ace-lab 0.8.0 → 0.9.0

data/lib/ace/lab/molecules/command_policy.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require "json"
+require "yaml"
+require "digest"
+require "ace/assign/atoms/evidence_digest"
+require_relative "grant_resolver"
+
+module Ace
+  module Lab
+    module Molecules
+      # One deployment-owned policy, independent of repository preferences.
+      # The selected grant covers the WHOLE service combination and exact argv.
+      class CommandPolicy
+        PATH = "/etc/lab/ace-lab/project-commands.yml"
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}\z/
+        ENV_KEY = /\A[A-Z][A-Z0-9_]{0,63}\z/
+        RESERVED = %w[HOME USER LOGNAME SHELL PATH RUBYOPT RUBYLIB BUNDLE_GEMFILE GEM_HOME GEM_PATH BASH_ENV ENV PYTHONPATH PYTHONHOME PERL5LIB LD_PRELOAD LD_LIBRARY_PATH].freeze
+        attr_reader :project, :launcher
+
+        def self.load(project:)
+          bytes = GrantResolver.read_verified(PATH)
+          raise InvalidConfigurationError, "project commands are not installed" unless bytes && bytes.bytesize <= 65_536
+          new(YAML.safe_load(bytes, aliases: false), project: project)
+        rescue Psych::Exception
+          raise InvalidConfigurationError, "invalid project command policy"
+        end
+
+        def initialize(document, project:)
+          strict!(document, %w[version projects])
+          invalid! unless document["version"] == 1 && document["projects"].is_a?(Hash) &&
+            document["projects"].keys.all? { |id| id.is_a?(String) && ID.match?(id) } && project.is_a?(String) && ID.match?(project)
+          @project = project
+          @document = JSON.parse(JSON.generate(document))
+          @entry = @document.fetch("projects").fetch(project) { invalid! }
+          strict!(@entry, %w[launcher default_executor default_services executors services commands grants])
+          @launcher = @entry.fetch("launcher")
+          strict!(@launcher, %w[socket_path identity_path])
+          invalid! unless @launcher.values.all? { |value| absolute?(value) }
+          %w[executors services commands].each do |key|
+            value = @entry.fetch(key)
+            invalid! unless value.is_a?(Hash) && value.size <= 64 && value.keys.all? { |id| id.is_a?(String) && ID.match?(id) }
+          end
+          @entry.fetch("executors").each_value do |value|
+            strict!(value, %w[uid gid groups home cwd path environment])
+            invalid! unless %w[uid gid].all? { |key| uid?(value[key]) } &&
+              value["groups"].is_a?(Array) && value["groups"].all? { |gid| uid?(gid) } &&
+              value["groups"].uniq == value["groups"] &&
+              %w[home cwd].all? { |key| absolute?(value[key]) } &&
+              value["path"].is_a?(Array) && !value["path"].empty? && value["path"].all? { |item| absolute?(item) }
+            environment!(value.fetch("environment"))
+          end
+          @entry.fetch("services").each_value do |value|
+            strict!(value, %w[environment secret_references])
+            environment!(value.fetch("environment"))
+            references = value.fetch("secret_references")
+            invalid! unless references.is_a?(Hash) && references.all? { |key, path| env_key?(key) && absolute?(path) }
+          end
+          @entry.fetch("commands").each_value do |value|
+            strict!(value, %w[argv executable_sha256 source purpose])
+            invalid! unless %w[command test].include?(value["purpose"])
+            argv!(value.fetch("argv"))
+            invalid! unless sha?(value.fetch("executable_sha256"))
+            source = value.fetch("source")
+            strict!(source, %w[head tree])
+            invalid! unless source.values.all? { |sha| sha.nil? || (sha.is_a?(String) && sha.match?(/\A[0-9a-f]{40}\z/)) } &&
+              source.values.all?(&:nil?) == source.values.any?(&:nil?)
+            invalid! if value["purpose"] == "test" && source.values.any?(&:nil?)
