@redue/cli 0.1.0-alpha.27 → 0.1.0-alpha.29

package/src/daemon.mjs

@@ -25,7 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
-import {ignoredNow,isSandboxed,sandboxChange,trackedBeneath} from './sandbox.mjs';
+import {isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -348,38 +348,17 @@ function describeChangedInput(plan,file) {
     .map(mapping=>mapping.logical).slice(0,2);
   return file+' changed'+(matches.length?` (installed via ${matches.join(', ')})`:'');
 }
-// A run that hid the checkout's git-ignored entries (sandbox@2) did not see
-// them. A changed file the run saw always counts. A file beneath a hidden
-// entry counts only once git tracks it, and a new file only when git does
-// not list it as ignored now, as the next run's hidden entries would not.
-// Installed trees count whatever git says. The first changed input that
-// counts, or null; once per receipt and pair of fingerprints. When git
-// cannot tell, every change counts.
+// A run that hid the checkout's git-ignored entries (sandbox@2), and maybe
+// documentation files (sandbox@3, the receipt's sandbox.docs): the first
+// changed input it could see (sandbox.mjs's visibleChange), or null; once
+// per receipt and pair of fingerprints.
 const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
 function visibleChange(row,r,name) {
   const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
-  if(row.visibleKey===key)return row.visibleChange;
-  const hidden=r.sandbox.hidden.map(entry=>entry.replace(/\/$/,''));
-  const beneath=file=>hidden.some(entry=>file===entry||file.startsWith(entry+'/'));
-  const current=combinedFiles(name);
-  const changed=[...new Set([...Object.keys(r.files),...Object.keys(current)])].filter(file=>r.files[file]!==current[file]).sort();
-  const seen=changed.filter(file=>file in r.files&&!beneath(file));
-  const covered=changed.filter(file=>beneath(file)),fresh=changed.filter(file=>!(file in r.files)&&!beneath(file));
-  let found=seen[0]??null;
-  if(!found&&covered.length){
-    const tracked=trackedBeneath(root,hidden.filter(entry=>covered.some(file=>file===entry||file.startsWith(entry+'/'))));
-    found=covered.find(file=>!tracked||tracked.has(file))??null;
-  }
-  if(!found&&fresh.length){
-    // Ask once per directory the run had no file in, then the files outside one.
-    const before=new Set(Object.keys(r.files).flatMap(file=>file.split('/').slice(0,-1).map((_,i,parts)=>parts.slice(0,i+1).join('/'))));
-    const newDir=file=>{const parts=file.split('/');for(let i=1;i<parts.length;i++){const dir=parts.slice(0,i).join('/');if(!before.has(dir))return dir+'/';}return null;};
-    const asked=[...new Set(fresh.filter(file=>!file.startsWith('external:')).map(file=>newDir(file)??file))];
-    const ignored=ignoredNow(root,asked);
-    found=fresh.find(file=>file.startsWith('external:')||!ignored||!ignored.has(file))??null;
-  }
-  row.visibleKey=key;row.visibleChange=found;
-  return found;
+  if(row.visibleKey!==key){const current=combinedFiles(name);
+    row.visibleKey=key;row.visibleChange=sandboxVisibleChange(root,r.sandbox.hidden,r.files,current,[...Object.keys(r.files),...Object.keys(current)],
+      {docs:Array.isArray(r.sandbox.docs)?r.sandbox.docs:null});}
+  return row.visibleChange;
 }
 function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   if(!index)return [];
@@ -433,7 +412,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason='target failure conflicts with outer invocation outcome';return item;}
     if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
       // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
-      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox)/.test(issue));
+      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox|network supervisor)/.test(issue));
       item.reason=sandbox?r.checkpoint.issues.join('; '):`inputs changed during execution or observation gap${issues}`;return item;}
     const names=[...(row.plan.environment.variables||[]),
       ...(row.plan.environment.prefixes||[]).map(prefix=>

package/src/landlock.py

