Merge pull request #2808 from fullsend-ai/agent/2806-host-files-url-resolution

fix(#2806): resolve host_files relative src paths for URL bases

Author: ggallen

internal/harness/compose.go

@@ -216,6 +216,15 @@ func loadBaseChain(
 		}
 		deps = append(deps, resourceDeps...)
 
+		// host_files with relative src paths need the same fetch-cache-rewrite
+		// treatment as scripts and resources. Entries using ${VAR} expansion
+		// are left unchanged — they resolve at bootstrap time on the host.
+		hostFileDeps, err := resolveBaseHostFiles(ctx, base, baseRef, allowlist, opts)
+		if err != nil {
+			return nil, nil, fmt.Errorf("resolving base host_files from %s: %w", cleanURL, err)
+		}
+		deps = append(deps, hostFileDeps...)
+
 		baseDir = childDir
 	} else {
 		// Local path base
@@ -664,6 +673,41 @@ func resolveBaseResources(ctx context.Context, base *Harness, baseURL string, al
 	return deps, nil
 }
 
+// resolveBaseHostFiles fetches host_files with relative src paths from a
+// URL-referenced base harness. For each host_files entry whose src is a
+// non-empty relative path (not a ${VAR} reference, URL, or absolute path),
+// the file is fetched from the base URL's directory, cached content-addressed,
+// and the src field is rewritten to the local cache path. This ensures
+// host_files inherited through base: composition resolve correctly at sandbox
+// setup time, the same way scripts and resources do.
+func resolveBaseHostFiles(ctx context.Context, base *Harness, baseURL string, allowlist []string, opts ComposeOpts) ([]Dependency, error) {
+	baseURLDir := urlParentDirPrefix(baseURL)
+	if baseURLDir == "" {
+		return nil, fmt.Errorf("cannot determine directory from base URL")
+	}
+
+	var deps []Dependency
+
+	for i := range base.HostFiles {
+		src := base.HostFiles[i].Src
+		if src == "" || strings.Contains(src, "${") || IsURL(src) || filepath.IsAbs(src) {
+			continue
+		}
+		fieldName := fmt.Sprintf("host_files[%d].src", i)
+		if err := validateBaseRelPath(fieldName, src); err != nil {
+			return nil, err
+		}
+		dep, cachePath, err := fetchBaseFile(ctx, fieldName, baseURLDir, src, allowlist, opts, "resource", false)
+		if err != nil {
+			return nil, err
+		}
+		base.HostFiles[i].Src = cachePath
+		deps = append(deps, dep)
+	}
+
+	return deps, nil
+}
+
 // validateBaseRelPath validates that a relative path inherited from a URL base
 // is safe to resolve. Rejects null bytes, query/fragment markers, URLs,
 // absolute paths, and path traversal segments.

