@gajae-code/coding-agent 0.17.4 → 0.17.5

package/src/extensibility/gjc-plugins/runtime-adapters.ts

@@ -3,6 +3,7 @@ import type { Dirent } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { redactCrashSecrets, safeErrorDescription } from "@gajae-code/utils";
 import { bindPluginMcpToPublicNetwork } from "../../runtime-mcp/plugin-network-boundary";
 import type { MCPStdioPreparedLaunch, MCPStdioSpawnLaunch } from "../../runtime-mcp/types";
 import { loadCustomTools } from "../custom-tools/loader";
@@ -20,7 +21,13 @@ import { isV2Tool } from "./migration";
 import { gjcPluginInstallRoot, resolveWithinRoot } from "./paths";
 import { loadEffectiveGjcPluginRegistry, registryPathForScope, registryRootForScope } from "./registry";
 import { type SessionQuarantine, type SessionValidationResult, validateSessionBundles } from "./session-validation";
-import type { GjcPluginRegistryEntry, GjcPluginScope, JsonSchema202012, NormalizedToolSurfaceV2 } from "./types";
+import type {
+	GjcBundleIdentity,
+	GjcPluginRegistryEntry,
+	GjcPluginScope,
+	JsonSchema202012,
+	NormalizedToolSurfaceV2,
+} from "./types";
 
 export interface AlwaysOnPluginTools {
 	tools: CustomTool[];
@@ -32,6 +39,23 @@ export interface GjcPluginToolDeclaration extends NormalizedToolSurfaceV2 {
 	scope: GjcPluginScope;
 }
 
+export interface GjcPluginMcpServerProvenance {
+	identity: GjcBundleIdentity;
+	surfaceId: string;
+}
+
+// Plugin MCP manifests reject per-server timeout controls; generated transports
+// share one bounded window so startup evidence reaches a terminal result.
+const PLUGIN_MCP_STARTUP_TIMEOUT_MS = 5_000;
+const MAX_PLUGIN_MCP_DIAGNOSTIC_LENGTH = 1_024;
+
+/** Bound and scrub plugin-controlled MCP causes before they enter logs or runtime findings. */
+export function safePluginMcpDiagnostic(value: unknown): string {
+	const message = safeErrorDescription(value).replace(/[\u0000-\u001f\u007f-\u009f]/gu, "");
+	const normalized = message.replace(/\b(Bearer|Basic|Token)(?=[A-Za-z0-9._~+/=-]{8,})/giu, "$1 ");
+	return redactCrashSecrets(normalized).slice(0, MAX_PLUGIN_MCP_DIAGNOSTIC_LENGTH);
+}
+
 function isWithin(root: string, target: string): boolean {
 	const rel = path.relative(root, target);
 	return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
@@ -557,7 +581,9 @@ async function prepareVerifiedStdioLaunch(input: {
 		throw new Error("Authenticated plugin MCP stdio launch capsules are available only on Linux");
 	}
 	if (input.launcher === "bun") {
-		throw new Error("Authenticated plugin MCP Bun launch capsules are unavailable");
+		throw new Error(
+			"Authenticated plugin MCP Bun launch capsules are unavailable: Bun's clearable runtime plugin hooks cannot enforce the authenticated module-loading boundary required to restrict plugin imports to verified capsule bytes",
+		);
 	}
 	const registerCleanup = input.registerCleanup;
 	if (!registerCleanup) {
@@ -1045,18 +1071,22 @@ export async function renderSkillAdvertisement(input: {
  * Convert active plugin-bundle MCP surfaces into runtime MCPServerConfig entries,
  * applying install + runtime MCP policy (URL scheme/private-range deny, DNS
  * re-resolution for http/sse, stdio root-confinement) before connection. Servers
- * failing policy are quarantined and excluded. Returns {} when none.
+ * failing policy are quarantined and excluded. The provenance map contains
+ * only servers present in `configs`, so connection errors can be attributed to
+ * the authenticated bundle and stable surface that supplied each server.
  */
 export async function buildPluginMcpConfigs(input: { cwd: string }): Promise<{
 	configs: Record<string, any>;
 	quarantine: SessionQuarantine[];
+	serverProvenance: ReadonlyMap<string, GjcPluginMcpServerProvenance>;
 }> {
 	const { effective, active, quarantine } = await loadValidatedPluginRegistry(input.cwd, true);
-	if (effective.length === 0) return { configs: {}, quarantine: [] };
+	if (effective.length === 0) return { configs: {}, quarantine: [], serverProvenance: new Map() };
 
