@b00dea/cockpit 0.0.0-stage → 0.1.1

package/libexec/browser-operation.cjs

@@ -0,0 +1,270 @@
+'use strict'
+
+// Drives one browser operation for packages/cockpit/src/browser/surfaces.ts through the project's own
+// Playwright module: navigate to a surface, then report it or save a screenshot into the artifact
+// root. Runs from a staged snapshot, so it must stay self-contained.
+//
+// argv: named flags (--operation, --engine, --connection, --url, --origin, --timeout, --module,
+// --module-proof, --control-authorities, --control-ports, --screenshot-limit, and the screenshot
+// artifact flags); see operationStep in surfaces.ts for the full set.
+// stdout on success: one JSON 'cockpit-browser-observation/v1' object. A drive observation also carries
+// per-route diagnostics: counts of console errors, uncaught page errors and failed or >= 400 requests to
+// the application origin, a count of warnings, aborted requests and third-party traffic, and a capped
+// list of entries. Entries hold only identifiers: a request's method, URL path (no query) and status or
+// network error code; a console error's script path and line; an uncaught error's class name. Bodies,
+// headers and cookies are never read. Message text is read only when cockpit passes --messages, which it
+// does only for a data posture that is isolated, not restored and not reaching production; the drive
+// observation then carries a capped `messages` list of console error and uncaught error text.
+// stderr on failure: one JSON 'cockpit-browser-failure/v1' object naming the phase and its category,
+// and, when one is known, a fixed-vocabulary reason (a browser network error code such as
+// ERR_CONNECTION_REFUSED, HTTP_<status> or TIMEOUT), exit code 1. The failure deliberately carries no
+// error text: page content, URLs and storage state must not leak into cockpit's output.
+//
+// Requests to cockpit's own browser-control authorities and nested top-level navigations are blocked
+// so the page under test cannot reach the control plane that drives it. Requests to a loopback or
+// resolver-mapped host outside the application origin are blocked too: such an address is the host
+// (through the remote runner's network exposure, or directly for a local browser), and the operation
+// was given only the application. Playwright does not route a request the browser follows as a
+// redirect, so a redirect to another loopback port still reaches it; this blocks direct requests only.
+const fs = require('node:fs')
+const crypto = require('node:crypto')
+const path = require('node:path')
+const args = process.argv.slice(2)
+const one = name => { const index = args.indexOf(name); if (index < 0 || index + 1 >= args.length) throw new Error('missing argument'); return args[index + 1] }
+const digest = bytes => crypto.createHash('sha256').update(bytes).digest('hex')
+const MAX_ENTRIES = 20
+const MAX_PATH = 200
+const MAX_MESSAGES = 5
+const MAX_MESSAGE_BYTES = 240
+const SETTLE_MS = 1000
+// Records what the page did wrong; what it said only with withMessages: see the stdout contract above.
+function collectDiagnostics(page, origin, withMessages) {
+    const counts = { consoleErrors: 0, consoleWarnings: 0, pageErrors: 0, failedRequests: 0, abortedRequests: 0 }
+    const thirdParty = { requests: 0, failed: 0 }
+    const entries = []
+    let omitted = 0
+    const messages = []
+    // Control characters are replaced so message text stays one line of plain text; the cap is in bytes.
+    const excerpt = value => {
+        // A character is at least one byte, so the first MAX_MESSAGE_BYTES characters hold the longest prefix within the cap.
+        let text = String(value).replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, MAX_MESSAGE_BYTES)
+        while (Buffer.byteLength(text) > MAX_MESSAGE_BYTES) text = text.slice(0, -1)
+        return text
+    }
+    const keep = (kind, value) => { if (withMessages && messages.length < MAX_MESSAGES) { const text = excerpt(value); if (text) messages.push({ kind, text }) } }
+    const add = entry => { if (entries.length < MAX_ENTRIES) entries.push(entry); else omitted += 1 }
+    // `new URL` throws TypeError for an address it cannot parse; anything else is a real fault.
