chainlesschain 0.166.83 → 0.166.85

package/src/lib/packer/web-panel-builder.js

@@ -12,6 +12,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { PackError, EXIT } from "./errors.js";
 import executionBroker from "../process-execution-broker/index.js";
+import {
+  createPackerBuildPolicy,
+  PACKER_BUILD_TIMEOUT_MS,
+} from "../process-execution-broker/packer-build-policy.js";
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
@@ -61,6 +65,9 @@ export function ensureWebPanel(ctx) {
       origin: "packer:web-panel-build",
       scope: "pack",
       policy: "allow",
+      sandboxPolicy: createPackerBuildPolicy("packer:web-panel-build"),
+      timeout: PACKER_BUILD_TIMEOUT_MS,
+      killSignal: "SIGKILL",
       shell: false,
       cwd: cliRoot,
       stdio: "inherit",

package/src/lib/permission-authority.js

@@ -2,11 +2,16 @@
 
 import settingsLoader from "./settings-loader.cjs";
 import path from "node:path";
-import { ScopedPermissionStore } from "./scoped-permission-store.js";
+import {
+  ScopedPermissionStore,
+  getScopedPermissionRevision,
+  subscribeScopedPermissionRevision,
+} from "./scoped-permission-store.js";
 
 const {
   applyManagedPermissionPolicy,
-  loadSettings,
+  inspectSettingsSources,
+  projectSettingsObservation,
   getSettingsPermissionRevision,
   subscribeSettingsPermissionRevision,
 } = settingsLoader;
@@ -16,11 +21,41 @@ const settingsAuthority = Object.freeze({
   getSnapshot: getSettingsPermissionRevision,
   subscribePolicyRevision: subscribeSettingsPermissionRevision,
 });
+let combinedSnapshot = null;
+function getCombinedSnapshot() {
+  const settings = getSettingsPermissionRevision();
+  const scoped = getScopedPermissionRevision();
+  if (
+    combinedSnapshot?.settings !== settings ||
+    combinedSnapshot?.scoped !== scoped
+  ) {
+    combinedSnapshot = Object.freeze({ settings, scoped });
+  }
+  return combinedSnapshot;
+}
+const combinedAuthority = Object.freeze({
+  getSnapshot: getCombinedSnapshot,
+  subscribePolicyRevision(listener) {
+    if (typeof listener !== "function")
+      throw new TypeError("permission revision listener must be a function");
+    const removeSettings = subscribeSettingsPermissionRevision(listener);
+    const removeScoped = subscribeScopedPermissionRevision(listener);
+    return () => {
+      removeSettings();
+      removeScoped();
+    };
+  },
+});
 
 function freezeSnapshot(value) {
-  if (value && typeof value === "object") {
-    for (const child of Object.values(value)) freezeSnapshot(child);
-    Object.freeze(value);
+  const pending = [value];
+  const seen = new WeakSet();
+  while (pending.length) {
+    const current = pending.pop();
+    if (!current || typeof current !== "object" || seen.has(current)) continue;
+    seen.add(current);
+    for (const child of Object.values(current)) pending.push(child);
+    Object.freeze(current);
   }
   return value;
 }
@@ -53,12 +88,14 @@ export function loadPermissionAuthority({
   scopedStore = null,
 } = {}) {
   const settingsRevision = getSettingsPermissionRevision();
-  const loaded = loadSettings({
+  const scopedRevision = baseRules ? null : getScopedPermissionRevision();
+  const settingsObservation = inspectSettingsSources({
     cwd,
     settingsFile,
     managedSettingsFile,
     env,
   });
+  const loaded = projectSettingsObservation(settingsObservation, { env });
   const sources = baseRules ? {} : { ...loaded.sources };
   let rules = baseRules
     ? applyManagedPermissionPolicy(baseRules, loaded.managed, sources)
@@ -99,6 +136,13 @@ export function loadPermissionAuthority({
     error.code = "CC_SETTINGS_PERMISSION_AUTHORITY_CHANGED";
     throw error;
   }
+  if (!baseRules && getScopedPermissionRevision() !== scopedRevision) {
+    const error = new Error(
+      "scoped permissions changed while permission authority was loading",
+    );
+    error.code = "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED";
+    throw error;
+  }
   return freezeSnapshot({
     ...loaded,
     rules,
@@ -106,6 +150,8 @@ export function loadPermissionAuthority({
     scoped,
     hasRules: hasRules(rules),
     settingsRevision,
+    settingsObservation,
+    ...(scopedRevision ? { scopedRevision } : {}),
   });
 }
 
@@ -128,7 +174,10 @@ export function createPermissionRulesProvider(options = {}) {
     scopedStore: options.scopedStore || null,
   });
   const provider = () => loadPermissionAuthority(captured);
-  providers.set(provider, settingsAuthority);
+  providers.set(
+    provider,
+    captured.baseRules ? settingsAuthority : combinedAuthority,
+  );
   return Object.freeze(provider);
 }
 

package/src/lib/process-execution-broker/index.js

@@ -86,11 +86,13 @@ import {
   mcpStdioCapsuleNativeCodePolicyDigest,
 } from "../mcp-stdio-native-code-policy.js";
 
+import { isPackerBuildPolicy } from "./packer-build-policy.js";
 const SUPPORTED_SANDBOX_BOUNDARIES = new Set(Object.values(SANDBOX_BOUNDARIES));
 const SUPPORTED_SANDBOX_PROFILES = new Set([
   "default",
   "strict",
   "network-only",
+  "build",
 ]);
 // Broker-private admission state. Public runtime-probe fields are audit
 // evidence, not authority to invoke a privileged post-spawn closure.
@@ -1590,6 +1592,15 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     const profile = rawPolicy?.profile ?? null;
+    if (
+      profile === "build" &&
+      !isPackerBuildPolicy(rawPolicy, options, launch)
+    ) {
+      throw this._sandboxBoundaryError(
+        "untrusted_build_sandbox_policy",
+        "The build CPU budget requires an original packer policy for this origin and scope",
+      );
+    }
     if (profile !== null && !SUPPORTED_SANDBOX_PROFILES.has(profile)) {
       throw this._sandboxBoundaryError(
         "invalid_sandbox_profile",

package/src/lib/process-execution-broker/linux-subreaper-helper.js

@@ -67,10 +67,77 @@ function compilerPath() {
   return compiler;
 }
 
+function isPkgRuntime() {
+  if (!process.pkg) return false;
+  // The location is derived only from this module and pkg's bootstrap, never
+  // from cwd, executable siblings, environment variables or caller paths.
+  if (
+    typeof process.pkg.defaultEntrypoint !== "string" ||
+    !process.pkg.defaultEntrypoint.startsWith("/snapshot/") ||
+    !fileURLToPath(import.meta.url).startsWith("/snapshot/")
+  )
+    throw failure("invalid-standalone-runtime");
+  return true;
+}
+
+function readPkgAsset(file, maximum) {
+  // pkg's snapshot descriptors refer to /dev/null in the kernel and are read
+  // through its immutable payload reader. They are NOT native directory FDs.
+  // Reject real files mounted under a snapshot-looking pathname as well as
+  // symlink aliases; a pathname prefix alone never establishes this identity.
+  if (fs.realpathSync(file) !== file || fs.lstatSync(file).isSymbolicLink())
+    throw failure("invalid-standalone-asset");
+  const fd = fs.openSync(file, fs.constants.O_RDONLY);
+  try {
+    if (fs.readlinkSync(`/proc/self/fd/${fd}`) !== "/dev/null")
+      throw failure("standalone-asset-not-embedded");
+    const stat = fs.fstatSync(fd);
+    if (
+      !stat.isFile() ||
+      stat.size < 1 ||
+      stat.size > maximum ||
+      stat.nlink !== 0 ||
+      stat.ino !== 0 ||
+      stat.dev !== 0
+    )
+      throw failure("invalid-standalone-asset");
+    // readFileSync(path) reads the embedded payload directly. pkg readSync(fd)
+    // can instead read a decompressed external cache when compression is on.
+    // Never trust those cache bytes as supervision executable content.
+    const bytes = fs.readFileSync(file);
+    if (
+      !Buffer.isBuffer(bytes) ||
+      bytes.length !== stat.size ||
+      bytes.length > maximum
+    )
+      throw failure("invalid-standalone-asset");
+    return bytes;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 function packagedImage() {
   const root = fileURLToPath(
     new URL("../../assets/linux-subreaper/", import.meta.url),
   );
+  if (isPkgRuntime()) {
+    const directory = path.join(root, `linux-${process.arch}`);
+    const manifest = readPkgAsset(
+      path.join(directory, "manifest.json"),
+      MAX_SUBREAPER_MANIFEST_BYTES,
+    );
+    const bytes = readPkgAsset(
+      path.join(directory, "supervisor"),
+      MAX_IMAGE_BYTES,
+    );
+    return {
+      bytes,
+      identity: validateLinuxSubreaperArtifact(manifest, bytes, {
+        arch: process.arch,
+      }),
+    };
+  }
   // Only source checkouts with no packaged directory may use the development
   // compiler path. A partial/corrupt installed payload must never fall back.
   try {
@@ -135,23 +202,28 @@ function compileImage(spawnSync) {
     const source = fileURLToPath(
       new URL("./linux-subreaper-supervisor.c", import.meta.url),
     );
-    sourceFd = fs.openSync(
-      source,
-      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
-    );
-    const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+    const packed = isPkgRuntime();
+    let sourceSnapshot;
+    if (packed) {
+      sourceSnapshot = readPkgAsset(source, MAX_SOURCE_BYTES);
+    } else {
+      sourceFd = fs.openSync(
+        source,
+        fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
+      );
+      const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+      if (snapshot.stat.nlink !== 1n) throw failure("source-digest-mismatch");
+      sourceSnapshot = snapshot.bytes;
+      fs.closeSync(sourceFd);
+      sourceFd = null;
+    }
     // npm/git may transport text with CRLF. Compile the exact canonical bytes
     // that the source digest commits to, passed on stdin rather than reopened.
     const sourceBytes = Buffer.from(
-      snapshot.bytes.toString("utf8").replace(/\r\n/g, "\n"),
+      sourceSnapshot.toString("utf8").replace(/\r\n/g, "\n"),
     );
-    if (
-      snapshot.stat.nlink !== 1n ||
-      sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST
-    )
+    if (sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST)
       throw failure("source-digest-mismatch");
-    fs.closeSync(sourceFd);
-    sourceFd = null;
     const packaged = packagedImage();
     const compiler = packaged ? null : compilerPath();
     temporaryRoot = fs.mkdtempSync(
@@ -253,7 +325,9 @@ function compileImage(spawnSync) {
     // Do not expose compiler stdout/stderr, paths, environment, or native argv.
     throw failure(
       error.code === "ENOENT"
-        ? "system-compiler-or-source-missing"
+        ? process.pkg
+          ? "standalone-asset-missing"
+          : "system-compiler-or-source-missing"
         : "native-build-setup-failed",
     );
   } finally {

