diff --git a/.gitattributes b/.gitattributes index 2a99890023b..1ce5b29ee45 100644 --- a/.gitattributes +++ b/.gitattributes @@ -8,7 +8,14 @@ /src/cli/bundled-skill-guides.ts text eol=lf # Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash. /resources/plugins/** text eol=lf -# pnpm hashes every patch byte-for-byte, so a CRLF checkout breaks the install. +# Pin the bytes so a patch reads and diffs identically on every host. It is NOT +# what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout +# cannot change it. Believing otherwise put a hand-computed raw digest in the +# lockfile twice and broke every install (#17886). +# These files are stored LF, which is not always the encoding they were written +# against -- @vscode/windows-process-tree ships CRLF sources -- so any code that +# runs `git apply` on one must force `-c core.autocrlf=input` rather than trust +# the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs. /config/patches/*.patch -text # The xterm bundle hunks also make a diff nobody can read; review the hand-written # source patch under xterm-src/ instead. The sibling patches stay diffable. diff --git a/.github/scripts/e2e-with-window-manager.sh b/.github/scripts/e2e-with-window-manager.sh new file mode 100644 index 00000000000..d431a039809 --- /dev/null +++ b/.github/scripts/e2e-with-window-manager.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +set -euo pipefail +openbox --sm-disable > /tmp/orca-e2e-window-manager.log 2>&1 & +wm_pid=$! +cleanup() { + kill "$wm_pid" 2>/dev/null || true + wait "$wm_pid" 2>/dev/null || true +} +trap cleanup EXIT +ready=false +for attempt in {1..100}; do + if xprop -root _NET_SUPPORTING_WM_CHECK 2>/dev/null | rg -q 'window id # 0x[1-9a-fA-F]'; then + ready=true + break + fi + if ! kill -0 "$wm_pid" 2>/dev/null; then + cat /tmp/orca-e2e-window-manager.log + exit 1 + fi + sleep 0.1 +done +if [ "$ready" != true ]; then + echo 'Window manager did not acquire the Xvfb root window' >&2 + exit 1 +fi +"$@" diff --git a/.github/workflows/adhoc-mac-build.yml b/.github/workflows/adhoc-mac-build.yml index 761a9585b73..3e17eee9b68 100644 --- a/.github/workflows/adhoc-mac-build.yml +++ b/.github/workflows/adhoc-mac-build.yml @@ -160,6 +160,9 @@ jobs: - name: Checkout the requested ref uses: actions/checkout@v6 + env: + # Full-history checkout must also preserve case-twin branch and tag names. + GIT_DEFAULT_REF_FORMAT: reftable with: # Why an input at all rather than just github.ref: the whole point is to # build code that has not landed, and the workflow definition itself diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml index f0cc2df2bad..e2ba9407ac4 100644 --- a/.github/workflows/cloud-verify.yml +++ b/.github/workflows/cloud-verify.yml @@ -25,9 +25,10 @@ defaults: working-directory: cloud jobs: + # Public-repository hosted runners preserve Blacksmith allowance for macOS. security: name: Secret scan - runs-on: blacksmith-2vcpu-ubuntu-2204 + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 with: @@ -53,7 +54,7 @@ jobs: # Compiles the workspace. No Postgres service: nothing here reaches a # database, and the service container costs ~13s of startup. build: - runs-on: blacksmith-4vcpu-ubuntu-2204 + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 @@ -73,7 +74,7 @@ jobs: # package it needs through the relay pretest hook, so it does not depend on # `pnpm build` having run. test: - runs-on: blacksmith-4vcpu-ubuntu-2204 + runs-on: ubuntu-22.04 services: postgres: image: postgres:16-alpine @@ -107,7 +108,7 @@ jobs: # Fork pull requests reach this job, so it never configures a backend, never plans, and never # holds a credential. Only the relay root ships here; foundation and apps stay private. terraform: - runs-on: blacksmith-2vcpu-ubuntu-2204 + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 3560d302a79..a94a7ea2ba5 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -27,6 +27,10 @@ on: description: Ref to check out (defaults to the workflow ref) required: false type: string + test_files: + description: JSON array of specs to run; empty runs the full suite + required: false + type: string schedule: # Why: GitHub cron uses UTC; these slots map to 10am and 3pm # America/Phoenix for the default-branch E2E run. @@ -146,7 +150,7 @@ jobs: # Native cache misses need the compiler, Electron needs Xvfb, and paired # Quick Open needs ripgrep. Install them in one apt transaction per shard. - name: Install native build and headless UI tools - run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh + run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh openbox x11-utils - uses: ./.github/actions/install-node-dependencies with: @@ -167,7 +171,7 @@ jobs: # ORCA_E2E_FORWARD_APP_LOGS keeps startup failures visible when Electron # launches but never creates a BrowserWindow. - name: Run E2E tests (${{ matrix.shard_name }}) - run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }} + run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }} # Why: Playwright retains traces/screenshots only on failure. Uploading # them as an artifact makes post-mortem debugging on CI possible without @@ -201,7 +205,7 @@ jobs: # unbounded inventory fallback; the paired fixture exercises that real boundary. # Why openssh-client: the Docker-SSH fixture shells out to ssh/ssh-keygen, and this # lane now receives those specs from pr.yml's SSH source mapping. - run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh + run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils - uses: ./.github/actions/install-node-dependencies with: @@ -241,7 +245,7 @@ jobs: if grep -l '@headful' "${TEST_FILES[@]}" >/dev/null; then E2E_PROJECT_ARGS+=(--project=electron-headful) fi - xvfb-run --auto-servernum env "${E2E_ENV[@]}" \ + xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env "${E2E_ENV[@]}" \ pnpm run test:e2e "${TEST_FILES[@]}" --workers=1 "${E2E_PROJECT_ARGS[@]}" - name: Upload Playwright traces @@ -278,7 +282,7 @@ jobs: ref: ${{ inputs.ref || github.ref }} - name: Install native build and headless UI tools - run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 xvfb zsh + run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils - uses: ./.github/actions/install-node-dependencies with: @@ -293,7 +297,7 @@ jobs: # Why: this is the release-path proof that the deployed Linux relay keeps # its PTY and explorer live across a real watcher SIGSEGV. - name: Run Docker SSH watcher isolation E2E - run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation + run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation # Why: Playwright empties test-results/ when it starts, so each step here used to # destroy the previous step's traces. Only the last lane's failure was ever @@ -310,7 +314,7 @@ jobs: # readiness across live SSH, headed paired, and headless serve topologies. - name: Run Docker SSH terminal parking + startup readiness E2E if: always() - run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking + run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking - name: Keep terminal-parking traces if: always() @@ -326,7 +330,7 @@ jobs: # legible as an SSH-named failure. - name: Run remaining Docker SSH E2E if: always() - run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker + run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker - name: Keep remaining-ssh-docker traces if: always() diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 93bc4c0afc8..878b7e3e591 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -93,12 +93,13 @@ jobs: NATIVE_IME_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --native-ime-source)" echo "native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED" >> "$GITHUB_OUTPUT" echo "Native IME source changed: $NATIVE_IME_SOURCE_CHANGED" - if [ "$TEST_FILES_JSON" != '[]' ]; then + SHOULD_RUN="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --reusable-workflow)" + if [ "$SHOULD_RUN" = true ]; then echo "should_run=true" >> "$GITHUB_OUTPUT" echo "Changed E2E specs: $TEST_FILES_JSON" else echo "should_run=false" >> "$GITHUB_OUTPUT" - echo "No changed E2E specs" + echo "No specs requiring the reusable E2E workflow" fi static_analysis: @@ -831,10 +832,13 @@ jobs: node_modules/.pnpm/@vscode+windows-process-tree@*/node_modules/@vscode/windows-process-tree/build key: native-modules-${{ runner.os }}-${{ steps.deps.outputs.native-cache-scope }}-${{ runner.arch }}-node-node${{ steps.deps.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch') }} + # vitest runs here directly rather than through `pnpm test`, so the addon + # assertions only hold once install-node-dependencies has rebuilt natives. - name: Test Windows-specific boundaries run: >- pnpm exec vitest run --config config/vitest.config.ts config/scripts/rebuild-native-deps.test.mjs + config/scripts/rebuild-native-deps-windows-process-tree.test.mjs src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-route-tcp-egress.electron.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts @@ -847,6 +851,7 @@ jobs: src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts src/main/windows/windows-pty-job.win32.test.ts src/main/windows/windows-host-job.win32.test.ts + src/main/windows/windows-process-tree-command-line-patch.test.ts src/main/windows-live-tree-kill.win32.test.ts src/main/wsl/wsl-runner.test.ts src/main/wsl/wsl-guest-environment.test.ts @@ -855,14 +860,18 @@ jobs: src/main/wsl/wsl-w1-w3-contract.test.ts src/shared/source-scan/source-tree-scan.test.ts src/main/cli/wsl-cli-powershell-boundary.test.ts + src/main/computer/desktop-script-runtime-host.win32.test.ts src/main/cursor/hook-service.test.ts src/main/orca-profiles/profile-index-store.test.ts src/main/startup/windows-install-dir-acl-repair.win32.test.ts src/main/runtime/repo-worktree-admin-fingerprint.test.ts src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts src/shared/secure-file-fsync-flags.test.ts + src/shared/secure-path-windows-acl.win32.test.ts + src/main/runtime/unreadable-secret-store-preservation.win32.test.ts src/main/ipc/pty-codex-account-attribution.test.ts src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts + src/relay/windows-port-scan.win32.test.ts # Why the :parallel variant: identical to build:release except the three # electron-vite targets overlap instead of running back to back. The Linux package diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml index 6f888c3a512..001eee4e03c 100644 --- a/.github/workflows/release-cut.yml +++ b/.github/workflows/release-cut.yml @@ -858,16 +858,17 @@ jobs: if: runner.os == 'Linux' run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version-file: package.json - - name: Setup pnpm uses: pnpm/setup@v2 with: install: false + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version-file: package.json + cache: pnpm + # Why: Linux terminal golden E2E uses the same native install path as # release CI, which needs pnpm to bypass its non-executable gyp_main.py. - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only) @@ -1074,16 +1075,17 @@ jobs: if: runner.os == 'Linux' run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version-file: package.json - - name: Setup pnpm uses: pnpm/setup@v2 with: install: false + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version-file: package.json + cache: pnpm + # Why: keep the non-blocking evidence lane on the same Linux native # install path as the blocking golden and release build jobs. - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only) @@ -1716,6 +1718,7 @@ jobs: with: name: orca-windows-unsigned-${{ needs.cut.outputs.tag }} path: dist/orca-windows-setup.exe + compression-level: 0 if-no-files-found: error # Why: SignPath Foundation production certificates require manual review, diff --git a/.github/workflows/release-ref-validation.yml b/.github/workflows/release-ref-validation.yml new file mode 100644 index 00000000000..6995f9db174 --- /dev/null +++ b/.github/workflows/release-ref-validation.yml @@ -0,0 +1,38 @@ +name: Release ref validation + +on: + pull_request: + paths: + - '.github/workflows/adhoc-mac-build.yml' + - '.github/workflows/dev-channel-win-build.yml' + - '.github/workflows/release-ref-validation.yml' + - 'config/scripts/workflow-ref-reachability.test.mjs' + - 'config/scripts/workflow-ref-mirror-case-safety.test.mjs' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: release-ref-validation-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + validate: + strategy: + fail-fast: false + matrix: + os: [macos-15, windows-2022] + runs-on: ${{ matrix.os }} + timeout-minutes: 10 + steps: + - uses: actions/checkout@v6 + with: + persist-credentials: false + - uses: ./.github/actions/install-node-dependencies + - name: Verify case-twin refs and release trust boundary + run: >- + pnpm exec vitest run --config config/vitest.config.ts + config/scripts/workflow-ref-reachability.test.mjs + config/scripts/workflow-ref-mirror-case-safety.test.mjs + config/scripts/dev-channel-windows-workflow-contract.test.mjs diff --git a/.github/workflows/skill-update-roundtrip.yml b/.github/workflows/skill-update-roundtrip.yml index 239f1b2f27c..96de1101275 100644 --- a/.github/workflows/skill-update-roundtrip.yml +++ b/.github/workflows/skill-update-roundtrip.yml @@ -45,7 +45,9 @@ jobs: steps: - uses: actions/checkout@v6 with: + # Historical skill snapshots need tags, but only their blobs are read. fetch-depth: 0 + filter: blob:none persist-credentials: false - uses: actions/setup-node@v6 with: diff --git a/.github/workflows/terminal-ime-e2e.yml b/.github/workflows/terminal-ime-e2e.yml index b9957b2daa9..1ab905d8783 100644 --- a/.github/workflows/terminal-ime-e2e.yml +++ b/.github/workflows/terminal-ime-e2e.yml @@ -38,23 +38,9 @@ jobs: xfwm4 xvfb - - name: Setup Node.js - uses: actions/setup-node@v6 + - uses: ./.github/actions/install-node-dependencies with: - node-version-file: package.json - - - name: Setup pnpm - uses: pnpm/setup@v2 - with: - install: false - - - name: Use external node-gyp to avoid pnpm bundled copy - run: | - npm install -g node-gyp@11.5.0 - echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV" - - - name: Install dependencies - run: pnpm install --frozen-lockfile + native-runtime: electron - name: Build Electron app for E2E run: pnpm exec electron-vite build --mode e2e diff --git a/.github/workflows/terminal-perf.yml b/.github/workflows/terminal-perf.yml index 38d0a25bbb7..72a0fec8992 100644 --- a/.github/workflows/terminal-perf.yml +++ b/.github/workflows/terminal-perf.yml @@ -67,16 +67,17 @@ jobs: - name: Install native build tools and xvfb run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb zsh - - name: Setup Node.js - uses: actions/setup-node@v6 - with: - node-version-file: package.json - - name: Setup pnpm uses: pnpm/setup@v2 with: install: false + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version-file: package.json + cache: pnpm + # Why: this scheduled/manual workflow uses the same native install path as # PR and E2E CI, which needs pnpm to bypass its bundled gyp_main.py. - name: Use external node-gyp to avoid pnpm's bundled copy diff --git a/.github/workflows/windows-signing-rehearsal.yml b/.github/workflows/windows-signing-rehearsal.yml index 54b751908dc..6fc6fab7193 100644 --- a/.github/workflows/windows-signing-rehearsal.yml +++ b/.github/workflows/windows-signing-rehearsal.yml @@ -215,6 +215,7 @@ jobs: with: name: orca-windows-installer-unsigned-${{ github.run_id }} path: dist/orca-windows-setup.exe + compression-level: 0 if-no-files-found: error - name: Submit Windows installer signing request diff --git a/.gitignore b/.gitignore index 8be3fc5b6f4..08be52f0751 100644 --- a/.gitignore +++ b/.gitignore @@ -110,6 +110,7 @@ docs/** !docs/reference/macos-press-and-hold.md !docs/reference/orcad-operations.md !docs/reference/relay-grace-time-reconfiguration.md +!docs/reference/windows-daemon-host-relocation.md !docs/reference/windows-edr-posture.md !docs/reference/windows-process-enumeration.md !docs/reference/wsl-runner-verification.md diff --git a/AGENTS.md b/AGENTS.md index 8b0156ba6b1..491d270b815 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,6 +4,12 @@ All UI work — layout, color, typography, spacing, component selection, UX beha ## Electron UI Validation +Always run tests and agent-launched apps in the background with `ORCA_BACKGROUND_LAUNCH=1`. +Never steal monitor focus or reveal test windows: no `show()`, `showInactive()`, `bringToFront()`, +`app.focus()`, or OS activation. Use CDP screenshots of hidden renderers. Keep native-focus and +visible-window tests paused on the user's desktop; run them on an isolated display or CI. +Rebuild modified launch-policy code before running an app; stale build wrappers are not safe. + Use the `$electron` skill and Playwright CDP for rendered Orca UI checks. Do not use computer-use for Orca UI validation. # Style @@ -49,6 +55,7 @@ Orca targets macOS, Linux, and Windows. Keep all platform-dependent behavior beh - **Windows setup scripts**: the setup/issue-command runner is a `.cmd` batch file unless the script starts with a `#!` line — never derive that from the user's terminal-shell preference, and never launch a `.cmd` runner with a bare `cmd.exe /c` from a Git Bash pane (MSYS rewrites the `/c`). See [`docs/reference/windows-setup-shell.md`](./docs/reference/windows-setup-shell.md). - **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import. - **Windows process enumeration**: read the table through `src/main/windows/windows-process-table.ts`, never by forking `powershell.exe`. See [`docs/reference/windows-process-enumeration.md`](./docs/reference/windows-process-enumeration.md). +- **Windows daemon-host relocation**: the terminal daemon runs from a copy of the app runtime under `%LOCALAPPDATA%`, which is what survives an auto-update. Before touching that copy, its exe name, or the NSIS uninstall macro, read [`docs/reference/windows-daemon-host-relocation.md`](./docs/reference/windows-daemon-host-relocation.md). - **Windows EDR signal**: don't add `-ExecutionPolicy Bypass`, `-EncodedCommand`, `cmd.exe /c` with escaped free text, per-operation interpreter spawning, or runtime `Add-Type` compilation without reading [`docs/reference/windows-edr-posture.md`](./docs/reference/windows-edr-posture.md) first — behavioural EDR scores each of those, and being signed does not clear them. - **WSL commands**: build argv with `buildWslExecArgs` (always `--exec` — under `--`, `wsl.exe` expands `$name` in every argument and silently rewrites the script), and fence anything whose stdout you parse with `buildWslCapturedLoginShellCommand`, because the interactive login shell prints the distro banner to stdout. See [`docs/reference/wsl-command-execution.md`](./docs/reference/wsl-command-execution.md). - **Linux native modules**: keep the glibc floor at Ubuntu 20.04 / glibc 2.31. A module compiled from source on a newer runner can reference symbol versions absent on the floor and crash the app on startup. See [`docs/reference/linux-glibc-compatibility.md`](./docs/reference/linux-glibc-compatibility.md); packaging fails if a bundled native binary needs newer glibc. diff --git a/config/nsis/orca-installer-hooks.nsh b/config/nsis/orca-installer-hooks.nsh index ca80c99fc6d..d89439073ab 100644 --- a/config/nsis/orca-installer-hooks.nsh +++ b/config/nsis/orca-installer-hooks.nsh @@ -49,22 +49,48 @@ ; --------------------------------------------------------------------------- ; Clean up the relocated terminal daemon on a REAL uninstall. ; -; Why: the daemon host is deliberately copied to a distinct image name -; (orca-terminal-daemon.exe) under %LOCALAPPDATA%\Orca\daemon-host so that app -; UPDATES cannot kill it — that relocation is what keeps terminals alive across -; updates. The same design means a normal uninstall's process sweep and file -; removal both miss it, leaving an orphaned daemon plus its runtime copy behind. +; Why: the daemon host is deliberately copied OUT of the install dir into +; %LOCALAPPDATA%\Orca\daemon-host so that app UPDATES cannot kill it — +; electron-builder's kill sweep selects processes whose image path is under +; $INSTDIR, and that relocation is what keeps terminals alive across updates. +; The same design means a normal uninstall's process sweep and file removal both +; miss it, leaving an orphaned daemon plus its runtime copy behind. ; ; The ${isUpdated} guard is essential: electron-builder runs this uninstaller as ; part of uninstallOldVersion on EVERY update, and killing the daemon there would ; defeat the whole feature. Only clean up on a genuine uninstall. ; -; The image name and the LOCALAPPDATA folder name must stay in sync with -; DAEMON_HOST_EXE_NAME and LOCAL_HOST_ROOT_NAME in -; src/main/daemon/daemon-host-relocation.ts. +; The LOCALAPPDATA folder name must stay in sync with LOCAL_HOST_ROOT_NAME in +; src/main/daemon/daemon-host-relocation.ts. See +; docs/reference/windows-daemon-host-relocation.md. !macro customUnInstall ${ifNot} ${isUpdated} - nsExec::Exec 'taskkill /F /IM orca-terminal-daemon.exe' + Push $0 + Push $1 + Push $2 + ; The host exe is a verbatim copy of the app exe, so the app's own image name + ; reaches it; the second name covers hosts left by builds that renamed the copy. + ; Filtered to the current user like upstream's per-user KILL_PROCESS, so an + ; elevated machine-wide uninstall cannot reach another logged-on user's session. + ; NSIS expands USERNAME itself: routing through cmd.exe only to get %USERNAME% + ; would add two interpreter spawns to the uninstall path for nothing. + ReadEnvStr $1 USERNAME + ${if} $1 == "" + ; Measured: taskkill rejects an empty filter value outright ("The search filter + ; cannot be recognized") and kills nothing, so with no USERNAME to scope by, + ; kill unfiltered rather than not at all. USERNAME is set in every session an + ; uninstaller runs in, so this is a backstop, not the expected path. + StrCpy $2 "" + ${else} + StrCpy $2 '/FI "USERNAME eq $1"' + ${endIf} + nsExec::Exec 'taskkill /F /IM "${APP_EXECUTABLE_FILENAME}" $2' + Pop $0 + nsExec::Exec 'taskkill /F /IM "orca-terminal-daemon.exe" $2' + Pop $0 + Pop $2 + Pop $1 + Pop $0 ; Give the OS a moment to release the image lock before removing the tree. Sleep 500 RMDir /r "$LOCALAPPDATA\Orca\daemon-host" diff --git a/config/patches/@vscode__windows-process-tree@0.8.0.patch b/config/patches/@vscode__windows-process-tree@0.8.0.patch index 10780f5288a..fe5e4be44b1 100644 --- a/config/patches/@vscode__windows-process-tree@0.8.0.patch +++ b/config/patches/@vscode__windows-process-tree@0.8.0.patch @@ -27,15 +27,424 @@ index 855bd4b86f0a3c18c7594212c0e42b6e35bc4001..33774e7ae296f0de39dd94156673c9e7 "/guard:cf", "/sdl", diff --git a/src/process.cc b/src/process.cc -index 3eea92077c4d1d433119361d5c432881859131e9..1998f4addd4d7e9aba946ea6f7f7a4a5d13291bc 100644 +index 3eea92077c4d1d433119361d5c432881859131e9..738775f6fcdfb676054386fe34c0380327ed1863 100644 --- a/src/process.cc +++ b/src/process.cc -@@ -37,7 +37,7 @@ uint32_t GetRawProcessList(std::vector& process_info, - process_info.push_back(std::move(pinfo)); - process_count++; - } +@@ -1,108 +1,112 @@ +-/*--------------------------------------------------------------------------------------------- +- * Copyright (c) Microsoft Corporation. All rights reserved. +- * Licensed under the MIT License. See License.txt in the project root for license information. +- *--------------------------------------------------------------------------------------------*/ +- +-#include "process.h" +-#include "process_commandline.h" +- +-#include +-#include +-#include +- +-uint32_t GetRawProcessList(std::vector& process_info, +- DWORD process_data_flags) { +- // Fetch the PID and PPIDs +- PROCESSENTRY32 process_entry = { 0 }; +- DWORD parent_pid = 0; +- uint32_t process_count = 0; +- HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); +- process_entry.dwSize = sizeof(PROCESSENTRY32); +- if (Process32First(snapshot_handle, &process_entry)) { +- do { +- if (process_entry.th32ProcessID != 0) { +- ProcessInfo pinfo; +- pinfo.pid = process_entry.th32ProcessID; +- pinfo.ppid = process_entry.th32ParentProcessID; +- +- if (MEMORY & process_data_flags) { +- GetProcessMemoryUsage(pinfo); +- } +- +- if (COMMANDLINE & process_data_flags) { +- GetProcessCommandLine(pinfo); +- } +- +- strcpy(pinfo.name, process_entry.szExeFile); +- process_info.push_back(std::move(pinfo)); +- process_count++; +- } - } while (process_count < 1024 && Process32Next(snapshot_handle, &process_entry)); +- } +- +- CloseHandle(snapshot_handle); +- return process_count; +-} +- +-void GetProcessMemoryUsage(ProcessInfo& process_info) { +- DWORD pid = process_info.pid; +- HANDLE hProcess; +- PROCESS_MEMORY_COUNTERS pmc; +- +- hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid); +- +- if (hProcess == NULL) { +- return; +- } +- +- if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) { +- process_info.memory = (DWORD)pmc.WorkingSetSize; +- } +- +- CloseHandle(hProcess); +-} +- +-// Per documentation, it is not recommended to add or subtract values from the FILETIME +-// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows. +-// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead. +-// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx +-ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) { +- ULARGE_INTEGER kt, ut; +- kt.LowPart = (*kernelTime).dwLowDateTime; +- kt.HighPart = (*kernelTime).dwHighDateTime; +- +- ut.LowPart = (*userTime).dwLowDateTime; +- ut.HighPart = (*userTime).dwHighDateTime; +- +- return kt.QuadPart + ut.QuadPart; +-} +- +-void GetCpuUsage(Cpu& cpu_info, bool first_pass) { +- DWORD pid = cpu_info.pid; +- HANDLE hProcess; +- +- hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid); +- +- if (hProcess == NULL) { +- return; +- } +- +- FILETIME creationTime, exitTime, kernelTime, userTime; +- FILETIME sysIdleTime, sysKernelTime, sysUserTime; +- if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime) +- && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) { +- if (first_pass) { +- cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime); +- cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime); +- } else { +- ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime); +- ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime); +- +- cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime); +- } +- } else { +- cpu_info.cpu = std::numeric_limits::quiet_NaN(); +- } +- +- CloseHandle(hProcess); ++/*--------------------------------------------------------------------------------------------- ++ * Copyright (c) Microsoft Corporation. All rights reserved. ++ * Licensed under the MIT License. See License.txt in the project root for license information. ++ *--------------------------------------------------------------------------------------------*/ ++ ++#include "process.h" ++#include "process_commandline.h" ++ ++#include ++#include ++#include ++ ++uint32_t GetRawProcessList(std::vector& process_info, ++ DWORD process_data_flags) { ++ // Fetch the PID and PPIDs ++ PROCESSENTRY32 process_entry = { 0 }; ++ DWORD parent_pid = 0; ++ uint32_t process_count = 0; ++ HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); ++ process_entry.dwSize = sizeof(PROCESSENTRY32); ++ if (Process32First(snapshot_handle, &process_entry)) { ++ do { ++ if (process_entry.th32ProcessID != 0) { ++ // Value-initialize: `memory` is otherwise stack garbage when the flag is unset. ++ ProcessInfo pinfo{}; ++ pinfo.pid = process_entry.th32ProcessID; ++ pinfo.ppid = process_entry.th32ParentProcessID; ++ ++ if (MEMORY & process_data_flags) { ++ GetProcessMemoryUsage(pinfo); ++ } ++ ++ if (COMMANDLINE & process_data_flags) { ++ GetProcessCommandLine(pinfo); ++ } ++ ++ strcpy(pinfo.name, process_entry.szExeFile); ++ process_info.push_back(std::move(pinfo)); ++ process_count++; ++ } + } while (Process32Next(snapshot_handle, &process_entry)); - } - - CloseHandle(snapshot_handle); ++ } ++ ++ CloseHandle(snapshot_handle); ++ return process_count; ++} ++ ++void GetProcessMemoryUsage(ProcessInfo& process_info) { ++ DWORD pid = process_info.pid; ++ HANDLE hProcess; ++ PROCESS_MEMORY_COUNTERS pmc; ++ ++ // PROCESS_VM_READ is never used here -- GetProcessMemoryInfo reads counters the ++ // kernel keeps, not the address space -- and acquiring it is what EDR scores. ++ hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid); ++ ++ if (hProcess == NULL) { ++ return; ++ } ++ ++ if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) { ++ process_info.memory = (DWORD)pmc.WorkingSetSize; ++ } ++ ++ CloseHandle(hProcess); ++} ++ ++// Per documentation, it is not recommended to add or subtract values from the FILETIME ++// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows. ++// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead. ++// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx ++ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) { ++ ULARGE_INTEGER kt, ut; ++ kt.LowPart = (*kernelTime).dwLowDateTime; ++ kt.HighPart = (*kernelTime).dwHighDateTime; ++ ++ ut.LowPart = (*userTime).dwLowDateTime; ++ ut.HighPart = (*userTime).dwHighDateTime; ++ ++ return kt.QuadPart + ut.QuadPart; ++} ++ ++void GetCpuUsage(Cpu& cpu_info, bool first_pass) { ++ DWORD pid = cpu_info.pid; ++ HANDLE hProcess; ++ ++ // GetProcessTimes needs no more than PROCESS_QUERY_LIMITED_INFORMATION. ++ hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid); ++ ++ if (hProcess == NULL) { ++ return; ++ } ++ ++ FILETIME creationTime, exitTime, kernelTime, userTime; ++ FILETIME sysIdleTime, sysKernelTime, sysUserTime; ++ if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime) ++ && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) { ++ if (first_pass) { ++ cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime); ++ cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime); ++ } else { ++ ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime); ++ ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime); ++ ++ cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime); ++ } ++ } else { ++ cpu_info.cpu = std::numeric_limits::quiet_NaN(); ++ } ++ ++ CloseHandle(hProcess); + } +\ No newline at end of file +diff --git a/src/process_commandline.cc b/src/process_commandline.cc +index ea822b120e8038a4803e34647042f08f4aaf5ca1..25907c0bf542bed6c72b1b462b19bcf3210c3cfd 100644 +--- a/src/process_commandline.cc ++++ b/src/process_commandline.cc +@@ -1,67 +1,125 @@ +-/*--------------------------------------------------------------------------------------------- +- * Copyright (c) Microsoft Corporation. All rights reserved. +- * Licensed under the MIT License. See License.txt in the project root for license information. +- *--------------------------------------------------------------------------------------------*/ +- +-#include "process.h" +-#include "process_commandline.h" +-#include +-#include +-#include +- +-bool GetProcessCommandLine(ProcessInfo& process_info) { +- HINSTANCE ntdll = GetModuleHandleW(L"ntdll.dll"); +- if (!ntdll) { +- return false; +- } +- +- decltype(NtQueryInformationProcess)* nt_query_information_process = +- reinterpret_cast( +- GetProcAddress(ntdll, "NtQueryInformationProcess")); +- +- if (!nt_query_information_process) { +- return false; +- } +- +- PROCESS_BASIC_INFORMATION pbi{}; +- PEB peb = {NULL}; +- RTL_USER_PROCESS_PARAMETERS process_parameters = {NULL}; +- +- // Get process handle +- DWORD pid = process_info.pid; +- HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid); +- if (hProcess == INVALID_HANDLE_VALUE) { +- return false; +- } +- +- // Get Process Environment Block (PEB) +- NTSTATUS status = nt_query_information_process(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), nullptr); +- if (NT_SUCCESS(status) && pbi.PebBaseAddress) { +- // Read PEB +- if (ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), nullptr)) { +- // Read the processs parameters +- if (ReadProcessMemory(hProcess, peb.ProcessParameters, &process_parameters, sizeof(RTL_USER_PROCESS_PARAMETERS), nullptr)) { +- if (process_parameters.CommandLine.Length > 0) { +- std::wstring buffer; +- buffer.resize(process_parameters.CommandLine.Length / sizeof(wchar_t)); +- if (ReadProcessMemory(hProcess, process_parameters.CommandLine.Buffer, &buffer[0], process_parameters.CommandLine.Length, nullptr)) { +- int wide_length = static_cast(buffer.length()); +- int charcount = WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length, +- NULL, 0, NULL, NULL); +- if (charcount) { +- process_info.commandLine.resize(static_cast(charcount)); +- WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length, +- &process_info.commandLine[0], charcount, +- NULL, NULL); +- } +- CloseHandle(hProcess); +- return true; +- } +- } +- } +- } +- } +- +- CloseHandle(hProcess); +- return false; +-} ++/*--------------------------------------------------------------------------------------------- ++ * Copyright (c) Microsoft Corporation. All rights reserved. ++ * Licensed under the MIT License. See License.txt in the project root for license information. ++ *--------------------------------------------------------------------------------------------*/ ++ ++#include "process.h" ++#include "process_commandline.h" ++#include ++#include ++#include ++ ++namespace { ++ ++// Windows 8.1 and later hand back a process's command line as a UNICODE_STRING ++// the kernel builds, needing only PROCESS_QUERY_LIMITED_INFORMATION. ++// ++// There is deliberately no PEB fallback. Reading the command line out of the ++// target's address space -- opening it for VM reads and then chaining ++// memory reads across every pid on a timer -- is the credential-dumping ++// primitive this reader exists to not perform, so it is absent from the binary ++// rather than one anomalous NTSTATUS away. Electron's floor is Windows 10, so ++// every OS Orca supports has this class; if a hooked ntdll refuses it anyway, ++// the command line comes back empty, which callers already handle, instead of ++// silently reinstating the primitive on exactly the instrumented machines this ++// reader was written for. ++const ULONG kProcessCommandLineInformation = 60; ++ ++const NTSTATUS kStatusInfoLengthMismatch = static_cast(0xC0000004L); ++const NTSTATUS kStatusBufferTooSmall = static_cast(0xC0000023L); ++ ++// A command line is a UNICODE_STRING, whose Length is a USHORT, so the kernel ++// can never need more than the header plus 64 KiB. Refusing anything larger ++// keeps a bogus size from throwing bad_alloc out of a scan that has already ++// walked most of the table. ++const ULONG kMaxCommandLineBytes = sizeof(UNICODE_STRING) + 0xFFFF + sizeof(wchar_t); ++ ++// winternl.h's PROCESSINFOCLASS does not name class 60 and its enumerator range ++// stops far short of it, so the class travels as a ULONG rather than a cast enum. ++typedef NTSTATUS(NTAPI* NtQueryInformationProcessFn)(HANDLE, ULONG, PVOID, ULONG, PULONG); ++ ++// ntdll ships no import library for this entry point; it has to be resolved. ++NtQueryInformationProcessFn ResolveNtQueryInformationProcess() { ++ HMODULE ntdll = GetModuleHandleW(L"ntdll.dll"); ++ if (!ntdll) { ++ return nullptr; ++ } ++ return reinterpret_cast( ++ GetProcAddress(ntdll, "NtQueryInformationProcess")); ++} ++ ++NtQueryInformationProcessFn NtQueryInformationProcessEntry() { ++ static NtQueryInformationProcessFn entry = ResolveNtQueryInformationProcess(); ++ return entry; ++} ++ ++bool StoreCommandLineUtf8(ProcessInfo& process_info, const wchar_t* data, size_t wide_length) { ++ if (wide_length == 0) { ++ return false; ++ } ++ int length = static_cast(wide_length); ++ int charcount = WideCharToMultiByte(CP_UTF8, 0, data, length, NULL, 0, NULL, NULL); ++ if (!charcount) { ++ return false; ++ } ++ process_info.commandLine.resize(static_cast(charcount)); ++ WideCharToMultiByte(CP_UTF8, 0, data, length, &process_info.commandLine[0], charcount, NULL, ++ NULL); ++ return true; ++} ++ ++} // namespace ++ ++bool GetProcessCommandLine(ProcessInfo& process_info) { ++ NtQueryInformationProcessFn query = NtQueryInformationProcessEntry(); ++ if (!query) { ++ return false; ++ } ++ ++ HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, process_info.pid); ++ if (process == NULL) { ++ return false; ++ } ++ ++ ULONG size = 0; ++ NTSTATUS status = query(process, kProcessCommandLineInformation, nullptr, 0, &size); ++ if (NT_SUCCESS(status)) { ++ // Nothing was written, so there is no command line to read. ++ CloseHandle(process); ++ return false; ++ } ++ if (status != kStatusInfoLengthMismatch && status != kStatusBufferTooSmall) { ++ CloseHandle(process); ++ return false; ++ } ++ if (size < sizeof(UNICODE_STRING) || size > kMaxCommandLineBytes) { ++ CloseHandle(process); ++ return false; ++ } ++ ++ std::vector buffer(size); ++ status = query(process, kProcessCommandLineInformation, &buffer[0], size, &size); ++ CloseHandle(process); ++ if (!NT_SUCCESS(status)) { ++ return false; ++ } ++ ++ // Header and characters arrive in one allocation, but treat the header as ++ // untrusted: a hooked ntdll is the case this reader is written for, and an ++ // unchecked Buffer/Length here would be an over-read encoded straight into JS. ++ // Bound against buffer.size(), never `size` -- the second query overwrote it. ++ const UNICODE_STRING* command_line = reinterpret_cast(&buffer[0]); ++ const unsigned char* begin = &buffer[0]; ++ const unsigned char* end = begin + buffer.size(); ++ const unsigned char* chars = reinterpret_cast(command_line->Buffer); ++ if (chars == nullptr || chars < begin + sizeof(UNICODE_STRING) || chars > end || ++ command_line->Length > static_cast(end - chars)) { ++ return false; ++ } ++ ++ // True only when a command line was actually stored, so "empty" and "not ++ // recovered" stay the same answer they were before this reader replaced the ++ // PEB read. `src/process.cc` discards the result either way. ++ return StoreCommandLineUtf8(process_info, command_line->Buffer, ++ command_line->Length / sizeof(wchar_t)); ++} diff --git a/config/scripts/benchmark-browser-tunnel-framing.mjs b/config/scripts/benchmark-browser-tunnel-framing.mjs new file mode 100644 index 00000000000..e91fd0887f6 --- /dev/null +++ b/config/scripts/benchmark-browser-tunnel-framing.mjs @@ -0,0 +1,110 @@ +import assert from 'node:assert/strict' +import { execFileSync } from 'node:child_process' +import { readFileSync } from 'node:fs' +import { stripTypeScriptTypes } from 'node:module' +import { performance } from 'node:perf_hooks' + +// Run from the worktree root: node config/scripts/benchmark-browser-tunnel-framing.mjs [base-ref] +const path = 'src/shared/browser-network-tunnel-stream-framing.ts' +const baselineRef = process.argv[2] ?? 'HEAD' +const beforeSource = execFileSync('git', ['show', `${baselineRef}:${path}`], { + encoding: 'utf8' +}) +const afterSource = readFileSync(path, 'utf8') +const load = (source) => + import( + `data:text/javascript;base64,${Buffer.from( + stripTypeScriptTypes(source, { mode: 'transform' }) + ).toString('base64')}` + ) +const before = await load(beforeSource) +const after = await load(afterSource) + +function measure(module, chunks, payload, repetitions) { + let frameCount = 0 + let lastFrame + const onFrame = (frame) => { + frameCount++ + lastFrame = frame + } + const onError = (error) => { + throw error + } + const run = () => { + const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError) + for (const chunk of chunks) { + decoder.feed(chunk) + } + } + run() + assert.deepEqual(lastFrame, payload) + const samples = [] + for (let sample = 0; sample < 5; sample++) { + const start = performance.now() + for (let iteration = 0; iteration < repetitions; iteration++) { + run() + } + samples.push((performance.now() - start) / repetitions) + } + assert.equal(frameCount, 1 + 5 * repetitions) + return samples.sort((a, b) => a - b)[2] +} + +function countCopies(module, chunks) { + const originalSet = Uint8Array.prototype.set + const originalSlice = Uint8Array.prototype.slice + let copied = 0 + Uint8Array.prototype.set = function (source, offset) { + copied += source.length + return originalSet.call(this, source, offset) + } + Uint8Array.prototype.slice = function (...args) { + const result = originalSlice.apply(this, args) + copied += result.length + return result + } + try { + const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder( + () => {}, + (error) => { + throw error + } + ) + for (const chunk of chunks) { + decoder.feed(chunk) + } + } finally { + Uint8Array.prototype.set = originalSet + Uint8Array.prototype.slice = originalSlice + } + return copied +} + +const rows = [] +for (const [payloadBytes, chunkBytes, repetitions] of [ + [1, 5, 10000], + [64 * 1024, 65540, 1000], + [64 * 1024, 4096, 100], + [64 * 1024, 256, 25], + [64 * 1024, 16, 5], + [64 * 1024, 1, 1] +]) { + const payload = Uint8Array.from({ length: payloadBytes }, (_, index) => index % 251) + const encoded = before.encodeBrowserNetworkTunnelStreamFrame(payload) + const chunks = [] + for (let offset = 0; offset < encoded.length; offset += chunkBytes) { + chunks.push(encoded.subarray(offset, offset + chunkBytes)) + } + const beforeMs = measure(before, chunks, payload, repetitions) + const afterMs = measure(after, chunks, payload, repetitions) + rows.push({ + payloadBytes, + chunkBytes, + beforeMs: +beforeMs.toFixed(6), + afterMs: +afterMs.toFixed(6), + speedup: +(beforeMs / afterMs).toFixed(2), + beforeCopiedBytes: countCopies(before, chunks), + afterCopiedBytes: countCopies(after, chunks) + }) +} +console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2)) diff --git a/config/scripts/benchmark-cli-error-imports.mjs b/config/scripts/benchmark-cli-error-imports.mjs new file mode 100644 index 00000000000..a4648f84aec --- /dev/null +++ b/config/scripts/benchmark-cli-error-imports.mjs @@ -0,0 +1,121 @@ +import assert from 'node:assert/strict' +import { createRequire } from 'node:module' +import { existsSync, realpathSync } from 'node:fs' +import { delimiter, join, resolve } from 'node:path' + +// Emit each revision with tsc -p config/tsconfig.cli.json --outDir --composite false --incremental false. +// Run: node config/scripts/benchmark-cli-error-imports.mjs +const [beforeDir, afterDir] = process.argv.slice(2) +assert.ok(beforeDir && afterDir, 'Pass distinct before and after TypeScript output directories.') +assert.notEqual( + realpathSync(beforeDir), + realpathSync(afterDir), + 'Do not compare a build to itself.' +) +const entries = { + before: join(resolve(beforeDir), 'cli', 'index.js'), + after: join(resolve(afterDir), 'cli', 'index.js') +} +for (const entry of Object.values(entries)) { + assert.ok(existsSync(entry), `Missing emitted CLI: ${entry}`) +} + +const { runProcessSync } = createRequire(import.meta.url)( + join(resolve(afterDir), 'shared', 'child-process', 'run-process.js') +) + +const child = String.raw` + const { performance } = require('node:perf_hooks') + const { writeSync } = require('node:fs') + const { createHash } = require('node:crypto') + const { basename } = require('node:path') + let stdout = '', stderr = '' + process.stdout.write = (text) => { stdout += text; return true } + process.stderr.write = (text) => { stderr += text; return true } + const started = performance.now() + const cli = require(process.argv[1]) + const importMs = performance.now() - started + cli.main(JSON.parse(process.argv[2])).then(() => { + const totalMs = performance.now() - started + const modules = Object.keys(require.cache) + writeSync(1, JSON.stringify({ + importMs, totalMs, modules: modules.length, + featureFormatters: modules.filter((file) => ['browser', 'terminal', 'project', 'automation', 'workspace', 'computer'].some((name) => basename(file) === name + '-format.js')), + stdout: createHash('sha256').update(stdout).digest('hex'), + stderr: createHash('sha256').update(stderr).digest('hex'), + exitCode: process.exitCode || 0 + })) + process.exitCode = 0 + }).catch((error) => { writeSync(2, String(error)); process.exitCode = 1 }) +` +const cases = [ + ['--help'], + ['help', 'terminal', 'read'], + ['does-not-exist'], + ['computer', 'click', '--does-not-exist'], + ['does-not-exist', '--json'] +] +const median = (values) => [...values].sort((a, b) => a - b)[Math.floor(values.length / 2)] +const summarize = (samples) => ({ + importMs: median(samples.map((sample) => sample.importMs)), + totalMs: median(samples.map((sample) => sample.totalMs)), + modules: samples[0].modules +}) +const rows = [] +for (const args of cases) { + const samples = { before: [], after: [] } + let expected + for (let run = 0; run < 22; run++) { + for (const variant of run % 2 ? ['after', 'before'] : ['before', 'after']) { + const result = runProcessSync({ + program: process.execPath, + args: ['-e', child, entries[variant], JSON.stringify(args)], + timeoutMs: 30_000, + env: { + ...process.env, + NODE_PATH: [resolve('node_modules'), process.env.NODE_PATH] + .filter(Boolean) + .join(delimiter) + } + }) + assert.equal(result.timedOut, false, 'CLI child timed out.') + assert.equal(result.code, 0, result.stderr) + const sample = JSON.parse(result.stdout) + const output = { stdout: sample.stdout, stderr: sample.stderr, exitCode: sample.exitCode } + expected ??