yamine 0.20.0 → 0.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c48a7ce222b3ffe113f542e81d84aca45270e4c3ea4f4f7da74bd22e8d0747d7
-  data.tar.gz: 8a8c1ad0f17b8bd741723cb9d83100248c559f5c7c995d64f30abfcebfe4fa60
+  metadata.gz: 73d2fe319b2c8af2c4bf821285dc76af42705e532761a8b2351377696928a114
+  data.tar.gz: 5a92b4760142642deed0a5a0131536094ac553b79759924daa7cc2157dec90a6
 SHA512:
-  metadata.gz: c9c3ae18ac29e5a30b378d7b70c7dd6c538b9140b058f4308ee2d9e5075567cde9ea21d169d30c54808d6a06a4283d3454d2a652b4b254b40e406d2de4a7edbc
-  data.tar.gz: 594bf48948e649c390aa3aed20246abd1c0eabbd0889f2a159f3b4a35d77b0d8cf8874b1eb1f8ebb51be9b0dc4300879139b943a35bde12fbc421a789b08f809
+  metadata.gz: 859e65d51d8e417cb1c747cf2d95a8336d4266fd57347d611ca3744baf4538dde86190fc5bc46023cbf28a0c12faceb7d2e3f84895afd62617e2c78e7fd1fc46
+  data.tar.gz: 8fc48c3d08d4ef3dfb5f579f41583ce3f315c90e896289279b072a5f9e6d66013eaa2b02f66eeb8ce3e983d2d4664287aa3e868e33606bc4f687f7975cd9c25a

data/CHANGELOG.md

@@ -2,6 +2,84 @@
 
 ## [Unreleased]
 
+## [0.21.0] — 2026-09-28
+
+### Security
+
+- **The privileged service no longer runs user-writable code.** The
+  launchd/systemd unit used to execute the gem's `bin`+`lib` straight
+  out of the user's home (a version-stamped, user-writable gem
+  directory), so anything that could write those paths — a gem upgrade,
+  a `bundle install`, an agent editing the gem — ran as root at every
+  boot. `service install` now stages `bin`+`lib` into a root-owned
+  directory at a stable, version-independent path (`/Library/Application
+  Support/yamine` on macOS, `/usr/local/share/yamine` on Linux):
+  copied aside, ownership/modes locked, verified fail-closed (a bad
+  tree registers no unit and leaves the running daemon untouched), then
+  swung live with an atomic symlink swap plus a root-owned `VERSION`
+  marker. The unit pins only that path.
+- **The passwordless grant can no longer introduce root-executed
+  code.** `yamine sudoers` used to grant the version-stamped gem path
+  with `service install --internal` — effectively arbitrary code as
+  root for anyone who could write the gem, and stale after every
+  release. It now grants only the staged, version-independent payload:
+  `hosts sync` (the recurring agent need) and `service uninstall`
+  (which only deletes yamine's own files). Staging new root code stays
+  a human interactive sudo; a non-interactive `service install` fails
+  fast saying so. If your `/etc/sudoers.d/yamine` still pins a
+  version-stamped gem path, re-run `yamine sudoers` and replace it.
+- **`hosts sync` is strictly validated before anything is written.**
+  Route names are user-writable and the sync runs as root, so every
+  name must now be well-formed (no newline/breakout), written only
+  inside yamine's managed block, and under `.localhost` or a domain in
+  the root-owned staged allowlist. Anything else fails closed naming
+  the policy. Custom `proxy.host` domains need one human step: append
+  the parent domain to the staged `allowed-tlds` file.
+- **`yamine doctor` gains a `service` check.** It names a legacy unit
+  (payload in a user home or version-stamped gem path) with the exact
+  migration (`sudo yamine service install`), warns on staged-vs-CLI
+  version skew, fails on any root-executed path that is not root-owned
+  or is group/other-writable, and always reports the service
+  interpreter's path and writability. The legacy daemon keeps working
+  until the next elevated install.
+
+### Changed
+
+- `service install` (human, interactive, elevated) migrates a legacy
+  install in place and prints the interpreter caveat; `service
+  uninstall` removes the staged payload as well as the unit, scoped to
+  yamine's own files.
+- Non-interactive (`sudo -n`) failure messaging points at the new
+  provisioning story: humans install the 443 service once per machine,
+  agents keep hosts entries fresh through the grant.
+
+### Fixed
+
+- **The printed grant now matches what the CLI invokes, byte for
+  byte.** Elevated re-execs went through `env YAMINE_STATE_DIR=…`,
+  which made the command `/usr/bin/env` — a path no rule names — so
+  every passwordless attempt fell through to the password-required
+  admin rule; and the staged macOS path's space was unescaped in the
+  sudoers output, so that rule could never match either. No
+  environment crosses sudo anymore (no `env` prefix, no SETENV): the
+  root half derives the invoking user's state dir from `SUDO_USER`,
+  and spaces are backslash-escaped when the rules are printed. Pinned
+  by a parity test that parses the printed specs and asserts equality
+  with the captured elevated argv.
+- **The `--no-service` sudo daemon no longer executes the gem
+  directory as root.** A privileged `proxy start` spawns the staged
+  root-owned payload, staging it first under the same
+  human-authorized sudo (`service stage --internal`, never granted)
+  when missing. The unprivileged spawn path is unchanged.
+
+### Open caveat (not closed, stated plainly)
+- **The interpreter is still user-writable.** No root-owned Ruby ≥ 3.2
+  exists on a stock machine, so the daemon necessarily runs the
+  invoking (user-writable) Ruby. The payload is root-owned; the
+  interpreter is not. Doctor reports it truthfully and the README says
+  so. Fixed only by a root-owned Ruby new enough for the gem; yamine
+  will not vendor or stage an interpreter.
+
 ## [0.20.0] — 2026-09-28
 
