@modelprofile.com/browser-runtime 5.7.1 → 5.8.0

package/readme.md

@@ -129,9 +129,13 @@ The runtime directory must be an owner-only `0700` directory on a trusted local
 
 `runtime.lock` is a permanent `0600`, single-link regular file retained through an open descriptor while ownership is live. It is metadata and a downgrade fence, not the live mutex, and is never removed by `stop()`. Version 3.2 and older create-exclusive runtimes therefore remain fenced during and between new-runtime generations. Bounded JSON metadata is overwritten and fsynced through that descriptor. It records the schema, directory identity, UID, boot ID, PID, `/proc/self/stat` start ticks, generation ID, nonce, and active/relinquished state. Malformed metadata or unsafe directory, anchor, lock, link, ownership, mode, containment, or inspection state fails closed with `FENCED`.
 
-Each successful `start()` creates private `generations/<generationId>/profiles` and `generations/<generationId>/artifacts` directories. A replacement holding the native mutex may inspect and remove only the generation named by valid metadata. For metadata generations, Runtime does not scan `runtime.lock` descriptors. It inspects every same-UID process and returns `LOCKED` when any process, Chromium or otherwise, has an absolute `--user-data-dir` equal to or below that generation's profile root. Process ownership is classified from all four IDs in `/proc/<pid>/status` `Uid:`: exact same-UID processes are inspected, definite other-UID processes are ignored, and mixed or unreadable identity remains indeterminate. Unknown generations and indeterminate inspection remain fenced.
+Each successful `start()` creates private `generations/<generationId>/profiles` and `generations/<generationId>/artifacts` directories. A replacement holding the native mutex may inspect and remove only the generation named by valid metadata. For metadata generations, Runtime does not scan `runtime.lock` descriptors. It inspects every candidate process and returns `LOCKED` when any process, Chromium or otherwise, has an absolute `--user-data-dir` equal to or below that generation's profile root. Unknown generations and indeterminate inspection remain fenced.
 
-A version 3.2 zero-byte lock uses a separate one-time migration gate. Runtime adopts it only when SmartIPC's consuming kernel exclusivity probe reports no other read/write open description, the lock's birth, change, and modification timestamps are all strictly before the bounded `/proc/stat` `btime`, and no same-UID process has `--user-data-dir` equal to or below the legacy `profiles` root. The exact original inode, ownership, mode, link count, zero size, and timestamps are revalidated when the lock is reopened after probing. Probe contention is `LOCKED`; probe or reopen uncertainty is `FENCED`. `O_PATH` descriptors do not contend. A same-boot unheld lock is `FENCED`; this prevents takeover during the old owner's close-before-unlink window. Malformed boot data or ambiguous timestamps are also `FENCED`.
+The inspection exists only to protect a profile root that is about to be removed, so when no inspected profile root is present the process table is never enumerated; an unreadable profile root is `FENCED`. Process identity is classified from all four IDs in `/proc/<pid>/status` `Uid:`. Same-UID processes and shared-UID processes — an ordinary setuid credential transition such as `sudo`, `su` or `passwd`, where this UID appears in some but not all four IDs — are both candidates; definite other-UID processes are ignored. A shared UID is never a fence by itself, and a single such process anywhere in `/proc` must never fence startup: the candidate's command line decides it. A readable command line naming no `--user-data-dir` at or below an inspected root proves the process is not using it. A candidate whose command line cannot be read is fail-closed and remains indeterminate, as does unparseable `Uid:` state.
+
+An empty command line is not a decision either. A process caught mid-`execve` or past `exit_mm` publishes one for a bounded window while `State:` still reports it running, so Runtime re-reads the identity and the command line over that window — five attempts 50 ms apart, at most 200 ms of waiting per candidate — before deciding. A departed PID, a definite other UID, and a zombie of any candidate UID state are clear; a command line that appears within the window takes the ordinary containment path and can still return `LOCKED`; a candidate still running and still command-less after the window is `FENCED`.
+
+A version 3.2 zero-byte lock uses a separate one-time migration gate. Runtime adopts it only when SmartIPC's consuming kernel exclusivity probe reports no other read/write open description, the lock's birth, change, and modification timestamps are all strictly before the bounded `/proc/stat` `btime`, and, when that root is present, no candidate process has `--user-data-dir` equal to or below the legacy `profiles` root. The exact original inode, ownership, mode, link count, zero size, and timestamps are revalidated when the lock is reopened after probing. Probe contention is `LOCKED`; probe or reopen uncertainty is `FENCED`. `O_PATH` descriptors do not contend. A same-boot unheld lock is `FENCED`; this prevents takeover during the old owner's close-before-unlink window. Malformed boot data or ambiguous timestamps are also `FENCED`.
 