 	// A manifest-controlled MCP name such as "constructor" or "toString" must
 	// remain an ordinary own key rather than interacting with Object.prototype.
 	const configs: Record<string, any> = Object.create(null) as Record<string, any>;
+	const serverProvenance = new Map<string, GjcPluginMcpServerProvenance>();
 	for (const entry of active) {
 		const disabled = new Set(entry.disabledSurfaceIds);
 		let compiledMcps: Map<string, (typeof entry.surfaces.mcps)[number]> | undefined;
@@ -1119,7 +1149,7 @@ export async function buildPluginMcpConfigs(input: { cwd: string }): Promise<{
 						command,
 						args: initialArgs,
 						cwd: invocation.cwd,
-						timeout: 5_000,
+						timeout: PLUGIN_MCP_STARTUP_TIMEOUT_MS,
 						// Third-party plugin MCP processes must not inherit host secrets;
 						// only a minimal OS allowlist (PATH/HOME/temp/locale) is provided.
 						noInheritEnv: true,
@@ -1207,18 +1237,26 @@ export async function buildPluginMcpConfigs(input: { cwd: string }): Promise<{
 					// resolution path expands ${env:...}/shell templates, which would let
 					// a third-party bundle exfiltrate host secrets. Plugin-bundle MCP
 					// servers connect without bundle-declared headers.
-					configs[m.name] = bindPluginMcpToPublicNetwork({ type: cfg.transport, url: url.toString() });
+					configs[m.name] = bindPluginMcpToPublicNetwork({
+						type: cfg.transport,
+						url: url.toString(),
+						timeout: PLUGIN_MCP_STARTUP_TIMEOUT_MS,
+					});
 				}
+				serverProvenance.set(m.name, {
+					identity: bundleIdentity(entry.scope, entry.name),
+					surfaceId: `mcp:${m.name}`,
+				});
 			} catch (error) {
 				quarantine.push({
 					identity: bundleIdentity(entry.scope, entry.name),
 					plugin: entry.name,
 					surfaceId: m.extensionId,
 					code: "security_policy",
-					message: error instanceof Error ? error.message : String(error),
+					message: safePluginMcpDiagnostic(error),
 				});
 			}
 		}
 	}
-	return { configs, quarantine };
+	return { configs, quarantine, serverProvenance };
 }

package/src/gjc-runtime/state-writer.ts

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import type { Stats } from "node:fs";
+import { constants as fsConstants, type Stats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { type FileLockOptions, withFileLock } from "../config/file-lock";
@@ -114,6 +115,12 @@ export function guardedStateWriteReceipt(result: GuardedWriteResult): GuardedSta
 
 export interface StateWriterOptions {
 	cwd?: string;
+	/**
+	 * Linux-only private durable source publication. The supplied directory is
+	 * the exact private subtree containing the target; existing paths are never
+	 * chmodded or repaired.
+	 */
+	privateDurable?: { directory: string };
 	receipt?: StateWriterReceiptContext;
 	audit?: StateWriterAuditContext;
 	sourceRevision?: number;
@@ -149,6 +156,16 @@ export interface DeleteIfOwnedOptions extends StateWriterOptions {
 	predicate?: (current: unknown) => boolean | Promise<boolean>;
 }
 
+export class StatePublicationUncertainError extends Error {
+	constructor(
+		public readonly path: string,
+		public readonly cause: unknown,
+	) {
+		super(`state publication requires authoritative reload: ${path}`);
+		this.name = "StatePublicationUncertainError";
+	}
+}
+
 export interface DeleteResult {
 	path: string;
 	deleted: boolean;
@@ -528,13 +545,293 @@ async function atomicWrite(filePath: string, content: string): Promise<string> {
 	return filePath;
 }
 
