* fix(#3712): confine in-process installs to a sandboxed HOME
A runtime kind may declare a global `home` override resolved from os.homedir()
rather than from the caller's configDir — codex's skills kind (`home: ".agents"`,
ADR-1239 / #2088) is the only live case. Sandboxing configDir/targetDir does not
contain it, and assertDestWithinConfigHome cannot see the class: that gate
confines a destSubpath to whatever root it is handed, and here the root IS the
escaped home. So an in-process caller that forgot to sandbox HOME wrote to, and
pruned gsd-* entries from, the developer's REAL ~/.agents/skills.
tests/agent-descriptor-parity.install.test.cjs's K1 loop did exactly that: it
iterates every agents-kind runtime (codex included) with a sandboxed targetDir
and an un-sandboxed HOME. Reproduced against a canary home on next @ adb46cdd8 —
71 gsd-* skill dirs deleted, a foreign `cloudflare` skill surviving, suite still
exit 0. It is silent because the runtime's own config home is untouched, so the
manifest keeps reporting a healthy install.
FIVE writers resolve a kind `home` and then destroy under it. Three are reachable
today — installRuntimeArtifacts, uninstallRuntimeArtifacts (install-engine.cts)
and applySurface (surface.cts). Two are descriptor-dependent and guarded against a
future descriptor change rather than a present escape: installOpencodeFamilySkills
(behind the combined-family early return) and installAgentsKindStandalone. Those
two are scoped to the single kind each destroys — passing the whole layout made
codex's unrelated skills override trip a writer that never touches it.
- src/test-home-guard.cts: refuse when a run under a test runner cannot be shown
to have sandboxed HOME. NODE_TEST_CONTEXT (set by `node --test`) gates it, so
installs outside a Node test context are untouched; GSD_TEST_MODE is unusable,
as several candidate files including the offender never set it. Homes are
compared by FILESYSTEM IDENTITY (st_dev + st_ino), not by pathname:
path.resolve() resolves neither symlinks nor case, and realpath returns a
canonical pathname that two routes to one directory can still disagree on (bind
mounts). Verified on macOS/APFS — HOME=/users/<name> made the strings differ
while naming the same directory, and the lexical form ALLOWED a write into the
physical real home. FAILS CLOSED: a pair is "different" only when both identify,
or one is definitively absent (ENOENT/ENOTDIR) while the other identifies; every
other errno is "cannot tell" and refuses. Only when neither home identifies is a
marker consulted, and it carries the sandbox PATH and must equal the home in
effect — a boolean checked first let an ambient or stale value disarm the guard.
- helpers: promote sandboxHome() out of its two byte-identical private copies,
which is also what makes them record the sandbox; the three withFakeHome()
helpers record it too. The marker NAME is duplicated as a bare string rather
than required from the compiled guard, keeping helpers.cjs's documented
no-built-lib-at-import-time contract; a test pins the two together.
- agent-descriptor-parity: sandbox HOME across the K1 loop.
- helpers-process-isolation: #3156's canary asserts on <home>/.gsd only, and its
`--cursor --local` spawn cannot reach `.agents` at all, so an assertion added
there would pass with all confinement removed. Add a discriminating row — a
`--codex --global` spawn against a seeded ambient home — which also asserts the
runtime still declares the override. Its check is a sampled inventory (dir names
+ each SKILL.md), not a tree compare.
- install-write-confinement: predicate rows through the deps seam, covering the
symlinked HOME, ambient and stale markers, and each sameDirectory branch
(both-identify, one-absent, neither-identifiable), plus wiring rows that drive
the REAL entrypoints so deleting a guard call site is red.
Verified: guard fires end-to-end against a real un-sandboxed HOME (exit 1, zero
deletions); the case-variant fail-open reproduced on APFS before the fix and
refuses after; K1 file 29/29 green with skills intact; mutation-tested — each of
the three reachable call sites, lexical-only comparison, and treating an unknown
errno as "absent" each take exactly one row red, with every mutation echoed back;
the process-isolation row negative-controlled by reverting installerEnv to its
pre-#3156 leak (16/0 -> 13/3); a full npm test leaves ~/.agents/skills at 71.
Stated residual: the two descriptor-dependent writers have no wiring test, because
no runtime declares a `home` override on those kinds and neither can be exercised
without inventing a descriptor.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore(#3712): add changeset
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(#3712): let a sandbox nested inside the real home through the guard
All six Windows shards of #3725 failed on legitimately sandboxed
destinations. On Windows os.tmpdir() is %LOCALAPPDATA%\Temp — inside the
user's home — so every sandbox a test creates is a descendant of the real
home, and "does this land inside the real home?" answers yes for the safe
case and the dangerous one alike. POSIX conceals this: /tmp and
/var/folders both sit outside $HOME.
Add the missing conjunct: a destination inside the real home is allowed
only when it also sits beneath a HOME that was sandboxed away from the
passwd home. Both halves are required — dropping the first re-admits a
plain un-sandboxed install, and dropping the second decays into the
"is HOME sandboxed?" check the module rejects, which a layout resolved
before the sandbox walks straight through. Each is mutation-proven by a
row that goes red without it.
Also covers the two fail-closed branches of the new exemption, which
survived mutation to `true` with the suite green, and avoids `<user>` in
a docblock — the prompt-injection scanner reads it as a delimiter tag.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): close three writer/rollback gaps found reviewing the whole PR
Cross-AI review of the full PR (not just the round's delta) surfaced
three ways the guard could still be defeated:
- The nested-sandbox exemption trusted the SPELLING of a destination.
With HOME sandboxed to a directory inside the real home — legitimate on
Windows — an aliased `.agents` (symlink, junction, subordinate bind
mount) beneath it redirected an allowed path into the real home. Decide
containment on the path the write RESOLVES to: walk up to the nearest
existing ancestor, canonicalize, re-append the tail.
- `migrateLegacyDevPreferencesToSkill` is a SIXTH writer that resolves a
skills-kind `home` override. It creates rather than prunes, which is
why it was missed, and `_runLegacyInstallMigrations` runs it before
`installRuntimeArtifacts`' own assertion. Guarded, scoped to that kind.
- Worst of the three: `bin/install.js` snapshots the resolved skills root
before installing, and its outer catch rolls back by deleting and
recreating every snapshotted `gsd-*` directory there. The guard's own
throw landed in that catch, so refusing an un-sandboxed codex install
provoked exactly the mutation the guard exists to prevent. Refusals are
now marked and rethrown without rollback — nothing was written, so
there is no partial install to undo. Every other error still rolls back.
Also carries the sandbox marker into `installSpawnEnv`, so spawned
installers are not refused on passwd-less CI images, and corrects three
claims that no longer hold: "every writer" (six, and named), the
unconditional "fails CLOSED" (the passwd-less marker branch is a
deliberate weakening, and TOCTOU is out of scope), and the assertion that
Windows os.tmpdir() is always %LOCALAPPDATA%\Temp (Node honors TEMP/TMP).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(#3712): name the guard's two limits instead of overclaiming
Round-2 review found the prose had drifted ahead of the code. Corrected,
with no behavior change:
- The module still said FIVE writers; there are six, and the sixth is
now named along with why it was missed (it creates rather than prunes)
and why it carries its own assertion (it runs before the main one).
- The canonicalization docblock listed subordinate bind mounts among the
aliases it closes. It does not close them: a bind mount is not a link,
so realpath keeps the mount-point spelling. `sameDirectory` already
recorded that limit; the new helper now inherits it explicitly rather
than contradicting it. Closing it needs mount-table introspection.
- "FAILS CLOSED" was unqualified while the passwd-less marker branch is
a deliberate weakening — with no passwd entry, nothing can contradict a
marker naming the real home.
- "Refuses BEFORE any write" was too broad: legacy install migrations run
ahead of the layout-driven ones, which is exactly why the two
rollbackInstallerMigrations() calls still execute before the rethrow.
Only the codex skills-root rollback is skipped, and that is the only
_codexPreConfigRollback() call site — applySurface is never called from
bin/install.js and uninstall cannot reach it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): sandbox HOME in the opencode-family home-override parity rows
The last two Windows failures, and the same platform asymmetry in a
different disguise. This row drives a skills-kind `home` override on
purpose — precisely what the guard polices — but relied on the override
temp dir happening to sit outside the real home. It does on POSIX
(/tmp, /var/folders); on Windows os.tmpdir() is under %USERPROFILE%, so
the guard correctly refused and only Windows went red.
Declare the sandbox instead of depending on the platform: HOME becomes
the override itself, which is the home the call writes under. This is the
fix the guard's own message prescribes, applied to the test rather than
to the guard.
Both failing Windows shards fail on exactly these two rows and nothing
else; every other shard is green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): make sameDirectory answer NO when it cannot tell
Review Major 1. sameDirectory()'s only caller is the passwd-less marker
branch, which reads a `true` as permission to PROCEED:
if (marker && sameDirectory(marker, osMod.homedir())) return;
The fallthrough returned `true` whenever neither side identified — two
absent paths, or two stats failing EACCES/EPERM/EIO on a locked-down
host — on the reasoning that "cannot tell" should make the caller refuse.
That reasoning was inverted with respect to this caller: it turned the
passwd-less escape hatch into an unconditional bypass for any marker
value at all, on precisely the hosts the fallback exists to serve. Only
two things now answer yes: one resolved pathname, or two readable
identities that match. Restoring the old fallthrough takes the new row
red.
