rea-agents 6.4.0 → 6.7.0

package/dist/process/ProcessOwnership.js

@@ -4,6 +4,7 @@ import { errorMessage, systemProcessOwnershipHost as systemHost, } from "./Proce
 import { launcherIdentityFailure } from "./ProcessOwnershipIdentity.js";
 import { descendantsOf, liveProcesses } from "./ProcessOwnershipProcessTree.js";
 import { readProcessRunTokens } from "./ProcessRunTokenObservations.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
 const execFileAsync = promisify(execFile);
 /**
  * Terminate one Windows process tree through the platform utility.
@@ -42,7 +43,11 @@ const systemWindowsProcessTreeHost = {
     },
 };
 /** Read the capture run token currently exposed by one live process. */
-export const readProcessRunId = async (pid, host = systemHost) => (await host.environment(pid)).REA_PROCESS_RUN_ID;
+export const readProcessRunId = async (pid, host = systemHost, signal) => (await host.environment(pid, signal)).REA_PROCESS_RUN_ID;
+/** Keep unrelated-process uncertainty attached to every outcome of this cleanup attempt. */
+const withUnverifiedObservations = (result, unverified) => unverified.length === 0 || (result.unverified?.length ?? 0) > 0
+    ? result
+    : { ...result, unverified };
 /** Token-validate every rooted POSIX process group before signaling any. */
 export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) => {
     const processTable = await readLiveProcessTable(host);
@@ -57,8 +62,16 @@ export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) =>
     let signaled = false;
     for (const processGroupId of plan.signalOrder) {
         const revalidation = await revalidateOwnedProcessGroup(processGroupId, ownership, host, plan.tokenOwnedIdentities);
-        if ("cleaned" in revalidation)
-            return revalidation;
+        if ("cleaned" in revalidation) {
+            if (!revalidation.cleaned)
+                return withUnverifiedObservations(revalidation, plan.unverified);
+            return {
+                ...revalidation,
+                ...(revalidation.unverified?.length || plan.unverified.length === 0
+                    ? {}
+                    : { unverified: plan.unverified }),
+            };
+        }
         if (revalidation.empty)
             continue;
         try {
@@ -68,10 +81,10 @@ export const cleanupOwnedProcessGroup = async (ownership, host = systemHost) =>
         catch (cause) {
             const code = cause instanceof Error && "code" in cause ? cause.code : undefined;
             if (code !== "ESRCH")
-                return {
+                return withUnverifiedObservations({
                     cleaned: false,
                     reason: `owned process group signal failed: ${errorMessage(cause)}`,
-                };
+                }, plan.unverified);
         }
     }
     if (plan.unresolved.length > 0)
@@ -222,8 +235,8 @@ const createOwnedCleanupPlan = async (ownership, initialProcesses, host) => {
                 diagnostic: "sampled process-group leader identity could not be verified",
             })));
         const scanFailures = tokenOwned.failures.filter(({ pid }) => members.some((member) => member.pid === pid));
-        if (failures.length > 0)
-            unresolved.push(...failures);
+        for (const failure of failures)
+            mergeProcessOwnershipFailure(unresolved, failure);
         if (failures.length === 0 &&
             scanFailures.length === 0 &&
             !unverifiableSampledGroups.has(processGroupId))
@@ -244,6 +257,26 @@ const createOwnedCleanupPlan = async (ownership, initialProcesses, host) => {
         unverified: tokenOwned.unverified,
     };
 };
+/** Keep one current, most useful ownership diagnosis for each live PID. */
+const mergeProcessOwnershipFailure = (failures, next) => {
+    const index = failures.findIndex(({ pid }) => pid === next.pid);
+    if (index < 0) {
+        failures.push(next);
+        return;
+    }
+    const previous = failures[index];
+    if (previous !== undefined &&
+        ownershipFailurePriority(next.reason) >=
+            ownershipFailurePriority(previous.reason))
+        failures[index] = next;
+};
+const ownershipFailurePriority = (reason) => reason === "run-token-mismatch"
+    ? 3
+    : reason === "process-identity-unavailable"
+        ? 2
+        : reason === "environment-unreadable"
