ace-lab 0.14.1 → 0.15.1

data/lib/ace/lab/auth/session_configuration.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "error"
+require_relative "../molecules/install_manifest_loader"
+
+module Ace
+  module Lab
+    module Auth
+      # Passive launch data from the installed manifest. Roles select a brief
+      # and a project-specific environment, not an operating-system identity.
+      class SessionConfiguration
+        ROLES = %w[lab-overseer project-overseer worker verifier integrator].freeze
+        Selection = Data.define(:project, :path, :role, :instructions, :gem_home, :runtime, :environment_file)
+
+        def initialize(loader: -> { Molecules::InstallManifestLoader.load })
+          @loader = loader
+        end
+
+        def resolve(project:, role:)
+          document = @loader.call
+          raise Error, "session role is not supported" unless ROLES.include?(role)
+
+          scope = if role == "lab-overseer"
+            document["coordinator"] if document.dig("coordinator", "id") == project
+          else
+            document.fetch("projects").find { |entry| entry["id"] == project }
+          end
+          selected_role = document.fetch("roles").find { |entry| entry["id"] == role }
+          raise Error, "session project or role is not configured" unless scope && selected_role
+
+          runtime = document.fetch("session_runtime")
+          raise Error, "session Pi runtime is not configured" unless runtime.is_a?(Hash)
+
+          Selection.new(project: project, path: scope.fetch("path"), role: role,
+            instructions: selected_role.fetch("instructions"),
+            gem_home: document.fetch("gemset").fetch("gem_home"), runtime: runtime,
+            environment_file: scope.fetch("environment_files", {})[role])
+        rescue KeyError, NoMethodError
+          raise Error, "session deployment configuration is incomplete"
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/cli/commands/prepare.rb

@@ -19,7 +19,8 @@ module Ace
             "directories" => ->(item) { item["path"] },
             "keys" => ->(item) { "#{item['account']}:#{item['path']}" },
             "roles" => ->(item) { item["id"] },
-            "gems" => ->(item) { "#{item['name']} #{item['version']}" }
+            "gems" => ->(item) { "#{item['name']} #{item['version']}" },
+            "extensions" => ->(item) { item["gem"] }
           }.freeze
 
           # "SHA256:" plus the first 20 base64 characters is enough to

data/lib/ace/lab/cli/commands/verify.rb

@@ -16,7 +16,8 @@ module Ace
             "accounts" => "account", "directories" => "directory", "keys" => "account",
             "roles" => "id", "repositories" => "project", "grants" => "principal",
             "registry" => "project", "overseer" => "project",
-            "adapters" => "adapter", "tools" => "tool", "gems" => "gem"
+            "adapters" => "adapter", "tools" => "tool", "gems" => "gem",
+            "extensions" => "gem"
           }.freeze
 
           desc "Verify the installed lab's readiness under the target accounts (read-only): " \

data/lib/ace/lab/molecules/extension_projection.rb

@@ -17,6 +17,59 @@ module Ace
 
         module_function
 
+        # Installed operational extensions must not sit below a directory
+        # that an agent can replace. The leaf may be created by the root
+        # installer, but every existing ancestor must already be protected.
+        def validate_protected_root!(path)
+          unless path.is_a?(String) && path.start_with?("/") && File.expand_path(path) == path && path != "/"
+            raise Ace::Lab::Error, "installed extension path must be a canonical absolute path"
+          end
+          current = "/"
+          root_stat = File.lstat(current)
+          unless root_stat.directory? && root_stat.uid.zero? && (root_stat.mode & 0o022).zero?
+            raise Ace::Lab::Error, "installed extension filesystem root is not root-controlled"
+          end
+          path.split("/").reject(&:empty?).each do |part|
+            current = File.join(current, part)
+            begin
+              stat = File.lstat(current)
+            rescue Errno::ENOENT
+              break
+            end
+            unless stat.directory? && !stat.symlink? && stat.uid.zero? && (stat.mode & 0o022).zero?
+              raise Ace::Lab::Error, "installed extension directory is not root-controlled: #{current}"
+            end
+          end
+          true
+        rescue SystemCallError => e
+          raise Ace::Lab::Error, "installed extension directory cannot be inspected (#{e.class})"
+        end
+
+        def validate_protected_files!(root, relative_paths, allow_missing: false)
+          validate_protected_root!(root)
+          relative_paths.each do |relative|
+            validate_destination!(root, relative)
+            current = root
+            segments = relative.split(File::SEPARATOR)
+            segments.each_with_index do |part, index|
+              current = File.join(current, part)
+              begin
+                stat = File.lstat(current)
+              rescue Errno::ENOENT
+                break if allow_missing
+                raise
+              end
+              kind_ok = index == segments.length - 1 ? stat.file? : stat.directory?
+              unless kind_ok && !stat.symlink? && stat.uid.zero? && (stat.mode & 0o022).zero?
+                raise Ace::Lab::Error, "installed extension path is not root-controlled: #{current}"
+              end
+            end
+          end
+          true
+        rescue SystemCallError => e
+          raise Ace::Lab::Error, "installed extension file cannot be inspected (#{e.class})"
+        end
+
         # The installed gem's own tree at the EXACT declared version.
         # @return [String, nil] the handbook/extensions directory or nil
         #   when the gem (or its extensions tree) is not installed
@@ -30,10 +83,16 @@ module Ace
         # gem's handbook/extensions tree (e.g. "ace-wake/index.js").
         # @return [Hash<String, String>]
         def source_files(source_root)
-          Dir.glob(File.join(source_root, "**", "*")).select { |path| File.file?(path) }
+          Dir.glob(File.join(source_root, "**", "*"), File::FNM_DOTMATCH).select { |path| File.file?(path) }
             .to_h { |path| [path.delete_prefix("#{source_root}/"), path] }
         end
 
