fix: harden package trust boundaries

Reject symlinked manifest/runtime paths and require explicit credential-bearing child processes, including separation of source-read and mutation tokens.\n\nCloses #2075\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: bradygaster

scripts/gh-aw-hosted-e2e.mjs

@@ -67,7 +67,13 @@ function requireArg(args, name) {
   return value;
 }
 
-export function sanitizedEnvironment(extra = {}) {
+export function sanitizedEnvironment(extra = {}, { allowGitHubToken = false } = {}) {
+  if ('SQUAD_GH_AW_E2E_TOKEN' in extra) {
+    throw new Error('SQUAD_GH_AW_E2E_TOKEN must never be passed to a child process.');
+  }
+  if ('GH_TOKEN' in extra && !allowGitHubToken) {
+    throw new Error('GH_TOKEN requires an explicitly privileged or source-read child process.');
+  }
   const env = Object.fromEntries(
     SAFE_CHILD_ENV.filter((key) => process.env[key] !== undefined)
       .map((key) => [key, process.env[key]]),
@@ -79,7 +85,7 @@ export function runChild(command, args, options = {}) {
   const result = spawnSync(command, args, {
     cwd: options.cwd,
     encoding: 'utf8',
-    env: sanitizedEnvironment(options.env),
+    env: sanitizedEnvironment(options.env, { allowGitHubToken: options.allowGitHubToken === true }),
     stdio: options.capture === false ? 'inherit' : 'pipe',
     timeout: options.timeout ?? 120_000,
   });
@@ -95,7 +101,11 @@ export function runChild(command, args, options = {}) {
 function privileged(command, args, options = {}) {
   const token = process.env.GH_TOKEN;
   if (!token) throw new Error('GH_TOKEN is required for the trusted hosted journey.');
-  return runChild(command, args, { ...options, env: { ...options.env, GH_TOKEN: token } });
+  return runChild(command, args, {
+    ...options,
+    allowGitHubToken: true,
+    env: { ...options.env, GH_TOKEN: token },
+  });
 }
 
 function ghJson(args, options = {}) {
@@ -106,7 +116,7 @@ function ghJson(args, options = {}) {
 function sourceGhJson(args) {
   const token = process.env.SOURCE_READ_TOKEN ?? process.env.GH_TOKEN;
   if (!token) throw new Error('A source repository read token is required.');
-  const output = runChild('gh', args, { env: { GH_TOKEN: token } });
+  const output = runChild('gh', args, { allowGitHubToken: true, env: { GH_TOKEN: token } });
   return output ? JSON.parse(output) : null;
 }
 
@@ -339,10 +349,14 @@ function hosted(args, repositoryRoot) {
 
     const sourceReadToken = process.env.SOURCE_READ_TOKEN;
     if (!sourceReadToken) throw new Error('SOURCE_READ_TOKEN is required for immutable package retrieval.');
+    if (sourceReadToken === process.env.GH_TOKEN) {
+      throw new Error('SOURCE_READ_TOKEN must not reuse the mutation-capable GH_TOKEN.');
+    }
     runChild('gh', ['aw', 'add', `${PACKAGE_NAME}@${sourceSha}`], {
       cwd: checkout,
       capture: false,
       timeout: 600_000,
+      allowGitHubToken: true,
       env: { GH_TOKEN: sourceReadToken },
     });
     runChild('node', ['.github/workflows/shared/squad-install-verifier.mjs', '--materialize-runtime'], {

test/gh-aw-hosted-e2e.test.ts

@@ -37,6 +37,8 @@ describe('Squad gh-aw hosted E2E controller', () => {
     expect(env.OTHER_CREDENTIAL).toBeUndefined();
     expect(env.ARBITRARY_UNTRUSTED_VALUE).toBeUndefined();
     expect(env.SAFE_VALUE).toBe('ok');
+    expect(() => sanitizedEnvironment({ GH_TOKEN: 'secret' })).toThrow(/explicitly privileged/);
+    expect(() => sanitizedEnvironment({ SQUAD_GH_AW_E2E_TOKEN: 'secret' })).toThrow(/never be passed/);
     delete process.env.GH_TOKEN;
     delete process.env.SQUAD_GH_AW_E2E_TOKEN;
     delete process.env.OTHER_CREDENTIAL;
@@ -91,8 +93,12 @@ describe('Squad gh-aw hosted E2E controller', () => {
   });
 