internal/harness/compose_test.go

@@ -2929,3 +2929,198 @@ func TestFetchBaseSkill_ForgeClient_NarrowAllowlist(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "not in allowed_remote_resources")
 }
+
+// --- resolveBaseHostFiles tests ---
+
+func TestLoadWithBase_URLBase_HostFilesFetched(t *testing.T) {
+	envContent := []byte("GCP_PROJECT=test-project\n")
+	triageEnv := []byte("TRIAGE_MODE=auto\n")
+
+	baseContent := []byte(`
+agent: agents/triage.md
+role: test
+host_files:
+  - src: env/gcp-vertex.env
+    dest: /sandbox/workspace/.env.d/gcp-vertex.env
+    expand: true
+  - src: env/triage.env
+    dest: /sandbox/workspace/.env.d/triage.env
+    expand: true
+`)
+
+	server, policy := setupScriptTestServer(t, baseContent, map[string][]byte{
+		"/env/gcp-vertex.env": envContent,
+		"/env/triage.env":     triageEnv,
+	})
+
+	hash := computeHash(baseContent)
+	dir := t.TempDir()
+	cacheDir := filepath.Join(dir, "cache")
+
+	baseURL := server.URL + "/harness/triage.yaml#sha256=" + hash
+
+	path := writeTestHarness(t, dir, "child.yaml", `
+role: test
+base: `+baseURL+`
+`)
+
+	h, deps, err := LoadWithBase(context.Background(), path, ComposeOpts{
+		WorkspaceRoot: cacheDir,
+		FetchPolicy:   policy,
+		OrgAllowlist:  []string{server.URL + "/"},
+	})
+	require.NoError(t, err)
+
+	// Host files resolved to local cache paths
+	require.Len(t, h.HostFiles, 2)
+	for i, hf := range h.HostFiles {
+		assert.True(t, filepath.IsAbs(hf.Src), "host_files[%d].src should be absolute cache path", i)
+		assert.False(t, IsURL(hf.Src), "host_files[%d].src should not be a URL", i)
+	}
+
+	// Verify cached content
+	content0, err := os.ReadFile(h.HostFiles[0].Src)
+	require.NoError(t, err)
+	assert.Equal(t, envContent, content0)
+
+	content1, err := os.ReadFile(h.HostFiles[1].Src)
+	require.NoError(t, err)
+	assert.Equal(t, triageEnv, content1)
+
+	// Dest and expand preserved
+	assert.Equal(t, "/sandbox/workspace/.env.d/gcp-vertex.env", h.HostFiles[0].Dest)
+	assert.True(t, h.HostFiles[0].Expand)
+
+	// Dependencies include host_files
+	hostFileDeps := []Dependency{}
+	for _, d := range deps {
+		if strings.HasPrefix(d.Field, "host_files[") {
+			hostFileDeps = append(hostFileDeps, d)
+		}
+	}
+	assert.Len(t, hostFileDeps, 2)
+	for _, d := range hostFileDeps {
+		assert.Equal(t, "resource", d.Type)
+	}
+}
+
+func TestLoadWithBase_URLBase_HostFilesMixedEnvVarAndRelative(t *testing.T) {
+	envContent := []byte("KEY=value\n")
+
+	baseContent := []byte(`
+agent: agents/triage.md
+role: test
+host_files:
+  - src: env/app.env
+    dest: /sandbox/.env.d/app.env
+  - src: ${GOOGLE_APPLICATION_CREDENTIALS}
+    dest: /tmp/.gcp-credentials.json
+`)
+
+	server, policy := setupScriptTestServer(t, baseContent, map[string][]byte{
+		"/env/app.env": envContent,
+	})
+
+	hash := computeHash(baseContent)
+	dir := t.TempDir()
+	cacheDir := filepath.Join(dir, "cache")
+
+	baseURL := server.URL + "/harness/triage.yaml#sha256=" + hash
+
+	path := writeTestHarness(t, dir, "child.yaml", `
+role: test
+base: `+baseURL+`
+`)
+
+	h, _, err := LoadWithBase(context.Background(), path, ComposeOpts{
+		WorkspaceRoot: cacheDir,
+		FetchPolicy:   policy,
+		OrgAllowlist:  []string{server.URL + "/"},
+	})
+	require.NoError(t, err)
+
+	require.Len(t, h.HostFiles, 2)
+
+	// Relative src resolved to cache path
+	assert.True(t, filepath.IsAbs(h.HostFiles[0].Src), "relative src should be resolved")
+
+	// ${VAR} src left unchanged
+	assert.Equal(t, "${GOOGLE_APPLICATION_CREDENTIALS}", h.HostFiles[1].Src)
+}
+
+func TestResolveBaseHostFiles_SkipsEnvVarPaths(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "${HOME}/file.txt", Dest: "/sandbox/file.txt"},
+		},
+	}
+	deps, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.NoError(t, err)
+	assert.Empty(t, deps)
+	assert.Equal(t, "${HOME}/file.txt", base.HostFiles[0].Src)
+}
+
+func TestResolveBaseHostFiles_SkipsAbsolutePaths(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "/absolute/path/file.txt", Dest: "/sandbox/file.txt"},
+		},
+	}
+	deps, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.NoError(t, err)
+	assert.Empty(t, deps)
+	assert.Equal(t, "/absolute/path/file.txt", base.HostFiles[0].Src)
+}
+
+func TestResolveBaseHostFiles_SkipsEmptySrc(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "", Dest: "/sandbox/file.txt"},
+		},
+	}
+	deps, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.NoError(t, err)
+	assert.Empty(t, deps)
+}
+
+func TestResolveBaseHostFiles_RejectsPathTraversal(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "../../etc/passwd", Dest: "/sandbox/passwd"},
+		},
+	}
+	_, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "must not contain path traversal")
+	assert.Contains(t, err.Error(), "host_files[0].src")
+}
+
+func TestResolveBaseHostFiles_RejectsNullBytes(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "env/test\x00.env", Dest: "/sandbox/.env"},
+		},
+	}
+	_, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "must not contain null bytes")
+	assert.Contains(t, err.Error(), "host_files[0].src")
+}
+
+func TestResolveBaseHostFiles_InvalidBaseURL(t *testing.T) {
+	base := &Harness{
+		HostFiles: []HostFile{
+			{Src: "env/test.env", Dest: "/sandbox/.env"},
+		},
+	}
+	_, err := resolveBaseHostFiles(context.Background(), base, "", nil, ComposeOpts{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot determine directory")
+}
+
+func TestResolveBaseHostFiles_EmptyHostFiles(t *testing.T) {
+	base := &Harness{}
+	deps, err := resolveBaseHostFiles(context.Background(), base, "https://example.com/harness/triage.yaml#sha256=abc", nil, ComposeOpts{})
+	require.NoError(t, err)
+	assert.Empty(t, deps)
+}