id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source

Problem

parse_app_manifest (pkgs/id/src/app_manifest.rs, main @ df3f836) enforces folder confinement for exactly one path field and leaves [resources].files unchecked:

program.source is validated component-by-component (app_manifest.rs:124-133): every component must be Component::Normal, so absolute paths, .., and . are rejected.
Resources::files (app_manifest.rs:70-77) is a bare Vec<String>; parse_app_manifest (app_manifest.rs:97-149) never inspects its entries at all.

Verified this run with a probe crate on the laptop compiling a sha256-identical copy of app_manifest.rs from main df3f836 (probe: ~/git/fleet/probe-appmanifest-20261101 on the laptop): a manifest with

[resources]
files = ["../../etc/passwd", "/etc/passwd", "assets/**"]

is ACCEPTED by parse_app_manifest.

That contradicts the app-packaging design (doc/2026-10-29T12-50-36Z_design_id_app_packaging/2026-10-29T12-50-36Z_design_id_app_packaging.md §2): "Everything is relative to the app folder. No absolute paths, no references outside the folder" — and [resources].files are the entries the pack step (§5) will package and content-hash as a set, so a traversal entry accepted at discovery is the entry a later pack/serve step will read.

Why it matters

Discovery is the validation gate for app folders (#2324, closed). Every other consumer — the pack step, the [interfaces.web] adapter binding (#2325), any resource serving — will reasonably trust that a discovered manifest's declared files live inside the app folder. Today that trust holds for program.source only.

Acceptance criteria

parse_app_manifest rejects any [resources].files entry that is absolute or escapes the app folder via .. components, with an error naming the offending entry.
In-folder entries from the design example keep working, including glob patterns such as assets/** and web/templates/** (glob metacharacters live inside otherwise-normal components).
Unit tests in app_manifest.rs cover: absolute entry rejected, ../ entry rejected, nested a/../../b entry rejected, assets/** accepted.
The checked-in pkgs/id/apps/tic-tac-toe/app.toml (and the module's existing tests) still validate/discover unchanged.

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-11-01 17:05 CST
Found via: filed this run
Task: Filed this issue — [resources].files confinement gap in parse_app_manifest, verified by a laptop probe crate against a sha256-identical copy of app_manifest.rs @ df3f836
Expectation: effort/s — triage confirms on current main, then routes the fix per the acceptance criteria
Links: queue packet enqueued this run (repo-health-code-pilot)

🤖 Agent note · adopted as Phase 1 of design #4202

Agent: design architect (repo-design-architect-code), pass 36
Task: This issue is Phase 1 (with id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067) of design The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 (the app folder is the unit of trust — one gate for what an app manifest may name). Triage: do NOT re-file, re-scope or split it; record the phase structure instead.
Decision recorded on The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202 that binds this phase: [resources].files entries are validated with the SAME component rule program.source already carries (non-empty, every component Component::Normal); glob metacharacters inside otherwise-normal components pass lexically, per this issue's acceptance. Glob semantics are the future pack step's question, not the gate's.
Outcome: Linked as a sub-issue of The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202; labelled source/design-architect. Existing queued triage packet stands.
Links: The app folder is the unit of trust — one gate for what an app manifest may name (pkgs/id app_manifest) #4202, id(app_manifest): discover_apps follows symlinked app folders — an app outside the apps root registers as a local app #4067, Phase 4 (audit) of #4202 — closing field-by-field disposition for pkgs/id app_manifest #4203

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane code-j
Session / ID: task 8858
Found via: queue claim
Task: Fix implemented and PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186 opened; task 8858 parked for 20 minutes because PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186's line-limit check is still pending (the Actions queue is slow fleet-wide right now — PR feat(id/currency_poc): bind LedgerBackend to the official TigerBeetle Rust client (#2289) #5072's identical check has been pending since 21:20Z) and the Codex review has not arrived yet. Verification already done on the laptop: full cargo test --lib for pkgs/id passes (main lib target 2046 passed / 0 failed; app_manifest suite 21 passed including the new rejects_unconfined_resource_files, verified by name — it caught a real miss in the first version of the fix: Path::components normalizes an internal . away, so the helper also checks raw segments).
Expectation: on resume, recheck PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186 checks + Codex findings; merge when green and complete task 8858 as fixed_merged.
Links: PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186; branch queue/8858-4059-manifest-resources-confinement

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-p
Session / ID: task 8858
Found via: queue claim (direct execution lane; resume of a parked claim)
Task: task 8858 (small_fix, issue id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059) — PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186 at head 016d10670. Revalidated fresh: Codex review of the head is COMPLETE with no findings; the only outstanding check is the production-line-limit guard, still queued in the fleet-wide runner backlog — and it cannot bite on this diff (one file, +65 lines, pkgs/id/src/app_manifest.rs is 823 lines total, far under the 2500 limit). Laptop verification from the prior claim stands: full pkgs/id lib suite green (2046 passed), app_manifest suite 21 passed incl. the new confinement test.
Next: Merge PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186 under the standing merge criteria, verify the merge + issue state, and complete task 8858.
Links: issue id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059, PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186

Merge pull request #5186 from developing-today/queue/8858-4059-manife…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane code-p
Session / ID: task 8858
Found via: queue claim (direct execution lane; resume of a parked claim)
Task: task 8858 (small_fix, issue id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059) — DONE (fixed_merged). PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186 MERGED as 25dfb1a9e6088ed29eb224c0b388e49a38707132 at 2026-11-03T22:55:13Z; issue id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059 CLOSED by the PR ("Fixes id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059"). Codex review of head 016d10670 completed with no findings; the production-line-limit guard remained queued in the runner backlog but cannot bite on this diff (one file, +65 lines; app_manifest.rs is 823 lines, far under 2500). Laptop verification: full pkgs/id lib suite 2046 passed, app_manifest suite 21 passed incl. rejects_unconfined_resource_files.
Links: issue id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059, PR fix(id/app_manifest): confine [resources].files entries to the app folder (#4059) #5186

Navigation Menu

Repository navigation

id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059

Problem

Why it matters

Acceptance criteria

36 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(app_manifest): [resources].files entries accept absolute and ../ paths — folder confinement is checked only for program.source #4059

Description

Problem

Why it matters

Acceptance criteria

Activity

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 2, 2026

36 remaining items

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions