yamine 0.19.0 → 0.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f7d162f5c1ad28d48339119a7a5f6c15e1d1b269a8e33a0a6f21b51d24be07f
-  data.tar.gz: 795408acb99c284062307bd7e08217af3b1806ccb0d4b6b47c2b0841e0439a83
+  metadata.gz: 73d2fe319b2c8af2c4bf821285dc76af42705e532761a8b2351377696928a114
+  data.tar.gz: 5a92b4760142642deed0a5a0131536094ac553b79759924daa7cc2157dec90a6
 SHA512:
-  metadata.gz: 05f6fc345aa7a2f2d92194d1c3095b41b16c15b3be3bfc9d5e030eb84b8b589de349129da286242abf41af3a956999946a9f6b88edc34ab87dd8424e17ae06fd
-  data.tar.gz: c33864d1addccc46714f86556310fcd19cad835525d1b3eb800d7badc5987177406f924dcc27e77b04d4363e014042f997b0b04c5a020931e8e0d0d187687b94
+  metadata.gz: 859e65d51d8e417cb1c747cf2d95a8336d4266fd57347d611ca3744baf4538dde86190fc5bc46023cbf28a0c12faceb7d2e3f84895afd62617e2c78e7fd1fc46
+  data.tar.gz: 8fc48c3d08d4ef3dfb5f579f41583ce3f315c90e896289279b072a5f9e6d66013eaa2b02f66eeb8ce3e983d2d4664287aa3e868e33606bc4f687f7975cd9c25a