+            ? 1
+            : 0;
 const revalidateOwnedProcessGroup = async (processGroupId, ownership, host, expectedIdentities) => {
     let members;
     try {
@@ -277,7 +310,13 @@ const cleanupValidationFailure = (failures, unverified = []) => {
     if (failures.some(({ reason }) => reason === "run-token-mismatch"))
         return {
             cleaned: false,
-            reason: "process tree contains an unowned or PID-reused process",
+            reason: `process ownership token mismatch for PID(s): ${[
+                ...new Set(failures
+                    .filter(({ reason }) => reason === "run-token-mismatch")
+                    .map(({ pid }) => pid)),
+            ]
+                .sort((left, right) => left - right)
+                .join(", ")}`,
             failures,
             ...unverifiedEntry,
         };
@@ -295,12 +334,12 @@ const cleanupValidationFailure = (failures, unverified = []) => {
             counts.set(category, (counts.get(category) ?? 0) + 1);
         }
         const breakdown = [...counts]
-            .sort(([left], [right]) => left.localeCompare(right))
+            .sort(([left], [right]) => compareUnicodeCodePoints(left, right))
             .map(([category, count]) => `${category}=${String(count)}`)
             .join(", ");
         const candidates = unreadable
             .map(({ pid, diagnostic }) => `${String(pid)}=${sanitizedTokenReadFailure(diagnostic)}`)
-            .sort((left, right) => left.localeCompare(right));
+            .sort((left, right) => compareUnicodeCodePoints(left, right));
         return {
             cleaned: false,
             reason: `process ownership token could not be read for ${String(unreadable.length)} live process(es): ${breakdown}; live candidates ${candidates.join(", ")}`,
@@ -320,6 +359,8 @@ const sanitizedTokenReadFailure = (diagnostic) => {
         return diagnostic;
     if (diagnostic === "platform_binary_environment_withheld")
         return diagnostic;
+    if (diagnostic === "restricted_process_environment_withheld")
+        return diagnostic;
     const environmentErrno = /^(EACCES|EPERM|ENOENT|ESRCH):/u.exec(diagnostic ?? "");
     if (environmentErrno?.[1] !== undefined)
         return `environment_errno_${environmentErrno[1]}`;
@@ -417,7 +458,15 @@ const recheckOwnershipFailures = async (failures, host) => {
     if (!failures.some(({ reason }) => reason !== "run-token-mismatch"))
         return failures;
     try {
-        const live = new Set(liveProcesses(await host.listProcesses()).map(({ pid }) => pid));
+        let processes = await host.listProcesses();
+        const isDarwin = (host.platform ?? process.platform) === "darwin";
+        for (let attempt = 0; isDarwin &&
+            attempt < TOKEN_READ_RETRY_ATTEMPTS &&
+            processes.some(({ pid, state }) => failures.some((failure) => failure.pid === pid && failure.reason !== "run-token-mismatch") && state.slice(1).includes("E")); attempt += 1) {
+            await new Promise((resolve) => setTimeout(resolve, TOKEN_READ_RETRY_DELAY_MS));
+            processes = await host.listProcesses();
+        }
+        const live = new Set(liveProcesses(processes).map(({ pid }) => pid));
         return failures.filter(({ pid, reason }) => reason === "run-token-mismatch" || live.has(pid));
     }
     catch (cause) {
@@ -433,20 +482,24 @@ const TOKEN_READ_RETRY_ATTEMPTS = 3;
 const TOKEN_READ_RETRY_DELAY_MS = 40;
 /** Darwin reports this when the kernel withholds a platform binary's environment. */
 const PLATFORM_BINARY_ENVIRONMENT_WITHHELD = "platform_binary_environment_withheld";
+/** Darwin reports this when the kernel withholds a restricted process environment. */
+const RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD = "restricted_process_environment_withheld";
 const currentProcessUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 /**
  * Whether the operating system provably withheld this candidate's run token:
- * current macOS omits the environment of Apple platform binaries from
- * KERN_PROCARGS2 and fails with EINVAL for processes owned by another
- * account, and neither class can be token-verified by any caller. Such a
- * candidate is recorded as unverified instead of failing an otherwise clean
- * capture; every other unreadable candidate stays fail-closed.
