chainlesschain 0.163.2 → 0.163.4

package/src/lib/process-execution-broker/index.js

@@ -73,7 +73,7 @@ const _ipcBus = null;
 function getTraceCtx() {
   if (!_traceCtx) {
     try {
-      _traceCtx = require("../execution-trace/trace-context.js");
+      _traceCtx = require("../execution-trace/trace-context.cjs");
     } catch {
       _traceCtx = null;
     }
@@ -1218,6 +1218,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "entrySnapshotAtomic",
         "runtimeLaunchAtomic",
         "mcpCapsuleCodeSnapshot",
+        "runtimeDetachedChildSpawnVerified",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1237,6 +1238,7 @@ class ProcessExecutionBroker extends EventEmitter {
         "runtimeSnapshotBytes",
         "runtimeAttestedBytes",
         "entrySnapshotBytes",
+        "capabilityCount",
       ]) {
         if (
           plan.runtimeProbe[field] !== undefined &&
@@ -1320,6 +1322,20 @@ class ProcessExecutionBroker extends EventEmitter {
         "pluginTreeSnapshotContractBound",
         "pluginTreeSnapshotAtomic",
       ];
+      const nodePluginTreeSnapshotEvidence =
+        plan.runtimeProbe.kind === "linux-bwrap-plugin-node-policy-v1" &&
+        plan.runtimeProbe.targetRuntime === "node" &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-source";
+      const nativePluginRuntimeEvidence =
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-static-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-static-elf") ||
+        (plan.runtimeProbe.kind ===
+          "linux-bwrap-plugin-native-dynamic-elf-policy-v1" &&
+          plan.runtimeProbe.targetRuntime === "native-dynamic-elf");
+      const nativePluginTreeSnapshotEvidence =
+        nativePluginRuntimeEvidence &&
+        plan.runtimeProbe.contentSnapshotScope === "plugin-entry-executable";
       if (
         pluginTreeSnapshot &&
         (plan.applied !== true ||
@@ -1334,11 +1350,10 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.attempted !== true ||
           plan.runtimeProbe.runnable !== true ||
           plan.runtimeProbe.reason !== null ||
-          plan.runtimeProbe.kind !== "linux-bwrap-plugin-node-policy-v1" ||
+          (!nodePluginTreeSnapshotEvidence &&
+            !nativePluginTreeSnapshotEvidence) ||
           plan.runtimeProbe.probeRuntime !== "node" ||
-          plan.runtimeProbe.targetRuntime !== "node" ||
           plan.runtimeProbe.contentSnapshot !== true ||
-          plan.runtimeProbe.contentSnapshotScope !== "plugin-entry-source" ||
           plan.runtimeProbe.contentSnapshotMechanism !==
             "verified-o_tmpfile-copy-bwrap-ro-bind-data-v1" ||
           plan.runtimeProbe.handleAtomic !== false ||
@@ -1382,6 +1397,18 @@ class ProcessExecutionBroker extends EventEmitter {
           "Sandbox runtime probe plugin tree snapshot evidence requires pluginTreeContentSnapshot",
         );
       }
+      const successfulNativeProbe =
+        plan.applied === true &&
+        plan.runtimeProbe.attempted === true &&
+        plan.runtimeProbe.runnable === true &&
+        plan.runtimeProbe.reason === null &&
+        nativePluginRuntimeEvidence;
+      if (successfulNativeProbe && !pluginTreeSnapshot) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Successful Linux native plugin evidence requires a complete plugin tree snapshot",
+        );
+      }
       const supervisorStringFields = [
         "supervisorBindingScope",
         "supervisorDescriptorBindingMechanism",
@@ -1733,6 +1760,7 @@ class ProcessExecutionBroker extends EventEmitter {
           plan.runtimeProbe.runtimeLaunchAtomic === true &&
           plan.runtimeProbe.runtimeLaunchMechanism ===
             "bwrap-descriptor-mount-node-runtime-exec-v1" &&
+          plan.runtimeProbe.runtimeDetachedChildSpawnVerified === true &&
           plan.runtimeProbe.supervisorDescriptorBound === true &&
           plan.runtimeProbe.pluginTreeContentSnapshot === true &&
           plan.runtimeProbe.runtimeLaunchPath ===
@@ -1769,6 +1797,7 @@ class ProcessExecutionBroker extends EventEmitter {
             (backend === "windows-appcontainer-job-restricted-token" &&
               plan.runtimeProbe.kind ===
                 "windows-appcontainer-launch-attestation-v1" &&
+              plan.runtimeProbe.capabilityCount === 0 &&
               policyAttested === true &&
               policyDigest !== null)) &&
           plan.runtimeProbe.contentSnapshotScope ===
@@ -1804,6 +1833,17 @@ class ProcessExecutionBroker extends EventEmitter {
           );
         }
       }
+      if (
+        plan.runtimeProbe.kind ===
+          "windows-appcontainer-launch-attestation-v1" &&
+        plan.runtimeProbe.runnable === true &&
+        plan.runtimeProbe.capabilityCount !== 0
+      ) {
+        throw this._sandboxError(
+          "invalid_sandbox_plan",
+          "Windows AppContainer runtime evidence must attest zero capabilities",
+        );
+      }
       const genericWorkspaceEvidenceFields = [
         "contractDigest",
         "policyDigest",
@@ -2078,6 +2118,9 @@ class ProcessExecutionBroker extends EventEmitter {
         ...(plan.runtimeProbe.targetRuntime !== undefined
           ? { targetRuntime: plan.runtimeProbe.targetRuntime }
           : {}),
+        ...(plan.runtimeProbe.capabilityCount !== undefined
+          ? { capabilityCount: plan.runtimeProbe.capabilityCount }
+          : {}),
         ...(plan.runtimeProbe.contentSnapshot !== undefined
           ? { contentSnapshot: plan.runtimeProbe.contentSnapshot }
           : {}),
@@ -2090,6 +2133,12 @@ class ProcessExecutionBroker extends EventEmitter {
         ...(plan.runtimeProbe.runtimeLaunchAtomic !== undefined
           ? { runtimeLaunchAtomic: plan.runtimeProbe.runtimeLaunchAtomic }
           : {}),
+        ...(plan.runtimeProbe.runtimeDetachedChildSpawnVerified !== undefined
+          ? {
+              runtimeDetachedChildSpawnVerified:
+                plan.runtimeProbe.runtimeDetachedChildSpawnVerified,
+            }
+          : {}),
         ...(plan.runtimeProbe.runtimeLaunchMechanism !== undefined
           ? {
               runtimeLaunchMechanism: plan.runtimeProbe.runtimeLaunchMechanism,
@@ -2585,12 +2634,6 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   _createWorkspaceProcessCloseFence(auditEntry, proc) {
-    if (
-      !Array.isArray(auditEntry.workspaceTransactionIds) ||
-      auditEntry.workspaceTransactionIds.length === 0
-    ) {
-      return null;
-    }
     return new Promise((resolve) => {
       if (typeof proc?.once === "function") {
         proc.once("close", (exitCode, signal) => {
@@ -2612,6 +2655,54 @@ class ProcessExecutionBroker extends EventEmitter {
     });
   }
 
