chainlesschain 0.166.84 → 0.166.86

package/src/lib/process-execution-broker/index.js

@@ -86,11 +86,13 @@ import {
   mcpStdioCapsuleNativeCodePolicyDigest,
 } from "../mcp-stdio-native-code-policy.js";
 
+import { isPackerBuildPolicy } from "./packer-build-policy.js";
 const SUPPORTED_SANDBOX_BOUNDARIES = new Set(Object.values(SANDBOX_BOUNDARIES));
 const SUPPORTED_SANDBOX_PROFILES = new Set([
   "default",
   "strict",
   "network-only",
+  "build",
 ]);
 // Broker-private admission state. Public runtime-probe fields are audit
 // evidence, not authority to invoke a privileged post-spawn closure.
@@ -1590,6 +1592,15 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     const profile = rawPolicy?.profile ?? null;
+    if (
+      profile === "build" &&
+      !isPackerBuildPolicy(rawPolicy, options, launch)
+    ) {
+      throw this._sandboxBoundaryError(
+        "untrusted_build_sandbox_policy",
+        "The build CPU budget requires an original packer policy for this origin and scope",
+      );
+    }
     if (profile !== null && !SUPPORTED_SANDBOX_PROFILES.has(profile)) {
       throw this._sandboxBoundaryError(
         "invalid_sandbox_profile",

