rubik 0.1.6 → 0.3.0

data/lib/rubik/runtime/repair_probe.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require "tempfile"
+require "timeout"
+require_relative "discovery"
+require_relative "diagnostic_engine"
+require_relative "../lsp/client"
+
+module Rubik
+  module Runtime
+    # Functional checks own their resources through the caller's probe context.
+    class RepairProbe
+      def initialize(root_dir:)
+        @root_dir = root_dir
+      end
+
+      PROBE_TIMEOUT = 5
+      # These commands support help without running tests or formatting files.
+      HELP_PROBE_BINARIES = ["ruby", "python", "python3", "pytest", "rspec", "rake", "bundle", "rubocop", "standardrb", "ruff", "black", "rustfmt", "cargo", "go", "gofmt",
+                             "goimports", "clang-format", "zig", "prettier", "biome", "npm", "pnpm", "yarn", "bun", "mix", "dart", "crystal", "echo"].freeze
+
+      def verify(target, lang, proposed_cmd, sub_ctx, probe_args: nil)
+        return probe_failure(proposed_cmd, 1, "Unknown target component type: #{target}") unless ["lsp", "test_runner", "linter", "command"].include?(target)
+        unless Rubik::Runtime::Discovery.binary_available?(proposed_cmd, root_dir: @root_dir)
+          return probe_failure(proposed_cmd, 127, "Availability check failed: executable not found in PATH")
+        end
+
+        if target == "lsp"
+          client = Rubik::LSP::Client.new(lang, root_dir: @root_dir, server_cmd: proposed_cmd)
+          sub_ctx.on_dispose { client.stop }
+          begin
+            result = Timeout.timeout(PROBE_TIMEOUT) { client.start }
+            return probe_failure(proposed_cmd, 1, "Functional probe failed: LSP initialize handshake rejected") unless result && client.alive?
+          rescue Timeout::Error
+            return probe_failure(proposed_cmd, 124, "LSP initialize handshake timed out")
+          end
+          return [true, nil]
+        end
+
+        argv = Shellwords.split(proposed_cmd)
+        if probe_args.nil?
+          unless HELP_PROBE_BINARIES.include?(File.basename(argv.first.to_s))
+            return probe_failure(proposed_cmd, 1, "Available but unverified: provide non-mutating probe_args for this executable")
+          end
+
+          probe_args = ["--help"]
+        end
+        return probe_failure(proposed_cmd, 1, "probe_args must be a non-empty array of strings") unless probe_args.is_a?(Array) && !probe_args.empty? && probe_args.all?(String)
+
+        argv.concat(probe_args)
+        # Array-form spawn never interprets shell operators. File-backed output
+        # avoids pipe-reader threads surviving a timeout or a forked descendant.
+        output = Tempfile.new("rubik-repair-probe")
+        sub_ctx.on_dispose { output.close! }
+        options = { chdir: @root_dir, in: File::NULL, out: output, err: output }
+        options[:pgroup] = true unless Rubik::Platform.windows?
+        pid = Process.spawn(*argv, **options)
+        reaped = false
+        sub_ctx.on_dispose do
+          if Rubik::Platform.windows?
+            Rubik::Platform.kill_tree(pid) unless reaped
+          else
+            begin
+              Process.kill("KILL", -pid)
+            rescue Errno::ESRCH
+              nil
+            end
+          end
+          Process.waitpid(pid) unless reaped
+        rescue Errno::ECHILD
+          nil
+        end
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + PROBE_TIMEOUT
+        loop do
+          waited = Process.waitpid2(pid, Process::WNOHANG)
+          if waited
+            reaped = true
+            status = waited.last
+            return [true, nil] if status.success?
+
+            output.rewind
+            return probe_failure(proposed_cmd, status.exitstatus || 1, "Functional probe failed: #{output.read(4096)}")
+          end
+          return probe_failure(proposed_cmd, 124, "Functional probe timed out") if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          sleep 0.01
+        end
+      end
+
+      private
+
+      def probe_failure(command, code, message)
+        [false, Rubik::Runtime::DiagnosticEngine.diagnose(cmd: command, exit_code: code, stderr: message)]
+      end
+    end
+  end
+end

