drafted 1.14.6 → 1.14.8

package/cli/drafted.mjs

@@ -8,8 +8,8 @@
  */
 
 import { program } from 'commander';
-import { spawn, execSync } from 'child_process';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, unlinkSync } from 'fs';
+import { spawn, execSync, execFileSync } from 'child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, unlinkSync, chmodSync } from 'fs';
 import { join, dirname, basename, resolve } from 'path';
 import { homedir, tmpdir, platform } from 'os';
 import { fileURLToPath } from 'url';
@@ -38,9 +38,9 @@ const PACKAGE_VERSION = (() => {
   }
 })();
 
-// Ensure state directory exists
+// Ensure state directory exists (0700 — holds the session token in auth.json)
 if (!existsSync(DEFAULT_STATE_DIR)) {
-  mkdirSync(DEFAULT_STATE_DIR, { recursive: true });
+  mkdirSync(DEFAULT_STATE_DIR, { recursive: true, mode: 0o700 });
 }
 
 // Helper: Read projects
@@ -203,9 +203,13 @@ function readAuth() {
 
 function writeAuth(authData) {
   if (!existsSync(DEFAULT_STATE_DIR)) {
-    mkdirSync(DEFAULT_STATE_DIR, { recursive: true });
+    mkdirSync(DEFAULT_STATE_DIR, { recursive: true, mode: 0o700 });
   }
-  writeFileSync(DEFAULT_AUTH_FILE, JSON.stringify(authData, null, 2));
+  // SECURITY: auth.json holds the long-lived Drafted session token. Restrict it to the
+  // owner (0600) so no other local user on a shared host can read it. writeFileSync's mode
+  // only applies on create, so chmod after to also fix a pre-existing world-readable file.
+  writeFileSync(DEFAULT_AUTH_FILE, JSON.stringify(authData, null, 2), { mode: 0o600 });
+  try { chmodSync(DEFAULT_AUTH_FILE, 0o600); } catch { /* best effort */ }
 }
 
 function clearAuth() {
@@ -422,12 +426,15 @@ program
     console.log('');
     console.log('   If the browser doesn\'t open, visit the URL above manually.');
 
-    // Open browser
+    // Open browser. SECURITY: verificationUrl comes from the server — pass it as an argv
+    // arg (execFileSync), never interpolated into a shell string, so a compromised/MITM'd
+    // server response can't inject `$(...)`/backticks that run on this host.
     try {
-      const openCmd = process.platform === 'darwin' ? 'open'
-        : process.platform === 'win32' ? 'start'
-        : 'xdg-open';
-      execSync(`${openCmd} "${verificationUrl}"`, { stdio: 'ignore' });
+      if (process.platform === 'win32') {
+        execFileSync('cmd', ['/c', 'start', '', verificationUrl], { stdio: 'ignore' });
+      } else {
+        execFileSync(process.platform === 'darwin' ? 'open' : 'xdg-open', [verificationUrl], { stdio: 'ignore' });
+      }
     } catch {
       // Browser open failed — user will use the URL manually
     }
@@ -1584,7 +1591,12 @@ async function syncOneSkill(ref, outDir, org) {
     mkdirSync(dirname(full), { recursive: true });
     writeFileSync(full, content);
   }
-  return { ref, slug, hash, status: 'ok' };
+  // createdBy + forkedFrom decide whether this skill's setup may auto-run: shell authored by
+  // someone else must not run unattended on sync. forkedFrom is load-bearing — the CLI/MCP
+  // AUTO-forks a global/other-org skill on use, which copies the source author's setup but
+  // stamps createdBy = the forking (victim) user, so createdBy alone would mislabel foreign
+  // setup as self-authored. A forked skill is never treated as self-authored.
+  return { ref, slug, hash, status: 'ok', createdBy: skill.createdBy ?? null, forkedFrom: skill.forkedFrom ?? null };
 }
 
