@celilo/cli 1.14.0 → 2.1.0

package/src/hooks/hook-trespass.test.ts

@@ -32,6 +32,7 @@ import {
   planFallbacks,
 } from '../../../../scripts/workspace-fallback';
 import { executeHookScript, hookChildEnv } from './executor';
+import { detectJailBackend, jailPolicy } from './jail';
 import { createCapturingLogger } from './logger';
 import type { HookContext } from './types';
 
@@ -150,7 +151,7 @@ afterAll(() => {
   rmSync(scratchHome, { recursive: true, force: true });
 });
 
-async function runTrespass(): Promise<{ report: TrespassReport; lines: string[] }> {
+async function runTrespass(jail = false): Promise<{ report: TrespassReport; lines: string[] }> {
   const { logger, messages } = createCapturingLogger();
   const context: HookContext = {
     config: { sibling_module_id: 'hello-foo', other_system_ip: '' },
@@ -163,14 +164,28 @@ async function runTrespass(): Promise<{ report: TrespassReport; lines: string[]
     capabilities: {},
   };
 
-  const outputs = await executeHookScript(TRESPASS_SCRIPT, context, {
-    timeoutMs: 60_000,
-    idleTimeoutMs: 60_000,
-  });
-  return {
-    report: outputs as unknown as TrespassReport,
-    lines: messages.map((m) => m.message),
-  };
+  // The jailed run jails under `required`, not the `auto` default. ce-29z
+  // made `auto` defer on sandbox-exec until D14 exists (undeclared host-path
+  // writes would break module hooks), so the test's jail is the operator's
+  // explicit act — exactly the bypass the deferral leaves open.
+  const savedPolicy = process.env.CELILO_HOOK_JAIL;
+  if (jail) process.env.CELILO_HOOK_JAIL = 'required';
+  try {
+    const outputs = await executeHookScript(TRESPASS_SCRIPT, context, {
+      timeoutMs: 60_000,
+      idleTimeoutMs: 60_000,
+      // The module's own tree, two levels above the hook script. Absent means
+      // "run unjailed", which is what the stage 1 assertions below need.
+      ...(jail ? { jail: { modulePath: dirname(dirname(TRESPASS_SCRIPT)), pathInputs: [] } } : {}),
+    });
+    return {
+      report: outputs as unknown as TrespassReport,
+      lines: messages.map((m) => m.message),
+    };
+  } finally {
+    if (savedPolicy === undefined) delete process.env.CELILO_HOOK_JAIL;
+    else process.env.CELILO_HOOK_JAIL = savedPolicy;
+  }
 }
 
 describe('the child environment is an allow-list', () => {
@@ -178,12 +193,13 @@ describe('the child environment is an allow-list', () => {
   // complement: the six things that MUST get through, because a hook with no
   // `PATH` cannot spawn anything and one with no `HOME` breaks more than it
   // protects.
-  test('forwards the allow-list and the channel, and nothing else', () => {
+  test('forwards the allow-list and the channels, and nothing else', () => {
     process.env.CELILO_TEST_SECRET = 'must-not-cross';
     try {
-      const env = hookChildEnv('/tmp/celilo-hook-x/s');
+      const env = hookChildEnv('/tmp/celilo-hook-x/s', '/tmp/celilo-hook-x/r', undefined);
 