data/lib/rubik/sandbox/driver/bubblewrap.rb

@@ -18,7 +18,6 @@ module Rubik
         end
 
         def run(cmd, timeout: 15, chdir: Dir.pwd, allow_network: false, memory_limit_mb: 512, cpus: "1.0") # rubocop:disable Lint/UnusedMethodArgument
-          start_time = Time.now
           workspace = File.expand_path(chdir)
 
           bwrap_cmd = [
@@ -42,66 +41,21 @@ module Rubik
           bwrap_cmd.push("--unshare-pid", "--die-with-parent")
           bwrap_cmd.push("sh", "-c", cmd)
 
-          stdout_str = ""
-          stderr_str = ""
-          exit_code = 127
-          pid = nil
+          res = Rubik::Platform.popen_capture(
+            *bwrap_cmd,
+            timeout: timeout,
+            chdir: workspace,
+            timeout_message: "Bubblewrap execution timed out after #{timeout} seconds",
+            error_message: "Bubblewrap execution error"
+          )
 
-          begin
-            Timeout.timeout(timeout) do
-              Open3.popen3(*bwrap_cmd) do |stdin, stdout, stderr, wait_thr|
-                pid = wait_thr.pid
-                begin
-                  stdin.close
-                rescue
-                  nil
-                end
-                t_out = Thread.new do
-                  stdout.read
-                rescue
-                  ""
-                end
-                t_err = Thread.new do
-                  stderr.read
-                rescue
-                  ""
-                end
-                begin
-                  stdout_str = t_out.value.to_s
-                  stderr_str = t_err.value.to_s
-                  status = wait_thr.value
-                  exit_code = status.exitstatus || (status.signaled? ? (128 + (status.termsig || 1)) : 1)
-                ensure
-                  begin
-                    t_out.kill
-                  rescue
-                    nil
-                  end
-                  begin
-                    t_err.kill
-                  rescue
-                    nil
-                  end
-                end
-              end
-            end
-          rescue Timeout::Error
-            Rubik::Platform.kill_tree(pid) if pid
-            stderr_str = "Bubblewrap execution timed out after #{timeout} seconds"
-            exit_code = 124
-          rescue StandardError => e
-            stderr_str = "Bubblewrap execution error: #{e.message}"
-            exit_code = 1
-          end
-
-          duration = Time.now - start_time
           {
-            ok: exit_code.zero?,
-            exit_code: exit_code,
-            stdout: stdout_str,
-            stderr: stderr_str,
-            output: [stdout_str, stderr_str].reject(&:empty?).join("\n"),
-            duration: duration.round(4),
+            ok: res[:ok],
+            exit_code: res[:exit_code],
+            stdout: res[:stdout],
+            stderr: res[:stderr],
+            output: res[:output],
+            duration: res[:duration],
             driver: "bwrap"
           }
         end

data/lib/rubik/sandbox/driver/docker.rb

@@ -18,7 +18,6 @@ module Rubik
         end
 
         def run(cmd, timeout: 15, chdir: Dir.pwd, allow_network: false, memory_limit_mb: 512, cpus: "1.0")
-          start_time = Time.now
           image = @options[:image] || DEFAULT_IMAGE
           workspace = File.expand_path(chdir)
           container_name = "rubik-box-#{SecureRandom.hex(6)}"
@@ -40,70 +39,25 @@ module Rubik
           docker_args.push("--network", "none") unless allow_network
           docker_args.push(image, "sh", "-c", cmd)
 
