kaizen: provider registry の実体パスを canonical workspace 内に制限しました。 (#206)

[s-hiraoku]

Closes #206

元Issue

#206: [scout] Constrain provider registry paths to workspace

Summary

Constrain KAIZEN_AGENT_PROVIDERS_FILE so custom provider registries used by Builder Agent resolve inside KAIZEN_WORKSPACE_DIR, matching the workspace containment posture already used for KAIZEN_BUILD_RESULT_PATH.

Target repository and affected paths

Target repository: kaizen-agents-org/builder-agent

Affected paths or components:

• src/agents/AgentRunner.ts, readProviderFile()
  …

Builder task understanding

provider registry の実体パスを canonical workspace 内に制限しました。
外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。

Builder notes

書き込み可能な一時 npm cache を指定し、check:dist、全121テスト（116成功、環境依存5 skip）、validate:json、共有スキル存在確認が成功しました。protected path の変更はありません。

Provider evidence:

• codex: exitCode=0, status=selected, failureClass=none, fallbackReason=none, payloadSource=last-message, truncatedOutput=none
  Selected backend: codex
  Final payload source: last-message

変更ファイル

• README.md — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。
• dist/agents/AgentRunner.d.ts.map — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。
• dist/agents/AgentRunner.js — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。
• dist/build-info.json — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。
• src/agents/AgentRunner.ts — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。
• test/agents/AgentRunner.test.ts — provider registry の実体パスを canonical workspace 内に制限しました。
  外部絶対パスと symlink escape の回帰テストを追加し、README と生成済み dist を更新しました。

Changed files: 6 / Changed lines: 99

Verification

• npm run check:dist — 成功
• npm test — 成功
• npm run validate:json — 成功
• test -f skills/gh-link-issue-pr/SKILL.md && test -f skills/kaizen-bug-router/SKILL.md && test -f skills/pr-guardian/SKILL.md — 成功

Verifier verdict

verifier: open_pr_with_warning
summary: Open PR with warning and 1 should_fix item(s); risk is medium.
evidence: reported (未実行の可能性あり)
should_fix: [builder_report] Verification output contains a non-blocking risk signal. — evidence: 書き込み可能な一時 npm cache を指定し、check:dist、全121テスト（116成功、環境依存5 skip）、validate:json、共有スキル存在確認が成功しました。protected path の変更はありません。
confidence: 64/100
risk: medium
notes: evidence_grade=reported
warning: この判定は実行証拠ではなくテキスト報告に基づくため、未実行の可能性があります。

Evidence strength

• reported: builder summary and builder notes come from the builder-agent self-report.
• executed: Kaizen Loop ran the verification commands listed above.
• reported: Kaizen Loop ran verifier, but verifier evidence is based on text reporting rather than execution proof.
• static: changed file and line counts come from git diff metadata.

残存リスク / レビュー観点

Verifier cleared PR with warning: Open PR with warning and 1 should_fix item(s); risk is medium.
should_fix: [builder_report] Verification output contains a non-blocking risk signal. — evidence: 書き込み可能な一時 npm cache を指定し、check:dist、全121テスト（116成功、環境依存5 skip）、validate:json、共有スキル存在確認が成功しました。protected path の変更はありません。
confidence: 64/100
risk: medium

Summary by CodeRabbit

• Bug Fixes

  • Provider configuration files are now restricted to paths within the configured workspace, including paths that escape through symlinks.
  • Invalid external provider-file paths are rejected before being read.

• Documentation

  • Clarified the workspace path requirements for provider configuration files.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: kaizen-agents-org/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6dc99e34-af61-4d30-813b-c4bfe1f4c6c1

📥 Commits

Reviewing files that changed from the base of the PR and between ac95057 and 4161820.

⛔ Files ignored due to path filters (3)

• dist/agents/AgentRunner.d.ts.map is excluded by !**/dist/**, !**/*.map
• dist/agents/AgentRunner.js is excluded by !**/dist/**
• dist/build-info.json is excluded by !**/dist/**

📒 Files selected for processing (3)

• README.md
• src/agents/AgentRunner.ts
• test/agents/AgentRunner.test.ts

---

📝 Walkthrough

Walkthrough

readProviderFile now canonicalizes provider paths and rejects paths outside KAIZEN_WORKSPACE_DIR, including symlink escapes. Documentation and tests describe and verify the workspace containment rule.

Changes

Provider registry path confinement

Layer / File(s)	Summary
Canonical provider path validation src/agents/AgentRunner.ts, README.md	readProviderFile resolves canonical workspace and provider paths, rejects paths outside the workspace, and reads the canonical path. The README documents symlink-aware containment.
Provider path regression coverage test/agents/AgentRunner.test.ts	Tests cover workspace-relative loading and rejection of absolute paths and symlink paths that resolve outside the workspace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• kaizen-agents-org/kaizen-loop#1: Hardens provider path handling with workspace and symlink validation.
• kaizen-agents-org/builder-agent#30: Relates to workspace-relative KAIZEN_AGENT_PROVIDERS_FILE loading.
• kaizen-agents-org/verifier#173: Applies similar workspace-boundary and symlink validation to verifier result paths.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states that provider registry paths are restricted to the canonical workspace.
Linked Issues check	✅ Passed	The changes implement workspace and symlink containment, preserve valid paths, add regression tests, and update the README as required by issue #206.
Out of Scope Changes check	✅ Passed	The reviewed source, test, and documentation changes directly support issue #206 and show no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kaizen/issue-206-scout-constrain-provider-registry-paths-to-works

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[s-hiraoku]

PR Guardian pass 1/5 final report

• Final observed state: MERGEABLE / CLEAN, non-draft, head 4e6db7510d2adcd141d1ad7fe8684891fac6fcf0.
• Required checks: test passed. Branch protection requires test and conversation resolution; it does not require an approval.
• Workflow watched: CI run 31073867869, completed successfully.
• Fixes pushed: none.
• Review feedback addressed: none; the paginated audit found zero review threads, inline review comments, or submitted reviews.
• PR comments: CodeRabbit could not start a review because its review limit was reached. Its status is successful and GitHub reports the PR CLEAN, so this is documented as non-actionable automation unavailability rather than a merge blocker.
• Check annotations: CI emitted a non-required Node.js 20 deprecation warning for existing actions/checkout and actions/setup-node versions. This PR does not modify .github workflows, so it was skipped as unrelated workflow maintenance.
• Remaining blockers: none observed. The guardian is completing the required stable-state rechecks before exiting.

The PR was not merged.