 ### Added

data/README.md

@@ -54,21 +54,35 @@ to get back to 443.
 
 Binding 443 is privileged, so yamine installs a **root-owned launchd
 service** (macOS) or systemd unit (Linux) that binds 443 at boot — the
-same model as puma-dev and portless. Installing it needs sudo **once per
-machine**; after that, every `yamine` run in any project gets a clean
-`https://<app>.localhost` with no elevation and no prompt.
+same model as puma-dev and portless. Installing it needs an interactive
+sudo **once per machine** (one Touch ID tap); after that, every `yamine`
+run in any project gets a clean `https://<app>.localhost` with no
+elevation and no prompt.
 
-**Human (interactive):** run setup once — it trusts the CA, installs the
-service, syncs hosts, and verifies:
+**Human (interactive):** run setup once — it stages a root-owned copy of
+yamine, installs the service, trusts the CA, syncs hosts, and verifies:
 
 ```bash
 yamine setup
+# or, for just the service: sudo yamine service install
 ```
 
-**Agent / CI (no TTY):** the same commands fail fast with guidance,
-because sudo needs a terminal. To pre-provision a machine or image so
-agents can install the service without a prompt, install the scoped
-passwordless-sudo rules once (as an admin):
+The unit runs a **staged payload**, not your gem directory: the install
+copies yamine's `bin`+`lib` into a root-owned directory at a stable,
+version-independent path (`/Library/Application Support/yamine` on
+macOS, `/usr/local/share/yamine` on Linux), verifies root ownership and
+modes fail-closed (a bad tree registers nothing), and pins that path in
+the unit. Ordinary user-space writes — a gem upgrade, a `bundle
+install`, an agent editing the gem — can no longer change what runs as
+root, and upgrades never stale the setup. `yamine doctor` names a legacy
+install (a unit still pointing at a user-writable gem path) with the
+exact migration, plus staged-vs-CLI version skew and any ownership
+problem.
+
+**Agents: the steady-state grant.** New project ⇒ new hostname ⇒ Safari
+needs the `/etc/hosts` entry; that recurring privileged need stays
+agent-invocable without a prompt. Install the scoped passwordless-sudo
+rules once (as an admin):
 
 ```bash
 yamine sudoers > /tmp/yamine.sudoers
@@ -76,11 +90,41 @@ sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine
 sudo install -o root -g root -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine   # Linux
 ```
 
