chainlesschain 0.162.182 → 0.162.184

package/src/lib/plugin-monitor-supervisor.js

@@ -25,6 +25,7 @@ import { executionBroker } from "./process-execution-broker/index.js";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
 import { monitorEventId } from "./monitor-event.js";
+import { resolvePluginWorkspaceAuthority } from "./plugin-runtime/sandbox-policy.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -44,7 +45,9 @@ export class PluginMonitorSupervisor {
     this._pluginSpawn = opts.brokerSpawn || this._spawn;
     const eventRuntimeStore =
       opts.eventRuntimeStore ||
-      (process.env.CC_EVENT_RUNTIME_DURABLE === "1" ? new EventRuntimeStore() : null);
+      (process.env.CC_EVENT_RUNTIME_DURABLE === "1"
+        ? new EventRuntimeStore()
+        : null);
     this._runtimeProducer = eventRuntimeStore
       ? new EventRuntimeProducer({ store: eventRuntimeStore, emitter: this })
       : null;
@@ -118,7 +121,11 @@ export class PluginMonitorSupervisor {
           { origin: "monitor", id: monitorEventId(desc.id, { stream, line }) },
         );
       } catch (error) {
-        this._outputs.push({ ...output, stream: "error", line: `durable publish failed: ${error.message}` });
+        this._outputs.push({
+          ...output,
+          stream: "error",
+          line: `durable publish failed: ${error.message}`,
+        });
       }
       if (this._outputs.length > OUTPUT_RING) this._outputs.shift();
     }
@@ -211,24 +218,54 @@ export class PluginMonitorSupervisor {
 
   _spawnForDescriptor(desc, options) {
     const isPlugin = desc?.origin === "plugin:monitor";
+    const pluginWorkspaceRoot = isPlugin
+      ? resolvePluginWorkspaceAuthority(desc.pluginWorkspaceAuthority, {
+          origin: desc.origin,
+          pluginId: desc.pluginId,
+          pluginVersion: desc.pluginVersion,
+          pluginSource: desc.pluginSource,
+        })
+      : null;
+    if (
+      isPlugin &&
+      desc.sandboxPolicy?.requiredBoundaries?.length > 0 &&
+      !pluginWorkspaceRoot
+    ) {
+      throw new Error(
+        `plugin monitor "${desc.id || desc.name || "unknown"}" is missing its trusted workspace authority`,
+      );
+    }
+    const spawnOptions = {
+      ...options,
+      origin: isPlugin ? desc.origin : "plugin-monitor:process",
+      policy: "allow",
+      scope: "plugin-monitor",
+      ...(isPlugin
+        ? {
+            pluginId: desc.pluginId,
+            pluginVersion: desc.pluginVersion,
+            pluginSource: desc.pluginSource,
+            ...(desc.sandboxPolicy
+              ? { sandboxPolicy: desc.sandboxPolicy }
+              : {}),
+          }
+        : {}),
+    };
+    const sandboxExecutionContract =
+      isPlugin && pluginWorkspaceRoot
+        ? executionBroker.issueLinuxWorkspaceSandboxExecutionContract(
+            desc.command,
+            desc.args,
+            spawnOptions,
+            pluginWorkspaceRoot,
+          )
+        : null;
     return (isPlugin ? this._pluginSpawn : this._spawn)(
       desc.command,
       desc.args,
       {
-        ...options,
-        origin: isPlugin ? desc.origin : "plugin-monitor:process",
-        policy: "allow",
-        scope: "plugin-monitor",
-        ...(isPlugin
-          ? {
-              pluginId: desc.pluginId,
-              pluginVersion: desc.pluginVersion,
-              pluginSource: desc.pluginSource,
-              ...(desc.sandboxPolicy
-                ? { sandboxPolicy: desc.sandboxPolicy }
-                : {}),
-            }
-          : {}),
+        ...spawnOptions,
+        ...(sandboxExecutionContract ? { sandboxExecutionContract } : {}),
       },
     );
   }

package/src/lib/plugin-runtime/bin.js

@@ -1118,7 +1118,7 @@ export function createPluginSandboxExecutionContract(invocation) {
       contractVersion: 1,
       kind:
         runtime === "native"
-          ? "strict-plugin-native-static-elf-bin"
+          ? "strict-plugin-native-elf-bin"
           : "strict-plugin-node-bin",
       pluginRoot,
       workingDirectory: pluginRoot,