fix(workflows): contain tool-package entry resolution via realpath + npm-name gate

Realpath containment mirrors vendor workflow-definition-loader: rejects interchange.tools escapes through file or directory symlinks. Gate dep names with ToolPackagePinName so keys like ../../evil cannot escape node_modules. Adds 3 regression tests.

Author: TheGreatAxios

src/workflows/tool-packages.test.ts

@@ -170,6 +170,56 @@ describe("resolveWorkflowToolPackages", () => {
     ).rejects.toThrow(/escapes its directory/);
   });
 
+  test("rejects an interchange.tools entry that escapes via a file symlink", async () => {
+    const workflowDir = await makeWorkflow(root, {
+      [TOOL_NAME]: "workspace:*",
+    });
+    const toolDir = await layOutTool(workflowDir, {
+      name: TOOL_NAME,
+      version: "1.2.3",
+      interchange: { tools: "./dist/tools.js" },
+    });
+    const outside = join(root, "evil.js");
+    await writeFile(outside, "export const tools = [];\n");
+    await rm(join(toolDir, "dist", "tools.js"));
+    await symlink(outside, join(toolDir, "dist", "tools.js"));
+    await expect(
+      resolveWorkflowToolPackages(workflowDir, [TOOL_NAME]),
+    ).rejects.toThrow(/escapes its directory via a symlink/);
+  });
+
+  test("rejects an interchange.tools entry that escapes via a directory symlink", async () => {
+    const workflowDir = await makeWorkflow(root, {
+      [TOOL_NAME]: "workspace:*",
+    });
+    const outsideDir = join(root, "evil-dir");
+    await mkdir(outsideDir, { recursive: true });
+    await writeFile(
+      join(outsideDir, "tools.js"),
+      "export const tools = [];\n",
+    );
+    const toolDir = join(workflowDir, "node_modules", TOOL_NAME);
+    await mkdir(toolDir, { recursive: true });
+    await writeJSON(join(toolDir, "package.json"), {
+      name: TOOL_NAME,
+      version: "1.2.3",
+      interchange: { tools: "./linked/tools.js" },
+    });
+    await symlink(outsideDir, join(toolDir, "linked"));
+    await expect(
+      resolveWorkflowToolPackages(workflowDir, [TOOL_NAME]),
+    ).rejects.toThrow(/escapes its directory via a symlink/);
+  });
+
+  test("rejects a tool package name that is not a valid npm package name", async () => {
+    const workflowDir = await makeWorkflow(root, {
+      [TOOL_NAME]: "workspace:*",
+    });
+    await expect(
+      resolveWorkflowToolPackages(workflowDir, ["../../evil"]),
+    ).rejects.toThrow(/not a valid npm package name/);
+  });
+
   test("rejects a resolved directory whose package.json names another package", async () => {
     const workflowDir = await makeWorkflow(root, {
       [TOOL_NAME]: "workspace:*",

src/workflows/tool-packages.ts

@@ -1,8 +1,9 @@
 import { readFile, realpath } from "node:fs/promises";
-import { join } from "node:path";
+import { join, sep } from "node:path";
 import { ArkErrors, type } from "arktype";
 
 import { isContainedEntryPath, PackageJSON } from "@intx/types/package-json";
+import { ToolPackagePinName } from "@intx/types/tool-packages";
 
 // A workflow package declares the tool packages its steps need as npm
 // dependencies (CL-4473). Resolution reads the laid-out `node_modules/` tree,
@@ -52,6 +53,15 @@ async function resolveOne(
   declared: ReadonlySet<string>,
   name: string,
 ): Promise<WorkflowToolPackage> {
+  // A declared dep key is joined onto `node_modules/` below, so the name must
+  // satisfy npm's package-name rules first — otherwise a key like
+  // `../../evil` resolves outside the workflow package. Same rule the hub
+  // enforces on tool-package pins (`ToolPackagePinName`).
+  if (ToolPackagePinName(name) instanceof ArkErrors) {
+    throw new Error(
+      `tool package ${JSON.stringify(name)} is not a valid npm package name`,
+    );
+  }
   if (!declared.has(name)) {
     throw new Error(
       `tool package ${JSON.stringify(name)} is not a dependency of the workflow package at ${workflowDir}; declare it as an npm dep`,
@@ -89,11 +99,34 @@ async function resolveOne(
       `tool package ${JSON.stringify(name)} at ${dir} declares an "interchange.tools" entry ${JSON.stringify(entryRel)} that escapes its directory`,
     );
   }
+  // Realpath containment, mirroring the vendored workflow-definition-loader:
+  // the string check above rejects `..`/absolute paths, and this check
+  // rejects an escape through a file or directory symlink inside the package.
+  // Both sides are realpath'd so the comparison holds under a symlinked
+  // parent (e.g. macOS `/tmp` -> `/private/tmp`).
+  const entryAbs = join(dir, entryRel);
+  let realDir: string;
+  let realEntry: string;
+  try {
+    realDir = await realpath(dir);
+    realEntry = await realpath(entryAbs);
+  } catch (cause) {
+    throw new Error(
+      `tool package ${JSON.stringify(name)} at ${dir} declares an "interchange.tools" entry ${JSON.stringify(entryRel)} that could not be resolved`,
+      { cause },
+    );
+  }
+  const containmentRoot = realDir.endsWith(sep) ? realDir : realDir + sep;
+  if (realEntry !== realDir && !realEntry.startsWith(containmentRoot)) {
+    throw new Error(
+      `tool package ${JSON.stringify(name)} at ${dir} declares an "interchange.tools" entry ${JSON.stringify(entryRel)} that escapes its directory via a symlink`,
+    );
+  }
   return {
     name,
     version: parsed.version,
     dir,
-    toolsEntry: join(dir, entryRel),
+    toolsEntry: entryAbs,
   };
 }