Harden runner workspace publication

Author: chubes4

.github/scripts/run-agent-task/execute-native-agent-task.mjs

@@ -388,12 +388,13 @@ await rm(nativeResultPath, { force: true })
 const runtimeResult = sanitizeRuntimeSourceValue(nativeRuntimeResult, privateRuntimeSourceRootForSanitization)
 assertNoRuntimeSourcePaths(runtimeResult, privateRuntimeSourceRootForSanitization)
 let workspaceApply = { status: "no-op", changedFiles: [] }
+let runnerWorkspaceCore = null
 if (execution.code === 0 && runtimeResult.success === true && request.runner_workspace?.enabled) {
-  const core = await import(pathToFileURL(join(codeboxRoot, "packages/runtime-core/dist/runner-workspace-apply.js")).href)
+  runnerWorkspaceCore = await import(pathToFileURL(join(codeboxRoot, "packages/runtime-core/dist/runner-workspace-apply.js")).href)
   const publicCore = await import(pathToFileURL(join(codeboxRoot, "packages/runtime-core/dist/public.js")).href)
   const refs = publicCore.normalizePublicArtifactRefDTOs(runtimeResult)
     .filter((ref) => ref.kind === "codebox-patch" || ref.kind === "codebox-changed-files")
-  workspaceApply = await core.applyRunnerWorkspacePatch({ artifactRoot: artifactsPath, artifactRefs: refs, workspaceRoot: workspace, writablePaths: String(request.writable_paths || "").split(",").map((value) => value.trim()).filter(Boolean) })
+  workspaceApply = await runnerWorkspaceCore.applyRunnerWorkspacePatch({ artifactRoot: artifactsPath, artifactRefs: refs, workspaceRoot: workspace, writablePaths: String(request.writable_paths || "").split(",").map((value) => value.trim()).filter(Boolean) })
 }
 await cleanupPrivateRuntimeSources()
 assertNoRuntimeSourcePaths(runtimeResult, privateRuntimeSourceRootForSanitization)
@@ -422,9 +423,10 @@ const runtimeRecord = record(runtimeResult)
 const agentResult = record(runtimeRecord.agent_task_run_result)
 let publication = resultValue(runtimeRecord, "metadata.runner_workspace_publication")
 if (execution.code === 0 && runtimeRecord.success === true && verificationPassed && workspaceApply.status === "applied") {
+  await runnerWorkspaceCore.verifyRunnerWorkspaceIntegrity(workspaceApply.integrity)
   const testPublisher = string(process.env.WP_CODEBOX_TEST_PUBLISHER_MODULE)
   const publisher = testPublisher ? (await import(pathToFileURL(resolve(testPublisher)).href)).publishRunnerWorkspace : publishRunnerWorkspace
-  publication = await publisher({ request, workspace, changedFiles: workspaceApply.changedFiles, token: process.env.ACCESS_TOKEN || process.env.GITHUB_TOKEN })
+  publication = await publisher({ request, changedFiles: workspaceApply.changedFiles, publicationFiles: workspaceApply.publicationFiles, token: process.env.ACCESS_TOKEN || process.env.GITHUB_TOKEN })
   runtimeRecord.metadata = { ...record(runtimeRecord.metadata), runner_workspace_publication: publication }
   runtimeRecord.outputs = { ...record(runtimeRecord.outputs), runner_workspace_publication: publication }
 }

.github/scripts/run-agent-task/runner-workspace-publisher.mjs

@@ -1,10 +1,8 @@
-import { readFile } from "node:fs/promises"
-import { resolve } from "node:path"
 
 function string(value) { return typeof value === "string" ? value.trim() : "" }
 function record(value) { return value && typeof value === "object" && !Array.isArray(value) ? value : {} }
 