+          end
+          invalid! unless @entry.fetch("executors").key?(@entry["default_executor"])
+          services!(@entry.fetch("default_services"))
+          invalid! unless @entry["grants"].is_a?(Array) && @entry["grants"].size <= 256
+          @entry["grants"].each do |grant|
+            strict!(grant, %w[kind uid command executor services])
+            invalid! unless %w[operator agent].include?(grant["kind"]) && uid?(grant["uid"]) &&
+              @entry.fetch("commands").key?(grant["command"]) && @entry.fetch("executors").key?(grant["executor"])
+            services!(grant.fetch("services"))
+          end
+          @fingerprint = Ace::Assign::Atoms::EvidenceDigest.digest(@entry)
+          freeze_value(@document)
+        end
+
+        def reader!(uid)
+          deny! unless @entry.fetch("grants").any? { |grant| grant.fetch("uid") == uid }
+          true
+        end
+
+        def select(selection:, peer:)
+          strict!(selection, %w[argv executor services pane])
+          argv!(selection.fetch("argv"))
+          executor_id = selection["executor"] || @entry.fetch("default_executor")
+          executor = @entry.fetch("executors")[executor_id]
+          deny! unless executor
+          requested = selection["services"].nil? ? @entry.fetch("default_services") : selection["services"]
+          services!(requested)
+          selected = requested.uniq.sort
+          matches = @entry.fetch("commands").select { |_name, value| value.fetch("argv") == selection["argv"] }
+          deny! unless matches.size == 1
+          command_id, command = matches.first
+          kind = selection["pane"].nil? ? "operator" : "agent"
+          deny! unless @entry.fetch("grants").any? { |grant|
+            grant.values_at("kind", "uid", "command", "executor") == [kind, peer.fetch("uid"), command_id, executor_id] &&
+              grant.fetch("services").sort == selected }
+          environment = executor.fetch("environment").dup
+          references = {}
+          selected.each do |id|
+            service = @entry.fetch("services").fetch(id)
+            additions = service.fetch("environment")
+            secrets = service.fetch("secret_references")
+            deny! unless (environment.keys & (additions.keys + secrets.keys)).empty? &&
+              (references.keys & (additions.keys + secrets.keys)).empty? && (additions.keys & secrets.keys).empty?
+            environment.merge!(additions)
+            references.merge!(secrets)
+          end
+          definition = {"policy_sha256" => @fingerprint, "project_id" => @project, "command_id" => command_id,
+            "argv" => command.fetch("argv"), "executable_sha256" => command.fetch("executable_sha256"),
+            "source" => command.fetch("source"), "purpose" => command.fetch("purpose"), "executor_id" => executor_id,
+            "executor" => executor.merge("environment" => environment, "groups" => executor.fetch("groups").sort), "services" => selected,
+            "secret_references" => references, "requester" => peer, "requester_kind" => kind,
+            "selection" => selection}
+          invalid! if JSON.generate(definition).bytesize > 8192
+          definition
+        end
+
+        private
+
+        def strict!(value, keys)
+          invalid! unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+        def argv!(value)
+          invalid! unless value.is_a?(Array) && value.size.between?(1, 128) &&
+            value.all? { |item| item.is_a?(String) && item.bytesize <= 4096 && !item.include?("\0") } &&
+            !value.first.empty? && value.sum(&:bytesize) <= 8192
+        end
+        def services!(value)
+          invalid! unless value.is_a?(Array) && value.size <= 64 && value.all? { |id| @entry.fetch("services").key?(id) }
+        end
+        def environment!(value)
+          invalid! unless value.is_a?(Hash) && value.size <= 64 && value.all? { |key, item|
+            env_key?(key) && item.is_a?(String) && item.bytesize <= 4096 && !item.include?("\0") }
+        end
+        def env_key?(key) = key.is_a?(String) && ENV_KEY.match?(key) && !RESERVED.include?(key) && !key.start_with?("GIT_CONFIG_", "BUNDLE_", "LD_", "DYLD_")
+        def absolute?(value) = value.is_a?(String) && value.start_with?("/") && !value.include?("\0") && File.expand_path(value) == value
+        def uid?(value) = value.is_a?(Integer) && value.between?(1, 2**31 - 1)
+        def sha?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+        def invalid! = raise(InvalidConfigurationError, "invalid project command policy")
+        def deny! = raise(SecurityError, "project command selection is not authorized")
+        def freeze_value(value)
+          case value
+          when Hash then value.each { |key, child| key.freeze; freeze_value(child) }
+          when Array then value.each { |child| freeze_value(child) }
+          end
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/grant_resolver.rb

@@ -43,6 +43,21 @@ module Ace
               "invalid lab configuration: trusted authorization file could not be parsed"
           end
 
+          # Validate an installed directory through the same original-path
+          # traversal as files, including root-owned system symlink aliases.