Also from review:
- Major 2 asked whether st_dev/st_ino discriminate directories on
Windows, where Node derives them from BY_HANDLE_FILE_INFORMATION. The
whole guard rests on that primitive, so assert it rather than argue it:
a row comparing two distinct temp directories, and one directory
reached by two spellings. It runs on every platform in the matrix, so
Windows answers the question itself.
- Minor 1: the refusal now names the real home it compared against, not
just the destination it refused. That is the one fact needed to tell a
true positive from a false one, and its absence is what made the
Windows case a CI-log dig rather than a glance.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): refuse a HOME that merely spells the real home more widely
Review round: one Blocker, four Minors, a Nit.
N2 (the one with teeth) — a destination's ancestor chain is linear, so
"inside the real home AND inside the effective HOME" admits two
arrangements, not one. The intended `effectiveHome ⊂ realHome` is the
Windows temp shape; `realHome ⊂ effectiveHome` — HOME at /Users, /home,
C:\Users — is not a sandbox at all, it is the real home reached by a
wider spelling, and it was exempting a stale destination pointing
straight at ~/.agents. Third conjunct added; the docblock no longer
claims two conditions suffice. Removing the conjunct reds the new row
and nothing else.
N4 — the migration guard resolved its OWN layout, and without
capabilityRegistry, so a registry-dependent descriptor could make it
vouch for a path the migration does not write: a guard reporting safe
while the unsafe write proceeds. It now guards the destination already
resolved by _resolveDevPreferencesSkillTarget, keyed on
`installRoot !== targetDir` — which is exactly the condition under which
a `home` override was declared, read off that same result.
N1 — CONTEXT.md gains the Test Home Guard Module glossary entry that
contributor-standards.md requires of a new Module. Not CI-enforced, so
green CI was never evidence it was met.
N3 — the docs/INVENTORY.md row was misfiled between install-fs-adapter
and install-model-override-resolver; the table is alphabetical and the
manifest already had it right. Moved, and its text now names six writers
and the third conjunct.
N5 — applySurface's signature docblock was two parameters stale; this PR
added the second of them.
N6 — the duplicated rollbackInstallerMigrations() adjacent to the new
rethrow: two identical consecutive calls, not two phases.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): guard the sixth writer, and close two false-ALLOW paths
Review round 3 (NEW-1, NEW-2) plus three defects Codex found in the
whole-PR pass, each reproduced before it was fixed.
NEW-1 — migrateLegacyDevPreferencesToSkill called the guard with no
`deps`, so it bound real os/process.env and could not be wiring-tested
the way the other three reachable writers were. It now takes the same
optional `deps: { os?, env? }` tail parameter. The wiring block gains
the missing fourth row, and a fifth pinning the ALLOW half; the test
file's header docblock said "FIVE writers ... the three reachable
today", contradicting the six/four statement this PR already put in
src/test-home-guard.cts, CONTEXT.md, docs/INVENTORY.md and the
changeset. Both directions of the guard's condition now fail a row
when broken — previously neither did.
NEW-2 — derivesFromSandboxedHome's docblock claimed "THREE conditions
are required, and no two of them suffice". False for {2,3}: isInside is
reflexive, so whenever conjunct 1 fires conjunct 2 already returns
false on its own. Reworded as a fast path, which is what it is.
Codex 1 (false ALLOW) — on a host with no readable passwd entry the
marker branch returned as soon as the marker matched the effective
HOME. That attests a caller sandboxed HOME and says nothing about where
an already-resolved destination points, so a layout captured before
sandboxHome() — still naming the real ~/.agents — was waved straight
through: the same stale-layout shape the primary branch refuses by
design. The marker must now identify AND contain every destination.
Codex 2 (false ALLOW) — `installRoot !== targetDir` was the stand-in
for "the skills kind declared a home override". The two are not
equivalent: the inequality is false when the override resolves onto
targetDir itself, which is exactly a configDir of $HOME/.agents. The
guard was skipped and SKILL.md written into the real home under a test
runner. _resolveDevPreferencesSkillTarget now reports hasHomeOverride
off the same resolution instead of inferring it from two paths.
Codex 3 (prose) — the shared refusal message claimed every guarded
writer prunes; the migrate writer only creates. The changeset headline
claimed in-process installer calls can no longer reach the real home,
which is wider than the guard: writeNonClaudeDefaults still writes
~/.gsd/defaults.json through os.homedir(). INVENTORY's and CONTEXT's
fail-closed sentences omitted sameDirectory's pathname-equality
shortcut. All four narrowed to what the code does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): let the sandbox marker follow an overridden HOME
Found by Codex in the whole-PR pass. installSpawnEnv spreads
`overrides` last so an explicit HOME wins — deliberate, and its
docblock tells callers needing per-spawn isolation to pass their own
{ HOME, USERPROFILE }. But the #3712 marker was set before that spread,
so such a caller got HOME=<theirs> and marker=<helper default>. On a
host with no readable passwd entry the guard compares the two and
refuses a legitimately sandboxed spawn — tests/install.test.cjs:7143
and install-shared.cjs's own runInstaller both take that path.
The marker is now derived from the final HOME unless the caller
supplied one explicitly. The contract test asserted HOME after an
override but not the marker, which is why it stayed green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(#3712): name the shipped guard condition, not the deleted one
Review round 4 of #3725. Two artifacts this PR adds still described
`target.installRoot !== targetDir` in the PRESENT tense as the live guard
condition on `migrateLegacyDevPreferencesToSkill`. The shipped condition is
`runtime && target.hasHomeOverride` (src/install-engine.cts:510).
This is not ordinary doc drift. The named condition is the exact false-ALLOW
the previous round closed: a `home` override resolving onto `targetDir` — a
configDir of `$HOME/.agents`, which is where codex's override points — makes
the inequality FALSE while the override is declared, so the guard was skipped.
A maintainer reading CONTEXT.md:290 as authoritative would believe the guard
still skips that case.
- tests/install-write-confinement.test.cjs — the ALLOW-half row's comment.
Its "teeth" rationale is unchanged and still correct as written.
- CONTEXT.md:290 — the Test Home Guard Module glossary entry, a documented
PR gate. Now states the condition and names the inequality only as what it
is NOT, with the reason.
The three surviving mentions of the inequality are all past-tense or negated
(src/install-engine.cts:448, :508 and the sibling test comment at :3698) and
are correct as they stand.
Verified: `npm run lint:ci` exit 0; full `npm test` 31327 tests / 31312 pass /
0 fail / 14 skipped, run with TMPDIR unset.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(#3712): canonicalization fails closed, matching identify's errno split
Codex full-PR review of #3725, run against the round-4 head.
`resolveThroughLinks` caught EVERY realpathSync error and fell back to
`path.resolve(dest)` — the lexical spelling. That inverts the function's own
purpose. An aliased `<sandbox>/.agents` that cannot be canonicalized keeps its
sandbox spelling, satisfies the nested-sandbox exemption at :227, and the write
is ALLOWED into the real home — the exact escape this walk exists to close. The
module documents that it fails CLOSED with ONE named exception (the marker
branch); this was a second, unnamed one.
Split by errno, and deliberately by the SAME split `identify` already draws
rather than a second policy in one module — both answer "does this path exist
as named?", so they must not disagree:
ENOENT / ENOTDIR -> walk up. The ordinary case: a fresh install resolves a
destination nothing has created yet, so realpath fails on the leaf and on
every not-yet-created ancestor. Refusing here rejects every install.
anything else (EACCES, EPERM, ELOOP, EIO) -> refuse. The component exists but
cannot be resolved, so the guard cannot tell where the write lands.
Three rows in the predicate block, beside the other aliasing rows:
- a symlink CYCLE in the destination path (ELOOP) -> REFUSE
- a destination that does not exist yet (ENOENT) -> ALLOW
- a component behind a regular file (ENOTDIR) -> ALLOW
Teeth checked against the artifact the test loads, not the source: reverting
the condition to the swallow-everything shape in the compiled
test-home-guard.cjs turns row 1 — and only row 1 — red. The ENOTDIR row caught
a stale build during development, which is the point of asserting on the
compiled file.
CONTEXT.md and the resolveThroughLinks docblock both record the new behaviour,
so this does not repeat the prose-vs-code drift the round-4 finding was about.
The changeset's existing scope sentence now bounds "six writers" to the
`installRuntimeArtifacts` call tree and names `cmdGenerateDevPreferences` —
which resolves the same codex `home` override through `getGlobalSkillsBase` and
writes SKILL.md beneath it unguarded. It has no in-process caller today (its
only direct require-and-call is a spawnSync with HOME sandboxed), so it is
latent rather than live, and whether it belongs in this PR is raised with the
maintainer rather than decided here.
