, stdout, stderr io.Writer) int {
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
 		case "--staged":
-			paths = append(paths, gitStagedNames(project)...)
+			staged, err := gitStagedNames(project)
+			if err != nil {
+				fmt.Fprintf(stderr, "secret-scan: cannot inspect staged paths: %v\n", err)
+				return 2
+			}
+			paths = append(paths, staged...)
 		case "--text":
 			i++
 			if i < len(args) {
@@ -433,7 +438,12 @@ func SecretScan(root string, args []string, stdout, stderr io.Writer) int {
 		paths = append(paths, touchedFiles(root, slug)...)
 	}
 	if len(paths) == 0 {
-		paths = append(paths, gitDiffNames(project)...)
+		changed, err := gitDiffNames(project)
+		if err != nil {
+			fmt.Fprintf(stderr, "secret-scan: cannot inspect changed paths: %v\n", err)
+			return 2
+		}
+		paths = append(paths, changed...)
 	}
 	findings := []secretFinding{}
 	seen := map[string]bool{}
@@ -484,12 +494,12 @@ func scanSecrets(path, text string) []secretFinding {
 	return out
 }
 
-func gitStagedNames(project string) []string {
-	out, err := boundedCommandOutput(15*time.Second, "", "git", "-C", project, "diff", "--cached", "--name-only")
+func gitStagedNames(project string) ([]string, error) {
+	out, err := runGitCommand(project, nil, "diff", "--cached", "--name-only")
 	if err != nil {
-		return nil
+		return nil, err
 	}
-	return splitLinesNoTrailing(out)
+	return splitLinesNoTrailing(out), nil
 }
 
 func touchedFiles(root, slug string) []string {
@@ -515,7 +525,12 @@ func DocsStale(root string, args []string, stdout, stderr io.Writer) int {
 	slug := slugOrActive(root, args)
 	changed := touchedFiles(root, slug)
 	if len(changed) == 0 {
-		changed = gitDiffNames(project)
+		var err error
+		changed, err = gitDiffNames(project)
+		if err != nil {
+			fmt.Fprintf(stderr, "docs-stale: cannot inspect changed paths: %v\n", err)
+			return 2
+		}
 	}
 	docsTouched, surfaceTouched := false, []string{}
 	for _, p := range changed {

package/engine/internal/lib/adoption_test.go

@@ -53,6 +53,36 @@ func TestSecretScanBlocksHighSeverityTouchedFile(t *testing.T) {
 	}
 }
 
+func TestSecretScanFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	t.Chdir(project)
+	t.Setenv("PATH", t.TempDir())
+
+	var out, err bytes.Buffer
+	if code := SecretScan(root, nil, &out, &err); code != 2 {
+		t.Fatalf("want rc=2 got %d stdout=%s stderr=%s", code, out.String(), err.String())
+	}
+	if !strings.Contains(err.String(), "cannot inspect changed paths") {
+		t.Fatalf("missing fail-closed diagnostic: %s", err.String())
+	}
+}
+
+func TestDocsStaleFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	t.Chdir(project)
+	t.Setenv("PATH", t.TempDir())
+
+	var out, err bytes.Buffer
+	if code := DocsStale(root, nil, &out, &err); code != 2 {
+		t.Fatalf("want rc=2 got %d stdout=%s stderr=%s", code, out.String(), err.String())
+	}
+	if !strings.Contains(err.String(), "cannot inspect changed paths") {
+		t.Fatalf("missing fail-closed diagnostic: %s", err.String())
+	}
+}
+
 func TestSpecDedupeSearchesScratchPRDs(t *testing.T) {
 	project := t.TempDir()
 	root := filepath.Join(project, ".devrites")

package/engine/internal/lib/closeout.go

@@ -5,6 +5,9 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/state"
 )
 
 // CloseOut retires a shipped feature: it moves the feature directory into the
@@ -30,13 +33,27 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 		return 4
 	}
 