 When version 3.2 stopped cleanly and removed `runtime.lock`, it may leave empty top-level `profiles` and `artifacts` directories. After winning creation of a new lock under the native mutex, Runtime validates those directories as exact private empty roots, performs the same exact-or-descendant profile-process inspection, removes only the validated roots, and publishes the new metadata without applying the stale-lock boot gate. If startup fails before metadata is durably published, Runtime unlinks only that exact process-created lock inode while still holding the native mutex; a preexisting lock is never removed.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/browser-runtime',
-  version: '5.7.1',
+  version: '5.8.0',
   description: 'Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.'
 }

package/ts/actions.ts

@@ -130,7 +130,7 @@ export const validateAgentAction = (value: unknown): TBrowserAgentAction => {
 const validateRuntimeState = (value: unknown): IBrowserRuntimeState => {
   const state = validateExactKeys(
     value,
-    ['status', 'activeTabId', 'viewportRevision', 'viewport', 'tabs', 'lastError', 'videoAcceleration'],
+    ['status', 'activeTabId', 'viewportRevision', 'viewport', 'tabs', 'lastError', 'videoAcceleration', 'videoSource'],
     'browser state',
   );
   if (
@@ -167,6 +167,7 @@ const validateRuntimeState = (value: unknown): IBrowserRuntimeState => {
       'generation',
       'appliedViewportRevision',
       'streaming',
+      'dialog',
     ], 'tab');
     validateBoundedString(tab.id, 'tab.id', 1, 128);
     if (typeof tab.url !== 'string' || tab.url.length > 8192) throw new BrowserRuntimeError('PROTOCOL_ERROR');
@@ -182,6 +183,39 @@ const validateRuntimeState = (value: unknown): IBrowserRuntimeState => {
       0,
       Number.MAX_SAFE_INTEGER,
     );
+    if (tab.dialog !== undefined) {
+      const dialog = validateExactKeys(tab.dialog, ['id', 'type', 'message', 'defaultPrompt', 'url'], 'dialog');
+      validateBoundedString(dialog.id, 'dialog.id', 1, 128);
+      if (!['alert', 'confirm', 'prompt', 'beforeunload'].includes(dialog.type as string)) {
+        throw new BrowserRuntimeError('PROTOCOL_ERROR');
+      }
+      for (const [key, maximum] of [['message', 16_384], ['defaultPrompt', 4096], ['url', 4096]] as const) {
+        if (typeof dialog[key] !== 'string' || dialog[key].length > maximum) {
+          throw new BrowserRuntimeError('PROTOCOL_ERROR');
+        }
+      }
+    }
+  }
+  if (state.videoSource !== undefined) {
+    const source = validateExactKeys(state.videoSource,
+      ['tabId', 'generation', 'viewportRevision', 'viewport', 'frameAlignment', 'rtpTimestampFloor'], 'videoSource');
+    validateBoundedString(source.tabId, 'videoSource.tabId', 1, 128);
+    validateInteger(source.generation, 'videoSource.generation', 0, Number.MAX_SAFE_INTEGER);
+    validateInteger(source.viewportRevision, 'videoSource.viewportRevision', 0, Number.MAX_SAFE_INTEGER);
+    const sourceViewport = validateExactKeys(source.viewport, ['width', 'height', 'deviceScaleFactor'], 'videoSource.viewport');
+    const matchingTabs = (state.tabs as IBrowserRuntimeState['tabs']).filter(tab => tab.id === source.tabId);
+    const tab = matchingTabs[0];
+    if (matchingTabs.length !== 1 || !tab?.active || !tab.streaming || tab.status !== 'open'
+      || source.tabId !== state.activeTabId || source.generation !== tab.generation
+      || source.viewportRevision !== state.viewportRevision || source.viewportRevision !== tab.appliedViewportRevision
+      || sourceViewport.width !== viewport.width || sourceViewport.height !== viewport.height
+      || sourceViewport.deviceScaleFactor !== viewport.deviceScaleFactor) {
+      throw new BrowserRuntimeError('PROTOCOL_ERROR');
+    }
+    if (source.frameAlignment !== undefined || source.rtpTimestampFloor !== undefined) {
+      if (source.frameAlignment !== 2) throw new BrowserRuntimeError('PROTOCOL_ERROR');
+      validateInteger(source.rtpTimestampFloor, 'videoSource.rtpTimestampFloor', 0, 0xffffffff);
+    }
   }
   if (state.videoAcceleration !== undefined) {
     const acceleration = validateExactKeys(state.videoAcceleration,