-export async function publishRunnerWorkspace({ request, workspace, changedFiles, token, fetchImpl = fetch }) {
+export async function publishRunnerWorkspace({ request, changedFiles, publicationFiles, workspace, token, fetchImpl = fetch }) {
   const targetRepo = string(request.target_repo).toLowerCase()
   const config = record(request.runner_workspace)
   const configuredRepo = string(config.repo).toLowerCase()
@@ -23,28 +21,26 @@ export async function publishRunnerWorkspace({ request, workspace, changedFiles,
     if (!response.ok) throw new Error(`GitHub API ${method} ${path} failed with ${response.status}.`)
     return payload
   }
-  const baseRef = await api("GET", `/git/ref/heads/${encodeURIComponent(base)}`)
-  const baseSha = string(baseRef.object?.sha)
+  let existing = null
+  try { existing = await api("GET", `/git/ref/heads/${head.split("/").map(encodeURIComponent).join("/")}`) } catch (error) { if (!String(error.message).includes(" 404.")) throw error }
+  // Existing PR branches are append-only publication targets. Their current tree
+  // is the base so files from earlier agent turns cannot disappear.
+  const parent = string(existing?.object?.sha)
+  const baseRef = parent ? null : await api("GET", `/git/ref/heads/${encodeURIComponent(base)}`)
+  const baseSha = parent || string(baseRef.object?.sha)
   const baseCommit = await api("GET", `/git/commits/${baseSha}`)
   const tree = []
-  for (const changed of changedFiles) {
-    const relativePath = string(changed)
+  const captured = Array.isArray(publicationFiles) ? publicationFiles : []
+  if (!captured.length) throw new Error("Runner workspace publication requires immutable approved file content.")
+  for (const changed of captured) {
+    const relativePath = string(changed?.path)
     if (!relativePath || relativePath.startsWith("/") || relativePath.split("/").some((part) => !part || part === "." || part === ".." || part === ".git")) throw new Error("Publication changed file path is invalid.")
-    const absolute = resolve(workspace, relativePath)
-    if (!absolute.startsWith(`${resolve(workspace)}/`)) throw new Error("Publication changed file escapes workspace.")
-    try {
-      const content = await readFile(absolute)
-      const blob = await api("POST", "/git/blobs", { content: content.toString("base64"), encoding: "base64" })
-      tree.push({ path: relativePath, mode: "100644", type: "blob", sha: string(blob.sha) })
-    } catch (error) {
-      if (error?.code === "ENOENT") tree.push({ path: relativePath, mode: "100644", type: "blob", sha: null })
-      else throw error
-    }
+    if (changed.deleted) { tree.push({ path: relativePath, mode: "100644", type: "blob", sha: null }); continue }
+    if (changed.mode !== "100644" && changed.mode !== "100755" || typeof changed.content !== "string") throw new Error("Publication file is not an approved regular file.")
+    const blob = await api("POST", "/git/blobs", { content: changed.content, encoding: "base64" })
+    tree.push({ path: relativePath, mode: changed.mode, type: "blob", sha: string(blob.sha) })
   }
   const nextTree = await api("POST", "/git/trees", { base_tree: string(baseCommit.tree?.sha), tree })
-  let parent = baseSha
-  let existing = null
-  try { existing = await api("GET", `/git/ref/heads/${head.split("/").map(encodeURIComponent).join("/")}`); parent = string(existing.object?.sha) || baseSha } catch (error) { if (!String(error.message).includes(" 404.")) throw error }
   const commit = await api("POST", "/git/commits", { message: string(config.commit_message || request.workload?.label || "Apply agent task changes"), tree: string(nextTree.sha), parents: [parent] })
   if (existing) await api("PATCH", `/git/refs/heads/${head.split("/").map(encodeURIComponent).join("/")}`, { sha: string(commit.sha), force: false })
   else await api("POST", "/git/refs", { ref: `refs/heads/${head}`, sha: string(commit.sha) })

packages/runtime-core/src/runner-workspace-apply.ts

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process"
-import { readFile, lstat, realpath } from "node:fs/promises"
-import { isAbsolute, resolve } from "node:path"
+import { readFile, lstat, realpath, readdir } from "node:fs/promises"
+import { isAbsolute, resolve, relative } from "node:path"
 import { promisify } from "node:util"
 import { createHash } from "node:crypto"
 import { pathIsWithinRoot, relativePathMatchesExcludePattern } from "./file-tree-policy.js"
@@ -36,6 +36,22 @@ export interface RunnerWorkspaceApplyResult {
   status: "applied" | "no-op"
   changedFiles: string[]
   patchSha256?: string
+  integrity?: RunnerWorkspaceIntegritySnapshot
+  publicationFiles?: RunnerWorkspacePublicationFile[]
+}
+
+export interface RunnerWorkspacePublicationFile {
+  path: string
+  mode: "100644" | "100755"
+  content?: string
+  sha256?: string
+  deleted: boolean
+}
+
+export interface RunnerWorkspaceIntegritySnapshot {
+  workspaceRoot: string
+  files: RunnerWorkspacePublicationFile[]
+  baseline: RunnerWorkspacePublicationFile[]
 }
 
