larkin 0.2.83 → 0.2.84
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -40,6 +40,7 @@ const crypto = __importStar(require("node:crypto"));
|
|
|
40
40
|
const path = __importStar(require("node:path"));
|
|
41
41
|
const root_layout_js_1 = require("../platform/root-layout.cjs");
|
|
42
42
|
const process_state_js_1 = require("../platform/process-state.cjs");
|
|
43
|
+
const secure_metadata_js_1 = require("../platform/secure-metadata.cjs");
|
|
43
44
|
const inbox_projection_js_1 = require("./inbox-projection.cjs");
|
|
44
45
|
const JSON_KEYS = new Set([
|
|
45
46
|
"agentState", "status", "map", "replyctx", "botIdentity", "senderProfiles", "readReceipts", "pendingReact", "runtimeDeliveries", "inboxState", "freshnessState", "documentComments", "reminders", "interactions",
|
|
@@ -222,7 +223,8 @@ class AgentStateStore {
|
|
|
222
223
|
try {
|
|
223
224
|
fd = fs.openSync(ownerFile, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
|
|
224
225
|
const stat = fs.fstatSync(fd);
|
|
225
|
-
if (!stat.isFile() || (typeof process.getuid === "function" && stat.uid !== process.getuid())
|
|
226
|
+
if (!stat.isFile() || (typeof process.getuid === "function" && stat.uid !== process.getuid())
|
|
227
|
+
|| (!secure_metadata_js_1.isWindows && (stat.mode & 0o077) !== 0)) {
|
|
226
228
|
throw new Error(`Inbox lock owner 文件不安全：${ownerFile}`);
|
|
227
229
|
}
|
|
228
230
|
const value = JSON.parse(fs.readFileSync(fd, "utf8"));
|
|
@@ -3,6 +3,7 @@ import * as crypto from "node:crypto";
|
|
|
3
3
|
import * as path from "node:path";
|
|
4
4
|
import { TargetRootLayout } from "../platform/root-layout.mjs";
|
|
5
5
|
import { acquireProcessLock, inspectProcess } from "../platform/process-state.mjs";
|
|
6
|
+
import { isWindows } from "../platform/secure-metadata.mjs";
|
|
6
7
|
import { targetKeyOfInboxEnvelope } from "./inbox-projection.mjs";
|
|
7
8
|
const JSON_KEYS = new Set([
|
|
8
9
|
"agentState", "status", "map", "replyctx", "botIdentity", "senderProfiles", "readReceipts", "pendingReact", "runtimeDeliveries", "inboxState", "freshnessState", "documentComments", "reminders", "interactions",
|
|
@@ -185,7 +186,8 @@ export class AgentStateStore {
|
|
|
185
186
|
try {
|
|
186
187
|
fd = fs.openSync(ownerFile, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
|
|
187
188
|
const stat = fs.fstatSync(fd);
|
|
188
|
-
if (!stat.isFile() || (typeof process.getuid === "function" && stat.uid !== process.getuid())
|
|
189
|
+
if (!stat.isFile() || (typeof process.getuid === "function" && stat.uid !== process.getuid())
|
|
190
|
+
|| (!isWindows && (stat.mode & 0o077) !== 0)) {
|
|
189
191
|
throw new Error(`Inbox lock owner 文件不安全：${ownerFile}`);
|
|
190
192
|
}
|
|
191
193
|
const value = JSON.parse(fs.readFileSync(fd, "utf8"));
|