@celilo/cli 1.14.0 → 2.1.0

package/src/hooks/mount-set.ts

@@ -17,7 +17,7 @@
  */
 
 import { dirname, isAbsolute, join, resolve } from 'node:path';
-import type { PathAccess } from '@celilo/capabilities';
+import { BROWSER_ROOT, type PathAccess } from '@celilo/capabilities';
 
 /**
  * `tmpfs` is not an access level, it is "put a fresh empty filesystem here".
@@ -105,20 +105,34 @@ export interface MountSetRequest {
   readonly runtimeModulePaths?: readonly string[];
   /** Contract-declared path inputs, already resolved to values. */
   readonly pathInputs: readonly DeclaredPathInput[];
-  /**
-   * The operator's `~/.ssh`, read-only, STAGE 2 ONLY.
-   *
-   * `remote.ts` still runs inside the hook and needs the key. Stage 3 brokers
-   * those calls and drops this row, which is what turns D12's target check
-   * from a convention into a boundary. Dropping it before stage 3 lands
-   * hardens nothing — it just stops every hook reaching its own systems.
-   */
-  readonly sshDir?: string;
 }
 
 /** Directories whose contents the runtime needs in order to start at all. */
 const RUNTIME_SUPPORT_DIRS = ['/usr/lib', '/lib', '/lib64', '/etc/ssl'] as const;
 
+/**
+ * What resolving a hostname needs. Read-only, and absent ones are dropped.
+ *
+ * Without these a jailed hook cannot resolve a NAME. `getaddrinfo` finds no
+ * nameserver, falls back to a loopback that answers nothing, and the call dies
+ * as `ETIMEOUT` — which reads as the remote endpoint being down rather than as
+ * the jail having no resolver. Measured on `namecheap`'s `validate_config`:
+ * `getaddrinfo ETIMEOUT dynamicdns.park-your-domain.com`, against an endpoint
+ * that was up and one the e2e topology answers for.
+ *
+ * This is not a widening of what a hook may reach. Design D12 already records
+ * as a residual that "a hook can still `fetch()` any HTTP endpoint directly;
+ * only `probeHttp` consults the target check" — so the network is already
+ * open, and a hook could always dial a literal IP. Withholding the resolver
+ * config did not close that door; it only made the door work for addresses and
+ * not for names, which is an accident rather than a policy.
+ *
+ * It sits beside `/etc/ssl` for the same reason that does: an outbound call
+ * needs a trust store AND a way to turn a name into an address, and binding
+ * one without the other leaves half a capability.
+ */
+const RESOLVER_FILES = ['/etc/resolv.conf', '/etc/nsswitch.conf', '/etc/hosts'] as const;
+
 /**
  * Paths that must NEVER appear in a mount set, whatever asks for them.
  *
@@ -181,6 +195,37 @@ export function deriveMountSet(request: MountSetRequest): MountSet {
   for (const dir of RUNTIME_SUPPORT_DIRS) {
     entries.push(entry(dir, 'ro', 'shared libraries and trust store'));
   }
+  for (const file of RESOLVER_FILES) {
+    entries.push(entry(file, 'ro', 'name resolution — see RESOLVER_FILES'));
+  }
+  // The fleet browser, read-only (task 4.10).
+  //
+  // `BROWSER_ROOT` rather than `~/.cache/ms-playwright`, which is what task 4.10
+  // says to bind and is now the wrong path: `managed-browser-runtime` moved the
+  // browser into a celilo-owned tree and `resolveBrowser()` is what a hook asks
+  // for it. Binding the cache would bind a directory nothing launches from.
+  //
+  // Read-only because a hook has no business writing to the shared browser
+  // install, and unconditional because it costs nothing when absent —
+  // `planJailedSpawn` drops a row whose source does not exist, so a host with no
+  // provisioned browser gets no row and no error. Gating it on some
+  // "this module uses a browser" signal would need a declaration that does not
+  // exist, and would fail closed in the one case that matters.
+  //
+  // Note what this does NOT bind: `/var/lib/celilo` itself stays out, so the
+  // data directory beside it is as absent as it was before. This is one
+  // subdirectory, named explicitly.
+  //
+  // ⚠️ The bind is necessary and not sufficient. Measured 2026-08-28 under a
+  // real bubblewrap jail (`hook-jail-toolchain-reach.test.ts`): Chromium with
+  // its own sandbox does NOT start inside the jail, and the same binary with
+  // `--no-sandbox` renders. Chromium's sandbox forks a helper into a new user
+  // namespace and nesting that inside bubblewrap's unprivileged one fails. So a
+  // browser hook also needs `--no-sandbox`, which belongs to whatever launches
+  // the browser rather than here. That interim landed 2026-08-31 (celilo#1215):
+  // the launch path in `test-fixtures/jail-toolchain-hook.ts` carries the flag,
+  // and `jail-browser-launch-flags.test.ts` pins it there.
+  entries.push(entry(BROWSER_ROOT, 'ro', 'the fleet browser, when one is provisioned'));
 