+ * current macOS omits the environment of Apple platform binaries and
+ * CS_RESTRICT processes from KERN_PROCARGS2, and fails with EINVAL for
+ * processes owned by another account. These classes cannot be token-verified
+ * by this caller. An unrelated candidate is recorded as unverified instead
+ * of failing an otherwise clean capture; every related or otherwise
+ * unreadable candidate stays fail-closed.
  */
 const environmentWithheldFromInspection = (entry, diagnostic) => {
     const uid = currentProcessUid();
     if (uid !== undefined && entry.uid !== undefined && entry.uid !== uid)
         return true;
-    return diagnostic === PLATFORM_BINARY_ENVIRONMENT_WITHHELD;
+    return (diagnostic === PLATFORM_BINARY_ENVIRONMENT_WITHHELD ||
+        diagnostic === RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD);
 };
 const scanTokenOwnedProcesses = async (processes, runId, host, captureBaseline, relation) => {
     let candidates = processes;

package/dist/process/ProcessOwnershipObservation.js

@@ -3,7 +3,7 @@ import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.
 import { launcherIdentityFailure } from "./ProcessOwnershipIdentity.js";
 import { descendantsOf, liveProcesses } from "./ProcessOwnershipProcessTree.js";
 import { execFileOutput } from "./ExecFileOutput.js";
-import { createDarwinProcessRunTokenReader } from "./DarwinProcessRunTokenReader.js";
+import { createDarwinProcessRunTokenReader, } from "./DarwinProcessRunTokenReader.js";
 import { readProcessRunTokens } from "./ProcessRunTokenObservations.js";
 /** Observe multiple groups from one process snapshot and one token batch. */
 export const observeOwnedProcessGroups = async (runId, processGroupIds, host = systemProcessOwnershipHost, signal) => {
@@ -156,10 +156,27 @@ const isExpectedAbort = (cause, signal) => signal?.aborted === true &&
         (cause instanceof Error && cause.name === "AbortError"));
 /** Create the operating-system process inspector for an explicit host context. */
 export const createSystemProcessOwnershipHost = (platform = process.platform, hostEnvironment = process.env, options = {}) => {
+    const darwinModuleCachePath = options.darwinModuleCachePath ??
+        hostEnvironment.REA_DARWIN_MODULE_CACHE_PATH;
+    const swiftcPath = hostEnvironment.REA_DARWIN_SWIFTC_PATH;
+    const darwinCompiler = options.darwinCompiler ??
+        (swiftcPath === undefined || swiftcPath === ""
+            ? undefined
+            : {
+                kind: "swiftc",
+                executable: swiftcPath,
+                sdkRoot: hostEnvironment.SDKROOT ?? "",
+            });
     const darwinTokens = platform === "darwin"
-        ? createDarwinProcessRunTokenReader(options.darwinXcrun === undefined
-            ? {}
-            : { xcrun: options.darwinXcrun })
+        ? createDarwinProcessRunTokenReader({
+            ...(darwinCompiler === undefined ? {} : { compiler: darwinCompiler }),
+            ...(darwinModuleCachePath === undefined
+                ? {}
+                : { moduleCachePath: darwinModuleCachePath }),
+            ...(options.compileTimeoutMs === undefined
+                ? { environment: hostEnvironment }
+                : { compileTimeoutMs: options.compileTimeoutMs }),
+        })
         : undefined;
     const listProcesses = async (signal) => {
         if (platform === "win32")
@@ -372,6 +389,20 @@ export const observeProcessStartIdentity = async (pid, host = systemProcessOwner
             reason: `process identity changed while validating the captured run token for PID ${String(pid)}`,
         };
 };
+/** Confirm whether the process that held an authenticated bridge has exited. */
+export const observeProcessStartIdentityExit = async (pid, expectedIdentity, host = systemProcessOwnershipHost) => {
+    try {
+        const observed = await observeProcessStartIdentity(pid, host);
+        if (observed === undefined)
+            return "exited";
+        if (observed.state !== "readable")
+            return "unverified";
+        return observed.identity === expectedIdentity ? "present" : "exited";
+    }
+    catch {
+        return "unverified";
+    }
+};
 /** Revalidate a launch-time start identity immediately before signaling a PID. */
 export const signalProcessWithStartIdentity = async (pid, expectedIdentity, signal, options = {}) => {
     const host = options.host ?? systemProcessOwnershipHost;

package/dist/process/ProviderDeadline.js

@@ -31,12 +31,12 @@ export class ProviderStartupDeadline {
         this.timeoutMs = timeoutMs;
         if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
             throw new RangeError("Provider startup timeout must be positive");
