fix: restrict project config write sinks

Author: thymikee

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-- Security: repository `./agent-device.json` now accepts only project-safe automation defaults. It rejects daemon endpoint/auth/transport/server settings, tenant/run/lease selectors, provider/cloud and Metro connection fields, headers, and other operator-controlled values before any daemon health or RPC request. Put remote endpoint and token together in protected CI environment variables, user config, an explicit `--config` file, or the existing `connect`/`--remote-config` workflow. Daemon auth tokens no longer travel in serialized command flags.
+- Security: repository `./agent-device.json` now accepts only project-safe automation defaults. It rejects daemon endpoint/auth/transport/server settings, tenant/run/lease selectors, provider/cloud and Metro connection fields, headers, executable reporter modules, local write destinations, and other operator-controlled values before local module loading or any daemon health/RPC request. Put remote endpoint and token together in protected CI environment variables, user config, an explicit `--config` file, or the existing `connect`/`--remote-config` workflow. Daemon auth tokens no longer travel in serialized command flags.
 - `viewport` is now rejected during capability admission on Apple targets instead of reaching the device and failing inside dispatch. No Apple backend can resize a screen — simulator and device geometry is fixed by the selected device type — so `viewport` on iOS/iPadOS/tvOS/macOS now fails with `UNSUPPORTED_OPERATION`, `viewport is not supported on this device`, and a hint pointing at `--platform web` and at picking a different simulator. `capabilities` no longer advertises `viewport` on Apple targets. Web viewport resizing (`agent-device viewport 1280 900 --platform web`) is unchanged, and Android was already denied.
 - `--save-script` is now accepted only by the commands that declare it — `open`, `close`, and `replay`. A hand-built daemon request (or a `batch` step) that set `saveScript` on any other command, such as `record` or `trace`, used to arm script publication and could write a `.ad` artifact; it is now rejected with `INVALID_ARGS` before the request reaches admission, the device, or any handler. CLI, Node, and MCP usage of `--save-script` on its documented commands is unchanged.
 - `diff screenshot` no longer runs the retired best-effort OCR and non-text analyzers. Their optional `ocr` and `nonTextDeltas` fields remain in the result type for source compatibility but are no longer emitted; use the baseline/current images and diff artifact with vision for qualitative interpretation.

src/__tests__/cli-config-trust.test.ts

@@ -82,6 +82,74 @@ test.each([
   },
 );
 
+test('project config rejects a custom reporter before importing repository code or dispatching', async () => {
+  const { root, home, project } = makeTempWorkspace();
+  const importMarker = path.join(project, 'reporter-imported');
+  fs.writeFileSync(
+    path.join(project, 'project-reporter.mjs'),
+    [
+      "import fs from 'node:fs';",
+      `fs.writeFileSync(${JSON.stringify(importMarker)}, 'imported', 'utf8');`,
+      "export default { name: 'project-controlled-reporter' };",
+    ].join('\n'),
+    'utf8',
+  );
+  fs.writeFileSync(
+    path.join(project, 'agent-device.json'),
+    JSON.stringify({ reporter: ['./project-reporter.mjs'] }),
+    'utf8',
+  );
+
+  const result = await runCliCapture(['test', './suite'], {
+    cwd: project,
+    env: { HOME: home },
+  });
+
+  assert.equal(result.code, 1);
+  assert.equal(result.calls.length, 0);
+  assert.equal(fs.existsSync(importMarker), false);
+  assert.match(`${result.stdout}\n${result.stderr}`, /reporter/);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /project-reporter\.mjs/);
+
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test.each([
+  ['reportJunit', './project.junit.xml', ['test', './suite']],
+  ['saveScript', './project.ad', ['open', 'Demo']],
+  ['launchConsole', './project.console.log', ['open', 'Demo']],
+] as const)(
+  'project config rejects local write sink %s before dispatch or file creation',
+  async (key, value, argv) => {
+    const { root, home, project } = makeTempWorkspace();
+    const dispatchMarker = path.join(project, 'daemon-dispatched');
+    const outputPath = path.join(project, value);
+    fs.writeFileSync(
+      path.join(project, 'agent-device.json'),
+      JSON.stringify({ [key]: value }),
+      'utf8',
+    );
+
+    const result = await runCliCapture([...argv], {
+      cwd: project,
+      env: { HOME: home },
+      sendToDaemon: async () => {
+        fs.writeFileSync(dispatchMarker, 'dispatched', 'utf8');
+        return { ok: true, data: {} };
+      },
+    });
+
+    assert.equal(result.code, 1);
+    assert.equal(result.calls.length, 0);
+    assert.equal(fs.existsSync(dispatchMarker), false);
+    assert.equal(fs.existsSync(outputPath), false);
+    assert.match(`${result.stdout}\n${result.stderr}`, new RegExp(key));
+    assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, new RegExp(path.basename(value)));
+
+    fs.rmSync(root, { recursive: true, force: true });
+  },
+);
+
 test('project config cannot pair an endpoint with an environment token', async () => {
   const { root, home, project } = makeTempWorkspace();
   fs.writeFileSync(

src/cli-schema/cli-config.ts

@@ -42,7 +42,6 @@ const PROJECT_CONFIG_FLAG_KEYS = new Set<FlagKey>([
   'session',
   'sessionLock',
   'activity',
-  'launchConsole',
   'launchArgs',
   'launchUrl',
   'remote',
@@ -60,7 +59,6 @@ const PROJECT_CONFIG_FLAG_KEYS = new Set<FlagKey>([
   'noRecord',
   'record',
   'recordAs',
-  'saveScript',
   'snapshotInteractiveOnly',
   'snapshotDiff',
   'snapshotDepth',
@@ -116,8 +114,6 @@ const PROJECT_CONFIG_FLAG_KEYS = new Set<FlagKey>([
   'batchMaxSteps',
   'retainPaths',
   'retentionMs',
-  'reporter',
-  'reportJunit',
   'shardAll',
   'shardSplit',
   'noLogin',

website/docs/docs/configuration.md

@@ -85,8 +85,9 @@ user- or explicit-config only:
 - provider/cloud fields (`provider*`, `aws*`)
 - Metro endpoint/token fields (`metro*`, `bundleUrl`)
 - request headers and structured install sources
+- local code and write destinations (`reporter`, `reportJunit`, `saveScript`, `launchConsole`)
 
-Project config can use project-safe command defaults such as `snapshotDepth`, `snapshotScope`, `activity`, `relaunch`, `shutdown`, `fps`, `quality`, and `saveScript`. `stepsFile` is user- or explicit-config only because it selects a local file.
+Project config can use project-safe command defaults such as `snapshotDepth`, `snapshotScope`, `activity`, `relaunch`, `shutdown`, `fps`, and `quality`. Local path and executable-module selectors such as `stepsFile` and `reporter` are user- or explicit-config only.
 
 `install-from-source` can read a structured GitHub Actions artifact source from user or explicit config when a compatible remote daemon resolves CI artifacts server-side. Repository config rejects this operator-controlled source: