chainlesschain 0.162.174 → 0.162.176

package/src/lib/process-execution-broker/index.js

@@ -1,10 +1,11 @@
 /**
- * Process Execution Broker — M1+M2+M3+M4+M5 集成
+ * Process Execution Broker — P0-1 生产化
  * 对应文档 §2.1 四层架构 Layer 1
  *
  * 统一拦截所有子进程执行：
  * - M1: 所有子进程唯一入口，权限检查
- * - M2: 沙箱分发（shell/sdk/jsii）
+ * - **P0-1**: 三平台原生沙箱 (macOS Seatbelt / Windows Job Object / Linux seccomp)
+ * - **P0-1**: 凭据代理 default-on（secrets 永远不裸传给子进程）
  * - M3: 集成W3C trace context自动传播
  * - M4: 自动写入Runtime Provenance Ledger (RPL)
  * - M5: Hooks v2事件发射
@@ -25,12 +26,23 @@ import crypto from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+// P0-1: 平台沙箱 + 凭据代理
+// platform-sandbox.js exports: applySandbox, postSpawnSandbox
+import {
+  applySandbox as _applySandbox,
+  postSpawnSandbox as _postSpawnSandbox,
+} from "./platform-sandbox.js";
+import { credentialAgent } from "./credential-agent.js";
 
 // 延迟导入避免循环依赖
 let _traceCtx = null;
 let _rpl = null;
 let _hooksV2 = null;
-let _ipcBus = null;
+const _ipcBus = null;
 
 function getTraceCtx() {
   if (!_traceCtx) {
@@ -72,13 +84,33 @@ class ProcessExecutionBroker extends EventEmitter {
     this._permissionState = new Map();
     this._defaultTimeout = 300000;
     this._blocked = new Set(["rm -rf /", "format c:", "del /f /s /q *"]);
-    this._stats = { totalSpawned: 0, allowed: 0, denied: 0, byOrigin: {} };
+    this._stats = {
+      totalSpawned: 0,
+      allowed: 0,
+      denied: 0,
+      byOrigin: {},
+      sandboxed: 0,
+      credFiltered: 0,
+    };
     this._logPath = path.join(
       os.homedir(),
       ".chainlesschain",
       "logs",
       "process-audit.log",
     );
+
+    // P0-1: Platform sandbox functions (applySandbox/postSpawnSandbox imported above)
+    // No instance needed — stateless functional API per platform
+
+    // P0-1: Credential filtering is default-on
+    this._credentialAgent = credentialAgent;
+    this._credentialFilteringEnabled = true;
+    this._sandboxEnabled = true;
+    // Keep the legacy aliases used by older call sites and make the strict
+    // plugin path use the same switches as the general broker path.
+    this._credentialAgentEnabled = true;
+    this._platformSandboxEnabled = true;
+
     this._ensureLogDir();
     this._loadPermissions();
   }
@@ -148,6 +180,75 @@ class ProcessExecutionBroker extends EventEmitter {
     return safe;
   }
 