data/CHANGELOG.md

@@ -2,6 +2,138 @@
 
 ## [Unreleased]
 
+## [0.21.0] — 2026-09-28
+
+### Security
+
+- **The privileged service no longer runs user-writable code.** The
+  launchd/systemd unit used to execute the gem's `bin`+`lib` straight
+  out of the user's home (a version-stamped, user-writable gem
+  directory), so anything that could write those paths — a gem upgrade,
+  a `bundle install`, an agent editing the gem — ran as root at every
+  boot. `service install` now stages `bin`+`lib` into a root-owned
+  directory at a stable, version-independent path (`/Library/Application
+  Support/yamine` on macOS, `/usr/local/share/yamine` on Linux):
+  copied aside, ownership/modes locked, verified fail-closed (a bad
+  tree registers no unit and leaves the running daemon untouched), then
+  swung live with an atomic symlink swap plus a root-owned `VERSION`
+  marker. The unit pins only that path.
+- **The passwordless grant can no longer introduce root-executed
+  code.** `yamine sudoers` used to grant the version-stamped gem path
+  with `service install --internal` — effectively arbitrary code as
+  root for anyone who could write the gem, and stale after every
+  release. It now grants only the staged, version-independent payload:
+  `hosts sync` (the recurring agent need) and `service uninstall`
+  (which only deletes yamine's own files). Staging new root code stays
+  a human interactive sudo; a non-interactive `service install` fails
+  fast saying so. If your `/etc/sudoers.d/yamine` still pins a
+  version-stamped gem path, re-run `yamine sudoers` and replace it.
+- **`hosts sync` is strictly validated before anything is written.**
+  Route names are user-writable and the sync runs as root, so every
+  name must now be well-formed (no newline/breakout), written only
+  inside yamine's managed block, and under `.localhost` or a domain in
+  the root-owned staged allowlist. Anything else fails closed naming
+  the policy. Custom `proxy.host` domains need one human step: append
+  the parent domain to the staged `allowed-tlds` file.
+- **`yamine doctor` gains a `service` check.** It names a legacy unit
+  (payload in a user home or version-stamped gem path) with the exact
+  migration (`sudo yamine service install`), warns on staged-vs-CLI
+  version skew, fails on any root-executed path that is not root-owned
+  or is group/other-writable, and always reports the service
+  interpreter's path and writability. The legacy daemon keeps working
+  until the next elevated install.
+
+### Changed
+
+- `service install` (human, interactive, elevated) migrates a legacy
+  install in place and prints the interpreter caveat; `service
+  uninstall` removes the staged payload as well as the unit, scoped to
+  yamine's own files.
+- Non-interactive (`sudo -n`) failure messaging points at the new
+  provisioning story: humans install the 443 service once per machine,
+  agents keep hosts entries fresh through the grant.
+
+### Fixed
+
+- **The printed grant now matches what the CLI invokes, byte for
+  byte.** Elevated re-execs went through `env YAMINE_STATE_DIR=…`,
+  which made the command `/usr/bin/env` — a path no rule names — so
+  every passwordless attempt fell through to the password-required
+  admin rule; and the staged macOS path's space was unescaped in the
+  sudoers output, so that rule could never match either. No
+  environment crosses sudo anymore (no `env` prefix, no SETENV): the
+  root half derives the invoking user's state dir from `SUDO_USER`,
+  and spaces are backslash-escaped when the rules are printed. Pinned
+  by a parity test that parses the printed specs and asserts equality
+  with the captured elevated argv.
+- **The `--no-service` sudo daemon no longer executes the gem
+  directory as root.** A privileged `proxy start` spawns the staged
+  root-owned payload, staging it first under the same
+  human-authorized sudo (`service stage --internal`, never granted)
+  when missing. The unprivileged spawn path is unchanged.
+
+### Open caveat (not closed, stated plainly)
+- **The interpreter is still user-writable.** No root-owned Ruby ≥ 3.2
+  exists on a stock machine, so the daemon necessarily runs the
+  invoking (user-writable) Ruby. The payload is root-owned; the
+  interpreter is not. Doctor reports it truthfully and the README says
+  so. Fixed only by a root-owned Ruby new enough for the gem; yamine
+  will not vendor or stage an interpreter.
+
+## [0.20.0] — 2026-09-28
+
+### Added
+
+- **Every proxy socket wait is bounded by an idle timeout
+  (`YAMINE_PROXY_IDLE_TIMEOUT`, default 60s).** Silence is capped,
+  total duration is not: the timer resets on each byte transferred, so
+  a slow-but-moving transfer runs as long as it needs while a stalled
+  peer or a stale keep-alive socket is dropped instead of pinning a
+  thread until the proxy stops answering.
+- **`yamine doctor` gains a "serving ca" check.** It verifies the
+  certificate the proxy actually serves against the CA now on disk and
+  names the fix when they disagree — so a regenerated CA shows up in
+  doctor instead of surfacing later as `ERR_CERT_AUTHORITY_INVALID` in
+  the browser.
+
+### Changed
+
+- **`yamine proxy start` no longer spawns a second proxy when one
+  already serves the port.** It reports that idempotently (new
+  `ProxyAlreadyRunningError`) instead of recording a dead PID over
+  real state — the shape that left the recorded PID pointing at
+  nothing while the real proxy kept serving.
+- **`yamine proxy start` on a privileged port elevates the way the
+  boot path does.** One sudo prompt when interactive, or a failure
+  pointing at `yamine setup` when not — never a doomed unprivileged
+  child that dies on `EACCES` and leaves its PID behind.
+- **`yamine proxy stop` tells the truth about a proxy it cannot
+  signal.** On a dead recorded PID it probes the port first: a proxy
+  still serving — the root launchd/systemd service, which the CLI
+  cannot kill — yields a "still serving" answer with the restart
+  command and the recorded state kept, instead of "Removed stale
+  proxy state" while the proxy kept running.
+- **`yamine clean` refuses while a proxy it cannot stop is serving.**
+  It exits 1 instead of untrusting the CA and deleting the state
+  directory out from under a live root service.
+- **A running proxy reloads the signing CA when the pair on disk
+  changes.** It re-reads the CA files and drops cached host
+  certificates, so a regenerated CA takes effect without a restart —
+  previously only a restart fixed it, and until then the proxy kept
+  signing certificates no browser trusts.
+- **The TLS handshake moved out of the acceptor into the connection
+  thread.** A client that connects and sends nothing can no longer pin
+  an acceptor; acceptors now survive per-connection errors and keep
+  accepting.
+
+### Fixed
+
+- **A spawned daemon that dies before serving fails immediately with
+  the proxy log tail instead of a timeout.** A child killed by
+  `EACCES` on a privileged port (or anything else fatal at bind)
+  used to burn the whole wait and then record a PID that was never
+  alive; it now fails fast and records nothing.
+
 ## [0.19.0] — 2026-09-27
 
 ### Added

data/README.md

@@ -54,21 +54,35 @@ to get back to 443.
 
 Binding 443 is privileged, so yamine installs a **root-owned launchd
 service** (macOS) or systemd unit (Linux) that binds 443 at boot — the
-same model as puma-dev and portless. Installing it needs sudo **once per
-machine**; after that, every `yamine` run in any project gets a clean
-`https://<app>.localhost` with no elevation and no prompt.
+same model as puma-dev and portless. Installing it needs an interactive
+sudo **once per machine** (one Touch ID tap); after that, every `yamine`
+run in any project gets a clean `https://<app>.localhost` with no
+elevation and no prompt.
 