Verified: `npm run lint:ci` exit 0; full `npm test` 31330 tests / 31315 pass /
0 fail / 14 skipped, TMPDIR unset.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Behruz Nassre Esfahani
committed by
GitHub
GitHub
parent
1178c5f995
commit
a44d513566
@@ -92,7 +92,7 @@ const assert = require('node:assert/strict');
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const { cleanup } = require('./helpers.cjs');
|
||||
const { cleanup, createTempDir, sandboxHome } = require('./helpers.cjs');
|
||||
|
||||
const REPO_ROOT = path.join(__dirname, '..');
|
||||
const LIB_DIR = path.join(REPO_ROOT, 'gsd-core', 'bin', 'lib');
|
||||
@@ -629,6 +629,16 @@ test('agent-descriptor-parity: K1 — every registry runtime declaring an agents
|
||||
assert.ok(runtimesWithAgentsKind.includes('kimi-code'), 'kimi-code (found via golden fixture, not analysis) must be covered here');
|
||||
assert.ok(runtimesWithAgentsKind.includes('cline'), 'cline must be covered here');
|
||||
|
||||
// #3712: this loop reaches `codex`, whose global skills kind declares a `home`
|
||||
// override (`.agents`) resolved from os.homedir() rather than from targetDir.
|
||||
// Sandboxing targetDir alone does NOT contain it — before this line the call
|
||||
// below pruned every gsd-* skill from the developer's REAL ~/.agents/skills
|
||||
// (71 -> 0) while the suite still exited 0. Sandbox HOME for the whole loop so
|
||||
// codex's skills land in <homeDir>/.agents/skills inside a temp dir we clean.
|
||||
const homeDir = createTempDir('gsd-adp-home-');
|
||||
t.after(() => cleanup(homeDir));
|
||||
sandboxHome(t, homeDir);
|
||||
|
||||
for (const runtime of runtimesWithAgentsKind) {
|
||||
const { commandsGsd, root } = buildSourceTree(SAMPLE_AGENTS);
|
||||
const targetDir = buildTargetDir(commandsGsd);
|
||||
|
||||
@@ -54,22 +54,14 @@ const TEST_ATTRIBUTION = () => 'Co-Authored-By: Test <t@example.com>';
|
||||
|
||||
/**
|
||||
* Sandbox HOME/USERPROFILE for the duration of a test. Some runtimes (e.g.
|
||||
* codex) resolve a kind's `home` via os.homedir(); without this, an
|
||||
* in-process install would write into the developer's real home directory.
|
||||
* Mirrors tests/install-runtime-artifacts.test.cjs's sandboxHome().
|
||||
* codex) resolve a kind's `home` via os.homedir(); without this, an in-process
|
||||
* install would write into the developer's real home directory.
|
||||
*
|
||||
* #3712: promoted to tests/helpers.cjs, from the byte-identical copy that used
|
||||
* to live here. It now also sets the sandbox marker src/test-home-guard.cts
|
||||
* needs to stay permissive on hosts with no readable passwd entry.
|
||||
*/
|
||||
function sandboxHome(t, dir) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
process.env.HOME = dir;
|
||||
process.env.USERPROFILE = dir;
|
||||
t.after(() => {
|
||||
if (savedHome === undefined) delete process.env.HOME;
|
||||
else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE;
|
||||
else process.env.USERPROFILE = savedUserProfile;
|
||||
});
|
||||
}
|
||||
const { sandboxHome } = require('./helpers.cjs');
|
||||
|
||||
// ─── E3 — the opencode-family early return (matrix row E3) ──────────────────
|
||||
|
||||
|
||||
@@ -363,6 +363,20 @@ describe('#3156: a raw installer spawn cannot write into the ambient HOME', () =
|
||||
'USERPROFILE must track HOME — os.homedir() reads it on Windows');
|
||||
assert.strictEqual(build({ HOME: '/explicit', USERPROFILE: '/explicit' }).HOME, '/explicit',
|
||||
'an explicit HOME override must still win (overrides spread last)');
|
||||
// #3712 / Codex review of #3725: the marker attests to the home ACTUALLY in
|
||||
// effect. Spreading `overrides` last used to leave it naming this helper's
|
||||
// default home while HOME was the caller's, and on a passwd-less host the
|
||||
// test-home guard compares the two and refuses a legitimately sandboxed
|
||||
// spawn. Asserting HOME alone did not catch it — the marker has to move too.
|
||||
assert.strictEqual(build().GSD_TEST_HOME_SANDBOX, build().HOME,
|
||||
'the marker must name the default sandbox home');
|
||||
const overridden = build({ HOME: '/explicit', USERPROFILE: '/explicit' });
|
||||
assert.strictEqual(overridden.GSD_TEST_HOME_SANDBOX, '/explicit',
|
||||
'the marker must follow an overridden HOME, not keep naming the default one');
|
||||
assert.strictEqual(
|
||||
build({ HOME: '/explicit', GSD_TEST_HOME_SANDBOX: '/caller-chosen' }).GSD_TEST_HOME_SANDBOX,
|
||||
'/caller-chosen',
|
||||
'an explicitly supplied marker still wins over the derived one');
|
||||
}
|
||||
});
|
||||
|
||||
@@ -410,3 +424,73 @@ describe('#3156: a raw installer spawn cannot write into the ambient HOME', () =
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('#3712: a raw installer spawn cannot reach the ambient HOME\'s shared skills root', () => {
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const { execFileSync } = require('node:child_process');
|
||||
const { cleanup } = require('./helpers.cjs');
|
||||
const { installerEnv } = require('./helpers/install-shared.cjs');
|
||||
const INSTALL_PATH = path.join(__dirname, '..', 'bin', 'install.js');
|
||||
|
||||
// #3156's canary asserts on <canaryHome>/.gsd. That is not the only ambient-HOME
|
||||
// surface: a kind may declare a global `home` override resolved from os.homedir()
|
||||
// — codex's skills kind (`.agents`) — and the installer PRUNES gsd-* entries under
|
||||
// it. A 71-skill deletion there passed the .gsd-only canary unnoticed (#3712).
|
||||
//
|
||||
// The runtime choice is load-bearing, not incidental. The .gsd row spawns
|
||||
// `--cursor --local`, and cursor declares no home override, so an `.agents`
|
||||
// assertion on THAT spawn passes even with all confinement removed. Only a
|
||||
// runtime that actually carries the override can discriminate — today that is
|
||||
// codex at global scope, asserted below so a descriptor change fails here loudly.
|
||||
test('installing codex globally leaves the ambient HOME\'s .agents/skills sampled inventory unchanged', () => {
|
||||
const { runtimes } = require('../gsd-core/bin/lib/capability-registry.cjs');
|
||||
const codexGlobalSkills = (runtimes?.codex?.runtime?.artifactLayout?.global ?? [])
|
||||
.find((e) => e.kind === 'skills' && e.home);
|
||||
assert.ok(codexGlobalSkills,
|
||||
'codex global skills must still declare a `home` override — without it this row '
|
||||
+ 'is non-discriminating and must be re-pointed at whichever runtime carries one');
|
||||
|
||||
const canaryHome = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-3712-canary-home-'));
|
||||
const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-3712-project-'));
|
||||
const realHome = process.env.HOME;
|
||||
const realUserProfile = process.env.USERPROFILE;
|
||||
|
||||
const skillsRoot = path.join(canaryHome, '.agents', 'skills');
|
||||
fs.mkdirSync(skillsRoot, { recursive: true });
|
||||
for (const name of ['gsd-plan-phase', 'gsd-dev-preferences', 'cloudflare']) {
|
||||
fs.mkdirSync(path.join(skillsRoot, name), { recursive: true });
|
||||
fs.writeFileSync(path.join(skillsRoot, name, 'SKILL.md'), `# ${name}\n`);
|
||||
}
|
||||
// A SAMPLE, not a byte-for-byte tree compare: immediate dir names plus each
|
||||
// dir's SKILL.md. It catches the demonstrated regression (whole gsd-* dirs
|
||||
// pruned) and would miss nested-file, mode, or metadata mutations.
|
||||
const inventory = () => fs.readdirSync(skillsRoot).sort()
|
||||
.map((d) => `${d}:${fs.readFileSync(path.join(skillsRoot, d, 'SKILL.md'), 'utf-8')}`)
|
||||
.join('|');
|
||||
const before = inventory();
|
||||
|
||||
try {
|
||||
// Make the AMBIENT home the canary, exactly as on a developer machine.
|
||||
process.env.HOME = canaryHome;
|
||||
process.env.USERPROFILE = canaryHome;
|
||||
|
||||
execFileSync(process.execPath, [INSTALL_PATH, '--codex', '--global', '--no-sdk'], {
|
||||
cwd: projectDir,
|
||||
encoding: 'utf-8',
|
||||
stdio: ['pipe', 'pipe', 'pipe'],
|
||||
env: installerEnv(),
|
||||
timeout: 300_000,
|
||||
});
|
||||
|
||||
assert.strictEqual(inventory(), before,
|
||||
'the installer pruned or wrote GSD skills in the ambient HOME instead of its own sandbox');
|
||||
} finally {
|
||||
if (realHome === undefined) delete process.env.HOME; else process.env.HOME = realHome;
|
||||
if (realUserProfile === undefined) delete process.env.USERPROFILE;
|
||||
else process.env.USERPROFILE = realUserProfile;
|
||||
cleanup(canaryHome);
|
||||
cleanup(projectDir);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -997,10 +997,86 @@ function installSpawnHome() {
|
||||
|
||||
function installSpawnEnv(overrides = {}) {
|
||||
const home = installSpawnHome();
|
||||
return { ...process.env, ...testEnvBase(), HOME: home, USERPROFILE: home, ...overrides };
|
||||
// #3712 — carry the sandbox marker too, not just HOME. The guard falls back to
|
||||
// the marker on hosts with no readable passwd entry (some CI images) and
|
||||
// otherwise REFUSES. A spawned installer inherits NODE_TEST_CONTEXT and has a
|
||||
// legitimately redirected HOME, so without this it is refused on exactly the
|
||||
// environment the fallback exists to serve. The name is the same constant
|
||||
// sandboxHome() writes; see the note there on why it is a bare string.