+  _credentialBoundaryEnabled() {
+    return (
+      this._credentialFilteringEnabled !== false &&
+      this._credentialAgentEnabled !== false
+    );
+  }
+
+  _sanitizeAuditArgs(args) {
+    const values = Array.isArray(args) ? args : [];
+    try {
+      return this._credentialAgent.sanitizeArgs(values).sanitizedArgs;
+    } catch {
+      return values.map(() => "***REDACTION_FAILED***");
+    }
+  }
+
+  _applyCredentialBoundary(command, args, spawnOptions, origin) {
+    const originalArgs = Array.isArray(args) ? [...args] : [];
+    const originalEnv = spawnOptions.env || process.env;
+    const input = {
+      ...spawnOptions,
+      env: originalEnv,
+      args: originalArgs,
+      file: command,
+      origin,
+    };
+    let filtered;
+    let report = null;
+    if (typeof this._credentialAgent.applyWithReport === "function") {
+      const result = this._credentialAgent.applyWithReport(input);
+      filtered = result.spawnOptions;
+      report = result.report;
+    } else {
+      filtered = this._credentialAgent.apply(input);
+    }
+    const filteredArgs = Array.isArray(filtered?.args)
+      ? filtered.args
+      : originalArgs;
+    const filteredEnv = filtered?.env || {};
+    const inferredEnvCount = Object.keys(originalEnv).filter(
+      (key) =>
+        this._credentialAgent.isSensitiveKey?.(key) &&
+        !Object.prototype.hasOwnProperty.call(filteredEnv, key),
+    ).length;
+    const inferredArgCount = originalArgs.reduce(
+      (count, value, index) =>
+        count + (String(value) === String(filteredArgs[index]) ? 0 : 1),
+      0,
+    );
+    const credentialReport = report || {
+      envCount: inferredEnvCount,
+      argCount: inferredArgCount,
+      filtered: inferredEnvCount > 0 || inferredArgCount > 0,
+    };
+    return {
+      args: filteredArgs,
+      env: filteredEnv,
+      report: credentialReport,
+    };
+  }
+
+  _recordCredentialReport(auditEntry, report) {
+    const filtered = report?.filtered === true;
+    auditEntry.credentialFiltered = filtered;
+    auditEntry.credentialEnvCount = Number(report?.envCount || 0);
+    auditEntry.credentialArgCount = Number(report?.argCount || 0);
+    if (filtered) this._stats.credFiltered++;
+  }
+
   _getTraceContext() {
     const traceCtx = getTraceCtx();
     if (traceCtx && traceCtx.activeContext) {
@@ -224,7 +325,7 @@ class ProcessExecutionBroker extends EventEmitter {
       origin,
       scope,
       command,
-      args: args || [],
+      args: this._sanitizeAuditArgs(args),
       cwd,
       startTime,
       permissionDecision: decision,
@@ -235,6 +336,9 @@ class ProcessExecutionBroker extends EventEmitter {
       exitCode: null,
       endTime: null,
       durationMs: null,
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
     };
 
     if (decision === "deny" || decision === "prompt") {
@@ -269,9 +373,73 @@ class ProcessExecutionBroker extends EventEmitter {
       spawnOpts.env.TRACEPARENT = traceCtx.traceparent;
     }
 
+    // P0-1: Credential filtering (default-on) — strip secrets from env/args
+    if (this._credentialBoundaryEnabled()) {
+      const credentialBoundary = this._applyCredentialBoundary(
+        command,
+        args,
+        spawnOpts,
+        origin,
+      );
+      spawnOpts.env = credentialBoundary.env;
+      args = credentialBoundary.args;
+      auditEntry.args = [...args];
+      this._recordCredentialReport(auditEntry, credentialBoundary.report);
+    }
+
+    // P0-1: Platform sandbox wrapping — apply macOS/Windows/Linux sandbox
+    const optsForSpawn = { ...spawnOpts };
+    let sandboxApplied = false;
+    let sandboxProfile = null;
+    if (this._platformSandboxEnabled) {
+      try {
+        const result = _applySandbox(
+          command,
+          args || [],
+          optsForSpawn,
+          "default",
+        );
+        if (result && result.applied) {
+          Object.assign(optsForSpawn, result.options || {});
+          if (result.command) command = result.command;
+          if (result.args) args = result.args;
+          sandboxApplied = true;
+          sandboxProfile = result.profile || null;
+          this._stats.sandboxed++;
+        }
+        auditEntry.sandboxed = sandboxApplied;
+        auditEntry.sandboxProfile = sandboxProfile;
+      } catch (sandboxErr) {
+        // Fail closed: if sandbox setup fails on strict, deny spawn
+        if (process.env.CC_SANDBOX_STRICT === "1") {
+          auditEntry.deniedReason = `sandbox-init-failed: ${sandboxErr.message}`;
+          this._auditLog.push(auditEntry);
+          const err = new Error(`Sandbox init failed: ${sandboxErr.message}`);
+          err.auditEntry = auditEntry;
+          throw err;
+        }
+        // Non-strict: warn but allow (development mode)
+        process.emitWarning(
+          `Sandbox init failed (continuing without): ${sandboxErr.message}`,
+        );
+      }
+    }
+
     // Use native spawn from _native (set by patch-child-process.js)
-    const nativeSpawn = this._native?.spawn || nativeSpawn;
-    const proc = nativeSpawn(command, args, spawnOpts);
+    const nativeSpawnFn = this._native?.spawn || nativeSpawn;
+    const proc = nativeSpawnFn(command, args, optsForSpawn);
+
+    // P0-1: Post-spawn sandbox setup (Windows Job Object association, etc.)
+    if (sandboxApplied && proc.pid) {
+      try {
+        _postSpawnSandbox(proc, sandboxProfile);
+      } catch (postErr) {
+        process.emitWarning(
+          `Post-spawn sandbox setup failed: ${postErr.message}`,
+        );
+      }
+    }
+
     auditEntry.pid = proc.pid;
     this._recordAudit(auditEntry);
     this._writeRplEntry(auditEntry, "started");
@@ -313,7 +481,10 @@ class ProcessExecutionBroker extends EventEmitter {
         error: err.message,
         component: origin,
       });
-      this.emit("error", auditEntry);
+      // EventEmitter treats an unhandled `error` event as an exception. A
+      // process ENOENT must reach the child-process listener/callback instead
+      // of crashing callers that did not subscribe to broker diagnostics.
+      if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
     });
     return proc;
   }
@@ -339,7 +510,7 @@ class ProcessExecutionBroker extends EventEmitter {
       origin,
       scope,
       command,
-      args: args || [],
+      args: this._sanitizeAuditArgs(args),
       cwd,
       startTime,
       permissionDecision: decision,
@@ -347,6 +518,9 @@ class ProcessExecutionBroker extends EventEmitter {
       isDangerous,
       shell: !!options.shell,
       sync: true,
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
     };
 
