chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/core/native/darwin-launcher.c

@@ -0,0 +1,312 @@
+/* macOS native-image launch boundary. No model routing or receipt signing here.
+ * ABI 1: inspect PATH | launch CDHASH PATH KEEP_PROMPT -- PROVIDER_ARGS...
+ * Admission ABI 1: launch-admitted CDHASH PATH KEEP_PROMPT NONCE -- ARGS...
+ * fd 5: one-shot GO, fd 6: READY output, fd 7: completion output,
+ * fd 8: separate owner-lifetime input, kept open without data after GO.
+ * launch inherits fd 4 as project cwd and optionally fd 3 as a private prompt.
+ * The provider receives only stdio and that explicitly allowed prompt descriptor.
+ * A separate reaper provides best-effort process-group cleanup on helper death.
+ * Detached descendants are NOT a PID namespace and are NOT claimed terminated.
+ */
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+#include <errno.h>
+#include <poll.h>
+#include <signal.h>
+#include <spawn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+#include "execution-admission.h"
+#include "darwin-launch-messages.h"
+#include "darwin-browser-proof.h"
+#include "darwin-code-identity.h"
+#include "darwin-browser-listener.h"
+
+static volatile sig_atomic_t provider_pid = -1;
+static volatile sig_atomic_t received_signal = 0;
+static void forward_signal(int number) {
+  received_signal = number;
+  if (provider_pid > 0) kill(-(pid_t)provider_pid, number == SIGALRM ? SIGKILL : number);
+  if (number == SIGALRM) _exit(124);
+}
+static int fail(const char *phase, int code) {
+  fprintf(stderr, "CHATI_DARWIN_LAUNCH:%s:%d\n", phase, code);
+  return 125;
+}
+static int read_byte(int fd, int milliseconds, char *byte) {
+  struct pollfd poller = { .fd = fd, .events = POLLIN | POLLHUP };
+  int result;
+  do { result = poll(&poller, 1, milliseconds); } while (result < 0 && errno == EINTR);
+  if (result <= 0) return -1;
+  ssize_t count;
+  do { count = read(fd, byte, 1); } while (count < 0 && errno == EINTR);
+  return count == 1 ? 0 : -1;
+}
+
+static int control_output(int fd) {
+  struct stat state;
+  return fstat(fd, &state) == 0 && S_ISFIFO(state.st_mode);
+}
+
+static int control_message(int fd, const char *message, size_t length) {
+  // One small message per pipe, never mixed with provider stdout/stderr.
+  ssize_t count;
+  do { count = write(fd, message, length); } while (count < 0 && errno == EINTR);
+  int closed = close(fd);
+  return count == (ssize_t)length && closed == 0 ? 0 : -1;
+}
+static int inspect(const char *path) {
+  struct stat stat;
+  if (lstat(path, &stat) < 0 || !S_ISREG(stat.st_mode) || stat.st_nlink != 1
+      || stat.st_size < 1 || stat.st_size > 1024LL * 1024 * 1024) return fail("image_shape", errno);
+  CFURLRef url = CFURLCreateFromFileSystemRepresentation(NULL,
+    (const UInt8 *)path, (CFIndex)strlen(path), false);
+  if (!url) return fail("image_url", 0);
+  SecStaticCodeRef code = NULL;
+  CFDictionaryRef information = NULL;
+  OSStatus status = SecStaticCodeCreateWithPath(url, kSecCSDefaultFlags, &code);
+  CFRelease(url);
+  if (status == errSecSuccess) status = SecStaticCodeCheckValidity(code, kSecCSDefaultFlags, NULL);
+  if (status == errSecSuccess) status = SecCodeCopySigningInformation(code, kSecCSDefaultFlags, &information);
+  if (status != errSecSuccess) {
+    if (code) CFRelease(code);
+    return fail("static_identity", (int)status);
+  }
+  CFDataRef hash = CFDictionaryGetValue(information, kSecCodeInfoUnique);
+  if (!hash || CFGetTypeID(hash) != CFDataGetTypeID() || CFDataGetLength(hash) != 20) {
+    CFRelease(information); CFRelease(code);
+    return fail("cdhash_shape", 0);
+  }
+  const UInt8 *bytes = CFDataGetBytePtr(hash);
+  char hex[41];
+  for (int i = 0; i < 20; i++) snprintf(hex + i * 2, 3, "%02x", bytes[i]);
+  printf("{\"schema_version\":1,\"cdhash\":\"%s\"}\n", hex);
+  CFRelease(information); CFRelease(code);
+  return 0;
+}
+static OSStatus check_child(pid_t child, const char *hex) {
+  // inspect() retains full signature validation before the sandbox is applied.