   // 3. The module's own tree, read-only, then its writable directories carved
   //    on top. bubblewrap resolves that in the right order, which is why the
@@ -215,16 +260,11 @@ export function deriveMountSet(request: MountSetRequest): MountSet {
     );
   }
 
-  // 6. Stage 2 only. See MountSetRequest.sshDir.
-  if (request.sshDir) {
-    entries.push(
-      entry(
-        resolve(request.sshDir),
-        'ro',
-        'remote.ts needs the key until the broker holds it (D12)',
-      ),
-    );
-  }
+  // There is deliberately NO `~/.ssh` row (stage 3, design D12). With no key
+  // in the jail, a hand-built `ssh` cannot authenticate anywhere; the remote
+  // primitives cross to the remote-ops broker instead, and withholding the
+  // key is what makes that broker's target check a boundary rather than a
+  // convention.
 
   return {
     entries: entries.filter((e) => !isForbidden(e.path)),
@@ -256,3 +296,132 @@ export function toBwrapArgs(set: MountSet): string[] {
   args.push('--chdir', set.chdir);
   return args;
 }
+
+/**
+ * Render a mount set as a `sandbox-exec` profile, in order (task 4.8).
+ *
+ * The SECOND renderer of the same derivation, alongside `toBwrapArgs`. That is
+ * the property task 4.7 asks for and the reason both live here: one
+ * computation, several consumers, so a macOS jail and a Linux jail cannot come
+ * to different conclusions about what a hook may see.
+ *
+ * **Order is semantic here for the same reason it is in `toBwrapArgs`, by a
+ * different mechanism.** SBPL is last-match-wins, so a read-write directory
+ * nested inside a read-only tree works exactly as bubblewrap's later-`--bind`-
+ * wins does. Measured 2026-08-27: with `state/` emitted after the module tree,
+ * a write to the tree gives `EPERM` and a write to `state/` succeeds.
+ *
+ * Three rules are not derived from the mount set, and each is a parity
+ * statement rather than a convenience:
+ *
+ *   - `(import bsd.sb)` supplies what any process needs to start at all —
+ *     the dyld shared cache, `file-read-metadata` for symlink traversal, the
+ *     `logd`/`cfprefsd` lookups. Without it `bun` dies before `main` with no
+ *     diagnostic (`SIGABRT`, no stderr, because stderr is denied too).
+ *   - `(allow process*)` matches bubblewrap, which does not restrict `exec`
+ *     either. A hook can run whatever it can READ, and what it can read is the
+ *     mount set. Withholding the path is the boundary in both backends.
+ *   - `(allow network*)` is D9: the network is not namespaced. D12 scopes
+ *     reachability by withholding the credential, never by filtering packets.
+ *
+ * Everything else this profile does NOT say is deliberate. `/etc` is absent
+ * because it is absent from D9's table, so on macOS a hook that resolves a
+ * hostname is not stopped by THIS profile: `(allow network*)` lets it reach
+ * the system resolver, which answers out of process in mDNSResponder
+ * (measured 2026-08-30, task 4.13's suite). Withholding `/etc/resolv.conf`
+ * does withhold resolution on Linux, where the file is the resolver's
+ * configuration. Adding `/etc` here alone is the drift task 4.7 exists to
+ * prevent.
+ *
+ * @param set - Paths already resolved through `realpath`. Not optional: a rule
+ *   naming an unresolved path does not match, and the failure is silent in
+ *   both directions (D8). Measured: with the module tree named as `/tmp/…`
+ *   rather than `/private/tmp/…` the rule does not apply, and bun cannot read
+ *   the cwd it was handed.
+ */
+export function toSandboxProfile(set: MountSet): string {
+  const lines = [
+    '(version 1)',
+    '(import "/System/Library/Sandbox/Profiles/bsd.sb")',