+        def valid_receipt?(receipt)
+          receipt.is_a?(Hash) && receipt["files"].is_a?(Array) && receipt["files"].all? do |path|
+            path.is_a?(String) && !path.start_with?("/") && path.split("/", -1).all? { |segment| !segment.empty? && segment != "." && segment != ".." }
+          end
+        end
+
         # Resolve and fully validate a projection destination before
         # anything is written or verified (the provider_syncer
         # validate_projection_destination posture): every path

data/lib/ace/lab/molecules/extension_provisioner.rb

@@ -83,15 +83,28 @@ module Ace
           end
 
           output_dir = entry["path"]
+          if ENV["ACE_TOOLCHAIN"] == "installed"
+            begin
+              ExtensionProjection.validate_protected_files!(source, expected.keys)
+              ExtensionProjection.validate_protected_files!(output_dir,
+                expected.keys + [RECEIPT_NAME], allow_missing: true)
+            rescue Ace::Lab::Error => e
+              return failed(entry, version, e.message)
+            end
+          end
           escape = projection_escape_reason(output_dir, expected.keys)
           return failed(entry, version, escape) if escape
 
           receipt = read_receipt(output_dir)
+          if receipt
+            escape = projection_escape_reason(output_dir, receipt["files"])
+            return failed(entry, version, escape) if escape
+          end
           loaded_version = receipt && receipt["gem"] == entry["gem"] ? receipt["version"] : nil
 
           changed = projection_changed?(output_dir, expected, receipt, version)
           if !changed
-            converge_modes(output_dir, expected, entry)
+            converge_modes(output_dir, expected, entry) unless @dry_run
             return entry_report(entry, version, "unchanged", loaded_version, false,
               receipt ? receipt.fetch("files") : expected.keys)
           end
@@ -157,6 +170,7 @@ module Ace
           # touched).
           previous = read_receipt(output_dir)&.fetch("files", []) || []
           retained = previous.filter_map do |relative|
+            ExtensionProjection.validate_destination!(output_dir, relative)
             target = File.join(output_dir, relative)
             next relative if expected.key?(relative)
 
@@ -175,22 +189,25 @@ module Ace
         # so the target executor can always read its extensions.
         def converge_modes(output_dir, expected, entry)
           account = @account_lookup.call(entry["account"])
+          owner = ENV["ACE_TOOLCHAIN"] == "installed" ? [0, 0] : (account && [account.uid, account.gid])
           targets = expected.keys.map { |relative| File.join(output_dir, relative) }
           targets << File.join(output_dir, RECEIPT_NAME)
           targets.each do |target|
             next unless File.file?(target)
 