+function currentUid(): number {
+	const uid = process.getuid?.();
+	if (uid === undefined) throw new Error("private durable publication requires a POSIX uid");
+	return uid;
+}
+
+interface PrivatePublicationDirectory {
+	handle: FileHandle;
+	parent?: PrivatePublicationDirectory;
+	name?: string;
+	dev: number;
+	ino: number;
+	privateSubtree: boolean;
+}
+
+interface PrivatePublicationContext {
+	root: string;
+	directories: PrivatePublicationDirectory[];
+	targetParent: PrivatePublicationDirectory;
+	anchoredTarget: string;
+}
+
+function assertSafePublicationDirectory(stat: Stats, directory: string, privateSubtree: boolean): void {
+	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("unsafe publication directory");
+	if ((stat.mode & 0o022) !== 0 || stat.uid !== currentUid()) {
+		const mode = (stat.mode & 0o777).toString(8);
+		throw new Error(
+			`publication parent is not exclusively owned (uid=${stat.uid}, mode=${mode}, directory=${path.basename(directory)})`,
+		);
+	}
+	if (privateSubtree && (stat.mode & 0o777) !== 0o700)
+		throw new Error("private publication directory is not owned mode 0700");
+}
+
+function procPath(handle: FileHandle): string {
+	return `/proc/self/fd/${handle.fd}`;
+}
+
+function directoryPath(directory: PrivatePublicationDirectory): string {
+	return procPath(directory.handle);
+}
+
+const LINUX_O_PATH = 0o10000000;
+
+async function readPrivateExistingStateForMutation(filePath: string): Promise<StrictMutationReadResult> {
+	let handle: FileHandle | undefined;
+	try {
+		handle = await fs.open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+		const stat = await handle.stat();
+		if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 0o777) !== 0o600 || stat.uid !== currentUid())
+			throw new Error("unsafe private publication file");
+		const parsed = JSON.parse(await handle.readFile("utf-8"));
+		if (isPlainObject(parsed)) return { kind: "valid", value: parsed };
+		return { kind: "corrupt", error: "state file must contain a JSON object" };
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return { kind: "absent" };
+		return { kind: "corrupt", error: error instanceof Error ? error.message : String(error) };
+	} finally {
+		await handle?.close();
+	}
+}
+
+async function assertPrivatePublicationDirectories(context: PrivatePublicationContext): Promise<void> {
+	for (const expected of context.directories) {
+		const current = await expected.handle.stat();
+		const directory =
+			expected.parent && expected.name ? path.join(directoryPath(expected.parent), expected.name) : context.root;
+		assertSafePublicationDirectory(current, directory, expected.privateSubtree);
+		if (current.dev !== expected.dev || current.ino !== expected.ino)
+			throw new Error("private publication directory changed during publication");
+		if (expected.parent && expected.name) {
+			const linked = await fs.lstat(path.join(directoryPath(expected.parent), expected.name));
+			if (
+				!linked.isDirectory() ||
+				linked.isSymbolicLink() ||
+				linked.dev !== expected.dev ||
+				linked.ino !== expected.ino
+			)
+				throw new Error("private publication directory changed during publication");
+		}
+	}
+	const namedRoot = await fs.lstat(context.root);
+	const root = context.directories[0];
+	if (
+		!root ||
+		!namedRoot.isDirectory() ||
+		namedRoot.isSymbolicLink() ||
+		namedRoot.dev !== root.dev ||
+		namedRoot.ino !== root.ino
+	)
+		throw new Error("private publication root changed during publication");
+}
+
+async function closePrivatePublicationContext(context: PrivatePublicationContext): Promise<void> {
+	await Promise.all(
+		context.directories
+			.splice(0)
+			.reverse()
+			.map(directory => directory.handle.close()),
+	);
+}
+
+async function preparePrivateDirectory(
+	filePath: string,
+	options: StateWriterOptions,
+): Promise<PrivatePublicationContext> {
+	if (process.platform !== "linux") throw new Error("private durable publication requires Linux");
+	const boundary = resolveGjcTarget(options.privateDurable!.directory, cwdForOptions(options));
+	if (boundary !== path.dirname(filePath)) throw new Error("private publication directory must be the target parent");
+	const root = cwdForOptions(options);
+	if ((await fs.realpath(root)) !== root) throw new Error("private publication requires canonical cwd");
+	const directories: PrivatePublicationDirectory[] = [];
+	const openFlags = fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW;
+	try {
+		const rootHandle = await fs.open(root, openFlags);
+		let rootStat: Stats;
+		try {
+			rootStat = await rootHandle.stat();
+		} catch (error) {
+			await rootHandle.close();
+			throw error;
+		}
+		directories.push({
+			handle: rootHandle,
+			dev: rootStat.dev,
+			ino: rootStat.ino,
+			privateSubtree: false,
+		});
+		assertSafePublicationDirectory(rootStat, root, false);
+		const namedRoot = await fs.lstat(root);
+		if (namedRoot.isSymbolicLink() || namedRoot.dev !== rootStat.dev || namedRoot.ino !== rootStat.ino)
+			throw new Error("private publication root changed during publication");
+
+		let parent = directories[0];
+		if (!parent) throw new Error("private publication root was not opened");
+		let directory = root;
+		for (const segment of path.relative(root, path.dirname(filePath)).split(path.sep)) {
+			const childPath = path.join(directoryPath(parent), segment);
+			directory = path.join(directory, segment);
+			let created = false;
+			try {
+				await fs.mkdir(childPath, { mode: 0o700 });
+				created = true;
+			} catch (error) {
+				if (!isErrno(error, "EEXIST")) throw error;
+			}