package/src/lib/process-execution-broker/linux-subreaper-helper.js

@@ -67,10 +67,77 @@ function compilerPath() {
   return compiler;
 }
 
+function isPkgRuntime() {
+  if (!process.pkg) return false;
+  // The location is derived only from this module and pkg's bootstrap, never
+  // from cwd, executable siblings, environment variables or caller paths.
+  if (
+    typeof process.pkg.defaultEntrypoint !== "string" ||
+    !process.pkg.defaultEntrypoint.startsWith("/snapshot/") ||
+    !fileURLToPath(import.meta.url).startsWith("/snapshot/")
+  )
+    throw failure("invalid-standalone-runtime");
+  return true;
+}
+
+function readPkgAsset(file, maximum) {
+  // pkg's snapshot descriptors refer to /dev/null in the kernel and are read
+  // through its immutable payload reader. They are NOT native directory FDs.
+  // Reject real files mounted under a snapshot-looking pathname as well as
+  // symlink aliases; a pathname prefix alone never establishes this identity.
+  if (fs.realpathSync(file) !== file || fs.lstatSync(file).isSymbolicLink())
+    throw failure("invalid-standalone-asset");
+  const fd = fs.openSync(file, fs.constants.O_RDONLY);
+  try {
+    if (fs.readlinkSync(`/proc/self/fd/${fd}`) !== "/dev/null")
+      throw failure("standalone-asset-not-embedded");
+    const stat = fs.fstatSync(fd);
+    if (
+      !stat.isFile() ||
+      stat.size < 1 ||
+      stat.size > maximum ||
+      stat.nlink !== 0 ||
+      stat.ino !== 0 ||
+      stat.dev !== 0
+    )
+      throw failure("invalid-standalone-asset");
+    // readFileSync(path) reads the embedded payload directly. pkg readSync(fd)
+    // can instead read a decompressed external cache when compression is on.
+    // Never trust those cache bytes as supervision executable content.
+    const bytes = fs.readFileSync(file);
+    if (
+      !Buffer.isBuffer(bytes) ||
+      bytes.length !== stat.size ||
+      bytes.length > maximum
+    )
+      throw failure("invalid-standalone-asset");
+    return bytes;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 function packagedImage() {
   const root = fileURLToPath(
     new URL("../../assets/linux-subreaper/", import.meta.url),
   );
+  if (isPkgRuntime()) {
+    const directory = path.join(root, `linux-${process.arch}`);
+    const manifest = readPkgAsset(
+      path.join(directory, "manifest.json"),
+      MAX_SUBREAPER_MANIFEST_BYTES,
+    );
+    const bytes = readPkgAsset(
+      path.join(directory, "supervisor"),
+      MAX_IMAGE_BYTES,
+    );
+    return {
+      bytes,
+      identity: validateLinuxSubreaperArtifact(manifest, bytes, {
+        arch: process.arch,
+      }),
+    };
+  }
   // Only source checkouts with no packaged directory may use the development
   // compiler path. A partial/corrupt installed payload must never fall back.
   try {
@@ -135,23 +202,28 @@ function compileImage(spawnSync) {
     const source = fileURLToPath(
       new URL("./linux-subreaper-supervisor.c", import.meta.url),
     );
-    sourceFd = fs.openSync(
-      source,
-      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
-    );
-    const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+    const packed = isPkgRuntime();
+    let sourceSnapshot;
+    if (packed) {
+      sourceSnapshot = readPkgAsset(source, MAX_SOURCE_BYTES);
+    } else {
+      sourceFd = fs.openSync(
+        source,
+        fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW,
+      );
+      const snapshot = readDescriptor(sourceFd, MAX_SOURCE_BYTES);
+      if (snapshot.stat.nlink !== 1n) throw failure("source-digest-mismatch");
+      sourceSnapshot = snapshot.bytes;
+      fs.closeSync(sourceFd);
+      sourceFd = null;
+    }
     // npm/git may transport text with CRLF. Compile the exact canonical bytes
     // that the source digest commits to, passed on stdin rather than reopened.
     const sourceBytes = Buffer.from(
-      snapshot.bytes.toString("utf8").replace(/\r\n/g, "\n"),
+      sourceSnapshot.toString("utf8").replace(/\r\n/g, "\n"),
     );
-    if (
-      snapshot.stat.nlink !== 1n ||
-      sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST
-    )
+    if (sha(sourceBytes) !== LINUX_SUBREAPER_SOURCE_DIGEST)
       throw failure("source-digest-mismatch");
-    fs.closeSync(sourceFd);
-    sourceFd = null;
     const packaged = packagedImage();
     const compiler = packaged ? null : compilerPath();
     temporaryRoot = fs.mkdtempSync(
@@ -253,7 +325,9 @@ function compileImage(spawnSync) {
     // Do not expose compiler stdout/stderr, paths, environment, or native argv.
     throw failure(
       error.code === "ENOENT"
-        ? "system-compiler-or-source-missing"
+        ? process.pkg
+          ? "standalone-asset-missing"
+          : "system-compiler-or-source-missing"
         : "native-build-setup-failed",
     );
   } finally {

package/src/lib/process-execution-broker/packer-build-policy.js

@@ -0,0 +1,31 @@
+// In-process identity, not a JSON profile name, admits the packer's larger
+// finite CPU budget. This grants no process permission: the broker's ordinary
+// deny/prompt checks and strict-mode override still apply.
+const policies = new WeakMap();
+const origins = new Set(["packer:pkg", "packer:web-panel-build"]);
+
+export const PACKER_BUILD_TIMEOUT_MS = 900_000;
+
+export function createPackerBuildPolicy(origin) {
+  if (!origins.has(origin)) throw new Error("Unknown packer build origin");
+  const policy = Object.freeze({ profile: "build" });
+  policies.set(policy, origin);
+  return policy;
+}
+
+export function isPackerBuildPolicy(policy, options, launch = {}) {
+  const { origin, scope, shell, detached, timeout, killSignal } = options;
+  return (
+    scope === "pack" &&
+    origins.has(origin) &&
+    policies.get(policy) === origin &&
+    launch.sync === true &&
+    launch.pty !== true &&
+    shell === false &&
+    (detached === undefined || detached === false) &&
+    Number.isSafeInteger(timeout) &&
+    timeout > 0 &&
+    timeout <= PACKER_BUILD_TIMEOUT_MS &&
+    killSignal === "SIGKILL"
+  );
+}