|
||||
const env = {
|
||||
...process.env,
|
||||
...testEnvBase(),
|
||||
HOME: home,
|
||||
USERPROFILE: home,
|
||||
[TEST_HOME_SANDBOX_MARKER]: home,
|
||||
...overrides,
|
||||
};
|
||||
// The marker attests to the home ACTUALLY in effect, so it has to follow an
|
||||
// overridden HOME rather than keep naming this helper's default one. Spreading
|
||||
// `overrides` last is deliberate (an explicit HOME must win — see the docblock's
|
||||
// "A test needing that passes its own { HOME, USERPROFILE }"), but it left the
|
||||
// marker stale: a caller supplying its own HOME got HOME=<theirs> and
|
||||
// marker=<helper default>. On a passwd-less host the guard compares the two and
|
||||
// REFUSES a legitimately sandboxed spawn — tests/install.test.cjs:7143 and
|
||||
// install-shared.cjs's own runInstaller both take that path. An explicitly
|
||||
// supplied marker still wins over both. Reported in Codex review of #3725.
|
||||
if (!(TEST_HOME_SANDBOX_MARKER in overrides)) env[TEST_HOME_SANDBOX_MARKER] = env.HOME;
|
||||
return env;
|
||||
}
|
||||
|
||||
module.exports = { runGsdTools, createTempDir, createTempProject, createTempGitProject, cleanup, tmpRootCandidates, readFileNormalized, readWorkflowCombined, parseFrontmatter, isUsageOutput, captureConsole, toPosixPath, absPlanningPath, runNpm, isolatedNpmEnv, withIsolatedProcessState, delay, waitFor, resetRuntimeWarningCaches, SESSION_ENV_KEYS, saveSessionEnv, restoreSessionEnv, clearSessionEnv, isolateWorkstreamEnv, restoreWorkstreamEnv, TOOLS_PATH, SESSION_IDENTITY_ENV_KEYS, scrubConfigLocationEnv, installSpawnEnv, installSpawnHome };
|
||||
/**
|
||||
* #3712 — sandbox HOME/USERPROFILE for the duration of ONE test.
|
||||
*
|
||||
* The spawn-side helpers above (#3156) cover CHILD processes only. A test that
|
||||
* calls the installer IN-PROCESS gets no protection from them, and a runtime kind
|
||||
* may declare a global `home` override that resolves from `os.homedir()` rather
|
||||
* than from the sandboxed configDir — codex's skills kind (`.agents`, ADR-1239 /
|
||||
* #2088) is the live case. Without this, such a call writes to, and prunes
|
||||
* `gsd-*` entries from, the developer's REAL ~/.agents/skills.
|
||||
*
|
||||
* Promoted here from the identical private copies in executed-plan.test.cjs and
|
||||
* install-runtime-artifacts.test.cjs so new in-process callers have one obvious
|
||||
* helper to reach for instead of re-deriving it (or forgetting it).
|
||||
*
|
||||
* Pass the test's own temp configDir as `dir` where possible: codex's skills dir
|
||||
* then resolves to `<configDir>/.agents/skills`, keeping every artifact the call
|
||||
* writes inside the directory the test already cleans up.
|
||||
*
|
||||
* @param {{ after: (fn: () => void) => void }} t - node:test context.
|
||||
* @param {string} dir - directory to use as HOME for the duration of the test.
|
||||
*/
|
||||
// #3712: the marker NAME is a constant, duplicated here deliberately rather than
|
||||
// required from the compiled guard. helpers.cjs is imported by ~370 test files and
|
||||
// documents (see builtLib above) that it must NOT load gsd-core/bin/lib at module
|
||||
// scope — an unbuilt tree would then fail on import alone, turning a missing
|
||||
// `npm run build:lib` into a whole-suite crash. A lazy require inside sandboxHome
|
||||
// would satisfy that too, but a bare string needs no build at all. The pairing is
|
||||
// pinned by a test so the two cannot drift.
|
||||
const TEST_HOME_SANDBOX_MARKER = 'GSD_TEST_HOME_SANDBOX';
|
||||
|
||||
function sandboxHome(t, dir) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
const savedMarker = process.env[TEST_HOME_SANDBOX_MARKER];
|
||||
process.env.HOME = dir;
|
||||
process.env.USERPROFILE = dir;
|
||||
// Records WHICH directory this call sandboxed to. src/test-home-guard.cts fails
|
||||
// CLOSED when it cannot read a passwd entry to compare HOME against (some CI
|
||||
// images), and consults this only in that branch, accepting it only when it
|
||||
// names the home actually in effect — so a stale marker cannot vouch for a
|
||||
// later, un-sandboxed call.
|
||||
process.env[TEST_HOME_SANDBOX_MARKER] = dir;
|
||||
t.after(() => {
|
||||
if (savedHome === undefined) delete process.env.HOME;
|
||||
else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE;
|
||||
else process.env.USERPROFILE = savedUserProfile;
|
||||
if (savedMarker === undefined) delete process.env[TEST_HOME_SANDBOX_MARKER];
|
||||
else process.env[TEST_HOME_SANDBOX_MARKER] = savedMarker;
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { runGsdTools, createTempDir, createTempProject, createTempGitProject, cleanup, tmpRootCandidates, readFileNormalized, readWorkflowCombined, parseFrontmatter, isUsageOutput, captureConsole, toPosixPath, absPlanningPath, runNpm, isolatedNpmEnv, withIsolatedProcessState, delay, waitFor, resetRuntimeWarningCaches, SESSION_ENV_KEYS, saveSessionEnv, restoreSessionEnv, clearSessionEnv, isolateWorkstreamEnv, restoreWorkstreamEnv, TOOLS_PATH, SESSION_IDENTITY_ENV_KEYS, scrubConfigLocationEnv, installSpawnEnv, installSpawnHome, sandboxHome, TEST_HOME_SANDBOX_MARKER };
|
||||
|
||||
// Lazy, for the reason builtLib() is lazy: reading either of these is what
|
||||
// forces the built-lib require, so a test file that needs neither can still
|
||||
|
||||
@@ -218,18 +218,11 @@ function readAllSkillMd(dir) {
|
||||
// write to (and an uninstall would mutate) the developer's REAL ~/.agents/skills.
|
||||
// Sandbox HOME/USERPROFILE to configDir before resolving the layout or invoking
|
||||
// install/uninstall so codex's resolved skills dir is configDir/.agents/skills.
|
||||
function sandboxHome(t, dir) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
process.env.HOME = dir;
|
||||
process.env.USERPROFILE = dir;
|
||||
t.after(() => {
|
||||
if (savedHome === undefined) delete process.env.HOME;
|
||||
else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE;
|
||||
else process.env.USERPROFILE = savedUserProfile;
|
||||
});
|
||||
}
|
||||
//
|
||||
// #3712: promoted to tests/helpers.cjs, from the byte-identical copy that used to
|
||||
// live here. It now also sets the sandbox marker src/test-home-guard.cts needs to
|
||||
// stay permissive on hosts with no readable passwd entry.
|
||||
const { sandboxHome } = require('./helpers.cjs');
|
||||
|
||||
describe('installRuntimeArtifacts — skills runtimes write gsd-prefixed skill dirs', () => {
|
||||
for (const runtime of SKILLS_RUNTIMES_LAYOUT) {
|
||||
@@ -5093,13 +5086,20 @@ describe('Bug #2911: migrateLegacyDevPreferencesToSkill honors the skills-kind h
|
||||
function withFakeHome(fakeHome, fn) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
// #3712: record WHICH home this sandboxed to. src/test-home-guard.cts fails
|
||||
// closed on hosts with no readable passwd entry, and this is what proves a
|
||||
// genuinely-sandboxed caller there. Without it these calls would be refused.
|
||||
const savedMarker = process.env.GSD_TEST_HOME_SANDBOX;
|
||||
process.env.HOME = fakeHome;
|
||||
process.env.USERPROFILE = fakeHome;
|
||||
process.env.GSD_TEST_HOME_SANDBOX = fakeHome;
|
||||
try {
|
||||
return fn();
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.HOME; else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = savedUserProfile;
|
||||
if (savedMarker === undefined) delete process.env.GSD_TEST_HOME_SANDBOX;
|
||||
else process.env.GSD_TEST_HOME_SANDBOX = savedMarker;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -3182,3 +3182,632 @@ describe('install()/uninstall() degrade (never abort) on a staging-root resoluti
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
/**
|
||||
* #3712 — an in-process run must never reach the developer's REAL home.
|
||||
*
|
||||
* The confinement rows above bound a write to the root they are handed. A kind
|
||||
* may ALSO declare a global `home` override resolved from `os.homedir()` rather
|
||||
* than from configDir (today: codex's skills kind, `home: ".agents"`, ADR-1239 /
|
||||
* #2088). assertDestWithinConfigHome cannot see that class: it confines a
|
||||
* destSubpath to whatever root it is given, and here the root IS the escaped home.
|
||||
*
|
||||
* The live defect: an in-process caller that forgot to sandbox HOME pruned the
|
||||
* real ~/.agents/skills — 71 gsd-* dirs deleted, a foreign `cloudflare` skill
|
||||
* surviving, suite still exit 0, because the runtime's own config home was
|
||||
* untouched and the manifest kept reporting a healthy install.