+    const parse = value => {
+        let parsed
+        try { parsed = new URL(value) } catch (error) { if (error instanceof TypeError) return undefined; throw error }
+        return ['http:', 'https:'].includes(parsed.protocol) ? parsed : undefined
+    }
+    const pathOf = parsed => parsed.pathname.slice(0, MAX_PATH)
+    page.on('console', message => {
+        if (message.type() === 'warning') counts.consoleWarnings += 1
+        if (message.type() !== 'error') return
+        counts.consoleErrors += 1
+        keep('console', message.text())
+        const location = message.location()
+        const parsed = location && typeof location.url === 'string' ? parse(location.url) : undefined
+        const own = parsed && parsed.origin === origin
+        add({ kind: 'console', ...(own ? { path: pathOf(parsed) } : {}),
+            ...(own && Number.isInteger(location.lineNumber) && location.lineNumber >= 0 ? { line: location.lineNumber } : {}) })
+    })
+    page.on('pageerror', error => {
+        counts.pageErrors += 1
+        keep('pageerror', error && typeof error.message === 'string' ? error.message : 'uncaught error')
+        add({ kind: 'pageerror', name: error && typeof error.name === 'string' && /^[A-Za-z0-9_$.]{1,64}$/.test(error.name) ? error.name : 'Error' })
+    })
+    page.on('request', request => { const parsed = parse(request.url()); if (parsed && parsed.origin !== origin) thirdParty.requests += 1 })
+    page.on('requestfailed', request => {
+        const parsed = parse(request.url())
+        if (!parsed) return
+        const failure = request.failure()
+        const code = failure && typeof failure.errorText === 'string' ? /net::(ERR_[A-Z0-9_]{1,64})\b/.exec(failure.errorText) : null
+        // A request the browser cancelled itself, such as one left behind by a navigation, is not a failure.
+        if (code && code[1] === 'ERR_ABORTED') { counts.abortedRequests += 1; return }
+        if (parsed.origin !== origin) { thirdParty.failed += 1; return }
+        counts.failedRequests += 1
+        add({ kind: 'request', method: request.method(), path: pathOf(parsed), failure: code ? code[1] : 'ERR_UNKNOWN' })
+    })
+    page.on('response', response => {
+        const status = response.status()
+        if (status < 400) return
+        const request = response.request()
+        // A main-document failure already refuses the drive, so it is not reported twice.
+        if (request.isNavigationRequest() && request.frame() === page.mainFrame()) return
+        const parsed = parse(response.url())
+        if (!parsed) return
+        if (parsed.origin !== origin) { thirdParty.failed += 1; return }
+        counts.failedRequests += 1
+        add({ kind: 'request', method: request.method(), path: pathOf(parsed), status })
+    })
+    return () => ({ ...counts, thirdParty, entries, omitted, ...(withMessages ? { messages } : {}) })
+}
+async function main() {
+    const moduleProof = fs.readFileSync(one('--module-proof'))
+    const modulePath = one('--module')
+    const moduleBytes = fs.readFileSync(modulePath)
+    if (digest(moduleProof) !== digest(moduleBytes)) throw new Error('module changed')
+    const api = require(modulePath)
+    const engine = one('--engine')
+    const browserType = api && api[engine]
+    const connection = one('--connection')
+    if (!['chromium', 'firefox', 'webkit'].includes(engine) || !browserType
+            || connection === 'remote' && typeof browserType.connect !== 'function'
+            || connection === 'local' && typeof browserType.launch !== 'function') throw new Error('browser module lacks selected engine operation')
+    const operation = one('--operation')
+    const url = one('--url')
+    const timeout = Number(one('--timeout'))
+    const deadline = Date.now() + timeout
+    const remaining = () => { const value = deadline - Date.now(); if (value <= 0) throw new Error('browser operation deadline expired'); return value }
+    const resolverRule = args.includes('--resolver-rule') ? one('--resolver-rule') : undefined
+    const categories = { connect: 'availability', context: 'setup', navigation: 'navigation',
+        screenshot: 'observation', artifact: 'artifact', cleanup: 'cleanup' }
+    let browser, context, page, observation, failurePhase, failureReason, httpStatus, cleanupFailed = false, phase = 'connect'
+    try {
+        browser = connection === 'remote'
+            ? await browserType.connect(one('--endpoint'), { timeout: remaining(), exposeNetwork: one('--expose-network') })
+            : await browserType.launch({ headless: true, timeout: remaining(),
+                    ...(resolverRule ? { args: ['--host-resolver-rules=' + resolverRule] } : {}) })
+        phase = 'context'
+        const state = process.env.COCKPIT_BROWSER_STORAGE_STATE
+        const stateProof = state ? fs.readFileSync(one('--state-proof')) : undefined
+        if (state && digest(fs.readFileSync(state)) !== digest(stateProof)) throw new Error('storage state changed')
+        const storageState = stateProof ? JSON.parse(stateProof.toString('utf8')) : undefined
+        context = await browser.newContext({ ...(storageState ? { storageState } : {}), serviceWorkers: 'block' })
+        const controlAuthorities = new Set(JSON.parse(one('--control-authorities')))
+        const controlPorts = new Set(JSON.parse(one('--control-ports')).map(String))
+        // An address that does not parse cannot be shown to be safe, so both guards treat it as blocked
+        // rather than naming the error, which would quote the address.