     if (decision === "deny" || decision === "prompt") {
@@ -374,9 +548,59 @@ class ProcessExecutionBroker extends EventEmitter {
       spawnOpts.env.TRACEPARENT = traceCtx.traceparent;
     }
 
-    const nativeSpawnSync = this._native?.spawnSync || nativeSpawnSync;
+    // P0-1: Credential filtering agent — strip secrets from env/args before spawn
+    if (this._credentialBoundaryEnabled()) {
+      const credentialBoundary = this._applyCredentialBoundary(
+        command,
+        args,
+        spawnOpts,
+        origin,
+      );
+      spawnOpts.env = credentialBoundary.env;
+      args = credentialBoundary.args;
+      auditEntry.args = [...args];
+      this._recordCredentialReport(auditEntry, credentialBoundary.report);
+    }
+
+    // P0-1: Platform sandbox wrapping (sync path)
+    const optsForSync = { ...spawnOpts };
+    let sandboxApplied = false;
+    let sandboxProfile = null;
+    if (this._platformSandboxEnabled) {
+      try {
+        const result = _applySandbox(
+          command,
+          args || [],
+          optsForSync,
+          "default",
+        );
+        if (result && result.applied) {
+          Object.assign(optsForSync, result.options || {});
+          if (result.command) command = result.command;
+          if (result.args) args = result.args;
+          sandboxApplied = true;
+          sandboxProfile = result.profile || null;
+          this._stats.sandboxed++;
+        }
+        auditEntry.sandboxed = sandboxApplied;
+        auditEntry.sandboxProfile = sandboxProfile;
+      } catch (sandboxErr) {
+        if (process.env.CC_SANDBOX_STRICT === "1") {
+          auditEntry.deniedReason = `sandbox-init-failed: ${sandboxErr.message}`;
+          this._recordAudit(auditEntry);
+          const err = new Error(`Sandbox init failed: ${sandboxErr.message}`);
+          err.auditEntry = auditEntry;
+          throw err;
+        }
+        process.emitWarning(
+          `Sandbox init failed (sync): ${sandboxErr.message}`,
+        );
+      }
+    }
+
+    const nativeSpawnSyncFn = this._native?.spawnSync || nativeSpawnSync;
     try {
-      const result = nativeSpawnSync(command, args, spawnOpts);
+      const result = nativeSpawnSyncFn(command, args, optsForSync);
       auditEntry.exitCode = result.status;
       auditEntry.endTime = Date.now();
       auditEntry.durationMs = auditEntry.endTime - startTime;
@@ -393,6 +617,94 @@ class ProcessExecutionBroker extends EventEmitter {
     }
   }
 