+  _postSpawnOwnershipError(
+    error,
+    { proc, auditEntry, workspaceProcessClosed, cleanup },
+  ) {
+    let failure =
+      error instanceof Error
+        ? error
+        : new Error(String(error || "spawn failed"));
+    if (
+      failure.processTerminationRequested !== true &&
+      failure.workspaceTerminationRequested !== true
+    ) {
+      try {
+        if (typeof proc?.once === "function") proc.once("error", () => {});
+      } catch {
+        // Listener installation failure is itself post-spawn evidence.
+      }
+      try {
+        proc?.kill?.("SIGKILL");
+      } catch {
+        // The close fence remains the only settlement authority.
+      }
+    }
+    try {
+      cleanup?.();
+    } catch {
+      // Ownership evidence must survive cleanup reporting failures.
+    }
+    const attach = (target) => {
+      target.auditEntry = auditEntry;
+      target.spawnedProcess = proc;
+      target.workspaceProcessClosed = workspaceProcessClosed;
+      target.workspaceTerminationRequested = true;
+      return target;
+    };
+    try {
+      return attach(failure);
+    } catch {
+      const wrapped = new Error(failure.message || "post-spawn failure", {
+        cause: failure,
+      });
+      wrapped.name = failure.name || wrapped.name;
+      if (failure.code !== undefined) wrapped.code = failure.code;
+      failure = wrapped;
+      return attach(failure);
+    }
+  }
+
   _runPostSpawnSandbox(proc, plan, auditEntry) {
     if (!plan.applied || !plan.postSpawn.required) {
       this._applySandboxAudit(auditEntry, plan, plan.applied);
@@ -2855,10 +2946,15 @@ class ProcessExecutionBroker extends EventEmitter {
 