+        const isControlAuthority = value => { try {
+            const parsed = new URL(value)
+            const port = parsed.port || (parsed.protocol === 'http:' || parsed.protocol === 'ws:' ? '80'
+                : parsed.protocol === 'https:' || parsed.protocol === 'wss:' ? '443' : '')
+            return controlAuthorities.has(parsed.hostname + ':' + port) || controlPorts.has(port)
+        } catch { return true } }
+        const origin = one('--origin')
+        const mappedHosts = new Set((resolverRule || '').split(',').map(rule => rule.trim().split(/\s+/))
+            .filter(parts => parts[0] === 'MAP' && parts[1]).map(parts => parts[1].toLowerCase()))
+        const isForeignHost = value => { try {
+            const parsed = new URL(value)
+            const scheme = { 'ws:': 'http:', 'wss:': 'https:' }[parsed.protocol] || parsed.protocol
+            if (!['http:', 'https:'].includes(scheme) || new URL(scheme + '//' + parsed.host).origin === origin) return false
+            const hostname = parsed.hostname
+            return hostname === 'localhost' || hostname.endsWith('.localhost') || /^127\./.test(hostname) || hostname === '0.0.0.0'
+                || hostname === '[::1]' || hostname.startsWith('[::ffff:7f') || mappedHosts.has(hostname)
+        } catch { return true } }
+        let mainNavigationAttempts = 0
+        await context.route('**/*', async (route, request) => {
+            if (isControlAuthority(request.url()) || isForeignHost(request.url())) return route.abort('blockedbyclient')
+            const frame = request.frame()
+            const mainNavigation = request.isNavigationRequest() && page && frame === page.mainFrame()
+            if (request.isNavigationRequest() && !mainNavigation
+                    && (!frame || typeof frame.parentFrame !== 'function' || frame.parentFrame() === null)) return route.abort('blockedbyclient')
+            if (mainNavigation) mainNavigationAttempts += 1
+            await route.continue()
+        })
+        if (typeof context.routeWebSocket !== 'function') throw new Error('browser module lacks WebSocket routing')
+        await context.routeWebSocket(() => true, webSocket => {
+            if (isControlAuthority(webSocket.url()) || isForeignHost(webSocket.url())) return webSocket.close({ code: 1008, reason: 'blocked by the cockpit browser operation' })
+            webSocket.connectToServer()
+        })
+        phase = 'navigation'
+        page = await context.newPage()
+        const diagnostics = operation === 'drive' ? collectDiagnostics(page, origin, args.includes('--messages')) : undefined
+        let documentEpoch = 0
+        let documentResponse
+        page.on('framenavigated', frame => { if (frame === page.mainFrame()) documentEpoch += 1 })
+        page.on('response', response => {
+            const request = response.request()
+            if (request.isNavigationRequest() && request.frame() === page.mainFrame()) documentResponse = response
+        })
+        const currentDocument = () => {
+            const displayed = new URL(page.url())
+            if (displayed.origin !== origin || displayed.username || displayed.password || displayed.hash) throw new Error('navigation left application origin')
+            if (!documentResponse || typeof documentResponse.ok !== 'function' || !documentResponse.ok()
+                    || typeof documentResponse.url !== 'function' || documentResponse.url() !== displayed.href) {
+                throw new Error('displayed document lacks a successful terminal HTTP response')
+            }
+            return { url: displayed.href, epoch: documentEpoch, attempts: mainNavigationAttempts }
+        }
+        const response = await page.goto(url, { timeout: remaining() })
+        if (response && typeof response.status === 'function') httpStatus = response.status()
+        if (!response || typeof response.ok !== 'function' || !response.ok()) throw new Error('navigation did not return a successful HTTP response')
+        documentResponse = response
+        const initialDocument = currentDocument()
+        if (operation === 'drive') {
+            // Errors raised just after load are findings too. An application that polls never goes idle,
+            // so running out the short wait is not a failure; any other error still propagates.