-**Human (interactive):** run setup once — it trusts the CA, installs the
-service, syncs hosts, and verifies:
+**Human (interactive):** run setup once — it stages a root-owned copy of
+yamine, installs the service, trusts the CA, syncs hosts, and verifies:
 
 ```bash
 yamine setup
+# or, for just the service: sudo yamine service install
 ```
 
-**Agent / CI (no TTY):** the same commands fail fast with guidance,
-because sudo needs a terminal. To pre-provision a machine or image so
-agents can install the service without a prompt, install the scoped
-passwordless-sudo rules once (as an admin):
+The unit runs a **staged payload**, not your gem directory: the install
+copies yamine's `bin`+`lib` into a root-owned directory at a stable,
+version-independent path (`/Library/Application Support/yamine` on
+macOS, `/usr/local/share/yamine` on Linux), verifies root ownership and
+modes fail-closed (a bad tree registers nothing), and pins that path in
+the unit. Ordinary user-space writes — a gem upgrade, a `bundle
+install`, an agent editing the gem — can no longer change what runs as
+root, and upgrades never stale the setup. `yamine doctor` names a legacy
+install (a unit still pointing at a user-writable gem path) with the
+exact migration, plus staged-vs-CLI version skew and any ownership
+problem.
+
+**Agents: the steady-state grant.** New project ⇒ new hostname ⇒ Safari
+needs the `/etc/hosts` entry; that recurring privileged need stays
+agent-invocable without a prompt. Install the scoped passwordless-sudo
+rules once (as an admin):
 
 ```bash
 yamine sudoers > /tmp/yamine.sudoers
@@ -76,11 +90,41 @@ sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine
 sudo install -o root -g root -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine   # Linux
 ```
 
-`yamine sudoers` prints rules scoped to yamine's own service
-re-exec — the gem's exact ruby + bin path with the `service install
---internal` / `service uninstall --internal` subcommands — never a bare
-interpreter. Re-run it after upgrading the gem if the install path
-changes. To undo: `sudo rm /etc/sudoers.d/yamine`.
+`yamine sudoers` prints rules for the **staged payload only** — `hosts
+sync` (hostnames strictly validated: well-formed, written only inside
+yamine's managed block, and only under `.localhost` or an allowlisted
+domain) and `service uninstall` (which only deletes yamine's own
+files). Installing or upgrading the staged payload moves user-writable
+source into root-owned paths, so it deliberately stays a human
+interactive sudo — no grant will ever cover it, and a non-interactive
+`service install` fails fast saying so. To undo the grant:
+`sudo rm /etc/sudoers.d/yamine`.
+
+If you installed an older yamine, your `/etc/sudoers.d/yamine` may still
+pin a version-stamped gem path (`.../gems/yamine-X.Y.Z/...`) including
+an install rule — re-run `yamine sudoers` and replace the file. The old
+rules go stale every release (which pushed people toward `NOPASSWD:
+ALL`); the new ones survive upgrades.
+
+**Custom domains** (e.g. `proxy.host: myapp.local.example.com` for OAuth
+parity) need their parent domain allowlisted once by a human — `hosts
+sync` refuses anything outside `.localhost` and the staged allowlist,
+because an unvalidated root hosts write could point a real vendor domain
+at loopback:
+
+```bash
+echo 'local.example.com' | sudo tee -a "/Library/Application Support/yamine/allowed-tlds"   # macOS
+echo 'local.example.com' | sudo tee -a /usr/local/share/yamine/allowed-tlds                 # Linux
+```
+
+**Open caveat: the interpreter.** The unit runs the invoking Ruby, and
+there is no root-owned Ruby ≥ 3.2 on a stock machine (`/usr/bin/ruby` is
+2.6), so the daemon necessarily runs a user-writable interpreter today.
+The payload is root-owned; the interpreter is not — `yamine doctor`
+reports its path and writability truthfully. Anything that can write
+that Ruby can change what runs as root. This hole stays open until the
+machine has a root-owned Ruby new enough for the gem; yamine will not
+vendor or stage an interpreter to pretend otherwise.
 
 ## The one-file model
 

data/lib/yamine/certs.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require "fileutils"
 require "openssl"
 