= output + assert.deepEqual(output, expected, `${variant} output changed for ${args.join(' ')}`) + if (variant === 'after') { + assert.deepEqual( + sample.featureFormatters, + [], + 'Help and syntax errors must skip feature formatters.' + ) + } + if (run >= 2) { + samples[variant].push(sample) + } + } + } + assert.ok(samples.after[0].modules < samples.before[0].modules, 'Expected fewer loaded modules.') + rows.push({ + args, + before: summarize(samples.before), + after: summarize(samples.after), + output: expected, + samples + }) +} +console.log( + JSON.stringify( + { + node: process.version, + platform: process.platform, + measurement: + 'Fresh-process import + main; excludes process creation; warmed filesystem; 2 warmups and 20 samples per variant, alternating order.', + entries, + rows + }, + null, + 2 + ) +) diff --git a/config/scripts/benchmark-cli-response-framing.mjs b/config/scripts/benchmark-cli-response-framing.mjs new file mode 100644 index 00000000000..40aab8d08f7 --- /dev/null +++ b/config/scripts/benchmark-cli-response-framing.mjs @@ -0,0 +1,128 @@ +import assert from 'node:assert/strict' +import { execFileSync } from 'node:child_process' +import { EventEmitter } from 'node:events' +import { readFileSync } from 'node:fs' +import Module from 'node:module' +import { dirname, resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +// Run from the worktree root: node config/scripts/benchmark-cli-response-framing.mjs +const sourcePath = 'src/cli/runtime/transport.ts' +const baselineRef = process.argv[2] +assert.ok(baselineRef, 'Pass the pre-change transport revision as base-ref.') +const beforeSource = execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], { + encoding: 'utf8' +}) +let chunks = [] + +async function loadTransport(source) { + const built = await build({ + stdin: { contents: source, loader: 'ts', resolveDir: dirname(resolve(sourcePath)) }, + bundle: true, + platform: 'node', + format: 'cjs', + write: false, + logLevel: 'silent' + }) + const module = new Module(resolve(sourcePath)) + const originalRequire = module.require.bind(module) + module.require = (name) => { + if (name === 'node:crypto') { + return { randomUUID: () => 'benchmark-request' } + } + if (name !== 'node:net') { + return originalRequire(name) + } + return { + createConnection() { + const socket = new EventEmitter() + socket.setEncoding = () => {} + socket.end = () => {} + socket.destroy = () => {} + socket.write = () => { + for (const chunk of chunks) { + socket.emit('data', chunk) + } + } + queueMicrotask(() => socket.emit('connect')) + return socket + } + } + } + module._compile(built.outputFiles[0].text, resolve(sourcePath)) + return module.exports.sendRequest +} + +const before = await loadTransport(beforeSource) +const after = await loadTransport(readFileSync(sourcePath, 'utf8')) +const metadata = { + runtimeId: 'benchmark-runtime', + authToken: 'benchmark-token', + transports: [{ kind: 'unix', endpoint: 'injected-socket' }] +} +const run = (sendRequest) => sendRequest(metadata, 'terminal.read', {}, 30000) + +async function measure(sendRequest, payloadBytes, repetitions) { + const warmup = await run(sendRequest) + assert.equal(warmup.result.data.length, payloadBytes) + const samples = [] + for (let sample = 0; sample < 5; sample++) { + const start = performance.now() + for (let iteration = 0; iteration < repetitions; iteration++) { + await run(sendRequest) + } + samples.push((performance.now() - start) / repetitions) + } + return samples.sort((a, b) => a - b)[2] +} + +async function searchedCharacters(sendRequest) { + const original = String.prototype.indexOf + let searched = 0 + String.prototype.indexOf = function (needle, position) { + if (needle === '\n') { + searched += this.length - (position ?? 0) + } + return original.call(this, needle, position) + } + try { + await run(sendRequest) + } finally { + String.prototype.indexOf = original + } + return searched +} + +const rows = [] +for (const [payloadBytes, chunkChars, repetitions] of [ + [32, 65536, 1000], + [1024 * 1024, 2 * 1024 * 1024, 20], + [1024 * 1024, 65536, 10], + [1024 * 1024, 4096, 5], + [4 * 1024 * 1024, 4096, 2], + [4 * 1024 * 1024, 256, 1] +]) { + const line = `${JSON.stringify({ + id: 'benchmark-request', + ok: true, + result: { data: 'x'.repeat(payloadBytes) }, + _meta: { runtimeId: 'benchmark-runtime' } + })}\n` + chunks = [] + for (let offset = 0; offset < line.length; offset += chunkChars) { + chunks.push(line.slice(offset, offset + chunkChars)) + } + const beforeMs = await measure(before, payloadBytes, repetitions) + const afterMs = await measure(after, payloadBytes, repetitions) + rows.push({ + payloadBytes, + chunkChars, + beforeMs: +beforeMs.toFixed(6), + afterMs: +afterMs.toFixed(6), + speedup: +(beforeMs / afterMs).toFixed(2), + beforeSearchedCharacters: await searchedCharacters(before), + afterSearchedCharacters: await searchedCharacters(after) + }) +} +console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2)) diff --git a/config/scripts/benchmark-explorer-dotfile-filter.mjs b/config/scripts/benchmark-explorer-dotfile-filter.mjs new file mode 100644 index 00000000000..e66a0ceb5af --- /dev/null +++ b/config/scripts/benchmark-explorer-dotfile-filter.mjs @@ -0,0 +1,165 @@ +import assert from 'node:assert/strict' +import { readFileSync } from 'node:fs' +import Module from 'node:module' +import { resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +// Pass the pre-change file-explorer-entries.ts snapshot as the only argument. +const baselinePath = process.argv[2] +assert.ok(baselinePath, 'Pass a pre-change file-explorer-entries.ts snapshot.') +const entry = 'src/renderer/src/components/right-sidebar/file-explorer-entries.ts' +const baseline = readFileSync(baselinePath, 'utf8') +assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.') + +async function load(useBaseline) { + const result = await build({ + stdin: { + contents: `export { isDotfileRelativePath } from './${entry}'; +export { createNameFilteredFileExplorerProjection } from './src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts';`, + resolveDir: process.cwd(), + loader: 'ts' + }, + bundle: true, + platform: 'node', + format: 'cjs', + write: false, + logLevel: 'silent', + alias: { '@': resolve('src/renderer/src') }, + plugins: useBaseline + ? [ + { + name: 'baseline-dotfile-predicate', + setup(builder) { + builder.onLoad({ filter: /file-explorer-entries\.ts$/ }, () => ({ + contents: baseline, + loader: 'ts' + })) + } + } + ] + : [] + }) + const module = new Module(resolve('dotfile-benchmark.cjs')) + module.paths = Module._nodeModulePaths(process.cwd()) + module._compile(result.outputFiles[0].text, module.id) + return module.exports +} + +const versions = [await load(true), await load(false)] +let parityCases = 0 +function check(path, depth) { + assert.equal( + versions[0].isDotfileRelativePath(path), + versions[1].isDotfileRelativePath(path), + path + ) + parityCases++ + if (depth > 0) { + for (const character of ['.', '/', '\\', 'a', '\n']) { + check(path + character, depth - 1) + } + } +} +check('', 8) + +function measure(functions, iterations = 1) { + let sink = 0 + const run = (fn) => { + for (let i = 0; i < iterations; i++) { + sink += Number(fn()) + } + } + for (const fn of functions) { + for (let warmup = 0; warmup < 3; warmup++) { + run(fn) + } + } + const samples = [[], []] + for (let round = 0; round < 11; round++) { + for (const variant of round % 2 ? [1, 0] : [0, 1]) { + const start = performance.now() + run(functions[variant]) + samples[variant].push(performance.now() - start) + } + } + return { + beforeMs: samples[0].sort((a, b) => a - b)[5], + afterMs: samples[1].sort((a, b) => a - b)[5], + iterations, + sink + } +} + +const predicates = [] +for (const path of [ + 'a', + '.env', + 'packages/pkg/src/file.tsx', + `a${'.'.repeat(254)}`, + `${'/'.repeat(4096)}.`, + `${'../'.repeat(1000)}file.ts`, + '😀/.你好', + '\n/.\n' +]) { + check(path, 0) + predicates.push({ + pathLength: path.length, + prefix: path.slice(0, 40), + ...measure( + versions.map((version) => () => version.isDotfileRelativePath(path)), + 10_000 + ) + }) +} + +const projections = [] +for (const count of [1000, 10_000, 100_000]) { + for (const query of ['nonmatching-needle', 'file-42']) { + const args = { + ignoredSet: new Set(['unrelated']), + nameFilter: { + query, + relativePaths: Array.from( + { length: count }, + (_, i) => `packages/package-${i % 50}/src/components/section-${i % 10}/file-${i}.tsx` + ) + }, + showDotfiles: false, + showGitIgnoredFiles: false, + worktreePath: '/workspace' + } + const functions = versions.map( + (version) => () => version.createNameFilteredFileExplorerProjection(args) + ) + const rows = functions.map((fn) => { + const projection = fn() + return Array.from({ length: projection.getVisibleCount() }, (_, i) => + projection.getRowAtIndex(i) + ) + }) + assert.deepEqual(rows[0], rows[1]) + projections.push({ + count, + query, + visibleRows: rows[0].length, + ...measure(functions.map((fn) => () => fn().getVisibleCount())) + }) + } +} +console.log( + JSON.stringify( + { + node: process.version, + platform: process.platform, + baselinePath: resolve(baselinePath), + parityCases, + samples: 11, + warmups: 3, + predicates, + projections + }, + null, + 2 + ) +) diff --git a/config/scripts/benchmark-sentinel-retention.mjs b/config/scripts/benchmark-sentinel-retention.mjs new file mode 100644 index 00000000000..93564eeac01 --- /dev/null +++ b/config/scripts/benchmark-sentinel-retention.mjs @@ -0,0 +1,72 @@ +import { strict as assert } from 'node:assert' +import { EventEmitter } from 'node:events' +import { mkdtemp, rm } from 'node:fs/promises' +import { createRequire } from 'node:module' +import { tmpdir } from 'node:os' +import { join, resolve } from 'node:path' +import { build } from 'esbuild' + +if (!global.gc) { + throw new Error('Run with node --expose-gc') +} +const root = resolve(import.meta.dirname, '../..') +const directory = await mkdtemp(join(tmpdir(), 'orca-sentinel-retention-')) +const output = join(directory, 'sentinel.cjs') +try { + await build({ + stdin: { + contents: `export {waitForSentinel} from './src/main/ssh/ssh-relay-deploy-helpers'; +export {RELAY_SENTINEL} from './src/main/ssh/relay-protocol';`, + resolveDir: root, + loader: 'ts' + }, + bundle: true, + platform: 'node', + format: 'cjs', + packages: 'external', + banner: { + js: `var require = require('node:module').createRequire(${JSON.stringify(join(root, 'package.json'))});` + }, + outfile: output + }) + const { waitForSentinel, RELAY_SENTINEL } = createRequire(import.meta.url)(output) + const held = [] + const banners = [] + for (let i = 0; i < 100; i++) { + const channel = Object.assign(new EventEmitter(), { + stderr: new EventEmitter(), + stdin: { write: () => true }, + close: () => {} + }) + const pending = waitForSentinel(channel) + banners.push(feedBanner(channel)) + channel.emit('data', Buffer.from(RELAY_SENTINEL)) + const transport = await pending + const received = [] + transport.onData((bytes) => received.push(bytes.toString())) + channel.emit('data', Buffer.from('frame')) + assert.deepEqual(received, ['frame']) + held.push({ channel, transport }) + } + await new Promise((resolve) => setImmediate(resolve)) + for (let i = 0; i < 5; i++) { + global.gc() + } + const retained = banners.filter((reference) => reference.deref() !== undefined).length + console.log( + JSON.stringify({ + connections: held.length, + bannerBytes: 65536, + retainedBannerBuffers: retained, + retainedBannerBytes: retained * 65536 + }) + ) +} finally { + await rm(directory, { recursive: true, force: true }) +} + +function feedBanner(channel) { + const banner = Buffer.alloc(65536, 120) + channel.emit('data', banner) + return new WeakRef(banner.buffer) +} diff --git a/config/scripts/benchmark-skill-depth.mjs b/config/scripts/benchmark-skill-depth.mjs new file mode 100644 index 00000000000..1ebb606f93c --- /dev/null +++ b/config/scripts/benchmark-skill-depth.mjs @@ -0,0 +1,122 @@ +import assert from 'node:assert/strict' +import { readFileSync } from 'node:fs' +import * as fs from 'node:fs/promises' +import Module from 'node:module' +import { tmpdir } from 'node:os' +import { join, resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +// Pass a pre-change skill-root-file-walk.ts snapshot as the only argument. +const baselinePath = process.argv[2] +const brokenLinks = process.argv.includes('--broken') +assert.ok(baselinePath, 'Pass a pre-change skill-root-file-walk.ts snapshot.') +const entry = 'src/main/skills/skill-root-file-walk.ts' +const baseline = readFileSync(baselinePath, 'utf8') +assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.') +let statCalls = 0 + +async function load(useBaseline) { + const result = await build({ + entryPoints: [entry], + bundle: true, + platform: 'node', + format: 'cjs', + write: false, + logLevel: 'silent', + plugins: useBaseline + ? [ + { + name: 'baseline-skill-depth', + setup(builder) { + builder.onLoad({ filter: /skill-root-file-walk\.ts$/ }, () => ({ + contents: baseline, + loader: 'ts' + })) + } + } + ] + : [] + }) + const module = new Module(resolve('skill-depth-benchmark.cjs')) + module.paths = Module._nodeModulePaths(process.cwd()) + const originalRequire = module.require.bind(module) + module.require = (name) => + name === 'node:fs/promises' + ? { + ...fs, + stat: (...args) => { + statCalls++ + return fs.stat(...args) + } + } + : originalRequire(name) + module._compile(result.outputFiles[0].text, module.id) + return module.exports.findSkillFiles +} + +const before = await load(true) +const after = await load(false) +const median = (values) => values.sort((a, b) => a - b)[Math.floor(values.length / 2)] +const temporaryRoot = await fs.mkdtemp(join(tmpdir(), 'orca-skill-depth-benchmark-')) +try { + for (const links of [0, 8, 100, 1000]) { + const root = join(temporaryRoot, String(links)) + const edge = join(root, 'a', 'b', 'c', 'd') + const target = join(temporaryRoot, 'target') + await fs.mkdir(edge, { recursive: true }) + await fs.mkdir(target, { recursive: true }) + await fs.writeFile(join(target, 'SKILL.md'), 'skill') + await fs.writeFile(join(edge, 'SKILL.md'), 'edge') + for (let index = 0; index < links; index++) { + await fs.symlink( + brokenLinks ? join(target, 'missing') : target, + join(edge, `link${index}`), + process.platform === 'win32' ? 'junction' : 'dir' + ) + } + for (const depth of [4, 5]) { + const timings = { before: [], after: [] } + const counts = {} + let rows + for (let sample = 0; sample < 13; sample++) { + const versions = + sample % 2 + ? [ + ['after', after], + ['before', before] + ] + : [ + ['before', before], + ['after', after] + ] + for (const [name, walk] of versions) { + statCalls = 0 + const start = performance.now() + const result = await walk(root, depth) + const elapsed = performance.now() - start + if (rows) { + assert.deepEqual(result, rows) + } + rows = result + counts[name] = statCalls + if (sample >= 2) { + timings[name].push(elapsed) + } + } + } + console.log( + JSON.stringify({ + links, + brokenLinks, + depth, + statCalls: counts, + rows: rows.length, + medianMs: { before: median(timings.before), after: median(timings.after) } + }) + ) + } + } +} finally { + await fs.rm(temporaryRoot, { recursive: true, force: true }) +} diff --git a/config/scripts/benchmark-tab-group-repair.mjs b/config/scripts/benchmark-tab-group-repair.mjs new file mode 100644 index 00000000000..17a1161fc4c --- /dev/null +++ b/config/scripts/benchmark-tab-group-repair.mjs @@ -0,0 +1,80 @@ +import { strict as assert } from 'node:assert' +import { mkdtemp, readFile, rm } from 'node:fs/promises' +import { createRequire } from 'node:module' +import { tmpdir } from 'node:os' +import { join, resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +const root = resolve(import.meta.dirname, '../..') +const source = join(root, 'src/renderer/src/store/slices/tab-group-reference-repair.ts') +const directory = await mkdtemp(join(tmpdir(), 'orca-tab-repair-')) +const current = await readFile(source, 'utf8') +const indexed = `const orderedTabIds = new Set(group.tabOrder) + const missingTabIds = ownedTabIds.filter((tabId) => !orderedTabIds.has(tabId))` +assert(current.includes(indexed), 'Expected indexed implementation') +try { + const implementations = [] + for (const baseline of [true, false]) { + const outfile = join(directory, baseline ? 'before.cjs' : 'after.cjs') + await build({ + stdin: { + contents: baseline + ? current.replace( + indexed, + 'const missingTabIds = ownedTabIds.filter((tabId) => !group.tabOrder.includes(tabId))' + ) + : current, + resolveDir: resolve(source, '..'), + loader: 'ts' + }, + bundle: true, + platform: 'node', + format: 'cjs', + outfile, + alias: { '@': join(root, 'src/renderer/src') } + }) + implementations.push(createRequire(import.meta.url)(outfile).appendOwnedTabIdsToGroups) + } + const rows = [] + for (const count of [1, 10, 100, 1_000, 10_000]) { + for (const missing of [false, true]) { + const ids = Array.from({ length: count }, (_, i) => `tab-${i}`) + const groups = [ + { id: 'group', worktreeId: 'workspace', activeTabId: null, tabOrder: ids, recentTabIds: [] } + ] + const owners = new Map(ids.map((id) => [missing ? `missing-${id}` : id, 'group'])) + assert.deepEqual(implementations[0](groups, owners), implementations[1](groups, owners)) + const iterations = Math.max(1, Math.floor(10_000 / count)) + const samples = [[], []] + for (let sample = -3; sample < 11; sample++) { + for (const index of sample % 2 === 0 ? [0, 1] : [1, 0]) { + const start = performance.now() + for (let i = 0; i < iterations; i++) { + implementations[index](groups, owners) + } + const elapsed = (performance.now() - start) / iterations + if (sample >= 0) { + samples[index].push(elapsed) + } + } + } + rows.push({ + count, + missing, + iterations, + beforeMs: samples[0].sort((a, b) => a - b)[5], + afterMs: samples[1].sort((a, b) => a - b)[5] + }) + } + } + console.log( + JSON.stringify( + { node: process.version, platform: process.platform, samples: 11, warmups: 3, rows }, + null, + 2 + ) + ) +} finally { + await rm(directory, { recursive: true, force: true }) +} diff --git a/config/scripts/benchmark-transcript-reverse-lines.mjs b/config/scripts/benchmark-transcript-reverse-lines.mjs new file mode 100644 index 00000000000..e9d370d1839 --- /dev/null +++ b/config/scripts/benchmark-transcript-reverse-lines.mjs @@ -0,0 +1,124 @@ +import assert from 'node:assert/strict' +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' +import Module from 'node:module' +import { tmpdir } from 'node:os' +import { join, resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +const entry = 'src/shared/agent-hook-listener/transcript-reader.ts' +assert.ok(process.argv[2], 'Pass a pre-change transcript-reader.ts snapshot.') +const baseline = readFileSync(process.argv[2], 'utf8') +assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.') + +async function load(useBaseline) { + const result = await build({ + stdin: { + contents: `export * from './${entry}'; +export { extractAssistantTextFromLine } from './src/shared/agent-hook-listener/transcript-entry-text.ts';`, + resolveDir: process.cwd(), + loader: 'ts' + }, + bundle: true, + platform: 'node', + format: 'cjs', + write: false, + logLevel: 'silent', + plugins: useBaseline + ? [ + { + name: 'baseline-transcript-reader', + setup(builder) { + builder.onLoad({ filter: /transcript-reader\.ts$/ }, () => ({ + contents: baseline, + loader: 'ts' + })) + } + } + ] + : [] + }) + const module = new Module(resolve('transcript-benchmark.cjs')) + module.paths = Module._nodeModulePaths(process.cwd()) + module._compile(result.outputFiles[0].text, module.id) + return module.exports +} + +const versions = [await load(true), await load(false)] +function measure(functions, iterations) { + let sink = 0 + const run = (fn) => { + for (let i = 0; i < iterations; i++) { + sink += fn()?.length ?? 0 + } + } + for (const fn of functions) { + for (let i = 0; i < 3; i++) { + run(fn) + } + } + const samples = [[], []] + for (let round = 0; round < 11; round++) { + for (const index of round % 2 ? [1, 0] : [0, 1]) { + const start = performance.now() + run(functions[index]) + samples[index].push((performance.now() - start) / iterations) + } + } + return { + beforeMs: samples[0].sort((a, b) => a - b)[5], + afterMs: samples[1].sort((a, b) => a - b)[5], + iterations, + sink + } +} + +const cases = [ + ['tiny', `${JSON.stringify({ role: 'assistant', content: 'hello' })}\n`, 10000], + ['64KiB line', `${JSON.stringify({ role: 'assistant', content: 'x'.repeat(65500) })}\n`, 100], + [ + '4MiB line', + `${JSON.stringify({ role: 'assistant', content: 'x'.repeat(4 * 1024 * 1024 - 40) })}\n`, + 10 + ], + [ + '1000 short tool lines', + Array.from({ length: 1000 }, () => + JSON.stringify({ role: 'tool', content: 'x'.repeat(100) }) + ).join('\n'), + 50 + ], + [ + 'Unicode line', + `${JSON.stringify({ role: 'assistant', content: '😀漢字'.repeat(16000) })}\n`, + 100 + ], + [ + 'leading and trailing blank lines', + `\n\r\n${JSON.stringify({ role: 'assistant', content: 'hello' })}\n\n`, + 10000 + ] +] +const directory = mkdtempSync(join(tmpdir(), 'orca-transcript-benchmark-')) +try { + for (const [name, text, iterations] of cases) { + const file = join(directory, 'transcript.jsonl') + writeFileSync(file, text) + const scanners = versions.map( + (v) => () => v.findLastExtractedTranscriptLineText(text, v.extractAssistantTextFromLine) + ) + const readers = versions.map((v) => () => v.readLastAssistantFromTranscriptOnce(file)) + assert.equal(scanners[0](), scanners[1](), name) + assert.equal(readers[0](), readers[1](), name) + console.log( + JSON.stringify({ + name, + bytes: Buffer.byteLength(text), + scanner: measure(scanners, iterations), + warmFileReader: measure(readers, Math.min(iterations, 100)) + }) + ) + } +} finally { + rmSync(directory, { recursive: true, force: true }) +} diff --git a/config/scripts/build-windows-process-tree-relay-addon.mjs b/config/scripts/build-windows-process-tree-relay-addon.mjs index d3b9db939cd..9243f5a5b78 100644 --- a/config/scripts/build-windows-process-tree-relay-addon.mjs +++ b/config/scripts/build-windows-process-tree-relay-addon.mjs @@ -32,6 +32,8 @@ import { import { join, resolve } from 'node:path' import { RELAY_WINDOWS_PROCESS_TREE_FILENAME } from '../../src/shared/relay-artifacts.ts' import { + ensureWindowsProcessTreeCommandLinePatch, + inspectWindowsProcessTreeAddon, nodeGypRebuildInvocation, stageWindowsProcessTreeNodeAddonApiHeaders, WINDOWS_PROCESS_TREE_PACKAGE_DIR as PACKAGE_DIR @@ -89,6 +91,13 @@ function assertPatchApplied() { 'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.' ) } + if (processCc.includes('OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ')) { + throw new Error( + 'src/process.cc still takes PROCESS_VM_READ for memory or CPU counters it never reads ' + + 'from the address space. pnpm did not apply ' + + 'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.' + ) + } } // pnpm can materialize this CRLF package without applying its patch. Repair the @@ -123,6 +132,13 @@ function applyWindowsProcessTreeBuildFixes() { '' ) processCc = processCc.replace(/process_count < 1024 && /, '') + // The memory and CPU readers only ever call GetProcessMemoryInfo/GetProcessTimes, + // which need no more than PROCESS_QUERY_LIMITED_INFORMATION; taking VM_READ is + // what EDR scores. + processCc = processCc.replaceAll( + 'OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid)', + 'OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid)' + ) if (bindingGyp !== originalBinding) { writeFileSync(bindingPath, bindingGyp) @@ -131,7 +147,8 @@ function applyWindowsProcessTreeBuildFixes() { writeFileSync(processPath, processCc) } stageWindowsProcessTreeNodeAddonApiHeaders(PACKAGE_DIR) - if (bindingGyp !== originalBinding || processCc !== originalProcess) { + const repairedCommandLine = ensureWindowsProcessTreeCommandLinePatch(PACKAGE_DIR) + if (bindingGyp !== originalBinding || processCc !== originalProcess || repairedCommandLine) { console.warn('[windows-process-tree] Repaired un-applied pnpm patch hunks before build.') } } @@ -173,6 +190,14 @@ function main() { if (!existsSync(built)) { throw new Error(`node-gyp reported success but ${built} is missing.`) } + // Why check the artifact and not only the source: the source checks above run + // before node-gyp, and a stale build directory can outlive them. + if (inspectWindowsProcessTreeAddon(built) === 'unpatched') { + throw new Error( + 'The built addon still calls ReadProcessMemory, so it did not come from the patched ' + + 'command-line reader. A relay would get the primitive MDE scores as credential dumping.' + ) + } const machine = readPeMachine(built) if (machine !== PE_MACHINE[arch]) { throw new Error( diff --git a/config/scripts/cli-runtime-client-deferral-equivalence.mjs b/config/scripts/cli-runtime-client-deferral-equivalence.mjs index f443bf3b9f9..a231b5ba75a 100644 --- a/config/scripts/cli-runtime-client-deferral-equivalence.mjs +++ b/config/scripts/cli-runtime-client-deferral-equivalence.mjs @@ -2,7 +2,7 @@ // Equivalence check for deferring the RuntimeClient module graph in the CLI. // // Builds the CLI twice with the REAL tsc emit — once from the working tree and -// once with the seven touched files restored from git HEAD~ (the pre-deferral +// once with the touched files restored from git HEAD~ (the pre-deferral // implementation) — then compares stdout, stderr and exit code BYTE FOR BYTE // across a matrix of invocations. // @@ -13,7 +13,7 @@ // // Usage: node config/scripts/cli-runtime-client-deferral-equivalence.mjs [--baseline ] import { execFileSync, spawnSync } from 'node:child_process' -import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs' +import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs' import { join, resolve } from 'node:path' import { fileURLToPath } from 'node:url' @@ -21,8 +21,11 @@ const REPO = fileURLToPath(new URL('../..', import.meta.url)) // The files this change touches. Restoring exactly these from the baseline rev // reconstructs the old implementation without disturbing anything else. +// Files absent at the baseline (e.g. cli-error.ts, split out of format.ts +// later) are removed for the baseline build and put back afterwards. const TOUCHED = [ 'src/cli/args.ts', + 'src/cli/cli-error.ts', 'src/cli/dispatch.ts', 'src/cli/flags.ts', 'src/cli/format.ts', @@ -72,12 +75,16 @@ function buildTree(label, baselineRev) { if (baselineRev) { for (const file of TOUCHED) { const path = join(REPO, file) - restored.push([path, readFileSync(path)]) - const old = execFileSync('git', ['show', `${baselineRev}:${file}`], { + restored.push([path, existsSync(path) ? readFileSync(path) : null]) + const old = spawnSync('git', ['show', `${baselineRev}:${file}`], { cwd: REPO, maxBuffer: 64 * 1024 * 1024 }) - writeFileSync(path, old) + if (old.status === 0) { + writeFileSync(path, old.stdout) + } else { + rmSync(path, { force: true }) + } } } execFileSync( @@ -97,7 +104,11 @@ function buildTree(label, baselineRev) { ) } finally { for (const [path, contents] of restored) { - writeFileSync(path, contents) + if (contents === null) { + rmSync(path, { force: true }) + } else { + writeFileSync(path, contents) + } } } return join(outDir, 'cli/index.js') diff --git a/config/scripts/electron-builder-markdown-associations.test.mjs b/config/scripts/electron-builder-markdown-associations.test.mjs index 7ae3b1c9428..58f6f8d8865 100644 --- a/config/scripts/electron-builder-markdown-associations.test.mjs +++ b/config/scripts/electron-builder-markdown-associations.test.mjs @@ -103,14 +103,24 @@ describe('electron-builder markdown file associations', () => { // Why: this include was renamed from daemon-host-uninstall.nsh to carry the markdown // hooks too. electron-builder allows only one include, so a merge that drops the daemon - // sweep would silently orphan a running orca-terminal-daemon.exe on every uninstall. + // sweep would silently orphan a running daemon host on every uninstall. + // + // Asserted against comment-stripped script, and on the app exe name first: the relocated + // host is a verbatim copy of the app exe (daemonHostExeName, daemon-host-relocation.ts), + // so a macro that kills only orca-terminal-daemon.exe matches no running process. The + // prose above the macro names both, so a toContain over the raw file proves nothing. it('keeps the daemon-host uninstall sweep across the include rename', async () => { - const hooks = await readInstallerHooks() + const script = stripNsisCommentLines(await readInstallerHooks()) - expect(hooks).toContain('orca-terminal-daemon.exe') - expect(hooks).toContain('$LOCALAPPDATA\\Orca\\daemon-host') + expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?\$\{APP_EXECUTABLE_FILENAME\}"?/) + // Legacy name, so hosts left by builds that renamed the copy still get reaped. + expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?orca-terminal-daemon\.exe"?/) + // Scopes both kills to the uninstalling user: an elevated machine-wide uninstall must + // not reach another logged-on user's session. + expect(script).toMatch(/\/FI\s+"USERNAME eq /) + expect(script).toContain('$LOCALAPPDATA\\Orca\\daemon-host') // Without this guard, uninstallOldVersion would kill the daemon on every update — // defeating the relocation that keeps terminals alive across updates. - expect(hooks).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/) + expect(script).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/) }) }) diff --git a/config/scripts/ensure-native-runtime.mjs b/config/scripts/ensure-native-runtime.mjs index a4cc6db8843..b2a47b99d5b 100644 --- a/config/scripts/ensure-native-runtime.mjs +++ b/config/scripts/ensure-native-runtime.mjs @@ -5,6 +5,12 @@ import { createRequire } from 'node:module' import { existsSync, readFileSync } from 'node:fs' import { release } from 'node:os' import { basename, dirname, resolve } from 'node:path' +import { + ensureWindowsProcessTreeCommandLinePatch, + inspectWindowsProcessTreeAddon, + stageWindowsProcessTreeNodeAddonApiHeaders, + windowsProcessTreeAddonPath +} from './windows-process-tree-gyp-rebuild.mjs' const require = createRequire(import.meta.url) const { assertNodePtyJobOwnership } = require('./node-pty-job-ownership.cjs') @@ -253,11 +259,18 @@ function collectNativeModuleFailures() { function loadNativeModule(moduleName) { if (moduleName === '@vscode/windows-process-tree') { - // A bare require already loads the .node addon on win32, so it catches an - // ABI mismatch on its own. What it cannot catch is a snapshot that comes - // back empty -- the shape a blocked CreateToolhelp32Snapshot produces -- - // so check the addon actually enumerates before calling the runtime healthy. + // A bare require loads the .node addon on win32, so it catches an ABI + // mismatch on its own. What it cannot catch is *which* addon loaded: the + // published tarball ships a prebuilt built from unpatched source that is + // node-addon-api, so it requires cleanly and then reads every process's + // command line out of its address space. Check the binary, not the load. require(moduleName) + if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath()) === 'unpatched') { + throw new Error( + 'the loaded addon still calls ReadProcessMemory, so it was not built from the patched ' + + 'source. Rebuild it (pnpm run rebuild:electron) rather than using the published prebuild.' + ) + } return } if (moduleName === 'windows-native-registry') { @@ -368,6 +381,14 @@ function getWindowsBuildNumber() { function rebuildNodeRuntimeModules(moduleNames) { for (const moduleName of moduleNames) { const moduleDir = dirname(require.resolve(`${moduleName}/package.json`)) + if (moduleName === '@vscode/windows-process-tree') { + // Why before node-gyp: this module is rebuilt precisely because the + // binary was the unpatched one, and pnpm materializes it unpatched often + // enough that compiling the source as-is would just rebuild the same + // reader and fail the verify pass. + ensureWindowsProcessTreeCommandLinePatch(moduleDir) + stageWindowsProcessTreeNodeAddonApiHeaders(moduleDir) + } console.warn(`[native-runtime] Rebuilding ${moduleName} with node-gyp.`) runPnpm(['exec', 'node-gyp', 'rebuild'], { cwd: moduleDir }) if (moduleName === 'node-pty' && process.platform === 'win32') { diff --git a/config/scripts/ensure-native-runtime.test.mjs b/config/scripts/ensure-native-runtime.test.mjs index ea6e876e619..973e2f6852d 100644 --- a/config/scripts/ensure-native-runtime.test.mjs +++ b/config/scripts/ensure-native-runtime.test.mjs @@ -12,6 +12,7 @@ import { tmpdir } from 'node:os' import { delimiter, join } from 'node:path' import { fileURLToPath } from 'node:url' import { describe, expect, it } from 'vitest' +import { copyScriptWithLocalModules } from './script-module-dependencies.mjs' const sourceScriptPath = fileURLToPath(new URL('./ensure-native-runtime.mjs', import.meta.url)) const sourceNodePtyJobOwnershipPath = fileURLToPath( @@ -27,7 +28,6 @@ describe('ensure-native-runtime', () => { const logPath = join(projectDir, 'native-runtime.log') const markerPath = join(projectDir, 'rebuilt.marker') const binDir = join(projectDir, 'bin') - copyFileSync(sourceScriptPath, scriptPath) writeFakeNativeModules(projectDir) writeNodePtyPatchFile(projectDir) writeFakePnpm(binDir) @@ -67,7 +67,6 @@ describe('ensure-native-runtime', () => { const logPath = join(projectDir, 'native-runtime.log') const markerPath = join(projectDir, 'rebuilt.marker') const binDir = join(projectDir, 'bin') - copyFileSync(sourceScriptPath, scriptPath) writeFakeNativeModules(projectDir, { windowsRegistryRequiresMarker: true }) writeNodePtyPatchFile(projectDir) writeFakePnpm(binDir) @@ -102,7 +101,6 @@ describe('ensure-native-runtime', () => { const logPath = join(projectDir, 'native-runtime.log') const markerPath = join(projectDir, 'rebuilt.marker') const binDir = join(projectDir, 'bin') - copyFileSync(sourceScriptPath, scriptPath) writeLoadableNativeModules(projectDir) writeNodePtyPatchFile(projectDir) writeFakePnpm(binDir) @@ -137,7 +135,6 @@ describe('ensure-native-runtime', () => { const logPath = join(projectDir, 'native-runtime.log') const markerPath = join(projectDir, 'rebuilt.marker') const binDir = join(projectDir, 'bin') - copyFileSync(sourceScriptPath, scriptPath) writeLoadableNativeModules(projectDir) writeNodePtyPatchFile(projectDir) writePatchedNodePtyBuildArtifacts(projectDir) @@ -171,7 +168,6 @@ describe('ensure-native-runtime', () => { const logPath = join(projectDir, 'native-runtime.log') const markerPath = join(projectDir, 'rebuilt.marker') const binDir = join(projectDir, 'bin') - copyFileSync(sourceScriptPath, scriptPath) writeLoadableNativeModules(projectDir, { nativeDir: '../build/Release/' }) writeNodePtyPatchFile(projectDir) writePatchedNodePtyBuildArtifacts(projectDir) @@ -198,7 +194,9 @@ describe('ensure-native-runtime', () => { function mkTempProject() { const projectDir = mkdtempSync(join(tmpdir(), 'orca-native-runtime-')) - mkdirSync(join(projectDir, 'config', 'scripts'), { recursive: true }) + // Walked, not listed: the script imports windows-process-tree-gyp-rebuild.mjs, and a fixture + // missing it fails every case with a module-resolution error instead of the defect under test. + copyScriptWithLocalModules(sourceScriptPath, join(projectDir, 'config', 'scripts')) copyFileSync( sourceNodePtyJobOwnershipPath, join(projectDir, 'config', 'scripts', 'node-pty-job-ownership.cjs') diff --git a/config/scripts/file-explorer-deletion-roots-benchmark.mjs b/config/scripts/file-explorer-deletion-roots-benchmark.mjs new file mode 100644 index 00000000000..d276964861b --- /dev/null +++ b/config/scripts/file-explorer-deletion-roots-benchmark.mjs @@ -0,0 +1,75 @@ +import assert from 'node:assert/strict' +import { join } from 'node:path' +import { performance } from 'node:perf_hooks' +import { fileURLToPath } from 'node:url' +import { build } from 'esbuild' + +const root = fileURLToPath(new URL('../..', import.meta.url)) +const bundled = await build({ + stdin: { + contents: `export { selectDeletionRoots } from './file-explorer-batch-deletion'; + export { isPathEqualOrDescendant } from './file-explorer-paths';`, + resolveDir: join(root, 'src/renderer/src/components/right-sidebar'), + loader: 'ts' + }, + alias: { '@': join(root, 'src/renderer/src') }, + bundle: true, + platform: 'node', + format: 'esm', + write: false, + logLevel: 'silent' +}) +const { selectDeletionRoots, isPathEqualOrDescendant } = await import( + `data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}` +) + +// Original production selector; both paths use the same path-comparison implementation. +function original(nodes) { + return nodes.filter( + (n) => + !nodes.some( + (other) => other !== n && other.isDirectory && isPathEqualOrDescendant(n.path, other.path) + ) + ) +} + +function measure(run, nodes) { + for (let index = 0; index < 3; index++) { + run(nodes) + } + const samples = [] + for (let index = 0; index < 11; index++) { + const start = performance.now() + run(nodes) + samples.push(performance.now() - start) + } + return samples.sort((a, b) => a - b)[5] +} + +const results = [] +for (const [fileCount, directoryCount] of [ + [100, 0], + [1000, 0], + [5000, 0], + [5000, 5], + [0, 100] +]) { + const nodes = Array.from({ length: fileCount + directoryCount }, (_, index) => ({ + name: `item-${index}`, + path: `/repo/item-${index}`, + relativePath: `item-${index}`, + isDirectory: index >= fileCount, + depth: 0 + })) + const expected = original(nodes) + const actual = selectDeletionRoots(nodes) + assert.equal(actual.length, expected.length) + actual.forEach((node, index) => assert.equal(node, expected[index])) + results.push({ + fileCount, + directoryCount, + beforeMs: measure(original, nodes), + afterMs: measure(selectDeletionRoots, nodes) + }) +} +console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2)) diff --git a/config/scripts/mobile-file-ranking-benchmark.mjs b/config/scripts/mobile-file-ranking-benchmark.mjs new file mode 100644 index 00000000000..68ac5b9d977 --- /dev/null +++ b/config/scripts/mobile-file-ranking-benchmark.mjs @@ -0,0 +1,53 @@ +import assert from 'node:assert/strict' +import { execFileSync } from 'node:child_process' +import { readFileSync } from 'node:fs' +import { stripTypeScriptTypes } from 'node:module' +import { performance } from 'node:perf_hooks' + +const baseline = process.argv[2] +if (!baseline) { + throw new Error('Usage: node config/scripts/mobile-file-ranking-benchmark.mjs ') +} +async function load(source) { + const js = stripTypeScriptTypes(source, { mode: 'transform' }) + return await import(`data:text/javascript;base64,${Buffer.from(js).toString('base64')}`) +} +function measure(fn, paths, query) { + for (let warmup = 0; warmup < 10; warmup++) { + fn(paths, query, 16) + } + const samples = [] + for (let i = 0; i < 9; i++) { + const start = performance.now() + fn(paths, query, 16) + samples.push(performance.now() - start) + } + return samples.sort((a, b) => a - b)[4] +} +const results = [] +for (const [file, name] of [ + ['src/main/runtime/runtime-mobile-file-path-search.ts', 'rankRuntimeMobileFilePaths'], + ['mobile/src/session/mobile-native-chat-autocomplete.ts', 'rankSuggestions'] +]) { + const before = ( + await load(execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8' })) + )[name] + const after = (await load(readFileSync(file, 'utf8')))[name] + for (const count of [100, 100000]) { + const paths = Array.from( + { length: count }, + (_, i) => `src/components/workspace/group-${i % 100}/file-${i}.tsx` + ) + for (const query of ['file-9', 'missing', 'workspace']) { + assert.deepEqual(after(paths, query, 16), before(paths, query, 16)) + results.push({ + function: name, + paths: count, + query, + beforeMs: measure(before, paths, query), + afterMs: measure(after, paths, query) + }) + } + } +} +console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2)) diff --git a/config/scripts/mobile-markdown-placeholder-benchmark.mjs b/config/scripts/mobile-markdown-placeholder-benchmark.mjs new file mode 100644 index 00000000000..20280e5a8d2 --- /dev/null +++ b/config/scripts/mobile-markdown-placeholder-benchmark.mjs @@ -0,0 +1,58 @@ +import assert from 'node:assert/strict' +import { execFileSync } from 'node:child_process' +import { readFileSync } from 'node:fs' +import { dirname, resolve } from 'node:path' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +const sourcePath = 'mobile/src/components/mobile-markdown-preview-html.ts' +const baselineRef = process.argv[2] +if (!baselineRef) { + throw new Error( + 'Usage: node config/scripts/mobile-markdown-placeholder-benchmark.mjs ' + ) +} +async function load(source) { + const result = await build({ + stdin: { contents: source, resolveDir: dirname(resolve(sourcePath)), loader: 'ts' }, + bundle: true, + write: false, + platform: 'node', + format: 'esm' + }) + return ( + await import( + `data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}` + ) + ).normalizeMobileMarkdownPreviewHtml +} +const before = await load( + execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], { encoding: 'utf8' }) +) +const after = await load(readFileSync(sourcePath, 'utf8')) +function measure(fn, input, repeats) { + const samples = [] + for (let run = 0; run < repeats; run++) { + const start = performance.now() + fn(input) + samples.push(performance.now() - start) + } + return samples.sort((a, b) => a - b)[Math.floor(samples.length / 2)] +} +const results = [] +for (const [shape, input] of [ + ['ordinary Markdown', '# Hello\n\n

Use `Array` and bold.

