terok-executor 0.3.0__tar.gz → 0.3.1__tar.gz

{terok_executor-0.3.0 → terok_executor-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: terok-executor
-Version: 0.3.0
+Version: 0.3.1
 Summary: Single-agent task runner for hardened Podman containers
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -29,7 +29,7 @@ Requires-Dist: prompt-toolkit (>=3.0,<4.0)
 Requires-Dist: pydantic (>=2.13,<3.0)
 Requires-Dist: rich (>=15.0,<16.0)
 Requires-Dist: ruamel.yaml (==0.19.1)
-Requires-Dist: terok-sandbox (>=0.4.0,<0.5.0)
+Requires-Dist: terok-sandbox (>=0.4.1,<0.5.0)
 Requires-Dist: terok-util (>=0.2.1,<0.3.0)
 Requires-Dist: tomli-w (>=1.2,<2.0)
 Project-URL: Changelog, https://github.com/terok-ai/terok-executor/blob/master/CHANGELOG.md

{terok_executor-0.3.0 → terok_executor-0.3.1}/pyproject.toml

@@ -19,7 +19,7 @@ dynamic = ["classifiers"]
 # Dependency pins follow the policy in AGENTS.md ("Dependency Pinning &
 # pyproject.toml Hygiene").  Keep the dependency list comment-free.
 dependencies = [
-    "terok-sandbox>=0.4.0,<0.5.0",
+    "terok-sandbox>=0.4.1,<0.5.0",
     "terok-util>=0.2.1,<0.3.0",
     "ruamel.yaml==0.19.1",
     "Jinja2~=3.1",
@@ -29,7 +29,7 @@ dependencies = [
     "rich~=15.0",
     "agent-client-protocol==0.10.1",
 ]
-version = "0.3.0"
+version = "0.3.1"
 
 [project.urls]
 Homepage = "https://terok-ai.github.io/terok-executor/"
@@ -63,12 +63,12 @@ pre-commit = ">=4.0"
 ruff = ">=0.15.20"
 bandit = ">=1.7"
 docstr-coverage = "^2.3.2"
-complexipy = ">=6.0.0"
+complexipy = ">=6.0.1"
 vulture = ">=2.12"
 reuse = "^6.2.0"
 tach = "^0.35.0"
 mypy = ">=2.1.0,<3.0"
-import-linter = ">=2.12"
+import-linter = ">=2.13"
 
 [tool.poetry.group.test.dependencies]
 pytest = ">=9.1.1"

{terok_executor-0.3.0 → terok_executor-0.3.1}/src/terok_executor/__init__.py

@@ -20,7 +20,7 @@ in their submodules; reach into ``terok_executor.<sub>`` when you
 need them.
 """
 
-__version__: str = "0.3.0"  # placeholder; replaced at build time
+__version__: str = "0.3.1"  # placeholder; replaced at build time
 
 from importlib.metadata import PackageNotFoundError, version as _meta_version
 

{terok_executor-0.3.0 → terok_executor-0.3.1}/src/terok_executor/commands.py

@@ -505,6 +505,8 @@ def _handle_list() -> None:
 
     runtime = PodmanRuntime()
     states = runtime.container_states("terok-executor")
+    if states is None:
+        raise SystemExit("Container runtime unavailable — cannot query container states.")
     run_root = container_state_root()
     named = (p.name for p in run_root.iterdir() if p.is_dir()) if run_root.is_dir() else ()
     for name in named:

{terok_executor-0.3.0 → terok_executor-0.3.1}/src/terok_executor/container/env.py

@@ -23,6 +23,8 @@ Usage::
 from __future__ import annotations
 
 import logging
+import os
+import stat
 from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Literal
@@ -438,6 +440,8 @@ def _shared_config_mounts(
     materialises the destination inside the container's userns as root
     with mode 0700, leaving the file unreadable to the agent (and breaking
     e.g. ``gh`` whose ``hosts.yml`` is normally absent on fresh installs).
+    Credential files are created — and pre-existing ones re-clamped —
+    owner-only, because glab aborts on a ``config.yml`` looser than 0600.
 