+  // Here the kernel must identify that exact sealed image while it is suspended.
+  // Repeating CMS/trust evaluation inside the script's sandbox requires host
+  // services that the script must not gain access to.
+  return chati_darwin_code_identity(child, hex);
+}
+
+static pid_t start_reaper(pid_t child, int owner_fd, int *watch_writer, int *ack_reader) {
+  int watch[2], ack[2];
+  if (pipe(watch) < 0) return -1;
+  if (pipe(ack) < 0) { close(watch[0]); close(watch[1]); return -1; }
+  pid_t reaper = fork();
+  if (reaper < 0) {
+    close(watch[0]); close(watch[1]); close(ack[0]); close(ack[1]); return -1;
+  }
+  if (reaper == 0) {
+    // Only async-signal-safe calls after fork. No Security/CF or user code here.
+    if (setsid() < 0) _exit(125);
+    signal(SIGTERM, SIG_DFL); signal(SIGINT, SIG_DFL); signal(SIGHUP, SIG_DFL);
+    signal(SIGALRM, SIG_DFL); signal(SIGPIPE, SIG_IGN);
+    int limit = getdtablesize();
+    for (int fd = 0; fd < limit; fd++) if (fd != watch[0] && fd != ack[1] && fd != owner_fd) close(fd);
+    if (write(ack[1], "R", 1) != 1) _exit(125);
+    struct pollfd inputs[2] = {
+      { .fd = watch[0], .events = POLLIN }, { .fd = owner_fd, .events = POLLIN }
+    };
+    int observed;
+    do { observed = poll(inputs, 2, -1); } while (observed < 0 && errno == EINTR);
+    // Data, EOF, a broken watcher or helper death all end this group's life.
+    // Closing the one-shot GO channel does not touch either lifetime input.
+    int stopped = kill(-child, SIGKILL) == 0 || errno == ESRCH;
+    unsigned char signal_error = (unsigned char)errno;
+    (void)write(ack[1], stopped ? "K" : "E", 1);
+    if (!stopped) (void)write(ack[1], &signal_error, 1);
+    close(watch[0]); close(ack[1]);
+    // XNU killpg excludes zombies and may return EPERM for a zombie-only group.
+    // Report the actual error; the parent must still prove ESRCH after reaping.
+    _exit(stopped || signal_error == EPERM ? 0 : 125);
+  }
+  close(watch[0]); close(ack[1]);
+  *watch_writer = watch[1]; *ack_reader = ack[0];
+  return reaper;
+}
+
+static int launch(int argc, char **argv, char **environment, int admitted, int browser) {
+  int separator = browser ? 7 : admitted ? 6 : 5;
+  if (argc <= separator || strlen(argv[2]) != 40 || strspn(argv[2], "0123456789abcdef") != 40
+      || argv[3][0] != '/' || (strcmp(argv[4], "0") && strcmp(argv[4], "1"))
+      || strcmp(argv[separator], "--")) return fail("arguments", EINVAL);
+  if (admitted && (strlen(argv[5]) != 64 || strspn(argv[5], "0123456789abcdef") != 64
+      || !chati_admission_channel(5) || !control_output(6) || !control_output(7)
+      || !chati_admission_channel(8))) return fail("admission_channels", EINVAL);
+  if (browser && (!chati_admission_channel(9) || !control_output(10) || strcmp(argv[4], "0"))) {
+    return fail("browser_proof_channels", EINVAL);
+  }
+  unsigned int browser_port = 0;
+  uint64_t listener_generation = 0, observed_generation = 0;
+  if (browser) {
+    if (!argv[6][0] || strlen(argv[6]) > 5 || strspn(argv[6], "0123456789") != strlen(argv[6])) return fail("browser_listener_port", EINVAL);
+    browser_port = (unsigned int)strtoul(argv[6], NULL, 10);
+    if (!chati_darwin_listener(getpid(), 11, browser_port, &listener_generation)) return fail("browser_listener", EINVAL);
+  }
+  struct stat directory;
+  if (fstat(4, &directory) < 0 || !S_ISDIR(directory.st_mode)) return fail("project_descriptor", errno);
+  int keep_prompt = !strcmp(argv[4], "1");
+  if (keep_prompt) {
+    struct stat prompt;
+    if (fstat(3, &prompt) < 0 || !S_ISREG(prompt.st_mode)) return fail("prompt_descriptor", errno);
+  }
+  signal(SIGTERM, forward_signal); signal(SIGINT, forward_signal);
+  signal(SIGHUP, forward_signal); signal(SIGALRM, forward_signal); signal(SIGPIPE, SIG_IGN);
+  // Pre-SIGCONT budget: the reaper-ready wait (5s) and the durable-dispatch
+  // admission wait (5s) each have their own timeout. The watchdog must sit
+  // above their sum plus spawn/identity overhead, never race them.