-          stdout_str = ""
-          stderr_str = ""
-          exit_code = 127
-          wait_thr_ref = nil
-
-          begin
-            Timeout.timeout(timeout) do
-              Open3.popen3(*docker_args) do |stdin, stdout, stderr, wait_thr|
-                wait_thr_ref = wait_thr
-                begin
-                  stdin.close
-                rescue StandardError
-                  nil
-                end
-                t_out = Thread.new do
-                  stdout.read
-                rescue StandardError
-                  ""
-                end
-                t_err = Thread.new do
-                  stderr.read
-                rescue StandardError
-                  ""
-                end
-                begin
-                  stdout_str = t_out.value.to_s
-                  stderr_str = t_err.value.to_s
-                  status = wait_thr.value
-                  exit_code = status.exitstatus || (status.signaled? ? (128 + (status.termsig || 1)) : 1)
-                ensure
-                  begin
-                    t_out.kill
-                  rescue StandardError
-                    nil
-                  end
-                  begin
-                    t_err.kill
-                  rescue StandardError
-                    nil
-                  end
-                end
-              end
-            end
-          rescue Timeout::Error
-            Rubik::Platform.kill_tree(wait_thr_ref.pid) if wait_thr_ref.respond_to?(:pid) && wait_thr_ref.pid
-            system("docker rm -f #{container_name} > #{Rubik::Platform.dev_null} 2>&1")
-            stderr_str = "Docker sandbox execution timed out after #{timeout} seconds"
-            exit_code = 124
-          rescue StandardError => e
-            stderr_str = "Docker sandbox error: #{e.message}"
-            exit_code = 1
+          res = begin
+            Rubik::Platform.popen_capture(
+              *docker_args,
+              timeout: timeout,
+              chdir: workspace,
+              timeout_message: "Docker sandbox execution timed out after #{timeout} seconds",
+              error_message: "Docker sandbox error"
+            )
           ensure
-            Rubik::Platform.kill_tree(wait_thr_ref.pid) if wait_thr_ref.respond_to?(:pid) && wait_thr_ref.pid
             system("docker rm -f #{container_name} > #{Rubik::Platform.dev_null} 2>&1")
           end
 
-          duration = Time.now - start_time
           {
-            ok: exit_code.zero?,
-            exit_code: exit_code,
-            stdout: stdout_str,
-            stderr: stderr_str,
-            output: [stdout_str, stderr_str].reject(&:empty?).join("\n"),
-            duration: duration.round(4),
+            ok: res[:ok],
+            exit_code: res[:exit_code],
+            stdout: res[:stdout],
+            stderr: res[:stderr],
+            output: res[:output],
+            duration: res[:duration],
             driver: "docker"
           }
         end

data/lib/rubik/sandbox/driver/podman.rb

@@ -16,7 +16,6 @@ module Rubik
         end
 
         def run(cmd, timeout: 15, chdir: Dir.pwd, allow_network: false, memory_limit_mb: 512, cpus: "1.0")
-          start_time = Time.now
           image = @options[:image] || DEFAULT_IMAGE
           workspace = File.expand_path(chdir)
 
@@ -32,63 +31,21 @@ module Rubik
           podman_args.push("--network", "none") unless allow_network
           podman_args.push(image, "sh", "-c", cmd)
 
-          stdout_str = ""
-          stderr_str = ""
-          exit_code = 127
+          res = Rubik::Platform.popen_capture(
+            *podman_args,
+            timeout: timeout,
+            chdir: workspace,
+            timeout_message: "Podman sandbox execution timed out after #{timeout} seconds",
+            error_message: "Podman sandbox error"
+          )
 
-          begin
-            Timeout.timeout(timeout) do
-              Open3.popen3(*podman_args) do |stdin, stdout, stderr, wait_thr|
-                begin
-                  stdin.close
-                rescue
-                  nil
-                end
-                t_out = Thread.new do
-                  stdout.read
-                rescue
-                  ""
-                end
-                t_err = Thread.new do
-                  stderr.read
-                rescue
-                  ""
-                end
-                begin
-                  stdout_str = t_out.value.to_s
-                  stderr_str = t_err.value.to_s
-                  status = wait_thr.value
-                  exit_code = status.exitstatus || (status.signaled? ? (128 + (status.termsig || 1)) : 1)
-                ensure
-                  begin
-                    t_out.kill
-                  rescue
-                    nil
-                  end
-                  begin
-                    t_err.kill
-                  rescue
-                    nil
-                  end
-                end
-              end
-            end
-          rescue Timeout::Error
-            stderr_str = "Podman sandbox execution timed out after #{timeout} seconds"
-            exit_code = 124
-          rescue StandardError => e
-            stderr_str = "Podman sandbox error: #{e.message}"
-            exit_code = 1
-          end
-
-          duration = Time.now - start_time
           {
-            ok: exit_code.zero?,
-            exit_code: exit_code,
-            stdout: stdout_str,
-            stderr: stderr_str,
-            output: [stdout_str, stderr_str].reject(&:empty?).join("\n"),
-            duration: duration.round(4),
+            ok: res[:ok],
+            exit_code: res[:exit_code],
+            stdout: res[:stdout],
+            stderr: res[:stderr],
+            output: res[:output],
+            duration: res[:duration],
             driver: "podman"
           }
         end