 /**
@@ -51,6 +67,7 @@ export async function applyRunnerWorkspacePatch(request: RunnerWorkspaceApplyReq
   const patchPath = await artifactPath(artifactRoot, patchRef.path)
   const changedPath = await artifactPath(artifactRoot, changedRef.path)
   const [patch, changedRaw] = await Promise.all([readBoundedText(patchPath), readBoundedText(changedPath)])
+  const baseline = await snapshotWorkspace(workspaceRoot)
   verifyDigest(patch, patchRef.sha256)
 
   const changed = parseChangedFiles(changedRaw)
@@ -64,13 +81,28 @@ export async function applyRunnerWorkspacePatch(request: RunnerWorkspaceApplyReq
 
   await execGit(workspaceRoot, ["apply", "--check", "--whitespace=error", "--", patchPath])
   await execGit(workspaceRoot, ["apply", "--whitespace=error", "--", patchPath])
+  const files = await snapshotWorkspace(workspaceRoot)
+  validateAppliedWorkspace(baseline, files, changed)
   if (request.verify) await request.verify()
 
   return {
     schema: "wp-codebox/runner-workspace-apply-result/v1",
     status: "applied",
     changedFiles: changed.map((file) => file.relativePath),
     patchSha256: createHash("sha256").update(patch).digest("hex"),
+    integrity: { workspaceRoot, files, baseline },
+    publicationFiles: changed.map((change) => {
+      const file = files.find((candidate) => candidate.path === change.relativePath)
+      return file ? file : { path: change.relativePath, mode: "100644", deleted: true }
+    }),
+  }
+}
+
+/** Ensures checks did not mutate approved output or introduce unrelated files. */
+export async function verifyRunnerWorkspaceIntegrity(snapshot: RunnerWorkspaceIntegritySnapshot): Promise<void> {
+  const current = await snapshotWorkspace(snapshot.workspaceRoot)
+  if (JSON.stringify(current) !== JSON.stringify(snapshot.files)) {
+    throw new Error("Runner workspace changed after approval; refusing publication.")
   }
 }
 
