tickmarkr 2.6.5 → 2.6.7

package/dist/run/git-trust.js

@@ -0,0 +1,178 @@
+import { execFileSync } from "node:child_process";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+// v2.6.7 T4 (GHSA-2): a seat-run linked worktree's gitdir is seat-writable (the Codex worker grant), so its
+// `commondir` and `config.worktree` can redirect every later unsandboxed host git in that checkout to a
+// hostile common directory or config program. Authority is derived afresh on every call from the seat-denied
+// worktree gitfile and the trusted ordinary common directory's own bytes — never persisted enrollment, never
+// the mutable commondir/config.worktree, never ambient GIT_DIR/GIT_COMMON_DIR. No verdict is cached: a check
+// passed once proves nothing about the next spawn. This module must not import git.ts, lease.ts or journal.ts.
+/** A covered git invocation refused before spawn; `path` names the offending metadata. */
+export class GitTrustRefusal extends Error {
+    path;
+    constructor(path, detail) {
+        super(`git trust refusal: ${path}: ${detail}`);
+        this.name = "GitTrustRefusal";
+        this.path = path;
+    }
+}
+/** The nearest `.git` entry at or above cwd, or undefined outside any checkout. */
+const dotGitOf = (cwd) => {
+    let dir;
+    try {
+        dir = realpathSync.native(cwd);
+    }
+    catch {
+        return undefined;
+    }
+    for (;;) {
+        const candidate = join(dir, ".git");
+        try {
+            lstatSync(candidate);
+            return candidate;
+        }
+        catch { /* keep walking */ }
+        const up = dirname(dir);
+        if (up === dir)
+            return undefined;
+        dir = up;
+    }
+};
+const present = (path) => {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * A path exactly as git reads it from a gitfile or commondir (setup.c read_gitfile_gently /
+ * get_common_dir_noenv): raw bytes with ONLY trailing CR/LF stripped — never trimmed, so a leading or trailing
+ * space stays a path component git follows — relative to `base` unless it starts with "/", then a PHYSICAL
+ * realpath (symlinks resolved before `..`, as git's strbuf_realpath and realpath(3) do; fs.realpathSync
+ * normalizes `..` lexically first). Throws when the path does not resolve.
+ */
+const resolveAsGit = (base, bytes) => {
+    let end = bytes.length;
+    while (end && (bytes[end - 1] === 0x0a || bytes[end - 1] === 0x0d))
+        end--;
+    const named = bytes.subarray(0, end);
+    return realpathSync.native(named[0] === 0x2f ? named : Buffer.concat([Buffer.from(`${base}/`), named]), { encoding: "buffer" });
+};
+function authorityOf(dotGit) {
+    let directory;
+    try {
+        directory = statSync(dotGit).isDirectory();
+    }
+    catch (e) {
+        throw new GitTrustRefusal(dotGit, `unreadable checkout metadata (${String(e)})`);
+    }
+    if (directory) {
+        const gitdir = realpathSync.native(dotGit);
+        return { gitdir, common: gitdir, linked: false };
+    }
+    // git accepts a gitfile only when its first bytes are exactly "gitdir: " and the rest names the path
+    let named;
+    try {
+        const bytes = readFileSync(dotGit);
+        if (bytes.subarray(0, 8).toString("latin1") === "gitdir: ")
+            named = bytes.subarray(8);
+    }
+    catch { /* refused below */ }
+    if (!named || !/[^\r\n]/.test(named.toString("latin1")))
+        throw new GitTrustRefusal(dotGit, "not a readable gitfile");
+    let gitdir;
+    try {
+        gitdir = resolveAsGit(dirname(dotGit), named).toString();
+    }
+    catch {
+        throw new GitTrustRefusal(dotGit, `names a missing gitdir ${named.toString().trimEnd()}`);
+    }
+    // Supported linked layout: <common>/worktrees/<name>, where <common> is itself an ordinary git directory.
+    // The layout decides, never commondir's presence: a seat can delete its own commondir (and plant standalone
+    // repository metadata beside it), which must not turn its writable gitdir into its own trusted common dir.
+    const common = basename(dirname(gitdir)) === "worktrees" ? dirname(dirname(gitdir)) : undefined;
+    if (common !== undefined && present(join(common, "HEAD")) && !present(join(common, "commondir")))
+        return { gitdir, common, linked: true };
+    // Outside that layout, a gitdir without commondir is an ordinary separate git directory (submodule, --separate-git-dir).