|
||||
*
|
||||
* SIX writers resolve a kind `home` and then write or destroy under it. The four
|
||||
* reachable today are covered below by driving the REAL entrypoint — not the
|
||||
* predicate — so that deleting a guard call site turns these rows red. The other
|
||||
* two, `installOpencodeFamilySkills` and `installAgentsKindStandalone`, are
|
||||
* guarded but not wiring-tested: no runtime declares a `home` override on those
|
||||
* kinds, so neither path can be exercised without inventing a descriptor.
|
||||
*
|
||||
* The sixth, `migrateLegacyDevPreferencesToSkill`, CREATES rather than prunes and
|
||||
* runs from `_runLegacyInstallMigrations` — i.e. BEFORE installRuntimeArtifacts'
|
||||
* own assertion — so it carries its own guard call and its own wiring row. The
|
||||
* count read FIVE/three until review of #3725 caught the row missing.
|
||||
*/
|
||||
describe('#3712 in-process home confinement', () => {
|
||||
const { createTempDir, sandboxHome } = require('./helpers.cjs');
|
||||
const installEngine = require('../gsd-core/bin/lib/install-engine.cjs');
|
||||
const surface = require('../gsd-core/bin/lib/surface.cjs');
|
||||
const runtimeArtifactLayout = require('../gsd-core/bin/lib/runtime-artifact-layout.cjs');
|
||||
const testHomeGuard = require('../gsd-core/bin/lib/test-home-guard.cjs');
|
||||
|
||||
const escapingKinds = (home) => [{ kind: 'skills', home, destSubpath: 'skills' }];
|
||||
const confinedKinds = [{ kind: 'skills', destSubpath: 'skills' }];
|
||||
const fakeOs = (homedir, passwdHome) => ({
|
||||
homedir: () => homedir,
|
||||
userInfo: () => ({ homedir: passwdHome }),
|
||||
});
|
||||
const underTest = { NODE_TEST_CONTEXT: 'child-v8' };
|
||||
|
||||
// ── the predicate ────────────────────────────────────────────────────────
|
||||
// Driven with REAL directories: the whole question is filesystem identity, and
|
||||
// synthetic paths cannot exercise it. The passwd home is injected via the deps
|
||||
// seam so no row depends on the developer's actual home.
|
||||
|
||||
describe('predicate', () => {
|
||||
test('refuses a destination that lands inside the real home', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-real-');
|
||||
t.after(() => cleanup(realHome));
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(realHome, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
);
|
||||
});
|
||||
|
||||
test('allows a destination outside the real home — the correct-usage path', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-real2-');
|
||||
const sandbox = createTempDir('gsd-3712-sandbox-');
|
||||
t.after(() => { cleanup(realHome); cleanup(sandbox); });
|
||||
assert.doesNotThrow(() => testHomeGuard.assertTestHomeSandboxed(
|
||||
'installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(sandbox, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest },
|
||||
));
|
||||
});
|
||||
|
||||
// The round-5 defect. A HOME-state check ("is HOME sandboxed right now?")
|
||||
// returns "sandboxed" here and lets the write through, because the layout was
|
||||
// resolved BEFORE the sandbox and its kind.home still names the real home.
|
||||
// applySurface takes an already-resolved layout, so this is reachable, not
|
||||
// theoretical. Asking about the DESTINATION is what closes it.
|
||||
test('refuses a STALE layout resolved before HOME was sandboxed', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-stale-real-');
|
||||
const sandbox = createTempDir('gsd-3712-stale-sandbox-');
|
||||
t.after(() => { cleanup(realHome); cleanup(sandbox); });
|
||||
// kind.home captured the REAL home; HOME is now the sandbox.
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
'a sandboxed HOME does not make a destination resolved before the sandbox safe',
|
||||
);
|
||||
});
|
||||
|
||||
// The round-6 defect, found by CI rather than by review: all six Windows
|
||||
// shards of #3725 failed here, every one of them on a legitimately sandboxed
|
||||
// destination. On Windows `os.tmpdir()` is `%LOCALAPPDATA%\Temp` —
|
||||
// `%USERPROFILE%\AppData\Local\Temp` — so every sandbox a test creates is a
|
||||
// DESCENDANT of the real home, and "does this land inside the real home?"
|
||||
// answers yes for the safe case and the dangerous one alike. POSIX hides this:
|
||||
// /tmp and /var/folders both sit outside $HOME, so the containment question
|
||||
// happens to discriminate there and the flaw is invisible.
|
||||
//
|
||||
// What actually separates the two is whether the destination derives from a
|
||||
// HOME that was sandboxed — hence the added conjunct. This must NOT decay into
|
||||
// the "is HOME sandboxed?" check the row above rejects; the row below holds
|
||||
// that line.
|
||||
test('allows a sandbox nested INSIDE the real home — the Windows temp-root shape', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-nested-home-');
|
||||
t.after(() => cleanup(realHome));
|
||||
const sandbox = path.join(realHome, 'AppData', 'Local', 'Temp', 'gsd-sandbox-a');
|
||||
fs.mkdirSync(sandbox, { recursive: true });
|
||||
assert.doesNotThrow(() => testHomeGuard.assertTestHomeSandboxed(
|
||||
'installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(sandbox, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest },
|
||||
));
|
||||
});
|
||||
|
||||
// The guard against fixing the row above by weakening it to a HOME-state
|
||||
// check. Same nested-sandbox environment, but the layout was resolved before
|
||||
// the sandbox existed, so the destination still names the real home's
|
||||
// `.agents`. HOME is sandboxed and the write is still fatal.
|
||||
test('a nested sandbox does NOT excuse a STALE destination in the real home', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-nested-stale-');
|
||||
t.after(() => cleanup(realHome));
|
||||
const sandbox = path.join(realHome, 'AppData', 'Local', 'Temp', 'gsd-sandbox-b');
|
||||
fs.mkdirSync(sandbox, { recursive: true });
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
'a sandbox beneath the real home vouches only for what is beneath the sandbox',
|
||||
);
|
||||
});
|
||||
|
||||
// Review N2: the leaking cell of the truth table. A destination's ancestor
|
||||
// chain is linear, so "inside the real home AND inside the effective HOME"
|
||||
// admits `realHome ⊂ effectiveHome` as well as the intended
|
||||
// `effectiveHome ⊂ realHome`. HOME at /Users, /home or C:\Users is not a
|
||||
// sandbox — it is the real home spelled more widely — and without the third
|
||||
// conjunct it exempts a stale destination pointing straight at ~/.agents.
|
||||
test('a HOME that is an ANCESTOR of the real home is not a sandbox', (t) => {
|
||||
const container = createTempDir('gsd-3712-ancestor-');
|
||||
t.after(() => cleanup(container));
|
||||
const realHome = path.join(container, 'someone');
|
||||
fs.mkdirSync(path.join(realHome, '.agents'), { recursive: true });
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
// HOME is the DIRECTORY THAT CONTAINS the real home, so it differs from
|
||||
// the passwd home and still contains the destination.
|
||||
{ os: fakeOs(container, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
'a HOME above the real home spells it more widely; it does not sandbox it',
|
||||
);
|
||||
});
|
||||
|
||||
// The escape the nested-sandbox exemption opens if it trusts the SPELLING of
|
||||
// a path instead of where it resolves. HOME is sandboxed to a directory
|
||||
// inside the real home (legitimate on Windows), but the sandbox's `.agents`
|
||||
// is an alias onto the real one, so a lexical ancestor walk reaches the
|
||||
// sandbox while the write lands in `$REAL/.agents`. On Windows the alias
|
||||
// would be a junction; the mechanism is the same.
|
||||
test('refuses a sandbox whose .agents is an ALIAS onto the real one', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-alias-');
|
||||
t.after(() => cleanup(realHome));
|
||||
const realAgents = path.join(realHome, '.agents');
|
||||
fs.mkdirSync(path.join(realAgents, 'skills'), { recursive: true });
|
||||
const sandbox = path.join(realHome, 'AppData', 'Local', 'Temp', 'gsd-sandbox-c');
|
||||
fs.mkdirSync(sandbox, { recursive: true });
|
||||
fs.symlinkSync(realAgents, path.join(sandbox, '.agents'), 'dir');
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(sandbox, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
'containment must be decided on where the write LANDS, not how it is spelled',
|
||||
);
|
||||
});
|
||||
|
||||
// The refusal happens before any write, so it is not a partial install.
|
||||
// bin/install.js reads this to decide NOT to run its pre-config rollback,
|
||||
// which would otherwise delete and recreate every snapshotted gsd-* dir in
|
||||
// the real skills root — the exact mutation this guard exists to prevent.
|
||||
test('a refusal is marked so callers can tell it from a partial install', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-flag-');
|
||||
t.after(() => cleanup(realHome));
|
||||
let caught;
|
||||
try {
|
||||
testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(realHome, realHome), env: underTest });
|
||||
} catch (err) { caught = err; }
|
||||
assert.ok(caught, 'precondition: the guard must have refused');
|
||||
assert.equal(testHomeGuard.isTestHomeGuardRefusal(caught), true);
|
||||
assert.equal(testHomeGuard.isTestHomeGuardRefusal(new Error('unrelated')), false,
|
||||
'an unrelated failure IS a partial install and must still roll back');
|
||||
assert.equal(testHomeGuard.isTestHomeGuardRefusal(undefined), false);
|
||||
});
|
||||
|
||||
// The exemption above is the only path in this guard that can turn a
|
||||
// destination inside the real home into an allowed write, so its
|
||||
// cannot-tell branches have to refuse. Mutating either of them to `true`
|
||||
// left the whole suite green before this row existed.