+  /**
+   * Route a node-pty session through the same provenance and credential
+   * boundary as child_process execution. node-pty owns the native PTY
+   * allocation, so the platform sandbox is reported as unavailable here
+   * rather than being falsely marked as applied.
+   */
+  spawnPty(ptyModule, command, args = [], options = {}) {
+    if (!ptyModule || typeof ptyModule.spawn !== "function") {
+      throw new TypeError("pty_module_spawn_unavailable");
+    }
+    const executionId = crypto.randomUUID();
+    const startTime = Date.now();
+    const origin = options.origin || "terminal:pty";
+    const scope = options.scope || "terminal";
+    const policy = options.policy || "allow";
+    const auditEntry = {
+      executionId,
+      traceId: this._getTraceContext()?.traceId || null,
+      origin,
+      scope,
+      command,
+      args: this._sanitizeAuditArgs(args),
+      cwd: options.cwd || process.cwd(),
+      startTime,
+      permissionDecision: policy,
+      policy,
+      operation: "pty.spawn",
+      pty: true,
+      sandboxed: false,
+      sandboxReason: "native_pty_host_boundary",
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
+    };
+    if (policy === "deny" || policy === "prompt") {
+      auditEntry.deniedReason = `policy_${policy}`;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = 0;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(
+        auditEntry,
+        "denied",
+        new Error(auditEntry.deniedReason),
+      );
+      const error = new Error(`PTY spawn denied: ${auditEntry.deniedReason}`);
+      error.auditEntry = auditEntry;
+      throw error;
+    }
+
+    const spawnOptions = { ...options, args: [...auditEntry.args] };
+    delete spawnOptions.origin;
+    delete spawnOptions.policy;
+    delete spawnOptions.scope;
+    delete spawnOptions.pluginId;
+    delete spawnOptions.pluginVersion;
+    delete spawnOptions.pluginSource;
+    try {
+      if (this._credentialBoundaryEnabled()) {
+        const credentialBoundary = this._applyCredentialBoundary(
+          command,
+          args,
+          spawnOptions,
+          origin,
+        );
+        spawnOptions.env = credentialBoundary.env;
+        spawnOptions.args = credentialBoundary.args;
+        auditEntry.args = [...credentialBoundary.args];
+        this._recordCredentialReport(auditEntry, credentialBoundary.report);
+      }
+      const filteredArgs = spawnOptions.args || [];
+      delete spawnOptions.args;
+      const proc = ptyModule.spawn(command, filteredArgs, spawnOptions);
+      auditEntry.pid = proc?.pid ?? null;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = auditEntry.endTime - startTime;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "started");
+      return proc;
+    } catch (error) {
+      auditEntry.error = error.message;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = auditEntry.endTime - startTime;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "error", error);
+      throw error;
+    }
+  }
+
   exec(command, options, callback) {
     const opts = typeof options === "function" ? {} : options;
     const cb = typeof options === "function" ? options : callback;
@@ -409,15 +721,129 @@ class ProcessExecutionBroker extends EventEmitter {
       shell: true,
       origin: options.origin || "shell:execSync",
     };
-    return this.spawnSync(command, [], spawnOpts);
+    const result = this.spawnSync(command, [], spawnOpts);
+    if (result?.error) throw result.error;
+    if (result?.status != null && result.status !== 0) {
+      const error = new Error(
+        `Command failed (exit ${result.status}): ${command}`,
+      );
+      error.status = result.status;
+      error.stdout = result.stdout;
+      error.stderr = result.stderr;
+      throw error;
+    }
+    return result?.stdout ?? "";
   }
 