-	work := featureDir(dv, slug)
-	arch := filepath.Join(dv, "archive", slug)
+	work, err := devritespaths.ExistingFeatureDirChecked(dv, slug)
+	if err != nil {
+		if os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "close-out: no workspace for %s\n", slug)
+			return 4
+		}
+		fmt.Fprintf(stderr, "close-out: invalid workspace for %s: %v\n", slug, err)
+		return 1
+	}
+	archiveDir, err := devritespaths.ArchiveDirChecked(dv)
+	if err != nil {
+		fmt.Fprintf(stderr, "close-out: invalid archive directory: %v\n", err)
+		return 1
+	}
+	arch := filepath.Join(archiveDir, slug)
 	active := filepath.Join(dv, "ACTIVE")
 
-	if !isDir(work) {
-		fmt.Fprintf(stderr, "close-out: no workspace at %s\n", work)
-		return 4
+	activeSlug, err := devritespaths.ActiveSlug(dv)
+	if err != nil {
+		fmt.Fprintf(stderr, "close-out: invalid ACTIVE cursor: %v\n", err)
+		return 1
 	}
 	// A broken symlink at the destination still counts as "already there", so use
 	// Lstat rather than Stat to avoid silently overwriting it.
@@ -47,7 +64,7 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 
 	// Fail closed: if the move does not happen, leave the cursor alone and do not
 	// claim success: a lost audit trail must never look like a clean close-out.
-	if err := os.MkdirAll(filepath.Join(dv, "archive"), 0o755); err != nil {
+	if err := os.MkdirAll(archiveDir, 0o755); err != nil {
 		fmt.Fprintf(stderr, "close-out: cannot create archive dir: %v\n", err)
 		return 1
 	}
@@ -57,12 +74,18 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	}
 
 	// Clear ACTIVE only if it still points at the slug we just archived.
-	if isFile(active) {
-		if b, err := os.ReadFile(active); err == nil && stripASCIISpace(string(b)) == slug {
-			_ = os.WriteFile(active, nil, 0o644)
-			fmt.Fprintf(stdout, "close-out: archived %s -> %s and cleared ACTIVE\n", slug, filepath.ToSlash(arch))
-			return 0
+	if activeSlug == slug {
+		if err := state.AtomicWrite(active, nil, 0o644); err != nil {
+			rollbackErr := os.Rename(arch, work)
+			if rollbackErr != nil {
+				fmt.Fprintf(stderr, "close-out: cannot clear ACTIVE after archiving: %v; rollback %s -> %s also failed: %v\n", err, arch, work, rollbackErr)
+			} else {
+				fmt.Fprintf(stderr, "close-out: cannot clear ACTIVE; archive move rolled back: %v\n", err)
+			}
+			return 1
 		}
+		fmt.Fprintf(stdout, "close-out: archived %s -> %s and cleared ACTIVE\n", slug, filepath.ToSlash(arch))
+		return 0
 	}
 	fmt.Fprintf(stdout, "close-out: archived %s -> %s (ACTIVE pointed elsewhere: left as-is)\n", slug, filepath.ToSlash(arch))
 	return 0