|
||||
test('refuses when HOME cannot be placed at all, rather than exempting it', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-nohome-place-');
|
||||
t.after(() => cleanup(realHome));
|
||||
const unplaceable = {
|
||||
'an empty homedir': () => '',
|
||||
'a homedir that throws': () => { throw new Error('no home'); },
|
||||
'a homedir that does not exist': () => path.join(realHome, 'absent-sandbox'),
|
||||
};
|
||||
for (const [label, homedir] of Object.entries(unplaceable)) {
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: { homedir, userInfo: () => ({ homedir: realHome }) }, env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
`${label} must refuse — an unplaceable HOME is not evidence of a sandbox`,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test('the message names the operation and the fix, so it is not silenced blindly', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-msg-');
|
||||
t.after(() => cleanup(realHome));
|
||||
let message = '';
|
||||
try {
|
||||
testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(realHome, realHome), env: underTest });
|
||||
} catch (err) { message = err.message; }
|
||||
assert.match(message, /applySurface/, 'must name the writer that was refused');
|
||||
assert.match(message, /sandboxHome/, 'must point at the helper that fixes it');
|
||||
assert.match(message, /Fix the TEST, not this guard/);
|
||||
assert.match(message, /BEFORE resolving the layout/, 'must state the ordering that matters');
|
||||
});
|
||||
|
||||
test('is inert outside a test runner — real codex installs still write to $HOME/.agents', (t) => {
|
||||
// The override exists so a REAL install lands in the user's home. Blocking
|
||||
// that would break codex installs outright, so this row is load-bearing.
|
||||
const realHome = createTempDir('gsd-3712-prod-');
|
||||
t.after(() => cleanup(realHome));
|
||||
assert.doesNotThrow(() => testHomeGuard.assertTestHomeSandboxed(
|
||||
'installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{ os: fakeOs(realHome, realHome), env: {} },
|
||||
));
|
||||
});
|
||||
|
||||
test('ignores kinds with no home override — they cannot escape configDir', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-nohome-');
|
||||
t.after(() => cleanup(realHome));
|
||||
assert.doesNotThrow(() => testHomeGuard.assertTestHomeSandboxed(
|
||||
'installRuntimeArtifacts', 'claude', confinedKinds,
|
||||
{ os: fakeOs(realHome, realHome), env: underTest },
|
||||
));
|
||||
});
|
||||
|
||||
// Identity, not pathname: path.resolve() resolves neither symlinks nor case,
|
||||
// and realpath returns a canonical pathname two routes to one directory can
|
||||
// still disagree on. Driven with the REAL fs — an injected os cannot prove
|
||||
// canonicalization, since that is what is under test.
|
||||
test('a destination reached through a SYMLINKED spelling of the real home is refused', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-symreal-');
|
||||
const linkParent = createTempDir('gsd-3712-symlink-');
|
||||
const linkHome = path.join(linkParent, 'home-link');
|
||||
t.after(() => { cleanup(realHome); cleanup(linkParent); });
|
||||
fs.symlinkSync(realHome, linkHome, 'dir');
|
||||
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(linkHome, '.agents')),
|
||||
{ os: fakeOs(linkHome, realHome), env: underTest }),
|
||||
/destination inside\s+your REAL home/,
|
||||
'two spellings of one directory are not two directories',
|
||||
);
|
||||
});
|
||||
|
||||
test('refuses rather than guessing when the passwd home cannot be identified', () => {
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds('/nonexistent-root-3712/.agents'),
|
||||
{
|
||||
os: { homedir: () => '/nonexistent-root-3712', userInfo: () => { throw new Error('no passwd entry'); } },
|
||||
env: underTest,
|
||||
}),
|
||||
/no identifiable passwd home/,
|
||||
);
|
||||
});
|
||||
|
||||
test('a caller that recorded THIS home still works with no passwd entry', (t) => {
|
||||
// Keeps fail-closed from breaking passwd-less CI for callers that DID sandbox.
|
||||
const sandbox = createTempDir('gsd-3712-marker-');
|
||||
t.after(() => cleanup(sandbox));
|
||||
assert.doesNotThrow(() => testHomeGuard.assertTestHomeSandboxed(
|
||||
'installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(sandbox, '.agents')),
|
||||
{
|
||||
os: { homedir: () => sandbox, userInfo: () => { throw new Error('no passwd entry'); } },
|
||||
env: { ...underTest, [testHomeGuard.SANDBOX_MARKER]: sandbox },
|
||||
},
|
||||
));
|
||||
});
|
||||
|
||||
test('a STALE marker naming a different home does not vouch for this call', (t) => {
|
||||
const sandbox = createTempDir('gsd-3712-marker2-');
|
||||
const other = createTempDir('gsd-3712-other-');
|
||||
t.after(() => { cleanup(sandbox); cleanup(other); });
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(sandbox, '.agents')),
|
||||
{
|
||||
os: { homedir: () => sandbox, userInfo: () => { throw new Error('no passwd entry'); } },
|
||||
env: { ...underTest, [testHomeGuard.SANDBOX_MARKER]: other },
|
||||
}),
|
||||
/no identifiable passwd home/,
|
||||
'the marker must name the home actually in effect',
|
||||
);
|
||||
});
|
||||
|
||||
// Codex review of #3725. The marker attests that a caller sandboxed HOME; it
|
||||
// says NOTHING about where an already-resolved destination points. A layout
|
||||
// captured before sandboxHome() still names the real `~/.agents`, and the
|
||||
// marker branch waved it straight through — the exact stale-layout shape the
|
||||
// primary branch refuses by design, reachable on any passwd-less host. Both
|
||||
// halves are now required: the marker names the home in effect AND every
|
||||
// destination derives from it.
|
||||
test('a marker matching HOME does not vouch for a destination that does not derive from it', (t) => {
|
||||
const sandbox = createTempDir('gsd-3712-marker-stale-');
|
||||
const realHome = createTempDir('gsd-3712-marker-real-');
|
||||
t.after(() => { cleanup(sandbox); cleanup(realHome); });
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{
|
||||
os: { homedir: () => sandbox, userInfo: () => { throw new Error('no passwd entry'); } },
|
||||
env: { ...underTest, [testHomeGuard.SANDBOX_MARKER]: sandbox },
|
||||
}),
|
||||
/NOT beneath that sandbox/,
|
||||
'a recorded sandbox vouches for HOME, never for a destination outside it',
|
||||
);
|
||||
});
|
||||
|
||||
// Codex review of #3725. resolveThroughLinks swallowed EVERY realpathSync
|
||||
// error and fell back to the LEXICAL spelling. That is a fail-open, and it
|
||||
// inverts the function's whole purpose: an aliased `<sandbox>/.agents` that
|
||||
// cannot be canonicalized keeps its sandbox spelling, satisfies the
|
||||
// nested-sandbox exemption, and the write is ALLOWED into the real home. The
|
||||
// module documents ONE named fail-open (the marker branch); this was a second,
|
||||
// unnamed one. ENOENT/ENOTDIR still walk up — that is the ordinary
|
||||
// destination-does-not-exist-yet case, and the split matches identify()'s.
|
||||
test('a destination component that cannot be canonicalized is refused, not assumed safe', (t) => {
|
||||
const sandbox = createTempDir('gsd-3712-uncanon-');
|
||||
const realHome = createTempDir('gsd-3712-uncanon-real-');
|
||||
t.after(() => { cleanup(sandbox); cleanup(realHome); });
|
||||
// A symlink CYCLE is the portable way to make realpathSync fail with
|
||||
// something other than "not there": every lookup through it returns ELOOP
|
||||
// while the parent directory resolves normally.
|
||||
const loopA = path.join(sandbox, 'loop-a');
|
||||
const loopB = path.join(sandbox, 'loop-b');
|
||||
try {
|
||||
fs.symlinkSync(loopB, loopA);
|
||||
fs.symlinkSync(loopA, loopB);
|
||||
} catch {
|
||||
t.skip('symlink creation unsupported on this platform/privilege');
|
||||
return;
|
||||
}
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(loopA, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
/could not be canonicalized/,
|
||||
'an unresolvable component must refuse — falling back to the lexical spelling is the '
|
||||
+ 'exact ALLOW an aliased <sandbox>/.agents needs to reach the real home',
|
||||
);
|
||||
});
|
||||
|
||||
// Non-vacuity for the row above, and the reason it cannot simply refuse on
|
||||
// ANY realpath error: the ordinary case is a destination that does not exist
|
||||
// yet, where realpath fails ENOENT on the leaf and on every not-yet-created
|
||||
// ancestor. Refusing there would reject every fresh install.
|
||||
test('… but a destination that merely does not exist yet still resolves and is allowed', (t) => {
|
||||
const sandbox = createTempDir('gsd-3712-uncanon-enoent-');
|
||||
const realHome = createTempDir('gsd-3712-uncanon-enoent-real-');
|
||||
t.after(() => { cleanup(sandbox); cleanup(realHome); });
|
||||
const neverCreated = path.join(sandbox, 'not-created-yet', '.agents');
|
||||
assert.strictEqual(fs.existsSync(neverCreated), false,
|
||||
'the row is only meaningful while the destination is absent');
|
||||
assert.doesNotThrow(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(neverCreated),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
'ENOENT is the expected shape of a fresh install, not a canonicalization failure',
|
||||
);
|
||||
});
|
||||
|
||||
// ENOTDIR takes the same walk-up branch as ENOENT, deliberately: both mean
|
||||
// "no such path as named", which is the question identify() answers the same
|
||||
// way. Pinned so the two cannot drift apart.