             FileUtils.chmod(FILE_MODE, target)
-            FileUtils.chown(account.uid, account.gid, target) if account
+            FileUtils.chown(*owner, target) if owner
           end
           root = File.realpath(output_dir)
+          FileUtils.chmod(DIR_MODE, root)
+          FileUtils.chown(*owner, root) if owner
           dirs = expected.keys.filter_map do |relative|
             File.dirname(File.join(root, relative)) if relative.include?(File::SEPARATOR)
           end.uniq
           until dirs.empty?
             dir = dirs.pop
             FileUtils.chmod(DIR_MODE, dir)
-            FileUtils.chown(account.uid, account.gid, dir) if account
+            FileUtils.chown(*owner, dir) if owner
             parent = File.dirname(dir)
             dirs << parent if dir != root && parent.start_with?("#{root}/") && !dirs.include?(parent) && parent != root
           end
@@ -210,7 +227,7 @@ module Ace
           return nil unless File.file?(path)
 
           document = JSON.parse(File.read(path))
-          document.is_a?(Hash) ? document : nil
+          ExtensionProjection.valid_receipt?(document) ? document : nil
         rescue JSON::ParserError, Errno::EACCES
           nil
         end

data/lib/ace/lab/molecules/gem_payload_permissions.rb

@@ -20,6 +20,7 @@ module Ace
           Gem.use_paths(home)
           queue = [Gem::Specification.find_by_name(ARGV.shift, ARGV.shift)]
           dry_run = ARGV.shift == "dry-run"
+          require_complete = ARGV.shift == "complete"
           seen = {}; rows = []
           until queue.empty?
             spec = queue.shift
@@ -47,28 +48,34 @@ module Ace
               rescue Gem::MissingSpecError
                 # Convergence already predicts installing absent dependencies.
                 # Validate the existing payload; do not invent future files.
-                raise unless dry_run
+                raise unless dry_run && !require_complete
               end
             end
           end
           puts JSON.generate(rows)
         CODE
 
-        def initialize(gem_home:, dry_run:, privileged:)
+        def initialize(gem_home:, dry_run:, privileged:, require_complete: false)
           @declared_home = File.expand_path(gem_home)
           raise Error, "gem runtime is a symlink" if File.symlink?(@declared_home)
           @home = File.realpath(@declared_home)
           @dry_run, @privileged = dry_run, privileged
+          @require_complete = require_complete
         end
 
         def call(name:, version:)
           # Default Ruby gems need no mutation in this runtime. With no local
           # specifications there cannot be any owned installed payload here.
-          return [] unless File.directory?(File.join(@home, "specifications"))
+          unless File.directory?(File.join(@home, "specifications"))
+            raise Error, "installed gem specifications are missing" if @require_complete
+            return []
+          end
 
           env = ENV.keys.grep(/\ABUNDLE/).to_h { |key| [key, nil] }
-          env.merge!("RUBYOPT" => nil, "RUBYLIB" => nil, "GEM_HOME" => @home, "GEM_PATH" => @home)
-          out, _err, status = Open3.capture3(env, RbConfig.ruby, "-e", INVENTORY, @home, name, version, @dry_run ? "dry-run" : "apply")
+          env.merge!("RUBYOPT" => nil, "RUBYLIB" => nil, "RUBYGEMS_GEMDEPS" => nil, "GEM_SPEC_CACHE" => nil,
+            "LD_PRELOAD" => nil, "LD_LIBRARY_PATH" => nil, "LD_AUDIT" => nil, "GEM_HOME" => @home, "GEM_PATH" => @home)
+          out, _err, status = Open3.capture3(env, RbConfig.ruby, "-e", INVENTORY, @home, name, version,
+            @dry_run ? "dry-run" : "apply", @require_complete ? "complete" : "partial")
           unless status.success?
             detail = begin
               JSON.parse(out)["error"]

data/lib/ace/lab/molecules/gemset_provisioner.rb

@@ -334,8 +334,13 @@ module Ace
 
         def satisfying_versions(dep, versions)
           requirement = dep["requirement"].split(",").map(&:strip)
+          constraint = Gem::Requirement.new(*requirement)
           versions.select do |version|
-            Gem::Dependency.new(dep["name"], *requirement).match?(dep["name"], version)
+            # RubyGems can activate an explicitly installed prerelease even
+            # when the depending gem uses a normal version requirement.
+            # Dependency#match? filters prereleases intended for discovery;
+            # closure checks must describe what this installed runtime can use.
+            constraint.satisfied_by?(Gem::Version.new(version))
           end
         end
 

data/lib/ace/lab/organisms/install.rb

@@ -76,6 +76,7 @@ module Ace
           effective_dry_run = dry_run.nil? ? self.dry_run : dry_run
           manifest = Molecules::InstallManifestLoader.load(path: manifest_path, platform: platform)
           declared_projects = manifest["projects"].map { |project| project["id"] }
+          declared_projects << manifest["coordinator"]["id"] if manifest["coordinator"]
 
           conflict = grants_molecule.foreign_grants?(declared_projects)
           if conflict