+            try { await page.waitForLoadState('networkidle', { timeout: Math.min(remaining(), SETTLE_MS) }) }
+            catch (error) { if (!error || error.name !== 'TimeoutError') throw error }
+            observation = { schema: 'cockpit-browser-observation/v1', operation, finalUrl: initialDocument.url, diagnostics: diagnostics() }
+        }
+        else if (operation === 'screenshot') {
+            phase = 'screenshot'
+            const displayedBefore = currentDocument()
+            const bytes = await page.screenshot()
+            if (!Buffer.isBuffer(bytes) || bytes.byteLength > Number(one('--screenshot-limit'))) throw new Error('screenshot observation exceeds bound')
+            const displayedAfter = currentDocument()
+            if (displayedAfter.url !== displayedBefore.url || displayedAfter.epoch !== displayedBefore.epoch
+                    || displayedAfter.attempts !== displayedBefore.attempts) throw new Error('navigation changed during screenshot observation')
+            const output = one('--output')
+            const root = one('--artifact-root')
+            const expectedDev = Number(one('--artifact-dev'))
+            const expectedIno = Number(one('--artifact-ino'))
+            const expectedBirthtimeNs = one('--artifact-birthtime-ns')
+            phase = 'artifact'
+            if (path.dirname(output) !== root || path.basename(output) !== one('--output-name')) throw new Error('screenshot output escaped root')
+            let rootDescriptor, dotDescriptor, descriptor
+            try {
+                rootDescriptor = fs.openSync(root, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+                const held = fs.fstatSync(rootDescriptor)
+                const named = fs.lstatSync(root)
+                // ext4 reuses a freed inode for the next directory created, so a root recreated since
+                // planning can carry the planned device and inode; birth time tells the two apart.
+                if (!held.isDirectory() || named.isSymbolicLink() || held.dev !== expectedDev || held.ino !== expectedIno
+                    || String(fs.fstatSync(rootDescriptor, { bigint: true }).birthtimeNs) !== expectedBirthtimeNs
+                    || named.dev !== held.dev || named.ino !== held.ino) throw new Error('artifact root changed')
+                process.chdir(root)
+                dotDescriptor = fs.openSync('.', fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+                const anchored = fs.fstatSync(dotDescriptor)
+                if (anchored.dev !== held.dev || anchored.ino !== held.ino) throw new Error('artifact root changed')
+                descriptor = fs.openSync(one('--output-name'), fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600)
+                fs.fchmodSync(descriptor, 0o600); fs.writeFileSync(descriptor, bytes); fs.fsyncSync(descriptor)
+                const after = fs.fstatSync(dotDescriptor)
+                if (after.dev !== held.dev || after.ino !== held.ino) throw new Error('artifact root changed')
+            } finally {
+                if (descriptor !== undefined) fs.closeSync(descriptor)
+                if (dotDescriptor !== undefined) fs.closeSync(dotDescriptor)
+                if (rootDescriptor !== undefined) fs.closeSync(rootDescriptor)
+            }
+            observation = { schema: 'cockpit-browser-observation/v1', operation, finalUrl: displayedAfter.url, evidence: { sha256: digest(bytes), byteLength: bytes.byteLength } }
+        } else throw new Error('unsupported operation')
+    } catch (error) {
+        failurePhase = phase
+        // Only identifiers leave this process: Chromium's net error code, the HTTP status or a timeout.