+			let createdIdentity: { dev: number; ino: number } | undefined;
+			if (created) {
+				const pathHandle = await fs.open(
+					childPath,
+					LINUX_O_PATH | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW,
+				);
+				try {
+					const beforeChmod = await pathHandle.stat();
+					if (!beforeChmod.isDirectory() || beforeChmod.uid !== currentUid() || (beforeChmod.mode & 0o022) !== 0)
+						throw new Error("unsafe newly created private publication directory");
+					await fs.chmod(procPath(pathHandle), 0o700);
+					const afterChmod = await pathHandle.stat();
+					if ((afterChmod.mode & 0o777) !== 0o700)
+						throw new Error("private publication directory is not owned mode 0700");
+					createdIdentity = { dev: afterChmod.dev, ino: afterChmod.ino };
+				} finally {
+					await pathHandle.close();
+				}
+			}
+			const childHandle = await fs.open(childPath, openFlags);
+			let childStat: Stats;
+			try {
+				childStat = await childHandle.stat();
+			} catch (error) {
+				await childHandle.close();
+				throw error;
+			}
+			if (createdIdentity && (childStat.dev !== createdIdentity.dev || childStat.ino !== createdIdentity.ino)) {
+				await childHandle.close();
+				throw new Error("private publication directory changed during creation");
+			}
+			const privateSubtree = directory === boundary || directory.startsWith(`${boundary}${path.sep}`);
+			const child: PrivatePublicationDirectory = {
+				handle: childHandle,
+				parent,
+				name: segment,
+				dev: childStat.dev,
+				ino: childStat.ino,
+				privateSubtree,
+			};
+			directories.push(child);
+			assertSafePublicationDirectory(childStat, directory, privateSubtree);
+			if (created || directory === boundary) {
+				// The newly linked entry is durable only after both the child and its
+				// parent have been synced. Newly created directories are chmodded first
+				// so umask cannot weaken their required mode.
+				await childHandle.sync();
+				await parent.handle.sync();
+			}
+			parent = child;
+		}
+		const targetParent = directories[directories.length - 1];
+		if (!targetParent) throw new Error("private publication target parent was not opened");
+		const context: PrivatePublicationContext = {
+			root,
+			directories,
+			targetParent,
+			anchoredTarget: path.join(directoryPath(targetParent), path.basename(filePath)),
+		};
+		await assertPrivatePublicationDirectories(context);
+		try {
+			const stat = await fs.lstat(context.anchoredTarget);
+			if (
+				!stat.isFile() ||
+				stat.isSymbolicLink() ||
+				stat.nlink !== 1 ||
+				(stat.mode & 0o777) !== 0o600 ||
+				stat.uid !== currentUid()
+			)
+				throw new Error("unsafe private publication file");
+		} catch (error) {
+			if (!isErrno(error, "ENOENT")) throw error;
+		}
+		return context;
+	} catch (error) {
+		await Promise.all(directories.reverse().map(directory => directory.handle.close().catch(() => undefined)));
+		throw error;
+	}
+}
+
+async function privateAtomicWrite(
+	filePath: string,
+	content: string,
+	options: StateWriterOptions,
+	context: PrivatePublicationContext,
+): Promise<void> {
+	await assertPrivatePublicationDirectories(context);
+	const temporary = tempPathFor(filePath);
+	const anchoredTemporary = path.join(directoryPath(context.targetParent), path.basename(temporary));
+	let renameAttempted = false;
+	try {
+		const handle = await fs.open(anchoredTemporary, "wx", 0o600);
+		try {
+			await handle.chmod(0o600);
+			const created = await handle.stat();
+			if (!created.isFile() || created.uid !== currentUid() || (created.mode & 0o777) !== 0o600)
+				throw new Error("unsafe private publication temporary file");
+			await handle.writeFile(content, "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		await assertPrivatePublicationDirectories(context);
+		renameAttempted = true;
+		await fs.rename(anchoredTemporary, context.anchoredTarget);
+		await context.targetParent.handle.sync();
+		await assertPrivatePublicationDirectories(context);
+		await maybeAudit(filePath, options);
+	} catch (error) {
+		// A rename call or anything after it can have committed the replacement
+		// before returning an error. The caller must reload instead of retrying
+		// with a new authority record.
+		if (renameAttempted) throw new StatePublicationUncertainError(filePath, error);
+		await fs.rm(anchoredTemporary, { force: true }).catch(() => undefined);
+		throw error;
+	}
+}
+
 async function writeGuardedResolvedJsonAtomic(
 	filePath: string,
 	value: unknown,
 	options: GuardedStateWriterOptions,
 ): Promise<GuardedWriteResult> {
+	let privateContext: PrivatePublicationContext | undefined;
+	if (options.privateDurable) {
+		if (options.policy !== "source" || options.expectedRevision === undefined)
+			throw new Error("private durable publication requires source CAS");
+		privateContext = await preparePrivateDirectory(filePath, options);
+	}
 	const write = async (): Promise<GuardedWriteResult> => {
-		const current = await readJsonIfPresentTolerant(filePath);
+		if (privateContext) await assertPrivatePublicationDirectories(privateContext);
+		const strict = privateContext
+			? await readPrivateExistingStateForMutation(privateContext.anchoredTarget)
+			: undefined;
+		if (strict?.kind === "corrupt") throw new Error(strict.error);
+		if (strict?.kind === "absent" && options.expectedRevision !== 0) throw new Error("established state missing");
+		const current = strict
+			? strict.kind === "valid"
+				? strict.value
+				: undefined
+			: await readJsonIfPresentTolerant(filePath);
 		const currentRevision = persistedStateRevision(current);
 