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2128,7 +2128,7 @@ export function applyMacSandbox(
   // non-strict mode records the unavailable primitive and executes the
   // original invocation, while strict mode fails closed. Explicit strict or
   // network-only profiles still opt in to the sandbox-exec wrapper below.
-  if ((sandboxOpts.profileName || "default") === "default") {
+  if (["default", "build"].includes(sandboxOpts.profileName || "default")) {
     return createSandboxPlan({
       ...base,
       reason: "macos_default_profile_requires_explicit_policy",
@@ -9969,8 +9969,16 @@ export function applySandbox(
   };
 
   const profile = {
-    ...(profiles[profileName] || profiles.default),
-    profileName: profiles[profileName] ? profileName : "default",
+    ...(profileName === "build"
+      ? {
+          ...profiles.default,
+          limits: { ...profiles.default.limits, cpu: 600 },
+        }
+      : profiles[profileName] || profiles.default),
+    profileName:
+      profileName === "build" || profiles[profileName]
+        ? profileName
+        : "default",
     requiredBoundaries: sandboxRequest.requiredBoundaries,
     sync: sandboxRequest.sync,
     pty: sandboxRequest.pty,

package/src/lib/sandbox-egress-authority-monitor.js

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+
 /**
  * Recheck the live shell authority while a Docker egress session exists. This
  * uses bounded polling as a fallback. Trusted policy owners also call revoke()
@@ -9,19 +11,35 @@ export function createDockerEgressAuthorityMonitor({
   abortProxy,
   intervalMs = 500,
   checkTimeoutMs = 5_000,
+  sessionId = null,
+  policyVersion = null,
 }) {
   if (typeof revalidate !== "function" || typeof abortProxy !== "function")
     throw new TypeError("Docker egress authority callbacks are required");
+  if (
+    (sessionId !== null && typeof sessionId !== "string") ||
+    (policyVersion !== null && typeof policyVersion !== "string")
+  )
+    throw new TypeError(
+      "Docker egress acknowledgement identities must be strings",
+    );
+  const stopIdentity = Object.freeze({
+    receiverId: randomUUID(),
+    sessionId,
+    policyVersion,
+  });
   let revoked = null;
   let session = null;
   let timer = null;
   let checking = null;
   let stopped = false;
   const cleanupTasks = new Set();
+  let proxyStopped = false;
+  let sessionStopped = false;
 
-  function trackCleanup(operation) {
+  function trackCleanup(operation, onStopped) {
     try {
-      const task = Promise.resolve(operation());
+      const task = Promise.resolve(operation()).then(onStopped);
       cleanupTasks.add(task);
       void task.catch((error) => {
         if (revoked && !revoked.cleanupError) revoked.cleanupError = error;
@@ -41,8 +59,18 @@ export function createDockerEgressAuthorityMonitor({
     if (!revoked.code) revoked.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
     clearTimeout(timer);
     // Latch first, then cut the broker before closing the target containers.
-    trackCleanup(abortProxy);
-    if (session) trackCleanup(() => session.close());
+    trackCleanup(abortProxy, () => {
+      proxyStopped = true;
+    });
+    if (session) {
+      const closing = session;
+      trackCleanup(
+        () => closing.close(),
+        () => {
+          if (session === closing) sessionStopped = true;
+        },
+      );
+    }
     return revoked;
   }
 