   _getTraceContext() {
     const traceCtx = getTraceCtx();
-    if (traceCtx && traceCtx.activeContext) {
-      return traceCtx.activeContext.value || null;
-    }
-    return null;
+    const activeContext = traceCtx?.traceContext?.getCurrentContext?.() || null;
+    if (!activeContext) return null;
+    return {
+      ...activeContext,
+      traceparent: traceCtx.traceContext.formatTraceparent(
+        activeContext.traceId,
+        activeContext.spanId,
+      ),
+    };
   }
 
   _writeRplEntry(auditEntry, status = "started", error = null) {
@@ -3328,6 +3424,7 @@ class ProcessExecutionBroker extends EventEmitter {
     // Use native spawn from _native (set by patch-child-process.js)
     const nativeSpawnFn = this._native?.spawn || nativeSpawn;
     let proc;
+    let workspaceProcessClosed = null;
     try {
       if (mcpStdioExecutableIdentityAuthority !== undefined) {
         const admitted = consumeMcpStdioExecutableIdentityAuthority(
@@ -3341,16 +3438,20 @@ class ProcessExecutionBroker extends EventEmitter {
         auditEntry.mcpStdioExecutableIdentityDigest = admitted.identityDigest;
       }
       proc = nativeSpawnFn(command, args, optsForSpawn);
+      workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
+        auditEntry,
+        proc,
+      );
       this._bindWorkspaceTransactionProcess(auditEntry, proc);
     } catch (spawnError) {
-      if (proc && typeof proc.kill === "function") {
-        try {
-          proc.kill("SIGKILL");
-        } catch {
-          // The transaction remains unsettled if shutdown cannot be proven.
-        }
-      }
-      if (!proc) {
+      if (proc) {
+        throw this._postSpawnOwnershipError(spawnError, {
+          proc,
+          auditEntry,
+          workspaceProcessClosed,
+          cleanup: sandboxPlan.cleanup,
+        });
+      } else {
         try {
           this._settleWorkspaceTransactionSpawn(auditEntry, {
             error: spawnError.message,
@@ -3363,102 +3464,105 @@ class ProcessExecutionBroker extends EventEmitter {
       throw spawnError;
     }
     auditEntry.pid = proc.pid;
-    const workspaceProcessClosed = this._createWorkspaceProcessCloseFence(
-      auditEntry,
-      proc,
-    );
-    const cleanupSandbox = this._scheduleSandboxCleanup(
-      proc,
-      sandboxPlan.cleanup,
-    );
-    if (
-      sandboxPlan.applied === true &&
-      (sandboxPlan.backend === "linux-bwrap-workspace" ||
-        sandboxPlan.backend === "linux-bwrap" ||
-        sandboxPlan.backend === "linux-fd-code-snapshot") &&
-      sandboxPlan.postSpawn.required === false
-    ) {
-      // child_process.spawn() has synchronously duplicated every stdio entry
-      // into the launched process before returning. The generic/direct bwrap
-      // backends and the MCP anonymous-code snapshot backend are complete
-      // pre-spawn plans with no parent-side enforcement handle. Retaining
-      // their pinned descriptors until a long-lived process exits would turn
-      // each child into an avoidable FD leak.
-      cleanupSandbox();
-    }
+    let cleanupSandbox = sandboxPlan.cleanup;
     try {
-      this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
-      this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
-      auditEntry.pid = proc.pid;
-      if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
-        auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
-      }
-      if (Number.isSafeInteger(proc.sandboxTargetPid)) {
-        auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+      cleanupSandbox = this._scheduleSandboxCleanup(proc, sandboxPlan.cleanup);
+      if (
+        sandboxPlan.applied === true &&
+        (sandboxPlan.backend === "linux-bwrap-workspace" ||
+          sandboxPlan.backend === "linux-bwrap" ||
+          sandboxPlan.backend === "linux-fd-code-snapshot") &&
+        sandboxPlan.postSpawn.required === false
+      ) {
+        // child_process.spawn() has synchronously duplicated every stdio entry
+        // into the launched process before returning. The generic/direct bwrap
+        // backends and the MCP anonymous-code snapshot backend are complete
+        // pre-spawn plans with no parent-side enforcement handle. Retaining
+        // their pinned descriptors until a long-lived process exits would turn
+        // each child into an avoidable FD leak.
+        cleanupSandbox();
       }
-    } catch (postSpawnError) {
-      if (postSpawnError.processTerminationRequested !== true) {
-        try {
-          proc.kill?.("SIGKILL");
-        } catch {
-          // The close fence remains pending and recovery stays fail-closed.
+      try {
+        this._runPostSpawnSandbox(proc, sandboxPlan, auditEntry);
+        this._updateWorkspaceTransactionProcessGuarantees(auditEntry);
+        auditEntry.pid = proc.pid;
+        if (Number.isSafeInteger(proc.sandboxWrapperPid)) {
+          auditEntry.sandboxWrapperPid = proc.sandboxWrapperPid;
+        }
+        if (Number.isSafeInteger(proc.sandboxTargetPid)) {
+          auditEntry.sandboxTargetPid = proc.sandboxTargetPid;
+        }
+      } catch (postSpawnError) {
+        if (postSpawnError.processTerminationRequested !== true) {
+          try {
+            proc.kill?.("SIGKILL");
+          } catch {
+            // The close fence remains pending and recovery stays fail-closed.
+          }
         }
+        cleanupSandbox();
+        this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
+        postSpawnError.auditEntry = auditEntry;
+        postSpawnError.spawnedProcess = proc;
+        postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
+        postSpawnError.workspaceTerminationRequested = true;
+        throw postSpawnError;
       }
-      cleanupSandbox();
-      this._recordSandboxDenial(auditEntry, postSpawnError, startTime);
-      postSpawnError.auditEntry = auditEntry;
-      postSpawnError.spawnedProcess = proc;
-      postSpawnError.workspaceProcessClosed = workspaceProcessClosed;
-      postSpawnError.workspaceTerminationRequested = true;
-      throw postSpawnError;
-    }
-
-    this._recordAudit(auditEntry);
-    this._writeRplEntry(auditEntry, "started");
-    this._emitHooksEvent("tool:start", {
-      executionId,
-      toolName: origin,
-      command,
-      args: [...auditEntry.args],
-      cwd,
-      pid: proc.pid,
-      component: origin,
-    });
 