@@ -6,13 +6,31 @@
 # connection to an abstract Unix socket outside the run. Writes are not
 # handled, so they are not restricted.
 #
+# --loopback (a test run) leaves TCP to a seccomp filter in the command's
+# process instead. Sockets other than Unix, netlink and inet TCP streams are
+# refused when they are created, and so are sendto, sendmsg and sendmmsg with
+# MSG_FASTOPEN (a connect without connect), io_uring_setup, and any foreign
+# architecture's or x32 system call. Every connect goes to the launcher
+# (seccomp user notification). It lets through AF_UNSPEC, an unnamed or
+# abstract Unix socket, a Unix socket file beneath a --write place, and the
+# local host (loopback, 0.0.0.0, ::) on a port no process listens on or one
+# of the run's own processes listens on: not a service started outside the
+# run. It refuses the rest. Nothing else goes through the launcher, so worker
+# processes' IPC is untouched; bind is allowed anywhere.
+#
+# --deny-write PATH (a test run's /tmp and /var/tmp) handles writes too: they
+# are allowed everywhere but beneath those paths, and beneath each --write
+# PATH (the run's own temporary directory).
+#
 # --hide PATH keeps the run from reading or executing beneath PATH, inside a
 # --read place. Landlock only grants, beneath a whole directory, so such a
 # place gets listing rights (beneath it all, hidden entries included) and
 # read and execute rights on each of its entries that is not hidden and
 # holds nothing hidden, descending into the ones that do. A hidden path can
 # still be listed and stat'ed. --stats FILE writes the rule count and the
-# time the rules took, as JSON.
+# time the rules took, as JSON; with --loopback, rewritten when the command
+# ends with `supervisor`: "ok" when it served the whole run, else what went
+# wrong. A missing or other value means the network was not supervised.
 #
 # The launcher stays as the command's parent and a child subreaper: when the
 # command exits, it stops every process the command left running, daemons
@@ -21,23 +39,240 @@
 # launcher gets is passed to that group once. The launcher then ends as the
 # command did: with its exit status, or by its signal.
 #
-#   landlock.py --read /usr --read /tmp ... [--hide P ...] [--stats F] [--no-tcp] -- cmd args...
+#   landlock.py --read /usr --read /tmp ... [--hide P ...] [--stats F] [--no-tcp | --loopback]
+#               [--deny-write P ... --write P ...] -- cmd args...
 #   landlock.py --probe     # prints {"abi": N} or {"abi": null, "errno": E}
 import ctypes
+import errno
 import json
 import os
+import select
 import signal
+import socket
 import sys
+import threading
 import time
 
 SYS_CREATE, SYS_ADD, SYS_RESTRICT = 444, 445, 446  # the same on x86_64 and aarch64
 EXECUTE, READ_FILE, READ_DIR = 1 << 0, 1 << 2, 1 << 3
+# Writing, making and removing files, renaming across directories (ABI 2), truncating (ABI 3).
+WRITE = sum(1 << bit for bit in (1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14))
 BIND_TCP, CONNECT_TCP = 1 << 0, 1 << 1
 SCOPE_ABSTRACT_UNIX_SOCKET = 1 << 0
 PR_SET_NO_NEW_PRIVS, PR_SET_CHILD_SUBREAPER = 38, 36
 
 libc = ctypes.CDLL(None, use_errno=True)
 libc.syscall.restype = ctypes.c_long
+libc.ioctl.argtypes = [ctypes.c_int, ctypes.c_ulong, ctypes.c_void_p]
+
+# The seccomp filter --loopback installs, per architecture: its audit value
+# and the system calls it looks at.