@@ -121,7 +153,7 @@ function validateChangedFiles(files: RunnerWorkspaceChangedFile[], writablePaths
   for (const file of files) {
     const path = file.relativePath.replaceAll("\\", "/")
     if (!path || path.startsWith("/") || path.split("/").some((part) => part === "" || part === "." || part === ".." || part === ".git" || part === ".codebox")) throw new Error(`Changed file has a denied path: ${file.relativePath}`)
-    if (![file.beforeMode, file.afterMode].filter(Boolean).every((mode) => mode === "100644")) throw new Error(`Changed file has an unsupported mode: ${file.relativePath}`)
+    if (![file.beforeMode, file.afterMode].filter(Boolean).every((mode) => mode === "100644" || mode === "100755")) throw new Error(`Changed file has an unsupported mode: ${file.relativePath}`)
     if (!writablePaths.some((pattern) => relativePathMatchesExcludePattern(path, pattern))) throw new Error(`Changed file is outside writable_paths: ${file.relativePath}`)
   }
 }
@@ -133,7 +165,53 @@ function validatePatchPaths(patch: string, changed: RunnerWorkspaceChangedFile[]
     const path = line.slice(4).split("\t", 1)[0].trim().replace(/^[ab]\//, "")
     return path === "/dev/null" ? [] : [path]
   })
-  if (paths.length === 0 || paths.some((path) => !declared.has(path))) throw new Error("Patch paths do not exactly correspond to canonical changed-files.")
+  if (paths.length === 0 || paths.some((path) => !declared.has(path)) || [...declared].some((path) => !paths.includes(path))) throw new Error("Patch paths do not exactly correspond to canonical changed-files.")
+  for (const line of patch.split("\n")) {
+    if (/^(old mode|new mode|new file mode|deleted file mode) /.test(line)) {
+      const mode = line.split(" ").at(-1)
+      if (mode !== "100644" && mode !== "100755") throw new Error("Patch contains an unsupported file mode.")
+    }
+    if (/^(similarity index|rename from|rename to|copy from|copy to|Subproject commit)/.test(line)) throw new Error("Patch contains unsupported git metadata.")
+  }
+}
+
+async function snapshotWorkspace(root: string): Promise<RunnerWorkspacePublicationFile[]> {
+  const output: RunnerWorkspacePublicationFile[] = []
+  async function visit(directory: string): Promise<void> {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      if (entry.name === ".git" || entry.name === ".codebox") continue
+      const absolute = resolve(directory, entry.name)
+      const path = relative(root, absolute).replaceAll("\\", "/")
+      const stat = await lstat(absolute)
+      if (stat.isSymbolicLink()) throw new Error(`Runner workspace contains an unsupported path type: ${path}`)
+      if (stat.isDirectory()) {
+        await visit(absolute)
+        continue
+      }
+      if (!stat.isFile()) throw new Error(`Runner workspace contains an unsupported path type: ${path}`)
+      const mode = (stat.mode & 0o111) ? "100755" : "100644"
+      const bytes = await readFile(absolute)
+      output.push({ path, mode, content: bytes.toString("base64"), sha256: createHash("sha256").update(bytes).digest("hex"), deleted: false })
+    }
+  }
+  await visit(root)
+  return output.sort((a, b) => a.path.localeCompare(b.path))
+}
+
+function validateAppliedWorkspace(baseline: RunnerWorkspacePublicationFile[], current: RunnerWorkspacePublicationFile[], changed: RunnerWorkspaceChangedFile[]): void {
+  const before = new Map(baseline.map((file) => [file.path, file]))
+  const after = new Map(current.map((file) => [file.path, file]))
+  const actual = new Set([...before.keys(), ...after.keys()].filter((path) => JSON.stringify(before.get(path)) !== JSON.stringify(after.get(path))))
+  const declared = new Set(changed.map((file) => file.relativePath))
+  if (actual.size !== declared.size || [...actual].some((path) => !declared.has(path))) throw new Error("Applied workspace differs from the canonical changed-files manifest.")
+  for (const file of changed) {
+    const value = after.get(file.relativePath)
+    if (file.status === "deleted") {
+      if (value) throw new Error(`Canonical deletion was not applied: ${file.relativePath}`)
+      continue
+    }
+    if (!value || value.mode !== file.afterMode) throw new Error(`Applied file mode does not match canonical manifest: ${file.relativePath}`)
+  }
 }
 
 async function execGit(cwd: string, args: string[]): Promise<void> {

packages/wordpress-plugin/src/class-wp-codebox-browser-runner-template.php

@@ -912,7 +912,10 @@ public static function runner_contract( string $runner_php ): array {
 
 	/** Builds the generated PHP runtime-local tool registration fragment. */
 	public static function runtime_tool_registration_fragment(): string {
-		return '
+		// The generated Playground runner is intentionally self-contained. Embed the
+		// same bounded executor used by the host registration, never a host bridge.
+		$sandbox_executor = file_get_contents( __DIR__ . '/class-wp-codebox-sandbox-workspace-executor.php' );
+		return "\nif ( ! class_exists( 'WP_Codebox_Sandbox_Workspace_Executor' ) ) {\n" . $sandbox_executor . "\n}\n" . '
 class WP_Codebox_Browser_Filesystem_Write_Tool {
 	public function handle_tool_call( array $parameters, array $tool_def = array() ): array {
 		global $wp_codebox_browser_artifact_environment;
@@ -959,15 +962,22 @@ function wp_codebox_browser_runtime_tool_name( string $tool_id ): string {
 	return \'filesystem_write\';
 }
 
+if ( preg_match( "/^(?:client\\/)?workspace_(?:show|ls|read|grep|write|edit|apply_patch|git_status|git_diff)$/", $tool_id ) ) {
+	return str_starts_with( $tool_id, "client/" ) ? substr( $tool_id, 7 ) : $tool_id;
+}
+
 return \'\';
 }
 
 function wp_codebox_browser_runtime_tool_declarations( array $tool_names ): array {
 global $wp_codebox_browser_artifact_environment;
 
 $declarations = array();
-if ( ! in_array( \'filesystem_write\', $tool_names, true ) ) {
-	return $declarations;
+foreach ( WP_Codebox_Sandbox_Workspace_Executor::tool_declarations() as $name => $declaration ) {
+	$base = substr( $name, strlen( "client/" ) );
+	if ( in_array( $base, $tool_names, true ) ) {
+		$declarations[ $base ] = $declaration;
+	}
 }
 
