fix: bind flow inputs exactly

Author: bigboateng

boatstack/cmd/boatstack-helper/flow_command.go

@@ -153,6 +153,9 @@ func compileFlow(ctx context.Context, options flowCommandOptions) error {
 	writes = append(writes, boatstackruntime.ProjectionWrite{
 		Path: artifactPath, Content: artifactRaw, Mode: 0o644, ExpectedPreviousSHA256: artifactPrevious, PublishLast: true,
 	})
+	if err := rejectProjectionInputOverlap(lockPath, writes, removals); err != nil {
+		return err
+	}
 	expectations := []boatstackruntime.ProjectionExpectation{
 		{Path: source, Exists: true, ExpectedSHA256: fileDigest(sourceRaw)},
 		{Path: lockPath, Exists: true, ExpectedSHA256: fileDigest(lockRaw)},
@@ -165,6 +168,21 @@ func compileFlow(ctx context.Context, options flowCommandOptions) error {
 	return renderFlowResult("compiled", artifactPath, artifact)
 }
 
+func rejectProjectionInputOverlap(lockPath string, writes []boatstackruntime.ProjectionWrite, removals []boatstackruntime.ProjectionRemoval) error {
+	lockPath = filepath.Clean(lockPath)
+	for _, write := range writes {
+		if filepath.Clean(write.Path) == lockPath {
+			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: dependency lock is a projection output")
+		}
+	}
+	for _, removal := range removals {
+		if filepath.Clean(removal.Path) == lockPath {
+			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: dependency lock is a retired projection output")
+		}
+	}
+	return nil
+}
+
 func requireUnchangedCompileInput(path string, expected []byte) error {
 	current, err := os.ReadFile(path)
 	if err != nil || !bytes.Equal(current, expected) {

boatstack/cmd/boatstack-helper/flow_runtime.go

@@ -71,7 +71,12 @@ func bindFlowEntry(ctx context.Context, options commandOptions) (commandOptions,
 	if err != nil {
 		return commandOptions{}, err
 	}
-	runID := flowRunID(repository, compiled.Fingerprint, options.entryID, deliveryID)
+	planRaw, err := os.ReadFile(plan)
+	if err != nil {
+		return commandOptions{}, fmt.Errorf("FLOW_INPUT_REQUIRED: read selected plan: %w", err)
+	}
+	planDigest := sha256.Sum256(planRaw)
+	runID := flowRunID(repository, compiled.Fingerprint, options.entryID, deliveryID, hex.EncodeToString(planDigest[:]))
 	if options.runID != "" && options.runID != runID {
 		return commandOptions{}, fmt.Errorf("FLOW_RUN_MISMATCH: run ID does not identify the selected plan and worktree")
 	}
@@ -336,8 +341,8 @@ func findEntry(entries []controlprogram.Entry, id string) (controlprogram.Entry,
 	return controlprogram.Entry{}, false
 }
 
-func flowRunID(repository, fingerprint, entry, delivery string) string {
-	value := strings.Join([]string{repository, fingerprint, entry, delivery}, "\x00")
+func flowRunID(repository, fingerprint, entry, delivery, planFingerprint string) string {
+	value := strings.Join([]string{repository, fingerprint, entry, delivery, planFingerprint}, "\x00")
 	digest := sha256.Sum256([]byte(value))
 	return "run-" + hex.EncodeToString(digest[:16])
 }

boatstack/cmd/boatstack-helper/flow_runtime_test.go

@@ -345,6 +345,51 @@ func TestFlowCompileProjectsHyphenatedEntryIdentity(t *testing.T) {
 	}
 }
 