+  alarm(20);
+  posix_spawnattr_t attributes;
+  posix_spawn_file_actions_t actions;
+  int status = posix_spawnattr_init(&attributes);
+  if (status) return fail("spawn_attributes", status);
+  status = posix_spawn_file_actions_init(&actions);
+  if (status) { posix_spawnattr_destroy(&attributes); return fail("spawn_actions", status); }
+  status = posix_spawnattr_setflags(&attributes,
+    POSIX_SPAWN_START_SUSPENDED | POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_CLOEXEC_DEFAULT);
+  if (!status) status = posix_spawnattr_setpgroup(&attributes, 0);
+  // Available since macOS 10.15, also present on the actual tested ARM64 host.
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+  if (!status) status = posix_spawn_file_actions_addfchdir_np(&actions, 4);
+#pragma clang diagnostic pop
+  for (int fd = 0; fd <= (keep_prompt ? 3 : 2) && !status; fd++) {
+    status = posix_spawn_file_actions_addinherit_np(&actions, fd);
+  }
+  if (browser && !status) status = posix_spawn_file_actions_addinherit_np(&actions, 11);
+  char **child_args = calloc((size_t)(argc - separator + 1), sizeof(char *));
+  if (!child_args) status = ENOMEM;
+  if (!status) {
+    child_args[0] = argv[3];
+    for (int i = separator + 1; i < argc; i++) child_args[i - separator] = argv[i];
+  }
+  pid_t child = -1;
+  if (!status) status = posix_spawn(&child, argv[3], &actions, &attributes, child_args, environment);
+  free(child_args);
+  posix_spawn_file_actions_destroy(&actions); posix_spawnattr_destroy(&attributes);
+  if (status) return fail("spawn", status);
+  provider_pid = child;
+  close(3); close(4);
+  int watch = -1, ack = -1;
+  pid_t reaper = start_reaper(child, admitted ? 8 : -1, &watch, &ack);
+  char ready = 0;
+  if (reaper < 0 || read_byte(ack, 5000, &ready) < 0 || ready != 'R') {
+    if (browser) { close(9); close(10); close(11); }
+    kill(-child, SIGKILL); waitpid(child, NULL, 0);
+    if (watch >= 0) close(watch);
+    if (ack >= 0) close(ack);
+    return fail("reaper_ready", 0);
+  }
+  OSStatus identity = check_child(child, argv[2]);
+  int continued = identity == errSecSuccess && !received_signal;
+  const char *admission_error = NULL;
+  if (browser && (!chati_darwin_listener(child, 11, browser_port, &observed_generation)
+      || observed_generation != listener_generation)) {
+    continued = 0; admission_error = "browser_listener_child";
+  }
+  long long started = chati_admission_monotonic_ms();
+  if (admitted) {
+    if (continued) {
+      char message[512];
+      int length = chati_format_darwin_ready(message, sizeof(message),
+        argv[5], getpid(), child, argv[2]);
+      if (length < 0 || (size_t)length >= sizeof(message)) {
+        close(6); admission_error = "ready_message";
+      } else if (control_message(6, message, (size_t)length) < 0) admission_error = "ready_channel";
+      if (!admission_error) admission_error = chati_wait_for_admission(5, 8, 5000);
+      // Recheck the suspended image after the durable-dispatch/GO pause.
+      if (!admission_error) identity = check_child(child, argv[2]);
+      if (browser && !admission_error
+          && (!chati_darwin_listener(getpid(), 11, browser_port, &observed_generation)
+            || observed_generation != listener_generation
+            || !chati_darwin_listener(child, 11, browser_port, &observed_generation)
+            || observed_generation != listener_generation)) admission_error = "browser_listener_changed";
+    } else close(6);
+    if (close(5) < 0 && !admission_error) admission_error = "go_channel_close";
+    close(8); // The already-ready separate reaper owns the lifetime reader.
+    started = chati_admission_monotonic_ms();
+    if (started < 0 && !admission_error) admission_error = "clock";
+    continued = continued && !admission_error && identity == errSecSuccess && !received_signal;
+  }
+  if (browser) close(11); // Only the admitted child and trusted caller retain the listener.