package/ts/classes.flexprovider.ts

@@ -12,7 +12,7 @@ const allowedActions = [
   'click',
   'fill',
   'press',
-] as const satisfies readonly plugins.smartagent.TBrowserToolAction[];
+] as const satisfies readonly plugins.flexharnessTools.TBrowserToolAction[];
 
 export class BrowserRuntimeFlexToolProvider<TScope>
 implements plugins.flexharness.IFlexToolProvider<TScope> {
@@ -67,7 +67,7 @@ implements plugins.flexharness.IFlexToolProvider<TScope> {
     }
     this.state = 'active';
 
-    const tools = plugins.smartagent.createBrowserTools({
+    const tools = plugins.flexharnessTools.createBrowserTools({
       abortSignal: context.signal,
       browser: this.client.asToolBrowserContext(),
       requestPermission: async (request) => {

package/ts/classes.framed.ts

@@ -732,7 +732,7 @@ export class BrowserRuntimeFramedClient {
     }
   }
 
-  public asToolBrowserContext(): plugins.smartagent.IToolBrowserContext {
+  public asToolBrowserContext(): plugins.flexharnessTools.IToolBrowserContext {
     return {
       execute: async (input, options) => {
         const record = validateExactKeys(

package/ts/classes.runtimeownership.ts

@@ -6,6 +6,8 @@ const metadataSchema = 1;
 const maximumMetadataBytes = 4096;
 const maximumProcFileBytes = 2 * 1024 * 1024;
 const anchorInitializationAttempts = 200;
+const emptyCommandAttempts = 5;
+const emptyCommandRetryDelayMs = 50;
 const generationIdPattern = /^[A-Za-z0-9_-]{32}$/u;
 const hashPattern = /^[a-f0-9]{64}$/u;
 const bootIdPattern = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
@@ -59,7 +61,26 @@ export interface IBrowserRuntimeGeneration {
 }
 
 type TInspectionResult = 'clear' | 'held' | 'indeterminate';
-type TProcessUidState = 'same' | 'other' | 'missing' | 'indeterminate';
+/**
+ * `same` is every one of the four `/proc/<pid>/status` `Uid:` identifiers, `other` is none of
+ * them, and `shared` is a setuid credential transition that names this uid in some but not all
+ * of them (`sudo`, `su`, `passwd`, a daemon that assumed this identity). A `shared` process can
+ * still open this uid's profile, so it is a scan candidate; it is never a whole-scan fence.
+ */
+type TProcessUidState = 'same' | 'other' | 'shared' | 'missing' | 'indeterminate';
+type TEmptyCommandResolution =
+  | { kind: 'clear' }
+  | { kind: 'indeterminate' }
+  | { kind: 'command'; cmdline: plugins.Buffer };
+
+/**
+ * Waits for one bounded retry step. The timer is referenced for its whole lifetime and always
+ * fires, so it is released as soon as the step ends and never outlives the acquisition it
+ * belongs to. An unreferenced timer would let the process exit in the middle of an inspection.
+ */
+const delayStep = (millisecondsArg: number): Promise<void> => new Promise<void>((resolve) => {
+  setTimeout(resolve, millisecondsArg);
+});
 