+          def trusted_directory!(path)
+            candidate = verified_resolve(path)
+            raise Ace::Lab::InvalidConfigurationError, "trusted directory is unavailable" unless candidate
+            File.open(candidate, File::RDONLY | File::NOFOLLOW) do |handle|
+              unless handle.stat.directory? && secure_file_stat?(handle.stat)
+                raise Ace::Lab::InvalidConfigurationError, "trusted directory ownership or mode differs"
+              end
+            end
+            true
+          rescue SystemCallError
+            raise Ace::Lab::InvalidConfigurationError, "trusted directory is unavailable"
+          end
+
           # @param documents [Array<Hash>] {path:, document:, defaults:}
           #   from Ace::Lab.cascade_documents
           # @param topology [Hash] normalized topology (project IDs)

data/lib/ace/lab/molecules/ordinary_owner_admission.rb

@@ -44,6 +44,19 @@ module Ace
           observe_identity(peer: peer, pane: pane, deadline: deadline, with_cwd: false).first
         end
 
+        def supervisor_ended!(binding:, deadline: default_deadline)
+          @config.verify_selection!
+          process = binding.fetch("process_identity")
+          @config.selected_principal!(process.fetch("uid"))
+          observation = Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline, binary: @config.runtime_binary)
+          result = Ace::Runtime::Molecules::ProcessIdentity.new(executor: observation).generation_status(process)
+          unless result.fetch("liveness") == "ended"
+            raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "original supervisor process generation is live or unknown"
+          end
+          @config.verify_selection!
+          result
+        end
+
         # The caller's claimed head is only a comparison. The accepted start
         # uses the observed worker's checkout and process, never daemon cwd.
         def execution!(peer:, pane:, head:, deadline: default_deadline)

data/lib/ace/lab/organisms/command_executor.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+require "json"
+require "pty"
+require "etc"
+require "fiddle"
+require "base64"
+require "io/console"
+require "ace/runtime/molecules/owned_child_scope"
+require_relative "command_run_client"
+
+module Ace
+  module Lab
+    module Organisms
+      # Short-lived execution child of the installed root labd, not a listener
+      # or another journal owner. A single Ruby thread forks the gated executor.
+      class CommandExecutor
+        def initialize(project:, owner: nil)
+          @project = project
+          @owner = owner || CommandRunClient.new(project: project).owner
+        end
+
+        def run(socket:, request:)
+          raise SecurityError, "command executor requires Linux root" unless RUBY_PLATFORM.include?("linux") && Process.uid.zero? && Process.euid.zero?
+          strict!(request, %w[execution_id caller tty rows cols])
+          id = request.fetch("execution_id")
+          raise ArgumentError, "invalid command reference" unless id.is_a?(String) && Molecules::CommandPolicy::ID.match?(id)
+          interactive = request.fetch("tty")
+          raise ArgumentError, "invalid terminal mode" unless [true, false].include?(interactive)
+          rows, cols = geometry(request)
+          params = {"execution_id" => id}
+          initial = @owner.call("command_status", params).data
+          unless initial["phase"] == "admitted" && initial.dig("definition", "requester") == request.fetch("caller")
+            raise SecurityError, "original command already claimed or requester differs"
+          end
+          definition = initial.fetch("definition")
+          unless definition.fetch("secret_references").empty?
+            raise SecurityError, "secret command execution capability is not installed"
+          end
+          claimed = @owner.call("command_claim", params.merge("caller" => request.fetch("caller")), mutation_id: "command-claim.#{id}")
+          raise SecurityError, "claim replay cannot execute" if claimed.replayed
+          launch(socket, id, definition, interactive, rows, cols)
+        end
+
+        private
+
+        def launch(socket, id, definition, interactive, rows, cols)
+          raise SecurityError, "command fork requires a single-thread helper" unless Thread.list.count(&:alive?) == 1
+          scope = Ace::Runtime::Molecules::OwnedChildScope.new
+          executor = definition.fetch("executor")
+          user = Etc.getpwuid(executor.fetch("uid"))
+          environment = {"HOME" => executor.fetch("home"), "USER" => user.name, "LOGNAME" => user.name,
+            "PATH" => executor.fetch("path").join(":")}.merge(executor.fetch("environment"))
+          if interactive
+            parent_input, child_output = PTY.open
+            parent_output, child_input = parent_input, child_output
+            child_output.winsize = [rows, cols]
+          else
+            child_input, parent_input = IO.pipe
+            parent_output, child_output = IO.pipe
+            parent_error, child_error = IO.pipe
+          end
+          gate_read, gate_write = IO.pipe
+          ready_read, ready_write = IO.pipe
+          child = fork do
+            begin
+              socket.close
+              [parent_input, parent_output, parent_error, gate_write, ready_read].compact.uniq.each(&:close)
+              Process.setsid
+              child_input.ioctl(0x540E, 0) if interactive # Linux TIOCSCTTY
+              $stdin.reopen(child_input)
+              $stdout.reopen(child_output)
+              $stderr.reopen(child_error || child_output)
+              [child_input, child_output, child_error].compact.uniq.each(&:close)
+              Process.groups = executor.fetch("groups")
+              Process::GID.change_privilege(executor.fetch("gid"))
+              Process::UID.change_privilege(executor.fetch("uid"))
+              File.umask(0o077)
+              prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
+                [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG], Fiddle::TYPE_INT)
+              raise SecurityError, "cannot inhibit privilege gain" unless prctl.call(38, 1, 0, 0, 0).zero?
