@remodex/rmx 1.0.2

package/src/codex/native-main-auth-temp.ts

@@ -0,0 +1,187 @@
+import {
+  closeSync,
+  constants as fsConstants,
+  fstatSync,
+  fsyncSync,
+  ftruncateSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  realpathSync,
+  unlinkSync,
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+const AUTH_TEMP_NAME = /^auth\.json\.ocx\.[1-9]\d*\.[1-9]\d*\.tmp$/;
+const MAX_AUTH_TEMP_RESIDUES = 128;
+
+interface PathIdentity {
+  readonly dev: bigint;
+  readonly ino: bigint;
+}
+
+export interface NativeMainAuthTempScrubTestSeam {
+  /** Test-only race seam. Production never supplies this callback. */
+  beforeOpen?: (path: string) => void;
+  /** Test-only removal-failure seam. Production never supplies this callback. */
+  beforeUnlink?: (path: string) => void;
+}
+
+export interface NativeMainAuthTempScrubResult {
+  scrubbed: number;
+}
+
+function cleanupRequired(): NativeProfileError {
+  return new NativeProfileError(
+    "AUTH_TEMP_CLEANUP_REQUIRED",
+    "A native-main credential write residue could not be safely removed; manual cleanup is required.",
+    500,
+    false,
+    true,
+  );
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function sameIdentity(stats: { dev: bigint; ino: bigint }, expected: PathIdentity): boolean {
+  return stats.dev === expected.dev && stats.ino === expected.ino;
+}
+
+function samePath(left: string, right: string): boolean {
+  return resolve(left) === resolve(right);
+}
+
+function inspectCanonicalParent(path: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isDirectory() || entry.isSymbolicLink()) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function inspectExactPath(path: string, parent: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  if (!samePath(dirname(absolute), parent)) throw cleanupRequired();
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute) || !samePath(dirname(canonical), parent)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function exactResidues(parent: string, parentIdentity: PathIdentity): string[] {
+  inspectCanonicalParent(parent, parentIdentity);
+  const names = readdirSync(parent).filter(name => AUTH_TEMP_NAME.test(name)).sort();
+  inspectCanonicalParent(parent, parentIdentity);
+  if (names.length > MAX_AUTH_TEMP_RESIDUES) throw cleanupRequired();
+  return names;
+}
+
+function assertOpenIdentity(
+  fd: number,
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  expected: PathIdentity,
+  expectedLinks: bigint,
+): void {
+  inspectCanonicalParent(parent, parentIdentity);
+  const opened = fstatSync(fd, { bigint: true });
+  if (
+    !opened.isFile()
+    || !sameIdentity(opened, expected)
+    || opened.nlink !== expectedLinks
+  ) throw cleanupRequired();
+  inspectExactPath(path, parent, expected);
+  inspectCanonicalParent(parent, parentIdentity);
+}
+
+function scrubOne(
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  seam: NativeMainAuthTempScrubTestSeam,
+): void {
+  const observed = inspectExactPath(path, parent);
+  inspectCanonicalParent(parent, parentIdentity);
+  seam.beforeOpen?.(path);
+
+  const flags = process.platform === "win32"
+    ? fsConstants.O_RDWR
+    : fsConstants.O_RDWR | fsConstants.O_NOFOLLOW;
+  let fd: number | undefined;
+  let failed = false;
+  try {
+    fd = openSync(path, flags);
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+
+    ftruncateSync(fd, 0);
+    fsyncSync(fd);
+    const truncated = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(truncated, observed) || truncated.nlink !== 1n || truncated.size !== 0n) {
+      throw cleanupRequired();
+    }
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+    seam.beforeUnlink?.(path);
+
+    // The lifetime owner and exclusive claim exclude cooperative Remodex writers.
+    // A malicious process running as the same OS user can still race Node's final
+    // identity-check/unlink gap and is intentionally outside this trusted-owner boundary.
+    unlinkSync(path);
+    const unlinked = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(unlinked, observed) || unlinked.nlink !== 0n || unlinked.size !== 0n) {
+      throw cleanupRequired();
+    }
+    try {
+      lstatSync(path);
+      throw cleanupRequired();
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      if (errorCode(error) !== "ENOENT") throw error;
+    }
+    inspectCanonicalParent(parent, parentIdentity);
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); }
+      catch (error) { if (!failed) throw error; }
+    }
+  }
+}
+
+/**
+ * Remove only crash residues created by atomicWriteFileAsync for canonical auth.json.