+    '(deny default)',
+    '(allow process*)',
+    '(allow network*)',
+  ];
+
+  // Every ANCESTOR of every mount, as a directory node and nothing more.
+  //
+  // This row has no bubblewrap counterpart and that is exactly why it exists.
+  // bubblewrap builds a new filesystem: to bind `/a/b/c` it must CREATE `/a/b`
+  // inside the namespace, so the parents come for free. `sandbox-exec` filters
+  // the tree that is already there and grants nothing implicitly, so every
+  // parent stays denied.
+  //
+  // What breaks is module resolution, and it breaks in a way that names none of
+  // this. Bun resolves a bare import by walking UP from the importing file
+  // testing each `<ancestor>/node_modules`. The shim's own `node_modules` is
+  // bound, but the directories BETWEEN are not, so the walk dies early, bun
+  // falls back to auto-install, and it tries to create `node_modules` in the
+  // read-only module tree. The message is `bun is unable to write files:
+  // PermissionDenied` — a write error for what is really a read denial three
+  // steps earlier. Measured 2026-08-27 by A/B on one variable: with a writable
+  // working directory the shim starts, with a read-only one it does not.
+  //
+  // `literal`, never `subpath`. A literal grant on a directory permits `stat`
+  // and `readdir` of that directory ALONE and confers nothing on the files in
+  // it. So `/var/celilo` becomes listable, which reveals that a file named
+  // `master.key` exists, and reading its bytes stays denied. That is the
+  // difference between D9's criterion holding and not, so do not "simplify"
+  // this to a subpath.
+  for (const path of ancestorsOf(set.entries)) {
+    lines.push(`(allow file-read* (literal ${sbplString(path)}))`);
+  }
+
+  for (const e of set.entries) {
+    // No tmpfs on macOS, and none is needed: `deny default` already makes the
+    // path unreadable, which is the privacy half of the row. The usability
+    // half — a working scratch directory — is what macOS does not get, so a
+    // hook writing to /tmp gets EPERM here and a discarded success on Linux.
+    // Louder than Linux rather than weaker, and named so nobody has to guess.
+    if (e.mode === 'tmpfs') {
+      lines.push(`; ${e.path}: no tmpfs backend; denied by default (${e.reason})`);
+      continue;
+    }
+    lines.push(`; ${e.reason}`);
+    if (e.mode === 'rw') {
+      lines.push(`(allow file-read* file-write* (subpath ${sbplString(e.path)}))`);
+      continue;
+    }
+    // The explicit deny makes `ro` mean read-only whatever preceded it, rather
+    // than relying on nothing earlier having granted write to a parent. That
+    // is true of today's derivation order and is not a property anyone should
+    // have to re-verify after editing it.
+    lines.push(`(deny file-write* (subpath ${sbplString(e.path)}))`);
+    lines.push(`(allow file-read* (subpath ${sbplString(e.path)}))`);
+  }
+
+  return `${lines.join('\n')}\n`;
+}
+
+/**
+ * Every directory strictly above one of these mounts, nearest-first order
+ * irrelevant, deduplicated. Excludes the mount paths themselves, which carry
+ * their own rules.
+ */
+function ancestorsOf(entries: readonly MountEntry[]): string[] {
+  const own = new Set(entries.map((e) => e.path));
+  const found = new Set<string>();
+  for (const e of entries) {
+    let dir = dirname(e.path);
+    while (dir !== dirname(dir)) {
+      if (!own.has(dir)) found.add(dir);
+      dir = dirname(dir);
+    }
+    found.add('/');
+  }
+  return [...found];
+}
+
+/** A path as an SBPL string literal. */
+function sbplString(path: string): string {
+  return `"${path.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}

