doer-agent 0.9.12 → 0.9.13

package/dist/agent-fs-rpc.js

@@ -5,17 +5,25 @@ import { StringCodec } from "nats";
 import { extract as extractTar } from "tar";
 import { validateImageBytes } from "./agent-runtime-utils.js";
 const fsRpcCodec = StringCodec();
-function normalizeFsRpcPath(workspaceRoot, rawPath) {
+function isPathInsideRoot(root, target) {
+    return target === root || target.startsWith(root + path.sep);
+}
+export function normalizeFsRpcPath(workspaceRoot, rawPath, options = {}) {
     const raw = typeof rawPath === "string" && rawPath.trim() ? rawPath.trim() : ".";
     const normalizedRaw = raw.replace(/\\/g, "/");
     const useAbsolute = path.isAbsolute(normalizedRaw);
     const rel = normalizedRaw.replace(/^\/+/, "") || ".";
-    const abs = useAbsolute ? path.resolve(normalizedRaw) : path.resolve(workspaceRoot, rel);
-    if (abs !== workspaceRoot && !abs.startsWith(workspaceRoot + path.sep)) {
+    const resolvedWorkspaceRoot = path.resolve(workspaceRoot);
+    const abs = useAbsolute ? path.resolve(normalizedRaw) : path.resolve(resolvedWorkspaceRoot, rel);
+    if (!options.allowOutsideWorkspace && !isPathInsideRoot(resolvedWorkspaceRoot, abs)) {
         throw new Error("path escapes workspace root");
     }
     const formatPath = (target) => {
-        return path.relative(workspaceRoot, target).split(path.sep).join("/") || ".";
+        const resolvedTarget = path.resolve(target);
+        if (!isPathInsideRoot(resolvedWorkspaceRoot, resolvedTarget)) {
+            return resolvedTarget.split(path.sep).join("/") || "/";
+        }
+        return path.relative(resolvedWorkspaceRoot, resolvedTarget).split(path.sep).join("/") || ".";
     };
     return { abs, formatPath };
 }
@@ -90,7 +98,13 @@ function sha256Hex(bytes) {
 }
 async function executeFsRpc(args) {
     const action = parseFsRpcAction(args.request.action);
-    const { abs, formatPath } = normalizeFsRpcPath(args.workspaceRoot, args.request.path);
+    const allowOutsideWorkspace = action === "list" ||
+        action === "stat" ||
+        action === "upload_file" ||
+        action === "read_text";
+    const { abs, formatPath } = normalizeFsRpcPath(args.workspaceRoot, args.request.path, {
+        allowOutsideWorkspace,
+    });
     if (action === "stat") {
         const entry = await stat(abs);
         return {

package/dist/agent-fs-rpc.test.js

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { StringCodec } from "nats";
+import { handleFsRpcMessage, normalizeFsRpcPath } from "./agent-fs-rpc.js";
+const workspaceRoot = path.resolve("/tmp/doer-workspace");
+const outsidePath = path.resolve("/tmp/outside/file.csv");
+test("normalizes workspace paths as workspace-relative paths", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, "folder/file.txt");
+    assert.equal(target.abs, path.join(workspaceRoot, "folder/file.txt"));
+    assert.equal(target.formatPath(target.abs), "folder/file.txt");
+});
+test("allows and preserves absolute paths outside the workspace for read operations", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, outsidePath, {
+        allowOutsideWorkspace: true,
+    });
+    assert.equal(target.abs, outsidePath);
+    assert.equal(target.formatPath(target.abs), outsidePath.split(path.sep).join("/"));
+});
+test("allows parent traversal outside the workspace for read operations", () => {
+    const target = normalizeFsRpcPath(workspaceRoot, "../outside/file.csv", {
+        allowOutsideWorkspace: true,
+    });
+    assert.equal(target.abs, outsidePath);
+    assert.equal(target.formatPath(target.abs), outsidePath.split(path.sep).join("/"));
+});
+test("keeps paths outside the workspace blocked by default", () => {
+    assert.throws(() => normalizeFsRpcPath(workspaceRoot, outsidePath), /path escapes workspace root/);
+    assert.throws(() => normalizeFsRpcPath(workspaceRoot, "../outside/file.csv"), /path escapes workspace root/);
+});
+test("filesystem RPC lists and reads files outside the workspace but does not delete them", async () => {
+    const tempRoot = await mkdtemp(path.join(os.tmpdir(), "doer-fs-rpc-"));
+    const rpcWorkspaceRoot = path.join(tempRoot, "workspace");
+    const externalDir = path.join(tempRoot, "external");
+    const externalFile = path.join(externalDir, "example.txt");
+    const codec = StringCodec();
+    await mkdir(rpcWorkspaceRoot);
+    await mkdir(externalDir);
+    await writeFile(externalFile, "outside workspace");
+    async function request(action, targetPath) {
+        let responseData;
+        const msg = {
+            data: codec.encode(JSON.stringify({ action, path: targetPath })),
+            respond(data) {
+                responseData = data;
+                return true;
+            },
+        };
+        await handleFsRpcMessage({
+            msg,
+            workspaceRoot: rpcWorkspaceRoot,
+            serverBaseUrl: "https://example.com",
+            agentId: "agent-1",
+            agentToken: "token",
+            onError: () => undefined,
+        });
+        assert.ok(responseData);
+        return JSON.parse(codec.decode(responseData));
+    }
+    try {
+        const listing = await request("list", externalDir);
+        assert.equal(listing.ok, true);
+        assert.equal(listing.path, externalDir.split(path.sep).join("/"));
+        assert.deepEqual(listing.items.map((item) => item.path), [externalFile.split(path.sep).join("/")]);
+        const text = await request("read_text", externalFile);
+        assert.equal(text.ok, true);
+        assert.equal(text.text, "outside workspace");
+        const deletion = await request("delete_path", externalFile);
+        assert.equal(deletion.ok, false);
+        assert.match(String(deletion.error), /path escapes workspace root/);
+        assert.equal(await readFile(externalFile, "utf8"), "outside workspace");
+    }
+    finally {
+        await rm(tempRoot, { recursive: true, force: true });
+    }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",