 		if (options.policy === "source") {
@@ -542,8 +839,13 @@ async function writeGuardedResolvedJsonAtomic(
 				throw new StateWriteConflictError(filePath, options.expectedRevision, currentRevision);
 			}
 			const next = stampStateRevision(withWorkflowReceipt(value, buildReceipt(options)), currentRevision + 1);
-			await atomicWrite(filePath, jsonText(next));
-			await maybeAudit(filePath, options);
+			if (options.privateDurable) {
+				if (!privateContext) throw new Error("private publication directories were not prepared");
+				await privateAtomicWrite(filePath, jsonText(next), options, privateContext);
+			} else {
+				await atomicWrite(filePath, jsonText(next));
+				await maybeAudit(filePath, options);
+			}
 			return { path: filePath, written: true, revision: currentRevision + 1, stamped: next };
 		}
 
@@ -567,7 +869,11 @@ async function writeGuardedResolvedJsonAtomic(
 	// that already holds this target's lock (via `withWorkflowStateLock`) must say
 	// so rather than deadlocking against itself — the same `lockHeld` contract the
 	// envelope writers already use.
-	return options.lockHeld ? write() : lockResolvedWorkflowTarget(filePath, write, options.lock);
+	try {
+		return options.lockHeld ? await write() : await lockResolvedWorkflowTarget(filePath, write, options.lock);
+	} finally {
+		if (privateContext) await closePrivatePublicationContext(privateContext);
+	}
 }
 