+ARCH = {'x86_64': (0xC000003E, {'socket': 41, 'connect': 42, 'sendto': 44, 'sendmsg': 46, 'sendmmsg': 307,
+                                'io_uring_setup': 425, 'seccomp': 317}),
+        'aarch64': (0xC00000B7, {'socket': 198, 'connect': 203, 'sendto': 206, 'sendmsg': 211, 'sendmmsg': 269,
+                                 'io_uring_setup': 425, 'seccomp': 277})}
+AF_UNSPEC, AF_UNIX, AF_INET, AF_INET6, AF_NETLINK = 0, 1, 2, 10, 16
+SOCK_STREAM, IPPROTO_TCP, IPPROTO_MPTCP, MSG_FASTOPEN = 1, 6, 262, 0x20000000
+RET_ALLOW, RET_NOTIFY, RET_ERRNO = 0x7fff0000, 0x7fc00000, 0x00050000
+LD, JEQ, JGE, JSET, AND, RET = 0x20, 0x15, 0x35, 0x45, 0x54, 0x06
+SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, SECCOMP_USER_NOTIF_FLAG_CONTINUE = 1, 1 << 3, 1
+NOTIF_RECV, NOTIF_SEND, NOTIF_ID_VALID, NOTIF_ID_VALID_OLD = 0xc0502100, 0xc0182101, 0x40082102, 0x80082102
+
+
+class SockFilter(ctypes.Structure):
+    _fields_ = [('code', ctypes.c_uint16), ('jt', ctypes.c_uint8), ('jf', ctypes.c_uint8), ('k', ctypes.c_uint32)]
+
+
+class SockFprog(ctypes.Structure):
+    _fields_ = [('len', ctypes.c_ushort), ('filter', ctypes.POINTER(SockFilter))]
+
+
+class SeccompData(ctypes.Structure):
+    _fields_ = [('nr', ctypes.c_int), ('arch', ctypes.c_uint32), ('ip', ctypes.c_uint64), ('args', ctypes.c_uint64 * 6)]
+
+
+class Notif(ctypes.Structure):
+    _fields_ = [('id', ctypes.c_uint64), ('pid', ctypes.c_uint32), ('flags', ctypes.c_uint32), ('data', SeccompData)]
+
+
+class NotifResp(ctypes.Structure):
+    _fields_ = [('id', ctypes.c_uint64), ('val', ctypes.c_int64), ('error', ctypes.c_int32), ('flags', ctypes.c_uint32)]
+
+
+def filter_program(machine):
+    # Little-endian: an argument's low 32 bits are at 16 + 8 * index.
+    audit, nr = ARCH[machine]
+    program, labels = [], {}
+    def op(code, k, jt=None, jf=None):
+        program.append([code, jt, jf, k])
+    def label(name):
+        labels[name] = len(program)
+    op(LD, 4); op(JEQ, audit, None, 'deny')
+    op(LD, 0)
+    if machine == 'x86_64':
+        op(JGE, 0x40000000, 'deny')
+    op(JEQ, nr['connect'], 'notify'); op(JEQ, nr['io_uring_setup'], 'deny'); op(JEQ, nr['socket'], 'socket')
+    op(JEQ, nr['sendto'], 'flags3'); op(JEQ, nr['sendmmsg'], 'flags3'); op(JEQ, nr['sendmsg'], 'flags2')
+    op(RET, RET_ALLOW)
+    # Unix and netlink sockets; inet only as TCP (or MPTCP) streams, which reach a host through connect alone.
+    label('socket'); op(LD, 16)
+    op(JEQ, AF_UNIX, 'allow'); op(JEQ, AF_NETLINK, 'allow'); op(JEQ, AF_INET, 'inet'); op(JEQ, AF_INET6, 'inet'); op(RET, RET_ERRNO | errno.EPERM)
+    label('inet'); op(LD, 24); op(AND, 0xf); op(JEQ, SOCK_STREAM, 'protocol', 'deny')
+    label('protocol'); op(LD, 32); op(JEQ, 0, 'allow'); op(JEQ, IPPROTO_TCP, 'allow'); op(JEQ, IPPROTO_MPTCP, 'allow', 'deny')
+    label('flags3'); op(LD, 16 + 8 * 3); op(JSET, MSG_FASTOPEN, 'deny', 'allow')
+    label('flags2'); op(LD, 16 + 8 * 2); op(JSET, MSG_FASTOPEN, 'deny', 'allow')
+    label('allow'); op(RET, RET_ALLOW)
+    label('notify'); op(RET, RET_NOTIFY)
+    label('deny'); op(RET, RET_ERRNO | errno.EPERM)
+    jump = lambda at, name: labels[name] - at - 1 if name else 0
+    return [SockFilter(code, jump(at, jt), jump(at, jf), k) for at, (code, jt, jf, k) in enumerate(program)]
+
+
+# In the command's process, before exec: the filter, and its listener for the launcher.