'], + ...[2048, 8192, 16384].map((length) => [ + `${length} underscore collision`, + `\uE000ORCA_MD_CODE_${'_'.repeat(length)}0\uE000 and \`Array\`` + ]) +]) { + assert.equal(after(input), before(input)) + results.push({ + shape, + bytes: Buffer.byteLength(input), + beforeMs: measure(before, input, 5), + afterMs: measure(after, input, 15) + }) +} +console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2)) diff --git a/config/scripts/patched-dependencies-frozen-install.test.mjs b/config/scripts/patched-dependencies-frozen-install.test.mjs new file mode 100644 index 00000000000..89f98ef074b --- /dev/null +++ b/config/scripts/patched-dependencies-frozen-install.test.mjs @@ -0,0 +1,155 @@ +import { + cpSync, + copyFileSync, + existsSync, + mkdirSync, + mkdtempSync, + readFileSync, + writeFileSync +} from 'node:fs' +import { tmpdir } from 'node:os' +import { isAbsolute, join, parse, resolve } from 'node:path' +import { describe, expect, it } from 'vitest' +import { runProcessSync } from '../../src/shared/child-process/run-process.ts' +import { resolveCliCommand } from '../../src/shared/node-cli-command-resolution.ts' +import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts' +import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs' + +/** + * Run the command that actually consumes the patch hashes. + * + * A hash comparison is not this check. `@vscode/windows-process-tree@0.8.0` shipped + * twice with a hand-computed `sha256(patchBytes)` in the lockfile, and two separate + * reviews "verified" it by recomputing the same number the same wrong way. pnpm + * hashes the **LF-normalized** content, so a CRLF patch makes the raw digest a value + * pnpm will never produce, and `--frozen-lockfile` dies with + * ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every runner. An independent check that + * repeats the original assumption is not independent; only the installer is. + * + * `--lockfile-only --ignore-scripts` keeps it to the resolution pnpm rejects on, + * with no node_modules and no native builds. + */ +const PROJECT_DIR = resolve(import.meta.dirname, '../..') +const WINDOWS_PROCESS_TREE_PATCH = '@vscode__windows-process-tree@0.8.0.patch' + +/** + * Which pnpm to run belongs to pnpm-cli-invocation.mjs, not to this file: naming + * the Windows shim here is what windows-cmd-shim-spawn-boundary.test.mjs rejects. + * Its `shell` is dropped on purpose -- runProcessSync refuses that flag and + * already drives a shim through the interpreter itself. + */ +function resolvePnpmInvocation() { + const { command, prefixArgs } = resolvePnpmCliInvocation() + if (isAbsolute(command)) { + return existsSync(command) ? { program: command, prefixArgs } : null + } + // Bare name only when npm_execpath is unset (bare `vitest`, not `pnpm test`). + // Drop the extension so the shared resolver tries every executable form of it. + const resolved = resolveCliCommand(parse(command).name) + return isAbsolute(resolved) ? { program: resolved, prefixArgs } : null +} + +describe('patched dependencies', () => { + it('installs with --frozen-lockfile, which is what validates every patch hash', () => { + const pnpm = resolvePnpmInvocation() + expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull() + + // A copy, because a --frozen-lockfile run still rewrites parts of the + // lockfile this repo does not track, and the real one must not move. + const scratch = mkdtempSync(join(tmpdir(), 'orca-frozen-install-')) + try { + for (const file of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']) { + copyFileSync(join(PROJECT_DIR, file), join(scratch, file)) + } + mkdirSync(join(scratch, 'config'), { recursive: true }) + cpSync(join(PROJECT_DIR, 'config', 'patches'), join(scratch, 'config', 'patches'), { + recursive: true + }) + + const result = runProcessSync({ + program: pnpm.program, + args: [ + ...pnpm.prefixArgs, + 'install', + '--frozen-lockfile', + '--lockfile-only', + '--ignore-scripts' + ], + cwd: scratch, + timeoutMs: 300_000 + }) + + expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0) + } finally { + removeTreeSync(scratch) + } + // The 300s spawn budget is only reachable if the case is allowed to take it; + // config/vitest.config.ts caps every case at 30s by default. + }, 300_000) + + /** + * `--lockfile-only` resolves; it never applies a patch. So the case above is + * bounded to hash consistency, and the actual question -- can pnpm still put + * the patched reader on disk? -- had nothing covering it. + * + * One package, patch applied for real, assert the marker landed. Scoped to the + * single dependency so it stays a ~2s check rather than a full install. + */ + it('materializes the patched command-line reader on a real install', () => { + const pnpm = resolvePnpmInvocation() + expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull() + + const scratch = mkdtempSync(join(tmpdir(), 'orca-patch-apply-')) + try { + mkdirSync(join(scratch, 'config', 'patches'), { recursive: true }) + copyFileSync( + join(PROJECT_DIR, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH), + join(scratch, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH) + ) + writeFileSync( + join(scratch, 'package.json'), + `${JSON.stringify( + { + name: 'orca-patch-apply-probe', + version: '1.0.0', + dependencies: { '@vscode/windows-process-tree': '0.8.0' } + }, + null, + 2 + )}\n` + ) + writeFileSync( + join(scratch, 'pnpm-workspace.yaml'), + 'packages: []\n' + + 'patchedDependencies:\n' + + ` '@vscode/windows-process-tree@0.8.0': config/patches/${WINDOWS_PROCESS_TREE_PATCH}\n` + ) + + const result = runProcessSync({ + program: pnpm.program, + args: [...pnpm.prefixArgs, 'install', '--no-frozen-lockfile', '--ignore-scripts'], + cwd: scratch, + timeoutMs: 300_000 + }) + expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0) + + const materialized = readFileSync( + join( + scratch, + 'node_modules', + '@vscode', + 'windows-process-tree', + 'src', + 'process_commandline.cc' + ), + 'utf8' + ) + expect(materialized).toContain('kProcessCommandLineInformation') + // The whole point of the patch: the upstream reader is gone, not merely + // supplemented. + expect(materialized).not.toContain('ReadProcessMemory') + } finally { + removeTreeSync(scratch) + } + }, 300_000) +}) diff --git a/config/scripts/pr-code-change-scope.mjs b/config/scripts/pr-code-change-scope.mjs index fd36a803bb9..c99e058891f 100644 --- a/config/scripts/pr-code-change-scope.mjs +++ b/config/scripts/pr-code-change-scope.mjs @@ -213,6 +213,7 @@ const LINUX_PACKAGE_TESTS = [ const WINDOWS_PACKAGE_TESTS = [ ...LINUX_PACKAGE_TESTS, 'config/scripts/rebuild-native-deps.test.mjs', + 'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs', 'src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts', 'src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts', 'src/shared/child-process/windows-command-line.win32.test.ts', @@ -220,6 +221,7 @@ const WINDOWS_PACKAGE_TESTS = [ 'src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts', 'src/main/windows/windows-pty-job.win32.test.ts', 'src/main/windows/windows-host-job.win32.test.ts', + 'src/main/windows/windows-process-tree-command-line-patch.test.ts', 'src/main/windows-live-tree-kill.win32.test.ts', 'src/main/wsl/wsl-runner.test.ts', 'src/main/wsl/wsl-guest-environment.test.ts', @@ -228,14 +230,18 @@ const WINDOWS_PACKAGE_TESTS = [ 'src/main/wsl/wsl-w1-w3-contract.test.ts', 'src/shared/source-scan/source-tree-scan.test.ts', 'src/main/cli/wsl-cli-powershell-boundary.test.ts', + 'src/main/computer/desktop-script-runtime-host.win32.test.ts', 'src/main/cursor/hook-service.test.ts', 'src/main/orca-profiles/profile-index-store.test.ts', 'src/main/startup/windows-install-dir-acl-repair.win32.test.ts', 'src/main/runtime/repo-worktree-admin-fingerprint.test.ts', 'src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts', 'src/shared/secure-file-fsync-flags.test.ts', + 'src/shared/secure-path-windows-acl.win32.test.ts', + 'src/main/runtime/unreadable-secret-store-preservation.win32.test.ts', 'src/main/ipc/pty-codex-account-attribution.test.ts', - 'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts' + 'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts', + 'src/relay/windows-port-scan.win32.test.ts' ] const DESKTOP_IRRELEVANT_PREFIXES = [ diff --git a/config/scripts/pr-e2e-native-only-routing.test.mjs b/config/scripts/pr-e2e-native-only-routing.test.mjs new file mode 100644 index 00000000000..b6c3662cd1d --- /dev/null +++ b/config/scripts/pr-e2e-native-only-routing.test.mjs @@ -0,0 +1,33 @@ +import { readFileSync } from 'node:fs' +import { describe, expect, it } from 'vitest' +import { parse } from 'yaml' +import { hasNativeImeSourceChange, shouldRunReusablePrE2e } from './pr-e2e-source-routing.mjs' + +const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8')) +const filterStep = workflow.jobs.code_paths.steps.find((step) => step.id === 'e2e_filter') + +describe('native-only PR E2E routing', () => { + it('avoids generic E2E allocation for native-only changes while preserving its IME lane', () => { + for (const file of [ + 'tests/e2e/terminal-ibus-hangul-native.spec.ts', + 'config/scripts/run-terminal-ibus-hangul-e2e.mjs' + ]) { + expect(hasNativeImeSourceChange([file])).toBe(true) + expect(shouldRunReusablePrE2e([file])).toBe(false) + } + expect(shouldRunReusablePrE2e([])).toBe(false) + for (const spec of [ + 'tests/e2e/ssh-startup-exec-readiness.spec.ts', + 'tests/e2e/paired-startup-exec-readiness.spec.ts', + 'tests/e2e/terminal-ime-exact-byte.spec.ts', + 'tests/e2e/future.spec.ts' + ]) { + expect(shouldRunReusablePrE2e([spec])).toBe(true) + expect(shouldRunReusablePrE2e(['tests/e2e/terminal-ibus-hangul-native.spec.ts', spec])).toBe( + true + ) + } + expect(filterStep.run).toContain('pr-e2e-source-routing.mjs --reusable-workflow') + expect(filterStep.run).toContain('if [ "$SHOULD_RUN" = true ]; then') + }) +}) diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs index 78814b663cb..5b698fb0b42 100644 --- a/config/scripts/pr-e2e-source-routing.mjs +++ b/config/scripts/pr-e2e-source-routing.mjs @@ -217,6 +217,16 @@ export function hasNativeImeSourceChange(changedPaths) { ).some((route) => changedPaths.some(route.matches)) } +export function shouldRunReusablePrE2e(changedPaths) { + // Native IME has its own workflow; SSH still runs inside the reusable workflow. + return ( + hasSshSourceChange(changedPaths) || + selectPrE2eSpecs(changedPaths).some( + (spec) => spec !== 'tests/e2e/terminal-ibus-hangul-native.spec.ts' + ) + ) +} + if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) { let input = '' process.stdin.setEncoding('utf8') @@ -226,6 +236,8 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) const changedPaths = input.split(/\r?\n/).filter(Boolean) if (process.argv.includes('--ssh-source')) { process.stdout.write(`${hasSshSourceChange(changedPaths)}\n`) + } else if (process.argv.includes('--reusable-workflow')) { + process.stdout.write(`${shouldRunReusablePrE2e(changedPaths)}\n`) } else if (process.argv.includes('--native-ime-source')) { process.stdout.write(`${hasNativeImeSourceChange(changedPaths)}\n`) } else { diff --git a/config/scripts/quick-open-exclusion-benchmark.mjs b/config/scripts/quick-open-exclusion-benchmark.mjs new file mode 100644 index 00000000000..399302c5a2b --- /dev/null +++ b/config/scripts/quick-open-exclusion-benchmark.mjs @@ -0,0 +1,60 @@ +import assert from 'node:assert/strict' +import { performance } from 'node:perf_hooks' +import { build } from 'esbuild' + +const bundled = await build({ + entryPoints: ['src/shared/quick-open-filter.ts'], + bundle: true, + platform: 'node', + format: 'esm', + write: false, + logLevel: 'silent' +}) +const { shouldExcludeQuickOpenRelPath: after } = await import( + `data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}` +) +// Original production predicate, including its exact boundary check. +function before(relPath, prefixes) { + for (const prefix of prefixes) { + if (relPath === prefix) { + return true + } + if (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) { + return true + } + } + return false +} +const files = Array.from( + { length: 100000 }, + (_, index) => `src/components/group-${index % 100}/file-${index}.tsx` +) +function run(fn, prefixes) { + let excluded = 0 + for (const file of files) { + excluded += Number(fn(file, prefixes)) + } + return excluded +} +function measure(fn, prefixes) { + run(fn, prefixes) + const samples = [] + for (let index = 0; index < 5; index++) { + const start = performance.now() + run(fn, prefixes) + samples.push(performance.now() - start) + } + return samples.sort((a, b) => a - b)[2] +} +const results = [] +for (const count of [0, 10, 100, 500]) { + const prefixes = Array.from({ length: count }, (_, index) => `nested-worktrees/worktree-${index}`) + assert.equal(run(after, prefixes), run(before, prefixes)) + results.push({ + files: files.length, + exclusions: count, + beforeMs: measure(before, prefixes), + afterMs: measure(after, prefixes) + }) +} +console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2)) diff --git a/config/scripts/rebuild-native-deps-node-pty.test.mjs b/config/scripts/rebuild-native-deps-node-pty.test.mjs index 09e38853371..871732dd53d 100644 --- a/config/scripts/rebuild-native-deps-node-pty.test.mjs +++ b/config/scripts/rebuild-native-deps-node-pty.test.mjs @@ -4,6 +4,8 @@ import { join } from 'node:path' import { describe, expect, it } from 'vitest' import { + gitLineEndingEnv, + initGitWorkTree, mkTempProject, runRebuildScript, writeFakeElectronRebuild, @@ -14,7 +16,8 @@ import { writeFakeWindowsProcessTreeWithNodeAddonApi, writeFakeWindowsRegistry, writeNodePtyPatchFile, - writePatchedNodePtyBuildArtifacts + writePatchedNodePtyBuildArtifacts, + writeWindowsProcessTreePatchFile } from './rebuild-native-deps-test-fixtures.mjs' describe('rebuild-native-deps patched node-pty rebuild', () => { @@ -85,6 +88,91 @@ describe('rebuild-native-deps patched node-pty rebuild', () => { } }) + const commandLineSourcePath = (projectDir) => + join( + projectDir, + 'node_modules', + '@vscode', + 'windows-process-tree', + 'src', + 'process_commandline.cc' + ) + + // Why inside a git work tree: `git apply` run under one prefixes patch paths + // with the cwd-relative prefix, silently skips what does not match, and still + // exits 0. The package dir is always under the project root in production, so + // a fixture in %TEMP% alone would pass while the real repair did nothing. + // + // Why both line-ending modes: the patch is stored LF while upstream ships this + // source CRLF, so whether the pre-image matches depends on `core.autocrlf` -- + // and under `false`, Git's own built-in default, it did not. The repair blinds + // git to the repo, so that value comes from global config, i.e. from whichever + // option the developer's installer wrote. Pinning both makes the case cover the + // host that breaks rather than the host that happens to run it. + for (const autocrlf of ['false', 'true']) { + it(`repairs an un-applied command-line patch in a work tree (autocrlf=${autocrlf})`, () => { + const projectDir = mkTempProject() + + try { + initGitWorkTree(projectDir) + writeFakeUsableElectronPackage(projectDir, { platform: 'win32' }) + writeFakeElectronRebuild(projectDir) + writeFakeNodePtyConptyPayload(projectDir, 'x64') + writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, { + commandLinePatchApplied: false + }) + writeWindowsProcessTreePatchFile(projectDir) + + const result = runRebuildScript( + projectDir, + { + npm_config_platform: 'win32', + npm_config_arch: 'x64', + ...gitLineEndingEnv(autocrlf) + }, + ['--platform=win32', '--arch=x64', '--force'] + ) + + expect(result.status, result.stderr).toBe(0) + expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).toContain( + 'kProcessCommandLineInformation' + ) + } finally { + removeTreeSync(projectDir) + } + }) + } + + // Why fail rather than build: an unpatched command-line reader compiles fine + // and then opens every process with PROCESS_VM_READ to walk its PEB, which is + // the primitive the patch exists to remove. + it('refuses a Windows rebuild when the command-line patch cannot be applied', () => { + const projectDir = mkTempProject() + + try { + initGitWorkTree(projectDir) + writeFakeUsableElectronPackage(projectDir, { platform: 'win32' }) + writeFakeElectronRebuild(projectDir) + writeFakeNodePtyConptyPayload(projectDir, 'x64') + writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, { commandLinePatchApplied: false }) + // No patch file, so the repair has nothing to apply. + + const result = runRebuildScript( + projectDir, + { npm_config_platform: 'win32', npm_config_arch: 'x64' }, + ['--platform=win32', '--arch=x64', '--force'] + ) + + expect(result.status).not.toBe(0) + expect(result.stderr).toContain('process_commandline.cc') + expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).not.toContain( + 'kProcessCommandLineInformation' + ) + } finally { + removeTreeSync(projectDir) + } + }) + it('restores the ConPTY runtime payload after a Windows Electron rebuild', () => { const projectDir = mkTempProject() @@ -256,4 +344,37 @@ describe('rebuild-native-deps patched node-pty rebuild', () => { } } ) + + // The binary this step produces is the one copied into the packaged app. The + // relay build checks its own artifact and ensure-native-runtime checks what it + // loads; nothing checked this one, so a rebuild that quietly emitted the + // upstream reader shipped. Both non-clean states have to fail, which is the + // caller the tri-state was missing: after a rebuild that reported success, an + // absent binary is a broken build, not an absence to shrug at. + for (const [addon, expected] of [ + ['unpatched', 'still imports ReadProcessMemory'], + ['none', 'is not there'] + ]) { + it(`fails a Windows rebuild that leaves ${addon} windows-process-tree bytes`, () => { + const projectDir = mkTempProject() + + try { + writeFakeUsableElectronPackage(projectDir, { platform: 'win32' }) + writeFakeElectronRebuild(projectDir, { addon }) + writeFakeNodePtyConptyPayload(projectDir, 'x64') + writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir) + + const result = runRebuildScript( + projectDir, + { npm_config_platform: 'win32', npm_config_arch: 'x64' }, + ['--platform=win32', '--arch=x64', '--force'] + ) + + expect(result.status).not.toBe(0) + expect(result.stderr).toContain(expected) + } finally { + removeTreeSync(projectDir) + } + }) + } }) diff --git a/config/scripts/rebuild-native-deps-test-fixtures.mjs b/config/scripts/rebuild-native-deps-test-fixtures.mjs index 585e7a58ef2..2cb7d8ba8b4 100644 --- a/config/scripts/rebuild-native-deps-test-fixtures.mjs +++ b/config/scripts/rebuild-native-deps-test-fixtures.mjs @@ -1,5 +1,12 @@ import { spawnSync } from 'node:child_process' -import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs' +import { + chmodSync, + copyFileSync, + mkdirSync, + mkdtempSync, + readFileSync, + writeFileSync +} from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { fileURLToPath } from 'node:url' @@ -15,6 +22,68 @@ const sourceNodePtyJobOwnershipPath = fileURLToPath( const sourceWindowsProcessTreeGypRebuildPath = fileURLToPath( new URL('./windows-process-tree-gyp-rebuild.mjs', import.meta.url) ) +const sourceWindowsProcessTreePatchPath = fileURLToPath( + new URL('../patches/@vscode__windows-process-tree@0.8.0.patch', import.meta.url) +) + +/** + * The command-line reader as it is *before* the patch, taken from the patch's + * own pre-image so no upstream copy has to be vendored. + * + * Written back as **CRLF**, which is what `@vscode/windows-process-tree@0.8.0` + * actually ships: all 67 pre-image lines of this file carried a CR before the + * patch was normalized to LF. Rebuilding it with the patch's current newline + * instead would make fixture and patch agree by construction, on any encoding — + * which is exactly how a repair that cannot apply to the real package passed + * this suite. + */ +function unpatchedWindowsProcessTreeCommandLineSource() { + const lines = readFileSync(sourceWindowsProcessTreePatchPath, 'utf8').split('\n') + const start = lines.findIndex((line) => + line.startsWith('diff --git a/src/process_commandline.cc ') + ) + const rest = lines.slice(start + 1) + const end = rest.findIndex((line) => line.startsWith('diff --git ')) + const preImage = (end === -1 ? rest : rest.slice(0, end)) + .filter((line) => line.startsWith(' ') || line.startsWith('-')) + .filter((line) => !line.startsWith('---')) + .map((line) => line.slice(1).replace(/\r$/, '')) + .join('\r\n') + // Splitting drops the file's own trailing newline as an empty element, and + // `git apply` needs the bytes exact. + return `${preImage}\r\n` +} + +/** + * Pin `core.autocrlf` for a spawned repair, whatever the host is set to. + * + * The repair blinds git to the surrounding repo with `GIT_DIR`, so the value it + * sees comes from global/system config — on a Git for Windows box that is + * whichever line-ending option the installer wrote, and `false` (Git's built-in + * default, "checkout as-is") is the one the repair used to fail under. A global + * config in a temp HOME outranks the system file, so this is deterministic + * rather than whatever the developer happens to have. + */ +export function gitLineEndingEnv(autocrlf) { + const home = mkdtempSync(join(tmpdir(), `orca-git-home-${autocrlf}-`)) + writeFileSync(join(home, '.gitconfig'), `[core]\n\tautocrlf = ${autocrlf}\n`) + return { HOME: home, USERPROFILE: home } +} + +/** Production always runs the repair from inside a work tree; `git apply` behaves differently there. */ +export function initGitWorkTree(projectDir) { + for (const args of [['init'], ['config', 'user.email', 'a@b.c'], ['config', 'user.name', 't']]) { + spawnSync('git', args, { cwd: projectDir, encoding: 'utf8' }) + } +} + +export function writeWindowsProcessTreePatchFile(projectDir) { + mkdirSync(join(projectDir, 'config', 'patches'), { recursive: true }) + copyFileSync( + sourceWindowsProcessTreePatchPath, + join(projectDir, 'config', 'patches', '@vscode__windows-process-tree@0.8.0.patch') + ) +} export function mkTempProject() { const projectDir = mkdtempSync(join(tmpdir(), 'orca-rebuild-native-deps-')) @@ -143,17 +212,46 @@ if (${JSON.stringify(createExecutable)}) { ) } -export function writeFakeElectronRebuild(projectDir, { logPathEnv = null } = {}) { +/** Bytes that stand in for a compiled addon's import table. */ +const FAKE_ADDON_BYTES = { + clean: 'MZ\0ntdll.dll\0NtQueryInformationProcess\0', + unpatched: 'MZ\0KERNEL32.dll\0ReadProcessMemory\0' +} + +/** + * A rebuild that produces nothing leaves no addon to inspect, and the script now + * asserts the binary it just built is a patched one. Emit a stand-in so the + * fixture models a rebuild that actually succeeded. `addon` picks which kind, + * because "produced the upstream reader" and "produced nothing" are both real + * outcomes that assertion has to tell apart. + */ +export function writeFakeElectronRebuild(projectDir, { logPathEnv = null, addon = 'clean' } = {}) { const rebuildDir = join(projectDir, 'node_modules', '@electron', 'rebuild') mkdirSync(rebuildDir, { recursive: true }) writeFileSync(join(rebuildDir, 'package.json'), JSON.stringify({ type: 'module' })) + const emitAddon = + addon === 'none' + ? '' + : ` + const packageDir = join('node_modules', '@vscode', 'windows-process-tree') + if (existsSync(join(packageDir, 'package.json'))) { + mkdirSync(join(packageDir, 'build', 'Release'), { recursive: true }) + writeFileSync( + join(packageDir, 'build', 'Release', 'windows_process_tree.node'), + ${JSON.stringify(FAKE_ADDON_BYTES[addon])} + ) + }` + const emitImports = + addon === 'none' + ? '' + : "import { existsSync, mkdirSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n" writeFileSync( join(rebuildDir, 'index.js'), logPathEnv ? ` import { appendFileSync } from 'node:fs' - -export async function rebuild(options) { +${emitImports} +export async function rebuild(options) {${emitAddon} const logPath = process.env[${JSON.stringify(logPathEnv)}] if (!logPath) { return @@ -171,7 +269,10 @@ export async function rebuild(options) { ) } ` - : 'export async function rebuild() {}\n' + : `${emitImports} +export async function rebuild() {${emitAddon} +} +` ) } @@ -271,12 +372,22 @@ export function writeFakeWindowsProcessTree(projectDir) { writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n') } -export function writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir) { +export function writeFakeWindowsProcessTreeWithNodeAddonApi( + projectDir, + { commandLinePatchApplied = true } = {} +) { const processTreeDir = join(projectDir, 'node_modules', '@vscode', 'windows-process-tree') const nodeAddonApiDir = join(processTreeDir, 'node_modules', 'node-addon-api') mkdirSync(nodeAddonApiDir, { recursive: true }) writeFileSync(join(processTreeDir, 'package.json'), '{"dependencies":{"node-addon-api":"*"}}\n') writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n') + mkdirSync(join(processTreeDir, 'src'), { recursive: true }) + writeFileSync( + join(processTreeDir, 'src', 'process_commandline.cc'), + commandLinePatchApplied + ? '// kProcessCommandLineInformation = 60\n' + : unpatchedWindowsProcessTreeCommandLineSource() + ) writeFileSync(join(nodeAddonApiDir, 'package.json'), '{"name":"node-addon-api"}\n') writeFileSync(join(nodeAddonApiDir, 'napi.h'), '// napi.h\n') writeFileSync(join(nodeAddonApiDir, 'napi-inl.h'), '// napi-inl.h\n') diff --git a/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs b/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs new file mode 100644 index 00000000000..4f98c1b092d --- /dev/null +++ b/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs @@ -0,0 +1,103 @@ +import { spawn } from 'node:child_process' +import { appendFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs' +import { createRequire } from 'node:module' +import { join } from 'node:path' +import { describe, expect, it } from 'vitest' +import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts' + +import { + mkTempProject, + runRebuildScript, + writeFakeElectronRebuild, + writeFakeNodePtyConptyPayload, + writeFakeUsableElectronPackage, + writeFakeWindowsProcessTreeWithNodeAddonApi +} from './rebuild-native-deps-test-fixtures.mjs' + +const require = createRequire(import.meta.url) + +/** A real loadable addon, so the OS holds the same lock a running Orca holds. */ +function repoAddonPath() { + try { + const entry = require.resolve('@vscode/windows-process-tree') + const built = join(entry, '..', '..', 'build', 'Release', 'windows_process_tree.node') + return existsSync(built) ? built : null + } catch { + return null + } +} + +/** + * Stage a stale addon and keep it loaded, exactly as a running Orca does. + * + * The bytes are the repo's own patched build with the flagged import appended, + * because the guard keys on that symbol and the patched binary does not carry + * it. Trailing bytes are PE overlay, so the file still loads. + */ +async function stageLoadedStaleAddon(projectDir) { + const source = repoAddonPath() + const releaseDir = join( + projectDir, + 'node_modules', + '@vscode', + 'windows-process-tree', + 'build', + 'Release' + ) + mkdirSync(releaseDir, { recursive: true }) + const stale = join(releaseDir, 'windows_process_tree.node') + copyFileSync(source, stale) + appendFileSync(stale, 'ReadProcessMemory') + + const holder = spawn( + process.execPath, + ['-e', 'require(process.argv[1]); process.send("held"); setInterval(() => {}, 1000)', stale], + { stdio: ['ignore', 'ignore', 'ignore', 'ipc'] } + ) + await new Promise((resolve, reject) => { + holder.once('message', resolve) + holder.once('exit', () => reject(new Error('the addon holder exited before loading'))) + }) + return holder +} + +// Why an end-to-end run: the defect was purely one of placement. The guard threw +// a real EPERM, and the classifier that turns that into "close running Orca" +// already existed -- the throw simply happened before the try that reaches it. +// Only the whole script exercises that. +describe.runIf(process.platform === 'win32')('rebuild-native-deps stale addon under lock', () => { + it.skipIf(!repoAddonPath())( + 'reports a locked stale addon as a Windows file lock instead of an EPERM stack', + async () => { + const projectDir = mkTempProject() + let holder + + try { + writeFakeUsableElectronPackage(projectDir, { platform: 'win32' }) + writeFakeElectronRebuild(projectDir) + writeFakeNodePtyConptyPayload(projectDir, process.arch) + writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir) + holder = await stageLoadedStaleAddon(projectDir) + + const result = runRebuildScript( + projectDir, + { + npm_lifecycle_event: 'postinstall', + npm_config_platform: 'win32', + npm_config_arch: process.arch + }, + ['--platform=win32', `--arch=${process.arch}`, '--force'] + ) + + expect(result.stderr).toContain( + 'Close running Orca/Electron/dev processes for this worktree' + ) + // Non-strict postinstall soft-exits on a lock; the next dev/start re-checks. + expect(result.status, result.stderr).toBe(0) + } finally { + holder?.kill() + removeTreeSync(projectDir) + } + } + ) +}) diff --git a/config/scripts/rebuild-native-deps.mjs b/config/scripts/rebuild-native-deps.mjs index 3b17683e831..863aac850a1 100644 --- a/config/scripts/rebuild-native-deps.mjs +++ b/config/scripts/rebuild-native-deps.mjs @@ -20,7 +20,12 @@ import { rebuild } from '@electron/rebuild' import { execFileSync, spawnSync } from 'node:child_process' -import { stageWindowsProcessTreeNodeAddonApiHeaders } from './windows-process-tree-gyp-rebuild.mjs' +import { + ensureWindowsProcessTreeCommandLinePatch, + inspectWindowsProcessTreeAddon, + stageWindowsProcessTreeNodeAddonApiHeaders, + windowsProcessTreeAddonPath +} from './windows-process-tree-gyp-rebuild.mjs' import { copyFileSync, existsSync, @@ -141,15 +146,21 @@ if (!ignoreModules.includes('cpu-features')) { } } -if ( - rebuildPlatform === 'win32' && - modulesToRebuild.includes('@vscode/windows-process-tree') && - existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json')) -) { - stageWindowsProcessTreeNodeAddonApiHeaders() -} - try { + // Why inside the try: the patch guard deletes a stale addon binary, and that + // delete fails EPERM when the addon is loaded -- exactly the running-Orca case + // the catch below is written for. Outside, it aborted `pnpm install` with a + // raw stack instead of the "close running Orca/Electron processes" message. + if ( + rebuildPlatform === 'win32' && + modulesToRebuild.includes('@vscode/windows-process-tree') && + existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json')) + ) { + stageWindowsProcessTreeNodeAddonApiHeaders() + if (ensureWindowsProcessTreeCommandLinePatch()) { + console.warn('[rebuild] Repaired the un-applied windows-process-tree command-line patch.') + } + } await rebuild({ buildPath: projectDir, electronVersion, @@ -165,6 +176,7 @@ try { force: true }) restoreNodePtyWindowsConptyRuntime() + assertWindowsProcessTreeAddonIsPatched() } catch (/** @type {any} */ err) { console.error('[rebuild] Native module rebuild failed:', err?.message ?? err) if (isWindowsNativeLockError(err)) { @@ -184,6 +196,40 @@ try { process.exit(1) } +/** + * The binary this rebuild just produced is the one the packaged app ships. + * + * The relay build asserts its own artifact and `ensure-native-runtime.mjs` + * asserts what it loads, but nothing checked the addon that gets copied into the + * packaged `node_modules` -- so a rebuild that silently produced the upstream + * reader would reach users. Anything but `clean` fails: after a rebuild that + * reported success the binary must exist, so `missing` is a broken build, not an + * absence to shrug at. This is the caller that needs the state to be a state and + * not a boolean. + */ +function assertWindowsProcessTreeAddonIsPatched() { + if ( + rebuildPlatform !== 'win32' || + !modulesToRebuild.includes('@vscode/windows-process-tree') || + !existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json')) + ) { + return + } + const addonPath = windowsProcessTreeAddonPath() + const state = inspectWindowsProcessTreeAddon(addonPath) + if (state === 'clean') { + return + } + throw new Error( + state === 'missing' + ? `the rebuild reported success but ${addonPath} is not there, so the packaged app would ` + + 'ship no windows-process-tree addon at all.' + : `${addonPath} still imports ReadProcessMemory, so it was not built from the patched ` + + 'command-line reader. The packaged app would carry the primitive MDE scores as ' + + 'credential dumping.' + ) +} + function restoreNodePtyWindowsConptyRuntime() { if (rebuildPlatform !== 'win32' || !onlyModules.includes('node-pty')) { return diff --git a/config/scripts/relay-frame-buffer-benchmark.mjs b/config/scripts/relay-frame-buffer-benchmark.mjs new file mode 100644 index 00000000000..24d7b565400 --- /dev/null +++ b/config/scripts/relay-frame-buffer-benchmark.mjs @@ -0,0 +1,62 @@ +#!/usr/bin/env node +import assert from 'node:assert/strict' +import { readFileSync } from 'node:fs' +import { stripTypeScriptTypes } from 'node:module' +import { performance } from 'node:perf_hooks' + +// Pass the pre-change source saved with git show :src/shared/relay-frame-buffer.ts. +const baselinePath = process.argv[2] +if (!baselinePath) { + throw new Error('Usage: node config/scripts/relay-frame-buffer-benchmark.mjs ') +} +async function load(source) { + return ( + await import( + `data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}` + ) + ).RelayFrameBuffer +} +const Before = await load(readFileSync(baselinePath, 'utf8')) +const After = await load( + readFileSync(new URL('../../src/shared/relay-frame-buffer.ts', import.meta.url), 'utf8') +) +function median(values) { + return values.sort((a, b) => a - b)[Math.floor(values.length / 2)] +} +for (const count of [1, 256, 16384, 65536]) { + const chunks = Array.from({ length: count }, (_, index) => Buffer.alloc(64, index % 256)) + const expected = Buffer.concat(chunks) + for (const mode of ['take', 'discard']) { + const times = [[], []] + for (let round = 0; round < 9; round += 1) { + for (const arm of round % 2 === 0 ? [0, 1] : [1, 0]) { + const FrameBuffer = arm === 0 ? Before : After + const buffer = new FrameBuffer() + for (const chunk of chunks) { + buffer.append(chunk) + } + const start = performance.now() + const output = buffer[mode](expected.length) + times[arm].push(performance.now() - start) + if (mode === 'take') { + assert.deepEqual(output, expected) + } + assert.equal(buffer.length, 0) + buffer.append(Buffer.from('tail')) + assert.equal(buffer.drain().toString(), 'tail') + } + } + const beforeMs = median(times[0]), + afterMs = median(times[1]) + console.log( + JSON.stringify({ + mode, + chunks: count, + bytes: expected.length, + beforeMs, + afterMs, + speedup: beforeMs / afterMs + }) + ) + } +} diff --git a/config/scripts/repo-icon-source-href-benchmark.mjs b/config/scripts/repo-icon-source-href-benchmark.mjs new file mode 100644 index 00000000000..76c42d261b4 --- /dev/null +++ b/config/scripts/repo-icon-source-href-benchmark.mjs @@ -0,0 +1,55 @@ +import assert from 'node:assert/strict' +import { performance } from 'node:perf_hooks' +import { extractIconHref } from '../../src/main/repo-icon-source-href.ts' + +// Original production expressions, preserved for the before/after measurement. +const html = + /]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i +const object = + /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i +const original = (source) => source.match(html)?.[1] ?? source.match(object)?.[1] ?? null + +function measurePair(source) { + original(source) + extractIconHref(source) + const beforeSamples = [] + const afterSamples = [] + for (let run = 0; run < 5; run++) { + const measurements = [ + [original, beforeSamples], + [extractIconHref, afterSamples] + ] + if (run % 2 === 1) { + measurements.reverse() + } + for (const [fn, samples] of measurements) { + const started = performance.now() + fn(source) + samples.push(performance.now() - started) + } + } + return { + beforeMs: beforeSamples.sort((a, b) => a - b)[2], + afterMs: afterSamples.sort((a, b) => a - b)[2] + } +} + +const results = [] +for (const size of [8192, 16384, 32768]) { + for (const shape of ['no icon', 'rel without href', 'unterminated link starts']) { + const source = + shape === 'unterminated link starts' + ? '') +} +const source = execFileSync('git', ['show', `${ref}:src/shared/source-scan/source-tree-scan.ts`], { + encoding: 'utf8' +}) +const { blankStringContents: before } = await import( + `data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}` +) +const tokens = [ + 'a', + '/', + '*', + ' ', + '\n', + '\r', + '\t', + '\u00a0', + '\u2028', + '"', + "'", + '`', + '${', + '}', + '{', + '\\', + '(', + ')', + '[', + ']', + '=', + '+', + '-', + ';' +] +let seed = 173 +for (let sample = 0; sample < 3000; sample++) { + let input = '' + for (let token = 0; token < 40; token++) { + seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0 + input += tokens[seed % tokens.length] + } + assert.equal(after(input), before(input), JSON.stringify(input)) + assert.equal(after(input, true), before(input, true), JSON.stringify(input)) +} +function measure(fn, input) { + const samples = [] + for (let run = 0; run < 3; run++) { + const start = performance.now() + fn(input) + samples.push(performance.now() - start) + } + return samples.sort((a, b) => a - b)[1] +} +const results = [] +for (const lines of [100, 1000, 5000, 10000]) { + const input = 'const x = value / 2;\n'.repeat(lines) + assert.equal(after(input), before(input)) + results.push({ + lines, + bytes: Buffer.byteLength(input), + beforeMs: measure(before, input), + afterMs: measure(after, input) + }) +} +console.log( + JSON.stringify( + { node: process.version, platform: process.platform, differentialCases: 3000, results }, + null, + 2 + ) +) diff --git a/config/scripts/windows-process-tree-gyp-rebuild.mjs b/config/scripts/windows-process-tree-gyp-rebuild.mjs index c815407d6d0..20d91e55497 100644 --- a/config/scripts/windows-process-tree-gyp-rebuild.mjs +++ b/config/scripts/windows-process-tree-gyp-rebuild.mjs @@ -9,7 +9,8 @@ * hop escapes the store and configure fails with "node_addon_api.gyp not * found" (run 32999886072). */ -import { copyFileSync, mkdirSync, realpathSync } from 'node:fs' +import { execFileSync } from 'node:child_process' +import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync } from 'node:fs' import { createRequire } from 'node:module' import { dirname, join, resolve } from 'node:path' @@ -22,6 +23,16 @@ export const WINDOWS_PROCESS_TREE_PACKAGE_DIR = join( 'windows-process-tree' ) +export const WINDOWS_PROCESS_TREE_PATCH_PATH = join( + ROOT, + 'config', + 'patches', + '@vscode__windows-process-tree@0.8.0.patch' +) + +/** Only the patched reader defines this; the upstream one walks the PEB. */ +const COMMAND_LINE_PATCH_MARKER = 'kProcessCommandLineInformation' + export const WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS = [ 'napi.h', 'napi-inl.h', @@ -39,6 +50,119 @@ export function nodeGypRebuildInvocation(arch, packageDir = WINDOWS_PROCESS_TREE } } +/** The binary the addon actually loads. */ +export function windowsProcessTreeAddonPath(packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR) { + return join(packageDir, 'build', 'Release', 'windows_process_tree.node') +} + +/** The import whose absence tells the patched binary from the published prebuilt. */ +const FLAGGED_IMPORT = 'ReadProcessMemory' + +/** + * Does this compiled addon still carry the flagged primitive? + * + * The patched reader never calls `ReadProcessMemory`, so the symbol is absent + * from its import table; the upstream build imports it. That makes this a + * property of the binary rather than of the source next to it, which matters + * because the published tarball ships a *loadable* prebuilt built from + * unpatched source: it is node-addon-api, so it satisfies a bare `require()` + * under both Node and Electron, and a skipped rebuild would use it. + * + * Tri-state, not a predicate: a binary that is not there has not been cleared, + * and a boolean makes "absent" indistinguishable from "verified clean" at every + * call site. Takes the binary path so the relay's staged addon -- which sits + * beside the bundle, with no package around it -- gets the same check. + * + * @param {string} addonPath + * @returns {'clean' | 'unpatched' | 'missing'} + */ +export function inspectWindowsProcessTreeAddon(addonPath) { + if (!existsSync(addonPath)) { + return 'missing' + } + return readFileSync(addonPath).includes(FLAGGED_IMPORT) ? 'unpatched' : 'clean' +} + +/** + * Refuse to compile or load the upstream command-line reader. + * + * Unpatched, it opens every process with `PROCESS_VM_READ` and walks the PEB to + * recover the command line -- the primitive MDE scores as credential dumping, + * and the reason this package is patched at all. pnpm has been seen + * materializing this CRLF package with its patch missing, so repair the source + * from the patch file, and drop any binary that predates the repair. + */ +export function ensureWindowsProcessTreeCommandLinePatch( + packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR +) { + const source = join(packageDir, 'src', 'process_commandline.cc') + if (!existsSync(source)) { + throw new Error( + `${source} is missing, so the command-line patch cannot be verified. Run pnpm install.` + ) + } + let repaired = false + + if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) { + try { + execFileSync( + 'git', + [ + // Why force the line-ending mode: the patch is stored LF (a contract + // test forbids CR bytes in it), but upstream ships this source CRLF, + // so its pre-image lines and the file's differ by a CR. Under + // `core.autocrlf=false` -- Git's own built-in default, and what + // "checkout as-is" selects in the Git for Windows installer -- git + // compares them literally, the hunk does not match, and the repair + // throws. `input` normalizes line endings for that comparison and + // nothing else, so a hunk whose real content drifted is still + // rejected. Measured: without it, apply exits 1 at autocrlf=false and + // 0 at true/input; with it, 0 for CRLF and LF sources under all three. + '-c', + 'core.autocrlf=input', + 'apply', + '--include=src/process_commandline.cc', + WINDOWS_PROCESS_TREE_PATCH_PATH + ], + { + cwd: realpathSync(packageDir), + stdio: 'pipe', + // Why blind git to the repo: run inside a work tree, `git apply` + // prefixes patch paths with the cwd-relative prefix, silently skips + // everything that does not match -- and still exits 0. The package + // dir is always under the project root, so without this the repair + // reports success and changes nothing. + env: { ...process.env, GIT_DIR: join(packageDir, '.orca-no-such-git-dir') } + } + ) + } catch (error) { + throw new Error( + 'src/process_commandline.cc still reads the PEB, and repairing it from ' + + `${WINDOWS_PROCESS_TREE_PATCH_PATH} failed: ${error?.message ?? error}. Run pnpm install.` + ) + } + if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) { + throw new Error( + 'src/process_commandline.cc still reads the PEB after repair, so the patch did not ' + + 'apply. Run pnpm install.' + ) + } + repaired = true + } + + // A binary from before the repair -- or the tarball's own prebuilt -- would + // otherwise survive a skipped rebuild and load the flagged reader anyway. + // Deleting it can fail EPERM against a loaded (memory-mapped) addon, which + // `force: true` does not cover -- it only swallows ENOENT. That throw is the + // caller's to classify as a Windows file lock, so it must not be swallowed. + if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath(packageDir)) === 'unpatched') { + rmSync(windowsProcessTreeAddonPath(packageDir), { force: true }) + repaired = true + } + + return repaired +} + // Patched binding.gyp includes deps/node-addon-api; the tarball does not ship those headers. export function stageWindowsProcessTreeNodeAddonApiHeaders( packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR diff --git a/config/scripts/windows-process-tree-gyp-rebuild.test.mjs b/config/scripts/windows-process-tree-gyp-rebuild.test.mjs index f4820e9430a..f2939b71179 100644 --- a/config/scripts/windows-process-tree-gyp-rebuild.test.mjs +++ b/config/scripts/windows-process-tree-gyp-rebuild.test.mjs @@ -10,8 +10,9 @@ import { } from 'node:fs' import { tmpdir } from 'node:os' import { join, resolve } from 'node:path' -import { describe, expect, it } from 'vitest' +import { afterEach, beforeEach, describe, expect, it } from 'vitest' import { + inspectWindowsProcessTreeAddon, nodeGypRebuildInvocation, stageWindowsProcessTreeNodeAddonApiHeaders, WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS, @@ -59,3 +60,40 @@ describe('windows-process-tree node-gyp rebuild', () => { } }) }) + +describe('inspecting a compiled windows-process-tree addon', () => { + let dir + + beforeEach(() => { + dir = mkdtempSync(join(tmpdir(), 'orca-windows-process-tree-addon-')) + }) + afterEach(() => { + rmSync(dir, { recursive: true, force: true }) + }) + + it('reports a binary that still imports ReadProcessMemory as unpatched', () => { + const addonPath = join(dir, 'windows_process_tree.node') + writeFileSync(addonPath, Buffer.from('MZ\0\0KERNEL32.dll\0ReadProcessMemory\0', 'binary')) + expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('unpatched') + }) + + it('reports a binary without the import as clean', () => { + const addonPath = join(dir, 'windows_process_tree.node') + writeFileSync(addonPath, Buffer.from('MZ\0\0ntdll.dll\0NtQueryInformationProcess\0', 'binary')) + expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('clean') + }) + + // The whole point of the tri-state: absence is not evidence of safety, and a + // boolean made "there is no binary" indistinguishable from "checked, clean". + it('reports an absent binary as missing rather than clean', () => { + expect(inspectWindowsProcessTreeAddon(join(dir, 'windows_process_tree.node'))).toBe('missing') + }) + + it('inspects whatever path it is handed, including a relay-staged addon', () => { + // The relay loads `./windows-process-tree.node` beside its bundle, which is + // nowhere near a node_modules package directory. + const staged = join(dir, 'windows-process-tree.node') + writeFileSync(staged, Buffer.from('MZ\0\0ReadProcessMemory\0', 'binary')) + expect(inspectWindowsProcessTreeAddon(staged)).toBe('unpatched') + }) +}) diff --git a/config/scripts/workflow-ref-mirror-case-safety.test.mjs b/config/scripts/workflow-ref-mirror-case-safety.test.mjs index 6008c9d8d5f..31366f5e489 100644 --- a/config/scripts/workflow-ref-mirror-case-safety.test.mjs +++ b/config/scripts/workflow-ref-mirror-case-safety.test.mjs @@ -15,6 +15,16 @@ const REF_MIRRORS = [ ] describe('ref-mirroring vet steps', () => { + it('keeps the full-history adhoc checkout on the same case-safe backend', () => { + const steps = readWorkflow('.github/workflows/adhoc-mac-build.yml').jobs['build-adhoc-mac'] + .steps + const checkout = steps.find((step) => step.name === 'Checkout the requested ref') + expect(checkout.env.GIT_DEFAULT_REF_FORMAT).toBe('reftable') + expect(checkout.with.ref).toBe('${{ steps.vetted.outputs.sha }}') + expect(checkout.with['fetch-depth']).toBe(0) + expect(checkout.with['persist-credentials']).toBe(false) + }) + // Why: macOS and Windows runner disks are case-insensitive, and this repo has // branches that differ only in casing. The files backend cannot store both, and // it fails the whole fetch rather than the one ref — so the vet step dies before diff --git a/config/scripts/workflow-ref-reachability.test.mjs b/config/scripts/workflow-ref-reachability.test.mjs new file mode 100644 index 00000000000..d71c3094c56 --- /dev/null +++ b/config/scripts/workflow-ref-reachability.test.mjs @@ -0,0 +1,125 @@ +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { pathToFileURL } from 'node:url' +import { afterAll, beforeAll, describe, expect, it } from 'vitest' +import { parse } from 'yaml' +import { runProcess } from '../../src/shared/child-process/run-process' + +const readWorkflow = (name) => parse(readFileSync(`.github/workflows/${name}.yml`, 'utf8')) +const windowsVet = readWorkflow('dev-channel-win-build').jobs['build-win'].steps.find( + (step) => step.id === 'vetted' +) +const macSteps = readWorkflow('adhoc-mac-build').jobs['build-adhoc-mac'].steps +const macVet = macSteps.find((step) => step.id === 'vetted') +const macCheckout = macSteps.find((step) => step.name === 'Checkout the requested ref') +const directory = mkdtempSync(join(tmpdir(), 'workflow-ref-reachability-')) +const repository = join(directory, 'remote.git') +const identity = { + ...process.env, + GIT_AUTHOR_NAME: 'Ref test', + GIT_AUTHOR_EMAIL: 'ref-test@example.com', + GIT_COMMITTER_NAME: 'Ref test', + GIT_COMMITTER_EMAIL: 'ref-test@example.com' +} +let ancestor, upper, lower, untrusted + +async function git(args, env = identity) { + const result = await runProcess({ program: 'git', args, env }) + expect(result.code, result.stderr).toBe(0) + return result.stdout.trim() +} + +beforeAll(async () => { + await git(['init', '--bare', '--ref-format=reftable', repository]) + const tree = await git(['-C', repository, 'mktree']) + ancestor = await git(['-C', repository, 'commit-tree', tree, '-m', 'ancestor']) + upper = await git(['-C', repository, 'commit-tree', tree, '-p', ancestor, '-m', 'upper']) + lower = await git(['-C', repository, 'commit-tree', tree, '-p', ancestor, '-m', 'lower']) + untrusted = await git(['-C', repository, 'commit-tree', tree, '-m', 'PR only']) + for (const [ref, sha] of [ + ['refs/heads/Fix', upper], + ['refs/heads/fix', lower], + ['refs/pull/1/head', untrusted] + ]) { + await git(['-C', repository, 'update-ref', ref, sha]) + } + await git(['-C', repository, 'tag', '-a', 'Release', upper, '-m', 'upper tag']) + await git(['-C', repository, 'tag', '-a', 'release', lower, '-m', 'lower tag']) + await git(['-C', repository, 'config', 'uploadpack.allowFilter', 'true']) +}) + +afterAll(() => rmSync(directory, { recursive: true, force: true })) + +async function vet(step, ref) { + const scratch = mkdtempSync(join(directory, 'attempt-')) + const script = join(scratch, 'vet.sh') + writeFileSync(script, step.run) + return runProcess({ + program: 'bash', + args: [script], + env: { + ...identity, + REPO_URL: pathToFileURL(repository).href, + RUNNER_TEMP: scratch, + GITHUB_OUTPUT: join(scratch, 'output'), + REQUESTED_REF: ref, + REQUESTED_SHA: ref, + CHANNEL: 'hourly', + TAG: 'v1.0.0-hourly.test', + VERSION: '1.0.0-hourly.test' + } + }) +} + +describe('release ref trust with case-twin names', () => { + it('accepts both branch tips, annotated tags, and their common ancestor', async () => { + for (const sha of [upper, lower, ancestor]) { + const result = await vet(windowsVet, sha) + expect(result.code, result.stderr).toBe(0) + } + for (const ref of ['Fix', 'fix', 'Release', 'release', ancestor]) { + const result = await vet(macVet, ref) + expect(result.code, result.stderr).toBe(0) + } + }) + + it('rejects PR-only commits even when the server has their objects', async () => { + for (const step of [windowsVet, macVet]) { + const result = await vet(step, untrusted) + expect(result.code).not.toBe(0) + expect(result.stdout).toContain('not reachable from any branch or tag') + } + const result = await vet(macVet, 'refs/pull/1/head') + expect(result.code).not.toBe(0) + expect(result.stdout).toContain('Refusing to build PR ref') + }) + + it('preserves both case variants in the subsequent full-history checkout', async () => { + const checkout = join(directory, 'checkout') + const env = { ...identity, ...macCheckout.env } + await git(['init', checkout], env) + await git( + [ + '-C', + checkout, + 'fetch', + '--no-tags', + repository, + '+refs/heads/*:refs/remotes/origin/*', + '+refs/tags/*:refs/tags/*' + ], + env + ) + await git(['-C', checkout, 'checkout', '--detach', upper], env) + for (const [ref, sha] of [ + ['refs/remotes/origin/Fix', upper], + ['refs/remotes/origin/fix', lower], + ['refs/tags/Release', upper], + ['refs/tags/release', lower] + ]) { + expect(await git(['-C', checkout, 'rev-parse', `${ref}^{commit}`], env)).toBe(sha) + } + expect(await git(['-C', checkout, 'rev-parse', 'HEAD'], env)).toBe(upper) + }) +}) diff --git a/docs/reference/ci-runner-efficiency.md b/docs/reference/ci-runner-efficiency.md index a9f644bc435..6d688598097 100644 --- a/docs/reference/ci-runner-efficiency.md +++ b/docs/reference/ci-runner-efficiency.md @@ -131,3 +131,69 @@ environments currently exist. An environment-gated design adds a GitHub approval after each SignPath approval and changes the current automatic inner signing timeout fallback; those are explicit release-policy decisions, so this PR leaves production signing behavior unchanged. + +## Second audit and hosted trials + +- Cloud Verify ran 100 times in a sampled 39-hour window (84 PR and 16 push + runs). Move its four Ubuntu 22.04 jobs from Blacksmith to standard hosted + Ubuntu 22.04, preserving Postgres, secret scanning, build, tests, and Terraform + validation. Baseline [34001538145](https://github.com/stablyai/orca/actions/runs/34001538145) + used 64/72/26/19 seconds for security/test/build/Terraform respectively. + This conserves the shared provider allowance; hosted latency must be checked. +- Keep full tag history for the 13-job skill round-trip matrix, but fetch blobs + lazily. Only two historical SKILL.md files are materialized. Baseline + [33999994876](https://github.com/stablyai/orca/actions/runs/33999994876) + spent 42–84 seconds per checkout, about 14 aggregate runner minutes. A hosted + trial must verify historical blob fetches on all three operating systems. +- Use the existing Electron/native dependency cache for native IME CI. Keep + both deterministic boundary and real IBus tests. Add pnpm store caching to + terminal perf and release golden/evidence lanes; retain their raw installs + because manually selected older refs may not contain the shared action. +- Disable ZIP recompression only for already-compressed NSIS installers sent + to SignPath. Installer contents, release compression, and signing stay intact. +- Advance existing placement and startup deadlines with scoped fake timers in + three renderer test files. All 34 tests pass in 62 ms of local test execution, + versus 65.182 seconds in the sampled hosted baseline. Imports and transforms + still dominate invocation time; this is not a claim of equal PR wall savings. + +Eight unit shards already have balanced 260–296-second sample durations. +Reducing shards or removing test isolation lacks evidence of a net gain. Real +subprocess tests intentionally cover lifecycle behavior and retain real clocks. +The 14-way E2E split retains headroom after earlier 12-way timeouts. Lowering +coverage or schedule frequency is outside this efficiency pass. Cache complexity +for a seven-second docs install is unlikely to pay back. Release build reuse +across modes risks differing telemetry identities and native platform artifacts. + +Terminal Perf's baseline [33955846492](https://github.com/stablyai/orca/actions/runs/33955846492) +failed waiting 30 seconds for workspaceSessionReady in its shared-page fixture, +before measuring terminal performance. Compare hosted trials against that known +failure rather than attributing it to dependency cache changes. + +Hosted trials for the second audit: + +- [Cloud Verify 34002295216](https://github.com/stablyai/orca/actions/runs/34002295216) + passed all four jobs on standard hosted Ubuntu: security 57s, test 102s, build + 35s, Terraform 19s. The test lane is 30s slower than the Blacksmith sample; + retain this modest latency tradeoff to conserve shared allowance. +- [Skill matrix 34002295221](https://github.com/stablyai/orca/actions/runs/34002295221) + passed all 13 legs, including historical blob materialization. Checkout took + 18–20s on Linux, 39–45s on macOS, and 49–58s on Windows, versus the earlier + 42–84s range across platforms. These are observational samples. +- [Native IME 34002299594](https://github.com/stablyai/orca/actions/runs/34002299594) + passed both deterministic and real IBus checks. Shared dependency setup took + 29s, versus 35s for the old install/toolchain steps in the sampled baseline. +- Native-IME-only source/spec changes no longer allocate the reusable E2E + build, cache, and consumer jobs just to filter out the native spec. The + separate native workflow still runs; SSH-only and mixed spec lists still + allocate the reusable workflow. Routing contracts exercise these cases. +- [Hourly 34001816449](https://github.com/stablyai/orca/actions/runs/34001816449) + exercised the new five-second preflight and successfully published macOS. + The Windows follow-up failed in its unchanged input-vetting fetch because + remote refs differ only by case on its case-insensitive filesystem. The + requested SHA was correct; this does not validate an unchanged-main skip yet. + +Moving the daily Mac freshness check has lower expected value than hourly: +only one potential idle allocation per day, and active development usually +requires that build. Defer another release-graph change until skip frequency +justifies it. The substantive remaining release occupancy opportunity is the +separately documented asynchronous signing policy decision. diff --git a/docs/reference/windows-daemon-host-relocation.md b/docs/reference/windows-daemon-host-relocation.md new file mode 100644 index 00000000000..f560597e25e --- /dev/null +++ b/docs/reference/windows-daemon-host-relocation.md @@ -0,0 +1,118 @@ +# Windows daemon-host relocation + +On Windows the terminal daemon does not run from the install directory. Before it forks the +daemon, Orca materializes a trimmed copy of its own runtime under +`%LOCALAPPDATA%\Orca\daemon-host\\` and forks the daemon from there +(`src/main/daemon/daemon-host-relocation.ts`). This is what keeps live terminals alive across an +auto-update and across a crash of the main process. + +Read this before changing the copy plan, the host exe name, the LOCALAPPDATA layout, or +`config/nsis/orca-installer-hooks.nsh`. + +## What the relocation actually escapes + +The killer is **electron-builder's process sweep, matched on image path** — not file deletion. +Windows will not delete a running image, so `RMDir /r "$INSTDIR"` cannot end the daemon on its own. + +In app-builder-lib's `allowOnlyOneInstallerInstance.nsh`, `FIND_PROCESS` / `KILL_PROCESS` have two +branches: + +| Branch | Condition | Selector | +| -------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Primary | `powershell.exe` runs, `Get-CimInstance` resolves, and `Get-ExecutionPolicy -Scope Process` is not `Restricted` | `Win32_Process` where `$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')` — **path-scoped** | +| Fallback | otherwise | per-user: `taskkill /F /IM ".exe" /FI "PID ne $pid" /FI "USERNAME eq %USERNAME%"`; per-machine: the same without the username filter — **image-name-scoped** | + +The probe reads the **process** scope, not the effective policy, and Group Policy writes +`MachinePolicy`/`UserPolicy` — so a GPO-managed host whose effective policy is `Restricted` still +exits 0 and takes the primary branch. The fallback is reached only when `powershell.exe` is absent, +`Get-CimInstance` does not resolve, PowerShell is blocked outright (WDAC/AppLocker, Server Core), or +an inherited `PSExecutionPolicyPreference=Restricted` is in the environment. + +So on essentially every machine the sweep is path-scoped, and a daemon whose image lives under +`%LOCALAPPDATA%` is out of range regardless of what the file is called. **Survival is a property of +the path.