data/lib/ace/lab/organisms/verify.rb

@@ -9,6 +9,7 @@ require_relative "../molecules/extension_provisioner"
 require_relative "../molecules/hitl_routes"
 require_relative "../molecules/caller_authorizer"
 require_relative "../atoms/topology_schema"
+require "ace/support/cli/toolchain"
 require "open3"
 require "yaml"
 require "json"
@@ -199,9 +200,8 @@ module Ace
         # verified readiness. Protocol instructions are resolved with
         # ace-nav from every declared project root (the execution
         # contexts the executor works in); a role that fails resolution
-        # is a failed check, an environment without the resolver
-        # reports unknown (offline verifier posture, like network
-        # remotes) and does not block.
+        # is a failed check. In auto mode a missing resolver reports unknown;
+        # installed mode requires the installed executable and fails closed.
         def check_roles(manifest)
           verifier = Molecules::RoleVerifier.new(
             account_lookup: @account_lookup, group_source: @group_source
@@ -252,6 +252,8 @@ module Ace
             "'#{instructions}'; not probed by the read-only verifier"] if unresolved_resolver
 
           [PASS, nil]
+        rescue Ace::Support::Cli::Toolchain::Error => e
+          [FAIL, "ACE toolchain error: #{e.message}"]
         end
 
         def resolution_error(result)
@@ -259,20 +261,18 @@ module Ace
           detail ? detail : "ace-nav exited with status #{result['status']}"
         end
 
-        # Same binary choice the executor's resolver makes
-        # (Ace::Coworker::Molecules::InstructionResolver): the
-        # project's binstub when present, otherwise the PATH lookup.
-        # A privileged installer never executes repository-controlled
-        # binstubs (same trust posture as the LAB-1 symlink refusals):
-        # under root only the PATH-installed resolver is used.
+        # Match the executor's resolver: installed mode always resolves the
+        # installed launcher, and root never executes repository binstubs.
         def nav_binary(project_root)
+          return Ace::Support::Cli::Toolchain.executable("ace-nav") if Ace::Support::Cli::Toolchain.installed?
+
           binstub = File.join(project_root, "bin", "ace-nav")
           use_binstub = !Process.uid.zero? && File.executable?(binstub)
           use_binstub ? binstub : "ace-nav"
         end
 
         def run_nav(argv, cwd)
-          out, err, status = Open3.capture3(*argv, chdir: cwd)
+          out, err, status = Open3.capture3(Ace::Support::Cli::Toolchain.child_environment, *argv, chdir: cwd)
           {"status" => status.success? ? "ok" : (status.exitstatus || "signal #{status.termsig}"),
            "out" => out, "err" => err}
         rescue Errno::ENOENT
@@ -577,7 +577,12 @@ module Ace
 
           gem_home = gemset["gem_home"]
           runtime_reason = gem_runtime_reason(gem_home)
-          provisioner = Molecules::GemsetProvisioner.new(runner: @runner)
+          # All probes below are read-only and overlap heavily across root
+          # dependency graphs. Reuse identical command results only within
+          # this verification pass; a later call always reads the runtime again.
+          probes = {}
+          read_once = ->(argv) { probes.fetch(argv) { probes[argv] = @runner.call(argv) } }
+          provisioner = Molecules::GemsetProvisioner.new(runner: read_once)
           gems.map do |gem|
             if runtime_reason
               next {"gem" => gem["name"], "version" => gem["version"], "gem_home" => gem_home,
@@ -657,8 +662,17 @@ module Ace
             gem_home, entry["gem"], declared["version"]
           )
           return "gem '#{entry["gem"]}' #{declared["version"]} is not installed with a " \
-            "handbook/extensions tree in '#{gem_home}'; rerun ace-lab install" unless File.directory?(source_root)
-
+            "handbook/extensions tree in '#{gem_home}'; rerun ace-lab install" if source_root.nil?
+
+          if ENV["ACE_TOOLCHAIN"] == "installed"
+            begin
+              Molecules::ExtensionProjection.validate_protected_root!(source_root)
+              Molecules::ExtensionProjection.validate_protected_files!(entry["path"],
+                [Molecules::ExtensionProjection::RECEIPT_NAME])
+            rescue Ace::Lab::Error => e
+              return "#{e.message}; rerun ace-lab install"
+            end
+          end
           receipt_path = File.join(entry["path"], Molecules::ExtensionProvisioner::RECEIPT_NAME)
           unless File.file?(receipt_path)
             return "extension projection receipt '#{receipt_path}' is missing; rerun ace-lab install"
@@ -672,6 +686,9 @@ module Ace
             return "extension projection receipt '#{receipt_path}' is not readable; " \
               "rerun ace-lab install"
           end
+          unless Molecules::ExtensionProjection.valid_receipt?(receipt)
+            return "extension projection receipt '#{receipt_path}' has invalid files; rerun ace-lab install"
+          end
           if receipt["gem"] != entry["gem"] || receipt["version"] != declared["version"]
             return "extension projection at '#{entry["path"]}' was projected from " \
               "'#{receipt["gem"]} #{receipt["version"]}' but the manifest declares " \
@@ -692,6 +709,11 @@ module Ace
             expected.each_key do |relative|
               Molecules::ExtensionProjection.validate_destination!(entry["path"], relative)
             end
+            if ENV["ACE_TOOLCHAIN"] == "installed"
+              Molecules::ExtensionProjection.validate_protected_files!(source_root, expected.keys)
+              Molecules::ExtensionProjection.validate_protected_files!(entry["path"],
+                expected.keys + [Molecules::ExtensionProjection::RECEIPT_NAME])
+            end
           rescue Ace::Lab::Error => e
             return "#{e.message}; rerun ace-lab install"
           end
@@ -713,7 +735,28 @@ module Ace
           return "extension projection file '#{unreadable}' is not readable by the declared " \
             "account '#{entry["account"]}'; rerun ace-lab install" if unreadable
 