   it('never executes candidate package or installed verifier with inherited credentials', () => {
-    expect(SCRIPT).toContain('env: sanitizedEnvironment(options.env)');
+    expect(SCRIPT).toContain(
+      'env: sanitizedEnvironment(options.env, { allowGitHubToken: options.allowGitHubToken === true })',
+    );
     expect(SCRIPT).toContain("runChild('gh', ['aw', 'add'");
+    expect(SCRIPT).toContain('SOURCE_READ_TOKEN must not reuse the mutation-capable GH_TOKEN');
+    expect(SCRIPT).toContain('allowGitHubToken: true');
     expect(SCRIPT).toContain('env: { GH_TOKEN: sourceReadToken }');
     expect(SCRIPT).toContain("runChild('node', ['.github/workflows/shared/squad-install-verifier.mjs'");
     expect(SCRIPT).not.toMatch(/privileged\('node'/);

test/gh-aw-quality.test.ts

@@ -9,7 +9,7 @@
  */
 
 import { afterAll, describe, it, expect } from 'vitest';
-import { chmodSync, cpSync, readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, unlinkSync } from 'node:fs';
+import { chmodSync, cpSync, readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, rmSync, symlinkSync, unlinkSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { execFileSync, execSync, spawnSync } from 'node:child_process';
@@ -3670,6 +3670,24 @@ describe('gh-aw: canonical package integrity contract', () => {
     }
   });
 
+  it('rejects symlinked manifest leaves and runtime parents', () => {
+    const manifestRoot = makeConsumer();
+    const manifestPath = join(manifestRoot, CONTRACT_DESTINATION);
+    const manifestTarget = join(manifestRoot, 'redirected-manifest.json');
+    writeFileSync(manifestTarget, readFileSync(manifestPath));
+    unlinkSync(manifestPath);
+    symlinkSync(manifestTarget, manifestPath);
+    expect(verifyInstall(manifestRoot).failures.join('\n')).toContain('symbolic link');
+
+    const runtimeRoot = makeConsumer(revisionA, false);
+    const shared = join(runtimeRoot, '.github/workflows/shared');
+    const redirected = join(runtimeRoot, '.github/workflows/shared-redirected');
+    cpSync(shared, redirected, { recursive: true });
+    rmSync(shared, { recursive: true });
+    symlinkSync(redirected, shared, 'dir');
+    expect(() => materializeRuntime(runtimeRoot)).toThrow(/symbolic link/);
+  });
+
   it('materializes package-only runtime bytes and rejects stale sources', () => {
     const root = makeConsumer(revisionA, false);
     const contract = JSON.parse(readFileSync(join(root, CONTRACT_DESTINATION), 'utf8'));

workflows/package/squad-bootstrap.md

@@ -151,7 +151,7 @@ pre-agent-steps:
         node --check "$path" >/dev/null
       }
       # BEGIN GENERATED RESOURCE DIGESTS
-      check_hash "$install_verifier" "f2af6cebe2aecf1aa152f6871aa428fa5382b1027c92c1eaf4a49f767a4ba4a4"
+      check_hash "$install_verifier" "0da2b31a80b47e428cb215a00d4655b54b7b66e4a6a2522f0f4da8f119d0346e"
       check_hash "$cast_validator" "62fbf47b51639fd1878c143e5176ee3099e390065997411511e9d483d467bbce"
       check_hash "$bootstrap_validator" "d449b9204f7fad133ff7133c1a30c9381c87e3c0c9d481352819ca93ea1a1dad"
       # END GENERATED RESOURCE DIGESTS

workflows/shared/squad-install-verifier.mjs

@@ -3,9 +3,11 @@
 import {
   cpSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
+  realpathSync,
   readdirSync,
   rmSync,
   writeFileSync,
@@ -207,24 +209,45 @@ export function validateContract(contract) {
 