 const skillCmd = program.command('skill').description('Skill library operations');
@@ -1594,10 +1606,11 @@ skillCmd
   .option('--ref <ref>', 'skill ref slug[@hash] (repeatable)', (v, acc) => { acc.push(v); return acc; }, [])
   .requiredOption('--out <dir>', 'output directory for bundles')
   .option('--org <org>', 'resolve against this Drafted org (id or name); scopes per-request without switching the session')
-  .option('--no-setup', 'do not run each skill\'s setup after materializing (default: run setup so source-only skills are runnable)')
+  .option('--no-setup', 'do not run each skill\'s setup after materializing (default: run setup only for skills you authored)')
+  .option('--allow-untrusted-setup', 'also run setup for skills authored by someone else (SECURITY: runs their shell on this host — only for skills you trust)')
   .option('--format <fmt>', 'output format: json or text', 'text')
   .action(async (opts) => {
-    requireLogin();
+    const auth = requireLogin();
     const refs = opts.ref || [];
     mkdirSync(opts.out, { recursive: true });
     const results = [];
@@ -1611,9 +1624,22 @@ skillCmd
         // failure is reported but the materialized source stays put (sync is still
         // `ok` — the bytes are there, just not built).
         if (r.status === 'ok' && opts.setup !== false) {
-          const s = runSkillSetup(join(opts.out, r.slug));
-          r.setup = s.skipped ? 'none' : (s.ok ? 'ok' : 'failed');
-          if (!s.ok && !s.skipped) r.setupError = s.failed ? `${s.failed}: ${s.error}` : s.error;
+          // SECURITY: setup commands are arbitrary shell (execSync). Auto-run them ONLY for
+          // skills the current user authored — self-consent, like your own repo. Skills
+          // authored by another org member, a fork, or an imported bundle must NOT run their
+          // shell unattended (Causeway auto-syncs pinned skills), or a teammate's skill is
+          // RCE on this host. `--allow-untrusted-setup` is the explicit opt-in.
+          // Self-authored = created by me AND not a fork (a fork carries another author's
+          // setup under my createdBy — see syncOneSkill). Forks/other-authored require the
+          // explicit opt-in.
+          const selfAuthored = r.createdBy && auth?.userId && r.createdBy === auth.userId && !r.forkedFrom;
+          if (selfAuthored || opts.allowUntrustedSetup) {
+            const s = runSkillSetup(join(opts.out, r.slug));
+            r.setup = s.skipped ? 'none' : (s.ok ? 'ok' : 'failed');
+            if (!s.ok && !s.skipped) r.setupError = s.failed ? `${s.failed}: ${s.error}` : s.error;
+          } else {
+            r.setup = 'skipped-untrusted';
+          }
         }
         results.push(r);
         if (r.status !== 'ok') allOk = false;

package/mcp/server.mjs

@@ -1693,9 +1693,11 @@ if (!isRemote) tool('auth', 'Sign in to Drafted. On a local install the DESKTOP
       console.error(`\n[MCP] Sign in at: ${verificationUrl}\n${qrText ? qrText + '\n' : ''}[MCP] Waiting for approval...`);
 
       if (!reusingPending) {
-        const { exec } = await import('child_process');
-        const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
-        exec(`${cmd} ${JSON.stringify(verificationUrl)}`);
+        // SECURITY: verificationUrl is server-supplied — pass as an argv arg (execFile, no
+        // shell) so a compromised/MITM'd server response can't inject shell into this host.
+        const { execFile } = await import('child_process');
+        if (process.platform === 'win32') execFile('cmd', ['/c', 'start', '', verificationUrl]);
+        else execFile(process.platform === 'darwin' ? 'open' : 'xdg-open', [verificationUrl]);
       }
 
       const deadline = Date.now() + (expiresIn * 1000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drafted",
-  "version": "1.14.6",
+  "version": "1.14.8",
   "description": "Drafted — visual thinking surface for humans and AI agents. Renders HTML, markdown, images, and code as frames on a zoomable canvas, with MCP tools for AI agents and real-time sync for humans.",
   "type": "module",
   "files": [