chainlesschain 0.162.197 → 0.162.200

package/src/lib/process-tree-termination.js

@@ -0,0 +1,253 @@
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const PROCESS_TREE_CLEANUP_MAX_MS = 2_000;
+export const PROCESS_TREE_GRACE_MAX_MS = 500;
+const TREE_MODES = new Set(["sandbox", "posix-group", "windows-tree"]);
+
+function boundedMilliseconds(value, fallback, maximum) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+  return Math.max(1, Math.min(maximum, Math.floor(parsed)));
+}
+
+function validChildPid(child) {
+  const pid = Number(child?.pid);
+  return Number.isInteger(pid) && pid > 0 && pid !== process.pid ? pid : null;
+}
+
+function childHasClosed(child, observedClose) {
+  return (
+    observedClose() ||
+    (child?.exitCode !== null && child?.exitCode !== undefined) ||
+    (child?.signalCode !== null && child?.signalCode !== undefined)
+  );
+}
+
+function posixGroupIsGone(pid, kill) {
+  try {
+    kill(-pid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === "ESRCH";
+  }
+}
+
+function requestDirectSignal(child, signal) {
+  try {
+    return child?.kill?.(signal) !== false;
+  } catch {
+    return false;
+  }
+}
+
+function requestPosixGroupSignal(child, pid, signal, kill) {
+  try {
+    kill(-pid, signal);
+    return { requested: true, treeRequested: true };
+  } catch {
+    return {
+      requested: requestDirectSignal(child, signal),
+      treeRequested: false,
+    };
+  }
+}
+
+function requestWindowsTreeSignal(child, pid, force, spawnSync, timeoutMs) {
+  try {
+    const args = ["/PID", String(pid), "/T"];
+    if (force) args.push("/F");
+    const result = spawnSync("taskkill", args, {
+      shell: false,
+      windowsHide: true,
+      encoding: "utf8",
+      timeout: Math.max(1, timeoutMs),
+      origin: "process-tree:taskkill",
+      policy: "allow",
+      scope: "process-tree",
+    });
+    if (!result?.error && result?.status === 0) {
+      return { requested: true, treeRequested: true };
+    }
+  } catch {
+    // Fall through to the hard-phase fallback below.
+  }
+  // Never kill only the Windows root during the soft phase: doing so can
+  // orphan its descendants and make the later `/T /F` walk impossible.
+  if (!force) return { requested: false, treeRequested: false };
+  return {
+    requested: requestDirectSignal(child, "SIGKILL"),
+    treeRequested: false,
+  };
+}
+
+/**
+ * Retire one Broker-owned child tree inside a host-capped deadline.
+ *
+ * `treeMode` describes the ownership established at spawn time:
+ * - `sandbox`: a PID namespace / Windows Job close fence owns descendants;
+ * - `posix-group`: the child is the leader of a detached process group;
+ * - `windows-tree`: taskkill walks the live root's descendant tree.
+ *
+ * The function never throws and never treats a direct-child fallback as proof
+ * that descendants are gone. Callers can preserve their primary error while
+ * attaching the structured result, or fail closed on an unconfirmed explicit
+ * disconnect.
+ */
+export async function terminateOwnedProcessTree(child, options = {}) {
+  const platform = options.platform || process.platform;
+  const cleanupTimeoutMs = boundedMilliseconds(
+    options.cleanupTimeoutMs,
+    PROCESS_TREE_CLEANUP_MAX_MS,
+    PROCESS_TREE_CLEANUP_MAX_MS,
+  );
+  const graceMs = Math.min(
+    cleanupTimeoutMs,
+    boundedMilliseconds(options.graceMs, 250, PROCESS_TREE_GRACE_MAX_MS),
+  );
+  const now = options.now || Date.now;
+  const sleep =
+    options.sleep ||
+    ((milliseconds) =>
+      new Promise((resolve) => setTimeout(resolve, milliseconds)));
+  const kill = options.kill || process.kill.bind(process);
+  const spawnSync =
+    options.spawnSync || executionBroker.spawnSync.bind(executionBroker);
+  const pid = validChildPid(child);
+  const inferredTreeMode =
+    options.treeMode ||
+    (options.sandboxManagedTree === true
+      ? "sandbox"
+      : platform === "win32"
+        ? "windows-tree"