+func TestFlowCompileRejectsDependencyLockProjectionOverlap(t *testing.T) {
+	// control-law: compile-inputs-cannot-be-replaced-or-retired-by-their-own-projection
+	if runtime.GOOS == "windows" {
+		t.Skip("shell fixture is Unix-only")
+	}
+	repository, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	documentRaw, err := json.Marshal(productDeliveryDocument("product-delivery"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sourcePath := ".boatstack/flows/product-delivery.flow.ts"
+	artifactPath := ".boatstack/flows/product-delivery.flow.ir.json"
+	writeFixture(t, repository, ".git/keep", nil)
+	writeFixture(t, repository, sourcePath, []byte("declarative source"))
+	writeFixture(t, repository, "package-lock.json", []byte("lock"))
+	writeFixture(t, repository, "raw-ir.json", documentRaw)
+	frontend := filepath.Join(repository, "frontend.sh")
+	if err := os.WriteFile(frontend, []byte("#!/bin/sh\ncat >/dev/null\ncat '"+filepath.Join(repository, "raw-ir.json")+"'\n"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	options := flowCommandOptions{repository: repository, source: sourcePath, lock: "package-lock.json", frontend: frontend}
+	if err := compileFlow(context.Background(), options); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.ReadFile(filepath.Join(repository, filepath.FromSlash(artifactPath)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	options.lock = artifactPath
+	err = compileFlow(context.Background(), options)
+	if err == nil || !strings.Contains(err.Error(), "FLOW_COMPILE_INPUT_OVERLAP") {
+		t.Fatalf("overlapping lock result = %v", err)
+	}
+	after, err := os.ReadFile(filepath.Join(repository, filepath.FromSlash(artifactPath)))
+	if err != nil || !bytes.Equal(after, before) {
+		t.Fatalf("overlapping compile changed artifact: %v", err)
+	}
+	if err := checkFlow(context.Background(), flowCommandOptions{repository: repository}); err != nil {
+		t.Fatalf("preserved artifact no longer checks: %v", err)
+	}
+}
+
 func TestFlowCompileRefusesUnmanagedGeneratedSkill(t *testing.T) {
 	// control-law: first-compile-cannot-adopt-or-overwrite-unmanaged-skill-bytes
 	if runtime.GOOS == "windows" {
@@ -693,7 +738,6 @@ func TestFlowEntryBindsStableRunAndResumesManagedPlan(t *testing.T) {
 	}
 	writeFixture(t, repository, ".boatstack/plans/delivery-one.source", []byte("exact plan"))
 	writeFixture(t, repository, ".boatstack/plans/inbox/unrelated.md", []byte("other plan"))
-	writeFixture(t, repository, ".boatstack/plans/delivery-one.source", []byte("approved amendment"))
 	resumed, err := bindFlowEntry(context.Background(), commandOptions{
 		repository: repository, programID: "product-delivery", entryID: "run", runID: initial.runID, host: "codex",
 		deliveryID: initial.deliveryID, objectiveKind: initial.objectiveKind, objectiveID: initial.objectiveID, transitionID: "plan.create",
@@ -713,6 +757,28 @@ func TestFlowEntryBindsStableRunAndResumesManagedPlan(t *testing.T) {
 	}
 }
 
+func TestFlowEntryRejectsSelectedPlanContentSubstitution(t *testing.T) {
+	// control-law: one-flow-run-binds-the-exact-selected-plan-bytes
+	repository := flowRepository(t)
+	planPath := ".boatstack/plans/inbox/delivery-one.md"
+	writeFixture(t, repository, planPath, []byte("plan A"))
+	initial, err := bindFlowEntry(context.Background(), commandOptions{repository: repository, programID: "product-delivery", entryID: "run", host: "codex"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeFixture(t, repository, planPath, []byte("plan B"))
+	_, err = bindFlowEntry(context.Background(), commandOptions{
+		repository: repository, programID: "product-delivery", entryID: "run", runID: initial.runID, host: "codex",
+		deliveryID: initial.deliveryID, objectiveKind: initial.objectiveKind, objectiveID: initial.objectiveID, transitionID: "plan.create",
+	})
+	if err == nil || !strings.Contains(err.Error(), "FLOW_RUN_MISMATCH") {
+		t.Fatalf("plan substitution result = %v", err)
+	}
+	if _, statErr := os.Stat(filepath.Join(repository, ".boatstack", "plans", "delivery-one.source")); !os.IsNotExist(statErr) {
+		t.Fatalf("plan substitution produced a managed source: %v", statErr)
+	}
+}
+
 func TestFlowEntryPreservesSelectedPlanFilenameBeforeMaterialization(t *testing.T) {
 	// control-law: an-admitted-plan-filename-remains-resolvable-for-the-same-run
 	repository := flowRepository(t)