+              Dir.chdir(executor.fetch("cwd"))
+              ready_write.write("R")
+              ready_write.close
+              exit! 125 unless IO.select([gate_read], nil, nil, 35) && gate_read.read(1) == "E"
+              gate_read.close
+              argv = definition.fetch("argv")
+              exec(environment, [File.expand_path(argv.first), argv.first], *argv.drop(1), unsetenv_others: true)
+            rescue Exception
+              exit! 126
+            end
+          end
+          [child_input, child_output, child_error, gate_read, ready_write].compact.uniq.each(&:close)
+          unless IO.select([ready_read], nil, nil, 10) && ready_read.read(1) == "R"
+            raise SecurityError, "child did not reach admission gate"
+          end
+          ready_read.close
+          witness = child_witness(child)
+          bound = @owner.call("command_bind", {"execution_id" => id, "child" => witness}, mutation_id: "command-bind.#{id}")
+          raise SecurityError, "binding replay cannot execute" if bound.replayed
+          gate_write.write("E")
+          gate_write.close
+          send_frame(socket, {"type" => "started", "execution_id" => id})
+          outputs = {parent_output => interactive ? "terminal" : "stdout"}
+          outputs[parent_error] = "stderr" if parent_error
+          pump(socket, parent_input, outputs, child, interactive)
+          scope.cleanup!(leader: child)
+          _, result = Process.waitpid2(child)
+          reaped = true
+          termination = {"exit_status" => result.exitstatus, "signal" => result.termsig}
+          @owner.call("command_complete", {"execution_id" => id, "result" => termination}, mutation_id: "command-complete.#{id}")
+          send_frame(socket, termination.merge("type" => "result", "execution_id" => id))
+          result.exitstatus || 128 + result.termsig
+        ensure
+          [gate_write, ready_read, parent_input, parent_output, parent_error].compact.uniq.each { |io| io.close unless io.closed? }
+          if child && !reaped
+            scope.cleanup!(leader: child)
+            deadline = monotonic + 5
+            loop do
+              break if Process.waitpid(child, Process::WNOHANG)
+              break if monotonic >= deadline
+              IO.select(nil, nil, nil, 0.01)
+            end
+          end
+        end
+
+        def pump(socket, input, outputs, child, interactive)
+          pending = "".b
+          pending_input = "".b
+          input_open = true
+          input_finished = false
+          terminal_at = nil
+          loop do
+            terminal_at ||= monotonic if zombie?(child)
+            break if terminal_at && (outputs.empty? || monotonic - terminal_at >= 1)
+            readers = (pending_input.bytesize < 131_072 ? [socket] : []) + outputs.keys
+            ready = IO.select(readers, pending_input.empty? || input.closed? ? [] : [input], nil, 0.1)
+            next unless ready
+            if ready.first.include?(socket)
+              bytes = socket.read_nonblock(65_536, exception: false)
+              next if bytes == :wait_readable
+              raise IOError, "command client disconnected" unless bytes
+              pending << bytes
+              raise ArgumentError, "command frame exceeds bound" if pending.bytesize > 131_072
+              while (newline = pending.index("\n"))
+                frame = JSON.parse(pending.slice!(0, newline + 1))
+                case frame.fetch("type")
+                when "input"
+                  strict!(frame, %w[type data])
+                  raise ArgumentError, "command input after EOF" unless input_open
+                  pending_input << Base64.strict_decode64(frame.fetch("data"))
+                  raise ArgumentError, "command buffered input exceeds bound" if pending_input.bytesize > 131_072
+                when "resize"
+                  strict!(frame, %w[type rows cols])