   execFile(file, args, options, callback) {
-    return this.spawn(file, args, options || {});
+    if (typeof args === "function") {
+      callback = args;
+      args = [];
+      options = {};
+    } else if (!Array.isArray(args)) {
+      callback = typeof options === "function" ? options : callback;
+      options = args || {};
+      args = [];
+    } else if (typeof options === "function") {
+      callback = options;
+      options = {};
+    }
+
+    options = options || {};
+    const proc = this.spawn(file, args, options);
+    if (typeof callback !== "function") return proc;
+
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    const outputEncoding = options.encoding ?? "utf8";
+    const returnBuffers =
+      outputEncoding === "buffer" || outputEncoding === null;
+    const configuredMaxBuffer = options.maxBuffer;
+    const maxBuffer =
+      configuredMaxBuffer === Infinity
+        ? Infinity
+        : Number.isFinite(configuredMaxBuffer) && configuredMaxBuffer >= 0
+          ? configuredMaxBuffer
+          : 1024 * 1024;
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let completionError = null;
+    let completed = false;
+
+    const asBuffer = (chunk) =>
+      Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    const render = (chunks) => {
+      const value = Buffer.concat(chunks);
+      return returnBuffers ? value : value.toString(outputEncoding);
+    };
+    const finish = (error, code = null, signal = null) => {
+      if (completed) return;
+      completed = true;
+      const stdout = render(stdoutChunks);
+      const stderr = render(stderrChunks);
+      if (error) {
+        error.stdout = stdout;
+        error.stderr = stderr;
+        if (error.status === undefined) error.status = code;
+        if (error.signal === undefined) error.signal = signal;
+      }
+      callback(error, stdout, stderr);
+    };
+    const collect = (stream, chunks, streamName) => {
+      if (!stream || typeof stream.on !== "function") return;
+      stream.on("data", (chunk) => {
+        const value = asBuffer(chunk);
+        chunks.push(value);
+        if (streamName === "stdout") stdoutBytes += value.length;
+        else stderrBytes += value.length;
+        const streamBytes = streamName === "stdout" ? stdoutBytes : stderrBytes;
+        if (!completionError && streamBytes > maxBuffer) {
+          completionError = new Error(`${streamName} maxBuffer exceeded`);
+          completionError.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
+          completionError.stream = streamName;
+          try {
+            proc.kill(options.killSignal || "SIGTERM");
+          } catch {}
+        }
+      });
+    };
+
+    collect(proc.stdout, stdoutChunks, "stdout");
+    collect(proc.stderr, stderrChunks, "stderr");
+    proc.once("error", (error) => finish(error));
+    proc.once("close", (code, signal) => {
+      if (completionError) return finish(completionError, code, signal);
+      if (code === 0) return finish(null, code, signal);
+      const error = new Error(
+        `Command failed (exit ${code ?? "unknown"}): ${file}`,
+      );
+      error.code = code;
+      error.killed = Boolean(proc.killed);
+      error.signal = signal;
+      error.status = code;
+      return finish(error, code, signal);
+    });
+    return proc;
   }
 
   execFileSync(file, args, options = {}) {
-    return this.spawnSync(file, args, options);
+    if (!Array.isArray(args)) {
+      options = args || {};
+      args = [];
+    }
+    const result = this.spawnSync(file, args, options);
+    if (result?.error) throw result.error;
+    if (result?.status !== 0) {
+      const error = new Error(
+        `Command failed (exit ${result?.status ?? "unknown"}): ${file}`,
+      );
+      error.status = result?.status ?? null;
+      error.signal = result?.signal ?? null;
+      error.stdout = result?.stdout;
+      error.stderr = result?.stderr;
+      throw error;
+    }
+    return result?.stdout ?? "";
   }
 
   fork(modulePath, args, options = {}) {

package/src/lib/process-execution-broker/patch-child-process.js

@@ -3,10 +3,9 @@
  * This runs at CLI startup, before any other imports, ensuring every subprocess is audited
  */
 import { createRequire } from "node:module";
-const require = createRequire(import.meta.url);
+import { executionBroker } from "./index.js";
 
-// Import ExecutionBroker singleton
-const { executionBroker } = require("./index.js");
+const require = createRequire(import.meta.url);
 
 // Get the REAL native child_process module (unpatched, from Node.js internals)
 const nativeCp = require("node:child_process");