Tom Boucher
|
21b81ea068
|
feat(#1681): ADR-1239 Phase C-2 — external-descriptor trust gate (configHome confinement) [slice 1] (#1806)
* feat(#1681): ADR-1239 Phase C-2 — external-descriptor trust gate (configHome confinement) [slice 1]
Phase 4 slice 1. Load-time, fail-closed configHome write-confinement for
installed third-party host-plugin descriptors — defense-in-depth on top of the
existing opt-in/schema/consent/first-party-wins loader gates + Phase 2's
install-time assertDestWithinConfigHome (#1679 AC3).
- src/external-descriptor-trust.cts: isPathConfined(target, root) pure
cross-platform containment primitive + assertDescriptorConfined(descriptor,
configHome) — walks runtime.artifactLayout global/local destSubpaths, throws
fail-closed (naming descriptor + path) on the first escape. Rejects ../escape
+ absolute-outside-root. Missing layout / invalid entries skipped.
- tests/external-descriptor-confinement.test.cjs: 7 tests (containment
primitive, benign passes, global/local/absolute escapes rejected, missing
layout, invalid entries).
Load-time twin of Phase 2's install-time gate — rejects malformed/escaping
descriptors BEFORE consent even matters. NOT wired into loadRegistry yet
(slice 2, 4 callers, medium blast radius); this ships the reusable gate + tests.
Not the ADR-1577 prompt-injection breaker (separate concern, shared word trust).
Proactive CI gates: ADR-457 ignores + INVENTORY-MANIFEST + injection-scan audit.
All clean locally (7 tests + security + inventory + eslint 0 problems).
* chore(changeset): add Changed fragment for external-descriptor trust gate (#1681)
|
2026-06-28 12:00:43 -04:00 |
|