** The name only matters on the fallback branch. + +## Why the exe is copied verbatim (and not renamed) + +The host exe keeps the app exe's own file name (`daemonHostExeName()` returns +`basename(process.execPath)`), so the relocated image is a byte-for-byte copy of the app binary +under its original name. + +An earlier revision copied it as `orca-terminal-daemon.exe` specifically so the fallback +`taskkill /IM Orca.exe` could not match. That bought survival on the rare no-PowerShell host and +cost a textbook defence-evasion signature: _a process copies its own image into a user-writable +directory under a different name so a kill-by-image-name cannot match it, then runs detached and +survives the installer._ Microsoft Defender for Endpoint flagged it as MITRE **T1036 +(Masquerading)**, and — because it is the process every other flagged action is attributed to — it +acted as a reputation multiplier on unrelated findings. No VS Code fork does this. + +Trading the fallback branch for the name is the right trade: + +- On the primary branch nothing changes: the daemon still survives the update. +- On the fallback branch the daemon is killed with the app and terminals **cold-restore** on + relaunch. That is the documented pre-relocation behaviour, a first-class outcome the update + harness already asserts (`--expect cold-restore`), not a failure. +- Relocation is fail-open end to end anyway: any materialization failure returns `null` and the + caller forks the install-dir host. + +One new failure mode comes with it, on the fallback branch only. The daemon now matches +`FIND_PROCESS` under the app's image name, so it enters electron-builder's retry loop +(`allowOnlyOneInstallerInstance.nsh:136-141`). If the `taskkill` there fails to end it — an elevated +or otherwise unkillable host — the loop reaches `MessageBox ... /SD IDCANCEL` and `Quit`s, aborting a +silent update rather than completing it. Under the old distinct name the daemon was invisible to +that loop. Low probability (fallback branch _and_ an unkillable daemon), but it is a real new path. + +What this does **not** buy. Two things bound the win honestly: + +- The strongest T1036 indicator is a PE-resource-vs-disk-name mismatch, and it was **never firing**: + the shipped binary's `OriginalFilename` is empty (only `InternalName = Orca` is set), so there was + no embedded name for the old disk name to contradict. +- The remaining behaviour — a signed app copying its own ~225 MB image into user-writable + `%LOCALAPPDATA%` and running it detached under `ELECTRON_RUN_AS_NODE=1` — is still execution from + a non-standard user-writable location, which maps to **T1036.005** and is a standard heuristic on + its own. + +So this removes a real but partial signal. Expect the score to drop; do not expect the process to +stop being scored. + +## Options that were rejected + +| Option | Why not | +| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Materialize the tree from the NSIS installer | The daemon host is ~246 MB. Writing it at install time doubles install footprint and lengthens the window in which the app is down during a silent update. Worse, on a per-machine install (`INSTALL_MODE_PER_ALL_USERS`) the installer runs as the installing admin, so `$LOCALAPPDATA` is the wrong user's — every other user still needs the runtime path, which means the runtime self-copy stays in the product and the signal is only made rarer. | +| Ship a second signed `orca-terminal-daemon.exe` in the installer | `Orca.exe` is 235,555,328 bytes (224.6 MiB). electron-builder's NSIS uses solid LZMA with a 64 MB dictionary, so a second copy 224 MB downstream does not dedupe; the compressed installer grows by roughly a whole compressed Electron binary, paid by every user on every update download. It also does not remove the runtime copy — the helper still has to reach `%LOCALAPPDATA%` to escape the sweep — so it buys the same signal reduction as the verbatim copy at a large download cost. | +| Override `customCheckAppRunning` to force a path-scoped kill on both branches | Cheap to write (~6 lines: `!include "getProcessInfo.nsh"`, `Var pid`, and a macro that pins `IsPowerShellAvailable`, reusing upstream's dialog, retry loop and elevated handling) — but wrong at any size. Forcing the PowerShell branch on a host where PowerShell is genuinely absent makes `FIND_PROCESS` and `KILL_PROCESS` silently no-op, so the installer proceeds with the **real app** still running and its files in use. That is a worse outcome than the cold restore it would prevent, so this is not worth doing ever, not merely not now. | +| Hardlink instead of copy | Avoids the 246 MB entirely and is not a "copy" at all, but is NTFS-and-same-volume-only and introduces fresh failure modes (link counts, AV interception, cross-volume installs). Worth revisiting deliberately, not as part of a signal fix. | + +## Invariants to preserve + +- The host exe name is **derived from `process.execPath`**, never a literal. A future + `executableName` or dev-channel rename must follow automatically; pinning a name of our own is + how the mismatch creeps back. +- The daemon is identified by **PID and command line**, never by image name — in the product + (`daemon-pid-file-parse`, `daemon-process-inspection`) and in the harness + (`tests/tools/win-update-e2e/daemon-processes.mjs`). Nothing may start matching on the exe name. +- `config/nsis/orca-installer-hooks.nsh` kills the daemon by image name. That now also matches the + app's own exe, which is correct on a genuine uninstall — the product is being removed — but its + `${isUpdated}` guard must stay: electron-builder runs the uninstaller during every update's + `uninstallOldVersion`, and killing the daemon there defeats the whole feature. The legacy + `orca-terminal-daemon.exe` name stays in the macro to reap hosts left by older builds. +- `LOCAL_HOST_ROOT_NAME` in `daemon-host-relocation.ts` and the path in the uninstall macro are the + same directory. Change both together. + +## Verifying a change + +Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, verbatim +naming, marker/atomic publish, fail-open, prune veto). Nothing in unit tests can prove survival, so +any change to this file or to the NSIS macro needs the packaged harnesses: + +- `.github/workflows/win-update-survival-e2e.yml` — builds an installer from the branch and updates + it over itself with `--expect survival`. The primary proof. +- `.github/workflows/win-crash-survival-e2e.yml` — proves the daemon survives a main-process crash. +- `.github/workflows/windows-terminal-restart-e2e.yml` — terminal restart behaviour. +- `.github/workflows/win-update-e2e.yml` — release-tag-to-release-tag update, both `survival` and + `cold-restore` profiles. + +All four are `workflow_dispatch`-only (the two update workflows also carry a push trigger pinned to +one historical feature branch), so they must be dispatched by hand against this branch before +merging a change here — which requires the workflow files to already exist on `main`. diff --git a/docs/reference/windows-edr-posture.md b/docs/reference/windows-edr-posture.md index 1f6ac777f17..24854890fc7 100644 --- a/docs/reference/windows-edr-posture.md +++ b/docs/reference/windows-edr-posture.md @@ -50,25 +50,37 @@ and `orca-terminal-daemon.exe` report `Valid CN=SignPath Foundation`. ## The behaviours, and why each one exists -### The daemon runs from a renamed copy of our own image +### The daemon runs from a copy of our own image `src/main/daemon/daemon-host-relocation.ts` copies the Electron runtime into -`%LOCALAPPDATA%\Orca\daemon-host\\` and renames `Orca.exe` to -`orca-terminal-daemon.exe`. The comment on `DAEMON_HOST_EXE_NAME` states the -reason without varnish: _"so the NSIS updater's `taskkill /IM Orca.exe` can't -match it."_ +`%LOCALAPPDATA%\Orca\daemon-host\\` and forks the terminal daemon from +there. It exists because the NSIS installer deletes the old install directory and force- kills every process imaged under it. Without relocation, an auto-update kills the terminal daemon and every live terminal with it. The copy is a run-as-node `Orca.exe` rather than `node.exe` so there is no console flash and asar still -resolves; `config/nsis/daemon-host-uninstall.nsh` reaps it on a real uninstall +resolves; `config/nsis/orca-installer-hooks.nsh` reaps it on a real uninstall (guarded by `${isUpdated}` so an update's `uninstallOldVersion` never fires it). -**How an EDR reads it: MITRE T1036, masquerading.** A signed executable copied -out of the install directory into `%LOCALAPPDATA%` under a different name, which -then spawns shells, matches the textbook description closely enough that no -behavioural engine can be expected to score it low. +**At the time of these incidents the copy was also renamed** to +`orca-terminal-daemon.exe`, the image name every incident here reports, and +`DAEMON_HOST_EXE_NAME`'s comment stated the reason without varnish: _"so the NSIS +updater's `taskkill /IM Orca.exe` can't match it."_ The rename has since been +removed; the copy now keeps the app exe's own file name, because the updater's +kill sweep is path-scoped on every host that has PowerShell and the rename only +ever bought the no-PowerShell fallback. See +[`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md). + +**How an EDR reads it: MITRE T1036, masquerading** — and, for what remains, +**T1036.005**. A signed executable copied out of the install directory into +`%LOCALAPPDATA%` under a different name, which then spawns shells, matches the +textbook description closely enough that no behavioural engine can be expected to +score it low. Dropping the rename removes that literal indicator but not the +underlying shape: execution from a non-standard user-writable location is scored +on its own. Note also that the strongest form of the T1036 signal was never +present here — the shipped binary's `OriginalFilename` is empty, so there was no +embedded name for the old disk name to contradict. ### Every process gets a handle, on a timer @@ -245,7 +257,8 @@ obfuscated-command-line detector is tuned on. ### The spawn tree itself -`Orca.exe` → `orca-terminal-daemon.exe` → a shell → an agent CLI is what a +`Orca.exe` → the relocated daemon host (`orca-terminal-daemon.exe` in the builds +these incidents cover, `Orca.exe` since) → a shell → an agent CLI is what a terminal multiplexer for coding agents *is*. `reg.exe` appears from `src/main/win32-utils.ts`, `src/main/agent-hooks/managed-hook-owner-identity.ts` and @@ -376,7 +389,7 @@ The checklist. On Windows, do not reach for: | Forking `powershell.exe` to read system state | The native reader — [`windows-process-enumeration.md`](./windows-process-enumeration.md) is the standing rule for the process table | | A process per operation in a loop | One long-lived helper with a request channel. A burst of short-lived interpreters under one parent is itself the signal | | `Add-Type -TypeDefinition` at runtime | A precompiled, signed assembly, or a native helper | -| Copying our own image under a different name | An installer or updater that does not need the rename. Where the rename is load-bearing, document it as such | +| Copying our own image under a different name | Copy it verbatim — [`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md) (done for the daemon host) | | Deriving a script runner from a UI preference | [`windows-setup-shell.md`](./windows-setup-shell.md) — the script declares its own interpreter | Two framing rules that outlast the table: diff --git a/docs/reference/windows-process-enumeration.md b/docs/reference/windows-process-enumeration.md index 7dc9a3d1213..34afb56c8e6 100644 --- a/docs/reference/windows-process-enumeration.md +++ b/docs/reference/windows-process-enumeration.md @@ -344,7 +344,7 @@ on any other OS keeps using the scan. ## Why the package is patched -`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries three hunks. +`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries four hunks. 1. **Spectre mitigation.** The upstream `binding.gyp` requires Spectre-mitigated libraries, which Orca's Windows build agents do not install. `node-pty` is @@ -359,10 +359,122 @@ on any other OS keeps using the scan. realpath, then loads the relative path from the `node_modules` symlink, so `node_addon_api.gyp` resolves outside the repo and hourly Windows builds die at configure. `node-pty` is patched the same way for the same reason. +4. **No PEB reads, no `PROCESS_VM_READ`.** See below. The typings claim `commandLine` is truncated at 512 characters. Measured, it is not: the longest observed on a real host was 26,059. +### The command line comes from the kernel, not the target's memory + +Upstream, `GetProcessCommandLine` opens every process with +`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and issues three chained +`ReadProcessMemory` calls — PEB, `RTL_USER_PROCESS_PARAMETERS`, then the string +— to recover the command line. Walking another process's address space for +credentials-adjacent data on a repeating timer is what a credential dumper does, +so Defender for Endpoint scores it as such regardless of intent. Nothing about +the flag sets above changes that; only removing the read does. + +Windows 8.1 added `NtQueryInformationProcess`'s `ProcessCommandLineInformation` +class (60), which returns the same string as a `UNICODE_STRING` the kernel +builds, needing only `PROCESS_QUERY_LIMITED_INFORMATION`. Electron's floor is +Windows 10, so every OS Orca supports has it. The entry point is resolved with +`GetProcAddress` on `ntdll.dll` — it has no import library — and the size is +probed with a null-buffer call that answers `STATUS_INFO_LENGTH_MISMATCH`. + +The same hunk drops `PROCESS_VM_READ` from `GetProcessMemoryUsage` and +`GetCpuUsage`, which acquired it and never read an address space: +`GetProcessMemoryInfo` and `GetProcessTimes` are satisfied by +`PROCESS_QUERY_LIMITED_INFORMATION`. Measured, both return identical values +under the weaker right on every process that opens at all. + +Measured on Windows 11, ~540 processes, counted in-process by replacing the +addon's import table entries with counting stubs: + +| per `CommandLine` scan | before | after | +| ---------------------- | ----------------------------------------- | -------------------------------------- | +| `OpenProcess` calls | 543 | 543 | +| desired access | `0x0410` (`VM_READ \| QUERY_INFORMATION`) | `0x1000` (`QUERY_LIMITED_INFORMATION`) | +| `ReadProcessMemory` | 1128 | **0** | +| p50 / p95 | 13.5 / 14.5 ms | 12.3 / 13.5 ms | + +Command lines were byte-identical on every process both readers recovered +(405/405, and 399/399 and 376/376 on other runs), including a 24,087-character +argv with embedded quotes, non-ASCII characters and trailing whitespace, and a +WOW64 target. The weaker right is also a strict superset in reach: three +processes that refused `PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` granted +`PROCESS_QUERY_LIMITED_INFORMATION`, and none went the other way. + +### There is no PEB fallback, deliberately + +An earlier revision kept the PEB reader for a kernel without class 60, behind a +latch. That was wrong, and the reason is worth recording: `ClassifyQueryFailure` +mapped `STATUS_INVALID_INFO_CLASS` / `NOT_SUPPORTED` / `NOT_IMPLEMENTED` from +**any single target** onto a process-wide, one-way switch back to +`PROCESS_VM_READ` plus three `ReadProcessMemory` per pid per scan, for the life +of the process, with nothing observable from JS. + +The environment this reader exists for is one where an EDR hooks `ntdll`. A hook +that returns `STATUS_INVALID_INFO_CLASS` for a class it does not recognise would +have silently reinstated the exact primitive the patch removes, on precisely the +machines it was written for — and one stray status from one process was enough. +The same applies under Wine or any instrumented `ntdll`. + +So the fallback is gone rather than guarded. `GetProcessCommandLine` returns +false and leaves the command line empty, which is already a normal outcome +(`WindowsProcessRow.command` is documented as empty when a process denies a +query handle, and callers fall back to the image name). Degrading to no command +line is recoverable; silently resuming address-space reads is not. + +This also makes the property checkable on the artifact rather than the source: +the patched reader never calls `ReadProcessMemory`, so the symbol is absent from +the compiled addon's import table. `inspectWindowsProcessTreeAddon()` in +`config/scripts/windows-process-tree-gyp-rebuild.mjs` is that check, and it is +the only way to tell the two binaries apart — see below. It answers +`clean` / `unpatched` / `missing` rather than a boolean, because a binary that is +not there has not been cleared, and a caller reading `false` as “verified” would +pass exactly the thing the check exists to catch. + +Because the returned `UNICODE_STRING` comes from that same hookable boundary, +its `Buffer` and `Length` are bounds-checked against the allocation before the +characters are encoded, and the probed size is capped at the header plus 64 KiB +(`Length` is a `USHORT`) so a bogus size cannot turn into a `bad_alloc` that +fails an entire scan instead of one process. + +### The published tarball ships a loadable unpatched prebuilt + +`@vscode/windows-process-tree@0.8.0` publishes +`build/Release/windows_process_tree.node` in the tarball. It is node-addon-api, +so it is ABI-stable and loads cleanly under both Node and Electron — and it was +built from unpatched source, so it performs 1179 `ReadProcessMemory` calls and +opens every process at `0x0410` per scan. + +That matters because `allowBuilds` is `false` for this package and CI installs +with `--ignore-scripts`, so nothing compiles it at install time. A `require()` +health check cannot tell the two binaries apart, and a rebuild that is skipped — +`rebuild-native-deps.mjs` soft-exits 0 on a Windows file lock during postinstall +— leaves the upstream prebuilt in place and cached. + +Four checks close that, all keyed on the absent `ReadProcessMemory` import: + +- `ensureWindowsProcessTreeCommandLinePatch()` deletes a binary that still has + it, so a skipped rebuild fails loudly instead of using the prebuilt; +- `ensure-native-runtime.mjs` treats such a binary as a load failure, which is + what triggers the rebuild; +- the relay build asserts it on the artifact it just produced; +- `loadWindowsProcessTree()` asserts it again on the addon staged beside a relay + bundle and refuses to bind one that still imports the symbol, falling back to + the CIM scan. The build-time assertion is not enough on its own: a bundle and + the addon beside it redeploy independently, so a host that has not taken a new + bundle keeps whatever `.node` is already there. + +What none of this does is narrow _which_ processes are asked. A detailed scan +still queries every pid, including `lsass.exe`; it now asks with the same right +Task Manager uses instead of `PROCESS_VM_READ`. Restricting the command-line +pass to Orca's own subtree is the complementary change, and it belongs with the +identity/detailed reader split rather than here — a ppid-derived allowlist would +miss exactly the detached, reparented descendants the trackers exist to find +(#9045, #10475), so it needs the job-object membership as its source of truth. + ## Packaging The addon is Windows-only, so it follows the same contract as @@ -376,6 +488,10 @@ The addon is Windows-only, so it follows the same contract as `ensure-native-runtime.mjs`; - copied into the packaged `node_modules` for win32 only. +The relay's copy is a separate artifact staged beside the bundle, so a relay host +only picks up a rebuilt addon on redeploy. Until then it keeps whatever binary it +already has, which is why the addon is checked again at load. + ## What the snapshot does not provide `CreationDate` (process start time) has no equivalent. Anything using a start diff --git a/mobile/src/components/mobile-markdown-preview-html.ts b/mobile/src/components/mobile-markdown-preview-html.ts index 8bb5fca0934..a5866b171e6 100644 --- a/mobile/src/components/mobile-markdown-preview-html.ts +++ b/mobile/src/components/mobile-markdown-preview-html.ts @@ -204,11 +204,18 @@ function escapeRegExp(value: string): string { } function codePlaceholderPrefix(content: string): string { - let prefix = CODE_PLACEHOLDER_PREFIX_BASE - while (content.includes(prefix)) { - prefix = `${prefix}_` + let suffixLength = 0 + let cursor = 0 + while ((cursor = content.indexOf(CODE_PLACEHOLDER_PREFIX_BASE, cursor)) !== -1) { + cursor += CODE_PLACEHOLDER_PREFIX_BASE.length + const suffixStart = cursor + while (content[cursor] === '_') { + cursor += 1 + } + // One extra underscore keeps the prefix longer than every authored run. + suffixLength = Math.max(suffixLength, cursor - suffixStart + 1) } - return prefix + return CODE_PLACEHOLDER_PREFIX_BASE + '_'.repeat(suffixLength) } function protectMarkdownCode(content: string): { diff --git a/mobile/src/components/mobile-markdown-preview-placeholder.test.ts b/mobile/src/components/mobile-markdown-preview-placeholder.test.ts new file mode 100644 index 00000000000..f751608af78 --- /dev/null +++ b/mobile/src/components/mobile-markdown-preview-placeholder.test.ts @@ -0,0 +1,33 @@ +import { describe, expect, it } from 'vitest' +import { normalizeMobileMarkdownPreviewHtml } from './mobile-markdown-preview-html' + +const marker = '\uE000ORCA_MD_CODE_' +const suffix = '\uE000' + +describe('mobile Markdown code placeholder collisions', () => { + it.each([0, 1, 2, 15, 128, 16384])('preserves a literal marker with %i underscores', (length) => { + const literal = `${marker}${'_'.repeat(length)}0${suffix}` + const input = `${literal} and \`Array\`\n\n\`\`\`html\n

literal

\n\`\`\`` + expect(normalizeMobileMarkdownPreviewHtml(input)).toBe(input) + }) + + it('handles adjacent markers and repeated maximum suffixes', () => { + const literal = `${marker}${marker}__0${suffix}${marker}__1${suffix}${marker}_2${suffix}` + expect(normalizeMobileMarkdownPreviewHtml(`

${literal} and \`

\`

`)).toBe( + `${literal} and \`
\`` + ) + }) + + it('preserves authored markers across generated suffix orders and HTML islands', () => { + let seed = 173 + for (let sample = 0; sample < 500; sample++) { + const literals: string[] = [] + for (let index = 0; index < 8; index++) { + seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0 + literals.push(`${marker}${'_'.repeat(seed % 32)}${index}${suffix}`) + } + const text = literals.join(' ') + ' and `Array`' + expect(normalizeMobileMarkdownPreviewHtml(`

${text}

`)).toBe(text) + } + }) +}) diff --git a/mobile/src/session/mobile-native-chat-autocomplete.ts b/mobile/src/session/mobile-native-chat-autocomplete.ts index 548d0614837..8de107c9fb0 100644 --- a/mobile/src/session/mobile-native-chat-autocomplete.ts +++ b/mobile/src/session/mobile-native-chat-autocomplete.ts @@ -81,7 +81,7 @@ export function rankSuggestions(candidates: readonly string[], query: string, li const substring: string[] = [] for (const candidate of candidates) { const lower = candidate.toLowerCase() - const base = lower.split('/').pop() ?? lower + const base = lower.slice(lower.lastIndexOf('/') + 1) if (lower.startsWith(q) || base.startsWith(q)) { prefix.push(candidate) } else if (lower.includes(q)) { diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.ts b/mobile/src/transport/mobile-direct-endpoint-probe.ts index 03264d5f7e5..038f73b93b8 100644 --- a/mobile/src/transport/mobile-direct-endpoint-probe.ts +++ b/mobile/src/transport/mobile-direct-endpoint-probe.ts @@ -31,7 +31,14 @@ export function directPathForEndpoint( // instead of holding the supervisor's operation mutex for the full outer bound. const RECONNECT_GRACE_MS = 2_000 -function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Promise { +function waitForAuthenticatedSession( + session: RpcClient, + timeoutMs: number, + signal?: AbortSignal +): Promise { + if (signal?.aborted) { + return Promise.reject(new Error('probe cancelled')) + } if (session.getState() === 'connected') { return Promise.resolve() } @@ -72,7 +79,13 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro finish() reject(new Error('probe session authentication timed out')) }, timeoutMs) + const onAbort = (): void => { + finish() + reject(new Error('probe cancelled')) + } + signal?.addEventListener('abort', onAbort, { once: true }) function finish(): void { + signal?.removeEventListener('abort', onAbort) if (timer) { clearTimeout(timer) } @@ -87,8 +100,12 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro export async function openAuthenticatedDirectEndpoint( host: HostProfile, openDirect: (endpoint: string) => RpcClient, - timeoutMs: number + timeoutMs: number, + signal?: AbortSignal ): Promise<{ client: RpcClient; path: Exclude } | null> { + if (signal?.aborted) { + return null + } const endpoints = directEndpointUrls(host) return await new Promise((resolve) => { const clients = new Set() @@ -110,8 +127,13 @@ export async function openAuthenticatedDirectEndpoint( continue } clients.add(client) - void waitForAuthenticatedSession(client, timeoutMs).then( + void waitForAuthenticatedSession(client, timeoutMs, signal).then( () => { + if (signal?.aborted) { + client.close() + rejectCandidate() + return + } if (settled) { client.close() return diff --git a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts new file mode 100644 index 00000000000..535790ed480 --- /dev/null +++ b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts @@ -0,0 +1,175 @@ +import { expect, it, vi } from 'vitest' +import { + dependencies, + FakeLogicalClient, + FakeSession, + host +} from './mobile-endpoint-supervisor-test-fakes' +import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis' +import { createStableLogicalRpcClient } from './stable-logical-rpc-client' +import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor' +vi.mock('react-native', () => ({ Platform: { OS: 'ios' } })) +vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' })) +vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) })) +it('closes in-flight candidates and clears their timeout when the owner stops', async () => { + vi.useFakeTimers() + try { + const candidate = new FakeSession('connecting') + const logical = new FakeLogicalClient('connected', 'relay') + const deps = dependencies({ openDirect: vi.fn(() => candidate) }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + await supervisor.start() + await vi.advanceTimersByTimeAsync(15_000) + expect(deps.openDirect).toHaveBeenCalledOnce() + supervisor.stop() + await vi.advanceTimersByTimeAsync(0) + expect(candidate.close).toHaveBeenCalledOnce() + expect(vi.getTimerCount()).toBe(0) + await vi.advanceTimersByTimeAsync(12_000) + expect(vi.getTimerCount()).toBe(0) + expect(candidate.close).toHaveBeenCalledOnce() + expect(logical.migrateTo).not.toHaveBeenCalled() + expect(deps.openDirect).toHaveBeenCalledOnce() + } finally { + vi.restoreAllMocks() + vi.useRealTimers() + } +}) + +it('closes an authenticated candidate when stop races its completion', async () => { + vi.useFakeTimers() + try { + const candidate = new FakeSession('connecting') + const logical = new FakeLogicalClient('connected', 'relay') + const deps = dependencies({ openDirect: vi.fn(() => candidate) }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + await supervisor.start() + await vi.advanceTimersByTimeAsync(15_000) + candidate.publishState('connected') + supervisor.stop() + await vi.advanceTimersByTimeAsync(0) + expect(candidate.close).toHaveBeenCalledOnce() + expect(logical.migrateTo).not.toHaveBeenCalled() + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.restoreAllMocks() + vi.useRealTimers() + } +}) + +it('preserves an in-flight probe across a transient background pause', async () => { + vi.useFakeTimers() + try { + const candidate = new FakeSession('connecting') + const logical = new FakeLogicalClient('connected', 'relay') + const deps = dependencies({ openDirect: vi.fn(() => candidate) }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + await supervisor.start() + await vi.advanceTimersByTimeAsync(15_000) + supervisor.setForeground(false) + await vi.advanceTimersByTimeAsync(0) + expect(candidate.close).not.toHaveBeenCalled() + supervisor.stop() + await vi.advanceTimersByTimeAsync(0) + expect(candidate.close).toHaveBeenCalledOnce() + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.restoreAllMocks() + vi.useRealTimers() + } +}) + +it('releases every candidate when multiple endpoint probes are pending', async () => { + vi.useFakeTimers() + try { + const candidates: FakeSession[] = [] + const logical = new FakeLogicalClient('connected', 'relay') + const deps = dependencies({ + openDirect: vi.fn(() => { + const candidate = new FakeSession('connecting') + candidates.push(candidate) + return candidate + }) + }) + const supervisor = new MobileEndpointSupervisor( + logical, + { + ...host, + endpoints: [{ id: 'alternate', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }] + }, + deps + ) + await supervisor.start() + await vi.advanceTimersByTimeAsync(15_000) + expect(candidates).toHaveLength(2) + supervisor.stop() + await vi.advanceTimersByTimeAsync(0) + expect(vi.getTimerCount()).toBe(0) + for (const candidate of candidates) { + expect(candidate.close).toHaveBeenCalledOnce() + candidate.publishState('connected') + } + await vi.advanceTimersByTimeAsync(60_000) + expect(logical.migrateTo).not.toHaveBeenCalled() + expect(deps.openDirect).toHaveBeenCalledTimes(2) + expect(vi.getTimerCount()).toBe(0) + } finally { + vi.restoreAllMocks() + vi.useRealTimers() + } +}) + +it.each([false, true])( + 'fences migration finishing after stop (already swapped: %s)', + async (alreadySwapped) => { + vi.useFakeTimers() + try { + const recordedMigration = vi.spyOn(MobileEndpointHysteresis.prototype, 'recordMigration') + const relay = new FakeSession('connected') + const logical = createStableLogicalRpcClient(relay, 'relay') + const candidates: FakeSession[] = [] + const deps = dependencies({ + openDirect: vi.fn(() => { + const candidate = new FakeSession('connected') + candidates.push(candidate) + return candidate + }) + }) + const supervisor = new MobileEndpointSupervisor(logical, host, deps) + const migrate = logical.migrateTo.bind(logical) + let release!: () => void + const pending = new Promise((resolve) => { + release = resolve + }) + const migration = vi.spyOn(logical, 'migrateTo').mockImplementation(async (...args) => { + if (alreadySwapped) { + await migrate(...args) + } + await pending + if (!alreadySwapped) { + await migrate(...args) + } + }) + await supervisor.start() + await vi.advanceTimersByTimeAsync(60_000) + expect(migration).toHaveBeenCalledOnce() + const requestsBeforeStop = relay.sendRequest.mock.calls.length + const candidateRequestsBeforeStop = candidates[3].sendRequest.mock.calls.length + const migrationsBeforeStop = recordedMigration.mock.calls.length + supervisor.stop() + release() + await vi.advanceTimersByTimeAsync(0) + expect(logical.getActivePath()).toBe(alreadySwapped ? 'lan' : 'relay') + expect(logical.getGeneration()).toBe(alreadySwapped ? 2 : 1) + expect(relay.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop) + expect(candidates[3].sendRequest).toHaveBeenCalledTimes(candidateRequestsBeforeStop) + expect(recordedMigration).toHaveBeenCalledTimes(migrationsBeforeStop) + expect(candidates[3].close).toHaveBeenCalledTimes(alreadySwapped ? 0 : 1) + expect(vi.getTimerCount()).toBe(0) + logical.close() + } finally { + vi.restoreAllMocks() + vi.useRealTimers() + } + } +) diff --git a/mobile/src/transport/mobile-direct-return-probe.ts b/mobile/src/transport/mobile-direct-return-probe.ts index dfb0572aa38..3ae31edd07f 100644 --- a/mobile/src/transport/mobile-direct-return-probe.ts +++ b/mobile/src/transport/mobile-direct-return-probe.ts @@ -11,6 +11,9 @@ const DIRECT_PROBE_INTERVAL_MS = 15_000 export class DirectReturnProbe { private timer: ReturnType | null = null + private stopped = false + private activeProbe: AbortController | null = null + constructor( private readonly deps: { now: () => number @@ -24,14 +27,18 @@ export class DirectReturnProbe { canSchedule: () => boolean canAttempt: () => boolean beginOperation: () => void - migrate: (client: RpcClient, path: MobileConnectionPath) => Promise + migrate: ( + client: RpcClient, + path: MobileConnectionPath, + shouldAbort: () => boolean + ) => Promise onDirectMigrated: () => Promise afterProbe: () => void } ) {} schedule(delayMs = DIRECT_PROBE_INTERVAL_MS): void { - if (!this.hooks.canSchedule() || this.timer) { + if (this.stopped || !this.hooks.canSchedule() || this.timer) { return } this.timer = this.deps.setTimer(() => { @@ -47,19 +54,34 @@ export class DirectReturnProbe { } } + stop(): void { + this.stopped = true + this.clear() + this.activeProbe?.abort() + } + private async probe(): Promise { + if (this.stopped) { + return + } if (!this.hooks.canAttempt() || !this.hooks.hysteresis.canProbe(this.deps.now())) { this.schedule() return } + const controller = new AbortController() + this.activeProbe = controller this.hooks.beginOperation() let successful: Awaited> = null try { successful = await openAuthenticatedDirectEndpoint( this.hooks.host(), this.deps.openDirect, - 12_000 + 12_000, + controller.signal ) + if (this.stopped) { + return + } if (!successful) { this.hooks.hysteresis.recordDirectFailure(this.deps.now()) return @@ -68,11 +90,24 @@ export class DirectReturnProbe { successful.client.close() return } - await this.hooks.migrate(successful.client, successful.path) + const candidate = successful + // Migration owns the candidate, including closing it if cutover is canceled. successful = null + try { + await this.hooks.migrate(candidate.client, candidate.path, () => this.stopped) + } catch (error) { + if (this.stopped) { + return + } + throw error + } + if (this.stopped) { + return + } this.hooks.hysteresis.recordMigration(this.deps.now()) await this.hooks.onDirectMigrated() } finally { + this.activeProbe = null successful?.client.close() // Why: a relay drop or backoff timer can arrive while the probe owns the // operation mutex; afterProbe releases it and replays deferred recovery. diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts index 6fca6c0cc17..9ba12f35112 100644 --- a/mobile/src/transport/mobile-endpoint-supervisor.ts +++ b/mobile/src/transport/mobile-endpoint-supervisor.ts @@ -120,7 +120,7 @@ export class MobileEndpointSupervisor { canSchedule: () => this.isActive() && this.logical.getActivePath() === 'relay', canAttempt: () => this.isActive() && !this.operationInFlight, beginOperation: () => (this.operationInFlight = true), - migrate: (client, path) => this.logical.migrateTo(client, path), + migrate: (client, path, abort) => this.logical.migrateTo(client, path, undefined, abort), onDirectMigrated: async () => { this.leaseRotation.clear() this.relayRotationPending = false @@ -195,6 +195,7 @@ export class MobileEndpointSupervisor { stop(): void { this.stopped = true + this.directProbe.stop() this.unsubscribeState?.() this.unsubscribeState = null this.backgroundGrace.stop() diff --git a/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts b/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts new file mode 100644 index 00000000000..59426fc42da --- /dev/null +++ b/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts @@ -0,0 +1,109 @@ +import { describe, expect, it } from 'vitest' +import { RuntimeBrowserScreencastController } from '../../../src/main/runtime/runtime-browser-screencast-controller' +import type { RuntimeBrowserCommands } from '../../../src/main/runtime/orca-runtime-browser' +import type { BrowserScreencastResult } from '../../../src/shared/runtime-types' +import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams' +import type { RpcResponse } from './types' + +describe('relay browser cancellation resource budget', () => { + it.each([false, true])('stops host frames when cancellation precedes ready=%s', async (early) => { + const subscriptions = new Map void | Promise>() + const done = Promise.withResolvers() + const ready = Promise.withResolvers() + let sequence = 0 + let stopped = false + let frameSends = 0 + let frameBytes = 0 + let sendBinary: (bytes: Uint8Array) => boolean | void = () => false + let hostRun: Promise | undefined + const methods: string[] = [] + const cleanup = (id: string): void => { + const release = subscriptions.get(id) + subscriptions.delete(id) + void release?.() + } + const host = new RuntimeBrowserScreencastController({ + getCommands: () => + ({ + browserScreencast: async (_params, stream) => { + sendBinary = stream.sendBinary + return { + subscriptionId: 'server-stream', + ready: { type: 'ready', subscriptionId: 'server-stream', browserPageId: 'page' }, + session: { + done: done.promise, + stop: () => { + stopped = true + done.resolve() + } + }, + flushPendingFrame: () => {} + } + } + }) as RuntimeBrowserCommands, + registerSubscriptionCleanup: (id, release) => subscriptions.set(id, release), + cleanupSubscription: cleanup, + getDriver: () => ({ kind: 'idle' }), + setDriver: () => {}, + notifyRemoteViewersChanged: () => {} + }) + const streams = new MobileRelayRpcStreams({ + nextId: () => `request-${++sequence}`, + waitForConnected: async () => {}, + sendFrame: (request) => { + methods.push(request.method) + if (request.method === 'browser.screencast' && (request.params as { page?: string }).page) { + hostRun = host.start(request.params as Parameters[0], { + connectionId: 'relay-connection', + sendBinary: (bytes) => { + frameSends++ + frameBytes += bytes.byteLength + return true + }, + emit: (result: BrowserScreencastResult) => { + if (result.type === 'ready') { + ready.resolve({ + id: request.id, + ok: true, + streaming: true, + result, + _meta: { runtimeId: 'host' } + }) + } + } + }) + } else if (request.method === 'browser.screencast.unsubscribe') { + cleanup((request.params as { subscriptionId: string }).subscriptionId) + } + return true + } + }) + const cancel = streams.subscribe('browser.screencast', { page: 'page' }, () => {}) + try { + const response = await ready.promise + if (early) { + cancel() + } + streams.handleResponse(response) + if (!early) { + cancel() + } + for (let frame = 0; frame < 100; frame++) { + if (!stopped) { + sendBinary(new Uint8Array(65_536)) + } + } + expect({ stopped, subscriptions: subscriptions.size, frameSends, frameBytes }).toEqual({ + stopped: true, + subscriptions: 0, + frameSends: 0, + frameBytes: 0 + }) + expect(methods).toEqual(['browser.screencast', 'browser.screencast.unsubscribe']) + } finally { + cleanup('server-stream') + await hostRun + streams.clear() + } + }) +}) diff --git a/mobile/src/transport/mobile-relay-rpc-session.test.ts b/mobile/src/transport/mobile-relay-rpc-session.test.ts index 5887dffc73d..4bf617faf50 100644 --- a/mobile/src/transport/mobile-relay-rpc-session.test.ts +++ b/mobile/src/transport/mobile-relay-rpc-session.test.ts @@ -136,6 +136,36 @@ describe('mobile relay RPC session', () => { }) afterEach(() => vi.useRealTimers()) + it('releases stream listeners on failure even when close follows it', async () => { + const { session } = await authenticateSession() + const listener = vi.fn() + session.subscribe('runtime.clientEvents.subscribe', {}, listener) + await Promise.resolve() + const request = JSON.parse(fakes.sendText.mock.calls[0]![0] as string) as { id: string } + fakes.linkOptions!.onText( + JSON.stringify({ + id: request.id, + ok: true, + streaming: true, + result: { type: 'ready', subscriptionId: 'server-events' }, + _meta: { runtimeId: 'runtime-1' } + }) + ) + expect(listener).toHaveBeenCalledTimes(1) + fakes.linkOptions!.onError(new Error('relay lost')) + session.close() + fakes.linkOptions!.onText( + JSON.stringify({ + id: request.id, + ok: true, + streaming: true, + result: { type: 'event' }, + _meta: { runtimeId: 'runtime-1' } + }) + ) + expect(listener).toHaveBeenCalledTimes(1) + }) + it('requires exact resume observations and confirms by request ID before becoming connected', async () => { const { session, confirmationRequest, capabilityRequest } = await authenticateSession() diff --git a/mobile/src/transport/mobile-relay-rpc-session.ts b/mobile/src/transport/mobile-relay-rpc-session.ts index 203a0329192..67b50ea591e 100644 --- a/mobile/src/transport/mobile-relay-rpc-session.ts +++ b/mobile/src/transport/mobile-relay-rpc-session.ts @@ -294,6 +294,7 @@ export function connectMobileRelayRpcSession(args: { closed = true failure = error livenessWatchdog.stop(livenessIdentity) + streams.clear() link.close() pending.rejectAll(error) publishState(error instanceof MobileE2EEAuthenticationError ? 'auth-failed' : 'disconnected') diff --git a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts new file mode 100644 index 00000000000..0a7a25dfbd7 --- /dev/null +++ b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts @@ -0,0 +1,259 @@ +import { describe, expect, it, vi } from 'vitest' +import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams' +import type { RpcResponse } from './types' + +function createStreams(waitForConnected = async () => {}) { + let sequence = 0 + const sendFrame = vi.fn((_request: { id: string; method: string; params?: unknown }) => true) + const streams = new MobileRelayRpcStreams({ + nextId: () => `request-${++sequence}`, + sendFrame, + waitForConnected + }) + return { streams, sendFrame } +} + +function response(id: string, result: unknown): RpcResponse { + return { id, ok: true, streaming: true, result, _meta: { runtimeId: 'test' } } +} + +const serverSubscriptions = [ + ['browser.screencast', 'browser.screencast.unsubscribe'], + ['runtime.clientEvents.subscribe', 'runtime.clientEvents.unsubscribe'] +] as const + +describe('mobile relay subscription cancellation', () => { + it.each(serverSubscriptions)('cleans up ready %s exactly once', async (method, unsubscribe) => { + const { streams, sendFrame } = createStreams() + const listener = vi.fn() + const cancel = streams.subscribe(method, {}, listener) + await Promise.resolve() + streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' })) + cancel() + cancel() + expect(sendFrame.mock.calls).toEqual([ + [{ id: 'request-1', method, params: {} }], + [{ id: 'request-2', method: unsubscribe, params: { subscriptionId: 'server-1' } }] + ]) + expect(streams.handleResponse(response('request-1', { type: 'end' }))).toBe(false) + expect(listener).toHaveBeenCalledTimes(1) + }) + + it.each(serverSubscriptions)( + 'cleans up late-ready %s without calling disposed listeners', + async (method, unsubscribe) => { + const { streams, sendFrame } = createStreams() + const listener = vi.fn() + const cancel = streams.subscribe(method, {}, listener) + await Promise.resolve() + cancel() + cancel() + expect(sendFrame).toHaveBeenCalledTimes(1) + expect(streams.handleResponse(response('request-1', { type: 'starting' }))).toBe(true) + streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' })) + expect(sendFrame).toHaveBeenLastCalledWith({ + id: 'request-2', + method: unsubscribe, + params: { subscriptionId: 'server-1' } + }) + expect( + streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' })) + ).toBe(false) + expect(listener).not.toHaveBeenCalled() + } + ) + + it.each(['error', 'end', 'disconnect', 'completed'])( + 'forgets cancelled cleanup routes on %s', + async (ending) => { + const { streams, sendFrame } = createStreams() + const cancel = streams.subscribe('browser.screencast', {}, vi.fn()) + await Promise.resolve() + cancel() + if (ending === 'disconnect') { + streams.clear() + } else if (ending === 'completed') { + streams.handleResponse({ + id: 'request-1', + ok: true, + result: null, + _meta: { runtimeId: 'test' } + }) + } else if (ending === 'error') { + streams.handleResponse({ + id: 'request-1', + ok: false, + error: { code: 'unsupported', message: 'failed' }, + _meta: { runtimeId: 'test' } + }) + } else { + streams.handleResponse(response('request-1', { type: 'end', subscriptionId: 'server-1' })) + } + expect( + streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' })) + ).toBe(false) + expect(sendFrame).toHaveBeenCalledTimes(1) + } + ) + + it.each([ + [ + 'terminal.subscribe', + { terminal: 'term', client: { id: 'phone' } }, + 'terminal.unsubscribe', + { subscriptionId: 'term:phone', client: { id: 'phone' } } + ], + [ + 'session.tabs.subscribe', + { worktree: 'id:workspace' }, + 'session.tabs.unsubscribe', + { worktree: 'id:workspace', subscriptionId: 'request-1' } + ], + [ + 'nativeChat.subscribe', + { subscriptionId: 'chat' }, + 'nativeChat.unsubscribe', + { subscriptionId: 'chat' } + ] + ])( + 'cancels %s using its request cleanup identity', + async (method, params, unsubscribe, unsubscribeParams) => { + const { streams, sendFrame } = createStreams() + const cancel = streams.subscribe(method as string, params, vi.fn()) + await Promise.resolve() + if (method === 'session.tabs.subscribe') { + streams.handleResponse(response('request-1', { type: 'snapshot' })) + } + cancel() + expect(sendFrame).toHaveBeenLastCalledWith({ + id: 'request-2', + method: unsubscribe, + params: unsubscribeParams + }) + } + ) + + it.each([ + 'terminal.subscribe', + 'browser.screencast', + 'runtime.clientEvents.subscribe', + 'session.tabs.subscribe', + 'nativeChat.subscribe' + ])('does not unsubscribe an unsent %s', async (method) => { + const wait = Promise.withResolvers() + const { streams, sendFrame } = createStreams(() => wait.promise) + const cancel = streams.subscribe( + method, + { terminal: 'term', worktree: 'id:workspace', subscriptionId: 'chat' }, + vi.fn() + ) + cancel() + wait.resolve() + await Promise.resolve() + expect(sendFrame).not.toHaveBeenCalled() + expect( + streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' })) + ).toBe(false) + }) + + it.each([false, true])( + 'preserves a same-worktree sibling when cancellation precedes snapshot=%s', + async (early) => { + const { streams, sendFrame } = createStreams() + const first = vi.fn() + const second = vi.fn() + const cancel = streams.subscribe( + 'session.tabs.subscribe', + { worktree: 'id:workspace' }, + first + ) + streams.subscribe('session.tabs.subscribe', { worktree: 'id:workspace' }, second) + await Promise.resolve() + if (early) { + cancel() + } + expect(sendFrame).toHaveBeenCalledTimes(2) + streams.handleResponse(response('request-1', { type: 'snapshot' })) + if (!early) { + cancel() + } + expect(sendFrame).toHaveBeenLastCalledWith({ + id: 'request-3', + method: 'session.tabs.unsubscribe', + params: { worktree: 'id:workspace', subscriptionId: 'request-1' } + }) + streams.handleResponse(response('request-2', { type: 'snapshot' })) + streams.handleResponse(response('request-2', { type: 'updated' })) + expect(second).toHaveBeenCalledTimes(2) + expect(first).toHaveBeenCalledTimes(early ? 