 function safePath(root, relativePath) {
   validatePathSyntax(relativePath, undefined, relativePath);
-  const absoluteRoot = resolve(root);
+  const absoluteRoot = realpathSync(resolve(root));
   const candidate = resolve(absoluteRoot, relativePath);
   if (candidate !== absoluteRoot && !candidate.startsWith(`${absoluteRoot}${sep}`)) {
     throw new Error(`Path escapes repository root: ${relativePath}`);
   }
+  let current = absoluteRoot;
+  const segments = relativePath.split('/');
+  for (let index = 0; index < segments.length; index += 1) {
+    current = join(current, segments[index]);
+    const stat = lstatSync(current, { throwIfNoEntry: false });
+    if (!stat) break;
+    if (stat.isSymbolicLink()) throw new Error(`Path contains a symbolic link: ${relativePath}`);
+    if (index < segments.length - 1 && !stat.isDirectory()) {
+      throw new Error(`Path parent is not a directory: ${relativePath}`);
+    }
+  }
   return candidate;
 }
 
 function readRequired(root, relativePath) {
   const path = safePath(root, relativePath);
-  if (!existsSync(path)) throw new Error(`Required file is missing: ${relativePath}`);
+  const stat = lstatSync(path, { throwIfNoEntry: false });
+  if (!stat) throw new Error(`Required file is missing: ${relativePath}`);
+  if (!stat.isFile()) throw new Error(`Required path is not a regular file: ${relativePath}`);
   return readFileSync(path);
 }
 
 function writePath(root, relativePath, content) {
-  const path = safePath(root, relativePath);
+  let path = safePath(root, relativePath);
   mkdirSync(dirname(path), { recursive: true });
+  path = safePath(root, relativePath);
+  const existing = lstatSync(path, { throwIfNoEntry: false });
+  if (existing && !existing.isFile()) {
+    throw new Error(`Write destination is not a regular file: ${relativePath}`);
+  }
   writeFileSync(path, content);
+  if (!lstatSync(path).isFile()) {
+    throw new Error(`Written destination is not a regular file: ${relativePath}`);
+  }
 }
 
 function fileDigest(root, path) {

workflows/squad-bootstrap.md

@@ -158,7 +158,7 @@ pre-agent-steps:
         node --check "$path" >/dev/null
       }
       # BEGIN GENERATED RESOURCE DIGESTS
-      check_hash "$install_verifier" "f2af6cebe2aecf1aa152f6871aa428fa5382b1027c92c1eaf4a49f767a4ba4a4"
+      check_hash "$install_verifier" "0da2b31a80b47e428cb215a00d4655b54b7b66e4a6a2522f0f4da8f119d0346e"
       check_hash "$cast_validator" "62fbf47b51639fd1878c143e5176ee3099e390065997411511e9d483d467bbce"
       check_hash "$bootstrap_validator" "d449b9204f7fad133ff7133c1a30c9381c87e3c0c9d481352819ca93ea1a1dad"
       # END GENERATED RESOURCE DIGESTS

workflows/squad-workflows.manifest.json

@@ -56,7 +56,7 @@
       "source": "workflows/package/squad-bootstrap.md",
       "destination": ".github/workflows/squad-bootstrap.md",
       "lock": ".github/workflows/squad-bootstrap.lock.yml",
-      "source_sha256": "4a2cd73cb3395c512eec6e8620fc20387f47607604e87dc6bec66bf96f81b6c2"
+      "source_sha256": "fb1bc0f0c1f63e09f94892f99bfe857499803a7ec9465108cb128b99eb01a852"
     }
   ],
   "shared_runtime": [
@@ -66,7 +66,7 @@
       "package_destination": ".github/workflows/shared/squad-install-verifier.mjs",
       "destination": ".github/workflows/shared/squad-install-verifier.mjs",
       "ownership": "manifest",
-      "sha256": "f2af6cebe2aecf1aa152f6871aa428fa5382b1027c92c1eaf4a49f767a4ba4a4"
+      "sha256": "0da2b31a80b47e428cb215a00d4655b54b7b66e4a6a2522f0f4da8f119d0346e"
     },
     {
       "path": "shared/squad-cast-validator.mjs",