 export async function writeGuardedJsonAtomic(
@@ -798,7 +1104,12 @@ export async function withWorkflowStateLock<T>(
 	options?: StateWriterOptions,
 ): Promise<T> {
 	const filePath = resolveGjcTarget(targetPath, cwdForOptions(options));
-	return lockResolvedWorkflowTarget(filePath, fn, options?.lock);
+	const privateContext = options?.privateDurable ? await preparePrivateDirectory(filePath, options) : undefined;
+	try {
+		return await lockResolvedWorkflowTarget(filePath, fn, options?.lock);
+	} finally {
+		if (privateContext) await closePrivatePublicationContext(privateContext);
+	}
 }
 
 async function lockResolvedWorkflowTarget<T>(

package/src/harness-control-plane/control-endpoint.ts

@@ -20,7 +20,11 @@ export interface EndpointRequest {
 	input: Record<string, unknown>;
 }
 
-export type EndpointHandler = (req: EndpointRequest) => Promise<unknown>;
+export interface EndpointHandlerRequest extends EndpointRequest {
+	signal: AbortSignal;
+}
+
+export type EndpointHandler = (req: EndpointHandlerRequest) => Promise<unknown>;
 
 function frame(value: unknown): string {
 	return `${JSON.stringify(value)}\n`;
@@ -54,6 +58,14 @@ export class ControlServer {
 		socket.setEncoding("utf8");
 		let buffer = "";
 		let handled = false;
+		let responseSent = false;
+		const controller = new AbortController();
+		socket.once("close", () => {
+			if (!responseSent) controller.abort(new Error("endpoint_client_disconnected"));
+		});
+		socket.on("error", () => {
+			if (!responseSent) controller.abort(new Error("endpoint_client_disconnected"));
+		});
 		socket.on("data", (chunk: string) => {
 			if (handled) return;
 			buffer += chunk;
@@ -61,20 +73,26 @@ export class ControlServer {
 			if (idx < 0) return;
 			handled = true;
 			const line = buffer.slice(0, idx).trim();
-			void this.#dispatch(line)
+			void this.#dispatch(line, controller.signal)
 				.then(response => {
-					socket.end(frame(response));
+					if (!socket.destroyed && !controller.signal.aborted) {
+						responseSent = true;
+						socket.end(frame(response));
+					}
 				})
 				.catch((error: unknown) => {
-					socket.end(frame({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+					if (!socket.destroyed && !controller.signal.aborted) {
+						responseSent = true;
+						socket.end(frame({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+					}
 				});
 		});
 	}
 
-	async #dispatch(line: string): Promise<unknown> {
+	async #dispatch(line: string, signal: AbortSignal): Promise<unknown> {
 		const req = JSON.parse(line) as EndpointRequest;
 		if (!req || typeof req.verb !== "string") throw new Error("bad_request");
-		return this.handler({ verb: req.verb, input: req.input ?? {} });
+		return this.handler({ verb: req.verb, input: req.input ?? {}, signal });
 	}
 
 	async close(): Promise<void> {