+        : "posix-group");
+  const treeMode = TREE_MODES.has(inferredTreeMode)
+    ? inferredTreeMode
+    : platform === "win32"
+      ? "windows-tree"
+      : "posix-group";
+  const startedAt = now();
+  const deadline = startedAt + cleanupTimeoutMs;
+  let closeObserved = options.alreadyClosed === true;
+  let softRequested = false;
+  let hardRequested = false;
+  let treeRequested = false;
+  let escalated = false;
+
+  const onClose = () => {
+    closeObserved = true;
+  };
+  child?.once?.("close", onClose);
+
+  const remaining = () => Math.max(0, deadline - now());
+  const closed = () => childHasClosed(child, () => closeObserved);
+  const treeGone = () => {
+    if (!pid) return false;
+    if (treeMode === "sandbox") return closed();
+    if (treeMode === "posix-group") return posixGroupIsGone(pid, kill);
+    return treeRequested;
+  };
+  const confirmed = () => closed() && treeGone();
+  const waitForConfirmation = async (maximumMs) => {
+    const phaseDeadline = Math.min(deadline, now() + Math.max(0, maximumMs));
+    while (!confirmed() && now() < phaseDeadline) {
+      await sleep(Math.max(1, Math.min(10, phaseDeadline - now())));
+    }
+    return confirmed();
+  };
+  const request = (force) => {
+    if (!pid) {
+      return {
+        requested: requestDirectSignal(child, force ? "SIGKILL" : "SIGTERM"),
+        treeRequested: false,
+      };
+    }
+    if (treeMode === "sandbox") {
+      return {
+        requested: requestDirectSignal(child, force ? "SIGKILL" : "SIGTERM"),
+        treeRequested: true,
+      };
+    }
+    if (treeMode === "windows-tree") {
+      return requestWindowsTreeSignal(
+        child,
+        pid,
+        force,
+        spawnSync,
+        remaining(),
+      );
+    }
+    return requestPosixGroupSignal(
+      child,
+      pid,
+      force ? "SIGKILL" : "SIGTERM",
+      kill,
+    );
+  };
+
+  try {
+    if (!pid) {
+      // Test doubles and partial spawn failures have no verifiable tree
+      // identity. Preserve legacy best-effort direct-child cleanup without
+      // upgrading it to a whole-tree claim.
+      const attempt = request(true);
+      hardRequested = attempt.requested;
+      return {
+        pid: null,
+        treeMode,
+        verifiable: false,
+        softRequested,
+        hardRequested,
+        treeRequested: false,
+        escalated: true,
+        closed: closed(),
+        treeTerminated: false,
+        confirmed: false,
+        deadlineExceeded: false,
+        elapsedMs: Math.max(0, now() - startedAt),
+      };
+    }
+
+    // A managed sandbox close fence already proves its namespace/job is empty.
+    // A closed unmanaged POSIX root does not: descendants in the owned group
+    // must still be signalled and probed.
+    if (treeMode === "sandbox" && closed()) {
+      treeRequested = true;
+    } else if (!closed()) {
+      try {
+        child?.stdin?.end?.();
+      } catch {
+        // EOF is only an additional graceful hint; SIGTERM remains authoritative.
+      }
+      const attempt = request(false);
+      softRequested = attempt.requested;
+      treeRequested ||= attempt.treeRequested;
+      await waitForConfirmation(graceMs);
+    }
+
+    if (!confirmed()) {
+      escalated = true;
+      const attempt = request(true);
+      hardRequested = attempt.requested;
+      treeRequested ||= attempt.treeRequested;
+      if (remaining() > 0) await waitForConfirmation(remaining());
+    }
+
+    const didConfirm = confirmed();
+    return {
+      pid,
+      treeMode,
+      verifiable: true,
+      softRequested,
+      hardRequested,
+      treeRequested,
+      escalated,
+      closed: closed(),
+      treeTerminated: treeGone(),
+      confirmed: didConfirm,
+      deadlineExceeded: !didConfirm && remaining() === 0,
+      elapsedMs: Math.max(0, now() - startedAt),
+    };
+  } finally {
+    child?.removeListener?.("close", onClose);
+  }
+}