@@ -51,9 +79,17 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   function attachSession(value) {
+    if (session)
+      throw new TypeError("Docker egress monitor session is already attached");
     session = value;
+    sessionStopped = false;
     if (revoked) {
-      trackCleanup(() => value.close());
+      trackCleanup(
+        () => value.close(),
+        () => {
+          if (session === value) sessionStopped = true;
+        },
+      );
       throw revoked;
     }
   }
@@ -112,6 +148,7 @@ export function createDockerEgressAuthorityMonitor({
   }
 
   return {
+    stopIdentity,
     get revocationError() {
       return revoked;
     },
@@ -134,5 +171,25 @@ export function createDockerEgressAuthorityMonitor({
     async awaitCleanup() {
       await Promise.allSettled([...cleanupTasks]);
     },
+    getStopAcknowledgement() {
+      // A synchronous writer commit is never a stop ACK. Only the receiving
+      // runtime, after stopping checks and awaiting both teardown operations,
+      // can report this acknowledgement. Cleanup failures never mint one.
+      if (
+        !stopped ||
+        !revoked ||
+        revoked.cleanupError ||
+        cleanupTasks.size ||
+        !proxyStopped ||
+        !sessionStopped
+      )
+        return null;
+      return Object.freeze({
+        schema: "chainlesschain.egress-stop-ack/v1",
+        ...stopIdentity,
+        proxyStopped: true,
+        sessionStopped: true,
+      });
+    },
   };
 }

package/src/lib/scoped-permission-store.js

@@ -11,6 +11,7 @@ import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import projectRoot from "./project-root.cjs";
 import permissionRules from "./permission-rules.cjs";
+import persistentSettings from "./settings-permission-authority.cjs";
 import { getMachineSecurityAnchorDir } from "./paths.js";
 import {
   readSecurityStore,
@@ -27,6 +28,7 @@ const STORE_LABEL = "scoped permission";
 const RULE_ID_PATTERN = /^spr_[0-9a-f]{32}$/;
 const DECISIONS = new Set(["allow", "ask", "deny"]);
 const DEFAULT_MAX_RECORDS = 1000;
+const persistentBindings = new WeakMap();
 
 // Official mutations revoke every provider in this module instance. Path
 // matching alone misses aliases and files that did not exist at admission.
@@ -143,7 +145,7 @@ function validateRecord(record, seenIds) {
     seenIds.has(record.id) ||
     !DECISIONS.has(record.decision) ||
     !parseRule(record.rule) ||
-    !Number.isInteger(record.revision) ||
+    !Number.isSafeInteger(record.revision) ||
     record.revision < 1 ||
     !Number.isFinite(record.createdAt) ||
     !Number.isFinite(record.expiresAt) ||
@@ -165,7 +167,7 @@ function validateState(value, workspace) {
     !value ||
     value.schema !== STATE_SCHEMA ||
     value.schemaVersion !== STATE_SCHEMA_VERSION ||
-    !Number.isInteger(value.generation) ||
+    !Number.isSafeInteger(value.generation) ||
     value.generation < 0 ||
     !value.workspace ||
     value.workspace.id !== workspace.id ||
@@ -188,6 +190,16 @@ function statusFor(record, now) {
   return "active";
 }
 
+function nextVersion(value, label) {
+  if (value === Number.MAX_SAFE_INTEGER) {
+    throw scopedPermissionError(
+      SCOPED_PERMISSION_ERROR_CODES.INVALID,
+      `Scoped permission ${label} is exhausted`,
+    );
+  }
+  return value + 1;
+}
+
 function projectRecord(record, now, filePath) {
   return Object.freeze({
     ...structuredClone(record),
@@ -206,6 +218,7 @@ export class ScopedPermissionStore {
     maxRecords = DEFAULT_MAX_RECORDS,
     lock = undefined,
     randomId = () => `spr_${randomUUID().replaceAll("-", "")}`,
+    settingsAuthority = null,
   } = {}) {
     this.workspace = workspaceBinding(cwd);
     this.filePath = path.resolve(
@@ -232,6 +245,17 @@ export class ScopedPermissionStore {
     );
     this._lock = lock;
     this._randomId = randomId;
+    if (settingsAuthority) {
+      const bound =
+        persistentSettings.settingsPermissionAuthorityOptions(
+          settingsAuthority,
+        );
+      if (path.resolve(cwd) !== bound.cwd || this.filePath !== bound.scopedFile)
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+      persistentBindings.set(this, settingsAuthority);
+    }
   }
 