+def install_filter():
+    machine = os.uname().machine
+    if machine not in ARCH:
+        raise OSError(f'no seccomp filter for {machine}')
+    program = filter_program(machine)
+    buffer = (SockFilter * len(program))(*program)
+    fprog = SockFprog(len(program), ctypes.cast(buffer, ctypes.POINTER(SockFilter)))
+    fd = libc.syscall(ARCH[machine][1]['seccomp'], SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, ctypes.byref(fprog))
+    if fd < 0:
+        raise OSError(ctypes.get_errno(), f'seccomp: {os.strerror(ctypes.get_errno())}')
+    return fd
+
+
+# The run's processes: the launcher's descendants (it is their subreaper).
+def run_processes(launcher):
+    parents = {}
+    for entry in os.listdir('/proc'):
+        if entry.isdigit():
+            try:
+                with open(f'/proc/{entry}/stat') as f:
+                    stat = f.read()
+                parents[int(entry)] = int(stat[stat.rindex(')') + 2:].split()[1])
+            except (OSError, ValueError, IndexError):
+                pass
+    def descends(pid, seen=0):
+        while pid in parents and seen < 64:
+            pid, seen = parents[pid], seen + 1
+            if pid == launcher:
+                return True
+        return False
+    return [pid for pid in parents if descends(pid)]
+
+
+# Who listens on a local TCP port: None when nobody does, else whether one of
+# the run's processes does.
+def listener_in_run(port, launcher):
+    inodes = set()
+    for table in ('/proc/net/tcp', '/proc/net/tcp6'):
+        try:
+            with open(table) as f:
+                rows = f.read().splitlines()[1:]
+        except OSError:
+            continue
+        for row in rows:
+            fields = row.split()
+            if len(fields) > 9 and fields[3] == '0A' and int(fields[1].rsplit(':', 1)[1], 16) == port:
+                inodes.add(fields[9])
+    if not inodes:
+        return None
+    links = {f'socket:[{inode}]' for inode in inodes}
+    for pid in run_processes(launcher):
+        try:
+            for fd in os.listdir(f'/proc/{pid}/fd'):
+                try:
+                    if os.readlink(f'/proc/{pid}/fd/{fd}') in links:
+                        return True
+                except OSError:
+                    pass
+        except OSError:
+            pass
+    return False
+
+
+# Whether a process may connect to the address it names (see --loopback).
+def connect_allowed(pid, address, length, places, launcher, ports):
+    if not address or length < 2:
+        return False
+    try:
+        fd = os.open(f'/proc/{pid}/mem', os.O_RDONLY | os.O_CLOEXEC)
+        try:
+            raw = os.pread(fd, min(length, 128), address)
+        finally:
+            os.close(fd)
+    except OSError:
+        return False
+    family = int.from_bytes(raw[:2], sys.byteorder)
+    if family == AF_UNSPEC:
+        return True
+    if family == AF_UNIX:
+        name = raw[2:].split(b'\0', 1)[0] if len(raw) > 2 and raw[2] != 0 else b''
+        if not name:
+            return True
+        try:
+            target = os.path.realpath(os.path.join(os.readlink(f'/proc/{pid}/cwd'), os.fsdecode(name)))
+        except OSError:
+            return False
+        return any(target == place or target.startswith(place.rstrip('/') + '/') for place in places)
+    if family == AF_INET and len(raw) >= 8:
+        local = raw[4] == 127 or raw[4:8] == bytes(4)
+    elif family == AF_INET6 and len(raw) >= 24:
+        host = raw[8:24]
+        mapped = host[:12] == bytes(10) + b'\xff\xff'
+        local = host in (bytes(15) + b'\x01', bytes(16)) or mapped and (host[12] == 127 or host[12:] == bytes(4))
+    else:
+        return False
+    if not local:
+        return False
+    port = int.from_bytes(raw[2:4], 'big')
+    if port in ports:
+        return True
+    owner = listener_in_run(port, launcher)
+    if owner:
+        ports.add(port)
+    return owner is not False
+
+
+# The launcher's side: every connect the command's processes make, until none is left.
+def supervise(fd, state, places, die=False):
+    def valid(id):
+        value = ctypes.c_uint64(id)
+        if libc.ioctl(fd, NOTIF_ID_VALID, ctypes.byref(value)) == 0:
+            return True
+        return ctypes.get_errno() in (errno.EINVAL, errno.ENOTTY) and libc.ioctl(fd, NOTIF_ID_VALID_OLD, ctypes.byref(value)) == 0
+    launcher, ports = os.getpid(), set()
+    places = [os.path.realpath(place) for place in places]
+    try:
+        poller = select.poll()
+        poller.register(fd, select.POLLIN)
+        while True:
+            events = dict(poller.poll())
+            if events.get(fd, 0) & select.POLLIN == 0:
+                break
+            notif = Notif()
+            if libc.ioctl(fd, NOTIF_RECV, ctypes.byref(notif)) < 0:
+                if ctypes.get_errno() in (errno.EINTR, errno.ENOENT):
+                    continue
+                raise OSError(ctypes.get_errno(), 'receive')
+            if die:
+                raise RuntimeError('test fault')
+            allowed = connect_allowed(notif.pid, notif.data.args[1], notif.data.args[2], places, launcher, ports)
+            state['connects'] = state.get('connects', 0) + 1
+            if not valid(notif.id):
+                continue
+            response = NotifResp(notif.id, 0, 0 if allowed else -errno.EPERM, SECCOMP_USER_NOTIF_FLAG_CONTINUE if allowed else 0)
+            if libc.ioctl(fd, NOTIF_SEND, ctypes.byref(response)) < 0 and ctypes.get_errno() != errno.ENOENT:
+                raise OSError(ctypes.get_errno(), 'respond')
+        state['supervisor'] = 'ok'
+    except Exception as e:
+        state['supervisor'] = f'failed: {e}'
+        # A closed listener makes every later connect fail (ENOSYS).
+        try:
+            os.close(fd)
+        except OSError:
+            pass
 
 
 class RulesetAttr(ctypes.Structure):
@@ -61,10 +296,19 @@ def main(argv):
         v, err = abi()
         print(json.dumps({'abi': v, 'errno': err}))
         return 0
-    reads, hidden, stats, no_tcp = [], set(), None, False
+    reads, hidden, stats, no_tcp, loopback, deny_write, writes, fault = [], set(), None, False, False, set(), [], None
     while argv and argv[0] != '--':
         if argv[0] == '--read':
             reads.append(argv[1]); argv = argv[2:]
+        elif argv[0] == '--loopback':
+            loopback = True; argv = argv[1:]
+        elif argv[0] == '--deny-write':
+            deny_write.add(os.path.normpath(argv[1])); argv = argv[2:]
+        elif argv[0] == '--write':
+            writes.append(argv[1]); argv = argv[2:]
+        elif argv[0] == '--test-fault':
+            # Tests only: the supervisor cannot start (unavailable) or stops at the first connect (die).
+            fault = argv[1]; argv = argv[2:]
         elif argv[0] == '--hide':
             hidden.add(os.path.normpath(argv[1])); argv = argv[2:]
         elif argv[0] == '--stats':
@@ -77,9 +321,10 @@ def main(argv):
     version, err = abi()
     if version is None:
         sys.exit(f'landlock.py: Landlock unavailable (errno {err})')
-    handled = EXECUTE | READ_FILE | READ_DIR
+    reading = EXECUTE | READ_FILE | READ_DIR
+    handled = reading | (WRITE if deny_write else 0)
     attr = RulesetAttr(handled, (BIND_TCP | CONNECT_TCP) if no_tcp and version >= 4 else 0,
-                       SCOPE_ABSTRACT_UNIX_SOCKET if no_tcp and version >= 6 else 0)
+                       SCOPE_ABSTRACT_UNIX_SOCKET if (no_tcp or loopback) and version >= 6 else 0)
     size = 24 if attr.scoped else 16 if attr.net else 8
     ruleset = libc.syscall(SYS_CREATE, ctypes.byref(attr), ctypes.c_size_t(size), ctypes.c_uint32(0))
     if ruleset < 0:
@@ -93,50 +338,84 @@ def main(argv):
             return
         # A file takes file rights only.
         if rights is None:
-            rights = handled if os.path.isdir(place) else EXECUTE | READ_FILE
+            rights = reading if os.path.isdir(place) else EXECUTE | READ_FILE
+        if not os.path.isdir(place):
+            rights &= EXECUTE | READ_FILE | (1 << 1) | (1 << 14)
         rule = PathBeneath(rights, fd)
         if libc.syscall(SYS_ADD, ctypes.c_int(ruleset), ctypes.c_int(1), ctypes.byref(rule), ctypes.c_uint32(0)) < 0:
             sys.exit(f'landlock.py: add_rule {place} errno {ctypes.get_errno()}')
         os.close(fd)
         count += 1
-    # The directories that hold a hidden path, up to the root.