+    if (!present(join(gitdir, "commondir")))
+        return { gitdir, common: gitdir, linked: false };
+    if (common === undefined)
+        throw new GitTrustRefusal(dotGit, `names ${gitdir}, outside a supported <common>/worktrees/<name> layout`);
+    throw new GitTrustRefusal(common, "the linked worktree's common directory is not an ordinary git directory");
+}
+/**
+ * The canonical, independently expected common git directory for the checkout enclosing `cwd` — never what
+ * a mutable commondir says. Throws GitTrustRefusal naming the authority path when it cannot be established.
+ */
+export function trustedCommonDir(cwd) {
+    const dotGit = dotGitOf(cwd);
+    if (!dotGit)
+        throw new GitTrustRefusal(cwd, "no checkout encloses this directory");
+    return authorityOf(dotGit).common;
+}
+/** Read failures and unparseable values never become clean authority. */
+function worktreeConfigEnabled(common) {
+    const config = join(common, "config");
+    if (!present(config))
+        throw new GitTrustRefusal(config, "the trusted common config is missing");
+    try {
+        return execFileSync("git", ["config", "--file", config, "--type=bool", "--get", "extensions.worktreeConfig"], {
+            cwd: "/", encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000,
+        }).trim() === "true";
+    }
+    catch (error) {
+        const e = error;
+        if (e.status === 1 && !e.stderr?.trim())
+            return false; // the key is absent
+        throw new GitTrustRefusal(config, `cannot read extensions.worktreeConfig (${(e.stderr ?? String(error)).trim().split("\n")[0]})`);
+    }
+}
+/**
+ * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
+ * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
+ * would follow resolves anywhere but the expected common directory, or when the trusted common config enables
+ * extensions.worktreeConfig and the linked gitdir holds a config.worktree.
+ */
+export function assertGitTrust(cwd) {
+    const dotGit = dotGitOf(cwd);
+    if (!dotGit)
+        return;
+    const { gitdir, common, linked } = authorityOf(dotGit);
+    const commondir = join(gitdir, "commondir");
+    if (linked && !present(commondir))
+        throw new GitTrustRefusal(commondir, `is missing, so git would treat the seat-writable gitdir as its own repository; expected ${common}`);
+    if (present(commondir)) {
+        // read as git reads it (resolveAsGit), never trimmed or lexically normalized: either would let a seat-written
+        // path that names the real common directory to us lead git somewhere else
+        let actual;
+        try {
+            actual = resolveAsGit(gitdir, readFileSync(commondir));
+        }
+        catch {
+            throw new GitTrustRefusal(commondir, `names no readable directory; expected ${common}`);
+        }
+        if (!actual.equals(Buffer.from(common)))
+            throw new GitTrustRefusal(commondir, `resolves to ${actual.toString()}, not the expected common directory ${common}`);
+    }
+    const worktreeConfig = join(gitdir, "config.worktree");
+    if (linked && present(worktreeConfig) && worktreeConfigEnabled(common)) {
+        throw new GitTrustRefusal(worktreeConfig, `extensions.worktreeConfig is enabled in ${join(common, "config")}, so git would read this seat-writable file`);
+    }
+}
+/** The inert hooks directory every protected git child receives (no hook can exist beneath it). */
+export const INERT_HOOKS_PATH = "/dev/null";
+const FORCED_GIT_CONFIG = `'core.fsmonitor=false' 'core.hooksPath=${INERT_HOOKS_PATH}'`;
+/**
+ * A copy of `env` whose git children run with core.fsmonitor=false and an inert core.hooksPath, despite repo
+ * config and inherited GIT_CONFIG_COUNT/GIT_CONFIG_PARAMETERS: git applies GIT_CONFIG_PARAMETERS after
+ * GIT_CONFIG_COUNT and the last value wins, so the forced pair is appended last. Every other value survives.
+ * Named keys only — this does not neutralize arbitrary executable drivers. The pair is inherited by every
+ * descendant of the protected child (a suite that needs real hooks must clear it for its own git).
+ */
+export function protectedGitEnv(env) {
+    const prior = env.GIT_CONFIG_PARAMETERS?.trim();
+    return { ...env, GIT_CONFIG_PARAMETERS: prior ? `${prior} ${FORCED_GIT_CONFIG}` : FORCED_GIT_CONFIG };
+}