|
||||
test('… and a component sitting behind a FILE (ENOTDIR) walks up rather than refusing', (t) => {
|
||||
const sandbox = createTempDir('gsd-3712-uncanon-enotdir-');
|
||||
const realHome = createTempDir('gsd-3712-uncanon-enotdir-real-');
|
||||
t.after(() => { cleanup(sandbox); cleanup(realHome); });
|
||||
const asFile = path.join(sandbox, 'a-file');
|
||||
fs.writeFileSync(asFile, 'not a directory\n');
|
||||
assert.doesNotThrow(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('applySurface', 'codex',
|
||||
escapingKinds(path.join(asFile, '.agents')),
|
||||
{ os: fakeOs(sandbox, realHome), env: underTest }),
|
||||
'ENOTDIR means the path does not exist as named — identify() calls that absent, and this '
|
||||
+ 'walk must agree with it rather than inventing a second errno policy',
|
||||
);
|
||||
});
|
||||
|
||||
// Review of #3725, Major 1. sameDirectory() is read by the marker branch as
|
||||
// permission to PROCEED, so "cannot tell" has to answer no. It used to answer
|
||||
// yes whenever neither side identified — two absent paths here, or two stats
|
||||
// failing EACCES/EPERM/EIO on a locked-down host — which turned the passwd-less
|
||||
// escape hatch into an unconditional bypass for any marker value at all.
|
||||
// The absent/absent shape is the portable way to pin it; the errno shapes take
|
||||
// the same branch.
|
||||
test('a marker and a home that BOTH fail to identify do not vouch for each other', (t) => {
|
||||
const root = createTempDir('gsd-3712-unident-');
|
||||
t.after(() => cleanup(root));
|
||||
// Two DIFFERENT paths, so the same-pathname shortcut cannot fire, and
|
||||
// neither exists, so neither identifies.
|
||||
const missingHome = path.join(root, 'home-never-created');
|
||||
const missingMarker = path.join(root, 'marker-never-created');
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(missingHome, '.agents')),
|
||||
{
|
||||
os: { homedir: () => missingHome, userInfo: () => { throw new Error('no passwd entry'); } },
|
||||
env: { ...underTest, [testHomeGuard.SANDBOX_MARKER]: missingMarker },
|
||||
}),
|
||||
/no identifiable passwd home/,
|
||||
'two unidentifiable paths are not evidence that either is a sandbox',
|
||||
);
|
||||
});
|
||||
|
||||
// Review of #3725, Major 2, raised as a question rather than a finding: on
|
||||
// Windows Node derives st_dev/st_ino from BY_HANDLE_FILE_INFORMATION, and the
|
||||
// uniqueness guarantees are weaker than POSIX. If dev collapsed to a per-volume
|
||||
// constant AND ino were 0 for directories, isInside() would match its very
|
||||
// first ancestor and report every path on the drive as inside the real home.
|
||||
// The whole guard rests on this primitive, so assert it directly instead of
|
||||
// reasoning about it — this row runs on every platform in the matrix, so
|
||||
// Windows answers the question itself.
|
||||
test('filesystem identity discriminates directories on this platform', (t) => {
|
||||
const a = createTempDir('gsd-3712-ident-a-');
|
||||
const b = createTempDir('gsd-3712-ident-b-');
|
||||
t.after(() => { cleanup(a); cleanup(b); });
|
||||
const sa = fs.statSync(a);
|
||||
const sb = fs.statSync(b);
|
||||
assert.ok(sa.dev !== sb.dev || sa.ino !== sb.ino,
|
||||
`two distinct directories share an identity (dev=${sa.dev}/${sb.dev}, ino=${sa.ino}/${sb.ino}) — ` +
|
||||
'isInside() would then match its first ancestor and refuse everything');
|
||||
const again = fs.statSync(path.join(a, '..', path.basename(a)));
|
||||
assert.equal(again.dev, sa.dev, 'one directory reached by two spellings must keep one dev');
|
||||
assert.equal(again.ino, sa.ino, 'one directory reached by two spellings must keep one ino');
|
||||
});
|
||||
|
||||
// An ambient marker must not disarm the guard on the PRIMARY path: it is only
|
||||
// consulted when the real home cannot be identified at all.
|
||||
test('an ambient marker does NOT disarm the guard when the real home is identifiable', (t) => {
|
||||
const realHome = createTempDir('gsd-3712-ambient-');
|
||||
t.after(() => cleanup(realHome));
|
||||
assert.throws(
|
||||
() => testHomeGuard.assertTestHomeSandboxed('installRuntimeArtifacts', 'codex',
|
||||
escapingKinds(path.join(realHome, '.agents')),
|
||||
{
|
||||
os: fakeOs(realHome, realHome),
|
||||
env: { ...underTest, [testHomeGuard.SANDBOX_MARKER]: realHome },
|
||||
}),
|
||||
/destination inside\s+your REAL home/,
|
||||
'destination containment is authoritative; no marker may short-circuit it',
|
||||
);
|
||||
});
|
||||
|
||||
test('the marker name tests/helpers.cjs writes matches the one the guard reads', () => {
|
||||
// helpers.cjs duplicates this string rather than requiring the compiled guard,
|
||||
// to keep its documented no-built-lib-at-import-time contract. Pin the pair.
|
||||
const { TEST_HOME_SANDBOX_MARKER } = require('./helpers.cjs');
|
||||
assert.strictEqual(TEST_HOME_SANDBOX_MARKER, testHomeGuard.SANDBOX_MARKER,
|
||||
'the helper and the guard must agree on the marker env var name');
|
||||
});
|
||||
});
|
||||
|
||||
// ── the wiring ───────────────────────────────────────────────────────────
|
||||
// These call the REAL entrypoints. Deleting a guard call site makes them fail;
|
||||
// the predicate rows above would stay green, which is why both halves exist.
|
||||
|
||||
describe('wiring — every writer that resolves kind.home is guarded', () => {
|
||||
/**
|
||||
* Sandbox the real HOME (so nothing real is ever at risk), then tell the guard
|
||||
* — through its deps seam only — that this sandboxed home IS the passwd home.
|
||||
* The layout then resolves its `home` override under that directory, so the
|
||||
* destination lands inside what the guard believes is the real home: exactly
|
||||
* "the caller forgot", reproduced against a throwaway directory.
|
||||
*/
|
||||
function forgottenSandbox(t) {
|
||||
const configDir = createTempDir('gsd-3712-cfg-');
|
||||
const homeDir = createTempDir('gsd-3712-home-');
|
||||
t.after(() => { cleanup(configDir); cleanup(homeDir); });
|
||||
sandboxHome(t, homeDir);
|
||||
return { configDir, homeDir, deps: { os: fakeOs(homeDir, homeDir), env: underTest } };
|
||||
}
|
||||
|
||||
test('installRuntimeArtifacts refuses before it writes or prunes anything', (t) => {
|
||||
const { configDir, homeDir, deps } = forgottenSandbox(t);
|
||||
const profile = { name: 'full', skills: '*', agents: new Set() };
|
||||
assert.throws(
|
||||
() => installEngine.installRuntimeArtifacts(
|
||||
'codex', configDir, 'global', profile, () => undefined, undefined, deps,
|
||||
),
|
||||
/destination inside\s+your REAL home/,
|
||||
'the guard must be wired into installRuntimeArtifacts, not merely exported',
|
||||
);
|
||||
assert.ok(!fs.existsSync(path.join(homeDir, '.agents', 'skills')),
|
||||
'it must refuse BEFORE creating the escaped destination');
|
||||
});
|
||||
|
||||
test('uninstallRuntimeArtifacts refuses — it prunes the same escaped home', (t) => {
|
||||
const { configDir, deps } = forgottenSandbox(t);
|
||||
assert.throws(
|
||||
() => installEngine.uninstallRuntimeArtifacts('codex', configDir, 'global', deps),
|
||||
/destination inside\s+your REAL home/,
|
||||
'uninstall resolves the same kind.home and calls _removeGsdEntries on it',
|
||||
);
|
||||
});
|
||||
|
||||
test('applySurface refuses — its dest selection prefers kind.home, then syncs', (t) => {
|
||||
const { configDir, deps } = forgottenSandbox(t);
|
||||
const layout = runtimeArtifactLayout.resolveRuntimeArtifactLayout('codex', configDir, 'global');
|
||||
assert.throws(
|
||||
() => surface.applySurface(configDir, layout, new Map(), undefined, undefined, undefined, deps),
|
||||
/destination inside\s+your REAL home/,
|
||||
'surface apply is the third writer that reaches kind.home',
|
||||
);
|
||||
});
|
||||
|
||||
// The fourth reachable writer, and the one the first pass of #3712 missed: it
|
||||
// CREATES SKILL.md under the skills kind's `home` instead of pruning, and it
|
||||
// runs from _runLegacyInstallMigrations — BEFORE installRuntimeArtifacts'
|
||||
// assertion — so the rows above cannot cover it. Driven directly because that
|
||||
// is the seam it has; `saved` must carry dev-preferences.md or the function
|
||||
// returns early before ever resolving a target.