-    proc.on("exit", (code, signal) => {
-      const endTime = Date.now();
-      auditEntry.exitCode = code;
-      auditEntry.signal = signal;
-      auditEntry.endTime = endTime;
-      auditEntry.durationMs = endTime - startTime;
-      this._writeRplEntry(auditEntry, "completed");
-      this._emitHooksEvent("tool:end", {
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "started");
+      this._emitHooksEvent("tool:start", {
         executionId,
-        success: code === 0,
-        exitCode: code,
-        signal,
-        durationMs: auditEntry.durationMs,
+        toolName: origin,
+        command,
+        args: [...auditEntry.args],
+        cwd,
+        pid: proc.pid,
         component: origin,
       });
-      this.emit("exit", auditEntry);
-    });
-    proc.on("error", (err) => {
-      auditEntry.error = err.message;
-      auditEntry.endTime = Date.now();
-      auditEntry.durationMs = auditEntry.endTime - startTime;
-      this._writeRplEntry(auditEntry, "error", err);
-      this._emitHooksEvent("tool:end", {
-        executionId,
-        success: false,
-        error: err.message,
-        component: origin,
+
+      proc.on("exit", (code, signal) => {
+        const endTime = Date.now();
+        auditEntry.exitCode = code;
+        auditEntry.signal = signal;
+        auditEntry.endTime = endTime;
+        auditEntry.durationMs = endTime - startTime;
+        this._writeRplEntry(auditEntry, "completed");
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: code === 0,
+          exitCode: code,
+          signal,
+          durationMs: auditEntry.durationMs,
+          component: origin,
+        });
+        this.emit("exit", auditEntry);
       });
-      // EventEmitter treats an unhandled `error` event as an exception. A
-      // process ENOENT must reach the child-process listener/callback instead
-      // of crashing callers that did not subscribe to broker diagnostics.
-      if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
-    });
-    return proc;
+      proc.on("error", (err) => {
+        auditEntry.error = err.message;
+        auditEntry.endTime = Date.now();
+        auditEntry.durationMs = auditEntry.endTime - startTime;
+        this._writeRplEntry(auditEntry, "error", err);
+        this._emitHooksEvent("tool:end", {
+          executionId,
+          success: false,
+          error: err.message,
+          component: origin,
+        });
+        // EventEmitter treats an unhandled `error` event as an exception. A
+        // process ENOENT must reach the child-process listener/callback instead
+        // of crashing callers that did not subscribe to broker diagnostics.
+        if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
+      });
+      return proc;
+    } catch (postNativeError) {
+      throw this._postSpawnOwnershipError(postNativeError, {
+        proc,
+        auditEntry,
+        workspaceProcessClosed,
+        cleanup: cleanupSandbox,
+      });
+    }
   }
 
   spawnSync(command, args, options = {}) {