@@ -170,23 +171,32 @@ module Yamine
     end
 
     # Build an SSLContext whose SNI callback serves the right cert per host.
+    #
+    # The CA pair on disk can be regenerated under a live proxy (`yamine
+    # clean`/`trust`/`setup` rewrite it). A proxy that keeps signing with
+    # its boot-time CA then mints leaves no browser trusts
+    # (ERR_CERT_AUTHORITY_INVALID against the new CA), so the SNI
+    # callback — which already runs per handshake — reloads the pair
+    # when it changes and drops every leaf minted from the old one.
     def server_context(dir = state_dir)
-      ca_cert, ca_key = load_ca(dir)
+      watcher = CaWatcher.new(dir)
       cache = CertCache.new(CACHE_SIZE)
+      watcher.on_reload = -> { cache.clear }
       ctx = OpenSSL::SSL::SSLContext.new
-      ctx.cert = ca_cert
-      ctx.key = ca_key
+      ctx.cert, ctx.key = watcher.current
       # ruby-openssl versions differ in how the callback receives its
       # arguments: [[socket, name]] (one array arg), (socket, name), or
       # (name). Flatten defensively — a raise inside the callback
       # surfaces as an unrecognized-name handshake alert.
       ctx.servername_cb = lambda do |*args|
         host = Array(args).flatten.last.to_s.downcase
-        entry = cache.fetch(host) do
-          cert, key = mint_host(host, ca_cert, ca_key)
-          [cert, key]
+        watcher.with_current do |ca_cert, ca_key|
+          entry = cache.fetch(host) do
+            cert, key = mint_host(host, ca_cert, ca_key)
+            [cert, key]
+          end
+          entry ? OpenSSL::SSL::SSLContext.new.tap { |c| c.cert, c.key = entry } : nil
         end
-        entry ? OpenSSL::SSL::SSLContext.new.tap { |c| c.cert, c.key = entry } : nil
       end
       ctx
     end
@@ -252,6 +262,96 @@ module Yamine
       def size
         @mutex.synchronize { @store.size }
       end
+
+      # Every entry is signed by one CA generation; a reload must not
+      # leave old-CA leaves behind to be served after the swap.
+      def clear
+        @mutex.synchronize do
+          @store.clear
+          @order.clear
+        end
+      end
+    end
+
+    # The CA pair a live server_context signs with, reloaded when the
+    # files on disk change. The hot path is two stat calls per
+    # handshake; the pair is only re-read (and the leaf cache only
+    # dropped) when a stat snapshot moves AND the digest differs, so a
+    # touch without content change costs nothing. One mutex around
+    # check+reload+mint keeps a swap from racing a handshake into a
+    # mixed pair or a stale cache hit. A failed reload keeps serving
+    # the previous CA — a raise inside the SNI callback would abort
+    # the handshake outright.
+    class CaWatcher
+      def initialize(dir)
+        @dir = dir
+        @mutex = Mutex.new
+        @cert, @key = Certs.load_ca(dir)
+        @stat = stat_snapshot
+        @digest = pair_digest
+        @on_reload = nil
+      end
+
+      # Called (once per swap, under the lock) after a reload. The
+      # server_context sets this to drop its leaf cache.
+      attr_writer :on_reload
+
+      def current
+        [@cert, @key]
+      end
+
+      def with_current
+        @mutex.synchronize do
+          reload_if_changed!
+          yield @cert, @key
+        end
+      end
+
+      private
+
+      def paths
+        Certs.ca_paths(@dir)
+      end
+
+      def stat_snapshot
+        [paths[:cert], paths[:key]].map do |path|
+          stat = File.stat(path)
+          [stat.mtime, stat.size]
+        end
+      rescue SystemCallError
+        nil
+      end
+
+      def pair_digest
+        Digest::SHA256.hexdigest(File.read(paths[:cert]) + File.read(paths[:key]))
+      rescue SystemCallError, OpenSSL::OpenSSLError
+        nil
+      end
+
+      def reload_if_changed!
+        snapshot = stat_snapshot
+        return if !snapshot.nil? && snapshot == @stat
+
+        digest = pair_digest
+        if !digest.nil? && digest == @digest
+          # Touched but unchanged: adopt the snapshot so the hot path
+          # goes back to two stats instead of a digest per handshake.
+          @stat = snapshot
+          return
+        end
+
+        # The serving SSLContext is frozen once the server accepts, so
+        # the default certificate cannot be swapped mid-flight — and it
+        # does not need to be: every real client sends SNI, and the
+        # per-host context this callback returns carries the new CA.
+        cert, key = Certs.load_ca(@dir)
+        @cert, @key = cert, key
+        @stat = stat_snapshot
+        @digest = digest || pair_digest
+        @on_reload&.call
+      rescue CertError, OpenSSL::OpenSSLError, SystemCallError
+        nil
+      end
     end
   end
 end

data/lib/yamine/cli/boot.rb

@@ -940,10 +940,11 @@ module Yamine
         privileged = port < 1024 && !ProxyControl.root?
         if privileged && !ctx.interactive?
           $stderr.puts "Error: proxy is not running and port #{port} needs root."
-          $stderr.puts "  Human: run this once — yamine setup"
-          $stderr.puts "  Agent/CI: pre-provision passwordless sudo once —"
-          $stderr.puts "    yamine sudoers > /tmp/yamine.sudoers"
-          $stderr.puts "    sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine"
+          $stderr.puts "  Human: run this once in a terminal — yamine setup (or: sudo yamine service install)"
+          $stderr.puts "  Agent/CI: the 443 service is installed by a human once per machine — it cannot be provisioned passwordlessly."
+          $stderr.puts "    Steady-state hosts sync works via the grant instead:"
+          $stderr.puts "      yamine sudoers > /tmp/yamine.sudoers"
+          $stderr.puts "      sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine"
           $stderr.puts "  Or start the proxy by hand: sudo yamine proxy start"
           exit 1
         end