+ * The caller must hold the lifetime native-main owner and exclusive credential claim.
+ */
+export function scrubNativeMainAuthTempResidues(
+  context: NativeProfileContext,
+  seam: NativeMainAuthTempScrubTestSeam = {},
+): NativeMainAuthTempScrubResult {
+  try {
+    const parent = resolve(context.codexHome);
+    const parentIdentity = inspectCanonicalParent(parent);
+    const names = exactResidues(parent, parentIdentity);
+    for (const name of names) {
+      scrubOne(join(parent, name), parent, parentIdentity, seam);
+    }
+    // A cooperative writer cannot create a new residue while the owner and
+    // exclusive claim are held. Seeing one now is ambiguous, so admission stays closed.
+    if (exactResidues(parent, parentIdentity).length !== 0) throw cleanupRequired();
+    return { scrubbed: names.length };
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    throw cleanupRequired();
+  }
+}

package/src/codex/native-main-claim.ts

@@ -0,0 +1,167 @@
+import { join } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import {
+  assertStableLockFile,
+  hardenStableLockFile,
+  openStableLockFile,
+  type StableLockFile,
+} from "./native-main-lock-file";
+import { nativeMainOwnerFilesystemSupported } from "./native-main-owner";
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+export const NATIVE_MAIN_CLAIM_DB = ".opencodex-native-main.claim.sqlite";
+
+export interface NativeMainClaimOptions {
+  waitMs?: number;
+  pollMs?: number;
+  hardenPath?: (path: string) => Promise<void>;
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+}
+
+const hardenedIdentities = new Map<string, string>();
+
+export function nativeMainClaimPath(context: NativeProfileContext): string {
+  return join(context.codexHome, NATIVE_MAIN_CLAIM_DB);
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function isBusy(error: unknown): boolean {
+  const code = errorCode(error);
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+function busyClaimError(message: string): NativeProfileError {
+  return new NativeProfileError("NATIVE_MAIN_CLAIM_BUSY", message, 503, true);
+}
+
+function unavailableClaimError(): NativeProfileError {
+  return new NativeProfileError(
+    "NATIVE_MAIN_CLAIM_UNAVAILABLE",
+    "The native-main cross-process claim is unavailable.",
+    503,
+    true,
+  );
+}
+
+function mapClaimSetupError(error: unknown, busyMessage: string): NativeProfileError {
+  if (error instanceof NativeProfileError) return error;
+  return isBusy(error) ? busyClaimError(busyMessage) : unavailableClaimError();
+}
+
+async function openClaimDatabase(
+  context: NativeProfileContext,
+  options: NativeMainClaimOptions,
+): Promise<{ database: Database; file: StableLockFile }> {
+  const platform = options.platform ?? process.platform;
+  if (!nativeMainOwnerFilesystemSupported(context.codexHome, platform, options.env ?? process.env)) {
+    throw new NativeProfileError(
+      "NATIVE_MAIN_CLAIM_UNAVAILABLE",
+      "Native-main claims are unsupported on this CODEX_HOME filesystem.",
+      503,
+      true,
+    );
+  }
+  const path = nativeMainClaimPath(context);
+  let file: StableLockFile | undefined;
+  let database: Database | undefined;
+  try {
+    file = openStableLockFile(path, platform);
+    const identity = `${file.dev}:${file.ino}`;
+    if (hardenedIdentities.get(path) !== identity) {
+      // The resolved platform is threaded into the DEFAULT hardener, not left to
+      // `hardenStableLockFile`'s own `process.platform` read. Otherwise a test
+      // that forces `platform` here still exercises the host's branch, and the
+      // production default — the thing that actually hardens a coordinator
+      // database — stays unproved. An audit deleted this call entirely and 89
+      // tests stayed green, because nearly every claim test injects `hardenPath`.
+      await (options.hardenPath ?? ((target: string) => hardenStableLockFile(target, platform)))(path);
+      assertStableLockFile(path, file);
+      hardenedIdentities.set(path, identity);
+    }
+    database = new Database(path, { create: true });
+    // Journal-mode negotiation itself may need a database lock. Disable
+    // SQLite's synchronous busy wait first so a contender never blocks Bun's
+    // event loop while the current shared holder is waiting for JS to release.