 const isMissingError = (errorArg: unknown): boolean => (
   (errorArg as NodeJS.ErrnoException).code === 'ENOENT'
@@ -1085,9 +1106,13 @@ export class BrowserRuntimeOwnership {
   }
 
   private async inspectProfileProcesses(profileRootsArg: string[]): Promise<TInspectionResult> {
-    const roots = profileRootsArg.map((root) => plugins.path.resolve(root));
+    const roots = await this.presentProfileRoots(profileRootsArg);
+    // The inspection exists only to protect a profile root that is about to be removed. When no
+    // root is present there is nothing to protect and no containment match is possible, so the
+    // process table is never enumerated.
+    if (roots.length === 0) return 'clear';
     let indeterminate = false;
-    for (const pid of await this.listOwnedProcessIds()) {
+    for (const pid of await this.listCandidateProcessIds()) {
       let cmdline: plugins.Buffer;
       try {
         cmdline = await this.readBoundedBuffer(
@@ -1095,6 +1120,8 @@ export class BrowserRuntimeOwnership {
           maximumProcFileBytes,
         );
       } catch {
+        // A candidate whose command line cannot be read stays fail-closed: its identity is known
+        // to involve this uid and nothing proves it is not using one of these profile roots.
         const uidState = await this.processStillExists(pid);
         if (uidState === 'missing' || uidState === 'other') continue;
         indeterminate = true;
@@ -1102,37 +1129,66 @@ export class BrowserRuntimeOwnership {
       }
       if (cmdline.byteLength === 0) {
         await this.afterEmptyProcessCmdline?.(pid);
-        if (!await this.emptyCommandProcessIsClear(pid)) indeterminate = true;
-        continue;
-      }
-      let cmdlineText: string;
-      try {
-        cmdlineText = new TextDecoder('utf-8', { fatal: true }).decode(cmdline);
-      } catch {
-        indeterminate = true;
-        continue;
-      }
-      const argumentsList = cmdlineText.split('\0');
-      if (argumentsList.at(-1) === '') argumentsList.pop();
-      for (let index = 0; index < argumentsList.length; index += 1) {
-        const argument = argumentsList[index]!;
-        let profilePath: string | undefined;
-        if (argument === '--user-data-dir') {
-          profilePath = argumentsList[index + 1];
-        } else if (argument.startsWith('--user-data-dir=')) {
-          profilePath = argument.slice('--user-data-dir='.length);
-        }
-        if (!profilePath || !plugins.path.isAbsolute(profilePath)) continue;
-        const resolved = plugins.path.resolve(profilePath);
-        if (roots.some((root) => resolved === root || this.pathIsWithin(root, resolved))) {
-          return 'held';
+        const resolution = await this.resolveEmptyCommandProcess(pid);
+        if (resolution.kind === 'clear') continue;
+        if (resolution.kind === 'indeterminate') {
+          indeterminate = true;
+          continue;
         }
+        cmdline = resolution.cmdline;
       }
+      const containment = this.commandLineContainment(cmdline, roots);
+      if (containment === 'held') return 'held';
+      if (containment === 'indeterminate') indeterminate = true;
     }
     return indeterminate ? 'indeterminate' : 'clear';
   }
 
