Add allowlisted script-based metadata adapters #93

Merged

lost-rob0t merged 3 commits from agent/issue-34-script-adapters into main

2026-08-30 04:51:26 +00:00

lost-rob0t commented

2026-08-30 04:45:40 +00:00

(Migrated from github.com)

Closes #34.

RAGE transaction for allowlisted script-based metadata adapters. Starting main: the #33 squash merge.

closed typed config: absolute script path, fixed argument template, bounded timeout/output, schema version, optional SHA-256 pin, environment allowlist;
eager fail-closed validation before every run: regular file, no symlink, current owner, owner-only permissions, pin enforcement (changed scripts disabled until re-approved);
no shell, no interpolation: strict argv via create_subprocess_exec; captured desktop values cannot enter the command line (spied argv assertions);
fresh private working directory, stdin closed, stderr discarded, timeout/output-limit kill;
strict versioned JSON output schema with closed keys and bounded values; sanitized ScriptAdapterFailure for everything else; provenance via adapter name + digest-derived revision so downstream redaction/policy handling treats script output identically to other metadata sources; failures degrade to other sources and never expand capture permissions (policy stays deny-by-default for sensitive contexts);
security tests: group/other-writable, symlink, pin mismatch, malformed/oversized/wrong-version JSON, timeout kill, output-limit kill, fixed argv, hostile environment exclusion with allowlist passthrough, sanitized cwd;
docs: docs/script-adapters.md; RAGE: rage/issue-34-script-adapters.org.

Acceptance evidence (exact head c8f911b): all five acceptance bullets covered by the test list above. Canonical ./scripts/check: 930 tests passed, 8 failure modes verified, Bandit clean, strict Pyright clean, CI 4/4 jobs green on exact head.

Closes #34. RAGE transaction for allowlisted script-based metadata adapters. Starting main: the #33 squash merge. - closed typed config: absolute script path, fixed argument template, bounded timeout/output, schema version, optional SHA-256 pin, environment allowlist; - eager fail-closed validation before every run: regular file, no symlink, current owner, owner-only permissions, pin enforcement (changed scripts disabled until re-approved); - no shell, no interpolation: strict argv via create_subprocess_exec; captured desktop values cannot enter the command line (spied argv assertions); - fresh private working directory, stdin closed, stderr discarded, timeout/output-limit kill; - strict versioned JSON output schema with closed keys and bounded values; sanitized ScriptAdapterFailure for everything else; provenance via adapter name + digest-derived revision so downstream redaction/policy handling treats script output identically to other metadata sources; failures degrade to other sources and never expand capture permissions (policy stays deny-by-default for sensitive contexts); - security tests: group/other-writable, symlink, pin mismatch, malformed/oversized/wrong-version JSON, timeout kill, output-limit kill, fixed argv, hostile environment exclusion with allowlist passthrough, sanitized cwd; - docs: `docs/script-adapters.md`; RAGE: `rage/issue-34-script-adapters.org`. Acceptance evidence (exact head `c8f911b`): all five acceptance bullets covered by the test list above. Canonical `./scripts/check`: 930 tests passed, 8 failure modes verified, Bandit clean, strict Pyright clean, CI 4/4 jobs green on exact head.