+        const message = error && typeof error.message === 'string' ? error.message : ''
+        const network = /net::(ERR_[A-Z0-9_]{1,64})\b/.exec(message)
+        failureReason = network ? network[1]
+            : error && error.name === 'TimeoutError' ? 'TIMEOUT'
+            : phase === 'navigation' && Number.isInteger(httpStatus) && httpStatus >= 100 && httpStatus <= 599
+                && (httpStatus < 200 || httpStatus > 299) ? 'HTTP_' + httpStatus
+            : undefined
+    }
+    finally {
+        for (const value of [page, context, browser]) if (value && typeof value.close === 'function') {
+            // The failure record carries a cleanup flag and never a message, so the error is not kept.
+            try { await value.close() } catch { cleanupFailed = true }
+        }
+    }
+    if (failurePhase || cleanupFailed || !observation) {
+        const failedAt = failurePhase || 'cleanup'
+        process.stderr.write(JSON.stringify({ schema: 'cockpit-browser-failure/v1', phase: failedAt,
+            category: categories[failedAt], cleanup: cleanupFailed, ...(failurePhase && failureReason ? { reason: failureReason } : {}) }))
+        process.exitCode = 1
+        return
+    }
+    process.stdout.write(JSON.stringify(observation))
+}
+main().catch(() => { process.stderr.write('{"schema":"cockpit-browser-failure/v1","phase":"context","category":"setup","cleanup":false}'); process.exitCode = 1 })

package/libexec/fence-marker.cjs

@@ -0,0 +1,101 @@
+'use strict'
+
+// Reads and replaces the executor's fence marker: the small JSON file that records whether a fenced
+// attempt is active, terminating, terminated or cancelled. The executor
+// (packages/cockpit/src/environment-exec/execute.ts), libexec/fenced-supervisor.cjs and
+// libexec/fenced-group-runner.cjs all read it here so they agree on what an authentic marker is.
+//
+// A marker is accepted only when the bytes came from the file that is named now: it is opened without
+// following links, read whole within a small bound, and the descriptor, the named entry and the parent
+// directory must still agree afterwards. Each marker records its own device and inode, so a copy or a
+// marker renamed into place from elsewhere does not match the file it claims to be. This module
+// decides nothing about status; callers check the fields they need.
+const fs = require('node:fs')
+const path = require('node:path')
+
+const FENCE_MARKER_MAX_BYTES = 1024n
+
+function readFenceMarkerFile(markerPath) {
+    let fd
+    try {
+        fd = fs.openSync(markerPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK)
+        const before = fs.fstatSync(fd, { bigint: true })
+        if (!before.isFile() || before.size > FENCE_MARKER_MAX_BYTES) return undefined
+        const bytes = Buffer.alloc(Number(before.size) + 1)
+        const count = fs.readSync(fd, bytes, 0, bytes.length, 0)
+        const after = fs.fstatSync(fd, { bigint: true })
+        const named = fs.lstatSync(markerPath, { bigint: true })
+        const parent = fs.lstatSync(path.dirname(markerPath), { bigint: true })
+        if (count !== Number(before.size) || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size
+            || !named.isFile() || named.dev !== before.dev || named.ino !== before.ino
+            || !parent.isDirectory() || parent.isSymbolicLink()) return undefined
+        return {
+            value: JSON.parse(bytes.subarray(0, count).toString('utf8')),
+            identity: {
+                markerDev: String(before.dev), markerIno: String(before.ino),
+                parentDev: String(parent.dev), parentIno: String(parent.ino),
+            },
+        }
+    } catch {
+        // Absent, unreadable and malformed markers all mean "no authentic marker"; every caller refuses
+        // on that answer, and the fence protocol has no channel that could carry the cause further.
+        return undefined
+    } finally {
+        if (fd !== undefined) try { fs.closeSync(fd) } catch { /* the answer above does not depend on the descriptor */ }
+    }
+}
+
+// The marker the executor published for this supervisor, unchanged since the executor named it in
+// its release line. `approved` carries supervisorPid plus the four identity fields from that line.