boatstack/controlprogram/artifact.go

@@ -61,7 +61,7 @@ func NewArtifact(compiled Compiled, input ArtifactInput) (Artifact, []byte, erro
 }
 
 func LoadArtifact(source io.Reader) (Artifact, error) {
-	raw, err := io.ReadAll(io.LimitReader(source, 32<<20))
+	raw, err := readLimited(source, 32<<20, "CONTROL_PROGRAM_ARTIFACT_INVALID: input exceeds 32 MiB")
 	if err != nil {
 		return Artifact{}, err
 	}

boatstack/controlprogram/canonical.go

@@ -21,7 +21,7 @@ type Compiled struct {
 }
 
 func Load(source io.Reader, resolver BindingResolver) (Compiled, error) {
-	raw, err := io.ReadAll(io.LimitReader(source, 16<<20))
+	raw, err := readLimited(source, 16<<20, "CONTROL_PROGRAM_INVALID: input exceeds 16 MiB")
 	if err != nil {
 		return Compiled{}, err
 	}
@@ -40,6 +40,17 @@ func Load(source io.Reader, resolver BindingResolver) (Compiled, error) {
 	return Compile(document, resolver)
 }
 
+func readLimited(source io.Reader, limit int64, oversized string) ([]byte, error) {
+	raw, err := io.ReadAll(io.LimitReader(source, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(raw)) > limit {
+		return nil, fmt.Errorf("%s", oversized)
+	}
+	return raw, nil
+}
+
 func Compile(document Document, resolver BindingResolver) (Compiled, error) {
 	if document.SchemaVersion != SchemaVersion {
 		return Compiled{}, invalid("schema_version", "unsupported schema")

boatstack/controlprogram/canonical_test.go

@@ -119,6 +119,39 @@ func TestStrictLoaderRejectsUnknownAndDuplicateFields(t *testing.T) {
 	}
 }
 
+func TestStrictLoadersRejectOversizedTrailingInput(t *testing.T) {
+	// control-law: size-limited-loaders-never-treat-truncation-as-eof
+	documentRaw, err := json.Marshal(incidentProgram())
+	if err != nil {
+		t.Fatal(err)
+	}
+	compiled, err := controlprogram.Compile(incidentProgram(), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, artifactRaw, err := controlprogram.NewArtifact(compiled, controlprogram.ArtifactInput{
+		CompilerVersion: "compiler-1", SourcePath: "flow.ts", Source: []byte("source"),
+		DependencyLockPath: "package-lock.json", DependencyLock: []byte("lock"), GeneratedSkills: map[string][]byte{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	oversized := func(raw []byte, limit int) []byte {
+		if len(raw) >= limit {
+			t.Fatalf("fixture length %d exceeds limit %d", len(raw), limit)
+		}
+		result := append([]byte(nil), raw...)
+		result = append(result, bytes.Repeat([]byte(" "), limit-len(result))...)
+		return append(result, 'x')
+	}
+	if _, err := controlprogram.Load(bytes.NewReader(oversized(documentRaw, 16<<20)), nil); err == nil || !strings.Contains(err.Error(), "exceeds 16 MiB") {
+		t.Fatalf("oversized IR result = %v", err)
+	}
+	if _, err := controlprogram.LoadArtifact(bytes.NewReader(oversized(artifactRaw, 32<<20))); err == nil || !strings.Contains(err.Error(), "exceeds 32 MiB") {
+		t.Fatalf("oversized artifact result = %v", err)
+	}
+}
+
 func TestCompilerRejectsUndeclaredEffectAndMissingRecovery(t *testing.T) {
 	for name, mutate := range map[string]func(*controlprogram.Document){
 		"undeclared-effect": func(value *controlprogram.Document) { value.Operators[0].Effects = []string{"undeclared"} },