-    holders = set()
-    for path in hidden:
-        at = os.path.dirname(path)
-        while at not in holders and at != os.path.dirname(at):
-            holders.add(at); at = os.path.dirname(at)
-    def grant(directory):
+    # The directories that hold an excluded path, up to the root.
+    def holders_of(excluded):
+        holders = set()
+        for path in excluded:
+            at = os.path.dirname(path)
+            while at not in holders and at != os.path.dirname(at):
+                holders.add(at); at = os.path.dirname(at)
+        return holders
+    # `rights` on every entry beneath `directory` but the excluded ones.
+    def grant(directory, excluded, holders, rights):
         # Links are not followed: what they lead to is granted on its own or not at all.
         try:
             entries = list(os.scandir(directory))
         except OSError:
             return
         for entry in entries:
-            if entry.path in hidden or entry.is_symlink():
+            if entry.path in excluded or entry.is_symlink():
                 continue
             if entry.path in holders:
-                grant(entry.path)
+                grant(entry.path, excluded, holders, rights)
             else:
-                add(entry.path)
+                add(entry.path, rights)
+    holders = holders_of(hidden)
     for place in reads:
         place = os.path.normpath(place)
         if place in holders and os.path.isdir(place):
             add(place, READ_DIR)
-            grant(place)
+            grant(place, hidden, holders, reading)
         else:
             add(place)
-    if stats:
-        with open(stats, 'w') as f:
-            json.dump({'rules': count, 'ms': round((time.monotonic() - started) * 1000, 1)}, f)
+    if deny_write:
+        grant('/', deny_write, holders_of(deny_write), WRITE)
+        for place in writes:
+            add(place, WRITE)
+    state = {'rules': count, 'ms': round((time.monotonic() - started) * 1000, 1)}
+    # Opened before the ruleset applies, so a write rule cannot refuse it later; not inherited.
+    stats_fd = os.open(stats, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_CLOEXEC, 0o600) if stats else None
+    def report():
+        if stats_fd is not None:
+            data = json.dumps(state).encode()
+            os.ftruncate(stats_fd, 0)
+            os.pwrite(stats_fd, data, 0)
+    report()
     if libc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0:
         sys.exit(f'landlock.py: no_new_privs errno {ctypes.get_errno()}')
     if libc.syscall(SYS_RESTRICT, ctypes.c_int(ruleset), ctypes.c_uint32(0)) < 0:
         sys.exit(f'landlock.py: restrict_self errno {ctypes.get_errno()}')
     os.close(ruleset)
     libc.prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0)
+    # The command's process sends its filter's listener back over this pair.
+    if loopback:
+        state['supervisor'] = 'not started'
+        report()
+        parent_end, child_end = socket.socketpair()
     pid = os.fork()
     if pid == 0:
         os.setpgid(0, 0)
+        if loopback:
+            parent_end.close()
+            try:
+                if fault == 'unavailable':
+                    raise OSError('test fault')
+                listener = install_filter()
+                socket.send_fds(child_end, [b'x'], [listener])
+                os.close(listener)
+                child_end.close()
+            except OSError as e:
+                # Never run the command unsupervised.