+                  raise ArgumentError, "resize requires a terminal" unless interactive
+                  input.winsize = geometry(frame)
+                when "eof"
+                  strict!(frame, %w[type])
+                  raise ArgumentError, "duplicate input EOF" unless input_open
+                  pending_input << "\x04" if interactive
+                  input_open = false
+                else raise ArgumentError, "invalid command input"
+                end
+              end
+            end
+            if ready[1].include?(input)
+              written = input.write_nonblock(pending_input, exception: false)
+              pending_input.slice!(0, written) if written.is_a?(Integer)
+            end
+            if !input_open && pending_input.empty? && !input_finished
+              input.close unless interactive
+              input_finished = true
+            end
+            outputs.keys.each do |output|
+              next unless ready.first.include?(output)
+              begin
+                bytes = output.read_nonblock(65_536, exception: false)
+              rescue Errno::EIO
+                bytes = nil
+              end
+              next if bytes == :wait_readable
+              if bytes
+                send_frame(socket, {"type" => "output", "stream" => outputs.fetch(output), "data" => Base64.strict_encode64(bytes)})
+              else
+                outputs.delete(output)
+              end
+            end
+          end
+        end
+
+        def child_witness(pid)
+          observer = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
+            Ace::Herdr::Molecules::BoundedObservation.new(deadline: monotonic + 5))
+          identity = observer.capture(pid)
+          raise SecurityError, "child generation unavailable" unless identity
+          status = File.readlines("/proc/#{pid}/status").filter_map { |line| line.include?(":") && line.split(":", 2) }.to_h
+          identity.merge("gid" => status.fetch("Gid").split.first.to_i, "groups" => status.fetch("Groups").split.map(&:to_i).sort,
+            "cwd" => File.readlink("/proc/#{pid}/cwd"), "process_group" => Process.getpgid(pid),
+            "no_new_privs" => Integer(status.fetch("NoNewPrivs").strip, 10),
+            "capabilities" => %w[CapInh CapPrm CapEff CapAmb].to_h { |key| [key, status.fetch(key).strip] })
+        end
+
+        def zombie?(pid) = File.read("/proc/#{pid}/stat").split(")").last.split.first == "Z"
+        def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        def geometry(value)
+          rows, cols = value.values_at("rows", "cols")
+          raise ArgumentError, "invalid command geometry" unless [rows, cols].all? { |v| v.is_a?(Integer) && v.between?(1, 65_535) }
+          [rows, cols]
+        end
+        def strict!(value, keys)
+          raise ArgumentError, "invalid command fields" unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+        def send_frame(socket, frame)
+          Ace::Runtime::Molecules::ProtectedSocket.write(socket, frame,
+            deadline: Ace::Runtime::Molecules::ProtectedSocket.deadline(5), limit: 131_072)
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/command_run_client.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "json"
+require "securerandom"
+require "fileutils"
+require "base64"
+require "io/console"
+require "ace/assign/authority/ordinary_client"
+require_relative "../molecules/ordinary_owner_config"
+require_relative "../molecules/command_policy"
+
+module Ace
+  module Lab
+    module Organisms
+      class CommandRunClient
+        def initialize(project:)
+          @project = project
+          @config = Molecules::OrdinaryOwnerConfig.load(project: project)
+        end
+
+        def owner
+          Ace::Assign::Authority::OrdinaryClient.new(project_id: @project, service: @config.service,
+            verify_selection: @config.method(:verify_owner!))