0 : 1) + expect(streams.handleResponse(response('request-1', { type: 'updated' }))).toBe(false) + } + ) + + it.each([ + ['nativeChat.subscribe', { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }], + ['terminal.subscribe', { terminal: 'term', client: { id: 'phone' } }] + ])( + 'keeps the newer %s live when an older same-token subscription unmounts', + async (method, params) => { + const { streams, sendFrame } = createStreams() + const older = vi.fn() + const newer = vi.fn() + const cancelOlder = streams.subscribe(method, params, older) + const cancelNewer = streams.subscribe(method, { ...params }, newer) + await Promise.resolve() + expect(sendFrame).toHaveBeenCalledTimes(2) + cancelOlder() + // The host keys cleanup by the deterministic token, so unsubscribing would evict the newer. + expect(sendFrame).toHaveBeenCalledTimes(2) + streams.handleResponse(response('request-2', { type: 'snapshot' })) + expect(newer).toHaveBeenCalledTimes(1) + expect(streams.handleResponse(response('request-1', { type: 'snapshot' }))).toBe(false) + expect(older).not.toHaveBeenCalled() + cancelNewer() + expect(sendFrame).toHaveBeenCalledTimes(3) + expect(sendFrame).toHaveBeenLastCalledWith( + expect.objectContaining({ method: method.replace(/\.subscribe$/, '.unsubscribe') }) + ) + } + ) + + it('still unsubscribes a shared-token nativeChat stream when the sibling is unsent', async () => { + const wait = Promise.withResolvers() + let connected = false + const { streams, sendFrame } = createStreams(() => + connected ? Promise.resolve() : wait.promise + ) + const params = { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' } + connected = true + const cancelOlder = streams.subscribe('nativeChat.subscribe', params, vi.fn()) + await Promise.resolve() + connected = false + streams.subscribe('nativeChat.subscribe', params, vi.fn()) + cancelOlder() + expect(sendFrame).toHaveBeenCalledTimes(2) + expect(sendFrame).toHaveBeenLastCalledWith({ + id: 'request-3', + method: 'nativeChat.unsubscribe', + params: { subscriptionId: 'claude:s1' } + }) + }) + + it('cleans up every cancelled server subscription across repeated late-ready cycles', async () => { + const { streams, sendFrame } = createStreams() + const listener = vi.fn() + for (let i = 0; i < 100; i++) { + const cancel = streams.subscribe('runtime.clientEvents.subscribe', {}, listener) + await Promise.resolve() + const requestId = `request-${2 * i + 1}` + cancel() + streams.handleResponse(response(requestId, { type: 'ready', subscriptionId: `server-${i}` })) + } + expect( + sendFrame.mock.calls.filter( + ([request]) => (request as { method: string }).method === 'runtime.clientEvents.unsubscribe' + ) + ).toHaveLength(100) + expect(listener).not.toHaveBeenCalled() + }) +}) diff --git a/mobile/src/transport/mobile-relay-rpc-streams.ts b/mobile/src/transport/mobile-relay-rpc-streams.ts index 2eacbd2168f..abb2c12564b 100644 --- a/mobile/src/transport/mobile-relay-rpc-streams.ts +++ b/mobile/src/transport/mobile-relay-rpc-streams.ts @@ -4,9 +4,11 @@ import { type TerminalSnapshotState } from './rpc-client-terminal-binary-frame' import { + buildStreamUnsubscribe, buildTerminalUnsubscribeParams, updateTerminalSubscriptionViewport } from './rpc-client-terminal-subscription' +import { buildReadyStreamUnsubscribe } from './rpc-client-server-subscription' import type { RpcClient } from './rpc-client' import type { RpcResponse, RpcSuccess } from './types' @@ -22,6 +24,23 @@ type StreamRecord = { streamIds: Set subscriptionId?: string cancelled: boolean + sent: boolean + receivedSnapshot?: boolean +} + +type StreamUnsubscribe = { method: string; params: unknown } + +/** Unsubscribe derived from the subscribe params alone (no server-assigned id). */ +function buildParamsUnsubscribe( + method: string, + params: unknown, + requestId: string +): StreamUnsubscribe | null { + if (method === 'terminal.subscribe') { + const unsubscribeParams = buildTerminalUnsubscribeParams(params) + return unsubscribeParams ? { method: 'terminal.unsubscribe', params: unsubscribeParams } : null + } + return buildStreamUnsubscribe(method, params, requestId) } type StreamManagerOptions = { @@ -32,6 +51,10 @@ type StreamManagerOptions = { export class MobileRelayRpcStreams { private readonly streams = new Map() + private readonly cancelledSubscriptions = new Map< + string, + { method: string; unsubscribe?: StreamUnsubscribe } + >() private readonly terminalListeners = new Map void>() private readonly terminalSnapshots = new Map() private activeBrowserStream: StreamRecord | null = null @@ -51,13 +74,15 @@ export class MobileRelayRpcStreams { listener, onBinaryFrame: subscribeOptions?.onBinaryFrame, streamIds: new Set(), - cancelled: false + cancelled: false, + sent: false } this.streams.set(id, stream) void this.options .waitForConnected() .then(() => { if (!stream.cancelled) { + stream.sent = true if (!this.options.sendFrame({ id, method, params: stream.params })) { this.fail(id, stream, 'Connection interrupted') } @@ -75,6 +100,30 @@ export class MobileRelayRpcStreams { } handleResponse(response: RpcResponse): boolean { + const cancelled = this.cancelledSubscriptions.get(response.id) + if (cancelled) { + if (!response.ok) { + this.cancelledSubscriptions.delete(response.id) + } else if (response.result && typeof response.result === 'object') { + const result = response.result as { subscriptionId?: unknown; type?: unknown } + if (result.type === 'end') { + this.cancelledSubscriptions.delete(response.id) + } else if (result.type === 'snapshot' && cancelled.unsubscribe) { + this.cancelledSubscriptions.delete(response.id) + this.options.sendFrame({ id: this.options.nextId(), ...cancelled.unsubscribe }) + } else if (typeof result.subscriptionId === 'string') { + this.cancelledSubscriptions.delete(response.id) + const unsubscribe = buildReadyStreamUnsubscribe(cancelled.method, result.subscriptionId) + if (unsubscribe) { + this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe }) + } + } + } + if (response.ok && response.streaming !== true) { + this.cancelledSubscriptions.delete(response.id) + } + return true + } const stream = this.streams.get(response.id) if (!stream) { return false @@ -86,6 +135,9 @@ export class MobileRelayRpcStreams { const result = (response as RpcSuccess).result if (result && typeof result === 'object') { const metadata = result as { subscriptionId?: unknown; streamId?: unknown; type?: unknown } + if (stream.method === 'session.tabs.subscribe' && metadata.type === 'snapshot') { + stream.receivedSnapshot = true + } if (typeof metadata.subscriptionId === 'string') { stream.subscriptionId = metadata.subscriptionId } @@ -125,6 +177,7 @@ export class MobileRelayRpcStreams { stream.cancelled = true } this.streams.clear() + this.cancelledSubscriptions.clear() this.terminalListeners.clear() this.terminalSnapshots.clear() this.activeBrowserStream = null @@ -136,25 +189,61 @@ export class MobileRelayRpcStreams { return } stream.cancelled = true - if (stream.method === 'terminal.subscribe') { - const params = buildTerminalUnsubscribeParams(stream.params) - if (params) { - this.options.sendFrame({ - id: this.options.nextId(), - method: 'terminal.unsubscribe', - params - }) + if (stream.sent) { + const byParams = buildParamsUnsubscribe(stream.method, stream.params, id) + if (stream.method === 'terminal.subscribe') { + if (byParams) { + this.sendUnsubscribe(byParams) + } + } else { + const unsubscribe = stream.subscriptionId + ? buildReadyStreamUnsubscribe(stream.method, stream.subscriptionId) + : null + if (byParams && stream.method === 'session.tabs.subscribe' && !stream.receivedSnapshot) { + // The host registers cleanup only after resolving the initial snapshot. + this.cancelledSubscriptions.set(id, { method: stream.method, unsubscribe: byParams }) + } else if (unsubscribe || byParams) { + this.sendUnsubscribe((unsubscribe ?? byParams)!) + } else if ( + stream.method === 'browser.screencast' || + stream.method === 'runtime.clientEvents.subscribe' + ) { + // Keep only the cleanup route while the server assigns its subscription ID. + this.cancelledSubscriptions.set(id, { method: stream.method }) + } else if (stream.subscriptionId) { + this.sendUnsubscribe({ + method: stream.method.replace(/\.subscribe$/, '.unsubscribe'), + params: { subscriptionId: stream.subscriptionId } + }) + } } - } else if (stream.subscriptionId) { - this.options.sendFrame({ - id: this.options.nextId(), - method: stream.method.replace(/\.subscribe$/, '.unsubscribe'), - params: { subscriptionId: stream.subscriptionId } - }) } this.remove(id) } + /** Skip the unsubscribe when a live sibling shares the host cleanup token (e.g. nativeChat's + * deterministic `agent:sessionId`), since the host would evict the sibling's registration. */ + private sendUnsubscribe(unsubscribe: StreamUnsubscribe): void { + if (this.hasLiveOwner(unsubscribe)) { + return + } + this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe }) + } + + private hasLiveOwner(unsubscribe: StreamUnsubscribe): boolean { + const token = JSON.stringify(unsubscribe) + for (const [siblingId, sibling] of this.streams) { + if (sibling.cancelled || !sibling.sent) { + continue + } + const siblingUnsubscribe = buildParamsUnsubscribe(sibling.method, sibling.params, siblingId) + if (siblingUnsubscribe && JSON.stringify(siblingUnsubscribe) === token) { + return true + } + } + return false + } + private remove(id: string): void { const stream = this.streams.get(id) if (!stream) { diff --git a/mobile/src/transport/rpc-client-terminal-subscription.ts b/mobile/src/transport/rpc-client-terminal-subscription.ts index 471bc3c4a4e..405f7f1d9e0 100644 --- a/mobile/src/transport/rpc-client-terminal-subscription.ts +++ b/mobile/src/transport/rpc-client-terminal-subscription.ts @@ -38,7 +38,8 @@ export function updateTerminalSubscriptionViewport( * the per-method echo logic out of the rpc-client teardown closure. */ export function buildStreamUnsubscribe( method: string | undefined, - params: unknown + params: unknown, + requestId?: string ): { method: string; params: Record } | null { if (!params || typeof params !== 'object') { return null @@ -46,7 +47,10 @@ export function buildStreamUnsubscribe( if (method === 'session.tabs.subscribe') { const worktree = (params as { worktree?: unknown }).worktree return typeof worktree === 'string' - ? { method: 'session.tabs.unsubscribe', params: { worktree } } + ? { + method: 'session.tabs.unsubscribe', + params: { worktree, ...(requestId ? { subscriptionId: requestId } : {}) } + } : null } if (method === 'nativeChat.subscribe') { diff --git a/native/computer-use-windows/runtime.ps1 b/native/computer-use-windows/runtime.ps1 index 4b68525c7c6..efd44e6cde7 100644 --- a/native/computer-use-windows/runtime.ps1 +++ b/native/computer-use-windows/runtime.ps1 @@ -1,9 +1,15 @@ param( - [Parameter(Mandatory = $true)] - [string]$OperationPath + [Parameter(Position = 0)] + [string]$OperationPath, + # Serve mode keeps one process alive so the Add-Type P/Invoke assembly below + # is emitted once per session instead of once per operation. + [switch]$Serve ) $ErrorActionPreference = "Stop" +# Progress records render to the host, which in serve mode is a pipe carrying +# one JSON response per line; a stray record would desynchronise the stream. +$ProgressPreference = "SilentlyContinue" $utf8NoBom = New-Object System.Text.UTF8Encoding $false [Console]::InputEncoding = $utf8NoBom [Console]::OutputEncoding = $utf8NoBom @@ -1313,9 +1319,56 @@ function Invoke-OrcaOperation($Operation) { [pscustomobject]@{ ok = $true; action = $action; snapshot = $snapshot } } -try { - $operation = Read-OrcaOperation $OperationPath - Write-OrcaJson (Invoke-OrcaOperation $operation) -} catch { - Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message }) +function Invoke-OrcaServeLoop { + # Announced before the first read, and after every Add-Type above: a caller + # that never sees this line knows the helper cannot have read a request, let + # alone synthesized a click, so replaying it is provably safe. Inferring that + # from a missing response instead would replay operations that did run. + [Console]::Out.WriteLine('{"ready":true}') + [Console]::Out.Flush() + # One NDJSON request per line in, one response per line out, until stdin closes. + # Responses carry base64 screenshots and routinely exceed a megabyte; ReadLine + # and the console writer are both length-bounded only by memory. + while ($true) { + $line = [Console]::In.ReadLine() + if ($null -eq $line) { break } + if ([string]::IsNullOrWhiteSpace($line)) { continue } + $requestId = $null + try { + $operation = $line | ConvertFrom-Json + $requestId = $operation.requestId + $response = Invoke-OrcaOperation $operation + } catch { + $response = [pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message } + # ConvertFrom-Json throws before the id is read, so recover it from the + # raw line. An error the caller can match is delivered to the request + # that caused it; an unmatched one only trips the caller's desync + # guard, which kills this helper, charges a failure toward its cooldown + # and discards the message below - so a malformed request would be + # reported as a broken stream and its real cause never surface. + if ($null -eq $requestId -and $line -match '"requestId"\s*:\s*(\d+)') { + $requestId = [long]$Matches[1] + } + } + # Echoed so the caller can prove which request a line answers; a reply it + # cannot match is a desynchronised stream, not a usable response. + if ($null -ne $requestId) { + $response | Add-Member -NotePropertyName requestId -NotePropertyValue $requestId -Force + } + [Console]::Out.WriteLine((ConvertTo-Json $response -Depth 100 -Compress)) + [Console]::Out.Flush() + } +} + +if ($Serve) { + Invoke-OrcaServeLoop +} elseif ([string]::IsNullOrWhiteSpace($OperationPath)) { + Write-OrcaJson ([pscustomobject]@{ ok = $false; error = "runtime.ps1 requires an operation path or -Serve" }) +} else { + try { + $operation = Read-OrcaOperation $OperationPath + Write-OrcaJson (Invoke-OrcaOperation $operation) + } catch { + Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message }) + } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6b59d23e026..a69e47f89b3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -109,7 +109,7 @@ overrides: monaco-editor>dompurify: 3.4.13 patchedDependencies: - '@vscode/windows-process-tree@0.8.0': 9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585 + '@vscode/windows-process-tree@0.8.0': f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e '@xterm/addon-ligatures@0.11.0-beta.300': 47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920 '@xterm/addon-search@0.17.0-beta.300': eee5338dd2621ece46e79c61ec06766cd7fadaf79ffdb24e2a8ab68e97ef31f0 '@xterm/addon-serialize@0.15.0-beta.300': 851eac3d75e6d8c013b9f4c053e61d824b23965cb19ecc28e335e05059f3a294 @@ -510,7 +510,7 @@ importers: optionalDependencies: '@vscode/windows-process-tree': specifier: 0.8.0 - version: 0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585) + version: 0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e) sherpa-onnx-darwin-arm64: specifier: 1.12.37 version: 1.12.37 @@ -9821,7 +9821,7 @@ snapshots: convert-source-map: 2.0.0 tinyrainbow: 3.1.0 - '@vscode/windows-process-tree@0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585)': + '@vscode/windows-process-tree@0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e)': dependencies: node-addon-api: 7.1.0 optional: true diff --git a/src/cli/cli-error.ts b/src/cli/cli-error.ts new file mode 100644 index 00000000000..6a87f149079 --- /dev/null +++ b/src/cli/cli-error.ts @@ -0,0 +1,144 @@ +import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery' +import { + matchAutomationOwnerConflict, + stripAutomationOwnerConflictCode +} from '../shared/automation-owner-conflict' +import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery' +import type { RuntimeRpcFailure } from './runtime-client' +import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types' + +type CliErrorContext = { + commandPath?: readonly string[] +} + +export function formatCliError(error: unknown, context: CliErrorContext = {}): string { + const message = error instanceof Error ? error.message : String(error) + if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') { + if (hasOrchestrationRequestId(error.data)) { + return message + } + return `${message}\nOrca is not running. Run 'orca open' first.` + } + // Why: error-specific recovery must win over the generic computer fallback. + // Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token. + const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error)) + if (conflict) { + return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps) + } + if (error instanceof RuntimeClientError) { + const nextSteps = nextStepsFromData(error.data) + if (nextSteps.length > 0) { + return formatMessageWithNextSteps(message, nextSteps) + } + if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') { + return formatMessageWithNextSteps( + message, + computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? [] + ) + } + } + if ( + error instanceof RuntimeRpcFailureError && + error.response.error.code === 'runtime_unavailable' + ) { + return `${message}\nOrca is not running. Run 'orca open' first.` + } + if (error instanceof RuntimeRpcFailureError) { + return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data)) + } + return message +} + +function hasOrchestrationRequestId(data: unknown): boolean { + return ( + data !== null && + typeof data === 'object' && + typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string' + ) +} + +export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void { + if (json) { + if (error instanceof RuntimeRpcFailureError) { + console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2)) + } else { + const response: RuntimeRpcFailure = { + id: 'local', + ok: false, + error: { + code: + matchAutomationOwnerConflict(error) ?? + (error instanceof RuntimeClientError ? error.code : 'runtime_error'), + message: stripAutomationOwnerConflictCode( + error instanceof Error ? error.message : String(error) + ), + data: localCliErrorData(error, context) + }, + _meta: { + runtimeId: null + } + } + console.log(JSON.stringify(response, null, 2)) + } + } else { + console.error(formatCliError(error, context)) + } +} + +/** Machine-readable half of the same recovery the human message carries. */ +function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure { + const code = matchAutomationOwnerConflict(response) + const conflict = automationOwnerConflictRecovery(code) + if (!conflict || !code) { + return response + } + return { + ...response, + error: { + ...response.error, + // Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport. + code, + message: stripAutomationOwnerConflictCode(response.error.message), + data: response.error.data ?? conflict + } + } +} + +function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string { + if (nextSteps.length === 0) { + return message + } + return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}` +} + +function nextStepsFromData(data: unknown): string[] { + if ( + data && + typeof data === 'object' && + Array.isArray((data as { nextSteps?: unknown }).nextSteps) + ) { + return (data as { nextSteps: unknown[] }).nextSteps.filter( + (step): step is string => typeof step === 'string' + ) + } + return [] +} + +function localCliErrorData(error: unknown, context: CliErrorContext): unknown { + // Why: error-specific recovery must win over the generic computer fallback. + if (error instanceof RuntimeClientError && error.data !== undefined) { + return error.data + } + const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error)) + if (conflict) { + return conflict + } + if ( + error instanceof RuntimeClientError && + error.code === 'invalid_argument' && + context.commandPath?.[0] === 'computer' + ) { + return computerUseErrorRecoveryData('invalid_argument') + } + return undefined +} diff --git a/src/cli/command-suggestion-budget.test.ts b/src/cli/command-suggestion-budget.test.ts new file mode 100644 index 00000000000..7902ad7fdba --- /dev/null +++ b/src/cli/command-suggestion-budget.test.ts @@ -0,0 +1,44 @@ +import { afterEach, describe, expect, it, vi } from 'vitest' +import * as distance from '../shared/edit-distance' +import { suggestCommands, unknownFlagData } from './command-suggestion' +import type { CommandSpec } from './command-spec' + +const specs: CommandSpec[] = [ + { path: ['list'], summary: '', usage: '', allowedFlags: [] }, + { path: ['remove'], summary: '', usage: '', allowedFlags: [], destructive: true } +] + +afterEach(() => vi.restoreAllMocks()) + +describe('suggestion distance work', () => { + it('does no distance calculations for a long command, including destructive intent', () => { + const spy = vi.spyOn(distance, 'levenshtein') + expect(suggestCommands(specs, ['x'.repeat(32_768)])).toEqual([]) + expect(spy).not.toHaveBeenCalled() + }) + + it('does no distance calculations for a long flag but still lists valid flags', () => { + const spy = vi.spyOn(distance, 'levenshtein') + expect(unknownFlagData('x'.repeat(32_768), ['worktree', 'json'])).toEqual({ + validFlags: ['json', 'worktree'], + suggestions: [], + nextSteps: ['Valid flags: --json, --worktree'] + }) + expect(spy).not.toHaveBeenCalled() + }) + + it('keeps the inclusive three-edit suggestion boundary', () => { + expect(suggestCommands(specs, ['listxxx'])).toEqual(['list']) + expect(unknownFlagData('jsonxxx', ['json']).suggestions).toEqual(['json']) + }) + + it('keeps the inclusive one-edit destructive intent boundary', () => { + expect(suggestCommands(specs, ['remov'])).toEqual(['remove']) + expect(suggestCommands(specs, ['remo'])).toEqual([]) + }) + + it('retains UTF-16 distance semantics at the length boundary', () => { + expect(unknownFlagData('json😀x', ['json']).suggestions).toEqual(['json']) + expect(unknownFlagData('json😀😀', ['json']).suggestions).toEqual([]) + }) +}) diff --git a/src/cli/command-suggestion.ts b/src/cli/command-suggestion.ts index 7b80138e2f3..9c935f694fa 100644 --- a/src/cli/command-suggestion.ts +++ b/src/cli/command-suggestion.ts @@ -37,7 +37,10 @@ function destructiveVerbs(specs: CommandSpec[]): Set { // input token is itself a near-miss of a destructive verb. #6303 function intendsDestruction(inputToken: string, verbs: Set): boolean { for (const verb of verbs) { - if (levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD) { + if ( + Math.abs(inputToken.length - verb.length) <= DESTRUCTIVE_INTENT_THRESHOLD && + levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD + ) { return true } } @@ -85,7 +88,9 @@ export function suggestCommands(specs: CommandSpec[], commandPath: string[]): st continue } seen.add(joined) - scored.push({ label: joined, distance: levenshtein(input, joined) }) + if (Math.abs(input.length - joined.length) <= SUGGESTION_THRESHOLD) { + scored.push({ label: joined, distance: levenshtein(input, joined) }) + } } } return rankByDistance(scored) @@ -106,9 +111,13 @@ export type FlagErrorData = { } function suggestFlags(flag: string, validFlags: string[]): string[] { - return rankByDistance( - validFlags.map((candidate) => ({ label: candidate, distance: levenshtein(flag, candidate) })) - ) + const scored: { label: string; distance: number }[] = [] + for (const candidate of validFlags) { + if (Math.abs(flag.length - candidate.length) <= SUGGESTION_THRESHOLD) { + scored.push({ label: candidate, distance: levenshtein(flag, candidate) }) + } + } + return rankByDistance(scored) } // Why: include the accepted set so agents can recover without another help call. diff --git a/src/cli/format.ts b/src/cli/format.ts index 1487a69eea0..dd6b7b739c7 100644 --- a/src/cli/format.ts +++ b/src/cli/format.ts @@ -1,13 +1,8 @@ import type { CliStatusResult } from '../shared/runtime-types' -import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery' -import { - matchAutomationOwnerConflict, - stripAutomationOwnerConflictCode -} from '../shared/automation-owner-conflict' -import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery' import { prepareComputerCliJsonResult } from './computer-format' -import type { RuntimeRpcFailure, RuntimeRpcSuccess } from './runtime-client' -import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types' +import type { RuntimeRpcSuccess } from './runtime-client' + +export { formatCliError, reportCliError } from './cli-error' export { formatBrowserProfileList, @@ -67,10 +62,6 @@ export { formatWorktreeShow } from './workspace-format' -type CliErrorContext = { - commandPath?: readonly string[] -} - export function printResult( response: RuntimeRpcSuccess, json: boolean, @@ -83,138 +74,6 @@ export function printResult( console.log(formatter(response.result)) } -export function formatCliError(error: unknown, context: CliErrorContext = {}): string { - const message = error instanceof Error ? error.message : String(error) - if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') { - if (hasOrchestrationRequestId(error.data)) { - return message - } - return `${message}\nOrca is not running. Run 'orca open' first.` - } - // Why: error-specific recovery must win over the generic computer fallback. - // Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token. - const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error)) - if (conflict) { - return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps) - } - if (error instanceof RuntimeClientError) { - const nextSteps = nextStepsFromData(error.data) - if (nextSteps.length > 0) { - return formatMessageWithNextSteps(message, nextSteps) - } - if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') { - return formatMessageWithNextSteps( - message, - computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? [] - ) - } - } - if ( - error instanceof RuntimeRpcFailureError && - error.response.error.code === 'runtime_unavailable' - ) { - return `${message}\nOrca is not running. Run 'orca open' first.` - } - if (error instanceof RuntimeRpcFailureError) { - return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data)) - } - return message -} - -function hasOrchestrationRequestId(data: unknown): boolean { - return ( - data !== null && - typeof data === 'object' && - typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string' - ) -} - -export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void { - if (json) { - if (error instanceof RuntimeRpcFailureError) { - console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2)) - } else { - const response: RuntimeRpcFailure = { - id: 'local', - ok: false, - error: { - code: - matchAutomationOwnerConflict(error) ?? - (error instanceof RuntimeClientError ? error.code : 'runtime_error'), - message: stripAutomationOwnerConflictCode( - error instanceof Error ? error.message : String(error) - ), - data: localCliErrorData(error, context) - }, - _meta: { - runtimeId: null - } - } - console.log(JSON.stringify(response, null, 2)) - } - } else { - console.error(formatCliError(error, context)) - } -} - -/** Machine-readable half of the same recovery the human message carries. */ -function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure { - const code = matchAutomationOwnerConflict(response) - const conflict = automationOwnerConflictRecovery(code) - if (!conflict || !code) { - return response - } - return { - ...response, - error: { - ...response.error, - // Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport. - code, - message: stripAutomationOwnerConflictCode(response.error.message), - data: response.error.data ?? conflict - } - } -} - -function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string { - if (nextSteps.length === 0) { - return message - } - return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}` -} - -function nextStepsFromData(data: unknown): string[] { - if ( - data && - typeof data === 'object' && - Array.isArray((data as { nextSteps?: unknown }).nextSteps) - ) { - return (data as { nextSteps: unknown[] }).nextSteps.filter( - (step): step is string => typeof step === 'string' - ) - } - return [] -} - -function localCliErrorData(error: unknown, context: CliErrorContext): unknown { - // Why: error-specific recovery must win over the generic computer fallback. - if (error instanceof RuntimeClientError && error.data !== undefined) { - return error.data - } - const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error)) - if (conflict) { - return conflict - } - if ( - error instanceof RuntimeClientError && - error.code === 'invalid_argument' && - context.commandPath?.[0] === 'computer' - ) { - return computerUseErrorRecoveryData('invalid_argument') - } - return undefined -} - export type HostListEntry = { kind: 'local' | 'ssh' | 'environment' name: string diff --git a/src/cli/index.ts b/src/cli/index.ts index 9389113b195..a0e1354307f 100644 --- a/src/cli/index.ts +++ b/src/cli/index.ts @@ -15,7 +15,7 @@ import { resolveHostFlagEnvironmentId } from './execution-host-flag' import { listSshTargets } from './host-selector-alternatives' -import { reportCliError } from './format' +import { reportCliError } from './cli-error' import { printHelp } from './help' import type { RuntimeClient } from './runtime-client' import { COMMAND_SPECS } from './specs' diff --git a/src/cli/runtime-client-deferral.test.ts b/src/cli/runtime-client-deferral.test.ts index 658cc60f0a4..5fcdf8b9686 100644 --- a/src/cli/runtime-client-deferral.test.ts +++ b/src/cli/runtime-client-deferral.test.ts @@ -84,14 +84,12 @@ describe('RuntimeClient module-graph deferral', () => { process.exitCode = 0 }) - // Why: the whole point of the change. These six modules load on EVERY - // invocation, so a value-import of the barrel from any of them drags the - // RuntimeClient graph (zod, ws, tweetnacl) back onto the --help path. + // These eager modules must not pull the RuntimeClient dependency graph into help. it.each([ 'args.ts', 'flags.ts', 'dispatch.ts', - 'format.ts', + 'cli-error.ts', 'selectors.ts', 'execution-host-flag.ts' ])('%s imports error classes from ./runtime/types, not the barrel', (file) => { @@ -110,6 +108,7 @@ describe('RuntimeClient module-graph deferral', () => { expect(source).toContain("import type { RuntimeClient } from './runtime-client'") expect(source).not.toMatch(/^import \{[^}]*RuntimeClient[^}]*\} from '\.\/runtime-client'/m) expect(source).toContain("await import('./runtime-client.js')") + expect(source).toContain("import { reportCliError } from './cli-error'") }) it('constructs no client for --help', async () => { diff --git a/src/cli/runtime/transport-framing.test.ts b/src/cli/runtime/transport-framing.test.ts new file mode 100644 index 00000000000..cf3150f60c9 --- /dev/null +++ b/src/cli/runtime/transport-framing.test.ts @@ -0,0 +1,150 @@ +import { EventEmitter } from 'node:events' +import { StringDecoder } from 'node:string_decoder' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import type { RuntimeMetadata } from '../../shared/runtime-bootstrap' +import { sendRequest } from './transport' + +const { createConnection } = vi.hoisted(() => ({ createConnection: vi.fn() })) +vi.mock('node:net', () => ({ createConnection })) +vi.mock('node:crypto', () => ({ randomUUID: () => 'request-1' })) + +const metadata: RuntimeMetadata = { + runtimeId: 'runtime-1', + pid: 123, + transports: [{ kind: 'unix', endpoint: 'test-only' }], + authToken: 'token', + startedAt: 1 +} +const reply = (result: unknown) => + `${JSON.stringify({ id: 'request-1', ok: true, result, _meta: { runtimeId: 'runtime-1' } })}\n` + +class TestSocket extends EventEmitter { + setEncoding = vi.fn() + write = vi.fn() + end = vi.fn() + destroy = vi.fn() +} +let socket: TestSocket + +beforeEach(() => { + socket = new TestSocket() + createConnection.mockReturnValue(socket) +}) +afterEach(() => { + vi.restoreAllMocks() + vi.useRealTimers() +}) + +describe('CLI runtime response framing', () => { + it.each([1, 7, 256, 4096])( + 'reads a fragmented response with %i-character chunks', + async (size) => { + const result = { data: '界😀'.repeat(10000) } + const encoded = reply(result) + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + for (let offset = 0; offset < encoded.length; offset += size) { + socket.emit('data', encoded.slice(offset, offset + size)) + } + await expect(pending).resolves.toMatchObject({ result }) + expect(socket.setEncoding).toHaveBeenCalledExactlyOnceWith('utf8') + expect(socket.end).toHaveBeenCalledOnce() + } + ) + + it('accepts Unicode split across socket bytes using the existing UTF-8 decoder', async () => { + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + const decoder = new StringDecoder('utf8') + for (const byte of Buffer.from(reply({ data: '界😀é' }))) { + socket.emit('data', decoder.write(Buffer.from([byte]))) + } + socket.emit('data', decoder.end()) + await expect(pending).resolves.toMatchObject({ result: { data: '界😀é' } }) + }) + + it('searches each fragment once without rescanning the accumulated reply', async () => { + const encoded = reply({ data: 'x'.repeat(1024 * 1024) }) + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + const originalIndexOf = String.prototype.indexOf + let searchedCharacters = 0 + const search = vi + .spyOn(String.prototype, 'indexOf') + .mockImplementation(function (this: string, value, position) { + if (value === '\n') { + searchedCharacters += this.length - (position ?? 0) + } + return originalIndexOf.call(this, value, position) + }) + try { + for (let offset = 0; offset < encoded.length; offset += 256) { + socket.emit('data', encoded.slice(offset, offset + 256)) + } + } finally { + search.mockRestore() + } + await expect(pending).resolves.toMatchObject({ ok: true }) + expect(searchedCharacters).toBe(encoded.length) + }) + + it('refreshes keepalives across chunks and ignores blanks and data after the final frame', async () => { + vi.useFakeTimers() + const pending = sendRequest(metadata, 'terminal.read', {}, 100) + await vi.advanceTimersByTimeAsync(90) + socket.emit('data', ' \r\n{"_keep') + socket.emit('data', 'alive":true}\n\t\n') + await vi.advanceTimersByTimeAsync(90) + socket.emit('data', `${reply({ data: 'done' })}invalid JSON\n`) + socket.emit('data', 'more ignored data') + await expect(pending).resolves.toMatchObject({ result: { data: 'done' } }) + expect(socket.end).toHaveBeenCalledOnce() + expect(vi.getTimerCount()).toBe(0) + }) + + it.each([ + ['broken JSON\n', 'invalid_runtime_response'], + ['{}\n', 'invalid_runtime_response'], + ['{"id":"other","ok":true,"result":{}}\n', 'invalid_runtime_response'], + [ + '{"id":"request-1","ok":true,"result":{},"_meta":{"runtimeId":"other"}}\n', + 'runtime_unavailable' + ] + ])( + 'rejects a fragmented invalid first frame before subsequent valid frames', + async (line, code) => { + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + socket.emit('data', line.slice(0, 2)) + socket.emit('data', line.slice(2) + reply({ data: 'ignored' })) + await expect(pending).rejects.toMatchObject({ code }) + expect(socket.end).toHaveBeenCalledOnce() + } + ) + + it('preserves terminal failure envelopes', async () => { + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + socket.emit('data', '{"id":"request-1","ok":false,"error":{"code":"bad","message":"no"}}\n') + await expect(pending).resolves.toMatchObject({ + ok: false, + error: { code: 'bad', message: 'no' } + }) + }) + + it('rejects close with an incomplete frame and does not parse later data', async () => { + const pending = sendRequest(metadata, 'terminal.read', {}, 30000) + socket.emit('data', '{"id":') + socket.emit('close') + socket.emit('data', reply({ data: 'ignored' })) + await expect(pending).rejects.toMatchObject({ code: 'runtime_unavailable' }) + expect(socket.end).toHaveBeenCalledOnce() + }) + + it('destroys a timed out socket holding an incomplete frame', async () => { + vi.useFakeTimers() + const pending = sendRequest(metadata, 'terminal.read', {}, 100) + const rejected = expect(pending).rejects.toMatchObject({ code: 'runtime_timeout' }) + socket.emit('data', '{"id":') + await vi.advanceTimersByTimeAsync(100) + socket.emit('data', reply({ data: 'ignored' })) + await rejected + expect(socket.destroy).toHaveBeenCalledOnce() + expect(vi.getTimerCount()).toBe(0) + }) +}) diff --git a/src/cli/runtime/transport.ts b/src/cli/runtime/transport.ts index 091ca9da0e0..4e0d0a15ec7 100644 --- a/src/cli/runtime/transport.ts +++ b/src/cli/runtime/transport.ts @@ -31,7 +31,7 @@ export async function sendRequest( return } const socket = createConnection(transport.endpoint) - let buffer = '' + let lineSegments: string[] = [] let settled = false const requestId = randomUUID() @@ -40,6 +40,7 @@ export async function sendRequest( return } settled = true + lineSegments = [] socket.destroy() reject( new RuntimeClientError( @@ -56,6 +57,7 @@ export async function sendRequest( return } settled = true + lineSegments = [] clearTimeout(timeout) socket.end() if (result.ok === false) { @@ -89,18 +91,27 @@ export async function sendRequest( }) }) socket.on('data', (chunk: string) => { - buffer += chunk // Why: the server may interleave `{"_keepalive":true}\n` frames with the // final success/failure frame to keep both idle timers alive during a // long-poll (see design doc §3.1). Read frames in a loop until we see a // terminal frame. Each keepalive refreshes the client-side timer so a // 10 min wait doesn't trip the 60 s default ceiling. - let newlineIndex = buffer.indexOf('\n') - while (newlineIndex !== -1 && !settled) { - const line = buffer.slice(0, newlineIndex) - buffer = buffer.slice(newlineIndex + 1) + let cursor = 0 + while (cursor < chunk.length && !settled) { + const newlineIndex = chunk.indexOf('\n', cursor) + if (newlineIndex === -1) { + lineSegments.push(chunk.slice(cursor)) + return + } + const segment = chunk.slice(cursor, newlineIndex) + let line = segment + if (lineSegments.length > 0) { + lineSegments.push(segment) + line = lineSegments.join('') + lineSegments = [] + } + cursor = newlineIndex + 1 if (line.trim().length === 0) { - newlineIndex = buffer.indexOf('\n') continue } @@ -124,7 +135,6 @@ export async function sendRequest( // major). See §7 risk #9. if (isKeepaliveFrame(raw)) { timeout.refresh() - newlineIndex = buffer.indexOf('\n') continue } @@ -150,7 +160,6 @@ export async function sendRequest( const frame = parsed.data if ('_keepalive' in frame) { timeout.refresh() - newlineIndex = buffer.indexOf('\n') continue } diff --git a/src/main/artifacts/artifact-create-intent-store.test.ts b/src/main/artifacts/artifact-create-intent-store.test.ts index f512f5ab439..08b0e03e374 100644 --- a/src/main/artifacts/artifact-create-intent-store.test.ts +++ b/src/main/artifacts/artifact-create-intent-store.test.ts @@ -1,4 +1,3 @@ -import { execFileSync } from 'node:child_process' import { mkdtemp, readFile, readdir, rm, stat, truncate, writeFile } from 'node:fs/promises' import { tmpdir } from 'node:os' import { join } from 'node:path' @@ -16,9 +15,14 @@ import { getOrCreateArtifactCreateIntent, removeArtifactCreateIntent } from './artifact-create-intent-store' +import { runProcessSync } from '../../shared/child-process/run-process' +import { __resetSecureFileWindowsUserSidForTests } from '../../shared/secure-file' import type { ArtifactShareScope } from './artifact-share-record-store' -vi.mock('node:child_process', () => ({ execFile: vi.fn(), execFileSync: vi.fn() })) +vi.mock('../../shared/child-process/run-process', () => ({ + runProcess: vi.fn(), + runProcessSync: vi.fn() +})) const createdPaths: string[] = [] const scope: ArtifactShareScope = { @@ -168,12 +172,27 @@ describe('artifact create intent store', () => { expect((await readdir(directory)).some((name) => name.endsWith('.tmp'))).toBe(false) }) - it('hardens one Windows journal directory without per-file PowerShell launches', async () => { + it('hardens one Windows journal directory without per-file ACL launches', async () => { const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform') Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) - vi.mocked(execFileSync).mockImplementation((file) => - String(file).endsWith('whoami.exe') ? '"USER","S-1-5-21-1000"' : '' - ) + const ok = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false } + // Earlier cases in this file already resolved (and cached) the SID against an unstubbed mock. + __resetSecureFileWindowsUserSidForTests() + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program.endsWith('whoami.exe')) { + return { ...ok, stdout: '"USER","S-1-5-21-1000"' } + } + const args = spec.args ?? [] + if (args.length > 1) { + return ok // /reset and the /grant:r pass + } + // The verify pass re-reads the DACL; answer with the three protected inheritable rules. + const rules = ['host\\me', 'NT AUTHORITY\\SYSTEM', 'BUILTIN\\Administrators'].map( + (name, index) => + index === 0 ? `${args[0]} ${name}:(OI)(CI)(F)` : ` ${name}:(OI)(CI)(F)` + ) + return { ...ok, stdout: `${rules.join('\r\n')}\r\n\r\nSuccessfully processed 1 files\r\n` } + }) try { const userDataPath = await createUserDataPath() getOrCreateArtifactCreateIntent( @@ -193,16 +212,20 @@ describe('artifact create intent store', () => { body ) - const powershellCalls = vi - .mocked(execFileSync) - .mock.calls.filter(([file]) => String(file).endsWith('powershell.exe')) - expect(powershellCalls).toHaveLength(1) - expect((powershellCalls[0]![1] as string[]).at(-1)).toBe('1') + // One harden across both intents: counted by its /reset pass, which opens each harden. + const aclCalls = vi + .mocked(runProcessSync) + .mock.calls.map(([spec]) => spec) + .filter((spec) => spec.program.endsWith('icacls.exe')) + expect(aclCalls.filter((spec) => spec.args?.includes('/reset'))).toHaveLength(1) + // The child intent files rely on inheritance, so the directory rules must carry (OI)(CI). + const grant = aclCalls.find((spec) => spec.args?.includes('/grant:r')) + expect(grant?.args?.filter((arg) => arg.endsWith(':(OI)(CI)(F)'))).toHaveLength(3) } finally { if (originalPlatform) { Object.defineProperty(process, 'platform', originalPlatform) } - vi.mocked(execFileSync).mockReset() + vi.mocked(runProcessSync).mockReset() } }) diff --git a/src/main/browser/browser-client-upload-transfer.test.ts b/src/main/browser/browser-client-upload-transfer.test.ts index fdc129618e8..84bb649abd3 100644 --- a/src/main/browser/browser-client-upload-transfer.test.ts +++ b/src/main/browser/browser-client-upload-transfer.test.ts @@ -1,4 +1,4 @@ -import { describe, expect, it } from 'vitest' +import { describe, expect, it, vi } from 'vitest' import type { BrowserClientHostCommandEvent } from '../../shared/browser-client-host-protocol' import { @@ -102,3 +102,38 @@ describe('readBrowserClientUploadPaths', () => { ) }) }) + +it.each([0, 1, 128 * 1024])( + 'avoids recopying 16 single-chunk uploads of %i bytes', + async (size) => { + const source = Buffer.alloc(size, 171) + const response = { + contentBase64: source.toString('base64'), + bytesRead: size, + totalBytes: size, + eof: true + } + const remotePaths = Array.from({ length: 16 }, (_, i) => `file-${i}.bin`) + const request = vi.fn(async () => response) + const concat = vi.spyOn(Buffer, 'concat') + let copies = 0 + let files: Awaited> + try { + files = await fetchBrowserClientUploadFiles({ request, event, remotePaths }) + copies = concat.mock.calls.length + } finally { + concat.mockRestore() + } + expect(copies).toBe(0) + expect(request).toHaveBeenCalledTimes(16) + expect(files.map((file) => file.remotePath)).toEqual(remotePaths) + for (const file of files) { + expect(file.contents).toEqual(source) + } + if (size > 0) { + files[0].contents[0] = 0 + expect(files[1].contents[0]).toBe(171) + expect(source[0]).toBe(171) + } + } +) diff --git a/src/main/browser/browser-client-upload-transfer.ts b/src/main/browser/browser-client-upload-transfer.ts index 1863f7b9f75..f85af071633 100644 --- a/src/main/browser/browser-client-upload-transfer.ts +++ b/src/main/browser/browser-client-upload-transfer.ts @@ -74,7 +74,7 @@ export async function fetchBrowserClientUploadFiles(options: { throw new Error('browser_client_upload_transfer_stalled') } } - files.push({ remotePath, contents: Buffer.concat(chunks) }) + files.push({ remotePath, contents: chunks.length === 1 ? chunks[0] : Buffer.concat(chunks) }) } return files } diff --git a/src/main/computer/computer-sidecar-diagnostics.test.ts b/src/main/computer/computer-sidecar-diagnostics.test.ts new file mode 100644 index 00000000000..06d1b1cfa02 --- /dev/null +++ b/src/main/computer/computer-sidecar-diagnostics.test.ts @@ -0,0 +1,45 @@ +import { afterEach, describe, expect, it, vi } from 'vitest' +import { + isComputerSidecarDiagnostic, + reportComputerDiagnostic +} from './computer-sidecar-diagnostics' + +describe('computer sidecar diagnostics', () => { + const originalSend = process.send + + afterEach(() => { + process.send = originalSend + vi.restoreAllMocks() + }) + + it('sends over IPC when running inside the sidecar', () => { + const send = vi.fn((_message: unknown) => true) + process.send = send as unknown as typeof process.send + const console_ = vi.spyOn(console, 'warn').mockImplementation(() => {}) + + reportComputerDiagnostic('fell back to Bypass') + + // The sidecar's stdout is piped and never read, so this must not go there. + expect(console_).not.toHaveBeenCalled() + expect(send).toHaveBeenCalledWith({ + kind: 'computer-sidecar-diagnostic', + message: 'fell back to Bypass' + }) + expect(isComputerSidecarDiagnostic(send.mock.calls[0][0])).toBe(true) + }) + + it('logs directly when there is no IPC channel', () => { + process.send = undefined + const console_ = vi.spyOn(console, 'warn').mockImplementation(() => {}) + + reportComputerDiagnostic('fell back to Bypass') + + expect(console_).toHaveBeenCalledWith('[computer-use] fell back to Bypass') + }) + + it('does not mistake a sidecar response for a diagnostic', () => { + expect(isComputerSidecarDiagnostic({ id: 1, ok: true, result: {} })).toBe(false) + expect(isComputerSidecarDiagnostic({ kind: 'computer-sidecar-diagnostic' })).toBe(false) + expect(isComputerSidecarDiagnostic(null)).toBe(false) + }) +}) diff --git a/src/main/computer/computer-sidecar-diagnostics.ts b/src/main/computer/computer-sidecar-diagnostics.ts new file mode 100644 index 00000000000..2b23418940d --- /dev/null +++ b/src/main/computer/computer-sidecar-diagnostics.ts @@ -0,0 +1,38 @@ +/** + * Warnings from the computer-use provider, routed to somewhere a human sees. + * + * Why not `console.warn`: the provider runs inside the forked sidecar, which + * `sidecar-client.ts` starts with piped stdio that nothing ever reads. Anything + * written there is discarded — including the only signal that a machine has + * fallen back to `-ExecutionPolicy Bypass`, a state that persists for the + * session. The sidecar has an IPC channel already, so the warning takes it. + */ +export type ComputerSidecarDiagnostic = { + kind: 'computer-sidecar-diagnostic' + message: string +} + +const DIAGNOSTIC_KIND = 'computer-sidecar-diagnostic' + +export function isComputerSidecarDiagnostic( + message: unknown +): message is ComputerSidecarDiagnostic { + if (!message || typeof message !== 'object') { + return false + } + const record = message as Record + return record.kind === DIAGNOSTIC_KIND && typeof record.message === 'string' +} + +export function reportComputerDiagnostic(message: string): void { + if (process.send) { + process.send({ kind: DIAGNOSTIC_KIND, message } satisfies ComputerSidecarDiagnostic) + return + } + logComputerDiagnostic(message) +} + +/** The main-process end: how a sidecar's forwarded diagnostic is printed. */ +export function logComputerDiagnostic(message: string): void { + console.warn(`[computer-use] ${message}`) +} diff --git a/src/main/computer/desktop-script-action.ts b/src/main/computer/desktop-script-action.ts index 38dde4b56fa..7c2c21f1e8c 100644 --- a/src/main/computer/desktop-script-action.ts +++ b/src/main/computer/desktop-script-action.ts @@ -228,3 +228,17 @@ export function elementParam( } return element } + +/** + * Tools that only observe, and so may be safely re-sent to a fresh helper. + * + * Why an allowlist: a helper can die after running an operation but before + * writing its reply, so a replayed mutation is a second click, keystroke or + * paste. Only the observation tools are provably safe to repeat, and a tool + * added later has to opt in rather than inherit a replay by default. + */ +const OBSERVATION_TOOLS = new Set(['handshake', 'list_apps', 'list_windows', 'get_app_state']) + +export function isReplayableTool(tool: string): boolean { + return OBSERVATION_TOOLS.has(tool) +} diff --git a/src/main/computer/desktop-script-provider-bridge.ts b/src/main/computer/desktop-script-provider-bridge.ts index c3c21496d29..fecc4036df1 100644 --- a/src/main/computer/desktop-script-provider-bridge.ts +++ b/src/main/computer/desktop-script-provider-bridge.ts @@ -1,28 +1,98 @@ import { execFile } from 'node:child_process' +import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary' +import { reportComputerDiagnostic } from './computer-sidecar-diagnostics' import { RuntimeClientError } from './runtime-client-error' import type { DesktopScriptPlatform } from './desktop-script-provider-paths' +import { + FALLBACK_WINDOWS_EXECUTION_POLICY, + PREFERRED_WINDOWS_EXECUTION_POLICY, + isExecutionPolicyBlocked, + windowsPowerShellRuntimeArgs +} from './windows-powershell-execution-policy' const REQUEST_TIMEOUT_MS = 30_000 const FORCE_KILL_GRACE_MS = 1_000 -export function execBridge( +export async function execBridge( platform: DesktopScriptPlatform, scriptPath: string, operationPath: string ): Promise<{ stdout: string; stderr: string }> { - const command = platform === 'windows' ? 'powershell.exe' : 'python3' - const args = - platform === 'windows' - ? [ - '-NoProfile', - '-NonInteractive', - '-ExecutionPolicy', - 'Bypass', - '-File', - scriptPath, - operationPath - ] - : [scriptPath, operationPath] + if (platform !