+                sys.stderr.write(f'landlock.py: network supervisor unavailable: {e}\n')
+                os._exit(125)
         try:
             os.execvp(cmd[0], cmd)
         except OSError as e:
@@ -154,8 +433,28 @@ def main(argv):
             pass
     for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
         signal.signal(number, forward)
+    supervisor = None
+    if loopback:
+        child_end.close()
+        try:
+            _, fds, _, _ = socket.recv_fds(parent_end, 1, 1)
+        except OSError:
+            fds = []
+        parent_end.close()
+        if fds:
+            state['supervisor'] = 'running'
+            supervisor = threading.Thread(target=supervise, args=(fds[0], state, writes, fault == 'die'), daemon=True)
+            supervisor.start()
+        else:
+            state['supervisor'] = 'unavailable'
     _, status = os.waitpid(pid, 0)
     stop_left()
+    # Every filtered process is gone: the supervisor sees its listener hang up.
+    if supervisor:
+        supervisor.join(5)
+        if supervisor.is_alive():
+            state['supervisor'] = 'did not end with the command'
+    report()
     code = os.waitstatus_to_exitcode(status)
     if code >= 0:
         return code

package/src/node-onboarding.mjs

@@ -323,7 +323,9 @@ export function discoverNodeProject(root,{recipe=null}={}) {
       }catch(e){classification={...classification,reason:`Sandboxed recipe unavailable (${e.code?.replace(/^test-/,'')||e.message}); ${classification.reason}`};}
     }
     if(generalRow){checks.push(generalRow);continue;}
-    if(!script&&classification.level!=='ready')continue;
+    // A proposed `tsc --noEmit` that no recipe takes is left out, with why.
+    if(!script&&classification.level!=='ready'){
+      skipped.push({kind,reason:`${kind}: no typecheck script, and a proposed tsc --noEmit was not taken (${classification.reason})`});continue;}
     if(parts&&classification.level==='ready'){
       for(const part of parts)checks.push({config:{...check,...part,qualification:classification.qualification},...classification});
       continue;

package/src/presentation.mjs

@@ -3,7 +3,7 @@
 const recipes={'npm-typescript-direct-v1':'direct TypeScript recipe','npm-tests-direct-v1':'direct test recipe',
   'node-script-v1':'general recipe','pnpm-tsc-v1':'pnpm TypeScript recipe','yarn-workspace-tsc-v1':'Yarn workspace TypeScript recipe',
   'typescript-noemit-v1':'npm TypeScript recipe','sandbox-v1':'sandboxed recipe',
-  'sandbox-v2':'sandboxed recipe, git-ignored files hidden'};
+  'sandbox-v2':'sandboxed recipe, git-ignored files hidden','sandbox-v3':'sandboxed recipe, git-ignored files and docs hidden'};
 export const recipeLabel=recipe=>recipes[recipe]??null;
 export function checkLabel(row) {
   return row.result==='FAIL'?'FAILED':row.freshness;
@@ -12,8 +12,8 @@ export function explanation(row) {
   const reason=row.reason||'No verification evidence is available.';
   if(reason==='no receipt')return 'No execution has been recorded. Run this check when verification is needed.';
   if(reason==='declared inputs match')return 'Recorded evidence still applies to the declared inputs.';
-  if(reason==='execution environment context not supplied')return 'Cached status cannot confirm your execution context. Use --sync if worthwhile, or rerun the check.';
-  if(/requires? a synchronized content read/.test(reason))return 'Cached status cannot establish applicability here. Use --sync if worthwhile, or rerun the check.';
+  if(reason==='execution environment context not supplied')return 'Cached status cannot confirm your execution context. Run redue status without --cached, or rerun the check.';
+  if(/requires? a synchronized content read/.test(reason))return 'Cached status cannot establish applicability here. Run redue status without --cached, or rerun the check.';
   if(reason.startsWith('input coverage unresolved: '))return 'Recording-only: '+reason.slice(27);
   if(/input plan (rebuilding|indexing)|observer initialization|input observation reconciliation pending/.test(reason))
     return 'Checking inputs after startup or changes. Wait for observation to finish, then query again.';
@@ -56,6 +56,6 @@ export function renderRun(value) {
   if(value.invocation!=='exited')lines.push(`Invocation ${value.invocation}; no reusable passing evidence.`);
   else if(!value.coverage_qualified)lines.push('Applicability remains UNVERIFIED: input coverage is incomplete.');
   else if(!value.stable)lines.push('Applicability remains UNVERIFIED: inputs changed or observation was unavailable during execution.');
-  else lines.push('Inspect redue status before reusing this evidence. Cached status may require --sync to establish applicability.');
+  else lines.push('Check redue status before reusing this evidence.');
   return lines.join('\n');
 }

package/src/python-onboarding.mjs

@@ -1,10 +1,10 @@
-// Python projects for `redue init`: typecheck and lint checks that run mypy,
-// pyright, ty or ruff from the project's .venv under the sandboxed recipe
+// Python projects for `redue init`: typecheck, lint and test checks that run
+// mypy, pyright, ty, ruff or pytest from the project's .venv under the sandboxed recipe
 // (sandbox.mjs). A tool is proposed when it is installed in .venv/bin. Its
 // arguments are the ones the project runs it with, read from CI workflows,
 // the Makefile, tox, nox, a justfile and shell scripts; without one, the
-// tool's own default (`ruff check`, `ty check`, `pyright`, and `mypy` with
-// its configured files or `.`).