+    database.exec("PRAGMA busy_timeout = 0; PRAGMA locking_mode = NORMAL");
+    const mode = database.query<{ journal_mode: string }, []>("PRAGMA journal_mode = DELETE").get()?.journal_mode;
+    if (mode?.toLowerCase() !== "delete") throw new Error("native-main claim database is not in rollback-journal mode");
+    assertStableLockFile(path, file);
+    return { database, file };
+  } catch (error) {
+    try { database?.close(); } catch { /* mapped below */ }
+    try { file?.close(); } catch { /* mapped below */ }
+    throw mapClaimSetupError(error, "Native-main credentials are changing.");
+  }
+}
+
+function releaseClaim(database: Database | undefined, file: StableLockFile | undefined): void {
+  try { database?.exec("ROLLBACK"); } catch { /* close still releases the OS-backed claim */ }
+  try { database?.close(); } catch { /* operation already completed */ }
+  try { file?.close(); } catch { /* operation already completed */ }
+}
+
+export async function withNativeMainSharedClaim<T>(
+  context: NativeProfileContext,
+  operation: () => Promise<T>,
+  options: NativeMainClaimOptions = {},
+): Promise<T> {
+  let database: Database | undefined;
+  let file: StableLockFile | undefined;
+  try {
+    ({ database, file } = await openClaimDatabase(context, options));
+    database.exec("BEGIN");
+    // A deferred BEGIN alone owns no lock. Reading page 1 through sqlite_schema
+    // establishes the SHARED lock that an exclusive transition must drain.
+    database.query<{ rootpage: number }, []>("SELECT rootpage FROM sqlite_schema LIMIT 1").get();
+    assertStableLockFile(nativeMainClaimPath(context), file);
+  } catch (error) {
+    releaseClaim(database, file);
+    throw mapClaimSetupError(error, "Native-main credentials are changing.");
+  }
+  try {
+    return await operation();
+  } finally {
+    releaseClaim(database, file);
+  }
+}
+
+export async function withNativeMainExclusiveClaim<T>(
+  context: NativeProfileContext,
+  operation: () => Promise<T>,
+  options: NativeMainClaimOptions = {},
+): Promise<T> {
+  const deadline = Date.now() + Math.max(0, options.waitMs ?? 0);
+  const pollMs = Math.max(1, options.pollMs ?? 50);
+  for (;;) {
+    let database: Database | undefined;
+    let file: StableLockFile | undefined;
+    try {
+      ({ database, file } = await openClaimDatabase(context, options));
+      database.exec("BEGIN EXCLUSIVE");
+      assertStableLockFile(nativeMainClaimPath(context), file);
+    } catch (error) {
+      releaseClaim(database, file);
+      const mapped = mapClaimSetupError(error, "Native-main credentials are in use.");
+      if (mapped.code === "NATIVE_MAIN_CLAIM_BUSY" && Date.now() < deadline) {
+        await Bun.sleep(Math.min(pollMs, Math.max(1, deadline - Date.now())));
+        continue;
+      }
+      throw mapped;
+    }
+    try {
+      return await operation();
+    } finally {
+      releaseClaim(database, file);
+    }
+  }
+}

package/src/codex/native-main-lock-file.ts

@@ -0,0 +1,162 @@
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  type Stats,
+} from "node:fs";
+
+import { hardenSecretPathAsync } from "../lib/windows-secret-acl";
+
+export interface StableLockFile {
+  readonly fd: number;
+  readonly dev: number;
+  readonly ino: number;
+  close(): void;
+}
+
+export class StableLockPathUnsafeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StableLockPathUnsafeError";
+  }
+}
+
+interface StableLockEntry {
+  readonly fd: number;
+  readonly dev: number;
+  readonly ino: number;
+  refs: number;
+}
+
+// POSIX fcntl locks are process-associated: closing any raw descriptor for an
+// inode can release SQLite locks held through a different descriptor in this
+// process. Keep one side descriptor per canonical lock path and close it only
+// after every SQLite user has closed its connection and released its reference.