 $environment = is_array( $wp_codebox_browser_artifact_environment ?? null ) ? $wp_codebox_browser_artifact_environment : array();
@@ -1119,7 +1129,16 @@ function wp_codebox_browser_runtime_replay_ability_lifecycle(): array {
 }
 
 function wp_codebox_browser_runtime_tool_callback( array $request, array $payload ) {
-unset( $payload );
+
+$workspace_tool = (string) ( $request[\'tool_name\'] ?? \'\' );
+if ( preg_match( "/^(?:client\\/)?workspace_(?:show|ls|read|grep|write|edit|apply_patch|git_status|git_diff)$/", $workspace_tool ) ) {
+	$task_input = is_array( $payload[\'task_input\'] ?? null ) ? $payload[\'task_input\'] : array();
+	$context = array(
+		\'workspace_root\' => \'/workspace\',
+		\'writable_paths\' => is_array( $task_input[\'writable_paths\'] ?? null ) ? $task_input[\'writable_paths\'] : array(),
+	);
+	return ( new WP_Codebox_Sandbox_Workspace_Executor() )->executeWP_Agent_Tool_Call( $request, is_array( $request[\'tool_def\'] ?? null ) ? $request[\'tool_def\'] : array(), $context );
+}
 
 if ( ! in_array( (string) ( $request[\'tool_name\'] ?? \'\' ), array( \'filesystem_write\', \'client/filesystem-write\' ), true ) ) {
 	return null;

tests/runner-workspace-apply.test.ts

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os"
 import { join } from "node:path"
 import { promisify } from "node:util"
 import { createHash } from "node:crypto"
-import { applyRunnerWorkspacePatch } from "../packages/runtime-core/src/runner-workspace-apply.js"
+import { applyRunnerWorkspacePatch, verifyRunnerWorkspaceIntegrity } from "../packages/runtime-core/src/runner-workspace-apply.js"
 
 const exec = promisify(execFile)
 
@@ -35,6 +35,7 @@ const files = [{ path: "/workspace/README.md", relativePath: "README.md", status
   assert.equal(result.status, "applied")
   assert.equal(await readFile(join(input.workspace, "README.md"), "utf8"), "after\n")
   assert.deepEqual(order, ["verify"])
+  await verifyRunnerWorkspaceIntegrity(result.integrity!)
 }
 
 {
@@ -43,6 +44,27 @@ const files = [{ path: "/workspace/README.md", relativePath: "README.md", status
   assert.equal(result.status, "no-op")
 }
 
+{
+  const executablePatch = "diff --git a/README.md b/README.md\nold mode 100644\nnew mode 100755\n--- a/README.md\n+++ b/README.md\n@@ -1 +1 @@\n-before\n+after\n"
+  const executableFiles = [{ ...files[0], afterMode: "100755" }]
+  const input = await fixture(executablePatch, executableFiles)
+  const result = await applyRunnerWorkspacePatch({ artifactRoot: input.artifacts, artifactRefs: input.refs, workspaceRoot: input.workspace, writablePaths: ["README.md"] })
+  assert.equal(result.publicationFiles?.[0]?.mode, "100755")
+}
+
+{
+  const input = await fixture(patch, files)
+  await writeFile(join(input.artifacts, "files", "changed-files.json"), JSON.stringify({ schema: "wp-codebox/changed-files/v1", files: [{ ...files[0], relativePath: "other.md" }] }))
+  await assert.rejects(() => applyRunnerWorkspacePatch({ artifactRoot: input.artifacts, artifactRefs: input.refs, workspaceRoot: input.workspace, writablePaths: ["README.md", "other.md"] }), /exactly correspond/)
+}
+
+{
+  const input = await fixture(patch, files)
+  const result = await applyRunnerWorkspacePatch({ artifactRoot: input.artifacts, artifactRefs: input.refs, workspaceRoot: input.workspace, writablePaths: ["README.md"] })
+  await writeFile(join(input.workspace, "extra.txt"), "unexpected\n")
+  await assert.rejects(() => verifyRunnerWorkspaceIntegrity(result.integrity!), /changed after approval/)
+}
+
 {
   const input = await fixture(patch, files)
   await assert.rejects(() => applyRunnerWorkspacePatch({ artifactRoot: input.artifacts, artifactRefs: input.refs, workspaceRoot: input.workspace, writablePaths: ["src/**"] }), /outside writable_paths/)