-`yamine sudoers` prints rules scoped to yamine's own service
-re-exec — the gem's exact ruby + bin path with the `service install
---internal` / `service uninstall --internal` subcommands — never a bare
-interpreter. Re-run it after upgrading the gem if the install path
-changes. To undo: `sudo rm /etc/sudoers.d/yamine`.
+`yamine sudoers` prints rules for the **staged payload only** — `hosts
+sync` (hostnames strictly validated: well-formed, written only inside
+yamine's managed block, and only under `.localhost` or an allowlisted
+domain) and `service uninstall` (which only deletes yamine's own
+files). Installing or upgrading the staged payload moves user-writable
+source into root-owned paths, so it deliberately stays a human
+interactive sudo — no grant will ever cover it, and a non-interactive
+`service install` fails fast saying so. To undo the grant:
+`sudo rm /etc/sudoers.d/yamine`.
+
+If you installed an older yamine, your `/etc/sudoers.d/yamine` may still
+pin a version-stamped gem path (`.../gems/yamine-X.Y.Z/...`) including
+an install rule — re-run `yamine sudoers` and replace the file. The old
+rules go stale every release (which pushed people toward `NOPASSWD:
+ALL`); the new ones survive upgrades.
+
+**Custom domains** (e.g. `proxy.host: myapp.local.example.com` for OAuth
+parity) need their parent domain allowlisted once by a human — `hosts
+sync` refuses anything outside `.localhost` and the staged allowlist,
+because an unvalidated root hosts write could point a real vendor domain
+at loopback:
+
+```bash
+echo 'local.example.com' | sudo tee -a "/Library/Application Support/yamine/allowed-tlds"   # macOS
+echo 'local.example.com' | sudo tee -a /usr/local/share/yamine/allowed-tlds                 # Linux
+```
+
+**Open caveat: the interpreter.** The unit runs the invoking Ruby, and
+there is no root-owned Ruby ≥ 3.2 on a stock machine (`/usr/bin/ruby` is
+2.6), so the daemon necessarily runs a user-writable interpreter today.
+The payload is root-owned; the interpreter is not — `yamine doctor`
+reports its path and writability truthfully. Anything that can write
+that Ruby can change what runs as root. This hole stays open until the
+machine has a root-owned Ruby new enough for the gem; yamine will not
+vendor or stage an interpreter to pretend otherwise.
 
 ## The one-file model
 

data/lib/yamine/cli/boot.rb

@@ -940,10 +940,11 @@ module Yamine
         privileged = port < 1024 && !ProxyControl.root?
         if privileged && !ctx.interactive?
           $stderr.puts "Error: proxy is not running and port #{port} needs root."
-          $stderr.puts "  Human: run this once — yamine setup"
-          $stderr.puts "  Agent/CI: pre-provision passwordless sudo once —"
-          $stderr.puts "    yamine sudoers > /tmp/yamine.sudoers"
-          $stderr.puts "    sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine"
+          $stderr.puts "  Human: run this once in a terminal — yamine setup (or: sudo yamine service install)"
+          $stderr.puts "  Agent/CI: the 443 service is installed by a human once per machine — it cannot be provisioned passwordlessly."
+          $stderr.puts "    Steady-state hosts sync works via the grant instead:"
+          $stderr.puts "      yamine sudoers > /tmp/yamine.sudoers"
+          $stderr.puts "      sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine"
           $stderr.puts "  Or start the proxy by hand: sudo yamine proxy start"
           exit 1
         end