       expect(env.CELILO_HOOK_SOCKET).toBe('/tmp/celilo-hook-x/s');
+      expect(env.CELILO_HOOK_REMOTE_SOCKET).toBe('/tmp/celilo-hook-x/r');
       expect(env.CELILO_HOOK_PROTOCOL_VERSION).toBe('1');
       expect(env.PATH).toBe(process.env.PATH as string);
       expect(env.HOME).toBe(process.env.HOME as string);
@@ -197,9 +213,14 @@ describe('the child environment is an allow-list', () => {
         'TMPDIR',
         'CELILO_DEBUG',
         'CELILO_HOOK_SOCKET',
+        'CELILO_HOOK_REMOTE_SOCKET',
         'CELILO_HOOK_PROTOCOL_VERSION',
+        'CELILO_HOOK_MOUNT_SET',
       ]);
       expect(Object.keys(env).filter((name) => !allowed.has(name))).toEqual([]);
+      // The unjailed lint's variable is present only when there is something
+      // to lint (task 4.7). A jailed run carries nothing.
+      expect(env.CELILO_HOOK_MOUNT_SET).toBeUndefined();
     } finally {
       delete process.env.CELILO_TEST_SECRET;
     }
@@ -211,7 +232,7 @@ describe('the child environment is an allow-list', () => {
     try {
       // Absent, not the string "undefined" — which is what a naive copy
       // produces and what a shell then happily uses as a timezone.
-      expect('TZ' in hookChildEnv('/tmp/s')).toBe(false);
+      expect('TZ' in hookChildEnv('/tmp/s', '/tmp/r', undefined)).toBe(false);
     } finally {
       if (saved !== undefined) process.env.TZ = saved;
     }
@@ -245,3 +266,44 @@ describe('hook process boundary — hello-trespass gate', () => {
     expect(report.ssh_key.attempted && !report.ssh_key.succeeded).toBe(false);
   });
 });
+
+const availability = detectJailBackend();
+const jailed = availability.backend !== 'none' && jailPolicy() !== 'off';
+
+describe.skipIf(!jailed)(
+  `stage 2: the same hook, jailed (backend: ${availability.backend})`,
+  () => {
+    // Task 4.12's platform half that a Mac can run. The e2e stage
+    // (`e2e/tests/hook-jail-trespass.test.ts`) is the other one, because
+    // bubblewrap needs a Linux kernel and a container to hold it.
+    //
+    // The SAME fixture, run twice, is the whole design of this gate: the stage 1
+    // block above asserts these two trespasses SUCCEED, and this one asserts the
+    // jail refuses them. Neither reading is available from one run.
+    test('trespasses 1 and 2 are refused, and the environment is still clean', async () => {
+      const { report, lines } = await runTrespass(true);
+      console.log(['', 'hello-trespass (jailed):', ...lines.slice(1)].join('\n'));
+
+      // What stage 2 claims: celilo's data directory is not bound, so the master
+      // key is unreachable. `<store>` is not bound either, so a sibling is too.
+      expect(report.master_key.succeeded).toBe(false);
+      expect(report.sibling_write.succeeded).toBe(false);
+
+      // Unreachability, never an errno. bubblewrap removes the path and reports
+      // ENOENT; sandbox-exec denies it and reports EPERM. Pinning either one
+      // would go red on a platform whose jail works perfectly (D9).
+      expect(report.master_key.detail).toMatch(/ENOENT|EPERM/);
+
+      // Stage 1's claim has not regressed on the way to stage 2.
+      expect(report.sensitive_env).toEqual([]);
+    }, 120_000);
+
+    // Trespass 3 is deliberately NOT asserted here, and the reason is a property
+    // of this fixture rather than of the jail. `jailRequest` binds `~/.ssh` from
+    // `os.homedir()`, which on macOS reads the password database and ignores the
+    // `HOME` this file redirects — so the hook looks in the scratch home and the
+    // jail bound the real one, and the row reports a refusal that says nothing
+    // about stage 3. The e2e stage asserts it, where the two agree. Filed as
+    // celilo#1211.
+  },
+);

package/src/hooks/jail-browser-launch-flags.test.ts

@@ -0,0 +1,34 @@
+/**
+ * The jailed browser launch path starts Chromium with `--no-sandbox` (task
+ * 4.10 interim, celilo#1215).
+ *
+ * The behavioural proof lives in `hook-jail-toolchain-reach.test.ts`: with its
+ * own sandbox on, Chromium does not start inside the bubblewrap jail; with
+ * `--no-sandbox` it renders. But that run needs `CELILO_PROBE_BROWSER`, so on
+ * an ordinary host it reports "no browser supplied" and nothing would fail if
+ * the flag were dropped from the launcher. This suite is the pin that always
+ * runs: it asserts the launch args the probe hook actually uses, and it fails
+ * the moment `--no-sandbox` leaves the launch path.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { JAILED_LAUNCH_ARGS, SANDBOXED_LAUNCH_ARGS } from './test-fixtures/jail-toolchain-hook';
+
+describe('jailed browser launch flags (4.10 interim, celilo#1215)', () => {
+  test('the jailed launch path carries --no-sandbox', () => {
+    expect(JAILED_LAUNCH_ARGS).toContain('--no-sandbox');
+  });
+
+  test('the experiment arm keeps Chromium sandboxed, so the comparison stays controlled', () => {
+    expect(SANDBOXED_LAUNCH_ARGS).not.toContain('--no-sandbox');
+  });
+
+  test('the two arms differ by the sandbox flag alone', () => {
+    const onlyInJailed = JAILED_LAUNCH_ARGS.filter((arg) => !SANDBOXED_LAUNCH_ARGS.includes(arg));
+    const onlyInSandboxed = SANDBOXED_LAUNCH_ARGS.filter(
+      (arg) => !JAILED_LAUNCH_ARGS.includes(arg),
+    );
+    expect(onlyInJailed).toEqual(['--no-sandbox']);
+    expect(onlyInSandboxed).toEqual([]);
+  });
+});

package/src/hooks/jail.test.ts

@@ -18,6 +18,7 @@ import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
+  JAIL_OFF_REASON,
   type JailAvailability,
   type JailPlan,
   jailModeStorePath,
@@ -227,6 +228,37 @@ describe('the three policies', () => {
   });
 });
 