data/lib/rubik/sandbox/driver/process.rb

@@ -15,80 +15,28 @@ module Rubik
         end
 
         def run(cmd, timeout: 15, chdir: Dir.pwd, allow_network: false, memory_limit_mb: 512, cpus: "1.0") # rubocop:disable Lint/UnusedMethodArgument -- sürücü arayüzü kwarg'leri korunuyor
-          start_time = Time.now
-          stdout_str = ""
-          stderr_str = ""
-          exit_code = 127
-
-          # Explicit-argv spawn (Plan 55 D-1): never leave interpreter choice
-          # to Open3's string form — on Windows that silently means cmd.exe.
           resolved = ShellResolver.resolve(cmd, preference: @options[:shell] || "auto")
-
           env = {}
-          # Direct host execution does NOT inject misleading dead proxy variables (127.0.0.1:9999).
-          # Hardware/namespace network isolation is only provided when a true sandbox
-          # (Bubblewrap, Docker, Podman) is enabled.
 
-          pid = nil
-          begin
-            Timeout.timeout(timeout) do
-              Open3.popen3(env, *spawn_args_for(resolved, cmd), chdir: chdir) do |stdin, stdout, stderr, wait_thr|
-                pid = wait_thr.pid
-                begin
-                  stdin.close
-                rescue
-                  nil
-                end
-                t_out = Thread.new do
-                  stdout.read
-                rescue
-                  ""
-                end
-                t_err = Thread.new do
-                  stderr.read
-                rescue
-                  ""
-                end
-                begin
-                  stdout_str = t_out.value.to_s
-                  stderr_str = t_err.value.to_s
-                  status = wait_thr.value
-                  exit_code = status.exitstatus || (status.signaled? ? (128 + (status.termsig || 1)) : 1)
-                ensure
-                  begin
-                    t_out.kill
-                  rescue
-                    nil
-                  end
-                  begin
-                    t_err.kill
-                  rescue
-                    nil
-                  end
-                end
-              end
-            end
-          rescue Timeout::Error
-            Rubik::Platform.kill_tree(pid) if pid
-            stderr_str = "Execution timed out after #{timeout} seconds"
-            exit_code = 124
-          rescue StandardError => e
-            stderr_str = "Execution error: #{e.message}"
-            exit_code = 1
-          end
+          res = Rubik::Platform.popen_capture(
+            env,
+            *spawn_args_for(resolved, cmd),
+            timeout: timeout,
+            chdir: chdir
+          )
 
-          duration = Time.now - start_time
-          stderr_out = resolved[:note] ? "#{resolved[:note]}\n#{stderr_str}" : stderr_str
+          stderr_out = resolved[:note] ? "#{resolved[:note]}\n#{res[:stderr]}" : res[:stderr]
           require_relative "../../security/redactor" unless defined?(Rubik::Security::Redactor)
-          clean_stdout = Rubik::Security::Redactor.redact(stdout_str)
+          clean_stdout = Rubik::Security::Redactor.redact(res[:stdout])
           clean_stderr = Rubik::Security::Redactor.redact(stderr_out)
+
           {
-            ok: exit_code.zero?,
-            exit_code: exit_code,
+            ok: res[:ok],
+            exit_code: res[:exit_code],
             stdout: clean_stdout,
             stderr: clean_stderr,
             output: [clean_stdout, clean_stderr].reject(&:empty?).join("\n"),
-            duration: duration.round(4),
+            duration: res[:duration],
             driver: "process",
             shell: resolved[:shell]
           }