package/src/hooks/remote-broker.test.ts

@@ -0,0 +1,350 @@
+/**
+ * The remote-ops broker, tested through the REAL asking half (tasks 5.1/5.2,
+ * design D12).
+ *
+ * Every bridged case below runs the actual `@celilo/capabilities` primitive
+ * with `CELILO_HOOK_REMOTE_SOCKET` set — in a SEPARATE process
+ * (`test-fixtures/remote-bridge-probe.ts`), because that is the only topology
+ * that exists: the bridge blocks its caller in spawnSync while celilo's event
+ * loop answers the socket, so asking and answering can never share a process.
+ * The round trip therefore exercises what a hook exercises: the primitive's
+ * bridge detection, the spawned client, the socket, the Zod parse, the
+ * policy, and the broker-side primitive — with the one seam a unit test must
+ * inject, the runner that would otherwise run ssh.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { connect } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { type MockRunner, type RunResult, createMockRunner } from '@celilo/capabilities';
+import { createCapturingLogger } from './logger';
+import { type RemoteAccessPolicy, type RemoteBroker, startRemoteBroker } from './remote-broker';
+
+const REMOTE_SOCKET_ENV = 'CELILO_HOOK_REMOTE_SOCKET';
+const PROBE = resolve(__dirname, 'test-fixtures/remote-bridge-probe.ts');
+
+const ALLOW_ALL: RemoteAccessPolicy = {
+  moduleId: 'caddy',
+  checkTarget: () => ({ allowed: true }),
+};
+
+const DENY_ALL: RemoteAccessPolicy = {
+  moduleId: 'caddy',
+  checkTarget: () => ({ allowed: false, message: 'policy says no' }),
+};
+
+/**
+ * The shape of the real policy's first rule (`services/remote-access.ts`):
+ * a request on the module's own credential is allowed, everything else is
+ * refused. Used to prove the broker computes and forwards
+ * `hasOwnCredential` — the decision itself is the policy's.
+ */
+const OWN_CREDENTIAL_ONLY: RemoteAccessPolicy = {
+  moduleId: 'generic-cpanel-hosting-provider',
+  checkTarget: (_target, hasOwnCredential) =>
+    hasOwnCredential ? { allowed: true } : { allowed: false, message: 'fleet key refused' },
+};
+
+describe('remote-ops broker', () => {
+  let scratch: string;
+  let socketDir: string;
+  let stateDir: string;
+  let broker: RemoteBroker | undefined;
+  let runner: MockRunner;
+
+  beforeEach(() => {
+    scratch = mkdtempSync(join(tmpdir(), 'celilo-remote-broker-'));
+    // Short-named like the real run directory: sun_path is 104 bytes on macOS.
+    socketDir = mkdtempSync(join(tmpdir(), 'celilo-hook-'));
+    stateDir = join(scratch, 'state');
+    mkdirSync(stateDir, { recursive: true });
+    runner = createMockRunner([
+      { match: 'ssh', result: { ok: true, stdout: 'remote-ok', stderr: '' } },
+    ]);
+  });
+
+  afterEach(() => {
+    broker?.close();
+    broker = undefined;
+    rmSync(scratch, { recursive: true, force: true });
+    rmSync(socketDir, { recursive: true, force: true });
+  });
+
+  async function start(policy: RemoteAccessPolicy | undefined): Promise<void> {
+    const { logger } = createCapturingLogger();
+    broker = await startRemoteBroker({
+      socketDir,
+      policy,
+      readableRoots: [scratch],
+      writableRoots: [stateDir],
+      logger,
+      onActivity: () => {},
+      runner: runner.run,
+    });
+  }
+
+  /** Run one primitive from a hook-shaped process; return what it returned. */
+  async function fromHookProcess<T = RunResult>(instruction: Record<string, unknown>): Promise<T> {
+    const proc = Bun.spawn({
+      cmd: [process.execPath, PROBE, JSON.stringify(instruction)],
+      env: { ...process.env, [REMOTE_SOCKET_ENV]: (broker as RemoteBroker).socketPath },
+      stdout: 'pipe',
+      stderr: 'pipe',
+    });
+    const [stdout, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ]);
+    const code = await proc.exited;
+    if (code !== 0) throw new Error(`probe exited ${code}: ${stderr}`);
+    return JSON.parse(stdout) as T;
+  }
+
+  test('bridges remoteExec end to end, and the broker builds the ssh line itself', async () => {
+    await start(ALLOW_ALL);
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '10.0.10.10' },