package/src/lib/recent-session.js

@@ -7,8 +7,10 @@
  */
 
 import { listSessions } from "./session-manager.js";
-import { listJsonlSessions } from "../harness/jsonl-session-store.js";
-import { feature } from "./feature-flags.js";
+import {
+  listSessionAuthoritySummaries,
+  listSessionEvidenceIds,
+} from "../harness/jsonl-session-store.js";
 
 /**
  * Merge both stores into a single newest-first, id-deduped list.
@@ -21,15 +23,18 @@ import { feature } from "./feature-flags.js";
 export function listRecentSessions(ctx, opts = {}) {
   const scan = Math.max(1, opts.scan || 20);
   const sessions = [];
+  const canonicalIds = new Set(listSessionEvidenceIds());
 
   if (ctx && ctx.db) {
     try {
       const db = ctx.db.getDatabase();
       sessions.push(
-        ...listSessions(db, { limit: scan }).map((s) => ({
-          ...s,
-          _store: "db",
-        })),
+        ...listSessions(db, { limit: scan })
+          .filter((s) => !canonicalIds.has(s?.id))
+          .map((s) => ({
+            ...s,
+            _store: "db",
+          })),
       );
     } catch (err) {
       /* db unavailable — fall through to JSONL */
@@ -37,17 +42,12 @@ export function listRecentSessions(ctx, opts = {}) {
     }
   }
 
-  if (feature("JSONL_SESSION")) {
-    try {
-      sessions.push(
-        ...listJsonlSessions({ limit: scan }).map((s) => ({
-          ...s,
-          _store: "jsonl",
-        })),
-      );
-    } catch (err) {
-      void err;
-    }
+  try {
+    // Existing canonical history remains authoritative even when the feature
+    // flag that controls new JSONL adoption is disabled.
+    sessions.push(...listSessionAuthoritySummaries({ limit: scan }));
+  } catch (err) {
+    void err;
   }
 
   // Dedup by id (JSONL precedence via sort+seen), newest updated_at first.

package/src/lib/secure-file-identity.js

@@ -33,6 +33,10 @@ const IDENTITY_FIELDS = Object.freeze([
 const IDENTITY_FIELDS_EXCEPT_DEVICE = Object.freeze(
   IDENTITY_FIELDS.filter((field) => field !== "dev"),
 );
+const STABLE_FILE_IDENTITY_FIELDS = Object.freeze(["dev", "ino", "mode"]);
+const STABLE_FILE_IDENTITY_FIELDS_EXCEPT_DEVICE = Object.freeze(
+  STABLE_FILE_IDENTITY_FIELDS.filter((field) => field !== "dev"),
+);
 const DIRECTORY_IDENTITY_FIELDS = Object.freeze(["dev", "ino", "mode"]);
 const DIRECTORY_IDENTITY_FIELDS_EXCEPT_DEVICE = Object.freeze(
   DIRECTORY_IDENTITY_FIELDS.filter((field) => field !== "dev"),
@@ -184,6 +188,49 @@ export function samePathHandleFileIdentity(
   );
 }
 