+// tool's own default (`ruff check`, `ty check`, `pyright`, `pytest`, and
+// `mypy` with its configured files or `.`).
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
@@ -15,7 +15,7 @@ const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
 const executable=file=>{try{fs.accessSync(file,fs.constants.X_OK);return fs.statSync(file).isFile();}catch{return false;}};
 // Each tool, its kind, and the subcommand it runs as a check.
 export const pythonTools=[{tool:'mypy',kind:'typecheck',sub:[]},{tool:'pyright',kind:'typecheck',sub:[]},
-  {tool:'ty',kind:'typecheck',sub:['check']},{tool:'ruff',kind:'lint',sub:['check']}];
+  {tool:'ty',kind:'typecheck',sub:['check']},{tool:'ruff',kind:'lint',sub:['check']},{tool:'pytest',kind:'test',sub:[]}];
 // The text of a TOML or INI section, up to the next section header.
 const section=(text,header)=>{const at=text.split(/\r?\n/).findIndex(line=>line.trim()===header);
   if(at<0)return null;const rest=text.split(/\r?\n/).slice(at+1);const end=rest.findIndex(line=>/^\s*\[/.test(line));
@@ -27,7 +27,9 @@ const wrappers=[/^uv run(?: --(?:frozen|locked|no-sync|offline|quiet|all-extras|
   /^\$\{?[A-Za-z_]+\}?(?=[A-Za-z])/];
 // A tool's arguments in one line of a script or workflow, or null. The line
 // must run the tool and its subcommand plainly; arguments with shell syntax,
-// or ones that change files or install packages, are not taken.
+// ones that change files or install packages, and pytest's that run a set
+// chosen from its cache (--lf, --ff, --sw, --nf), show the cache, loop
+// (-f), rewrite snapshots or add to earlier coverage data, are not taken.
 export function toolArgs(line,{tool,sub}){
   let text=line.trim().replace(/^-\s+/,'').replace(/^run:\s*/,'').replace(/^[@-]+/,'');
   text=text.split(/\s(?:&&|\|\||;|\|)\s/)[0].replace(/\s+/g,' ').trim();
@@ -35,7 +37,7 @@ export function toolArgs(line,{tool,sub}){
   const words=text.split(' ');
   if(words[0]!==tool||JSON.stringify(words.slice(1,1+sub.length))!==JSON.stringify(sub))return null;
   const args=words.slice(1+sub.length);
-  if(args.some(arg=>!/^[A-Za-z0-9_./:=,@+%-]+$/.test(arg)||/^--(?:fix|unsafe-fixes|write|install-types|watch)(?:=|$)/.test(arg)||arg.startsWith('..')||arg.startsWith('/')))return null;
+  if(args.some(arg=>!/^[A-Za-z0-9_./:=,@+%-]+$/.test(arg)||/^--(?:fix|unsafe-fixes|write|install-types|watch|lf|last-failed|ff|failed-first|sw|sw-skip|sw-reset|stepwise|stepwise-skip|stepwise-reset|nf|new-first|cache-show|looponfail|snapshot-update|update-snapshots|inline-snapshot|cov-append)(?:=|$)/.test(arg)||arg==='-f'||arg.startsWith('..')||arg.startsWith('/')))return null;
   return args;
 }
 // The places a project writes how it runs its tools, in order of preference.