+      command: 'echo hi',
+    });
+
+    expect(result).toEqual({ ok: true, stdout: 'remote-ok', stderr: '' });
+    expect(runner.calls).toHaveLength(1);
+    expect(runner.calls[0]?.cmd).toContain('root@10.0.10.10');
+    expect(runner.calls[0]?.cmd).toContain("'echo hi'");
+  });
+
+  test('sugar primitives ride the bridge with no awareness of their own', async () => {
+    await start(ALLOW_ALL);
+
+    const result = await fromHookProcess({
+      op: 'serviceCtl',
+      target: { ipv4_address: '10.0.10.10' },
+      unit: 'caddy',
+      action: 'restart',
+    });
+
+    expect(result.ok).toBe(true);
+    expect(runner.calls[0]?.cmd).toContain('systemctl restart caddy');
+  });
+
+  test('a policy refusal comes back as the failed RunResult, and nothing runs', async () => {
+    await start(DENY_ALL);
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '10.0.30.7' },
+      command: 'id -un',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain('policy says no');
+    expect(runner.calls).toHaveLength(0);
+  });
+
+  test('no policy means deny, naming the gap (Rule 6.4)', async () => {
+    await start(undefined);
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '10.0.10.10' },
+      command: 'echo hi',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain('without a remote-access policy');
+    expect(runner.calls).toHaveLength(0);
+  });
+
+  test('streamBackup writes only inside the writable roots', async () => {
+    await start(ALLOW_ALL);
+
+    const inside = await fromHookProcess({
+      op: 'streamBackup',
+      target: { ipv4_address: '10.0.10.10' },
+      producerCommand: 'cat /etc/x',
+      localPath: join(stateDir, 'x'),
+    });
+    expect(inside.ok).toBe(true);
+    // The broker realpaths before it binds the containment decision to the
+    // command, so assert on the resolved path (macOS: /var → /private/var).
+    expect(runner.calls[0]?.cmd).toContain(join(realpathSync(stateDir), 'x'));
+
+    const outside = await fromHookProcess({
+      op: 'streamBackup',
+      target: { ipv4_address: '10.0.10.10' },
+      producerCommand: 'cat /etc/x',
+      localPath: join(scratch, 'not-writable'),
+    });
+    expect(outside.ok).toBe(false);
+    expect(outside.stderr).toContain('writable directories');
+    expect(runner.calls).toHaveLength(1);
+  });
+
+  test('streamBackup refuses a symlink leaf inside a writable root', async () => {
+    // The shell's `>` follows a link, so `state/evil` → anywhere would aim
+    // celilo's write outside the roots. Inside the jail the link can be
+    // dangling (the target path does not exist THERE) and still resolve on
+    // the broker's side — which is exactly why the leaf is refused rather
+    // than resolved.
+    await start(ALLOW_ALL);
+    const { symlinkSync } = await import('node:fs');
+    symlinkSync('/var/celilo/master.key', join(stateDir, 'evil'));
+
+    const result = await fromHookProcess({
+      op: 'streamBackup',
+      target: { ipv4_address: '10.0.10.10' },
+      producerCommand: 'cat /etc/x',
+      localPath: join(stateDir, 'evil'),
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain('symlink');
+    expect(runner.calls).toHaveLength(0);
+  });
+
+  test('streamRestore reads only inside the readable roots', async () => {
+    await start(ALLOW_ALL);
+    const source = join(scratch, 'payload.tar');
+    writeFileSync(source, 'bytes');
+
+    const inside = await fromHookProcess({
+      op: 'streamRestore',
+      target: { ipv4_address: '10.0.10.10' },
+      localPath: source,
+      consumerCommand: 'tar -xf -',
+    });
+    expect(inside.ok).toBe(true);
+
+    const outside = await fromHookProcess({
+      op: 'streamRestore',
+      target: { ipv4_address: '10.0.10.10' },
+      localPath: '/etc/passwd',
+      consumerCommand: 'cat',
+    });
+    expect(outside.ok).toBe(false);
+    expect(outside.stderr).toContain('readable directories');
+  });
+
+  test('an identityFile crosses as content, is materialised for the call, and is removed', async () => {
+    // A target carrying its own credential reaches the policy with