== 'windows') { + return await mapped(runBridgeProcess('python3', [scriptPath, operationPath])) + } + const command = windowsPowerShellPath() + try { + return await runBridgeProcess( + command, + windowsPowerShellRuntimeArgs(scriptPath, PREFERRED_WINDOWS_EXECUTION_POLICY, [operationPath]) + ) + } catch (error) { + if (!isPolicyBlockedStart(error)) { + throw error instanceof BridgeProcessFailure ? error.mapped : error + } + reportComputerDiagnostic( + `bridge start blocked at ${PREFERRED_WINDOWS_EXECUTION_POLICY}; retrying once with ${FALLBACK_WINDOWS_EXECUTION_POLICY}` + ) + return await mapped( + runBridgeProcess( + command, + windowsPowerShellRuntimeArgs(scriptPath, FALLBACK_WINDOWS_EXECUTION_POLICY, [operationPath]) + ) + ) + } +} + +/** Unwrap the raw-stream carrier back into the error callers expect. */ +async function mapped( + run: Promise<{ stdout: string; stderr: string }> +): Promise<{ stdout: string; stderr: string }> { + try { + return await run + } catch (error) { + throw error instanceof BridgeProcessFailure ? error.mapped : error + } +} + +/** + * Only a run that produced no stdout at all may be replayed. + * + * What the stdout guard covers: operations are not idempotent, and the response + * embeds window titles and element names, so a snapshot that merely contains + * the word "SecurityError" must not be read as a policy block and replayed as a + * second click, keystroke or paste. It closes that injection route only. + * + * What it does not cover: one-shot mode runs the operation to completion and + * writes stdout only afterwards, so stdout is empty for the whole action, not + * just before it starts. A crash after the click but before the write looks + * identical to a helper that never started. Nothing here can tell those apart — + * only a policy pattern that cannot match a non-policy failure keeps the replay + * off, which is why its `\b` is load-bearing rather than cosmetic. + */ +function isPolicyBlockedStart(error: unknown): error is BridgeProcessFailure { + return ( + error instanceof BridgeProcessFailure && + !error.stdout.trim() && + isExecutionPolicyBlocked(error.stderr) + ) +} + +/** Carries the raw streams so the retry decision does not read a mapped message. */ +class BridgeProcessFailure extends Error { + constructor( + readonly stdout: string, + readonly stderr: string, + readonly mapped: RuntimeClientError + ) { + super(mapped.message) + this.name = 'BridgeProcessFailure' + } +} + +function runBridgeProcess( + command: string, + args: readonly string[] +): Promise<{ stdout: string; stderr: string }> { return new Promise((resolve, reject) => { let child: ReturnType | null = null let settled = false @@ -76,7 +146,7 @@ export function execBridge( try { child = execFile( command, - args, + [...args], { env: process.env, maxBuffer: 20 * 1024 * 1024, @@ -86,11 +156,10 @@ export function execBridge( (error, stdout, stderr) => { if (error) { const message = stderr.trim() || stdout.trim() || error.message - finish( - error.killed - ? new RuntimeClientError('action_timeout', message) - : mapBridgeError(message) - ) + const mapped = error.killed + ? new RuntimeClientError('action_timeout', message) + : mapBridgeError(message) + finish(new BridgeProcessFailure(stdout, stderr, mapped)) return } finish(null, { stdout, stderr }) diff --git a/src/main/computer/desktop-script-provider-client.ts b/src/main/computer/desktop-script-provider-client.ts index 5e8e01e0d44..a655eeddb07 100644 --- a/src/main/computer/desktop-script-provider-client.ts +++ b/src/main/computer/desktop-script-provider-client.ts @@ -35,6 +35,7 @@ import type { BridgeResponse, NativeActionMethod } from './desktop-script-provider-types' +import { DesktopScriptRuntimeHost, isRuntimeHostUnavailable } from './desktop-script-runtime-host' import { DesktopScriptSnapshotStore } from './desktop-script-snapshot-store' import { normalizeBridgeApp, renderSnapshot } from './desktop-script-snapshot-rendering' import { normalizeComputerActionResult } from './computer-action-verification-normalization' @@ -51,12 +52,17 @@ export class DesktopScriptProviderClient { constructor( private readonly platform: DesktopScriptPlatform = requiredPlatform(), - private readonly scriptPath: string = requiredScriptPath() + private readonly scriptPath: string = requiredScriptPath(), + private readonly runtimeHost: DesktopScriptRuntimeHost | null = defaultRuntimeHost( + platform, + scriptPath + ) ) {} shutdown(): void { this.snapshotStore.clear() this.providerCapabilities = null + this.runtimeHost?.dispose() } async listApps(): Promise { @@ -203,6 +209,23 @@ export class DesktopScriptProviderClient { } private async callBridge(request: BridgeRequest): Promise { + const host = this.runtimeHost + if (host) { + try { + return checkedBridgeResponse(await host.request(request), '') + } catch (error) { + // Only a helper that cannot start falls back; operation errors surface. + // The host is kept: it re-probes after its cooldown, so a transient bad + // spawn cannot strand the session on one powershell.exe per operation. + if (!isRuntimeHostUnavailable(error)) { + throw error + } + } + } + return await this.callOneShotBridge(request) + } + + private async callOneShotBridge(request: BridgeRequest): Promise { const operationDirectory = await mkdtemp(join(tmpdir(), 'orca-computer-use-')) const operationPath = join(operationDirectory, 'operation.json') try { @@ -217,10 +240,7 @@ export class DesktopScriptProviderClient { `desktop provider returned invalid JSON: ${error instanceof Error ? error.message : String(error)}` ) } - if (!response.ok) { - throw mapBridgeError(response.error ?? stderr) - } - return response + return checkedBridgeResponse(response, stderr) } finally { await rm(operationDirectory, { force: true, recursive: true }) } @@ -255,6 +275,21 @@ export class DesktopScriptProviderClient { } } +function checkedBridgeResponse(response: BridgeResponse, stderr: string): BridgeResponse { + if (!response.ok) { + throw mapBridgeError(response.error ?? stderr) + } + return response +} + +// Why Windows only: the Linux provider is a python3 one-shot with no serve mode. +function defaultRuntimeHost( + platform: DesktopScriptPlatform, + scriptPath: string +): DesktopScriptRuntimeHost | null { + return platform === 'windows' ? new DesktopScriptRuntimeHost(scriptPath) : null +} + function requiredPlatform(): DesktopScriptPlatform { const platform = desktopScriptPlatform() if (!platform) { diff --git a/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts b/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts new file mode 100644 index 00000000000..e50a3878a11 --- /dev/null +++ b/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts @@ -0,0 +1,139 @@ +import { afterEach, describe, expect, it, vi } from 'vitest' +import { + bridgeProcessArgs, + createDesktopScriptProviderClient, + expectDesktopProviderSubprocessStartCount, + mockBridgeProcessFailure, + mockBridgeResponse, + resetDesktopScriptProviderTestHarness, + sampleCapabilities +} from './desktop-script-provider-test-harness' +import type { BridgeResponse } from './desktop-script-provider-types' +import type { DesktopScriptRuntimeHost } from './desktop-script-runtime-host' +import { RuntimeClientError } from './runtime-client-error' + +const POLICY_STDERR = + 'File runtime.ps1 cannot be loaded because running scripts is disabled on this system. + CategoryInfo : SecurityError' + +function fakeRuntimeHost(request: DesktopScriptRuntimeHost['request']) { + const dispose = vi.fn() + return { host: { request, dispose } as unknown as DesktopScriptRuntimeHost, dispose } +} + +describe('desktop script provider runtime host routing', () => { + afterEach(resetDesktopScriptProviderTestHarness) + + it('serves Windows operations from the runtime host without spawning a one-shot bridge', async () => { + const request = vi.fn( + async () => ({ ok: true, capabilities: sampleCapabilities() }) as BridgeResponse + ) + const { host } = fakeRuntimeHost(request) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host) + + await expect(client.capabilities()).resolves.toMatchObject({ platform: 'linux' }) + expect(request).toHaveBeenCalledWith({ tool: 'handshake' }) + expectDesktopProviderSubprocessStartCount(0) + }) + + it('maps runtime host operation failures without falling back to the one-shot bridge', async () => { + const { host } = fakeRuntimeHost( + vi.fn(async () => ({ ok: false, error: 'appBlocked("1Password")' }) as BridgeResponse) + ) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host) + + await expect(client.listApps()).rejects.toMatchObject({ code: 'app_blocked' }) + expectDesktopProviderSubprocessStartCount(0) + }) + + it('degrades to the one-shot bridge for the operations a host cannot serve', async () => { + const request = vi.fn(async () => { + throw new RuntimeClientError('runtime_host_unavailable', 'could not start') + }) + const { host, dispose } = fakeRuntimeHost(request as never) + mockBridgeResponse({ ok: true, apps: [{ name: 'Notepad', pid: 42 }] }) + mockBridgeResponse({ ok: true, apps: [{ name: 'Notepad', pid: 42 }] }) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host) + + await expect(client.listApps()).resolves.toMatchObject({ apps: [{ pid: 42 }] }) + await client.listApps() + + // The host is kept and asked again: it owns its own cooldown, so one bad + // spawn must not stand the session down to a powershell.exe per click. + expect(request).toHaveBeenCalledTimes(2) + expect(dispose).not.toHaveBeenCalled() + expectDesktopProviderSubprocessStartCount(2) + }) + + it('returns to the runtime host once it recovers', async () => { + let healthy = false + const request = vi.fn(async () => { + if (!healthy) { + throw new RuntimeClientError('runtime_host_unavailable', 'could not start') + } + return { ok: true, apps: [] } as BridgeResponse + }) + const { host } = fakeRuntimeHost(request) + mockBridgeResponse({ ok: true, apps: [] }) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host) + + await client.listApps() + expectDesktopProviderSubprocessStartCount(1) + + healthy = true + await expect(client.listApps()).resolves.toEqual({ apps: [] }) + expectDesktopProviderSubprocessStartCount(1) + }) + + it('runs the one-shot bridge under RemoteSigned and falls back to Bypass once', async () => { + mockBridgeProcessFailure(POLICY_STDERR) + mockBridgeResponse({ ok: true, apps: [] }) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1') + + await expect(client.listApps()).resolves.toEqual({ apps: [] }) + expectDesktopProviderSubprocessStartCount(2) + expect(bridgeProcessArgs(0)).toContain('-NoLogo') + expect(bridgeProcessArgs(0)).toContain('RemoteSigned') + expect(bridgeProcessArgs(0)).not.toContain('Bypass') + expect(bridgeProcessArgs(1)).toContain('Bypass') + }) + + it('does not retry the one-shot bridge for a non-policy failure', async () => { + mockBridgeProcessFailure('No top-level UI Automation window is available for Notepad') + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1') + + await expect(client.listApps()).rejects.toMatchObject({ code: 'window_not_found' }) + expectDesktopProviderSubprocessStartCount(1) + }) + + it('never replays an operation whose own output merely mentions a policy error', async () => { + // Window titles and element names are user-controlled text that lands in + // stdout; matching them would double a click, a keystroke or a paste. + mockBridgeProcessFailure({ + stdout: JSON.stringify({ + ok: true, + snapshot: { windowTitle: 'SecurityError - UnauthorizedAccess.log - Notepad' } + }), + stderr: '' + }) + + const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1') + + await expect(client.listApps()).rejects.toBeInstanceOf(Error) + expectDesktopProviderSubprocessStartCount(1) + }) + + it('keeps Linux on the one-shot python bridge with no execution policy flags', async () => { + mockBridgeResponse({ ok: true, apps: [] }) + + const client = await createDesktopScriptProviderClient('linux', '/tmp/runtime.py') + + await expect(client.listApps()).resolves.toEqual({ apps: [] }) + expect(bridgeProcessArgs(0)).toEqual(['/tmp/runtime.py', expect.any(String)]) + }) +}) diff --git a/src/main/computer/desktop-script-provider-test-harness.ts b/src/main/computer/desktop-script-provider-test-harness.ts index 2cbd1e9a776..bcb0a4b0118 100644 --- a/src/main/computer/desktop-script-provider-test-harness.ts +++ b/src/main/computer/desktop-script-provider-test-harness.ts @@ -1,4 +1,5 @@ import { expect, vi } from 'vitest' +import type { DesktopScriptRuntimeHost } from './desktop-script-runtime-host' const { execFileMock, operationFiles, mkdtempMock, rmMock, writeFileMock } = vi.hoisted(() => { const files = new Map() @@ -23,12 +24,14 @@ vi.mock('fs/promises', () => ({ writeFile: writeFileMock })) +/** Builds a client on the one-shot bridge; pass a host to exercise serve mode. */ export async function createDesktopScriptProviderClient( platform: 'linux' | 'windows', - executablePath: string + executablePath: string, + runtimeHost: DesktopScriptRuntimeHost | null = null ) { const { DesktopScriptProviderClient } = await import('./desktop-script-provider-client') - return new DesktopScriptProviderClient(platform, executablePath) + return new DesktopScriptProviderClient(platform, executablePath, runtimeHost) } export function resetDesktopScriptProviderTestHarness(): void { @@ -77,6 +80,19 @@ export function mockBridgeResponse( }) } +export function mockBridgeProcessFailure(streams: string | { stdout?: string; stderr?: string }) { + const { stdout = '', stderr = '' } = typeof streams === 'string' ? { stderr: streams } : streams + execFileMock.mockImplementationOnce((_command, _args, _options, callback) => { + const done = callback as (error: Error | null, stdout: string, stderr: string) => void + done(new Error('Command failed'), stdout, stderr) + return null as never + }) +} + +export function bridgeProcessArgs(call: number): string[] { + return (execFileMock.mock.calls[call]?.[1] ?? []) as string[] +} + export function sampleBridgeSnapshot(name: string, value: string) { return { app: { name, bundleIdentifier: name, pid: 100 }, diff --git a/src/main/computer/desktop-script-provider-types.ts b/src/main/computer/desktop-script-provider-types.ts index 0ff48e80b4f..6e474fdcf29 100644 --- a/src/main/computer/desktop-script-provider-types.ts +++ b/src/main/computer/desktop-script-provider-types.ts @@ -101,6 +101,8 @@ export type BridgeWindow = { export type BridgeResponse = { ok: boolean + /** Echo of BridgeRequest.requestId; set only on the persistent serve path. */ + requestId?: number error?: string capabilities?: ComputerProviderCapabilities apps?: { @@ -122,6 +124,8 @@ export type BridgeResponse = { export type BridgeRequest = { tool: string + /** Correlates a serve-mode reply with its request; the one-shot path omits it. */ + requestId?: number app?: string element?: BridgeElement fromElement?: BridgeElement diff --git a/src/main/computer/desktop-script-request-queue.ts b/src/main/computer/desktop-script-request-queue.ts new file mode 100644 index 00000000000..8f32b5f6888 --- /dev/null +++ b/src/main/computer/desktop-script-request-queue.ts @@ -0,0 +1,73 @@ +import { RuntimeClientError } from './runtime-client-error' + +/** + * Serializes operations onto one helper and bounds how long one may wait its + * turn. + * + * Why the wait needs its own deadline: the in-flight timeout is armed only once + * a request reaches a helper, so a request behind N timing-out ones waited N + * times that timeout with no deadline of its own — bounded, but the caller sees + * an `await` that looks hung for minutes and gets no error to act on. + * + * Why only the wait: a request that reaches a helper still gets its full + * execution budget. A single deadline covering both would fail operations that + * queued briefly and would otherwise have succeeded. + */ +export class DesktopScriptRequestQueue { + /** + * Never rejects: downstream turns chain onto it, and a rejection here would + * be delivered to whichever request happened to queue behind the failure. + */ + private tail: Promise | null = null + + constructor( + private readonly waitTimeoutMs: number, + /** Called when the queue empties, so the host can arm its idle shutdown. */ + private readonly onDrained: () => void + ) {} + + enqueue(run: () => Promise): Promise { + const queued = this.tail + if (!queued) { + return this.track(run()) + } + let expiry: RuntimeClientError | null = null + let waitTimer: NodeJS.Timeout | undefined + const waited = new Promise((_resolve, reject) => { + waitTimer = setTimeout(() => { + expiry = new RuntimeClientError( + 'action_timeout', + `desktop provider timed out after ${this.waitTimeoutMs}ms waiting for earlier operations` + ) + reject(expiry) + }, this.waitTimeoutMs) + waitTimer.unref?.() + }) + // An abandoned request is never handed to a helper. The caller has already + // been told it failed, and a click delivered after that is worse than none. + const turn = (): Promise => { + clearTimeout(waitTimer) + return expiry ? Promise.reject(expiry) : run() + } + // The tail chains on the turn, not on the race: a caller giving up early + // must not release the next request while this one's predecessor is still + // in flight. + return Promise.race([waited, this.track(queued.then(turn, turn))]) + } + + private track(result: Promise): Promise { + const tail = result.then( + () => undefined, + () => undefined + ) + this.tail = tail + void tail.finally(() => { + if (this.tail !== tail) { + return + } + this.tail = null + this.onDrained() + }) + return result + } +} diff --git a/src/main/computer/desktop-script-runtime-availability.ts b/src/main/computer/desktop-script-runtime-availability.ts new file mode 100644 index 00000000000..58123f5eab7 --- /dev/null +++ b/src/main/computer/desktop-script-runtime-availability.ts @@ -0,0 +1,176 @@ +import { + FALLBACK_WINDOWS_EXECUTION_POLICY, + PREFERRED_WINDOWS_EXECUTION_POLICY, + type WindowsExecutionPolicy +} from './windows-powershell-execution-policy' + +/** + * Consecutive child failures before the helper is believed dead, and how long + * the one-shot bridge covers for it afterwards. + * + * Why not a latch: every plausible cause is transient — a Defender scan touching + * the script mid-launch, a locked CSC temp directory failing one `Add-Type`, + * momentary memory pressure. Giving up permanently silently restores the + * per-click process burst the host exists to remove, and computer use keeps + * working throughout, so nothing looks wrong while the MDE signature returns. + */ +export const MAX_START_ATTEMPTS = 3 +export const START_FAILURE_COOLDOWN_MS = 60_000 + +/** + * Why not `Date.now`: an NTP correction, a VM snapshot restore or a user changing + * the clock steps the wall clock backwards, which extended the cooldown by the + * size of the step. Nothing shortens it from there — only `recordSuccess` clears + * it, and no request can reach a helper to succeed while it holds — so a one-hour + * step disabled the persistent helper for the life of the sidecar, silently + * restoring the per-click process burst. Elapsed monotonic time cannot go + * backwards. + */ +const monotonicNowMs = (): number => performance.now() + +/** + * Whether the persistent helper is currently believed usable, and the execution + * policy it should be started under. + * + * Split from the host so the recovery rules are readable on their own: they are + * what stands between a transient bad spawn and a session that silently spends + * the rest of its life on one powershell.exe per click. + */ +export class RuntimeHostAvailability { + private policy: WindowsExecutionPolicy = PREFERRED_WINDOWS_EXECUTION_POLICY + private retryUnderFallbackPolicy = false + private consecutiveFailures = 0 + private consecutiveSuccesses = 0 + /** Null, not 0, for "no cooldown": `performance.now()` legitimately returns 0. */ + private cooldownStartedAtMs: number | null = null + /** + * Set while the escalated policy has yet to start a helper, so a wrong + * diagnosis can be taken back. + * + * Why it can be wrong: AppLocker and WDAC constrained language mode raise + * PSSecurityException under the same SecurityError category a policy block + * uses, but they refuse the script at parse time, which `Bypass` cannot lift. + * Latching there would spend the session putting the most heavily weighted + * MDE token on every command line, on exactly the hardened hosts watching + * for it. + */ + private fallbackPolicyUnproven = false + + constructor( + private readonly cooldownMs: number, + /** Public so the host can report its own start attempts to the same sink. */ + readonly warn: (message: string) => void, + /** Overridden only by tests; the default must stay monotonic. */ + private readonly now: () => number = monotonicNowMs + ) {} + + get executionPolicy(): WindowsExecutionPolicy { + return this.policy + } + + get policyRetryPending(): boolean { + return this.retryUnderFallbackPolicy + } + + get atPreferredPolicy(): boolean { + return this.policy === PREFERRED_WINDOWS_EXECUTION_POLICY + } + + /** Milliseconds left before the host may try a helper again; 0 when it may. */ + remainingCooldown(): number { + if (this.cooldownStartedAtMs === null) { + return 0 + } + // Elapsed since the cooldown began, never a stored deadline: a deadline is + // only as trustworthy as the clock it was computed against. + return Math.max(0, Math.ceil(this.cooldownMs - (this.now() - this.cooldownStartedAtMs))) + } + + requestPolicyRetry(): void { + this.retryUnderFallbackPolicy = true + } + + escalateExecutionPolicy(): void { + this.retryUnderFallbackPolicy = false + this.policy = FALLBACK_WINDOWS_EXECUTION_POLICY + this.fallbackPolicyUnproven = true + // Sticky once proven: a genuinely Restricted machine would otherwise pay a + // guaranteed failed spawn per operation. Only a helper that produced no + // output at all can reach here, so a snapshot cannot talk the host into it. + this.warn( + `runtime host start blocked at ${PREFERRED_WINDOWS_EXECUTION_POLICY}; trying ${FALLBACK_WINDOWS_EXECUTION_POLICY}` + ) + } + + /** A helper started under the current policy, so the policy is the right one. */ + confirmExecutionPolicy(): void { + this.fallbackPolicyUnproven = false + } + + /** + * Undo an escalation the fallback never justified. + * + * The escalation is a diagnosis, and a fallback that cannot start a helper + * either disproves it: the policy was not what stopped the first attempt. Go + * back rather than latch, so a re-probe can escalate again later if the real + * cause clears. Re-probing costs one spawn per outage, which the failure + * count and its cooldown already bound, and never latching is the whole point + * of this class. + */ + abandonUnprovenFallback(): void { + if (!this.fallbackPolicyUnproven) { + return + } + this.fallbackPolicyUnproven = false + this.policy = PREFERRED_WINDOWS_EXECUTION_POLICY + this.warn( + `${FALLBACK_WINDOWS_EXECUTION_POLICY} did not start a helper either, so the execution policy was not the cause; returning to ${PREFERRED_WINDOWS_EXECUTION_POLICY}` + ) + } + + recordFailure(): void { + this.consecutiveSuccesses = 0 + this.consecutiveFailures++ + } + + /** True once a helper has died often enough that respawning is just thrash. */ + get exhausted(): boolean { + return this.consecutiveFailures >= MAX_START_ATTEMPTS + } + + recordSuccess(): void { + this.consecutiveSuccesses++ + this.fallbackPolicyUnproven = false + // Why a clean run and not a single reply: a helper that answers one + // operation and dies on the next would otherwise reset the count forever, + // and respawn once per operation — the exact burst the host removes. + if (this.consecutiveSuccesses >= MAX_START_ATTEMPTS) { + this.consecutiveFailures = 0 + } + if (this.cooldownStartedAtMs === null) { + return + } + this.cooldownStartedAtMs = null + this.warn('runtime host recovered; operations are served by the persistent helper again') + } + + enterCooldown(): void { + // An escalation that never started a helper must not outlive the outage it + // was guessed from; the next one re-diagnoses from the preferred policy. + this.abandonUnprovenFallback() + const failures = this.consecutiveFailures + this.cooldownStartedAtMs = this.now() + // The wait is the penalty; leaving the count at the limit would charge twice + // and let the first death after recovery re-enter a full cooldown, so an + // interleaved workload would spend its life on the one-shot bridge. + this.consecutiveFailures = 0 + this.consecutiveSuccesses = 0 + this.warn( + `runtime host unavailable after ${failures} consecutive failures; falling back to one powershell.exe per operation for ${this.cooldownMs}ms` + ) + } + + clearCooldown(): void { + this.cooldownStartedAtMs = null + } +} diff --git a/src/main/computer/desktop-script-runtime-host.test.ts b/src/main/computer/desktop-script-runtime-host.test.ts new file mode 100644 index 00000000000..4d42a3c3e37 --- /dev/null +++ b/src/main/computer/desktop-script-runtime-host.test.ts @@ -0,0 +1,857 @@ +import { EventEmitter } from 'node:events' +import { afterEach, describe, expect, it, vi } from 'vitest' +import type { ProcessSpec } from '../../shared/child-process/process-spec' +import type { RuntimeChildProcess } from './desktop-script-serve-channel' +import { DesktopScriptRuntimeHost, isRuntimeHostUnavailable } from './desktop-script-runtime-host' + +const POLICY_ERROR = + 'File runtime.ps1 cannot be loaded because running scripts\nis disabled on this system.\n + CategoryInfo : SecurityError' + +class FakeRuntimeChild extends EventEmitter { + readonly stdout = new EventEmitter() + readonly stderr = new EventEmitter() + readonly writes: string[] = [] + killed = false + stdinEnded = false + /** Holds write callbacks so a late stdin failure can be fired deliberately. */ + deferWrites = false + private readonly pendingWrites: ((error?: Error | null) => void)[] = [] + + readonly stdin = { + write: (chunk: string, callback?: (error?: Error | null) => void): boolean => { + this.writes.push(chunk) + if (this.deferWrites) { + if (callback) { + this.pendingWrites.push(callback) + } + return true + } + callback?.(null) + return true + }, + end: (): void => { + this.stdinEnded = true + }, + on: (): void => {} + } + + kill(): boolean { + this.killed = true + return true + } + + /** What a destroyed stdin does to writes still queued at teardown. */ + failQueuedWrites(): void { + for (const callback of this.pendingWrites.splice(0)) { + callback(new Error('ERR_STREAM_DESTROYED')) + } + } + + /** Fail one queued write, leaving later ones outstanding. */ + failQueuedWrite(index: number): void { + this.pendingWrites.splice(index, 1)[0](new Error('EPIPE')) + } + + /** Requests written to this child, decoded. */ + requests(): Record[] { + return this.writes.map((line) => JSON.parse(line) as Record) + } + + /** The id the host is currently waiting on, so replies can echo it. */ + pendingId(): number { + return this.requests().at(-1)?.requestId as number + } + + /** The announcement the real serve loop writes before its first read. */ + ready(): void { + this.write('{"ready":true}\n') + } + + respond(response: Record, requestId = this.pendingId()): void { + this.write(`${JSON.stringify({ ...response, requestId })}\n`) + } + + write(raw: string): void { + this.stdout.emit('data', Buffer.from(raw, 'utf8')) + } + + exit(code: number | null, stderr = ''): void { + if (stderr) { + this.stderr.emit('data', Buffer.from(stderr, 'utf8')) + } + this.emit('close', code, null) + } +} + +function createHost( + options: { + idleShutdownMs?: number + requestTimeoutMs?: number + cooldownMs?: number + now?: () => number + deferWrites?: boolean + } = {} +) { + const children: FakeRuntimeChild[] = [] + const specs: ProcessSpec[] = [] + const warnings: string[] = [] + const host = new DesktopScriptRuntimeHost('C:\\orca\\runtime.ps1', { + ...options, + powerShellPath: () => 'C:\\Windows\\System32\\powershell.exe', + warn: (message) => warnings.push(message), + spawn: (spec) => { + specs.push(spec) + const child = new FakeRuntimeChild() + child.deferWrites = options.deferWrites === true + children.push(child) + return child as unknown as RuntimeChildProcess + } + }) + return { host, children, specs, warnings } +} + +/** Let the host's queue microtasks drain so the next request reaches its child. */ +async function settle(): Promise { + for (let index = 0; index < 6; index++) { + await Promise.resolve() + } +} + +/** The wait the host reported, read back out of its refusal message. */ +function remainingCooldownMs(error: Error | null): number { + const match = /retrying the runtime host in (\d+)ms/.exec(error?.message ?? '') + return match ? Number(match[1]) : Number.NaN +} + +/** Kill each helper the host starts, until it stops starting them. */ +async function failEveryStart(children: FakeRuntimeChild[], stderr: string): Promise { + for (let index = 0; index < 8; index++) { + if (index >= children.length) { + return + } + children[index].exit(1, stderr) + await settle() + } +} + +describe('DesktopScriptRuntimeHost', () => { + afterEach(() => { + vi.useRealTimers() + vi.restoreAllMocks() + }) + + it('starts one helper for many operations and never writes an operation file', async () => { + const { host, children, specs } = createHost() + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await expect(first).resolves.toMatchObject({ ok: true }) + + for (let index = 0; index < 5; index++) { + const next = host.request({ tool: 'click', app: 'Notepad' }) + await settle() + children[0].respond({ ok: true, action: { path: 'synthetic' } }) + await expect(next).resolves.toMatchObject({ ok: true }) + } + + expect(children).toHaveLength(1) + expect(children[0].requests()).toHaveLength(6) + expect(specs[0].args).toEqual([ + '-NoLogo', + '-NoProfile', + '-NonInteractive', + '-ExecutionPolicy', + 'RemoteSigned', + '-File', + 'C:\\orca\\runtime.ps1', + '-Serve' + ]) + host.dispose() + }) + + it('serializes requests so only one operation is ever in flight', async () => { + const { host, children } = createHost() + + const first = host.request({ tool: 'click', app: 'A' }) + const second = host.request({ tool: 'click', app: 'B' }) + await settle() + + expect(children[0].requests()).toEqual([{ tool: 'click', app: 'A', requestId: 1 }]) + + children[0].respond({ ok: true, action: { path: 'synthetic' } }) + await expect(first).resolves.toMatchObject({ ok: true }) + await settle() + + expect(children[0].requests()).toHaveLength(2) + children[0].respond({ ok: true, action: { path: 'accessibility' } }) + await expect(second).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('strips the echoed id from the response it hands back', async () => { + const { host, children } = createHost() + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + + await expect(promise).resolves.toEqual({ ok: true, capabilities: {} }) + host.dispose() + }) + + it('reassembles a response split across chunks, including a split code point', async () => { + const { host, children } = createHost() + const promise = host.request({ tool: 'get_app_state', app: 'Editor' }) + await settle() + + const payload = Buffer.from( + `${JSON.stringify({ ok: true, snapshot: { app: 'né' }, requestId: 1 })}\r\n`, + 'utf8' + ) + const split = payload.indexOf(Buffer.from('é', 'utf8')) + 1 + children[0].stdout.emit('data', payload.subarray(0, split)) + children[0].stdout.emit('data', payload.subarray(split)) + + await expect(promise).resolves.toEqual({ ok: true, snapshot: { app: 'né' } }) + host.dispose() + }) + + it('kills the helper rather than answering a request with another reply', async () => { + const { host, children } = createHost() + + const first = host.request({ tool: 'handshake' }) + await settle() + // A stray line would otherwise shift every later response by one. + children[0].respond({ ok: true, capabilities: {} }, 999) + + await expect(first).rejects.toThrow(/did not match the pending request/) + expect(children[0].killed).toBe(true) + host.dispose() + }) + + it('kills the helper when an unsolicited line arrives with nothing pending', async () => { + const { host, children } = createHost() + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await first + + children[0].write(`${JSON.stringify({ ok: true, requestId: 77 })}\n`) + expect(children[0].killed).toBe(true) + host.dispose() + }) + + it('times out a wedged operation and starts a fresh helper for the next one', async () => { + vi.useFakeTimers() + const { host, children } = createHost({ requestTimeoutMs: 30_000 }) + + const promise = host.request({ tool: 'click', app: 'Frozen' }) + await settle() + await vi.advanceTimersByTimeAsync(30_001) + + await expect(promise).rejects.toMatchObject({ code: 'action_timeout' }) + expect(children[0].killed).toBe(true) + + const next = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(2) + children[1].respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('rejects the in-flight request when a working helper crashes, then restarts', async () => { + const { host, children } = createHost() + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await first + + const second = host.request({ tool: 'click', app: 'Notepad' }) + await settle() + children[0].exit(1, 'boom') + + await expect(second).rejects.toMatchObject({ code: 'accessibility_error' }) + await expect(second).rejects.toThrow(/runtime host exited/) + + const third = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(2) + children[1].respond({ ok: true, capabilities: {} }) + await expect(third).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('stops respawning a helper that dies on every second operation', async () => { + let clock = 1_000 + const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock }) + + // One good answer per helper is exactly the pattern that used to respawn + // forever: the success reset the failure count before it could ever trip. + for (let round = 0; round < 3; round++) { + const good = host.request({ tool: 'handshake' }) + await settle() + children.at(-1)?.respond({ ok: true, capabilities: {} }) + await expect(good).resolves.toMatchObject({ ok: true }) + await settle() + + const crash = host.request({ tool: 'click', app: 'Crashy' }) + await settle() + children.at(-1)?.exit(1, 'boom') + await expect(crash).rejects.toThrow(/runtime host exited/) + await settle() + } + + const spawned = children.length + await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable) + expect(children).toHaveLength(spawned) + host.dispose() + }) + + it('keeps serving a healthy helper after an isolated crash', async () => { + const { host, children } = createHost({ cooldownMs: 60_000 }) + + const crashed = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await crashed + const second = host.request({ tool: 'click', app: 'Notepad' }) + await settle() + children[0].exit(1, 'boom') + await expect(second).rejects.toThrow(/runtime host exited/) + + for (let index = 0; index < 4; index++) { + const next = host.request({ tool: 'handshake' }) + await settle() + children.at(-1)?.respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + } + + // A clean run clears the count, so one bad helper cannot degrade a good one. + expect(children).toHaveLength(2) + host.dispose() + }) + + it('stops respawning a helper that keeps answering the wrong request', async () => { + let clock = 1_000 + const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock }) + + // Desync is host-detected, so it bypassed the exit handler entirely: without + // its own accounting this respawned once per operation, forever. + for (let round = 0; round < 3; round++) { + const promise = host.request({ tool: 'handshake' }) + await settle() + const child = children.at(-1) + child?.respond({ ok: true, capabilities: {} }, child.pendingId() + 500) + await expect(promise).rejects.toThrow(/did not match the pending request/) + await settle() + } + + const spawned = children.length + await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable) + expect(children).toHaveLength(spawned) + host.dispose() + }) + + it('stops respawning a helper that times out on every operation', async () => { + vi.useFakeTimers() + let clock = 1_000 + const { host, children } = createHost({ + requestTimeoutMs: 1_000, + cooldownMs: 60_000, + now: () => clock + }) + + for (let round = 0; round < 3; round++) { + const promise = host.request({ tool: 'get_app_state', app: 'Frozen' }) + await settle() + await vi.advanceTimersByTimeAsync(1_001) + await expect(promise).rejects.toMatchObject({ code: 'action_timeout' }) + await settle() + } + + const spawned = children.length + await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable) + expect(children).toHaveLength(spawned) + host.dispose() + }) + + it('never re-sends a mutation to a fresh helper after a pre-answer death', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'click', app: 'Notepad', x: 10, y: 10 }) + await settle() + children[0].exit(1, 'Add-Type : Cannot access the temporary directory') + + // The click may already have landed inside the helper that died; replaying + // it would click twice. An observation in the same position is retried. + await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable) + expect(children).toHaveLength(1) + host.dispose() + }) + + it('never replays a mutation once the helper announced it was reading', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'click', app: 'Notepad', x: 10, y: 10 }) + await settle() + children[0].ready() + // Past the announcement the click may already have been synthesized: the + // snapshot that follows it is the fault-prone part, so a missing reply + // proves nothing about whether the input landed. + children[0].exit(1, 'faulting module gdiplus.dll') + + await expect(promise).rejects.toThrow(/runtime host exited/) + expect(children).toHaveLength(1) + host.dispose() + }) + + it('replays a mutation only for a helper that died before announcing readiness', async () => { + const { host, children } = createHost() + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].ready() + children[0].respond({ ok: true, capabilities: {} }) + await first + + const crashed = host.request({ tool: 'click', app: 'Notepad', x: 1, y: 1 }) + await settle() + children[0].exit(1, 'boom') + await expect(crashed).rejects.toThrow(/runtime host exited/) + + const retried = host.request({ tool: 'click', app: 'Notepad', x: 1, y: 1 }) + await settle() + // This helper never announced, so it cannot have read the click: replaying + // is a fact rather than a guess, and the caller never sees the stumble. + children[1].exit(1, 'Add-Type : Cannot access the temporary directory') + await settle() + + expect(children).toHaveLength(3) + children[2].ready() + children[2].respond({ ok: true, action: { path: 'synthetic' } }) + await expect(retried).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('does not treat the readiness announcement as an unmatched reply', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].ready() + + expect(children[0].killed).toBe(false) + children[0].respond({ ok: true, capabilities: {} }) + await expect(promise).resolves.toEqual({ ok: true, capabilities: {} }) + host.dispose() + }) + + it('charges one cooldown per outage, not one per later death', async () => { + let clock = 1_000 + const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock }) + + const failed = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, 'The term is not recognized') + await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable) + + clock += 61_000 + const recovered = host.request({ tool: 'handshake' }) + await settle() + children.at(-1)?.respond({ ok: true, capabilities: {} }) + await recovered + + // One death after recovery must not re-enter a full cooldown; the previous + // outage was already paid for. + const crashed = host.request({ tool: 'handshake' }) + await settle() + children.at(-1)?.exit(1, 'boom') + await expect(crashed).rejects.toBeInstanceOf(Error) + + const next = host.request({ tool: 'handshake' }) + await settle() + children.at(-1)?.respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('charges one failure when a write fails after the helper was torn down', async () => { + const { host, children, warnings } = createHost({ deferWrites: true }) + + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }, 999) + await expect(promise).rejects.toThrow(/did not match the pending request/) + + // stop() destroys stdin, so the queued write calls back with an error. That + // is the same operation failing, not a second one, and counting it twice + // would drive a 3-strike cooldown at half the intended rate. + children[0].failQueuedWrites() + + expect(warnings.filter((line) => /helper stopped/.test(line))).toHaveLength(1) + host.dispose() + }) + + it('never lets a stale write error stop a replacement helper', async () => { + const { host, children } = createHost({ deferWrites: true }) + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }, 999) + await expect(first).rejects.toBeInstanceOf(Error) + + const second = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(2) + + // The late callback belongs to a channel and a request that are both gone. + children[0].failQueuedWrites() + + expect(children[1].killed).toBe(false) + children[1].respond({ ok: true, capabilities: {} }) + await expect(second).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('ignores a write error for a request that already finished', async () => { + const { host, children } = createHost({ deferWrites: true }) + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await first + + const second = host.request({ tool: 'handshake' }) + await settle() + + // Backpressure can hold a write callback past its own response. The channel + // is alive and was never stopped, so only the request id can tell that this + // report is stale — this is what pins the host-side guard on its own. + children[0].failQueuedWrite(0) + + expect(children[0].killed).toBe(false) + children[0].respond({ ok: true, capabilities: {} }) + await expect(second).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('shuts the helper down when idle and starts a new one on the next operation', async () => { + vi.useFakeTimers() + const { host, children } = createHost({ idleShutdownMs: 60_000 }) + + const first = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await first + await settle() + + expect(children[0].killed).toBe(false) + await vi.advanceTimersByTimeAsync(60_001) + expect(children[0].stdinEnded).toBe(true) + expect(children[0].killed).toBe(true) + + const next = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(2) + children[1].respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('disposes the helper and rejects the in-flight request', async () => { + const { host, children } = createHost() + const promise = host.request({ tool: 'click', app: 'Notepad' }) + await settle() + + host.dispose() + + expect(children[0].stdinEnded).toBe(true) + expect(children[0].killed).toBe(true) + await expect(promise).rejects.toThrow(/shut down/) + }) + + it('never respawns for a request queued behind dispose', async () => { + const { host, children } = createHost() + const first = host.request({ tool: 'handshake' }) + const queued = host.request({ tool: 'handshake' }) + await settle() + + host.dispose() + await expect(first).rejects.toBeInstanceOf(Error) + await expect(queued).rejects.toSatisfy(isRuntimeHostUnavailable) + await settle() + + expect(children).toHaveLength(1) + }) + + it('falls back to Bypass once when the execution policy blocks the start', async () => { + const { host, children, specs, warnings } = createHost() + + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].exit(1, POLICY_ERROR) + await settle() + + expect(children).toHaveLength(2) + expect(specs[1].args).toContain('Bypass') + children[1].respond({ ok: true, capabilities: {} }) + await expect(promise).resolves.toMatchObject({ ok: true }) + expect(warnings.some((line) => /trying Bypass/.test(line))).toBe(true) + + // A helper started under Bypass, so the diagnosis is proven and the fallback + // is remembered for the session rather than re-probed per call. + const next = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(2) + children[1].respond({ ok: true, capabilities: {} }) + await next + expect(warnings.some((line) => /returning to RemoteSigned/.test(line))).toBe(false) + host.dispose() + }) + + it('returns to RemoteSigned when Bypass does not start a helper either', async () => { + let clock = 1_000 + const { host, children, specs, warnings } = createHost({ cooldownMs: 60_000, now: () => clock }) + + // What AppLocker and WDAC constrained language mode look like: the same + // SecurityError category, but the block is at script load, so Bypass cannot + // lift it and the escalation was a misdiagnosis. + const promise = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, POLICY_ERROR) + await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable) + + expect(specs[1].args).toContain('Bypass') + expect(warnings.some((line) => /returning to RemoteSigned/.test(line))).toBe(true) + // The revert lands inside the outage, not just at its end: every attempt + // after the fallback is disproved is back on the preferred policy, so the + // misdiagnosis costs one Bypass command line rather than one per attempt. + expect(specs).toHaveLength(3) + expect(specs[2].args).not.toContain('Bypass') + + // Latching here would put the most heavily weighted MDE token on every + // later command line, on exactly the hardened host that is watching. + clock += 61_000 + const recovered = host.request({ tool: 'handshake' }) + await settle() + expect(specs.at(-1)?.args).not.toContain('Bypass') + children.at(-1)?.respond({ ok: true, capabilities: {} }) + await expect(recovered).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('reports itself unavailable when Bypass is also refused', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, POLICY_ERROR) + + await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable) + host.dispose() + }) + + it('reports itself unavailable when the helper cannot be spawned at all', async () => { + const host = new DesktopScriptRuntimeHost('C:\\orca\\runtime.ps1', { + powerShellPath: () => 'C:\\Windows\\System32\\powershell.exe', + warn: () => {}, + spawn: () => { + throw new Error('spawn ENOENT') + } + }) + + await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable) + host.dispose() + }) + + it('retries a transient pre-answer death without the caller ever seeing it', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].exit(1, 'Add-Type : Cannot access the temporary directory') + await settle() + + expect(children).toHaveLength(2) + children[1].respond({ ok: true, capabilities: {} }) + + await expect(promise).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('gives up only after repeated start failures, then serves from the host again after the cooldown', async () => { + let clock = 1_000 + const { host, children, warnings } = createHost({ cooldownMs: 60_000, now: () => clock }) + + const failed = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, 'The term is not recognized') + await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable) + + const attempts = children.length + expect(attempts).toBe(3) + + // Inside the cooldown the host stays out of the way without respawning. + clock += 30_000 + await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable) + expect(children).toHaveLength(attempts) + + // Past it, the next operation re-probes rather than staying degraded forever. + clock += 31_000 + const recovered = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(attempts + 1) + children[attempts].respond({ ok: true, capabilities: {} }) + await expect(recovered).resolves.toMatchObject({ ok: true }) + + expect(warnings.at(-1)).toMatch(/recovered/) + host.dispose() + }) + + it('keeps the helper account of a reply it could not tag', async () => { + const { host, children } = createHost() + + const promise = host.request({ tool: 'handshake' }) + await settle() + const child = children[0] + // What an old runtime.ps1 sends when a request will not parse: a real error, + // with no id to route it by. The desync is honest, but replacing its message + // reports a broken stream and loses the only account of the cause. + child.respond({ ok: false, error: 'Invalid object passed in' }, child.pendingId() + 500) + + await expect(promise).rejects.toThrow( + /did not match the pending request: Invalid object passed in/ + ) + host.dispose() + }) + + it('does not charge a cooldown for requests the helper rejects as malformed', async () => { + const { host, children } = createHost({ cooldownMs: 60_000 }) + + // A tagged error is the helper working, not failing. Three of them used to + // arrive untagged, and three desync aborts is exactly the cooldown. + for (let round = 0; round < 3; round++) { + const promise = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: false, error: 'Invalid object passed in' }) + await expect(promise).resolves.toMatchObject({ ok: false }) + await settle() + } + + expect(children).toHaveLength(1) + const next = host.request({ tool: 'handshake' }) + await settle() + children[0].respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('fails a request that spends its whole timeout queued behind others', async () => { + vi.useFakeTimers() + const { host, children } = createHost({ requestTimeoutMs: 1_000 }) + + // Two ahead of it, because one puts the turn exactly on the deadline. + const first = host.request({ tool: 'get_app_state', app: 'Frozen' }) + const second = host.request({ tool: 'get_app_state', app: 'Frozen' }) + const queued = host.request({ tool: 'click', app: 'Notepad' }) + // Asserted before the clock moves: both reject while the test is still + // inside advanceTimersByTimeAsync. + const firstFailed = expect(first).rejects.toMatchObject({ code: 'action_timeout' }) + // Its own deadline, not the one it would inherit by reaching the head. + const queuedFailed = expect(queued).rejects.toMatchObject({ + code: 'action_timeout', + message: /waiting for earlier operations/ + }) + await settle() + expect(children[0].requests()).toHaveLength(1) + + await vi.advanceTimersByTimeAsync(1_001) + await firstFailed + await queuedFailed + + // Drain past the abandoned request: it is never handed to a helper, because + // a click the caller has been told failed must not still land. + children[1].respond({ ok: true, state: {} }) + await expect(second).resolves.toMatchObject({ ok: true }) + await settle() + expect(children.flatMap((child) => child.requests())).not.toContainEqual( + expect.objectContaining({ tool: 'click' }) + ) + + // The request that gave up does not poison the queue behind it. + const next = host.request({ tool: 'handshake' }) + await settle() + children[1].respond({ ok: true, capabilities: {} }) + await expect(next).