|
||||
test('migrateLegacyDevPreferencesToSkill refuses — it writes SKILL.md under kind.home', (t) => {
|
||||
const { configDir, homeDir, deps } = forgottenSandbox(t);
|
||||
const saved = new Map([['dev-preferences.md', '# saved\n']]);
|
||||
assert.throws(
|
||||
() => installEngine.migrateLegacyDevPreferencesToSkill(configDir, saved, 'codex', 'global', deps),
|
||||
/destination inside\s+your REAL home/,
|
||||
'the legacy migration is the sixth writer that reaches kind.home, and it runs first',
|
||||
);
|
||||
assert.ok(!fs.existsSync(path.join(homeDir, '.agents', 'skills', 'gsd-dev-preferences')),
|
||||
'it must refuse BEFORE creating the escaped skill directory');
|
||||
});
|
||||
|
||||
// The guard call is conditional on `target.hasHomeOverride` — the skills
|
||||
// kind's own answer to "did it declare a home override?", read off the same
|
||||
// layout resolution the write uses. Pin the ALLOW half too, so widening that
|
||||
// condition cannot pass silently. configDir sits INSIDE the (fake) real home
|
||||
// deliberately: that is what gives this row teeth. With the condition as
|
||||
// written the guard is never consulted, because no home override was
|
||||
// declared; widened to run unconditionally it would see a destination inside
|
||||
// the real home with no sandbox to derive from, and refuse an ordinary
|
||||
// confined migration.
|
||||
test('… and still migrates for a runtime whose skills kind declares no home override', (t) => {
|
||||
const { homeDir, deps } = forgottenSandbox(t);
|
||||
const configDir = path.join(homeDir, '.claude');
|
||||
fs.mkdirSync(configDir, { recursive: true });
|
||||
const layout = runtimeArtifactLayout.resolveRuntimeArtifactLayout('claude', configDir, 'global');
|
||||
const skills = layout.kinds.find((k) => k.kind === 'skills');
|
||||
assert.ok(skills && !skills.home,
|
||||
'claude skills must carry NO home override — if this fails the descriptor drifted '
|
||||
+ 'and this row is no longer testing the ALLOW half');
|
||||
const saved = new Map([['dev-preferences.md', '# saved\n']]);
|
||||
assert.strictEqual(
|
||||
installEngine.migrateLegacyDevPreferencesToSkill(configDir, saved, 'claude', 'global', deps),
|
||||
true,
|
||||
'a confined destination must not be refused — the guard is destination-keyed, not runtime-keyed',
|
||||
);
|
||||
});
|
||||
|
||||
// Codex review of #3725. `installRoot !== targetDir` was the stand-in for "the
|
||||
// skills kind declared a home override", and the two are not equivalent: the
|
||||
// inequality is FALSE when the override resolves onto targetDir itself — a
|
||||
// configDir of `$HOME/.agents`, which is exactly where codex's override points.
|
||||
// The guard was skipped and SKILL.md was written into the real home under a
|
||||
// test runner. The condition now reads the declaration off the same layout
|
||||
// resolution instead of comparing two paths.
|
||||
test('… and refuses when the configDir IS the home-override destination', (t) => {
|
||||
const { homeDir, deps } = forgottenSandbox(t);
|
||||
const configDir = path.join(homeDir, '.agents');
|
||||
fs.mkdirSync(configDir, { recursive: true });
|
||||
const saved = new Map([['dev-preferences.md', '# saved\n']]);
|
||||
assert.throws(
|
||||
() => installEngine.migrateLegacyDevPreferencesToSkill(configDir, saved, 'codex', 'global', deps),
|
||||
/destination inside\s+your REAL home/,
|
||||
'an override that resolves onto targetDir is still a declared override',
|
||||
);
|
||||
assert.ok(!fs.existsSync(path.join(configDir, 'skills', 'gsd-dev-preferences')),
|
||||
'it must refuse BEFORE creating the skill directory in the real home');
|
||||
});
|
||||
});
|
||||
|
||||
// ── the property the one real fix depends on ─────────────────────────────
|
||||
|
||||
test('a sandboxed HOME actually contains codex\'s global skills kind', (t) => {
|
||||
const configDir = createTempDir('gsd-3712-contain-cfg-');
|
||||
const homeDir = createTempDir('gsd-3712-contain-home-');
|
||||
t.after(() => { cleanup(configDir); cleanup(homeDir); });
|
||||
|
||||
const ambientHome = path.resolve(os.homedir());
|
||||
sandboxHome(t, homeDir);
|
||||
|
||||
const layout = runtimeArtifactLayout.resolveRuntimeArtifactLayout('codex', configDir, 'global');
|
||||
const skills = layout.kinds.find((k) => k.kind === 'skills');
|
||||
assert.ok(skills && skills.home,
|
||||
'codex skills must still carry the global home override this guard exists for — '
|
||||
+ 'if this fails the descriptor drifted, and the guard is now testing nothing');
|
||||
|
||||
const dest = path.resolve(path.join(skills.home, skills.destSubpath));
|
||||
assert.ok(dest.startsWith(path.resolve(homeDir) + path.sep),
|
||||
`codex skills must resolve inside the sandboxed HOME, got ${dest}`);
|
||||
assert.ok(!dest.startsWith(ambientHome + path.sep),
|
||||
`codex skills must NOT resolve inside the ambient home ${ambientHome}, got ${dest}`);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -16,7 +16,7 @@ const { writeSurface, readSurface, resolveSurface, listSurface, applySurface } =
|
||||
const { loadSkillsManifest, writeActiveProfile, resolveProfile } = require('../gsd-core/bin/lib/install-profiles.cjs');
|
||||
const { resolveRuntimeArtifactLayout } = require('../gsd-core/bin/lib/runtime-artifact-layout.cjs');
|
||||
const { CLUSTERS, allClusteredSkills } = require('../gsd-core/bin/lib/clusters.cjs');
|
||||
const { createTempDir, cleanup } = require('./helpers.cjs');
|
||||
const { createTempDir, cleanup, sandboxHome } = require('./helpers.cjs');
|
||||
|
||||
const REAL_COMMANDS_DIR = path.join(__dirname, '..', 'commands', 'gsd');
|
||||
|
||||
@@ -1140,13 +1140,20 @@ describe('skills-kind destination parity: installer vs surface-apply (#2911)', (
|
||||
function withFakeHome(fakeHome, fn) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
// #3712: record WHICH home this sandboxed to. src/test-home-guard.cts fails
|
||||
// closed on hosts with no readable passwd entry, and this is what proves a
|
||||
// genuinely-sandboxed caller there. Without it these calls would be refused.
|
||||
const savedMarker = process.env.GSD_TEST_HOME_SANDBOX;
|
||||
process.env.HOME = fakeHome;
|
||||
process.env.USERPROFILE = fakeHome;
|
||||
process.env.GSD_TEST_HOME_SANDBOX = fakeHome;
|
||||
try {
|
||||
return fn();
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.HOME; else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = savedUserProfile;
|
||||
if (savedMarker === undefined) delete process.env.GSD_TEST_HOME_SANDBOX;
|
||||
else process.env.GSD_TEST_HOME_SANDBOX = savedMarker;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1265,13 +1272,20 @@ describe('codex skills-kind destination: home override (#2911)', () => {
|
||||
function withFakeHome(fakeHome, fn) {
|
||||
const savedHome = process.env.HOME;
|
||||
const savedUserProfile = process.env.USERPROFILE;
|
||||
// #3712: record WHICH home this sandboxed to. src/test-home-guard.cts fails
|
||||
// closed on hosts with no readable passwd entry, and this is what proves a
|
||||
// genuinely-sandboxed caller there. Without it these calls would be refused.
|
||||
const savedMarker = process.env.GSD_TEST_HOME_SANDBOX;
|
||||
process.env.HOME = fakeHome;
|
||||
process.env.USERPROFILE = fakeHome;
|
||||
process.env.GSD_TEST_HOME_SANDBOX = fakeHome;
|
||||
try {
|
||||
return fn();
|
||||
} finally {
|
||||
if (savedHome === undefined) delete process.env.HOME; else process.env.HOME = savedHome;
|
||||
if (savedUserProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = savedUserProfile;
|
||||
if (savedMarker === undefined) delete process.env.GSD_TEST_HOME_SANDBOX;
|
||||
else process.env.GSD_TEST_HOME_SANDBOX = savedMarker;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1372,6 +1386,14 @@ describe('installOpencodeFamilySkills destination parity (#2911 sibling coverage
|
||||
const configDir = fs.mkdtempSync(path.join(os.tmpdir(), `gsd-2911-ocfs-${runtime}-`));
|
||||
const fakeHomeOverride = fs.mkdtempSync(path.join(os.tmpdir(), `gsd-2911-ocfs-home-${runtime}-`));
|
||||
t.after(() => { cleanup(configDir); cleanup(fakeHomeOverride); });
|
||||
// #3712 — this row drives a skills-kind `home` override on purpose, which is
|
||||
// exactly what the test-home guard exists to police, so it has to declare the
|
||||
// sandbox rather than rely on the destination happening to sit outside the
|
||||
// real home. On POSIX it does (os.tmpdir() is /tmp or /var/folders); on
|
||||
// Windows os.tmpdir() is under %USERPROFILE%, so without this the guard
|
||||
// correctly refuses and the row fails on Windows only. HOME is the override
|
||||
// itself, which is the home this call actually writes under.
|
||||
sandboxHome(t, fakeHomeOverride);
|
||||
|
||||
const originalResolve = runtimeArtifactLayoutModule.resolveRuntimeArtifactLayout;
|
||||
// Capture the real destSubpath before patching so the assertion below
|
||||
|
||||
Reference in New Issue
Block a user