+function readApprovedActiveMarker(fence, approved) {
+    const read = readFenceMarkerFile(fence.markerPath)
+    if (!read) return undefined
+    const { value: marker, identity } = read
+    if (marker === null || typeof marker !== 'object'
+        || marker.format !== 'cockpit-executor/v1' || marker.attemptId !== fence.attemptId
+        || marker.supervisorPid !== approved.supervisorPid || marker.status !== 'active'
+        || marker.markerDev !== approved.markerDev || marker.markerIno !== approved.markerIno
+        || marker.parentDev !== approved.parentDev || marker.parentIno !== approved.parentIno
+        || marker.markerDev !== identity.markerDev || marker.markerIno !== identity.markerIno
+        || marker.parentDev !== identity.parentDev || marker.parentIno !== identity.parentIno) return undefined
+    return marker
+}
+
+function syncDirectory(directory) {
+    const fd = fs.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+    try { fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+}
+
+// Replaces the approved active marker with one carrying `fields`, durably. The replacement is written
+// beside the marker under a name owned by `writer` and this process, and renamed over the marker only
+// if the active marker is still the approved one, so a concurrent repair or cancel is never overwritten.
+function replaceApprovedActiveMarker(fence, approved, writer, fields) {
+    const current = readApprovedActiveMarker(fence, approved)
+    if (!current) return false
+    const temporary = `${fence.markerPath}.${writer}-${process.pid}`
+    let fd
+    try {
+        fd = fs.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600)
+        const identity = fs.fstatSync(fd, { bigint: true })
+        fs.writeFileSync(fd, `${JSON.stringify({ ...current, markerDev: String(identity.dev), markerIno: String(identity.ino), ...fields })}\n`)
+        fs.fsyncSync(fd)
+        fs.closeSync(fd)
+        fd = undefined
+        if (!readApprovedActiveMarker(fence, approved)) return false
+        fs.renameSync(temporary, fence.markerPath)
+        syncDirectory(path.dirname(fence.markerPath))
+        return true
+    } catch {
+        // Before the rename, nothing landed: the active marker stays in place, which repair reads as
+        // "attempt may still run". If only the directory sync failed, the rename has happened and the
+        // replacement is what a reader now sees, but a crash may still bring the old active marker
+        // back. Either way the new status is not known durable, so the caller gets false and must not
+        // report it published; repair then reads whichever marker survives and both are safe to act on.
+        return false
+    } finally {
+        if (fd !== undefined) try { fs.closeSync(fd) } catch { /* the replacement already failed */ }
+        try { fs.unlinkSync(temporary) } catch { /* renamed into place, or never created */ }
+    }
+}
+
+module.exports = { readFenceMarkerFile, replaceApprovedActiveMarker, syncDirectory }

package/libexec/fence-marker.d.cts

@@ -0,0 +1,24 @@
+export interface FenceMarkerIdentity {
+    readonly markerDev: string
+    readonly markerIno: string
+    readonly parentDev: string
+    readonly parentIno: string
+}
+
+export interface FenceMarkerLocation {
+    readonly attemptId: string
+    readonly markerPath: string
+}
+
+export interface ApprovedFenceMarker extends FenceMarkerIdentity {
+    readonly supervisorPid: number
+}
+
+export function readFenceMarkerFile(markerPath: string): { readonly value: unknown; readonly identity: FenceMarkerIdentity } | undefined
+export function replaceApprovedActiveMarker(
+    fence: FenceMarkerLocation,
+    approved: ApprovedFenceMarker,
+    writer: string,
+    fields: Readonly<Record<string, unknown>>,
+): boolean
+export function syncDirectory(directory: string): void

package/libexec/fenced-group-runner.cjs

@@ -0,0 +1,77 @@
+'use strict'
+
+// Runs one fenced action as the leader of its own process group, under libexec/fenced-supervisor.cjs.
+//
+// argv: <config>, base64url JSON { command, args, argv0, cwd, spawnNotAfter, fence, approved }, where
+// `approved` is the active marker the executor published ({ supervisorPid, markerDev, markerIno,
+// parentDev, parentIno }).
+// fd 3 to the supervisor: 'EXPIRED\n' when the spawn deadline had passed (the action never starts),
+// otherwise exactly one 'DONE <exit code>\n' when the action closes.
+// stdin from the supervisor: 'STOP\n' stops the group. Any other input, or stdin closing without it,
+// means the supervisor is gone: the runner then records a 'terminating' marker naming its group, so
+// a later repair can prove the group ended, before it stops the group itself.