data/lib/rubik/security/blocked_guidance.rb

@@ -59,6 +59,25 @@ module Rubik
                     "If genuinely required and safe, the operator can allowlist it once:",
                     "  !allow-cmd add #{quoted}"
                   ]
+                elsif kind == :classifier_error
+                  # AST walk crashed (fail-closed): the command was never
+                  # classified, so no rule matched — blame-free guidance
+                  # plus the explicit statement that AST evaluation failed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be evaluated (classifier error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist the exact simple command once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
+                elsif kind == :parse_ambiguous
+                  # Tree-sitter reported syntax errors: a partial verdict is
+                  # not a verdict — the command was blocked unparsed.
+                  [
+                    "Security blocked: #{message}",
+                    "The command AST could not be fully parsed (tree-sitter syntax error), so the command was not classified.",
+                    "If genuinely required and safe, the operator can allowlist it once:",
+                    "  !allow-cmd add #{quoted}"
+                  ]
                 elsif cmd && err.respond_to?(:probe_like) && err.probe_like
                   # Probe branch first: `python3 --version` is probe-shaped and
                   # must not be hijacked by the text-munging variant below.

data/lib/rubik/security/guard.rb

@@ -109,6 +109,13 @@ module Rubik
       # whose ONLY arguments are these flags is read-only by construction.
       SAFE_PROBE_FLAGS = ["--version", "-v", "--help", "-h"].freeze
 
+      # Shell metacharacters that make a raw (AST-less) token-prefix allowlist
+      # match dishonest: they can join, redirect, substitute, or line-split
+      # the string, so "the first tokens match" would not mean "the whole
+      # simple command matches". The classifier-crash rescue only accepts a
+      # single simple command; anything else fails closed.
+      RAW_ALLOWLIST_UNSAFE_PATTERN = /[;&|<>`$(){}\[\]\\\n\r]/
+
       attr_reader :audit_log_path
 
       # Live-reconfigurable audit destination (ConfigWiring applies config
@@ -486,16 +493,55 @@ module Rubik
             )
           end
 
+          # Ambiguous parse (tree-sitter syntax errors) is a classification
+          # failure, not a pass: the walk cannot vouch for the whole
+          # expression, so a safe-looking partial verdict must not fall
+          # through to the catastrophic-only regex gate. The allowlist stays
+          # the valve because a real AST exists — every segment is checked
+          # against the operator entries.
+          if !allow_unknown && ast.parse_warnings.to_a.any?
+            allowlisted = begin
+              command_allowlisted?(ast, cmd_str: cmd_str)
+            rescue StandardError => e
+              warn "[Guard] allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+              false
+            end
+            if allowlisted
+              log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist")
+              verify_command_fallback_regex!(cmd_str)
+              return true
+            end
+            log_audit("blocked_command", command: cmd_str, reason: "parse_ambiguous",
+                                         parse_warnings: ast.parse_warnings.to_a.size)
+            raise BlockedWriteError.new(
+              "Command AST could not be fully parsed (tree-sitter syntax error); execution blocked (fail-closed): #{cmd_str}",
+              kind: :parse_ambiguous,
+              blocked_command: cmd_str,
+              rule_name: "parse_ambiguous",
+              probe_like: probe_shape?(cmd_str),
+              segment_report: nil
+            )
+          end
+
           return true if [:readonly, :local_effects, :external_effects].include?(ast.classification) && ast.parse_warnings.empty?
         rescue BlockedWriteError
           raise
         rescue StandardError => e
-          # Unconditional warn + audit trail: a classifier crash downgrades
-          # this verification to the narrow fallback regex, silently skipping
-          # allowlist/probe logic — a security-observable downgrade nobody
-          # should need RUBIK_DEBUG to notice.
-          warn "[WARN] AST classification error, falling back to regex gate: #{e.message}"
-          log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}")
+          # Unconditional warn + audit trail: a classifier crash is a
+          # security-observable downgrade nobody should need RUBIK_DEBUG to
+          # notice. The shell gate fails closed — an exception must never
+          # mint execution permission; the operator allowlist is the one
+          # sanctioned valve. The synthesis seam (allow_unknown) keeps
+          # flowing into its own deny layers (DANGEROUS_SYNTHESIS_PATTERNS
+          # + RubyVM walk), which run after this gate.
+          if allow_unknown
+            warn "[WARN] AST classification error on non-shell input, continuing to synthesis deny layers: #{e.message}"
+            log_audit("classifier_error", command: cmd_str, reason: "#{e.class}: #{e.message}",
+                                          decision: "synthesis_layers")
+          else
+            warn "[WARN] AST classification error, failing closed: #{e.class}: #{e.message}"
+            block_on_classifier_failure!(cmd_str, e)
+          end
         end
 