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + it('gives a queued request its full timeout once it reaches the helper', async () => { + vi.useFakeTimers() + const { host, children } = createHost({ requestTimeoutMs: 1_000 }) + + const head = host.request({ tool: 'handshake' }) + const queued = host.request({ tool: 'get_app_state', app: 'Slow' }) + await settle() + + await vi.advanceTimersByTimeAsync(900) + children[0].respond({ ok: true, capabilities: {} }) + await expect(head).resolves.toMatchObject({ ok: true }) + await settle() + + // Past the point the enqueue deadline would have fired: waiting its turn + // must not eat the budget the operation itself is entitled to. + await vi.advanceTimersByTimeAsync(900) + children[0].respond({ ok: true, state: {} }) + await expect(queued).resolves.toMatchObject({ ok: true }) + host.dispose() + }) + + // Both of these deliberately leave `now` unset: the bug was in the default the + // host picks, so a test that injects a clock cannot see it. + it('does not stretch the cooldown when the wall clock steps backwards', async () => { + const wallClock = vi.spyOn(Date, 'now').mockReturnValue(2_000_000_000_000) + const { host, children } = createHost({ cooldownMs: 60_000 }) + + const failed = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, 'The term is not recognized') + await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable) + + // An NTP correction, a VM snapshot restore, a user changing the clock. + wallClock.mockReturnValue(2_000_000_000_000 - 3_600_000) + + const refused = await host.request({ tool: 'handshake' }).then( + () => null, + (error: Error) => error + ) + expect(refused?.message).toMatch(/retrying the runtime host in/) + expect(remainingCooldownMs(refused)).toBeLessThanOrEqual(60_000) + host.dispose() + }) + + it('serves from the persistent helper again after a backwards clock step', async () => { + vi.spyOn(Date, 'now').mockReturnValue(2_000_000_000_000) + const { host, children } = createHost({ cooldownMs: 25 }) + + const failed = host.request({ tool: 'handshake' }) + await settle() + await failEveryStart(children, 'The term is not recognized') + await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable) + const attempts = children.length + + vi.mocked(Date.now).mockReturnValue(2_000_000_000_000 - 3_600_000) + // Real elapsed time, because the clock under test is the real monotonic one. + await new Promise((resolve) => setTimeout(resolve, 60)) + + const recovered = host.request({ tool: 'handshake' }) + await settle() + expect(children).toHaveLength(attempts + 1) + children[attempts].respond({ ok: true, capabilities: {} }) + await expect(recovered).resolves.toMatchObject({ ok: true }) + host.dispose() + }) +}) diff --git a/src/main/computer/desktop-script-runtime-host.ts b/src/main/computer/desktop-script-runtime-host.ts new file mode 100644 index 00000000000..09aff5ec479 --- /dev/null +++ b/src/main/computer/desktop-script-runtime-host.ts @@ -0,0 +1,384 @@ +import { spawnProcess } from '../../shared/child-process/run-process' +import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary' +import { reportComputerDiagnostic } from './computer-sidecar-diagnostics' +import { isReplayableTool } from './desktop-script-action' +import type { BridgeRequest, BridgeResponse } from './desktop-script-provider-types' +import { DesktopScriptRequestQueue } from './desktop-script-request-queue' +import { + startServeChannel, + type DesktopScriptServeChannel, + type RuntimeProcessSpawn +} from './desktop-script-serve-channel' +import { + MAX_START_ATTEMPTS, + RuntimeHostAvailability, + START_FAILURE_COOLDOWN_MS +} from './desktop-script-runtime-availability' +import { RuntimeClientError } from './runtime-client-error' +import { + isExecutionPolicyBlocked, + windowsPowerShellRuntimeArgs +} from './windows-powershell-execution-policy' + +const REQUEST_TIMEOUT_MS = 30_000 +const IDLE_SHUTDOWN_MS = 120_000 + +/** Code the client keys on to serve this one operation from the one-shot bridge. */ +export const RUNTIME_HOST_UNAVAILABLE = 'runtime_host_unavailable' + +export type DesktopScriptRuntimeHostOptions = { + spawn?: RuntimeProcessSpawn + powerShellPath?: () => string + requestTimeoutMs?: number + idleShutdownMs?: number + cooldownMs?: number + now?: () => number + warn?: (message: string) => void +} + +type PendingRequest = { + id: number + resolve: (response: BridgeResponse) => void + reject: (error: Error) => void + timer: NodeJS.Timeout +} + +export function isRuntimeHostUnavailable(error: unknown): boolean { + return error instanceof RuntimeClientError && error.code === RUNTIME_HOST_UNAVAILABLE +} + +/** + * One long-lived `runtime.ps1 -Serve` process serving every computer-use + * operation over NDJSON on stdin/stdout. + * + * Why persistent: the one-shot bridge started a powershell.exe per click, and + * each one re-emitted the script's inline `Add-Type` P/Invoke assembly, which + * Defender for Endpoint reports as suspicious MSIL emission alongside the + * screen capture. Compiling once per session collapses a burst of short-lived + * PIDs into a single process. + * + * Requests are strictly serialized, and each carries an id the helper echoes. + * Serialization alone would leave a single stray line answering every later + * request with the previous response — silently acting on stale element + * indexes, with no error raised — so the id is checked and a mismatch is fatal + * to the child rather than merely logged. + */ +export class DesktopScriptRuntimeHost { + private channel: DesktopScriptServeChannel | null = null + private pending: PendingRequest | null = null + private idleTimer: NodeJS.Timeout | null = null + private childReady = false + private childAnswered = false + /** + * Set once any helper has announced itself, which proves the script on disk + * speaks the ready protocol. Until then a mutating request is not replayed + * even on a clean start failure, because ORCA_COMPUTER_DESKTOP_SCRIPT_PROVIDER_PATH + * can point at an older runtime.ps1 that simply never announces. + */ + private readyProtocolConfirmed = false + private disposed = false + private nextRequestId = 1 + private readonly availability: RuntimeHostAvailability + private readonly queue: DesktopScriptRequestQueue + private readonly requestTimeoutMs: number + private readonly idleShutdownMs: number + + constructor( + private readonly scriptPath: string, + private readonly options: DesktopScriptRuntimeHostOptions = {} + ) { + this.requestTimeoutMs = options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS + this.idleShutdownMs = options.idleShutdownMs ?? IDLE_SHUTDOWN_MS + this.queue = new DesktopScriptRequestQueue(this.requestTimeoutMs, () => this.armIdleTimer()) + this.availability = new RuntimeHostAvailability( + options.cooldownMs ?? START_FAILURE_COOLDOWN_MS, + (message) => (options.warn ?? reportComputerDiagnostic)(message), + options.now + ) + } + + request(request: BridgeRequest): Promise { + return this.queue.enqueue(() => this.send(request)) + } + + /** Permanently stop this host. Callers build a new one for a new session. */ + dispose(): void { + this.disposed = true + this.clearIdleTimer() + this.availability.clearCooldown() + this.stopChannel() + this.rejectPending( + new RuntimeClientError('accessibility_error', 'desktop provider runtime host was shut down') + ) + } + + private async send(request: BridgeRequest): Promise { + this.clearIdleTimer() + // Why checked here and not only on entry: requests queue, and dispose can + // land while one waits its turn. Without this a teardown respawns a helper. + if (this.disposed) { + throw this.unavailableError('runtime host was disposed') + } + const cooldown = this.availability.remainingCooldown() + if (cooldown > 0) { + throw this.unavailableError(`retrying the runtime host in ${cooldown}ms`) + } + let lastError: unknown + for (let attempt = 1; attempt <= MAX_START_ATTEMPTS; attempt++) { + try { + const response = await this.sendOnce(request) + this.availability.recordSuccess() + return response + } catch (error) { + lastError = error + if (this.availability.policyRetryPending) { + this.availability.escalateExecutionPolicy() + continue + } + // Only this error proves no helper started, which is what disproves the + // escalation; a helper that started and then died proves the opposite. + if (isRuntimeHostUnavailable(error)) { + this.availability.abandonUnprovenFallback() + } + // A helper that answered and then died is a crash, not a bad start: the + // caller sees it and the next operation gets a fresh process — unless it + // keeps happening, which is thrash the one-shot bridge should absorb. + if (!isRuntimeHostUnavailable(error) || !this.mayReplay(request)) { + if (this.availability.exhausted) { + this.availability.enterCooldown() + } + throw error + } + this.availability.warn( + `runtime host failed to start (attempt ${attempt}/${MAX_START_ATTEMPTS}): ${errorText(error)}` + ) + } + } + this.availability.enterCooldown() + throw lastError + } + + private sendOnce(request: BridgeRequest): Promise { + let channel: DesktopScriptServeChannel + try { + channel = this.ensureChannel() + } catch (error) { + this.availability.recordFailure() + return Promise.reject(this.unavailableError(errorText(error))) + } + const id = this.nextRequestId++ + return new Promise((resolve, reject) => { + // Why kill rather than wait: a hung UI Automation call cannot be + // cancelled, so the process itself is the only thing left to reclaim. + const timer = setTimeout(() => { + this.abortChannel( + new RuntimeClientError( + 'action_timeout', + `desktop provider timed out after ${this.requestTimeoutMs}ms` + ) + ) + }, this.requestTimeoutMs) + timer.unref?.() + this.pending = { id, resolve, reject, timer } + channel.write(`${JSON.stringify({ ...request, requestId: id })}\n`, (error) => { + // Bind the report to what it was written for: a late callback must not + // charge a second failure for this operation, nor stop a replacement + // helper and reject a later request with this one's error. Deliberately + // redundant with the channel's own closed guard — keep both. This one + // also covers a live channel whose request has already been answered, + // which the channel cannot see; that case is what pins it. + // + // Redundant does not mean untested: removing either guard alone fails a + // test, so neither can be deleted as "the one the other covers". + if (this.channel !== channel || this.pending?.id !== id) { + return + } + this.abortChannel(new RuntimeClientError('accessibility_error', error.message)) + }) + }) + } + + private ensureChannel(): DesktopScriptServeChannel { + if (this.channel) { + return this.channel + } + this.childReady = false + this.childAnswered = false + const channel: DesktopScriptServeChannel = startServeChannel( + { + program: (this.options.powerShellPath ?? windowsPowerShellPath)(), + args: windowsPowerShellRuntimeArgs(this.scriptPath, this.availability.executionPolicy, [ + '-Serve' + ]), + env: process.env + }, + this.options.spawn ?? spawnProcess, + { + onLine: (line) => this.deliver(line), + // A replaced channel can still report; that must not fail the live one. + onGone: (detail) => { + if (this.channel === channel) { + this.handleGone(detail) + } + }, + onOverflow: () => + this.abortChannel( + new RuntimeClientError( + 'accessibility_error', + 'desktop provider response exceeded the runtime host buffer' + ) + ) + } + ) + this.channel = channel + return channel + } + + /** + * Whether the helper that just died can be proved not to have run the request. + * + * Why proof and not inference: "no reply came back" is not "nothing happened". + * runtime.ps1 synthesizes the input and only then builds the snapshot, which + * allocates a full-window bitmap and walks the UIA tree — a native fault there + * is uncatchable and would leave a click already delivered. Retrying on that + * inference turns one requested click into four. + */ + private mayReplay(request: BridgeRequest): boolean { + if (this.childReady || this.childAnswered) { + return false + } + return this.readyProtocolConfirmed || isReplayableTool(request.tool) + } + + private deliver(line: string): void { + let parsed: Record + try { + parsed = JSON.parse(line) as Record + } catch { + // Not a response at all — a PowerShell banner, a stray write. Dropping it + // is safe now that the id below is what decides which request is answered, + // and it keeps a chatty console from making the helper unusable. + return + } + // The readiness announcement carries no request id and answers nothing. + if (parsed.ready === true && parsed.requestId === undefined) { + this.childReady = true + this.readyProtocolConfirmed = true + this.availability.confirmExecutionPolicy() + return + } + const pending = this.pending + if (!pending || parsed.requestId !== pending.id) { + // One unmatched reply would otherwise shift every later response by one. + // Carry the helper's own message when it sent one: a line it could not tag + // with an id is usually the only account of what went wrong, and reporting + // a bare desync in its place loses the cause for good. + const reported = typeof parsed.error === 'string' ? `: ${parsed.error}` : '' + this.abortChannel( + new RuntimeClientError( + 'accessibility_error', + `desktop provider response did not match the pending request${reported}` + ) + ) + return + } + // Only a reply this host can prove is its own counts as the helper working. + this.childAnswered = true + this.pending = null + clearTimeout(pending.timer) + const { requestId: _echoed, ...response } = parsed + pending.resolve(response as BridgeResponse) + } + + private handleGone(detail: string): void { + const started = this.childReady || this.childAnswered + this.channel = null + this.availability.recordFailure() + if (!started && this.availability.atPreferredPolicy && isExecutionPolicyBlocked(detail)) { + this.availability.requestPolicyRetry() + // Unavailable rather than a generic error, because this can now be the + // final attempt: reverting an unproven escalation puts the host back on + // the preferred policy, so a later attempt can land here again. Only this + // code routes the operation to the one-shot bridge, which carries its own + // policy fallback; anything else fails the operation outright. + this.rejectPending(this.unavailableError(detail)) + return + } + if (!started) { + this.rejectPending(this.unavailableError(detail)) + return + } + this.rejectPending( + new RuntimeClientError( + 'accessibility_error', + `desktop provider runtime host exited: ${detail}` + ) + ) + } + + /** + * Stop a helper this host has judged unusable — a timeout, a desynchronised + * reply, an oversized line. + * + * Why it counts as a failure: stopping the channel suppresses the exit + * handler, so without this these paths bypassed the accounting entirely and a + * helper that failed this way on every operation was respawned once per + * operation forever — the burst this host exists to remove, restored through + * its own recovery path. + */ + private abortChannel(error: Error): void { + this.stopChannel() + this.availability.recordFailure() + this.availability.warn(`runtime host helper stopped: ${error.message}`) + this.rejectPending(error) + } + + private stopChannel(): void { + const channel = this.channel + this.channel = null + channel?.stop() + } + + private takePending(): PendingRequest | null { + const pending = this.pending + this.pending = null + if (pending) { + clearTimeout(pending.timer) + } + return pending + } + + private rejectPending(error: Error): void { + this.takePending()?.reject(error) + } + + private armIdleTimer(): void { + this.clearIdleTimer() + if (!this.channel) { + return + } + this.idleTimer = setTimeout(() => { + this.idleTimer = null + this.stopChannel() + }, this.idleShutdownMs) + this.idleTimer.unref?.() + } + + private clearIdleTimer(): void { + if (this.idleTimer) { + clearTimeout(this.idleTimer) + this.idleTimer = null + } + } + + private unavailableError(message: string): RuntimeClientError { + return new RuntimeClientError( + RUNTIME_HOST_UNAVAILABLE, + `desktop provider runtime host could not start: ${message}` + ) + } +} + +function errorText(error: unknown): string { + return error instanceof Error ? error.message : String(error) +} diff --git a/src/main/computer/desktop-script-runtime-host.win32.test.ts b/src/main/computer/desktop-script-runtime-host.win32.test.ts new file mode 100644 index 00000000000..76927a7dd65 --- /dev/null +++ b/src/main/computer/desktop-script-runtime-host.win32.test.ts @@ -0,0 +1,130 @@ +import { resolve } from 'node:path' +import { afterEach, describe, expect, it } from 'vitest' +import { spawnProcess } from '../../shared/child-process/run-process' +import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary' +import { DesktopScriptRuntimeHost } from './desktop-script-runtime-host' +import { startServeChannel } from './desktop-script-serve-channel' +import { + PREFERRED_WINDOWS_EXECUTION_POLICY, + windowsPowerShellRuntimeArgs +} from './windows-powershell-execution-policy' + +/** + * The other half of the serve-mode proof: the unit test drives a fake child, + * this one drives the real `runtime.ps1 -Serve` on a real Windows box. + * + * Both are needed. The framing that matters — one NDJSON line per response, + * megabyte-scale screenshot payloads, a console writer that actually flushes — + * only exists in PowerShell, and a fake child cannot disprove any of it. + * + * Runs only on win32; skipped elsewhere. + */ +const describeOnWindows = process.platform === 'win32' ? describe : describe.skip + +const SCRIPT_PATH = resolve(__dirname, '../../../native/computer-use-windows/runtime.ps1') + +describeOnWindows('runtime.ps1 serve mode', () => { + let host: DesktopScriptRuntimeHost | null = null + let spawns = 0 + + function startHost(): DesktopScriptRuntimeHost { + spawns = 0 + host = new DesktopScriptRuntimeHost(SCRIPT_PATH, { + warn: () => {}, + spawn: (spec) => { + spawns++ + return spawnProcess(spec) + } + }) + return host + } + + afterEach(() => { + host?.dispose() + host = null + }) + + it('answers repeated operations from a single PowerShell process', async () => { + const runtime = startHost() + + await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({ + ok: true, + capabilities: { protocolVersion: 1, provider: 'orca-computer-use-windows' } + }) + + const apps = await runtime.request({ tool: 'list_apps' }) + expect(apps.ok).toBe(true) + expect(Array.isArray(apps.apps)).toBe(true) + + await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({ ok: true }) + + expect(spawns).toBe(1) + }) + + it('returns a structured error for a bad request without killing the helper', async () => { + const runtime = startHost() + + await expect(runtime.request({ tool: 'not_a_tool' })).resolves.toMatchObject({ ok: false }) + await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({ ok: true }) + expect(spawns).toBe(1) + }) + + /** + * The host can only write well-formed JSON, so the parse-failure branch of the + * serve loop is unreachable through it. Driving the channel directly is the + * only way to prove what the real PowerShell answers. + */ + it('echoes the id it can recover when a request will not parse', async () => { + const answer = await answerRawLine('{"tool":"handshake","requestId":7') + + // Tagged, so the host resolves the waiting request with a failed operation + // instead of reading an untagged line as a desynchronised stream. + expect(answer).toMatchObject({ ok: false, requestId: 7 }) + expect(String(answer.error)).not.toBe('') + }) + + it('reports an error for a line with no recoverable id', async () => { + const answer = await answerRawLine('{"tool":"handshake"') + + expect(answer).toMatchObject({ ok: false }) + expect(answer.requestId).toBeUndefined() + expect(String(answer.error)).not.toBe('') + }) +}) + +/** One raw line into a real `runtime.ps1 -Serve`, and the line it writes back. */ +function answerRawLine(raw: string): Promise> { + return new Promise((settle, fail) => { + const channel = startServeChannel( + { + program: windowsPowerShellPath(), + args: windowsPowerShellRuntimeArgs(SCRIPT_PATH, PREFERRED_WINDOWS_EXECUTION_POLICY, [ + '-Serve' + ]), + env: process.env + }, + spawnProcess, + { + onLine: (line) => { + let parsed: Record + try { + parsed = JSON.parse(line) as Record + } catch { + return + } + if (parsed.ready === true) { + channel.write(`${raw}\n`, fail) + return + } + channel.stop() + settle(parsed) + }, + onGone: (detail) => fail(new Error(`helper exited before answering: ${detail}`)), + onOverflow: () => { + channel.stop() + fail(new Error('helper overflowed the response buffer')) + } + } + ) + }) +} diff --git a/src/main/computer/desktop-script-serve-channel.test.ts b/src/main/computer/desktop-script-serve-channel.test.ts new file mode 100644 index 00000000000..80a5dd491d3 --- /dev/null +++ b/src/main/computer/desktop-script-serve-channel.test.ts @@ -0,0 +1,99 @@ +import { EventEmitter } from 'node:events' +import { describe, expect, it, vi } from 'vitest' +import { DesktopScriptServeChannel, type RuntimeChildProcess } from './desktop-script-serve-channel' + +class FakeChild extends EventEmitter { + readonly stdout = new EventEmitter() + readonly stderr = new EventEmitter() + readonly writes: string[] = [] + killed = false + private readonly pendingWrites: ((error?: Error | null) => void)[] = [] + + readonly stdin = { + write: (chunk: string, callback?: (error?: Error | null) => void): boolean => { + this.writes.push(chunk) + if (callback) { + this.pendingWrites.push(callback) + } + return true + }, + end: (): void => {}, + on: (): void => {} + } + + kill(): boolean { + this.killed = true + return true + } + + /** What a destroyed stdin does to writes still queued at teardown. */ + failQueuedWrites(): void { + for (const callback of this.pendingWrites.splice(0)) { + callback(new Error('ERR_STREAM_DESTROYED')) + } + } +} + +function createChannel() { + const child = new FakeChild() + const handlers = { onLine: vi.fn(), onGone: vi.fn(), onOverflow: vi.fn() } + const channel = new DesktopScriptServeChannel(child as unknown as RuntimeChildProcess, handlers) + return { channel, child, handlers } +} + +describe('DesktopScriptServeChannel', () => { + it('splits responses into lines and tolerates a trailing carriage return', () => { + const { child, handlers } = createChannel() + + child.stdout.emit('data', Buffer.from('{"a":1}\r\n{"b":2}\n', 'utf8')) + + expect(handlers.onLine.mock.calls.map(([line]) => line)).toEqual(['{"a":1}', '{"b":2}']) + }) + + it('reports the exit reason with the stderr tail', () => { + const { child, handlers } = createChannel() + + child.stderr.emit('data', Buffer.from('it broke', 'utf8')) + child.emit('close', 1, null) + + expect(handlers.onGone).toHaveBeenCalledWith('code 1: it broke') + }) + + describe('once stopped', () => { + /** + * The channel's half of the stale-callback guard, pinned here rather than + * through the host: the host refuses a stale report too, so a host-level + * test passes with either guard alone and neither ends up covered. + */ + it('accepts no further writes', () => { + const { channel, child } = createChannel() + + channel.stop() + channel.write('{"tool":"click"}\n', vi.fn()) + + expect(child.writes).toEqual([]) + }) + + it('reports no error from a write that was already queued', () => { + const { channel, child } = createChannel() + const onError = vi.fn() + + channel.write('{"tool":"click"}\n', onError) + channel.stop() + child.failQueuedWrites() + + expect(onError).not.toHaveBeenCalled() + }) + + it('reports neither lines nor the exit it was asked to cause', () => { + const { channel, child, handlers } = createChannel() + + channel.stop() + child.stdout.emit('data', Buffer.from('{"a":1}\n', 'utf8')) + child.emit('close', 0, null) + + expect(handlers.onLine).not.toHaveBeenCalled() + expect(handlers.onGone).not.toHaveBeenCalled() + }) + }) +}) diff --git a/src/main/computer/desktop-script-serve-channel.ts b/src/main/computer/desktop-script-serve-channel.ts new file mode 100644 index 00000000000..afabb47962a --- /dev/null +++ b/src/main/computer/desktop-script-serve-channel.ts @@ -0,0 +1,145 @@ +import { StringDecoder } from 'node:string_decoder' +import type { ProcessSpec } from '../../shared/child-process/process-spec' +import type { spawnProcess } from '../../shared/child-process/run-process' + +/** The all-pipes child `spawnProcess` returns; avoids a node:child_process import. */ +export type RuntimeChildProcess = ReturnType + +export type RuntimeProcessSpawn = (spec: ProcessSpec) => RuntimeChildProcess + +/** UTF-16 units, not bytes — this bounds the buffer, it is not a payload contract. */ +const MAX_RESPONSE_CHARS = 20 * 1024 * 1024 +const MAX_STDERR_CHARS = 4096 + +export type ServeChannelHandlers = { + /** One complete line from the helper, without its terminator. */ + onLine: (line: string) => void + /** The helper is gone; detail carries the exit reason and its stderr tail. */ + onGone: (detail: string) => void + /** The helper produced more than one buffer's worth without a line break. */ + onOverflow: () => void +} + +/** + * One `runtime.ps1 -Serve` child, framed as NDJSON lines. + * + * Split from the host so the host reads as what it is — a queue, a retry policy + * and a correlation check — rather than that plus stream plumbing. Responses + * carry base64 screenshots and routinely exceed a megabyte, so lines are + * reassembled across chunks with a decoder that survives a code point split + * across a chunk boundary. + */ +export class DesktopScriptServeChannel { + private readonly decoder = new StringDecoder('utf8') + private buffer = '' + private stderrTail = '' + private detach: (() => void) | null = null + private closed = false + + constructor( + private readonly child: RuntimeChildProcess, + private readonly handlers: ServeChannelHandlers + ) { + const onStdout = (chunk: Buffer | string): void => this.readStdout(chunk) + const onStderr = (chunk: Buffer | string): void => { + this.stderrTail = `${this.stderrTail}${chunk.toString()}`.slice(-MAX_STDERR_CHARS) + } + // Why close and not exit: the caller classifies the failure from stderr, and + // only close guarantees the stdio streams were drained first. + const onClose = (code: number | null, signal: NodeJS.Signals | null): void => + this.reportGone(signal ? `signal ${signal}` : `code ${code ?? 'unknown'}`) + const onError = (error: Error): void => this.reportGone(error.message) + child.stdout.on('data', onStdout) + child.stderr.on('data', onStderr) + child.once('close', onClose) + child.once('error', onError) + // An unhandled stream error is an uncaught exception in the main process. + child.stdin.on('error', () => {}) + this.detach = (): void => { + child.stdout.off('data', onStdout) + child.stderr.off('data', onStderr) + child.off('close', onClose) + child.off('error', onError) + child.on('error', () => {}) + } + } + + write(payload: string, onError: (error: Error) => void): void { + if (this.closed) { + return + } + this.child.stdin.write(payload, (error) => { + // A destroyed stdin calls back after stop(); reporting then charges the + // caller a second failure for one operation. Deliberately redundant with + // the host's own staleness check — keep both, and note that each is + // pinned separately, this one by the "once stopped" tests here. + if (error && !this.closed) { + onError(error) + } + }) + } + + /** Stop the helper and go silent; handlers are not called afterwards. */ + stop(): void { + if (this.closed) { + return + } + this.closed = true + this.detach?.() + this.detach = null + this.buffer = '' + // Closing stdin ends the serve loop; the kill covers a wedged helper. + try { + this.child.stdin.end() + } catch { + /* already closed */ + } + this.child.kill() + } + + private reportGone(detail: string): void { + if (this.closed) { + return + } + const text = [detail, this.stderrTail.trim()].filter(Boolean).join(': ') + this.closed = true + this.detach?.() + this.detach = null + this.handlers.onGone(text) + } + + private readStdout(chunk: Buffer | string): void { + if (this.closed) { + return + } + this.buffer += typeof chunk === 'string' ? chunk : this.decoder.write(chunk) + if (this.buffer.length > MAX_RESPONSE_CHARS) { + this.buffer = '' + this.handlers.onOverflow() + return + } + for (let newline = this.buffer.indexOf('\n'); newline >= 0;) { + // Slice a trailing CR off by index; trimming copies the whole payload. + const end = newline > 0 && this.buffer.charCodeAt(newline - 1) === 13 ? newline - 1 : newline + const line = this.buffer.slice(0, end) + this.buffer = this.buffer.slice(newline + 1) + if (line.length > 0) { + this.handlers.onLine(line) + // A handler may have stopped this channel; stop reading its backlog. + if (this.closed) { + this.buffer = '' + return + } + } + newline = this.buffer.indexOf('\n') + } + } +} + +export function startServeChannel( + spec: ProcessSpec, + spawn: RuntimeProcessSpawn, + handlers: ServeChannelHandlers +): DesktopScriptServeChannel { + return new DesktopScriptServeChannel(spawn(spec), handlers) +} diff --git a/src/main/computer/sidecar-client.ts b/src/main/computer/sidecar-client.ts index 489c463dd93..23af1aa603b 100644 --- a/src/main/computer/sidecar-client.ts +++ b/src/main/computer/sidecar-client.ts @@ -9,6 +9,7 @@ import type { ComputerSnapshotResult } from '../../shared/runtime-types' import { normalizeComputerActionResult } from './computer-action-verification-normalization' +import { isComputerSidecarDiagnostic, logComputerDiagnostic } from './computer-sidecar-diagnostics' import { validateComputerSidecarPasteText } from './computer-sidecar-paste-validation' import { RuntimeClientError } from './runtime-client-error' @@ -245,6 +246,11 @@ class ComputerSidecarProcess { } private handleMessage(message: unknown): void { + // The sidecar's stdio is piped and unread, so its warnings arrive here. + if (isComputerSidecarDiagnostic(message)) { + logComputerDiagnostic(message.message) + return + } if (!isSidecarResponse(message)) { return } diff --git a/src/main/computer/sidecar-entry.ts b/src/main/computer/sidecar-entry.ts index 8489f71e7f3..961d2261ede 100644 --- a/src/main/computer/sidecar-entry.ts +++ b/src/main/computer/sidecar-entry.ts @@ -8,6 +8,11 @@ type SidecarRequest = { params?: Record } +// Why disconnect carries the weight on Windows: the parent stops the sidecar +// with kill('SIGTERM'), which is TerminateProcess there, so the SIGTERM handler +// below never runs and teardown rides on the IPC channel closing instead. A +// helper wedged inside a UI Automation call can still outlive that and deliver +// input after teardown; only a real signal would preempt it. process.once('disconnect', shutdownProviders) process.once('SIGTERM', () => { shutdownProviders() diff --git a/src/main/computer/windows-powershell-execution-policy.test.ts b/src/main/computer/windows-powershell-execution-policy.test.ts new file mode 100644 index 00000000000..033eec58fb5 --- /dev/null +++ b/src/main/computer/windows-powershell-execution-policy.test.ts @@ -0,0 +1,92 @@ +import { describe, expect, it } from 'vitest' +import { + FALLBACK_WINDOWS_EXECUTION_POLICY, + PREFERRED_WINDOWS_EXECUTION_POLICY, + isExecutionPolicyBlocked, + windowsPowerShellRuntimeArgs +} from './windows-powershell-execution-policy' + +/** + * Captured from powershell.exe on Windows, verbatim including the hard wrapping. + * + * The discriminator has to be pinned in both directions: a policy block must + * escalate once, and a plain access denial must not, because escalation is + * sticky for the session and lands on `-ExecutionPolicy Bypass`. + */ +const POLICY_BLOCKED_RESTRICTED = [ + 'File C:\\Temp\\runtime.ps1 cannot be loaded because running scripts is disabled on this system. For more ', + 'information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.', + ' + CategoryInfo : SecurityError: (:) [], ParentContainsErrorRecordException', + ' + FullyQualifiedErrorId : UnauthorizedAccess' +].join('\r\n') + +const POLICY_BLOCKED_REMOTE_SIGNED = [ + 'File C:\\Temp\\runtime.ps1 cannot be loaded. The file ', + 'C:\\Temp\\runtime.ps1 is not digitally signed. You cannot run this script on the current system. For more ', + 'information about running scripts and setting execution policy, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.', + ' + CategoryInfo : SecurityError: (:) [], ParentContainsErrorRecordException', + ' + FullyQualifiedErrorId : UnauthorizedAccess' +].join('\r\n') + +/** No execution policy involved: .NET refusing a file the process may not read. */ +const GENUINE_ACCESS_DENIED = [ + 'Exception calling "ReadAllText" with "1" argument(s): "Access to the path \'C:\\Windows\\System32\\config\\SAM\' is denied."', + 'At C:\\Temp\\runtime.ps1:1 char:1', + '+ [System.IO.File]::ReadAllText("C:\\Windows\\System32\\config\\SAM")', + '+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~', + ' + CategoryInfo : NotSpecified: (:) [], MethodInvocationException', + ' + FullyQualifiedErrorId : UnauthorizedAccessException' +].join('\r\n') + +describe('isExecutionPolicyBlocked', () => { + it('recognises a policy block under either policy', () => { + expect(isExecutionPolicyBlocked(POLICY_BLOCKED_RESTRICTED)).toBe(true) + expect(isExecutionPolicyBlocked(POLICY_BLOCKED_REMOTE_SIGNED)).toBe(true) + }) + + it('does not read a plain access denial as a policy block', () => { + // UnauthorizedAccessException merely starts with the policy error id. Without + // the word boundary this matched, and one locked file downgraded the whole + // session to Bypass with no path back. + expect(isExecutionPolicyBlocked(GENUINE_ACCESS_DENIED)).toBe(false) + }) + + it('keeps recognising a block when the record labels are localized', () => { + // The labels are translated on a non-English host; the ids and the help + // topic are not, so the match must not depend on the labels. + const localized = POLICY_BLOCKED_RESTRICTED.replace('CategoryInfo', 'Categoria') + .replace('FullyQualifiedErrorId', 'IdErroreCompleto') + .replace( + 'cannot be loaded because running scripts is disabled on this system', + 'non puo essere caricato' + ) + expect(isExecutionPolicyBlocked(localized)).toBe(true) + }) + + it('ignores the failures the helper reports every day', () => { + expect(isExecutionPolicyBlocked('code 1: The term is not recognized')).toBe(false) + expect(isExecutionPolicyBlocked('Add-Type : Cannot access the temporary directory')).toBe(false) + expect(isExecutionPolicyBlocked('')).toBe(false) + }) +}) + +describe('windowsPowerShellRuntimeArgs', () => { + it('never emits Bypass unless the caller escalated to it', () => { + const preferred = windowsPowerShellRuntimeArgs( + 'C:\\orca\\runtime.ps1', + PREFERRED_WINDOWS_EXECUTION_POLICY, + ['-Serve'] + ) + expect(preferred).not.toContain(FALLBACK_WINDOWS_EXECUTION_POLICY) + expect(preferred).toEqual([ + '-NoLogo', + '-NoProfile', + '-NonInteractive', + '-ExecutionPolicy', + 'RemoteSigned', + '-File', + 'C:\\orca\\runtime.ps1', + '-Serve' + ]) + }) +}) diff --git a/src/main/computer/windows-powershell-execution-policy.ts b/src/main/computer/windows-powershell-execution-policy.ts new file mode 100644 index 00000000000..204f5b02b06 --- /dev/null +++ b/src/main/computer/windows-powershell-execution-policy.ts @@ -0,0 +1,59 @@ +/** + * Execution-policy handling for the Windows computer-use runtime script. + * + * Why not `Bypass` outright: it is the highest-weighted token on a + * powershell.exe command line for Defender for Endpoint, and the shipped + * runtime.ps1 does not need it — NSIS extraction writes no Zone.Identifier, so + * an unsigned local script runs under `RemoteSigned`. `Restricted` is still the + * Windows client default though, so a policy-blocked start must fall back once + * rather than leaving computer use broken. + */ +export type WindowsExecutionPolicy = 'RemoteSigned' | 'Bypass' + +export const PREFERRED_WINDOWS_EXECUTION_POLICY: WindowsExecutionPolicy = 'RemoteSigned' +export const FALLBACK_WINDOWS_EXECUTION_POLICY: WindowsExecutionPolicy = 'Bypass' + +/** + * Matches the SecurityError PowerShell emits for `-File` under a blocking policy. + * + * Every alternative is a PowerShell or .NET identifier, never prose. The prose + * differs by policy ("running scripts is disabled" under Restricted, "is not + * digitally signed" under RemoteSigned), is localized, and PowerShell hard-wraps + * it mid-sentence at the console width, so it can anchor nothing. + * + * The `\b` after UnauthorizedAccess is the whole discriminator and must not be + * dropped. `UnauthorizedAccess` is the FullyQualifiedErrorId of a policy block, + * but it is also a strict prefix of `UnauthorizedAccessException`, which .NET + * raises for an ordinary locked or ACL-denied file: an AV scan holding + * runtime.ps1, a locked CSC temp directory, a roaming-profile hiccup. Matching + * that escalates to `Bypass` for the rest of the session — the exact command + * line token this stack exists to stop emitting — and on the one-shot path + * replays an operation that already ran. + * + * Anchoring on the `FullyQualifiedErrorId:`/`CategoryInfo:` labels would be more + * precise still, but the labels are localized where these values are not, so a + * non-English host would stop recognising a real block and lose the fallback. + */ +const EXECUTION_POLICY_BLOCKED = /\bUnauthorizedAccess\b|\bSecurityError\b|about_Execution_Policies/ + +export function isExecutionPolicyBlocked(text: string): boolean { + return EXECUTION_POLICY_BLOCKED.test(text) +} + +export function windowsPowerShellRuntimeArgs( + scriptPath: string, + policy: WindowsExecutionPolicy, + scriptArgs: readonly string[] = [] +): string[] { + return [ + // -NoLogo: a banner on stdout would be read as a malformed response line. + '-NoLogo', + '-NoProfile', + '-NonInteractive', + '-ExecutionPolicy', + policy, + '-File', + scriptPath, + ...scriptArgs + ] +} diff --git a/src/main/daemon/daemon-host-relocation.test.ts b/src/main/daemon/daemon-host-relocation.test.ts index 0d2323fd449..e899a67ed43 100644 --- a/src/main/daemon/daemon-host-relocation.test.ts +++ b/src/main/daemon/daemon-host-relocation.test.ts @@ -5,12 +5,13 @@ import { mkdtempSync, readFileSync, readdirSync, + renameSync, rmSync, utimesSync, writeFileSync } from 'node:fs' import os from 'node:os' -import { dirname, join } from 'node:path' +import { basename, dirname, join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { setAppEnvironment, type AppEnvironment } from '../../shared/app-environment' @@ -141,12 +142,11 @@ describe('buildDaemonHostManifest', () => { entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js' }) const byDest = new Map(ops.map((op) => [op.destRel, op])) - // The host exe is renamed to a distinct image name (NOT the source basename) - // so the NSIS updater's name-based `taskkill /IM Orca.exe` can't kill it. - expect(byDest.get('orca-terminal-daemon.exe')?.kind).toBe('file') - expect(byDest.has('Orca.exe')).toBe(false) + // The host exe keeps the source basename: a verbatim, signature-preserving copy with no + // image-name mismatch. What escapes the updater's sweep is the path, not the name. + expect(byDest.get('Orca.exe')?.kind).toBe('file') const exeOp = ops.find((op) => op.sourcePath === 'C:\\app\\Orca.exe') - expect(exeOp?.destRel).not.toBe('Orca.exe') + expect(exeOp?.destRel).toBe('Orca.exe') // V8/ICU data blobs are read by the Electron bootstrap and kept. expect(byDest.has('icudtl.dat')).toBe(true) // GPU/graphics DLLs are never loaded by the windowless host, so not copied. @@ -170,7 +170,7 @@ describe('materializeRelocatedDaemonHost', () => { const result = materializeRelocatedDaemonHost() expect(result).not.toBeNull() const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9') - expect(result?.execPath).toBe(join(dest, 'orca-terminal-daemon.exe')) + expect(result?.execPath).toBe(join(dest, 'Orca.exe')) expect(result?.entryPath).toBe( join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'daemon-entry.js') ) @@ -203,6 +203,28 @@ describe('materializeRelocatedDaemonHost', () => { expect(marker.entryRelPath).toBe('resources/app.asar.unpacked/out/main/daemon-entry.js') }) + it('copies the exe verbatim: same file name and same bytes as the install-dir exe', () => { + const result = materializeRelocatedDaemonHost() + const sourceExe = join(installDir, 'Orca.exe') + // Byte-for-byte under the same name is what preserves the Authenticode signature and leaves + // no renamed-image signal for endpoint detection to read as masquerading. + expect(basename(result!.execPath)).toBe(basename(sourceExe)) + expect(readFileSync(result!.execPath)).toEqual(readFileSync(sourceExe)) + }) + + it('tracks a differently-named app exe rather than pinning an image name of its own', () => { + // A dev-channel or rebranded build ships a different executableName; the host copy must follow + // it, which is what keeps the copy verbatim instead of reintroducing a name mismatch. + renameSync(join(installDir, 'Orca.exe'), join(installDir, 'Orca Nightly.exe')) + setProcessProp('execPath', join(installDir, 'Orca Nightly.exe')) + const result = materializeRelocatedDaemonHost() + const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9') + expect(result?.execPath).toBe(join(dest, 'Orca Nightly.exe')) + expect(existsSync(join(dest, 'orca-terminal-daemon.exe'))).toBe(false) + // Re-resolution must agree with materialization or the fork would target a missing exe. + expect(getRelocatedDaemonHost()?.execPath).toBe(join(dest, 'Orca Nightly.exe')) + }) + it('is idempotent: a valid marker short-circuits without recopying', () => { materializeRelocatedDaemonHost() const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9') @@ -210,7 +232,7 @@ describe('materializeRelocatedDaemonHost', () => { const sentinel = join(dest, 'sentinel.txt') writeFileSync(sentinel, 'keep') const result = materializeRelocatedDaemonHost() - expect(result?.execPath).toBe(join(dest, 'orca-terminal-daemon.exe')) + expect(result?.execPath).toBe(join(dest, 'Orca.exe')) expect(existsSync(sentinel)).toBe(true) }) diff --git a/src/main/daemon/daemon-host-relocation.ts b/src/main/daemon/daemon-host-relocation.ts index 6d94bea06e4..13aab9fd8f9 100644 --- a/src/main/daemon/daemon-host-relocation.ts +++ b/src/main/daemon/daemon-host-relocation.ts @@ -22,6 +22,10 @@ import { inspectProcessLiveness, mergeProcessLivenessVerdict } from './daemon-pr * imaged under it, which would otherwise kill the daemon and its live terminals. The relocated exe is a * run-as-node Orca.exe copy (not node.exe) so there's no console flash and asar still resolves. Fail-open: * any failure returns null and the caller forks the install-dir host (pre-relocation behavior). + * + * What escapes the updater is the PATH, not the file name: electron-builder's kill sweep selects + * processes whose image path sits under $INSTDIR. See docs/reference/windows-daemon-host-relocation.md + * for the survival contract and why the exe is copied verbatim rather than renamed. */ export type RelocatedDaemonHost = { @@ -37,8 +41,14 @@ const MARKER_NAME = '.materialized.json' // LOCAL appData (not roaming) so OneDrive/roaming never syncs this ~260MB runtime. Shared with NSIS uninstall (config/nsis/orca-installer-hooks.nsh) — keep in sync. const LOCAL_HOST_ROOT_NAME = 'Orca' -// Copy of Orca.exe renamed to a distinct image name so the NSIS updater's `taskkill /IM Orca.exe` can't match it. -const DAEMON_HOST_EXE_NAME = 'orca-terminal-daemon.exe' +/** + * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte, + * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036). + * Survival comes from the path (see the module header). The one name-sensitive updater path is the + * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore — + * the documented pre-relocation outcome, not a failure. + */ +const daemonHostExeName = (execPath: string): string => winPath.basename(execPath) // V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe. const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin'] @@ -146,8 +156,8 @@ export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] { const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources const ops: CopyOp[] = [] - // Host exe (renamed) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved). - ops.push({ sourcePath: execPath, destRel: DAEMON_HOST_EXE_NAME, kind: 'file' }) + // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved). + ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' }) for (const name of RUNTIME_DATA_FILES) { ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true }) } @@ -245,7 +255,7 @@ export function getRelocatedDaemonHost(): RelocatedDaemonHost | null { if (!marker || marker.version !== version) { return null } - const execPath = join(dest, DAEMON_HOST_EXE_NAME) + const execPath = join(dest, daemonHostExeName(sources.execPath)) const entryPath = destPath(dest, marker.entryRelPath) if (!existsSync(execPath) || !existsSync(entryPath)) { return null @@ -281,7 +291,9 @@ export function materializeRelocatedDaemonHost(): RelocatedDaemonHost | null { entryRelPath: sources.entryRelPath } writeFileSync(join(staging, MARKER_NAME), JSON.stringify(marker)) - // Replace any stale/partial dest, then publish the staging dir atomically. + // Replace any stale/partial dest, then publish atomically. Windows refuses to delete a running + // image, so a live daemon already hosted in THIS version's dir (same-version reinstall, or a dev + // channel reusing a version) throws here and materialization fails open to the install-dir host. rmSync(dest, { recursive: true, force: true }) renameSync(staging, dest) } catch { diff --git a/src/main/git/source-control/status-read.ts b/src/main/git/source-control/status-read.ts index 276bf26e646..1ec81694d33 100644 --- a/src/main/git/source-control/status-read.ts +++ b/src/main/git/source-control/status-read.ts @@ -14,7 +14,10 @@ import { } from '../../../shared/git-status-line-stats-cache' import { resolveWorktreeHostPath } from '../../../shared/git-metadata-path' import { gitOptionalLocksDisabledEnv, gitStreamStdout } from '../runner' -import { findExistingWorktreeSymlinkPaths } from '../worktree-symlink-detection' +import { + findExistingWorktreeSymlinkPaths, + getSafeRelativePath +} from '../worktree-symlink-detection' import type { GetStatusOptions } from './get-status-options' import { statusReadLeaseOwner } from './git-read-cache-invalidation' import { detectConflictOperation } from './git-conflict-operation' @@ -89,8 +92,18 @@ async function dropSharedSymlinkUntrackedEntries( if (sharedLinkPaths.length === 0 || !entries.some((entry) => entry.area === 'untracked')) { return } + const untrackedPaths = new Set( + entries.filter((entry) => entry.area === 'untracked').map((entry) => entry.path) + ) + const candidatePaths = sharedLinkPaths.filter((rawPath) => { + const path = getSafeRelativePath(rawPath) + return path.safe && untrackedPaths.has(path.rel) + }) + if (candidatePaths.length === 0) { + return + } const sharedLinks = new Set( - await findExistingWorktreeSymlinkPaths(worktreePath, sharedLinkPaths, { + await findExistingWorktreeSymlinkPaths(worktreePath, candidatePaths, { wslDistro: options.wslDistro }) ) diff --git a/src/main/git/status-symlink-probe-budget.test.ts b/src/main/git/status-symlink-probe-budget.test.ts new file mode 100644 index 00000000000..b312048078b --- /dev/null +++ b/src/main/git/status-symlink-probe-budget.test.ts @@ -0,0 +1,81 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' +import { resolve } from 'node:path' +import { getStatus } from './source-control/status-read' + +const { lstat, stream, conflict } = vi.hoisted(() => ({ + lstat: vi.fn(), + stream: vi.fn(), + conflict: vi.fn() +})) +vi.mock('node:fs/promises', () => ({ lstat })) +vi.mock('./source-control/git-conflict-operation', () => ({ detectConflictOperation: conflict })) +vi.mock('./runner', () => ({ + gitStreamStdout: stream, + gitOptionalLocksDisabledEnv: () => ({ GIT_OPTIONAL_LOCKS: '0' }) +})) + +beforeEach(() => { + vi.clearAllMocks() + conflict.mockResolvedValue(undefined) + lstat.mockResolvedValue({ isSymbolicLink: () => true }) + stream.mockImplementation(async (_args, options) => { + options.onStdout('? unrelated.txt\n') + return { stoppedEarly: false } + }) +}) + +function status(sharedLinkPaths: string[]) { + return getStatus('/repo', { sharedLinkPaths, includeLineStats: false }) +} + +describe('status shared symlink probe budget', () => { + it.each([1, 8, 32])( + 'does no unrelated symlink probes for %i configured paths over 100 refreshes', + async (count) => { + const paths = Array.from({ length: count }, (_, index) => `shared-${index}`) + for (let refresh = 0; refresh < 100; refresh++) { + expect((await status(paths)).entries).toEqual([ + { path: 'unrelated.txt', status: 'untracked', area: 'untracked' } + ]) + } + expect(lstat).not.toHaveBeenCalled() + expect(stream).toHaveBeenCalledTimes(100) + } + ) + + it('probes matching normalized paths, retaining duplicate probes and original order', async () => { + stream.mockImplementation(async (_args, options) => { + options.onStdout('? link\n? 日本 語\n? unrelated.txt\n') + return { stoppedEarly: false } + }) + const result = await status(['absent', ' /link ', '\\日本 語', 'link', '../link', 'C:link']) + expect(lstat.mock.calls.map(([path]) => path)).toEqual([ + resolve('/repo', 'link'), + resolve('/repo', '日本 語'), + resolve('/repo', 'link') + ]) + expect(result.entries.map((entry) => entry.path)).toEqual(['unrelated.txt']) + }) + + it('rechecks matching paths after the filesystem changes and preserves unreadable paths', async () => { + const paths = ['unrelated.txt'] + expect((await status(paths)).entries).toEqual([]) + lstat.mockResolvedValueOnce({ isSymbolicLink: () => false }) + expect((await status(paths)).entries).toHaveLength(1) + lstat.mockRejectedValueOnce(new Error('EACCES')) + expect((await status(paths)).entries).toHaveLength(1) + expect(lstat).toHaveBeenCalledTimes(3) + }) + + it('does not broaden exact path matching to descendants or case variants', async () => { + stream.mockImplementation(async (_args, options) => { + options.onStdout('? link/child\n? LINK\n') + return { stoppedEarly: false } + }) + expect((await status(['link'])).entries.map((entry) => entry.path)).toEqual([ + 'link/child', + 'LINK' + ]) + expect(lstat).not.toHaveBeenCalled() + }) +}) diff --git a/src/main/ipc/dashboard-popout.test.ts b/src/main/ipc/dashboard-popout.test.ts index ce10b3556fc..9bead362816 100644 --- a/src/main/ipc/dashboard-popout.test.ts +++ b/src/main/ipc/dashboard-popout.test.ts @@ -97,6 +97,14 @@ function makeStore(enabled = true) { } } +// These cases exercise foreground behavior against Electron mocks. +beforeEach(() => { + vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined) + vi.stubEnv('ORCA_E2E_HEADLESS', undefined) + vi.stubEnv('ORCA_E2E_HEADFUL', undefined) +}) +afterEach(() => vi.unstubAllEnvs()) + describe('registerDashboardPopoutHandlers', () => { let store: ReturnType diff --git a/src/main/ipc/filesystem-watcher-local-events.test.ts b/src/main/ipc/filesystem-watcher-local-events.test.ts index e08145e7ad2..1907383bd6b 100644 --- a/src/main/ipc/filesystem-watcher-local-events.test.ts +++ b/src/main/ipc/filesystem-watcher-local-events.test.ts @@ -12,6 +12,7 @@ vi.mock('fs/promises', () => ({ stat: statMock })) vi.mock('./parcel-watcher-process', () => ({ subscribeViaWatcherProcess: subscribeMock })) import { createLocalWatcher } from './filesystem-watcher-local-events' +import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control' function deferred(): { promise: Promise; resolve: (value: T) => void } { let resolve!: (value: T) => void @@ -170,6 +171,35 @@ describe('local filesystem watcher flush serialization', () => { ) }) + it('starts no further stats when a full inflight batch is cancelled', async () => { + const eventCount = 5_000 + const pendingStats = deferred<{ isDirectory: () => boolean }>() + statMock.mockReturnValue(pendingStats.promise) + const root = await createLocalWatcher('/repo', '/repo') + root.listeners.set(1, sender as never) + + watcherCallback?.