+const stableLockEntries = new Map<string, StableLockEntry>();
+
+function reference(path: string, entry: StableLockEntry): StableLockFile {
+  let closed = false;
+  return {
+    fd: entry.fd,
+    dev: entry.dev,
+    ino: entry.ino,
+    close() {
+      if (closed) return;
+      closed = true;
+      entry.refs = Math.max(0, entry.refs - 1);
+      if (entry.refs !== 0) return;
+      if (stableLockEntries.get(path) === entry) stableLockEntries.delete(path);
+      closeSync(entry.fd);
+    },
+  };
+}
+
+function assertRegular(stats: Stats, path: string): void {
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new StableLockPathUnsafeError(`unsafe SQLite lock path: ${path}`);
+  }
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function matches(handle: StableLockFile, stats: Stats): boolean {
+  return handle.dev === stats.dev && handle.ino === stats.ino;
+}
+
+export function openStableLockFile(path: string, platform: NodeJS.Platform = process.platform): StableLockFile {
+  const retained = stableLockEntries.get(path);
+  if (retained) {
+    retained.refs += 1;
+    const handle = reference(path, retained);
+    try {
+      assertStableLockFile(path, handle);
+      return handle;
+    } catch (error) {
+      handle.close();
+      throw error;
+    }
+  }
+  if (existsSync(path)) assertRegular(lstatSync(path), path);
+  const noFollow = platform === "win32" ? 0 : constants.O_NOFOLLOW;
+  const fd = openSync(path, constants.O_RDWR | constants.O_CREAT | noFollow, 0o600);
+  try {
+    const descriptor = fstatSync(fd);
+    assertRegular(descriptor, path);
+    const entry: StableLockEntry = {
+      fd,
+      dev: descriptor.dev,
+      ino: descriptor.ino,
+      refs: 1,
+    };
+    stableLockEntries.set(path, entry);
+    const handle = reference(path, entry);
+    assertStableLockFile(path, handle);
+    return handle;
+  } catch (error) {
+    const entry = stableLockEntries.get(path);
+    if (entry?.fd === fd) stableLockEntries.delete(path);
+    closeSync(fd);
+    throw error;
+  }
+}
+
+export function assertStableLockFile(path: string, handle: StableLockFile): void {
+  let pathStats: Stats;
+  try {
+    pathStats = lstatSync(path);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") {
+      throw new StableLockPathUnsafeError(`SQLite lock path identity changed: ${path}`);
+    }
+    throw error;
+  }
+  assertRegular(pathStats, path);
+  if (!matches(handle, pathStats)) {
+    throw new StableLockPathUnsafeError(`SQLite lock path identity changed: ${path}`);
+  }
+}
+
+/**
+ * Harden the stable lock file: chmod everywhere, per-user NTFS ACLs on Windows.
+ *
+ * The platform is a parameter rather than a direct `process.platform` read so the
+ * Windows branch is reachable from a test. It was not, and an audit deleted the
+ * whole ACL delegation without a single test noticing — the primitive underneath
+ * had 73 tests while the call edge that activates it had none. That is the same
+ * absence-as-guarantee defect one layer up: proving a mechanism works says nothing
+ * about whether production still calls it.
+ *
+ * `required: true` is deliberate: a failure to apply the ACL must reject rather
+ * than leave a coordinator database readable by other accounts.
+ */
+export async function hardenStableLockFile(
+  path: string,
+  platform: NodeJS.Platform = process.platform,
+  options: { retryTimedOutOnce?: boolean } = {},
+): Promise<void> {
+  if (platform === "win32") {
+    // Best-effort here: POSIX modes are not authoritative on NTFS, and the
+    // required ACL hardening below is what actually decides.
+    try { chmodSync(path, 0o600); } catch { /* ACL below is authoritative. */ }
+    await hardenSecretPathAsync(path, {
+      required: true,
+      retryTimedOutOnce: options.retryTimedOutOnce,
+    });
+    return;
+  }
+  // On POSIX the mode IS the mechanism, so a failure may not be swallowed.
+  //
+  // The previous unconditional catch was a real fail-open: a coordinator
+  // database that already existed with permissive bits stayed permissive, and
+  // the caller was told the lock file had been hardened. Creation mode 0600 does
+  // not repair an existing file, and there is no ACL fallback outside Windows.
+  chmodSync(path, 0o600);
+}