         verify_command_fallback_regex!(cmd_str)
@@ -685,6 +731,69 @@ module Rubik
         report ? report[:segments].size : 0
       end
 
+      # Classifier-crash gate for the shell path: structured block by
+      # default, one sanctioned rescue — an operator allowlist entry
+      # covering the exact single-command prefix (the same explicit
+      # authorization contract as the unknown-command gate). The
+      # catastrophic fallback regex still runs afterwards on the rescue
+      # path; on the block path it gets first refusal so a catastrophic
+      # command keeps its precise :dangerous_pattern reason.
+      def block_on_classifier_failure!(cmd_str, error)
+        allowlisted = begin
+          command_allowlisted_raw?(cmd_str)
+        rescue StandardError => e
+          warn "[Guard] raw allowlist evaluation failed, failing closed: #{e.class}: #{e.message}"
+          false
+        end
+        log_audit("classifier_error", command: cmd_str, reason: "#{error.class}: #{error.message}",
+                                      decision: allowlisted ? "operator_allowlist" : "blocked")
+
+        if allowlisted
+          log_audit("allowed_command", command: cmd_str, reason: "operator_allowlist_classifier_error")
+          return
+        end
+
+        verify_command_fallback_regex!(cmd_str)
+        log_audit("blocked_command", command: cmd_str, reason: "classifier_error")
+        raise BlockedWriteError.new(
+          "AST evaluation failed, so the command could not be classified; execution blocked (fail-closed): #{cmd_str}",
+          kind: :classifier_error,
+          blocked_command: cmd_str,
+          rule_name: "classifier_error",
+          probe_like: probe_shape?(cmd_str),
+          segment_report: nil
+        )
+      end
+
+      # Token-prefix allowlist check for an input whose AST does not exist
+      # (classifier crashed). Only a single simple command qualifies: with
+      # shell metacharacters present the string may hold several segments
+      # and the gate's "every segment must match" contract cannot be
+      # honored — fail closed instead of over-promising the prefix match.
+      # Quoting is handled by Shellwords; an unparseable string (unbalanced
+      # quote) fails closed.
+      def command_allowlisted_raw?(cmd_str)
+        return false if @command_allowlist.empty?
+        return false if cmd_str.match?(RAW_ALLOWLIST_UNSAFE_PATTERN)
+
+        tokens = nil
+        begin
+          tokens = Shellwords.split(cmd_str)
+        rescue ArgumentError
+          return false
+        end
+        return false if tokens.empty?
+        return false if Rubik::Security::Classifier::Matcher::BUILTIN_DANGEROUS_CMDS.include?(tokens[0].to_s)
+
+        @command_allowlist.any? do |entry|
+          next false if entry.length > tokens.length
+
+          entry.each_with_index.all? do |token, i|
+            i.zero? ? binary_allowlist_match?(tokens[i], token) : tokens[i] == token
+          end
+        end
+      end
+
       def verify_command_fallback_regex!(cmd_str)
         return true unless DANGEROUS_COMMAND_PATTERNS.any? { |p| cmd_str.match?(p) }
 
@@ -699,7 +808,7 @@ module Rubik
 
       # ── Synthesis capability table (Candidate 07) ───────────────────────
       # The ONE declaration point for everything the synthesis AST walk
-      # denies (ARCHITECTURE.md §2 "single declaration point" doctrine; §8.3
+      # denies (docs/explanation/architecture.md §2 "single declaration point" doctrine; §8.3
       # "the seam is enforced where it is declared"). Each row is a capability
       # a synthesized tool must never exercise; layer fields say WHERE the
       # denial bites: