From 7ace1731c65426ab12e20b08aceaf98db799c7de Mon Sep 17 00:00:00 2001 From: Alex Clarke Date: Wed, 16 Sep 2026 18:48:15 -0600 Subject: [PATCH] fix(TASK-048): cover agent and repo scripts in eol=lf rules; probe Scenario H for installed bundled scripts Extends the .gitattributes eol=lf guard to assets/agents/** (33 embedded shell scripts share the CRLF failure mode the hooks rules fix) and scripts/*.sh. Adopts the probe-authored Scenario H: black-box checks of the installed log-events.sh (XDG default, 0600, UTC header, secret filter, symlink refusal) and notify.sh (control-byte-stripped fallback), plus non-executable .builtin-manifest. --- .gitattributes | 2 + scripts/usage-probe-hooks.sh | 85 ++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+) diff --git a/.gitattributes b/.gitattributes index 07bd69a..a5280f8 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,5 +1,7 @@ assets/config-template.yaml text eol=lf assets/hooks/*.sh text eol=lf +assets/agents/** text eol=lf assets/functions/tools/* text eol=lf assets/functions/scripts/* text eol=lf assets/functions/utils/*.sh text eol=lf +scripts/*.sh text eol=lf diff --git a/scripts/usage-probe-hooks.sh b/scripts/usage-probe-hooks.sh index aab18ac..2cd99be 100755 --- a/scripts/usage-probe-hooks.sh +++ b/scripts/usage-probe-hooks.sh @@ -19,6 +19,12 @@ # on reinstall; a malformed manifest deletes NOTHING (fail-safe). # G) a plain startup sweeps manifest-owned hooks of removed builtin agents # while leaving user agent dirs and user files untouched. +# H) the INSTALLED bundled scripts behave as documented when run directly: +# log-events.sh defaults under ${XDG_STATE_HOME:-$HOME/.local/state}/coyote/ +# (0600, UTC ISO-8601 header, secrets filtered, symlink at the default +# path refused) and notify.sh's no-notifier/no-tty fallback strips +# ANSI/OSC control bytes; the hooks-dir .builtin-manifest is never +# installed executable. # # Not covered here (see src/function/mod.rs tests for tool.* + payload-file # coverage instead): a live tool.started firing requires a real LLM round @@ -373,5 +379,84 @@ COYOTE_CONFIG_DIR="$CFG_G" "$BIN" --no-stream "say exactly: hi" > /dev/null || fail "sweep touched a user agent dir without a manifest" echo "PASS: startup sweep removes only manifest-owned hooks of removed agents" +echo "== Scenario H: bundled hook scripts behave as documented when run directly ==" +# The two shipped scripts are consumer-facing artifacts in their own right. +# Exercise the INSTALLED copies (real CLI install) the way a hook runner or a +# manual invocation would: clean env, no COYOTE_HOOK_LOG, no notifier +# binaries, no controlling terminal. +CFG_H="$WORKDIR/h" +mkdir -p "$CFG_H" +COYOTE_CONFIG_DIR="$CFG_H" "$BIN" --install-builtins hooks > /dev/null 2>&1 +LOG_SCRIPT="$CFG_H/hooks/log-events.sh" +NOTIFY_SCRIPT="$CFG_H/hooks/notify.sh" +[ -x "$LOG_SCRIPT" ] || fail "installed log-events.sh missing or non-executable" +[ -x "$NOTIFY_SCRIPT" ] || fail "installed notify.sh missing or non-executable" + +# The manifest the installer drops beside the scripts is NOT a script: the +# unified exec-bit predicate must leave it non-executable. +if [ -f "$CFG_H/hooks/.builtin-manifest" ]; then + [ ! -x "$CFG_H/hooks/.builtin-manifest" ] \ + || fail ".builtin-manifest in the hooks dir is