package/src/lib/process-execution-broker/packer-build-policy.js

@@ -0,0 +1,31 @@
+// In-process identity, not a JSON profile name, admits the packer's larger
+// finite CPU budget. This grants no process permission: the broker's ordinary
+// deny/prompt checks and strict-mode override still apply.
+const policies = new WeakMap();
+const origins = new Set(["packer:pkg", "packer:web-panel-build"]);
+
+export const PACKER_BUILD_TIMEOUT_MS = 900_000;
+
+export function createPackerBuildPolicy(origin) {
+  if (!origins.has(origin)) throw new Error("Unknown packer build origin");
+  const policy = Object.freeze({ profile: "build" });
+  policies.set(policy, origin);
+  return policy;
+}
+
+export function isPackerBuildPolicy(policy, options, launch = {}) {
+  const { origin, scope, shell, detached, timeout, killSignal } = options;
+  return (
+    scope === "pack" &&
+    origins.has(origin) &&
+    policies.get(policy) === origin &&
+    launch.sync === true &&
+    launch.pty !== true &&
+    shell === false &&
+    (detached === undefined || detached === false) &&
+    Number.isSafeInteger(timeout) &&
+    timeout > 0 &&
+    timeout <= PACKER_BUILD_TIMEOUT_MS &&
+    killSignal === "SIGKILL"
+  );
+}

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2128,7 +2128,7 @@ export function applyMacSandbox(
   // non-strict mode records the unavailable primitive and executes the
   // original invocation, while strict mode fails closed. Explicit strict or
   // network-only profiles still opt in to the sandbox-exec wrapper below.
-  if ((sandboxOpts.profileName || "default") === "default") {
+  if (["default", "build"].includes(sandboxOpts.profileName || "default")) {
     return createSandboxPlan({
       ...base,
       reason: "macos_default_profile_requires_explicit_policy",
@@ -9969,8 +9969,16 @@ export function applySandbox(
   };
 
   const profile = {
-    ...(profiles[profileName] || profiles.default),
-    profileName: profiles[profileName] ? profileName : "default",
+    ...(profileName === "build"
+      ? {
+          ...profiles.default,
+          limits: { ...profiles.default.limits, cpu: 600 },
+        }
+      : profiles[profileName] || profiles.default),
+    profileName:
+      profileName === "build" || profiles[profileName]
+        ? profileName
+        : "default",
     requiredBoundaries: sandboxRequest.requiredBoundaries,
     sync: sandboxRequest.sync,
     pty: sandboxRequest.pty,