-  private async listOwnedProcessIds(): Promise<number[]> {
+  private commandLineContainment(
+    cmdlineArg: plugins.Buffer,
+    rootsArg: string[],
+  ): TInspectionResult {
+    let cmdlineText: string;
+    try {
+      cmdlineText = new TextDecoder('utf-8', { fatal: true }).decode(cmdlineArg);
+    } catch {
+      return 'indeterminate';
+    }
+    const argumentsList = cmdlineText.split('\0');
+    if (argumentsList.at(-1) === '') argumentsList.pop();
+    for (let index = 0; index < argumentsList.length; index += 1) {
+      const argument = argumentsList[index]!;
+      let profilePath: string | undefined;
+      if (argument === '--user-data-dir') {
+        profilePath = argumentsList[index + 1];
+      } else if (argument.startsWith('--user-data-dir=')) {
+        profilePath = argument.slice('--user-data-dir='.length);
+      }
+      if (!profilePath || !plugins.path.isAbsolute(profilePath)) continue;
+      const resolved = plugins.path.resolve(profilePath);
+      if (rootsArg.some((root) => resolved === root || this.pathIsWithin(root, resolved))) {
+        return 'held';
+      }
+    }
+    return 'clear';
+  }
+
+  private async presentProfileRoots(profileRootsArg: string[]): Promise<string[]> {
+    const roots: string[] = [];
+    for (const profileRoot of profileRootsArg) {
+      const root = plugins.path.resolve(profileRoot);
+      try {
+        await plugins.fsPromises.lstat(root, { bigint: true });
+      } catch (error) {
+        if (isMissingError(error)) continue;
+        throw new BrowserRuntimeError('FENCED', 'runtime profile root is unreadable');
+      }
+      roots.push(root);
+    }
+    return roots;
+  }
+
+  private async listCandidateProcessIds(): Promise<number[]> {
     let entries: string[];
     try {
       // /proc can report DT_UNKNOWN. Node's eager Dirent conversion then
@@ -1161,8 +1217,11 @@ export class BrowserRuntimeOwnership {
         indeterminate = true;
         continue;
       }
+      // A credential state alone never fences the scan. An unrelated process is discarded here
+      // only when it definitely belongs to another uid; every process this uid owns or shares is
+      // a candidate whose command line decides it in inspectProfileProcesses().
       const uidState = await this.processStillExists(pid);
-      if (uidState === 'same') processIds.push(pid);
+      if (uidState === 'same' || uidState === 'shared') processIds.push(pid);
       else if (uidState === 'indeterminate') indeterminate = true;
     }
     if (indeterminate) {
@@ -1208,31 +1267,63 @@ export class BrowserRuntimeOwnership {
     }
     if (ids.every((id) => id === this.uid)) return 'same';
     if (ids.every((id) => id !== this.uid)) return 'other';
-    return 'indeterminate';
+    return 'shared';
   }
 