-        this.#deadlineAt = Date.now() + timeoutMs;
+        this.#deadlineAt = performance.now() + timeoutMs;
         this.#externalSignal = signal;
         this.#onExternalAbort = () => {
             if (this.#controller.signal.aborted)
                 return;
-            if (Date.now() >= this.#deadlineAt) {
+            if (performance.now() >= this.#deadlineAt) {
                 this.#interruption = "timeout";
                 this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
                 return;
@@ -49,12 +49,7 @@ export class ProviderStartupDeadline {
             return;
         }
         signal?.addEventListener("abort", this.#onExternalAbort, { once: true });
-        this.#timer = setTimeout(() => {
-            if (this.#controller.signal.aborted)
-                return;
-            this.#interruption = "timeout";
-            this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
-        }, timeoutMs);
+        this.#armDeadlineTimer(timeoutMs);
     }
     /** Composite signal aborted by either the caller or the absolute deadline. */
     get signal() {
@@ -63,15 +58,47 @@ export class ProviderStartupDeadline {
     /** First control path that interrupted startup, if any. */
     get interruption() {
         return (this.#interruption ??
-            (Date.now() >= this.#deadlineAt ? "timeout" : undefined));
+            (performance.now() >= this.#deadlineAt ? "timeout" : undefined));
     }
     /** Milliseconds still available to the next startup phase. */
     remainingMs() {
-        return Math.max(0, this.#deadlineAt - Date.now());
+        // Node timers can fire a fraction of a millisecond before the monotonic
+        // deadline, so an elapsed timer must not report time left to spend. A
+        // terminal timeout also cannot regain budget after later clock queries.
+        if (this.#interruption === "timeout")
+            return 0;
+        return Math.max(0, Math.ceil(this.#deadlineAt - performance.now()));
     }
-    /** Wait for at most one polling interval under the shared deadline signal. */
+    /**
+     * Wait for at most one polling interval under the shared deadline signal.
+     *
+     * Both timers may fire before their monotonic targets. Retain the earlier
+     * of the polling target and deadline, and wait again for any residual time.
+     */
     wait(milliseconds) {
-        return waitForAbortableDelay(Math.min(milliseconds, this.remainingMs()), this.signal);
+        const startedAt = performance.now();
+        // Absolute target: the earlier of the requested polling interval and the
+        // absolute monotonic deadline.
+        const targetAt = Math.min(startedAt + milliseconds, this.#deadlineAt);
+        const poll = () => {
+            const budget = this.remainingMs();
+            const residual = Math.max(0, targetAt - performance.now());
+            return waitForAbortableDelay(Math.min(residual, budget), this.signal).then((result) => {
+                if (result === "aborted")
+                    return "aborted";
+                const now = performance.now();
+                // The monotonic deadline expired: a full-budget wait resolves as an
+                // abort so polling stops at the boundary.
+                if (now >= this.#deadlineAt)
+                    return "aborted";
+                // The polling interval elapsed without expiring the deadline.
+                if (now >= targetAt)
+                    return "elapsed";
+                // A timer fired before the absolute target; keep waiting.
+                return poll();
+            });
+        };
+        return poll();
     }
     /** Release the deadline timer and external abort listener. */
     dispose() {
@@ -88,4 +115,23 @@ export class ProviderStartupDeadline {
             clearTimeout(this.#timer);
         this.#timer = undefined;
     }
+    /**
+     * Arm (or re-arm) the timer that expires the absolute monotonic deadline.
+     *
+     * Re-check the clock before classifying expiry, and retain the residual
+     * budget when the timer arrives early.
+     */
+    #armDeadlineTimer(milliseconds) {
+        this.#timer = setTimeout(() => {
+            this.#timer = undefined;
+            if (this.#controller.signal.aborted)
+                return;
+            if (performance.now() >= this.#deadlineAt) {
+                this.#interruption = "timeout";
+                this.#abort(new DOMException("Provider startup deadline elapsed", "TimeoutError"));
+                return;
+            }
+            this.#armDeadlineTimer(this.remainingMs());
+        }, milliseconds);
+    }
 }