   _capture() {
@@ -243,7 +267,22 @@ export class ScopedPermissionStore {
       randomId: this._randomId.bind(this),
       maxRecords: this.maxRecords,
       lock: this._lock || withFileLock,
+      settingsAuthority: persistentBindings.get(this) || null,
     });
+    if (captured.settingsAuthority) {
+      const bound = persistentSettings.settingsPermissionAuthorityOptions(
+        captured.settingsAuthority,
+      );
+      const workspace = workspaceBinding(bound.cwd);
+      if (
+        captured.filePath !== bound.scopedFile ||
+        captured.workspace.id !== workspace.id ||
+        captured.workspace.root !== workspace.root
+      )
+        throw new TypeError(
+          "persistent scoped permission authority options mismatch",
+        );
+    }
     if (getScopedPermissionRevision() !== revision)
       throw scopedPermissionError(
         "CC_SCOPED_PERMISSION_AUTHORITY_CHANGED",
@@ -254,13 +293,54 @@ export class ScopedPermissionStore {
 
   _read(captured = this._capture()) {
     getScopedPermissionRevision();
-    const stored = readSecurityStore(captured.filePath, STORE_LABEL);
+    const stored = captured.settingsAuthority
+      ? persistentSettings.readSettingsPermissionAuthority(
+          captured.settingsAuthority,
+        ).scopedObservation.settings || {}
+      : readSecurityStore(captured.filePath, STORE_LABEL);
     if (Object.keys(stored).length === 0) return emptyState(captured.workspace);
     return validateState(stored, captured.workspace);
   }
 
   _mutate(captured, update) {
     getScopedPermissionRevision(); // Reject observer reentry before the lock.
+    if (captured.settingsAuthority) {
+      let started = false;
+      try {
+        persistentSettings.mutateSettingsPermissionSource(
+          captured.settingsAuthority,
+          {
+            logicalPath: captured.filePath,
+            prepare(draft) {
+              if (Object.keys(draft).length === 0)
+                Object.assign(draft, emptyState(captured.workspace));
+              validateState(draft, captured.workspace);
+              if (update(draft) === false) return false;
+              validateState(draft, captured.workspace);
+            },
+            revokeLocal() {
+              started = true;
+              beginMutation();
+            },
+            replace(file, draft) {
+              validateState(draft, captured.workspace);
+              writeSecurityStore(file, STORE_LABEL, draft);
+            },
+          },
+        );
+        if (started) finishMutation("ready");
+      } catch (error) {
+        if (started)
+          finishMutation(
+            error.commitState === "unknown" ||
+              permissionRevision.state === "invalid"
+              ? "invalid"
+              : "ready",
+          );
+        throw error;
+      }
+      return;
+    }
     fs.mkdirSync(path.dirname(captured.filePath), {
       recursive: true,
       mode: 0o700,
@@ -412,7 +492,7 @@ export class ScopedPermissionStore {
         reason: normalizedReason,
       };
       Object.assign(draft, current, {
-        generation: current.generation + 1,
+        generation: nextVersion(current.generation, "generation"),
         updatedAt: now,
         rules: [...retained, created],
       });
@@ -462,13 +542,13 @@ export class ScopedPermissionStore {
       }
       revoked = {
         ...record,
-        revision: record.revision + 1,
+        revision: nextVersion(record.revision, "revision"),
         revokedAt: now,
       };
       const rules = [...current.rules];
       rules[index] = revoked;
       Object.assign(draft, current, {
-        generation: current.generation + 1,
+        generation: nextVersion(current.generation, "generation"),
         updatedAt: now,
         rules,
       });
@@ -477,3 +557,36 @@ export class ScopedPermissionStore {
     return projectRecord(revoked, now, captured.filePath);
   }
 }
+
+// Only the production provider uses a scoped observation already validated in
+// the same durable read as settings. A store cannot substitute another source.
+export function projectScopedPermissionObservation(
+  store,
+  binding,
+  observation,
+) {
+  if (persistentBindings.get(store) !== binding)
+    throw new TypeError(
+      "scoped store must use the provider's persistent authority",
+    );
+  const captured = ScopedPermissionStore.prototype._capture.call(store);
+  if (observation.logicalPath !== captured.filePath)
+    throw new TypeError("persistent scoped permission source mismatch");
+  const stored = observation.settings || {};
+  const state =
+    Object.keys(stored).length === 0
+      ? emptyState(captured.workspace)
+      : validateState(stored, captured.workspace);
+  const now = captured.now();
+  return Object.freeze({
+    schema: state.schema,
+    schemaVersion: state.schemaVersion,
+    generation: state.generation,
+    updatedAt: state.updatedAt,
+    workspace: structuredClone(state.workspace),
+    file: captured.filePath,
+    rules: state.rules.map((record) =>
+      projectRecord(record, now, captured.filePath),
+    ),
+  });
+}