+const { spawn } = require('node:child_process')
+const fs = require('node:fs')
+const path = require('node:path')
+const { replaceApprovedActiveMarker, syncDirectory } = require('./fence-marker.cjs')
+
+const STOP_KILL_DELAY_MS = 50
+
+const config = JSON.parse(Buffer.from(process.argv[2], 'base64url').toString('utf8'))
+const { fence, approved } = config
+
+// The group ends only through SIGKILL below, after the action had its SIGTERM; a stray terminal
+// signal must not take the runner down and orphan the action outside its fence.
+process.on('SIGTERM', () => {})
+process.on('SIGINT', () => {})
+
+const expired = config.spawnNotAfter !== undefined && Date.now() > Date.parse(config.spawnNotAfter)
+const child = expired ? undefined : spawn(config.command, config.args, {
+    argv0: config.argv0, cwd: config.cwd, env: process.env, stdio: ['ignore', 'inherit', 'inherit'],
+})
+let reported = false
+const report = code => {
+    if (reported) return
+    reported = true
+    fs.writeSync(3, `DONE ${Number.isInteger(code) ? code : 1}\n`)
+}
+if (expired) fs.writeSync(3, 'EXPIRED\n')
+else {
+    child.once('error', () => report(1))
+    child.once('close', code => report(code))
+}
+
+function publishTerminating() {
+    if (!replaceApprovedActiveMarker(fence, approved, 'runner', { status: 'terminating', groupPid: process.pid })) return false
+    try {
+        try { fs.unlinkSync(fence.socketPath) } catch (error) { if (error.code !== 'ENOENT') return false }
+        syncDirectory(path.dirname(fence.socketPath))
+        return true
+    } catch {
+        // The 'terminating' marker is already durable; repair still waits for the socket to go.
+        return false
+    }
+}
+
+let stopping = false
+let controlled = false
+function stop(supervisorLost) {
+    if (stopping) return
+    if (supervisorLost) publishTerminating()
+    stopping = true
+    process.kill(-process.pid, 'SIGTERM')
+    setTimeout(() => process.kill(-process.pid, 'SIGKILL'), STOP_KILL_DELAY_MS)
+}
+
+let input = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+    input += chunk
+    if (stopping || !input.includes('\n')) return
+    if (input !== 'STOP\n') return stop(true)
+    controlled = true
+    stop(false)
+})
+process.stdin.on('end', () => { if (!controlled) stop(true) })
+// Keeps the runner alive after the action closes, until the supervisor sends STOP.
+setInterval(() => {}, 1000)

package/libexec/fenced-supervisor.cjs

@@ -0,0 +1,137 @@
+'use strict'
+
+// Supervises one fenced action for the executor (packages/cockpit/src/environment-exec/execute.ts) so
+// that an attempt whose executor died can still be ended and proven gone by `repairFencedExecution`.
+//
+// argv: <config>, base64url JSON { command, args, argv0, cwd, spawnNotAfter, fence }.
+// fd 3 to the executor: 'READY\n' once the repair socket listens; 'EXPIRED\n' before exiting when the
+// action was never released because its spawn deadline passed or the executor cancelled it.
+// stdin from the executor: one release line, 'GO' or 'CANCEL', then the attempt id and the device and
+// inode of the active marker and its parent directory that the executor published. Anything else exits.
+// repair socket: a client that writes the attempt id is answered { attemptId, supervisorPid } and the
+// action is stopped.
+// exit code: the action's exit code, or 125 when the fence could not be kept (protocol violation, the
+// runner lost, or no durable 'terminated' marker). The supervisor exits only after the action's process
+// group is gone and the marker reads 'terminated', so that marker proves nothing of the attempt runs.