package/dist/run/git.js

@@ -1,5 +1,6 @@
+import { observeVerificationReceipt, observeVerificationSpawn, verificationJobEnvironment } from "./verification-job.js";
 import { executionSignal } from "./execution-budget.js";
-import { commandLeaseEnvironment, withCommandLease } from "./lease.js";
+import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
@@ -10,6 +11,7 @@ import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 import { titleEnvironment } from "./title-environment.js";
+import { assertGitTrust, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
 // OBS-110: gate/baseline/tip-verify children are vitest suites; without a fork cap, concurrent
 // full-suite gate runs fork a worker-per-core pool per worktree and saturate the operator box.
@@ -289,6 +291,7 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
                 activeShells.delete(activePid);
             activePid = undefined;
         }
+        observeVerificationReceipt({ ...receipt, confirmedStart });
         // Observational callbacks must not change process cleanup, retries or cancellation.
         try {
             options.onReceipt?.({ ...receipt, confirmedStart, ...(attribution ? { attribution: { ...attribution } } : {}) });
@@ -315,7 +318,9 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
     // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
     // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
     // children are hermetic by construction; the daemon's own process.env stays unchanged.
-    const env = commandLeaseEnvironment(options.env ?? process.env);
+    // v2.6.7 T4 (E1): git children run with core.fsmonitor=false and an inert hooksPath whatever the
+    // repository or inherited GIT_CONFIG_* say; every other parent, capability and explicit value survives.
+    const env = protectedGitEnv(verificationJobEnvironment(repositoryLeaseEnvironment(commandLeaseEnvironment(options.env ?? process.env))));
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
     // A run freezes the operator override and cores at startup; admission can lower the round cap.
@@ -346,6 +351,15 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
         let p;
+        // v2.6.7 T4: the trust check runs before EVERY spawn attempt (retries included) and caches nothing — a
+        // seat can rewrite its gitdir's commondir/config.worktree between any two calls. A refusal names the file.
+        try {
+            assertGitTrust(cwd);
+        }
+        catch (error) {
+            observation.emit({ outcome: "spawn-failed", exitCode: null, signal: null, error: String(error) });
+            throw error;
+        }
         try {
             p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         }
@@ -428,6 +442,19 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
             boundDrain();
         };
         options.signal?.addEventListener("abort", abort, { once: true });
+        try {
+            registerRepositoryChild(p.pid);
+        }
+        catch (error) {
+            try {
+                process.kill(-p.pid, "SIGKILL");
+            }
+            catch {
+                p.kill("SIGKILL");
+            }
+            spawnError = String(error);
+        }
+        observeVerificationSpawn(p.pid);
         options.onSpawn?.(p.pid);
         if (options.signal?.aborted)
             abort();
@@ -693,21 +720,14 @@ export async function createWorktree(repo, branch, baseRef) {
 // match the provisioned SYMLINK, so a worker staging with `git add -A` commits the link and burns an
 // attempt on the scope gate. Write `node_modules` (no slash: matches the link too) into the exclude
 // file git actually consults for this worktree. Per-worktree `info/` is ignored in linked worktrees
-// (gitrepository-layout redirects it), so resolve through the `.git` gitfile + `commondir` indirection
-// to the common git dir. Local git metadata only — the target repository's .gitignore is never edited.
+// (gitrepository-layout redirects it), so write the common git dir's exclude. Local git metadata only — the target repository's .gitignore is never edited.
 // Idempotent (appends only when no entry exists) and best-effort, like the link itself.
+// v2.6.7 T4 (W1): the common dir is the independently derived one (trustedCommonDir), never what a
+// seat-writable commondir names — a redirected commondir never receives the write.
 function excludeNodeModules(dir) {
     try {
-        let gitDir = join(dir, ".git");
-        if (lstatSync(gitDir).isFile()) { // linked worktree: .git is a gitfile naming the real git dir
-            const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(gitDir, "utf8"));
-            if (!m)
-                return;
-            gitDir = resolve(dir, m[1]);
-        }
-        const commondir = join(gitDir, "commondir");
-        if (existsSync(commondir))
-            gitDir = resolve(gitDir, readFileSync(commondir, "utf8").trim());
+        lstatSync(join(dir, ".git")); // only the checkout itself, never an enclosing repository
+        const gitDir = trustedCommonDir(dir);
         const exclude = join(gitDir, "info", "exclude");
         const current = existsSync(exclude) ? readFileSync(exclude, "utf8") : "";
         if (/^node_modules$/m.test(current))