+          directories = [entry["path"]] + expected.keys.flat_map do |relative|
+            segments = relative.split("/")[0...-1]
+            segments.each_index.map { |i| File.join(entry["path"], *segments[0..i]) }
+          end
+          if ENV["ACE_TOOLCHAIN"] == "installed"
+            parent = File.dirname(entry["path"])
+            loop do
+              directories << parent
+              break if parent == "/"
+              parent = File.dirname(parent)
+            end
+          end
+          inaccessible = directories.uniq.find do |dir|
+            stat = lstat(dir)
+            !stat || !stat.directory? || stat.symlink? ||
+              ((stat.mode & 0o001).zero? && !((stat.mode & 0o100) != 0 && account_entry && stat.uid == account_entry.uid))
+          end
+          return "extension projection directory '#{inaccessible}' is not traversable by the declared account '#{entry["account"]}'" if inaccessible
+
           nil
+        rescue SystemCallError => e
+          "extension projection at '#{entry["path"]}' cannot be inspected (#{e.class.name}); rerun ace-lab install"
         end
 
         def unreadable_reason(path, account_entry)

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.14.1"
+    VERSION = "0.15.1"
   end
 end

data/libexec/forgejo-askpass

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Executable code belongs to the protected installed package, never the
+# ephemeral credential directory (which may be mounted noexec).
+if [ "$1" = "Username for '$ACE_LAB_FORGEJO_ORIGIN': " ]; then
+  printf '%s\n' "$ACE_LAB_FORGEJO_ACCOUNT"
+elif [ "$1" = "Password for '$ACE_LAB_FORGEJO_SCHEME://$ACE_LAB_FORGEJO_ACCOUNT@$ACE_LAB_FORGEJO_AUTHORITY': " ]; then
+  cat "$ACE_LAB_CREDENTIAL_FILE"
+else
+  exit 1
+fi

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.14.1
+  version: 0.15.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-11-01 00:00:00.000000000 Z
+date: 2026-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -58,6 +58,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,6 +68,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.0
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -175,13 +181,16 @@ files:
 - lib/ace/lab/atoms/topology_schema.rb
 - lib/ace/lab/auth.rb
 - lib/ace/lab/auth/credential_handoff.rb
+- lib/ace/lab/auth/error.rb
 - lib/ace/lab/auth/lease_store.rb
+- lib/ace/lab/auth/local_command.rb
 - lib/ace/lab/auth/plugins/env_provider.rb
 - lib/ace/lab/auth/plugins/forgejo_provider.rb
 - lib/ace/lab/auth/plugins/github_provider.rb
 - lib/ace/lab/auth/profile_schema.rb
 - lib/ace/lab/auth/providers.rb
 - lib/ace/lab/auth/service.rb
+- lib/ace/lab/auth/session_configuration.rb
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
@@ -234,6 +243,7 @@ files:
 - lib/ace/lab/organisms/topology_service.rb
 - lib/ace/lab/organisms/verify.rb
 - lib/ace/lab/version.rb
+- libexec/forgejo-askpass
 homepage: https://github.com/cs3b/ace
 licenses:
 - MIT