+const { spawn } = require('node:child_process')
+const { createServer } = require('node:net')
+const fs = require('node:fs')
+const path = require('node:path')
+const { replaceApprovedActiveMarker } = require('./fence-marker.cjs')
+
+const FENCE_LOST = 125
+const GROUP_EXIT_WAIT_MS = 2000
+const RUNNER = path.join(__dirname, 'fenced-group-runner.cjs')
+
+const config = JSON.parse(Buffer.from(process.argv[2], 'base64url').toString('utf8'))
+const { fence } = config
+
+let action
+let approved
+let started = false
+let finished = false
+let terminating = false
+let expired = false
+let actionCode = 1
+
+const groupGone = pid => {
+    try { process.kill(-pid, 0); return false } catch (error) { return error.code === 'ESRCH' }
+}
+const removeSocket = () => {
+    try { fs.unlinkSync(fence.socketPath) } catch { /* already absent; repair checks absence itself */ }
+}
+const abandon = () => {
+    removeSocket()
+    process.exit(FENCE_LOST)
+}
+const publishTerminated = () => approved !== undefined && replaceApprovedActiveMarker(
+    fence, { ...approved, supervisorPid: process.pid }, 'supervisor',
+    { status: 'terminated', finishedAt: new Date().toISOString() },
+)
+
+const server = createServer(socket => {
+    let request = ''
+    socket.setEncoding('utf8')
+    socket.on('data', chunk => {
+        request += chunk
+        if (request.length > 256) return socket.destroy()
+        if (!request.includes('\n')) return
+        if (request.trim() !== fence.attemptId) return socket.destroy()
+        socket.end(`${JSON.stringify({ attemptId: fence.attemptId, supervisorPid: process.pid })}\n`)
+        terminate()
+    })
+})
+
+function finish(deadline) {
+    if (finished) return
+    if (action && !groupGone(action.pid)) {
+        if (Date.now() >= deadline) return abandon()
+        return setTimeout(() => finish(deadline), 10)
+    }
+    finished = true
+    server.close()
+    removeSocket()
+    if (!publishTerminated()) process.exit(FENCE_LOST)
+    if (expired) fs.writeSync(3, 'EXPIRED\n')
+    process.exit(actionCode)
+}
+
+function terminate(code) {
+    if (!action || terminating) return
+    terminating = true
+    actionCode = Number.isInteger(code) ? code : 1
+    // A stop line that cannot be written means the action is unreachable; abandon exits with the fence-lost status.
+    try { action.stdin.end('STOP\n') } catch { abandon() }
+}
+
+function startAction() {
+    const runnerConfig = Buffer.from(JSON.stringify({
+        command: config.command, args: config.args, argv0: config.argv0, cwd: config.cwd,
+        spawnNotAfter: config.spawnNotAfter, fence, approved: { ...approved, supervisorPid: process.pid },
+    })).toString('base64url')
+    action = spawn(process.execPath, ['--', RUNNER, runnerConfig], {
+        cwd: config.cwd, env: process.env, stdio: ['pipe', 'inherit', 'inherit', 'pipe'], detached: true,
+    })
+    let control = ''
+    action.stdio[3].setEncoding('utf8')
+    action.stdio[3].on('data', chunk => {
+        control += chunk
+        if (control.length > 64) return abandon()
+        if (!control.includes('\n')) return
+        if (control === 'EXPIRED\n') {
+            expired = true
+            return terminate(1)
+        }
+        const done = /^DONE (-?[0-9]+)\n$/.exec(control)
+        if (!done) return abandon()
+        terminate(Number(done[1]))
+    })
+    action.once('error', abandon)
+    action.once('close', () => {
+        if (!terminating) return abandon()
+        finish(Date.now() + GROUP_EXIT_WAIT_MS)
+    })
+}
+
+try { fs.unlinkSync(fence.socketPath) } catch (error) { if (error.code !== 'ENOENT') process.exit(FENCE_LOST) }
+server.listen(fence.socketPath, () => fs.writeSync(3, 'READY\n'))
+
+let release = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+    release += chunk
+    if (started || !release.includes('\n')) return
+    const fields = release.trim().split(' ')
+    if (fields.length !== 6 || (fields[0] !== 'GO' && fields[0] !== 'CANCEL') || fields[1] !== fence.attemptId
+        || fields.slice(2).some(value => !/^[0-9]+$/.test(value))) return abandon()
+    approved = { markerDev: fields[2], markerIno: fields[3], parentDev: fields[4], parentIno: fields[5] }
+    started = true
+    if (fields[0] === 'CANCEL' || config.spawnNotAfter !== undefined && Date.now() > Date.parse(config.spawnNotAfter)) {
+        expired = true
+        return finish(Date.now() + GROUP_EXIT_WAIT_MS)
+    }
+    startAction()
+})
+process.stdin.on('end', () => { if (!started) abandon() })
+process.on('SIGTERM', () => terminate(1))
+process.on('SIGINT', () => terminate(1))