     Providers in *expose_credential_providers* keep the writable mount —
     used by terok's experimental ``expose_oauth_token`` mode where the
@@ -454,13 +458,18 @@ def _shared_config_mounts(
         host_dir.mkdir(parents=True, exist_ok=True)
         specs.append(VolumeSpec(host_dir, m.container_path))
 
-        if not m.credential_file or m.writable or m.provider in expose_credential_providers:
+        if not m.credential_file:
             continue
 
         host_file = host_dir / m.credential_file
+        _clamp_credential_mode(host_file)
+
+        if m.writable or m.provider in expose_credential_providers:
+            continue
+
         host_file.parent.mkdir(parents=True, exist_ok=True)
         if not host_file.exists():
-            host_file.touch()
+            host_file.touch(mode=0o600)
 
         container_file = f"{m.container_path}/{m.credential_file}"
         specs.append(VolumeSpec(host_file, container_file, read_only=True))
@@ -468,6 +477,34 @@ def _shared_config_mounts(
     return specs
 
 
+def _clamp_credential_mode(host_file: Path) -> None:
+    """Strip group/other permission bits from an existing credential file.
+
+    Releases up to 0.2.x ``touch()``-ed credential files with the umask
+    default (0644), and those files persist in the shared mounts across
+    upgrades.  glab refuses to start when its ``config.yml`` is looser
+    than 0600, so every launch re-clamps to owner-only — idempotent, and
+    never *adds* bits (a deliberately read-only 0400 file stays 0400).
+
+    Opens with ``O_NOFOLLOW`` + ``fchmod`` so a symlink planted in the
+    container-writable shared dir cannot redirect the chmod to an
+    arbitrary operator-owned file (CWE-59).  The clamp is best-effort:
+    any open failure (missing file, planted symlink, permissions) leaves
+    the file as-is rather than aborting container assembly — a file we
+    cannot even open is not one the old ``touch()`` created loose.
+    """
+    try:
+        fd = os.open(host_file, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    except OSError:
+        return
+    try:
+        st = os.fstat(fd)
+        if stat.S_ISREG(st.st_mode) and stat.S_IMODE(st.st_mode) & 0o077:
+            os.fchmod(fd, stat.S_IMODE(st.st_mode) & ~0o077)
+    finally:
+        os.close(fd)
+
+
 def _set_provider_handle(
     env: dict[str, str],
     provider: str,

{terok_executor-0.3.0 → terok_executor-0.3.1}/src/terok_executor/resources/scripts/init-ssh-and-repo.sh

@@ -198,6 +198,21 @@ if [[ -n "${REPO_ROOT:-}" && -n "${CODE_REPO:-}" ]]; then
     fi
   fi
 
+  # Terok-managed origin must match the launch env, not whatever a previous
+  # container generation persisted into .git/config: gate URLs embed a
+  # per-task auth token, so a stale origin breaks every fetch with 403.
+  # In both security modes the invariant is the same — origin is CODE_REPO
+  # (the gate in gatekeeping mode, upstream in online mode) — and it must
+  # hold BEFORE the first fetch below.
+  if [[ -d "${REPO_ROOT}/.git" ]]; then
+    CURRENT_ORIGIN=$(git -C "${REPO_ROOT}" remote get-url origin 2>/dev/null || echo "")
+    if [[ -n "${CURRENT_ORIGIN}" && "${CURRENT_ORIGIN}" != "${CODE_REPO}" ]]; then
+      echo ">> fixing origin remote (was: $(redact_url "${CURRENT_ORIGIN}"))"
+      git -C "${REPO_ROOT}" remote set-url origin "${CODE_REPO}" || true
+      git -C "${REPO_ROOT}" remote set-url --push origin "${CODE_REPO}" || true
+    fi
+  fi
+
   if [[ ! -d "${REPO_ROOT}/.git" ]]; then
     # No .git directory - perform initial clone
     # Remove marker first so the directory is empty for git clone
@@ -245,7 +260,7 @@ if [[ -n "${REPO_ROOT:-}" && -n "${CODE_REPO:-}" ]]; then
       git -C "${REPO_ROOT}" remote set-url origin "${CODE_REPO}" || true
       git -C "${REPO_ROOT}" remote set-url --push origin "${CODE_REPO}" || true
       # Fetch latest from upstream to ensure we have all refs
-      git -C "${REPO_ROOT}" fetch --all --prune || true
+      git -C "${REPO_ROOT}" fetch origin --prune || true
       # After repointing, checkout the target branch from the new origin if specified
       if [[ -n "${TARGET_BRANCH}" ]]; then
         if git -C "${REPO_ROOT}" rev-parse --verify "origin/${TARGET_BRANCH}" >/dev/null 2>&1; then
@@ -270,7 +285,10 @@ if [[ -n "${REPO_ROOT:-}" && -n "${CODE_REPO:-}" ]]; then
     # .git exists and this is a new task (marker present).
     # Normal fast path when clone cache pre-populated the workspace.
     echo ">> new task — updating cached workspace to latest HEAD"
-    git -C "${REPO_ROOT}" fetch --all --prune
+    # Fetch origin only: the "external" remote is unreachable by design
+    # (gatekeeping blocks egress) and the "gate" remote is re-added with a
+    # fresh URL further down — ``--all`` would fetch both and fail.
+    git -C "${REPO_ROOT}" fetch origin --prune
     TARGET_BRANCH="${GIT_BRANCH:-}"
 
     # Checkout and reset to the target branch. Use checkout -B to create/reset
@@ -301,7 +319,8 @@ if [[ -n "${REPO_ROOT:-}" && -n "${CODE_REPO:-}" ]]; then
     # .git exists and no marker - this is a restarted task
     # Only fetch updates, preserve local changes
     echo ">> restarted task - fetching updates (preserving local changes)"
-    git -C "${REPO_ROOT}" fetch --all --prune
+    # origin only — see the new-task fetch above for why not ``--all``.
+    git -C "${REPO_ROOT}" fetch origin --prune
     # Only reset if explicitly requested via GIT_RESET_MODE
     if [[ -n "${GIT_BRANCH:-}" && "${GIT_RESET_MODE}" != "none" ]]; then
       echo ">> git reset (${GIT_RESET_MODE}) to origin/${GIT_BRANCH}"
@@ -316,21 +335,6 @@ if [[ -n "${REPO_ROOT:-}" && -n "${CODE_REPO:-}" ]]; then
     fi
   fi
 
-  # Gatekeeping mode: Ensure origin remote is set to the git-gate (CODE_REPO).
-  # This is necessary because:
-  # 1. Existing workspaces might have origin pointing to the real upstream
-  #    (e.g., from a previous online mode run or misconfigured setup)
-  # 2. In gatekeeping mode, origin should ALWAYS be the local git-gate
-  # We detect gatekeeping mode by checking if CODE_REPO is a local file path.
-  if [[ "${CODE_REPO}" == file://* ]]; then
-    CURRENT_ORIGIN=$(git -C "${REPO_ROOT}" remote get-url origin 2>/dev/null || echo "")
-    if [[ "${CURRENT_ORIGIN}" != "${CODE_REPO}" ]]; then
-      echo ">> gatekeeping mode: fixing origin remote (was: $(redact_url "${CURRENT_ORIGIN}"))"
-      git -C "${REPO_ROOT}" remote set-url origin "${CODE_REPO}" || true
-      git -C "${REPO_ROOT}" remote set-url --push origin "${CODE_REPO}" || true
-    fi
-  fi
-
   # In gatekeeping mode, optionally add an "external" remote pointing to the
   # real upstream. This is informational only - the container cannot actually
   # reach this URL. Useful for IDEs on the host side that want to know the