package/src/lib/settings-authority-domain.cjs

@@ -727,12 +727,24 @@ function transitionSettingsAuthority(
     replace,
     revokeLocal,
     transactionId = randomUUID(),
+    expectedSnapshot = null,
+    localRevision = null,
   } = {},
 ) {
   const state = stateFor(handle);
   // Snapshot caller data before any callback. These are trusted host APIs, but
   // mutable intents must not turn an already-validated no-op into a mutation.
   intent = plainCopy(intent);
+  if (expectedSnapshot !== null) {
+    expectedSnapshot = plainCopy(expectedSnapshot);
+    shape(expectedSnapshot, [
+      "domainId",
+      "epoch",
+      "generation",
+      "digest",
+      "state",
+    ]);
+  }
   requireSynchronous(observeContexts);
   requireSynchronous(revokeLocal);
   if (intent.kind === "write") requireSynchronous(replace);
@@ -743,7 +755,15 @@ function transitionSettingsAuthority(
   try {
     return locked(state, () => {
       const perform = () => {
-        const current = readSettingsAuthority(handle, { observeContexts });
+        const current = readSettingsAuthority(handle, {
+          observeContexts,
+          localRevision,
+        });
+        if (
+          expectedSnapshot !== null &&
+          !sameData(current.snapshot, expectedSnapshot)
+        )
+          refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
         if (
           intent.kind === "register" &&
           current.ledger.contexts.some(
@@ -841,7 +861,15 @@ function transitionSettingsAuthority(
         };
       };
       if (intent.kind !== "write") return perform();
-      const admission = readSettingsAuthority(handle, { observeContexts });
+      const admission = readSettingsAuthority(handle, {
+        observeContexts,
+        localRevision,
+      });
+      if (
+        expectedSnapshot !== null &&
+        !sameData(admission.snapshot, expectedSnapshot)
+      )
+        refuse("CC_SETTINGS_AUTHORITY_CONFLICT");
       records.prepareTransition({
         ledger: admission.ledger,
         transactionId,
@@ -878,6 +906,12 @@ function transitionSettingsAuthority(
   }
 }
 
+// Official read/modify/write adapters take an initial snapshot under the same
+// authority lock. The later transition MUST still compare expectedSnapshot.
+function readSettingsAuthorityForUpdate(handle, options) {
+  return locked(stateFor(handle), () => readSettingsAuthority(handle, options));
+}
+
 function recoverSettingsAuthority(
   handle,
   { transactionId, observeContexts, outcome } = {},
@@ -954,6 +988,7 @@ function recoverSettingsAuthority(
 }
 
 module.exports = {
+  readSettingsAuthorityForUpdate,
   DOMAIN_SCHEMA,
   initializeSettingsAuthorityDomain,
   pinSettingsAuthorityDomain,