package/dist/run/journal.js

@@ -11,6 +11,7 @@ import { channelRouteIdentity, modelProvider } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
 import { PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER } from "./git.js";
+import { assertGitTrust, protectedGitEnv } from "./git-trust.js";
 import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
@@ -2398,9 +2399,17 @@ export class Journal {
 // "unknown" — never zero — for a waiver without a well-formed obligation or a proof that no longer holds.
 export const OWED_CHECK_VERSION = 1;
 export const OWED_DISCHARGE_EVENT = "owed-check-discharged";
-const owedGit = (cwd, args, input) => execFileSync("git", args, {
-    cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
-});
+// v2.6.7 T4: every owed-identity git call runs the uncached trust check and the forced child config, and its
+// diff-producing verbs never run an external diff or textconv driver; a refusal throws, so the fold is unknown.
+const NO_DRIVERS = new Set(["diff", "show", "log"]);
+const owedGit = (cwd, args, input) => {
+    assertGitTrust(cwd);
+    const argv = NO_DRIVERS.has(args[0]) ? [args[0], "--no-ext-diff", "--no-textconv", ...args.slice(1)] : args;
+    return execFileSync("git", argv, {
+        cwd, env: protectedGitEnv(process.env), encoding: "utf8", maxBuffer: 64 * 1024 * 1024,
+        ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
+    });
+};
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 export const owedCriteria = (acceptance) => sha256(JSON.stringify(acceptance));
 /** The daemon's canonical gate subject for base..head (daemon.ts gateCommitSubject), byte for byte. */
@@ -2700,6 +2709,9 @@ export function foldOwedChecks(events, cwd, memo) {
     }
 }
 function foldOwedChecksOrThrow(events, cwd, memo) {
+    // v2.6.7 T4 (G2): checkout trust is re-derived at the fold boundary, before a memoised proof can answer —
+    // a memo hit runs no git, so hostile metadata would otherwise ride a clean fold's cached proof to known debt.
+    assertGitTrust(cwd);
     const accepted = new Map();
     const discharged = new Set();
     const unknown = [];

package/dist/run/lease.d.ts

@@ -27,6 +27,13 @@ export interface RepositoryLeaseHolder {
     cwd: string;
     at: number;
     token: string;
+    /** Exact owner birth and token-bound execution roots; retained across owner death. */
+    identity?: string;
+    protectOrphans?: true;
+    /** The owner settled; only its protected tree can still block reclamation. */
+    ownerReleased?: true;
+    roots?: number[];
+    rootBirths?: Record<string, string>;
 }
 export interface RepositoryLeaseOptions {
     pollMs?: number;
@@ -35,6 +42,13 @@ export interface RepositoryLeaseOptions {
     onWait?: (holder: RepositoryLeaseHolder) => void;
     /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
     inherited?: string;
+    /** Manifest jobs bridge capabilities through explicit child environments, never process.env. */
+    isolated?: boolean;
+    protectOrphans?: boolean;
+    onAdmission?: (holder: RepositoryLeaseHolder) => void;
+    onRelease?: () => void;
+    /** A new job inside an existing job cannot borrow that job's async capability. */
+    independent?: boolean;
 }
 /** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
  * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
@@ -68,4 +82,13 @@ export declare const readHolder: (path: string) => RepositoryLeaseHolder | undef
 export declare function tryReserve(path: string, mine: RepositoryLeaseHolder): boolean;
 /** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
 export declare const reclaimDead: (path: string, identity: string, pollMs?: number) => Promise<boolean>;
+export declare function protectedProcesses(holder: RepositoryLeaseHolder, tokenEnv?: string, ownedOnly?: boolean): Promise<number[]>;
+export declare const repositoryLeaseEnvironment: (env: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
+/** Called synchronously at spawn, before any user callback, and only on an owned generation. */
+export declare function registerRepositoryChild(pid: number | undefined): void;
+export declare const withFreshCommandLease: <T>(command: string, run: () => Promise<T>) => Promise<T>;
+/** The standalone wrapper uses the same command-then-repository order when a scheduler exists.
+ * Without one (CLI/global setup), this remains exactly the outer file reservation API. */
 export declare function withRepositoryLease<T>(cwd: string, run: () => Promise<T>, opts?: RepositoryLeaseOptions): Promise<T>;
+export declare const hasRepositoryLeaseOwnership: () => boolean;
+export declare function reapRepositoryChildren(holder: RepositoryLeaseHolder, pollMs: number, tokenEnv?: string): Promise<void>;