package/engine/internal/lib/closeout_test.go

@@ -0,0 +1,99 @@
+package lib
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func runCloseOut(t *testing.T, root string, args ...string) (int, string) {
+	t.Helper()
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := CloseOut(root, args, stdout, stderr)
+	return code, stdout.String() + stderr.String()
+}
+
+func TestCloseOutRejectsWorkspaceSymlinkEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "work"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "work", "feat")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	writeFile(t, filepath.Join(outside, "state.md"), "outside\n")
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "invalid workspace") {
+		t.Fatalf("missing workspace diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(outside, "state.md")) {
+		t.Fatal("close-out moved a workspace through an external symlink")
+	}
+}
+
+func TestCloseOutRejectsArchiveSymlinkEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n")
+	if err := os.Symlink(outside, filepath.Join(root, "archive")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "invalid archive") {
+		t.Fatalf("missing archive diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(root, "work", "feat", "state.md")) {
+		t.Fatal("close-out moved the workspace through an external archive symlink")
+	}
+	if entries, err := os.ReadDir(outside); err != nil {
+		t.Fatal(err)
+	} else if len(entries) != 0 {
+		t.Fatalf("outside archive changed: %v", entries)
+	}
+}
+
+func TestCloseOutRollsBackArchiveWhenActiveCannotBeCleared(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission model differs on Windows")
+	}
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n")
+	writeFile(t, filepath.Join(root, "ACTIVE"), "feat\n")
+	if err := os.MkdirAll(filepath.Join(root, "archive"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(root, 0o555); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = os.Chmod(root, 0o755) }()
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "archive move rolled back") {
+		t.Fatalf("missing rollback diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(root, "work", "feat", "state.md")) {
+		t.Fatal("workspace was not restored after ACTIVE clear failed")
+	}
+	if _, err := os.Lstat(filepath.Join(root, "archive", "feat")); !os.IsNotExist(err) {
+		t.Fatalf("archive remained after rollback: %v", err)
+	}
+	data, err := os.ReadFile(filepath.Join(root, "ACTIVE"))
+	if err != nil || string(data) != "feat\n" {
+		t.Fatalf("ACTIVE changed after rollback: %q, %v", data, err)
+	}
+}

package/engine/internal/lib/dispatchwaive.go

@@ -0,0 +1,31 @@
+package lib
+
+import (
+	"fmt"
+	"io"
+)
+
+var dispatchWaiverReasons = map[string]struct{}{
+	"human-gate-before-dispatch": {},
+	"no-active-workspace":        {},
+	"no-eligible-work":           {},
+	"readiness-failed":           {},
+	"wrong-phase":                {},
+}
+
+func ValidDispatchWaiver(reason string) bool {
+	_, ok := dispatchWaiverReasons[reason]
+	return ok
+}
+
+// DispatchWaive validates the reason token used by the agent-dispatch hook.
+// The hook records the successful PostToolUse receipt; this command deliberately
+// owns no separate state.
+func DispatchWaive(args []string, stdout, stderr io.Writer) int {
+	if len(args) != 1 || !ValidDispatchWaiver(args[0]) {
+		fmt.Fprintln(stderr, "usage: devrites-engine dispatch-waive <human-gate-before-dispatch|no-active-workspace|no-eligible-work|readiness-failed|wrong-phase>")
+		return 2
+	}
+	fmt.Fprintf(stdout, "dispatch-waive: accepted %s\n", args[0])
+	return 0
+}

package/engine/internal/lib/dispatchwaive_test.go

@@ -0,0 +1,23 @@
+package lib
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestDispatchWaiveAcceptsOnlyKnownSingleReason(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := DispatchWaive([]string{"wrong-phase"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("valid reason code=%d stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "accepted wrong-phase") {
+		t.Fatalf("missing receipt: %s", stdout.String())
+	}
+
+	stdout.Reset()
+	stderr.Reset()
+	if code := DispatchWaive([]string{"anything"}, &stdout, &stderr); code != 2 {
+		t.Fatalf("invalid reason code=%d, want 2", code)
+	}
+}

package/engine/internal/lib/mutationgate.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -32,8 +33,11 @@ func MutationGate(root string, args []string, stdout, stderr io.Writer) int {
 	// Config files are looked up relative to the repo root, falling back to the
 	// working directory when this is not a git repo.
 	cwd, _ := os.Getwd()
-	base := gitToplevel(cwd)
-	if base == "" {
+	base, err := gitToplevel(cwd)
+	if errors.Is(err, errNotGitRepository) {
+		base = "."
+	} else if err != nil {
+		fmt.Fprintf(stderr, "mutation-gate: cannot resolve git worktree; using current directory: %v\n", err)
 		base = "."
 	}