+        end
+
+        def status(reference)
+          owner.call("command_status", {"execution_id" => reference}).data
+        end
+
+        def run(argv:, executor:, services:, pane: nil)
+          id = SecureRandom.hex(16)
+          selection = {"argv" => argv, "executor" => executor, "services" => services, "pane" => pane}
+          request = {"project" => @project, "execution_id" => id, "selection" => selection,
+            "mutation_id" => "command-admit.#{id}"}
+          parent = File.expand_path(".ace-local/lab-commands")
+          FileUtils.mkdir_p(parent, mode: 0o700)
+          directory = File.join(parent, id)
+          Dir.mkdir(directory, 0o700)
+          File.open(File.join(directory, "request.json"), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+            file.write(JSON.generate(request) + "\n")
+            file.flush
+            file.fsync
+          end
+          File.open(directory, File::RDONLY) { |parent_io| parent_io.fsync }
+          $stderr.puts "Execution #{id}; inspect with ace-lab run-status --project #{@project} --reference #{id}"
+          reply = owner.call("command_admit", {"execution_id" => id, "selection" => selection}, mutation_id: request.fetch("mutation_id"))
+          raise Ace::Assign::AttemptErrors::Conflict, "original command admission must be reconciled" if reply.replayed
+          stream(id)
+        end
+
+        private
+
+        def stream(id)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          policy = Molecules::CommandPolicy.load(project: @project)
+          path = policy.launcher.fetch("socket_path")
+          wire.root_path!(File.dirname(path), directory: true)
+          endpoint = wire.socket_identity(path, mode: 0o660)
+          raise SecurityError, "command launcher endpoint owner differs" unless endpoint.last.zero?
+          expected = JSON.parse(Molecules::GrantResolver.read_verified(policy.launcher.fetch("identity_path")) || "null")
+          wire.connect(path, deadline: wire.deadline(5)) do |socket|
+            peer = Ace::Assign::Authority::OrdinaryPeer.new.capture(socket)
+            unless expected.is_a?(Hash) && expected["schema"] == "labd-command-launcher/v1" && expected["identity"] == peer
+              raise SecurityError, "command launcher generation differs"
+            end
+            interactive = $stdin.tty? && $stdout.tty?
+            rows, cols = interactive ? $stdin.winsize : [24, 80]
+            wire.write(socket, {"op" => "command_run", "project" => @project, "execution_id" => id,
+              "tty" => interactive, "rows" => rows, "cols" => cols}, deadline: wire.deadline(5), limit: 16_384)
+            if interactive
+              $stdin.raw { pump(socket, id, interactive: true) }
+            else
+              pump(socket, id, interactive: false)
+            end
+          end
+        end
+
+        def pump(socket, id, interactive:)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          ingress = wire::Ingress.new(socket)
+          inputs = [socket]
+          resize = false
+          old_winch = Signal.trap("WINCH") { resize = true } if interactive
+          loop do
+            if resize
+              resize = false
+              rows, cols = $stdin.winsize
+              wire.write(socket, {"type" => "resize", "rows" => rows, "cols" => cols}, deadline: wire.deadline(5), limit: 131_072)
+            end
+            ready = IO.select(inputs, nil, nil, 0.25)
+            next unless ready
+            if ready.first.include?(socket)
+              frame = wire.read(ingress, deadline: wire.deadline(5), limit: 131_072)
+              case frame["type"]
+              when "started"
+                raise SecurityError, "invalid command start frame" unless frame.keys.sort == %w[execution_id type]
+                raise SecurityError, "command reference differs" unless frame["execution_id"] == id
+                inputs << $stdin unless inputs.include?($stdin)
+              when "output"
+                raise SecurityError, "invalid command output frame" unless frame.keys.sort == %w[data stream type] && %w[stdout stderr terminal].include?(frame["stream"])
+                destination = frame["stream"] == "stderr" ? $stderr : $stdout
+                destination.write(Base64.strict_decode64(frame.fetch("data")))
+                destination.flush
+              when "result"
+                raise SecurityError, "invalid command result frame" unless frame.keys.sort == %w[execution_id exit_status signal type]
+                raise SecurityError, "command reference differs" unless frame["execution_id"] == id
+                exited, signal = frame.values_at("exit_status", "signal")
+                if exited.is_a?(Integer) && exited.between?(0, 255) && signal.nil?
+                  return exited
+                elsif exited.nil? && signal.is_a?(Integer) && signal.between?(1, 127)
+                  return 128 + signal
+                end
+                raise SecurityError, "command termination is invalid"
+              else
+                raise SecurityError, "command stream is incomplete"
+              end
+            end
+            next unless ready.first.include?($stdin)
+            bytes = $stdin.read_nonblock(8192, exception: false)
+            next if bytes == :wait_readable
+            frame = bytes ? {"type" => "input", "data" => Base64.strict_encode64(bytes)} : {"type" => "eof"}
+            wire.write(socket, frame, deadline: wire.deadline(5), limit: 131_072)
+            inputs.delete($stdin) unless bytes
+          end
+        ensure
+          Signal.trap("WINCH", old_winch) if old_winch
+        end
+      end
+    end
+  end
+end