-  private async emptyCommandProcessIsClear(pidArg: number): Promise<boolean> {
+  /**
+   * An empty `/proc/<pid>/cmdline` is not a decision. A candidate publishes one for a bounded
+   * window while it is mid-`execve` or has already released its mm on the way to becoming a
+   * zombie, and during that window `State:` still reports a running process. Re-read the
+   * identity and the command line across that window before deciding anything.
+   */
+  private async resolveEmptyCommandProcess(pidArg: number): Promise<TEmptyCommandResolution> {
     const processPath = plugins.path.join(this.procRoot, String(pidArg));
-    try {
-      const status = await this.readBoundedFile(
-        plugins.path.join(processPath, 'status'),
-        64 * 1024,
-      );
+    for (let attempt = 0; attempt < emptyCommandAttempts; attempt += 1) {
+      let status: string;
+      try {
+        status = await this.readBoundedFile(
+          plugins.path.join(processPath, 'status'),
+          64 * 1024,
+        );
+      } catch (error) {
+        return await this.departedProcessResolution(processPath, error);
+      }
       const uidState = this.parseProcessUidState(status);
-      if (uidState === 'other') return true;
-      if (uidState !== 'same') return false;
+      if (uidState === 'other') return { kind: 'clear' };
+      if (uidState !== 'same' && uidState !== 'shared') return { kind: 'indeterminate' };
       const stateLines = status.split('\n').filter((line) => line.startsWith('State:'));
-      return stateLines.length === 1 && /^State:[\t ]+Z(?:[\t ]|$)/u.test(stateLines[0]!);
-    } catch (error) {
-      if (!isMissingError(error)) return false;
-      // An empty command line can precede process exit. A missing status file
-      // alone is insufficient: the PID directory must also have disappeared.
+      if (stateLines.length !== 1) return { kind: 'indeterminate' };
+      // A zombie has released its mm, holds no descriptor and cannot be using any profile root.
+      if (/^State:[\t ]+Z(?:[\t ]|$)/u.test(stateLines[0]!)) return { kind: 'clear' };
+      let cmdline: plugins.Buffer;
       try {
-        await plugins.fsPromises.lstat(processPath, { bigint: true });
-        return false;
-      } catch (statError) {
-        return isMissingError(statError);
+        cmdline = await this.readBoundedBuffer(
+          plugins.path.join(processPath, 'cmdline'),
+          maximumProcFileBytes,
+        );
+      } catch (error) {
+        return await this.departedProcessResolution(processPath, error);
       }
+      if (cmdline.byteLength > 0) return { kind: 'command', cmdline };
+      if (attempt + 1 < emptyCommandAttempts) await delayStep(emptyCommandRetryDelayMs);
+    }
+    // Still running and still command-less after the whole window. Nothing proves this process is
+    // not using one of the inspected roots, so it stays fail-closed.
+    return { kind: 'indeterminate' };
+  }
+
+  private async departedProcessResolution(
+    processPathArg: string,
+    errorArg: unknown,
+  ): Promise<TEmptyCommandResolution> {
+    if (!isMissingError(errorArg)) return { kind: 'indeterminate' };
+    // A missing status or command-line file alone is insufficient: the PID directory must also
+    // have disappeared before the process counts as departed.
+    try {
+      await plugins.fsPromises.lstat(processPathArg, { bigint: true });
+      return { kind: 'indeterminate' };
+    } catch (statError) {
+      return isMissingError(statError) ? { kind: 'clear' } : { kind: 'indeterminate' };
     }
   }
 

package/ts/plugins.ts

@@ -16,12 +16,12 @@ export { Buffer, crypto, dns, fs, fsPromises, http, net, os, path, stream, tls,
 
 // foss.global scopes
 import * as flexharness from '@modelprofile.com/flexharness';
-import * as smartagent from '@push.rocks/smartagent';
+import * as flexharnessTools from '@modelprofile.com/flexharness/tools';
 import * as smartipc from '@push.rocks/smartipc';
 import * as smartmcp from '@push.rocks/smartmcp';
 import * as smartpuppeteer from '@push.rocks/smartpuppeteer';
 
-export { flexharness, smartagent, smartipc, smartmcp, smartpuppeteer };
+export { flexharness, flexharnessTools, smartipc, smartmcp, smartpuppeteer };
 
 // third-party scope
 import ipaddr from 'ipaddr.js';

package/.smartconfig.json

@@ -1,34 +0,0 @@
-{
-  "@git.zone/cli": {
-    "schemaVersion": 2,
-    "projectType": "npm",
-    "module": {
-      "githost": "code.foss.global",
-      "gitscope": "modelprofile.com",
-      "gitrepo": "browser-runtime",
-      "description": "Parent-owned, resource-centric Chromium runtime with revisioned attachment fencing, authenticated human and agent control, fail-closed egress, bounded artifacts, and Flex/MCP adapters.",
-      "npmPackagename": "@modelprofile.com/browser-runtime",
-      "license": "MIT",
-      "projectDomain": "modelprofile.com"
-    },
-    "release": {
-      "targets": {
-        "git": {
-          "enabled": true,
-          "remote": "origin",
-          "pushBranch": true,
-          "pushTags": true
-        },
-        "npm": {
-          "enabled": true,
-          "registries": [
-            "https://verdaccio.lossless.digital",
-            "https://registry.npmjs.org"
-          ],
-          "accessLevel": "public",
-          "alreadyPublished": "success"
-        }
-      }
-    }
-  }
-}