+  if (kill(child, continued ? SIGCONT : SIGKILL) < 0) continued = 0;
+  alarm(0);
+  siginfo_t exited;
+  memset(&exited, 0, sizeof(exited));
+  int waited;
+  // Keep the primary child unreaped while the reaper signals its process group.
+  if (browser && continued) waited = chati_browser_wait(child, argv[5], &exited);
+  else do { waited = waitid(P_PID, (id_t)child, &exited, WEXITED | WNOWAIT); } while (waited < 0 && errno == EINTR);
+  int wait_error = waited < 0 ? errno : 0;
+  // Irrevocably revoke ownership service before reaper signalling or reap.
+  if (browser) { close(9); close(10); }
+  close(watch);
+  char stopped = 0;
+  int acknowledged = read_byte(ack, 5000, &stopped) == 0 && stopped == 'K';
+  char signal_error = 0;
+  if (stopped == 'E') (void)read_byte(ack, 1000, &signal_error);
+  close(ack);
+  int child_status = 0, reaper_status = 0;
+  pid_t reaped;
+  do { reaped = waitpid(child, &child_status, 0); } while (reaped < 0 && errno == EINTR);
+  int reap_error = reaped < 0 ? errno : 0;
+  do { status = waitpid(reaper, &reaper_status, 0); } while (status < 0 && errno == EINTR);
+  provider_pid = -1;
+  if (admission_error) return fail(admission_error, 0);
+  if (!continued) return fail("dynamic_identity", (int)identity);
+  if (waited < 0) return fail("waitid", wait_error);
+  if (reaped != child) return fail("reap_provider", reap_error);
+  if (!acknowledged && !(stopped == 'E' && (unsigned char)signal_error == EPERM)) {
+    return fail("reaper_ack", signal_error ? (unsigned char)signal_error : (int)stopped);
+  }
+  if (status != reaper || !WIFEXITED(reaper_status) || WEXITSTATUS(reaper_status) != 0) return fail("reap_reaper", reaper_status);
+  int group_empty = 0;
+  for (int attempt = 0; attempt < 500; attempt++) {
+    if (kill(-child, 0) < 0) {
+      if (errno == ESRCH) { group_empty = 1; break; }
+      if (errno != EPERM) break;
+      // A transient zombie-only group may still exist until launchd reaps it.
+      // EPERM is not proof of emptiness: keep waiting for actual ESRCH.
+    }
+    struct timespec delay = { .tv_sec = 0, .tv_nsec = 10000000 };
+    nanosleep(&delay, NULL);
+  }
+  if (!group_empty) return fail("process_group_not_empty", 0);
+  if (admitted) {
+    long long finished = chati_admission_monotonic_ms();
+    if (finished < started) return fail("completion_clock", 0);
+    char message[768];
+    const struct chati_darwin_completion result = {
+      .elapsed_ms = finished - started,
+      .exit_code = WIFEXITED(child_status) ? WEXITSTATUS(child_status) : -1,
+      .signal = WIFSIGNALED(child_status) ? WTERMSIG(child_status) : 0,
+      .supervisor_signal = received_signal,
+      .reaper_acknowledged = acknowledged,
+    };
+    int length = chati_format_darwin_completion(message, sizeof(message),
+      argv[5], getpid(), child, argv[2], &result);
+    if (length < 0 || (size_t)length >= sizeof(message)) return fail("completion_message", 0);
+    if (control_message(7, message, (size_t)length) < 0) return fail("completion_channel", 0);
+  }
+  if (received_signal) return 128 + received_signal;
+  if (WIFSIGNALED(child_status)) return 128 + WTERMSIG(child_status);
+  return WIFEXITED(child_status) ? WEXITSTATUS(child_status) : fail("child_status", 0);
+}
+
+int main(int argc, char **argv, char **environment) {
+  if (argc == 3 && !strcmp(argv[1], "inspect")) return inspect(argv[2]);
+  if (argc >= 6 && !strcmp(argv[1], "launch")) return launch(argc, argv, environment, 0, 0);
+  if (argc >= 7 && !strcmp(argv[1], "launch-admitted")) return launch(argc, argv, environment, 1, 0);
+  // No legacy self-binding browser launch: stale callers fail closed.
+  if (argc >= 8 && !strcmp(argv[1], "launch-browser-prebound-admitted")) return launch(argc, argv, environment, 1, 1);
+  return fail("mode", EINVAL);
+}