+/**
+ * Compare only the immutable/type portion of a path/handle file identity.
+ *
+ * This is for appenders: size and timestamps are expected to change while the
+ * descriptor is held, but the published name must continue to designate that
+ * exact regular file. The independently opened parent/volume device keeps the
+ * narrow Node 22.12 Windows device-projection bridge fail-closed.
+ */
+export function samePathHandleStableFileIdentity(
+  pathStat,
+  handleStat,
+  expectedDevice,
+  runtime = undefined,
+) {
+  const pathIdentity = fileStatIdentity(pathStat);
+  const handleIdentity = fileStatIdentity(handleStat);
+  const trustedDevice =
+    expectedDevice === undefined || expectedDevice === null
+      ? null
+      : String(expectedDevice);
+  if (
+    !hasFields(pathIdentity, STABLE_FILE_IDENTITY_FIELDS) ||
+    !hasFields(handleIdentity, STABLE_FILE_IDENTITY_FIELDS) ||
+    trustedDevice === null ||
+    handleIdentity.dev !== trustedDevice
+  ) {
+    return false;
+  }
+  if (sameFields(pathIdentity, handleIdentity, STABLE_FILE_IDENTITY_FIELDS)) {
+    return true;
+  }
+  return (
+    isAffectedWindowsZeroDeviceStatRuntime(runtime) &&
+    pathIdentity.dev !== handleIdentity.dev &&
+    handleIdentity.dev !== "0" &&
+    sameFields(
+      pathIdentity,
+      handleIdentity,
+      STABLE_FILE_IDENTITY_FIELDS_EXCEPT_DEVICE,
+    )
+  );
+}
+
 /**
  * Directory contents can legitimately change while a child is written, so a
  * parent recheck excludes content-derived metadata and the directory link

package/src/lib/secure-fs.js

@@ -1004,6 +1004,7 @@ export function ensurePrivateDirectory(target, options = {}) {
     platform,
   );
   let existed = deps.fs.existsSync(target);
+  let existingMode = null;
   if (existed) {
     const pathEntry = readPrivatePathEntry(
       target,
@@ -1013,6 +1014,7 @@ export function ensurePrivateDirectory(target, options = {}) {
     );
     existed = pathEntry.exists;
     const existing = pathEntry.entry;
+    existingMode = existing ? Number(existing.mode) : null;
     if (existed && existing.isSymbolicLink()) {
       throw new Error(
         `Refusing owner-only directory through a symbolic link: ${target}`,
@@ -1031,7 +1033,16 @@ export function ensurePrivateDirectory(target, options = {}) {
     mode: PRIVATE_DIRECTORY_MODE,
   });
   if ((options.platform || deps.platform()) !== "win32") {
-    deps.fs.chmodSync(target, PRIVATE_DIRECTORY_MODE);
+    // chmod updates ctime even when the mode is already correct. Session and
+    // security stores use ctime as part of their physical witness, so avoid
+    // invalidating an otherwise unchanged owner-only directory.
+    if (
+      !existed ||
+      !Number.isFinite(existingMode) ||
+      (existingMode & 0o7777) !== PRIVATE_DIRECTORY_MODE
+    ) {
+      deps.fs.chmodSync(target, PRIVATE_DIRECTORY_MODE);
+    }
   } else if (
     options.applyWindowsAcl === true ||
     (!existed && options.applyWindowsAcl !== false)
@@ -1071,7 +1082,15 @@ export function ensurePrivateFile(target, options = {}) {
     throw new Error(`Expected a file for owner-only storage: ${target}`);
   }
   if (platform !== "win32") {
-    deps.fs.chmodSync(target, PRIVATE_FILE_MODE);
+    // Preserve ctime for an already-secure file. Rejected CAS writes and
+    // read-only preflights must not make a persisted physical witness stale.
+    const existingMode = Number(existing.mode);
+    if (
+      !Number.isFinite(existingMode) ||
+      (existingMode & 0o7777) !== PRIVATE_FILE_MODE
+    ) {
+      deps.fs.chmodSync(target, PRIVATE_FILE_MODE);
+    }
   } else if (
     options.applyWindowsAcl === true &&
     (options.deps || !securedWindowsPaths.has(target))