+describe('auto defers on sandbox-exec until D14 exists (ce-29z)', () => {
+  // The backend hand-built here is one no probe yields yet — task 4.8 owns
+  // the platform probe that reports it. The policy, though, is decided NOW:
+  // sandbox-exec denies (EPERM) a hook write to an undeclared host path where
+  // bubblewrap masks it into its private tmpfs, so a macOS auto jail reddens
+  // the full suite for fixtures main's Linux CI passes. Measured, ce-29z.
+  const SANDBOX_EXEC: JailAvailability = { backend: 'sandbox-exec' };
+
+  test("'auto' runs the hook unjailed and says why", () => {
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'auto', allPresent);
+    expect(p.mode).toBe('unjailed');
+    expect(p.cmd).toEqual(CMD);
+    expect(p.backend).toBe('sandbox-exec');
+    expect(p.reason).toMatch(/D14/);
+    expect(p.reason).toMatch(/CELILO_HOOK_JAIL=required/);
+  });
+
+  test("'required' is the operator's explicit act and is NOT deferred", () => {
+    // Mode only, not argv shape: the sandbox-exec spawn arm is task 4.8's.
+    // This assertion survives that landing; an argv assertion would not.
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'required', allPresent);
+    expect(p.mode).toBe('jailed');
+  });
+
+  test("'off' still declines a jail that IS available", () => {
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'off', allPresent);
+    expect(p.mode).toBe('unjailed');
+    expect(p.reason).toBe(JAIL_OFF_REASON);
+  });
+});
+
 describe('jailPolicy reads the operator’s switch', () => {
   const withEnv = <T>(value: string | undefined, fn: () => T): T => {
     const saved = process.env.CELILO_HOOK_JAIL;
@@ -367,4 +399,64 @@ describe('the mode is recorded state, not a log line (design D8)', () => {
       if (saved !== undefined) process.env.CELILO_HOOK_JAIL_MODE_PATH = saved;
     }
   });
+
+  // The write overwrites the previous record, and the self-monitor (task 4.4)
+  // reads the file on a sweep long after `recordJailMode`'s return value is
+  // gone. `lastJailed` is what keeps the transition readable.
+  test('an unjailed record remembers the jailed record it replaced (task 4.4)', () => {
+    withStore(() => {
+      recordJailMode(jailed);
+      const jailedAt = readJailMode()?.recordedAt;
+      recordJailMode(unjailed);
+      const record = readJailMode();
+      expect(record?.lastJailed?.backend).toBe('bubblewrap');
+      expect(record?.lastJailed?.recordedAt).toBe(jailedAt as string);
+    });
+  });
+
+  test('re-jailing clears the memory, so a later regression dates from the new jailed record', () => {
+    withStore(() => {
+      recordJailMode(jailed);
+      recordJailMode(unjailed);
+      recordJailMode(jailed);
+      expect(readJailMode()?.lastJailed).toBeUndefined();
+    });
+  });
+
+  test('an unjailed-to-unjailed rewrite carries the memory along', () => {
+    withStore(() => {
+      // CELILO_HOOK_JAIL=off on a host whose backend still works: mode
+      // unjailed, backend bubblewrap. The regression memory must survive the
+      // operator then losing the backend too.
+      const off: JailPlan = {
+        cmd: CMD,
+        mode: 'unjailed',
+        backend: 'bubblewrap',
+        reason: 'CELILO_HOOK_JAIL=off',
+        skipped: [],
+      };
+      recordJailMode(jailed);
+      const jailedAt = readJailMode()?.recordedAt;
+      recordJailMode(off);
+      recordJailMode(unjailed);
+      expect(readJailMode()?.lastJailed?.recordedAt).toBe(jailedAt as string);
+    });
+  });
+
+  test("another host's jailed record is a move, not a transition", () => {
+    withStore((path) => {
+      mkdirSync(join(path, '..'), { recursive: true });
+      writeFileSync(
+        path,
+        JSON.stringify({
+          mode: 'jailed',
+          backend: 'bubblewrap',
+          host: 'some-other-box',
+          recordedAt: '2026-01-01T00:00:00.000Z',
+        }),
+      );
+      recordJailMode(unjailed);
+      expect(readJailMode()?.lastJailed).toBeUndefined();
+    });
+  });
 });