executable; non-script files must stay non-executable" +fi + +# H1: with COYOTE_HOOK_LOG unset the log defaults under XDG_STATE_HOME, is +# created 0600, carries a UTC ISO-8601 header, and never logs COYOTE_SECRET_*. +XDG_H="$WORKDIR/h-xdg" +env -u COYOTE_HOOK_LOG XDG_STATE_HOME="$XDG_H" HOME="$WORKDIR/h-home-unused" \ + COYOTE_EVENT=probe.event COYOTE_HOOK_NAME=probe COYOTE_SECRET_TOKEN=hunter2 \ + bash "$LOG_SCRIPT" || fail "log-events.sh exited non-zero on the XDG default path" +HLOG="$XDG_H/coyote/hooks.log" +[ -f "$HLOG" ] || fail "log-events.sh did not default to \$XDG_STATE_HOME/coyote/hooks.log" +if command -v stat > /dev/null 2>&1; then + mode_hlog="$(stat -c '%a' "$HLOG" 2>/dev/null || stat -f '%Lp' "$HLOG")" + [ "$mode_hlog" = "600" ] || fail "default hook log mode is $mode_hlog, expected 600" +fi +grep -Eq '^=== [0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z probe\.event$' "$HLOG" \ + || fail "log header is not a UTC ISO-8601 timestamp: $(head -1 "$HLOG")" +grep -q '^COYOTE_EVENT=probe.event$' "$HLOG" \ + || fail "log snapshot is missing COYOTE_EVENT" +! grep -q 'hunter2' "$HLOG" \ + || fail "COYOTE_SECRET_* value leaked into the hook log" + +# H2: with XDG_STATE_HOME also unset, the log falls back to +# $HOME/.local/state/coyote/hooks.log. +HOME_H="$WORKDIR/h-home" +mkdir -p "$HOME_H" +env -u COYOTE_HOOK_LOG -u XDG_STATE_HOME HOME="$HOME_H" COYOTE_EVENT=probe.event \ + bash "$LOG_SCRIPT" || fail "log-events.sh exited non-zero on the HOME default path" +[ -f "$HOME_H/.local/state/coyote/hooks.log" ] \ + || fail "log-events.sh did not fall back to ~/.local/state/coyote/hooks.log" + +# H3: a symlink planted at the DEFAULT log path is refused — exit 0, target +# untouched (the hardening must hold on the new default location too). +HOME_S="$WORKDIR/h-sym" +mkdir -p "$HOME_S/.local/state/coyote" +VICTIM_H="$WORKDIR/h-victim.txt" +echo "untouched" > "$VICTIM_H" +ln -s "$VICTIM_H" "$HOME_S/.local/state/coyote/hooks.log" +env -u COYOTE_HOOK_LOG -u XDG_STATE_HOME HOME="$HOME_S" COYOTE_EVENT=probe.event \ + bash "$LOG_SCRIPT" || fail "log-events.sh exited non-zero when refusing a symlink" +[ "$(cat "$VICTIM_H")" = "untouched" ] \ + || fail "log-events.sh wrote through a symlink planted at the default log path" + +# H4: notify.sh with no notifier on PATH and no controlling terminal falls +# back to stdout with control bytes (ESC/BEL, i.e. ANSI + OSC) stripped from +# model-influenced values. +BIN_H="$WORKDIR/h-bin" +mkdir -p "$BIN_H" +ln -s "$(command -v tr)" "$BIN_H/tr" +NOTIFY_OUT="$WORKDIR/h-notify.out" +rc_h=0 +setsid -w env -i PATH="$BIN_H" \ + COYOTE_EVENT=turn.completed \ + COYOTE_TOOL_NAME="$(printf 'evil\033]0;own\007\033[31mred')" \ + "$(command -v bash)" "$NOTIFY_SCRIPT" > "$NOTIFY_OUT" 2> /dev/null || rc_h=$? +[ "$rc_h" = "0" ] || fail "notify.sh fallback exited $rc_h" +grep -Fq '[coyote] turn.completed tool=evil]0;own[31mred' "$NOTIFY_OUT" \ + || fail "notify.sh fallback output missing/unsanitized: $(cat "$NOTIFY_OUT")" +! LC_ALL=C grep -q "$(printf '\033')" "$NOTIFY_OUT" \ + || fail "ANSI/OSC escape bytes leaked through the notify.sh tty fallback" +echo "PASS: installed hook scripts honor XDG default, 0600, UTC timestamps, symlink refusal, secret filter, and ANSI-stripped notify fallback" + echo echo "ALL SCENARIOS PASSED"