+    // hasOwnCredential=true, which the real policy's first rule allows.
+    await start(OWN_CREDENTIAL_ONLY);
+    const keyPath = join(scratch, 'own-key');
+    writeFileSync(keyPath, 'not-a-real-key\n');
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '198.51.100.7', user: 'peba-hosting', identityFile: keyPath },
+      command: 'echo hi',
+    });
+
+    expect(result.ok).toBe(true);
+    const cmd = runner.calls[0]?.cmd ?? '';
+    const materialized = cmd.match(/-i (\S*celilo-hook-identity-[^ ]*)/)?.[1];
+    expect(materialized).toBeDefined();
+    expect(materialized).not.toBe(keyPath);
+    expect(existsSync(materialized as string)).toBe(false);
+  });
+
+  test("installAuthorizedKey is brokered and its password counts as the module's own credential", async () => {
+    runner = createMockRunner([
+      { match: 'ssh-copy-id', result: { ok: true, stdout: 'installed', stderr: '' } },
+    ]);
+    // The password IS the credential: the broker reports hasOwnCredential
+    // and the policy's own-credential rule is what allows the call.
+    await start(OWN_CREDENTIAL_ONLY);
+
+    const result = await fromHookProcess({
+      op: 'installAuthorizedKey',
+      target: { ipv4_address: '198.51.100.7', user: 'peba-hosting', port: 7822 },
+      password: 'hunter2',
+    });
+
+    expect(result.ok).toBe(true);
+    expect(runner.calls[0]?.cmd).toContain('ssh-copy-id');
+    expect(runner.calls[0]?.cmd).toContain('peba-hosting@198.51.100.7');
+    // The password rides the child environment, never the command line.
+    expect(runner.calls[0]?.cmd).not.toContain('hunter2');
+  });
+
+  test('probeHttp asks the broker about the target and honours a refusal', async () => {
+    await start(DENY_ALL);
+
+    const refused = await fromHookProcess<{ healthy: boolean; failure?: string; detail: string }>({
+      op: 'probeHttpRefused',
+      target: { ipv4_address: '10.0.10.10' },
+    });
+
+    expect(refused.healthy).toBe(false);
+    expect(refused.failure).toBe('refused');
+    expect(refused.detail).toContain('policy says no');
+  });
+
+  test('probeHttp fetches when the broker allows the target', async () => {
+    await start(ALLOW_ALL);
+
+    const result = await fromHookProcess<{ healthy: boolean; detail: string }>({
+      op: 'probeHttpAllowed',
+      target: { ipv4_address: '10.0.10.10' },
+    });
+
+    expect(result).toEqual({ healthy: true, detail: 'GET http://10.0.10.10:80/ → 200' });
+  });
+
+  test('opts.env is refused on the asking side before anything crosses', async () => {
+    await start(ALLOW_ALL);
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '10.0.10.10' },
+      command: 'echo hi',
+      opts: { env: { LD_PRELOAD: '/tmp/evil.so' } },
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain('opts.env does not cross');
+    expect(runner.calls).toHaveLength(0);
+  });
+
+  test('stop() refuses further operations, which is what makes a kill real', async () => {
+    await start(ALLOW_ALL);
+    broker?.stop();
+
+    const result = await fromHookProcess({
+      op: 'remoteExec',
+      target: { ipv4_address: '10.0.10.10' },
+      command: 'echo hi',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.stderr).toContain('Hook run has ended');
+    expect(runner.calls).toHaveLength(0);
+  });
+
+  test('a malformed request line is answered, not hung on', async () => {
+    await start(ALLOW_ALL);
+
+    const answer = await new Promise<string>((resolvePromise, reject) => {
+      const socket = connect((broker as RemoteBroker).socketPath);
+      socket.setEncoding('utf-8');
+      let buffer = '';
+      socket.on('connect', () => socket.write('this is not JSON\n'));
+      socket.on('data', (chunk: string) => {
+        buffer += chunk;
+        if (buffer.includes('\n')) {
+          socket.end();
+          resolvePromise(buffer);
+        }
+      });
+      socket.on('error', reject);
+    });
+
+    const parsed = JSON.parse(answer) as { ok: boolean; stderr: string };
+    expect(parsed.ok).toBe(false);
+    expect(parsed.stderr).toContain('malformed request');
+  });
+});