( + null, + Array.from({ length: eventCount }, (_, index) => ({ + type: 'update' as const, + path: `/repo/file-${index}.ts` + })) + ) + vi.advanceTimersByTime(WATCH_BATCH_TRAILING_MS) + await flushMicrotasks() + expect(statMock).toHaveBeenCalledTimes(8) + + cancelLocalBatchFlush(root) + pendingStats.resolve({ isDirectory: () => false }) + for (let i = 0; i < eventCount * 4 && root.batch.flushInFlight; i++) { + await Promise.resolve() + } + + expect(root.batch.flushInFlight).toBe(false) + expect(statMock).toHaveBeenCalledTimes(8) + expect(sender.send).not.toHaveBeenCalled() + }) + it('leaves an open debounce window to the armed timer instead of draining early', async () => { const firstStat = deferred<{ isDirectory: () => boolean }>() const secondStat = deferred<{ isDirectory: () => boolean }>() diff --git a/src/main/ipc/filesystem-watcher-local-events.ts b/src/main/ipc/filesystem-watcher-local-events.ts index 57ef7da4e1f..9f31adde4bd 100644 --- a/src/main/ipc/filesystem-watcher-local-events.ts +++ b/src/main/ipc/filesystem-watcher-local-events.ts @@ -139,7 +139,10 @@ async function flushBatch(root: WatchedRoot): Promise { DIRECTORY_STAT_CONCURRENCY, async (evt) => { // Why: a deleted path can't be stat'd; leave isDirectory undefined and let the renderer infer from dirCache. - const isDirectory = evt.type === 'delete' ? undefined : await tryStatIsDirectory(evt.path) + const isDirectory = + root.batch.cancelled || evt.type === 'delete' + ? undefined + : await tryStatIsDirectory(evt.path) return { kind: evt.type, diff --git a/src/main/ipc/notifications-retention-lifecycle.test.ts b/src/main/ipc/notifications-retention-lifecycle.test.ts index 278ca8f13ae..9705cf85a58 100644 --- a/src/main/ipc/notifications-retention-lifecycle.test.ts +++ b/src/main/ipc/notifications-retention-lifecycle.test.ts @@ -1,4 +1,4 @@ -import { beforeEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { getAllWindowsMock, @@ -30,6 +30,14 @@ vi.mock('../tray/system-tray', async () => import { registerNotificationHandlers } from './notifications' +// These cases exercise foreground behavior against Electron mocks. +beforeEach(() => { + vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined) + vi.stubEnv('ORCA_E2E_HEADLESS', undefined) + vi.stubEnv('ORCA_E2E_HEADFUL', undefined) +}) +afterEach(() => vi.unstubAllEnvs()) + describe('registerNotificationHandlers', () => { beforeEach(() => { vi.useFakeTimers() diff --git a/src/main/jira/attachment-image-cache-generation.test.ts b/src/main/jira/attachment-image-cache-generation.test.ts new file mode 100644 index 00000000000..e92ca5c5a53 --- /dev/null +++ b/src/main/jira/attachment-image-cache-generation.test.ts @@ -0,0 +1,57 @@ +import { beforeEach, describe, expect, it } from 'vitest' +import { + _resetAttachmentImageCache, + clearAttachmentImagesForSite, + getCachedAttachmentDataUrl, + loadAttachmentDataUrlWithCache +} from './attachment-image-cache' + +type Image = { dataUrl: string; byteSize: number } | null +function deferredImage() { + let resolve!: (image: Image) => void + let reject!: (error: Error) => void + const promise = new Promise((done, fail) => { + resolve = done + reject = fail + }) + return { promise, resolve, reject } +} + +beforeEach(_resetAttachmentImageCache) + +describe.each(['site', 'all'] as const)('attachment download after clearing %s', (scope) => { + it.each(['success', 'empty', 'failure'] as const)( + 'keeps the replacement singleflight when the old download completes with %s', + async (outcome) => { + const old = deferredImage() + const replacement = deferredImage() + let downloads = 0 + const load = () => { + downloads += 1 + return downloads === 1 ? old.promise : replacement.promise + } + const args = { siteId: 'site-a', attachmentId: 'image-1', load } + const first = loadAttachmentDataUrlWithCache(args).catch(() => 'old failure') + clearAttachmentImagesForSite(scope === 'site' ? 'site-a' : undefined) + const second = loadAttachmentDataUrlWithCache(args) + expect(downloads).toBe(2) + + if (outcome === 'failure') { + old.reject(new Error('old failure')) + } else { + old.resolve(outcome === 'empty' ? null : { dataUrl: 'old image', byteSize: 3 }) + } + expect(await first).toBe( + outcome === 'failure' ? 'old failure' : outcome === 'empty' ? null : 'old image' + ) + expect(getCachedAttachmentDataUrl('site-a', 'image-1')).toBeNull() + + const third = loadAttachmentDataUrlWithCache(args) + expect(downloads).toBe(2) + replacement.resolve({ dataUrl: 'new image', byteSize: 3 }) + expect(await second).toBe('new image') + expect(await third).toBe('new image') + expect(getCachedAttachmentDataUrl('site-a', 'image-1')).toBe('new image') + } + ) +}) diff --git a/src/main/jira/attachment-image-cache.ts b/src/main/jira/attachment-image-cache.ts index f9fdbfe3f7d..9d118ffdc9c 100644 --- a/src/main/jira/attachment-image-cache.ts +++ b/src/main/jira/attachment-image-cache.ts @@ -133,7 +133,10 @@ export async function loadAttachmentDataUrlWithCache(args: { } return loaded.dataUrl } finally { - inFlight.delete(key) + // A cleared generation no longer owns the current download's singleflight slot. + if (currentEpoch(args.siteId) === epochAtStart) { + inFlight.delete(key) + } } })() diff --git a/src/main/observability/index.ts b/src/main/observability/index.ts index f891da51418..74728a2d81b 100644 --- a/src/main/observability/index.ts +++ b/src/main/observability/index.ts @@ -48,7 +48,8 @@ import { type UploadBundleOptions, type UploadBundleResult } from './diagnostic-bundle-upload' -import { setActiveSink } from './tracer' +import { setActiveSink, startSpan } from './tracer' +import { setSecurePathHardeningReporter } from '../../shared/secure-path-hardening-report' const CI_ENV_VARS = [ 'CI', @@ -153,10 +154,37 @@ export function initObservability(): ObservabilityConsent { return c } installLocalSink() + installSecurePathHardeningReporter() return c } +/** + * Why route it here: Windows path hardening lives in `src/shared` and defaults to `console.warn`, + * which reaches nothing in a packaged build — the main process is GUI-subsystem and owns no + * console. A credential file left on inherited ACLs is exactly what a diagnostic bundle should + * show, so it becomes a span in the trace sink. + * + * `recovered` ends successfully rather than failing: a host that climbs back out of the + * rate-limited state has to be as visible as one that fell into it, or the degraded state is only + * ever half-diagnosable. + */ +function installSecurePathHardeningReporter(): void { + setSecurePathHardeningReporter((entry) => { + const span = startSpan('secure-path.windows-acl', { + attributes: { targetPath: entry.targetPath, stage: entry.stage, detail: entry.detail } + }) + if (entry.stage === 'recovered') { + span.end() + console.info('[secure-path.windows-acl] path hardening recovered', entry) + return + } + span.fail(entry.detail) + console.warn('[secure-path.windows-acl] failed to restrict path', entry) + }) +} + export async function shutdownObservability(): Promise { + setSecurePathHardeningReporter(null) // Order matters: tracer first so no new pushes arrive while the local sink // is closing and flushing buffered lines. setActiveSink(null) diff --git a/src/main/orca-profiles/profile-cloud-auth-status.ts b/src/main/orca-profiles/profile-cloud-auth-status.ts index 400498d223e..b0eb7da1978 100644 --- a/src/main/orca-profiles/profile-cloud-auth-status.ts +++ b/src/main/orca-profiles/profile-cloud-auth-status.ts @@ -29,7 +29,10 @@ export function getOrcaProfileAuthStatusFromProfile( state: 'unconfigured', persistence: session.status === 'found' ? session.persistence : 'none', cloud, - credentialError: session.status === 'decrypt-failed' ? session.error : undefined, + credentialError: + session.status === 'decrypt-failed' || session.status === 'unreadable' + ? session.error + : undefined, setupMessage: configState.setupMessage } } @@ -51,6 +54,9 @@ export function getOrcaProfileAuthStatusFromProfile( state: 'reconnect-required', persistence: 'none', cloud, - credentialError: session.status === 'decrypt-failed' ? session.error : undefined + credentialError: + session.status === 'decrypt-failed' || session.status === 'unreadable' + ? session.error + : undefined } } diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.ts b/src/main/orca-profiles/profile-cloud-session-refresh.ts index 221b4908bee..273f71f016e 100644 --- a/src/main/orca-profiles/profile-cloud-session-refresh.ts +++ b/src/main/orca-profiles/profile-cloud-session-refresh.ts @@ -72,6 +72,11 @@ function clearCloudSessionIfUnchanged( if (current.status === 'found' && current.session.refreshToken !== failed.refreshToken) { return } + // A session we were denied is not a session we may delete: the token we would be clearing might + // not even be the one that failed, and `clearOrcaCloudSession` unlinks the file outright. + if (current.status === 'unreadable') { + return + } if (active.profile.cloud) { tombstoneCloudSession( cloudSessionIdentity(active.profile.id, active.profile.cloud), diff --git a/src/main/orca-profiles/profile-cloud-session-store.ts b/src/main/orca-profiles/profile-cloud-session-store.ts index 62d779772c1..d1334d96b6b 100644 --- a/src/main/orca-profiles/profile-cloud-session-store.ts +++ b/src/main/orca-profiles/profile-cloud-session-store.ts @@ -1,7 +1,7 @@ import { existsSync, readFileSync, rmSync } from 'node:fs' import { join } from 'node:path' import { safeStorage } from 'electron' -import { writeSecureJsonFile } from '../../shared/secure-file' +import { isUnreadableError, writeSecureJsonFile } from '../../shared/secure-file' import type { OrcaCloudCapabilities, OrcaCloudOrgSummary, @@ -29,6 +29,11 @@ export type OrcaCloudSessionReadResult = | { status: 'found'; session: OrcaCloudSession; persistence: OrcaCloudSessionPersistence } | { status: 'missing'; persistence: 'none' } | { status: 'decrypt-failed'; persistence: 'none'; error: string } + /** + * The file is there and this process may not read it. Distinct from `decrypt-failed` because + * that one means "read it, it was garbage" and licenses replacing it; this one licenses nothing. + */ + | { status: 'unreadable'; persistence: 'none'; error: string } type PersistedEncryptedSession = { version: 1 @@ -215,7 +220,14 @@ export function readOrcaCloudSession( return { status: 'found', session: parsed.session, persistence: 'dev-plaintext' } } return { status: 'decrypt-failed', persistence: 'none', error: 'Unsafe session format.' } - } catch { + } catch (error) { + if (isUnreadableError(error)) { + return { + status: 'unreadable', + persistence: 'none', + error: 'Cannot read the saved Orca account session: the read failed.' + } + } return { status: 'decrypt-failed', persistence: 'none', diff --git a/src/main/plugins/plugin-secrets-store.ts b/src/main/plugins/plugin-secrets-store.ts index 7f16821cfb6..fb41aba71c8 100644 --- a/src/main/plugins/plugin-secrets-store.ts +++ b/src/main/plugins/plugin-secrets-store.ts @@ -1,7 +1,7 @@ import { existsSync, readFileSync, statSync } from 'node:fs' import { join } from 'node:path' import { safeStorage } from 'electron' -import { writeSecureFile } from '../../shared/secure-file' +import { isUnreadableError, writeSecureFile } from '../../shared/secure-file' import { PLUGIN_STORAGE_KEY_LIMIT, PLUGIN_STORAGE_TOTAL_MAX_BYTES @@ -25,6 +25,8 @@ type PersistedSecretsFile = { export type PluginSecretsResult = { ok: true; value: T } | { ok: false; error: string } +const UNREADABLE_VAULT_ERROR = 'secret vault exists but could not be read; refusing to overwrite it' + export class PluginSecretsStore { private readonly filePath: string @@ -32,7 +34,8 @@ export class PluginSecretsStore { this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), 'secrets.json.enc') } - private read(): PersistedSecretsFile { + /** `null` means the vault exists and this process may not read it — which is never "empty". */ + private read(): PersistedSecretsFile | null { const empty: PersistedSecretsFile = { version: 1, format: 'electron-safe-storage-v1', @@ -56,7 +59,13 @@ export class PluginSecretsStore { ) { return parsed } - } catch { + } catch (error) { + // Being denied the read is not evidence the vault is corrupt. Returning `empty` here would + // make the next set() write a vault containing only that one key, silently dropping every + // secret the file still holds — and the write would succeed. + if (isUnreadableError(error)) { + return null + } // Corrupt vaults read as empty; set() rewrites a valid file. } return empty @@ -64,6 +73,9 @@ export class PluginSecretsStore { get(key: string): PluginSecretsResult { const file = this.read() + if (!file) { + return { ok: false, error: UNREADABLE_VAULT_ERROR } + } const ciphertext = file.ciphertexts[key] if (typeof ciphertext !== 'string') { return { ok: true, value: null } @@ -83,6 +95,9 @@ export class PluginSecretsStore { return { ok: false, error: 'OS-backed encryption is unavailable; secret not stored' } } const file = this.read() + if (!file) { + return { ok: false, error: UNREADABLE_VAULT_ERROR } + } if ( !Object.hasOwn(file.ciphertexts, key) && Object.keys(file.ciphertexts).length >= PLUGIN_STORAGE_KEY_LIMIT @@ -100,6 +115,10 @@ export class PluginSecretsStore { delete(key: string): void { const file = this.read() + if (!file) { + // Rewriting what we could not read would drop every other secret in the vault. + return + } if (Object.hasOwn(file.ciphertexts, key)) { delete file.ciphertexts[key] writeSecureFile(this.filePath, JSON.stringify(file, null, 2)) diff --git a/src/main/plugins/plugin-storage-store.ts b/src/main/plugins/plugin-storage-store.ts index b3949b8f6d4..94a74261e1e 100644 --- a/src/main/plugins/plugin-storage-store.ts +++ b/src/main/plugins/plugin-storage-store.ts @@ -1,6 +1,6 @@ import { existsSync, readFileSync, statSync } from 'node:fs' import { join } from 'node:path' -import { writeSecureFile } from '../../shared/secure-file' +import { isUnreadableError, writeSecureFile } from '../../shared/secure-file' import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest' import { PLUGIN_STORAGE_KEY_LIMIT, @@ -16,6 +16,8 @@ import { * Adapted from community PR #5801's per-plugin settings store. */ +const UNREADABLE_STORE_ERROR = 'storage file exists but could not be read; refusing to overwrite it' + export function pluginDataDir(pluginsDataDir: string, qualifiedKey: string): string { if (!isQualifiedPluginKey(qualifiedKey)) { throw new Error(`unsafe plugin key: ${qualifiedKey}`) @@ -36,7 +38,8 @@ export class PluginKvStore { this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), fileName) } - private read(): Record { + /** `null` means the file exists and this process may not read it - which is never `{}`. */ + private read(): Record | null { try { if (!existsSync(this.filePath)) { return {} @@ -48,22 +51,27 @@ export class PluginKvStore { if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) { return parsed as Record } - } catch { + } catch (error) { + // Being denied the read is not evidence of corruption. Returning `{}` here would make + // the next set()/delete() write a file holding only that one key, dropping the rest. + if (isUnreadableError(error)) { + return null + } // Corrupt files reset to empty rather than wedging the plugin. } return {} } get(key: string): unknown { - return this.read()[key] + return this.read()?.[key] } getAll(): Record { - return this.read() + return this.read() ?? {} } keys(): string[] { - return Object.keys(this.read()) + return Object.keys(this.read() ?? {}) } set(key: string, value: unknown): PluginKvWriteResult { @@ -80,6 +88,9 @@ export class PluginKvStore { return { ok: false, error: `value exceeds ${PLUGIN_STORAGE_VALUE_MAX_BYTES} bytes` } } const settings = this.read() + if (!settings) { + return { ok: false, error: UNREADABLE_STORE_ERROR } + } if (!Object.hasOwn(settings, key) && Object.keys(settings).length >= PLUGIN_STORAGE_KEY_LIMIT) { return { ok: false, error: `storage exceeds the ${PLUGIN_STORAGE_KEY_LIMIT}-key limit` } } @@ -94,6 +105,10 @@ export class PluginKvStore { delete(key: string): void { const settings = this.read() + if (!settings) { + // Rewriting what we could not read would drop every other key in the store. + return + } if (Object.hasOwn(settings, key)) { delete settings[key] writeSecureFile(this.filePath, JSON.stringify(settings, null, 2)) diff --git a/src/main/repo-icon-file-detection.test.ts b/src/main/repo-icon-file-detection.test.ts index 820b2edddfc..19c895e6024 100644 --- a/src/main/repo-icon-file-detection.test.ts +++ b/src/main/repo-icon-file-detection.test.ts @@ -1,4 +1,6 @@ -import { readFile, stat } from 'node:fs/promises' +import { join } from 'node:path' +import { tmpdir } from 'node:os' +import { mkdtemp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises' import type * as FsPromisesModule from 'node:fs/promises' import { describe, expect, it, vi } from 'vitest' import type { ExecutionHostFilesystemRoute } from './providers/execution-host-provider-dispatch' @@ -136,3 +138,55 @@ describe('detectRepoFileIcon connection boundary', () => { expect(stat).toHaveBeenCalled() }) }) + +describe('declared repo icons through production filesystem routes', () => { + it.each([ + ['local', false], + ['ssh', false], + ['local', true], + ['ssh', true] + ] as const)('preserves declared icon detection on %s (no icon: %s)', async (kind, noIcon) => { + const directory = await mkdtemp(join(tmpdir(), 'orca-icon-href-')) + const source = noIcon + ? 'a'.repeat(256 * 1024) + : `${'a'.repeat(32768)}{ rel: "icon", href: "/first.png", href: "/chosen.png" }` + try { + await mkdir(join(directory, 'public')) + await writeFile(join(directory, 'index.html'), source) + await writeFile(join(directory, 'public', 'chosen.png'), Buffer.from(PNG_BASE64, 'base64')) + const provider = remoteFilesystemProvider({ + stat: async (path) => { + const info = await stat(path) + return { + type: info.isFile() ? 'file' : 'directory', + size: info.size, + mtime: info.mtimeMs + } + }, + readFile: async (path) => { + const buffer = await readFile(path) + const isBinary = path.endsWith('.png') + return { + content: buffer.toString(isBinary ? 'base64' : 'utf8'), + isBinary, + mimeType: isBinary ? 'image/png' : 'text/html' + } + } + }) + const route: ExecutionHostFilesystemRoute = + kind === 'local' ? { kind: 'local', hostId: 'local' } : sshRoute('icon-oracle', provider) + await expect(detectRepoFileIcon(directory, route)).resolves.toEqual( + noIcon + ? null + : { + type: 'image', + src: `data:image/png;base64,${PNG_BASE64}`, + source: 'file', + label: 'public/chosen.png' + } + ) + } finally { + await rm(directory, { recursive: true, force: true }) + } + }) +}) diff --git a/src/main/repo-icon-file-detection.ts b/src/main/repo-icon-file-detection.ts index f4289924b08..831248b94b3 100644 --- a/src/main/repo-icon-file-detection.ts +++ b/src/main/repo-icon-file-detection.ts @@ -3,6 +3,7 @@ import { buildImageDataUri } from '../shared/image-data-uri' import { MAX_REPO_ICON_UPLOAD_BYTES, type RepoIcon } from '../shared/repo-icon' import type { ExecutionHostFilesystemRoute } from './providers/execution-host-provider-dispatch' import type { IFilesystemProvider } from './providers/types' +import { extractIconHref } from './repo-icon-source-href' import { iconHrefCandidates } from './repo-icon-href-candidates' import { joinWorktreeRelativePath } from './runtime/runtime-relative-paths' @@ -49,11 +50,6 @@ const REPO_ICON_SOURCE_FILE_CANDIDATES = [ // not read large app entrypoints just to find a small favicon href. const MAX_REPO_ICON_SOURCE_BYTES = 256 * 1024 -const LINK_ICON_HTML_RE = - /]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i -const LINK_ICON_OBJECT_RE = - /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i - type DetectedImageFormat = { mimeType: 'image/png' | 'image/webp' } @@ -98,10 +94,6 @@ function detectImageFormat(buffer: Buffer): DetectedImageFormat | null { return null } -function extractIconHref(source: string): string | null { - return source.match(LINK_ICON_HTML_RE)?.[1] ?? source.match(LINK_ICON_OBJECT_RE)?.[1] ?? null -} - function repoIconFromImageBuffer(buffer: Buffer, relativePath: string): RepoIcon | null { const format = detectImageFormat(buffer) if (!format) { diff --git a/src/main/repo-icon-source-href.test.ts b/src/main/repo-icon-source-href.test.ts new file mode 100644 index 00000000000..7c74511f3d6 --- /dev/null +++ b/src/main/repo-icon-source-href.test.ts @@ -0,0 +1,76 @@ +import { describe, expect, it } from 'vitest' +import { extractIconHref } from './repo-icon-source-href' + +// Original production expressions are the compatibility oracle. +const HTML_RE = + /]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i +const OBJECT_RE = + /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i + +export function originalIconHref(source: string): string | null { + return source.match(HTML_RE)?.[1] ?? source.match(OBJECT_RE)?.[1] ?? null +} + +describe('repo icon source href compatibility', () => { + it.each([ + '', + '', + '', + '', + '', + '', + 'plain source without icon properties', + '{ rel: "icon", href: "/first.png", href: "/last.png" }', + '{ href: "/first.png", rel: "icon", rel: "stylesheet" }', + '{ rel: "icon" } { href: "/unrelated.png" }', + '{ rel: "icon", href: "/first.png" } { rel: "icon", href: "/last.png" }', + '{ rel: "icon", href: "/object.png" } ', + '{ rel: "ICON", href: "/UPPER.png" }', + '}\n\n{href: "/line.png",\nrel : "shortcut icon"}', + '{ rel: "icon", href: "/unterminated}after brace', + '{ rel: "icon", href: "?query" }', + '{ rel: "icon", href: "/before?query" }', + '', + ' { + expect(extractIconHref(source)).toBe(originalIconHref(source)) + }) + + it('matches the original across generated malformed property sequences', () => { + const tokens = [ + '}', + '{', + ' ', + 'rel:"icon"', + 'href:"a"', + 'href:"b"', + 'rel:"other"', + 'x', + '\n', + '', + 'rel="icon"', + 'href="a"', + 'href="b"' + ] + let seed = 97 + for (let sample = 0; sample < 3000; sample++) { + let source = '' + for (let token = 0; token < 12; token++) { + seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0 + source += tokens[seed % tokens.length] + } + expect(extractIconHref(source), source).toBe(originalIconHref(source)) + } + }) + + it('handles a maximum-size unterminated HTML tag region', () => { + expect(extractIconHref(' { + expect(extractIconHref('a'.repeat(256 * 1024))).toBeNull() + }) +}) diff --git a/src/main/repo-icon-source-href.ts b/src/main/repo-icon-source-href.ts new file mode 100644 index 00000000000..b8363da3711 --- /dev/null +++ b/src/main/repo-icon-source-href.ts @@ -0,0 +1,46 @@ +const LINK_START_RE = /]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/iy +const LINK_ICON_OBJECT_RE = + /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/iy + +function extractHtmlIconHref(source: string): string | null { + LINK_START_RE.lastIndex = 0 + let match: RegExpExecArray | null + while ((match = LINK_START_RE.exec(source))) { + LINK_ICON_HTML_RE.lastIndex = match.index + const href = LINK_ICON_HTML_RE.exec(source)?.[1] + if (href !== undefined) { + return href + } + // Later link starts before the same closing angle see only a subset of these attributes. + const closingAngle = source.indexOf('>', LINK_START_RE.lastIndex) + if (closingAngle === -1) { + return null + } + LINK_START_RE.lastIndex = closingAngle + 1 + } + return null +} + +export function extractIconHref(source: string): string | null { + const htmlHref = extractHtmlIconHref(source) + if (htmlHref !== null) { + return htmlHref + } + let start = 0 + while (start <= source.length) { + // Every suffix before the next closing brace sees the same candidate properties. + LINK_ICON_OBJECT_RE.lastIndex = start + const href = LINK_ICON_OBJECT_RE.exec(source)?.[1] + if (href !== undefined) { + return href + } + const closingBrace = source.indexOf('}', start) + if (closingBrace === -1) { + return null + } + start = closingBrace + 1 + } + return null +} diff --git a/src/main/runtime/device-registry.ts b/src/main/runtime/device-registry.ts index b5f0c7a6c8d..b2d5de8ef41 100644 --- a/src/main/runtime/device-registry.ts +++ b/src/main/runtime/device-registry.ts @@ -5,7 +5,11 @@ import { randomBytes, randomUUID } from 'node:crypto' import { existsSync, readFileSync } from 'node:fs' import { join } from 'node:path' -import { hardenExistingSecureFile, writeSecureJsonFile } from '../../shared/secure-file' +import { + hardenExistingSecureFile, + isUnreadableError, + writeSecureJsonFile +} from '../../shared/secure-file' import type { DeviceScope } from '../../shared/runtime-types' import { DEVICE_REGISTRY_FILENAME } from './mobile-pairing-files' import type { RelayDeviceBinding } from './relay/relay-revoke-outbox' @@ -54,6 +58,8 @@ const LAST_SEEN_FLUSH_DELAY_MS = 250 export class DeviceRegistry { private readonly registryPath: string private devices: DeviceEntry[] = [] + /** Set when the registry exists but could not be read, which makes `devices` a lie to save from. */ + private registryUnreadable = false private pendingLastSeenFlush: NodeJS.Timeout | null = null constructor(userDataPath: string) { @@ -293,12 +299,21 @@ export class DeviceRegistry { // LAN links), so a missing value must keep binding every interface on reconnect. pairingReach: device.pairingReach === 'this-computer' ? 'this-computer' : 'network' })) - } catch { + this.registryUnreadable = false + } catch (error) { + // "Cannot read" is not "is empty". Saving an empty list over a registry we were merely + // denied would erase every paired device's bearer token, and the write would succeed. + this.registryUnreadable = isUnreadableError(error) this.devices = [] } } private save(devices: DeviceEntry[]): void { + if (this.registryUnreadable) { + throw new Error( + `Cannot read the device registry at ${this.registryPath}: the read failed. Refusing to overwrite it, which would revoke every paired device.` + ) + } writeSecureJsonFile(this.registryPath, devices) // Why: every registry save includes the latest in-memory timestamps, so a later timer would rewrite it. this.cancelPendingLastSeenFlush() diff --git a/src/main/runtime/e2ee-keypair.ts b/src/main/runtime/e2ee-keypair.ts index 3e8b3e0aa0a..9ffb9844e86 100644 --- a/src/main/runtime/e2ee-keypair.ts +++ b/src/main/runtime/e2ee-keypair.ts @@ -4,7 +4,11 @@ import { existsSync, readFileSync, statSync } from 'node:fs' import { join } from 'node:path' import nacl from 'tweetnacl' -import { hardenExistingSecureFile, writeSecureJsonFile } from '../../shared/secure-file' +import { + hardenExistingSecureFile, + isUnreadableError, + writeSecureJsonFile +} from '../../shared/secure-file' import { E2EE_KEYPAIR_FILENAME } from './mobile-pairing-files' const KEYPAIR_FILENAME = E2EE_KEYPAIR_FILENAME @@ -42,7 +46,17 @@ export function loadOrCreateE2EEKeypair(userDataPath: string): E2EEKeypair { return { publicKey, secretKey, publicKeyB64: raw.publicKeyB64 } } } - } catch { + } catch (error) { + // A read this process is not permitted to make says nothing about the contents. Falling + // through would overwrite the only copy of the secret key — and the overwrite succeeds, so + // nothing downstream stops it. Every paired device derives its shared secret from this key, + // so regenerating silently un-pairs all of them and no old message stays decryptable. + if (isUnreadableError(error)) { + throw new Error( + `Cannot read the E2EE keypair at ${filePath}: the read failed. Refusing to regenerate it, which would invalidate every paired device.`, + { cause: error } + ) + } // Malformed file — regenerate below. } } diff --git a/src/main/runtime/relay/relay-revoke-outbox.ts b/src/main/runtime/relay/relay-revoke-outbox.ts index 473f619e134..5989af0c283 100644 --- a/src/main/runtime/relay/relay-revoke-outbox.ts +++ b/src/main/runtime/relay/relay-revoke-outbox.ts @@ -1,7 +1,11 @@ import { randomUUID } from 'node:crypto' import { existsSync, readFileSync } from 'node:fs' import { join } from 'node:path' -import { hardenExistingSecureFile, writeSecureJsonFile } from '../../../shared/secure-file' +import { + hardenExistingSecureFile, + isUnreadableError, + writeSecureJsonFile +} from '../../../shared/secure-file' export type RelayDeviceBinding = { relayHostId: string @@ -37,6 +41,8 @@ function isItem(value: unknown): value is RelayRevokeOutboxItem { export class RelayRevokeOutbox { private readonly path: string private items: RelayRevokeOutboxItem[] + /** Set when the outbox exists but could not be read, so `items` is not what is on disk. */ + private outboxUnreadable = false constructor(userDataPath: string) { this.path = join(userDataPath, OUTBOX_FILENAME) @@ -83,12 +89,20 @@ export class RelayRevokeOutbox { hardenExistingSecureFile(this.path) const parsed: unknown = JSON.parse(readFileSync(this.path, 'utf-8')) return Array.isArray(parsed) ? parsed.filter(isItem) : [] - } catch { + } catch (error) { + // An outbox we were denied is not an empty outbox. Saving [] over it would drop + // revocations that have not reached the relay, so a revoked device stays live. + this.outboxUnreadable = isUnreadableError(error) return [] } } private save(items: readonly RelayRevokeOutboxItem[]): void { + if (this.outboxUnreadable) { + throw new Error( + `Cannot read the relay revoke outbox at ${this.path}: the read failed. Refusing to overwrite it, which would drop pending revocations.` + ) + } writeSecureJsonFile(this.path, items) } } diff --git a/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts b/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts index 35225f72f9c..b5589aa7724 100644 --- a/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts +++ b/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts @@ -1,26 +1,71 @@ // Why: the E2EE auth handshake used to persist `lastSeenAt` inline, and on Windows every secure-file -// write blocks the main thread on two synchronous PowerShell ACL spawns (~1-1.5s cold each). These tests +// write blocks the main thread on synchronous icacls ACL spawns (~1-1.5s cold each). These tests // pin the spawn count on the auth critical path, not wall-clock, so they are deterministic under load. -import { execFile, execFileSync } from 'node:child_process' -import { mkdtempSync, readFileSync, rmSync } from 'node:fs' +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import type { WebSocket } from 'ws' +import type { ProcessResult, ProcessSpec } from '../../../shared/child-process/run-process' +import { runProcess, runProcessSync } from '../../../shared/child-process/run-process' import { DEVICE_REGISTRY_FILENAME } from '../mobile-pairing-files' import { DeviceRegistry, type DeviceEntry } from '../device-registry' import { decrypt, deriveSharedKey, encrypt, generateKeyPair } from './e2ee-crypto' import { MobileSocketWiring, type MobileSocketTransport } from './mobile-socket-wiring' -vi.mock('node:child_process', () => ({ - execFileSync: vi.fn(), - execFile: vi.fn() +// Why this module and not `node:child_process`: hardening reaches the OS only through +// runProcess/runProcessSync, and a hand-written child_process factory silently omitted the one +// function they call — so every spawn threw, hardening no-opped, and the test double hid it. +vi.mock('../../../shared/child-process/run-process', () => ({ + runProcess: vi.fn(), + runProcessSync: vi.fn() })) -// Why: stands in for the PowerShell cold start; long enough that a gated response would be obvious, +// Why: stands in for the icacls cold start; long enough that a gated response would be obvious, // short enough that the suite stays fast. Assertions use the recorded ordering, never this number. const INJECTED_SPAWN_LATENCY_MS = 5 -const POWERSHELL = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe' +const USER_SID = 'S-1-5-21-1000' +const OK: ProcessResult = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false } +/** + * One secure write hardens two paths: the staged temp file, fresh and still on the inherited DACL, + * costs the full verify/reset/grant/verify pass; the published file, whose protected DACL came + * along with the rename, costs only its verify. + */ +const BLOCKING_SPAWNS_PER_WRITE = 5 + +/** Paths the fake icacls has granted a protected DACL, keyed to the ACE flags the grant used. */ +const hardenedByFake = new Map() + +/** + * Stands in for icacls. `/save` really writes a UTF-16LE SDDL file, because the code under test + * reads that file back off disk to decide whether a rewrite is needed at all — which is what makes + * the spawn count per write a property of the real ACL path rather than of this double. + */ +function fakeIcacls(spec: ProcessSpec): ProcessResult { + const args = spec.args ?? [] + const path = args[0] ?? '' + const grantIndex = args.indexOf('/grant:r') + if (grantIndex !== -1) { + hardenedByFake.set(path, args[grantIndex + 1]!.includes('(OI)(CI)') ? 'OICI' : '') + return OK + } + const saveIndex = args.indexOf('/save') + if (saveIndex === -1) { + return OK // /reset + } + writeFileSync(args[saveIndex + 1]!, fakeSddl(path), 'utf16le') + return OK +} + +function fakeSddl(path: string): string { + const aceFlags = hardenedByFake.get(path) + if (aceFlags === undefined) { + // Never hardened: the inherited DACL a fresh file carries, so the first verify must fail. + return `name\r\nD:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;${USER_SID})\r\n` + } + const ace = (sid: string): string => `(A;${aceFlags};FA;;;${sid})` + return `name\r\nD:PAI${ace('BA')}${ace('SY')}${ace(USER_SID)}\r\n` +} type TimelineEntry = 'acl-spawn' | 'e2ee_ready' | 'e2ee_authenticated' | 'other-frame' @@ -62,24 +107,23 @@ describe('mobile auth critical path', () => { process.env.SystemRoot = 'C:\\Windows' Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) userDataPath = mkdtempSync(join(tmpdir(), 'orca-auth-acl-')) - vi.mocked(execFileSync).mockReset() - vi.mocked(execFile).mockReset() - vi.mocked(execFileSync).mockImplementation((file) => { - if (String(file).endsWith('whoami.exe')) { - return '"USER","S-1-5-21-1000"' + hardenedByFake.clear() + vi.mocked(runProcessSync).mockReset() + vi.mocked(runProcess).mockReset() + vi.mocked(runProcessSync).mockImplementation((spec) => { + // Matched by suffix, not by the whole path: `windowsSystem32Binary` joins with the host + // separator, so the literal only matches when the tests happen to run on Windows. + if (spec.program.endsWith('whoami.exe')) { + return { ...OK, stdout: `"USER","${USER_SID}"` } } timeline.push('acl-spawn') // Why: the real spawn blocks the main thread, so the fake must too — and via Atomics, not a // Date.now() spin, which would never terminate under fake timers. Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, INJECTED_SPAWN_LATENCY_MS) - return '' - }) - vi.mocked(execFile).mockImplementation((_file, _args, _options, callback) => { - if (typeof callback === 'function') { - callback(null, '', '') - } - return {} as ReturnType + return fakeIcacls(spec) }) + // The directory harden stays on the async lane, so it never lands on the timeline. + vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec))) }) afterEach(() => { @@ -157,8 +201,11 @@ describe('mobile auth critical path', () => { registry.flushPendingLastSeen() // Hardening is deferred, never dropped: tmp file + published file, exactly as the inline path did. - expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2) - expect(vi.mocked(execFileSync).mock.lastCall?.[0]).toBe(POWERSHELL) + expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength( + BLOCKING_SPAWNS_PER_WRITE + ) + // The blocking work is the ACL tool itself, not some other spawn on the same lane. + expect(vi.mocked(runProcessSync).mock.lastCall?.[0].program).toMatch(/icacls\.exe$/) expect(readPersistedDevices()[0]?.lastSeenAt).toBe( registry.getDevice(device.deviceId)?.lastSeenAt ) @@ -172,7 +219,11 @@ describe('mobile auth critical path', () => { authenticate(registry, device) // Why: rotatePendingDevice drops entries disk says were never scanned, so this write stays inline. - expect(timeline).toEqual(['e2ee_ready', 'acl-spawn', 'acl-spawn', 'e2ee_authenticated']) + expect(timeline).toEqual([ + 'e2ee_ready', + ...Array(BLOCKING_SPAWNS_PER_WRITE).fill('acl-spawn'), + 'e2ee_authenticated' + ]) expect(readPersistedDevices()[0]?.lastSeenAt).toBeGreaterThan(0) }) @@ -189,7 +240,9 @@ describe('mobile auth critical path', () => { expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(0) vi.advanceTimersByTime(250) - expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2) + expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength( + BLOCKING_SPAWNS_PER_WRITE + ) }) it('cancels the deferred rewrite when another registry save persists the timestamp', () => { @@ -201,9 +254,13 @@ describe('mobile auth critical path', () => { registry.updateLastSeenDeferred(device.deviceId) registry.addDevice('Other client', 'runtime') - expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2) + expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength( + BLOCKING_SPAWNS_PER_WRITE + ) vi.advanceTimersByTime(250) - expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2) + expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength( + BLOCKING_SPAWNS_PER_WRITE + ) }) }) diff --git a/src/main/runtime/runtime-mobile-file-path-search.test.ts b/src/main/runtime/runtime-mobile-file-path-search.test.ts index 495a7933842..0be5ecad50e 100644 --- a/src/main/runtime/runtime-mobile-file-path-search.test.ts +++ b/src/main/runtime/runtime-mobile-file-path-search.test.ts @@ -6,6 +6,37 @@ import { } from './runtime-mobile-file-path-search' describe('rankRuntimeMobileFilePaths', () => { + it('preserves basename matching, ordering and total counts for unusual paths', () => { + const paths = [ + '', + '/', + 'a/', + 'a//b.ts', + 'b.ts', + 'B.TS', + 'a\\b.ts', + '界/😀.ts', + '.hidden', + 'a/./b.ts' + ] + for (const query of ['', ' ', 'b', '.ts', '😀', '/', 'a\\', 'missing']) { + for (const limit of [0, 1, 3, 100]) { + const q = query.trim().toLowerCase() + const prefix = paths.filter((path) => { + const lower = path.toLowerCase() + return lower.startsWith(q) || (lower.split('/').pop() ?? lower).startsWith(q) + }) + const other = paths.filter( + (path) => !prefix.includes(path) && path.toLowerCase().includes(q) + ) + expect(rankRuntimeMobileFilePaths(paths, query, limit)).toEqual({ + paths: [...prefix, ...other].slice(0, limit), + totalCount: prefix.length + other.length + }) + } + } + }) + it('ranks path and basename prefixes before substrings and caps output', () => { expect( rankRuntimeMobileFilePaths( diff --git a/src/main/runtime/runtime-mobile-file-path-search.ts b/src/main/runtime/runtime-mobile-file-path-search.ts index 13213d6dfcf..1455028c798 100644 --- a/src/main/runtime/runtime-mobile-file-path-search.ts +++ b/src/main/runtime/runtime-mobile-file-path-search.ts @@ -76,7 +76,7 @@ export function rankRuntimeMobileFilePaths( let totalCount = 0 for (const path of paths) { const lower = path.toLowerCase() - const basename = lower.split('/').pop() ?? lower + const basename = lower.slice(lower.lastIndexOf('/') + 1) if (lower.startsWith(normalizedQuery) || basename.startsWith(normalizedQuery)) { totalCount++ if (prefix.length < limit) { diff --git a/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts b/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts new file mode 100644 index 00000000000..d92deccfa9a --- /dev/null +++ b/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts @@ -0,0 +1,262 @@ +import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest' +import { runProcessSync } from '../../shared/child-process/run-process' +import { windowsSystem32Binary } from '../../shared/child-process/windows-system-binary' +import { removeTreeSync } from '../../shared/windows-transient-lock-removal' + +/** + * What a *successful* harden does to a reader that cannot read. + * + * Path hardening writes a protected DACL granting only the SIDs the running process holds. Where + * the data root came from somewhere else — a relocated `ORCA_USER_DATA_PATH`, a share, a roaming + * profile, a backup restored under a recreated local account, or a harden whose `/reset` landed + * and whose `/grant` did not — the file ends up granting a SID this process does not have. It then + * reads as `EPERM` while its *directory* stays writable, because file hardening is synchronous on + * the write path and directory hardening is fire-and-forget. + * + * Every store below used to treat any read failure as "malformed — regenerate", and the + * regeneration succeeds: `renameSync` over an unreadable file needs `FILE_DELETE_CHILD` on the + * parent, not `DELETE` on the file. So the healing path destroyed the thing it could not read. + * Before hardening actually applied, this failed open — the file was simply readable. + * + * These assert the file still holds its original bytes afterwards. Runs only on win32, where a + * DACL is the mechanism; skipped elsewhere. + */ + +/** Whether a DACL that omits this token actually denies it a read. */ +function readDenied(filePath: string): boolean { + try { + readFileSync(filePath, 'utf8') + return false + } catch (error) { + return /^(?:EPERM|EACCES)$/.test((error as NodeJS.ErrnoException).code ?? '') + } +} + +/** + * An elevated token logged in as the built-in Administrator reads straight through a DACL that + * grants it nothing, so on such a host every assertion here would pass while proving nothing. + * Probe once and skip rather than assert vacuously -- the same trade the ACL suite makes for its + * unelevated-only case. `isUnreadableError` has its own unit tests on every platform; this suite + * carries the stores' refusal wherever a denial is actually reproducible. + */ +function canDenyReads(): boolean { + if (process.platform !== 'win32') { + return false + } + const probeRoot = mkdtempSync(join(tmpdir(), 'orca-deny-probe-')) + const probe = join(probeRoot, 'probe.json') + try { + writeFileSync(probe, '{}') + icacls(probe, '/inheritance:r', '/q') + icacls(probe, '/grant:r', `*${FOREIGN_SID}:(F)`, '/q') + return readDenied(probe) + } finally { + icacls(probe, '/reset', '/q') + icacls(probeRoot, '/reset', '/t', '/q') + removeTreeSync(probeRoot) + } +} + +/** + * BUILTIN\Guests: a real, always-resolvable group that no interactive token is a member of. + * `S-1-5-32-544` looks foreign only until the suite meets a host that is elevated AND logged + * in as the built-in Administrator -- a CI runner -- where it grants the reader full control + * and every assertion below goes vacuous. An unresolvable SID is not an option: icacls + * rejects one with ERROR_NONE_MAPPED (1332). + */ +const FOREIGN_SID = 'S-1-5-32-546' + +function icacls(...args: string[]): number | null { + return runProcessSync({ + program: windowsSystem32Binary('icacls.exe'), + args, + timeoutMs: 10_000 + }).code +} + +/** The on-disk state a successful harden leaves for a SID this process does not hold. */ +function makeUnreadable(filePath: string): void { + // Two invocations: the combined `/inheritance:r /grant:r` form keeps %TEMP%'s inherited + // [SYSTEM, Administrators, user] as *explicit* ACEs on Windows Server, which left the file + // readable and every assertion below vacuous. Remove inheritance first, then grant. + expect(icacls(filePath, '/inheritance:r', '/q')).toBe(0) + expect(icacls(filePath, '/grant:r', `*${FOREIGN_SID}:(F)`, '/q')).toBe(0) + expect(readDenied(filePath), 'fixture should be unreadable').toBe(true) +} + +const describeOnWindows = process.platform === 'win32' && canDenyReads() ? describe : describe.skip + +describeOnWindows('a secure store that exists but cannot be read', () => { + let root: string + + beforeAll(() => { + root = mkdtempSync(join(tmpdir(), 'orca-unreadable-')) + }) + + afterAll(() => { + // Reset first: the tree is not removable while its files grant only Administrators. + icacls(root, '/reset', '/t', '/q') + removeTreeSync(root) + }) + + it('does not regenerate the E2EE keypair, which would un-pair every device', async () => { + const { loadOrCreateE2EEKeypair } = await import('./e2ee-keypair') + const { E2EE_KEYPAIR_FILENAME } = await import('./mobile-pairing-files') + const dir = join(root, 'e2ee') + mkdirSync(dir, { recursive: true }) + const filePath = join(dir, E2EE_KEYPAIR_FILENAME) + const original = JSON.stringify({ + v: 1, + publicKeyB64: Buffer.alloc(32, 7).toString('base64'), + secretKeyB64: Buffer.alloc(32, 9).toString('base64') + }) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + expect(() => loadOrCreateE2EEKeypair(dir)).toThrow(/Refusing to (regenerate|overwrite)/) + + // The point: the secret key is still the one every paired phone derived its shared secret from. + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + }) + + it('does not erase the device registry, which would revoke every paired token', async () => { + const { DeviceRegistry } = await import('./device-registry') + const { DEVICE_REGISTRY_FILENAME } = await import('./mobile-pairing-files') + const dir = join(root, 'devices') + mkdirSync(dir, { recursive: true }) + const filePath = join(dir, DEVICE_REGISTRY_FILENAME) + const original = JSON.stringify([ + { + deviceId: 'device-1', + name: 'Phone', + token: 'bearer-token-that-must-survive', + scope: 'mobile', + pairedAt: 1, + lastSeenAt: 2 + } + ]) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + const registry = new DeviceRegistry(dir) + // Any mutator reaches save(); it must refuse rather than write the empty list it loaded. + expect(() => registry.addDevice('Another phone', 'mobile')).toThrow( + /Refusing to (regenerate|overwrite)/ + ) + + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + }) + + it('does not blank the plugin secret vault on write', async () => { + vi.doMock('electron', () => ({ + safeStorage: { + isEncryptionAvailable: () => true, + encryptString: (value: string) => Buffer.from(`enc:${value}`), + decryptString: (buffer: Buffer) => buffer.toString().replace(/^enc:/, '') + } + })) + const { PluginSecretsStore } = await import('./../plugins/plugin-secrets-store') + const dir = join(root, 'plugin-secrets') + mkdirSync(dir, { recursive: true }) + const store = new PluginSecretsStore(dir, 'publisher.plugin') + // Reach the path the store computes rather than restating its layout here. + const filePath = (store as unknown as { filePath: string }).filePath + mkdirSync(join(filePath, '..'), { recursive: true }) + const original = JSON.stringify({ + version: 1, + format: 'electron-safe-storage-v1', + ciphertexts: { existing: Buffer.from('enc:keep-me').toString('base64') } + }) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + expect(store.set('added', 'value')).toEqual({ ok: false, error: expect.any(String) }) + store.delete('existing') + + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + vi.doUnmock('electron') + }) + it('does not blank the plugin KV store on write', async () => { + const { PluginKvStore } = await import('./../plugins/plugin-storage-store') + const dir = join(root, 'plugin-kv') + mkdirSync(dir, { recursive: true }) + const store = new PluginKvStore(dir, 'publisher.plugin', 'storage.json') + const filePath = (store as unknown as { filePath: string }).filePath + mkdirSync(join(filePath, '..'), { recursive: true }) + const original = JSON.stringify({ keep: 'me' }) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + expect(store.set('added', 'value')).toEqual({ ok: false, error: expect.any(String) }) + store.delete('keep') + + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + }) + + it('does not drop pending relay revocations', async () => { + const { RelayRevokeOutbox } = await import('./relay/relay-revoke-outbox') + const dir = join(root, 'relay') + mkdirSync(dir, { recursive: true }) + const filePath = join(dir, 'mobile-relay-revoke-outbox.json') + const original = JSON.stringify([ + { + relayHostId: 'host-1', + relayDeviceId: 'device-1', + ownerIdentityKey: 'owner-1', + reqId: 'req-1', + createdAt: 1 + } + ]) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + const outbox = new RelayRevokeOutbox(dir) + expect(() => + outbox.enqueue({ + relayHostId: 'host-2', + relayDeviceId: 'device-2', + ownerIdentityKey: 'owner-2' + }) + ).toThrow(/Refusing to (regenerate|overwrite)/) + + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + }) + + /** + * The one site that *deletes* rather than overwrites: a refresh failure plus an unreadable + * session used to fall past the `status === 'found'` guard into `clearOrcaCloudSession`. + */ + it('does not delete the account session it could not read', async () => { + vi.doMock('electron', () => ({ + safeStorage: { + isEncryptionAvailable: () => true, + encryptString: (value: string) => Buffer.from(value), + decryptString: (buffer: Buffer) => buffer.toString() + } + })) + const { readOrcaCloudSession, getOrcaCloudSessionPath } = + await import('./../orca-profiles/profile-cloud-session-store') + const dir = join(root, 'profiles') + mkdirSync(dir, { recursive: true }) + const filePath = getOrcaCloudSessionPath('profile-1', dir) + mkdirSync(join(filePath, '..'), { recursive: true }) + const original = JSON.stringify({ version: 1, format: 'dev-plaintext-v1', savedAt: 1 }) + writeFileSync(filePath, original) + makeUnreadable(filePath) + + // The status the delete path keys off: `unreadable`, never `decrypt-failed`. + expect(readOrcaCloudSession('profile-1', dir).status).toBe('unreadable') + + icacls(filePath, '/reset', '/q') + expect(readFileSync(filePath, 'utf8')).toBe(original) + vi.doUnmock('electron') + }) +}) diff --git a/src/main/runtime/windows-mobile-firewall.test.ts b/src/main/runtime/windows-mobile-firewall.test.ts index 19109a444b8..d561878a538 100644 --- a/src/main/runtime/windows-mobile-firewall.test.ts +++ b/src/main/runtime/windows-mobile-firewall.test.ts @@ -1,4 +1,5 @@ import { describe, expect, it, vi } from 'vitest' +import { execFile } from 'node:child_process' import { getWebSocketPort, inspectWindowsMobileFirewall, @@ -6,6 +7,9 @@ import { type WindowsMobileFirewallEnvironment } from './windows-mobile-firewall' +// Why: every other case injects `runPowerShell`, so only the argv case below reaches execFile. +vi.mock('node:child_process', () => ({ execFile: vi.fn() })) + function environment( runPowerShell: WindowsMobileFirewallEnvironment['runPowerShell'], overrides: Partial = {} @@ -179,6 +183,56 @@ describe('windows mobile firewall', () => { expect(repairScript).toContain('-EdgeTraversalPolicy Block') }) + it('keeps the elevated child encoded because Start-Process re-splits its ArgumentList', async () => { + // Why: `Start-Process -ArgumentList` joins the array into one ShellExecuteEx parameter + // string without quoting and PowerShell re-splits it on whitespace, which collapses runs + // of spaces. Measured on Windows 11: a `-Command` payload turned `C:\My App\Orca.exe` + // into `C:\My App\Orca.exe`, i.e. a firewall rule for the wrong program. Base64 is the + // only form that survives that hop, so this site must not follow the local runner. + const runPowerShell = vi.fn().mockResolvedValue('{"launched":true,"exitCode":0}') + await repairWindowsMobileFirewall( + 6769, + environment(runPowerShell, { executablePath: 'C:\\My App\\Orca.exe' }) + ) + + const outerScript = runPowerShell.mock.calls[0]![0] as string + expect(outerScript).toContain("'-EncodedCommand'") + expect(outerScript).not.toContain("'-Command'") + expect(outerScript).toContain('-Verb RunAs') + + const encoded = outerScript.match(/'-EncodedCommand', '([^']+)'/)?.[1] + const repairScript = Buffer.from(encoded!, 'base64').toString('utf16le') + expect(repairScript).toContain("-Program 'C:\\My App\\Orca.exe'") + }) + + it('runs the local PowerShell over argv with a plain -Command script', async () => { + // Why: execFile reaches CreateProcess with no shell in between, so the script needs no + // base64 armouring, and argv preserves runs of spaces that the elevated hop cannot. + // `-EncodedCommand` here was pure EDR signal. + const execFileMock = vi.mocked(execFile) + execFileMock.mockImplementation(((_file, _args, _options, callback) => { + callback(null, '{"privateFirewallEnabled":true,"networkCategory":"Private"}', '') + return {} + }) as unknown as typeof execFile) + + await inspectWindowsMobileFirewall(6768, undefined, { + platform: 'win32', + isPackaged: true, + executablePath: 'C:\\My App\\Orca.exe', + systemRoot: 'C:\\Windows' + }) + + const [file, args] = execFileMock.mock.calls[0]! + expect(file).toMatch(/WindowsPowerShell\\v1\.0\\powershell\.exe$/i) + expect(args!.slice(0, 3)).toEqual(['-NoProfile', '-NonInteractive', '-Command']) + expect(args).not.toContain('-EncodedCommand') + expect(args).not.toContain('-ExecutionPolicy') + // The script travels as ONE argv element, so its spaces and newlines survive verbatim. + expect(args).toHaveLength(4) + expect(args![3]).toContain("-Program 'C:\\My App\\Orca.exe'") + expect(args![3]).toContain('\n') + }) + it('distinguishes a cancelled UAC prompt from repair failure', async () => { await expect( repairWindowsMobileFirewall( diff --git a/src/main/runtime/windows-mobile-firewall.ts b/src/main/runtime/windows-mobile-firewall.ts index 88b885ab5f0..c90a025cb14 100644 --- a/src/main/runtime/windows-mobile-firewall.ts +++ b/src/main/runtime/windows-mobile-firewall.ts @@ -229,6 +229,11 @@ Get-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -ErrorAction Si New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShell(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShell(executablePath)} -EdgeTraversalPolicy Block | Out-Null` } +// Why the elevated child keeps `-EncodedCommand` while the local runner does not: `Start-Process +// -ArgumentList` joins its array into one ShellExecuteEx parameter string without quoting, and +// PowerShell then re-splits it on whitespace — measured to collapse `C:\My App\...` to +// `C:\My App\...`, which would silently write the firewall rule for the wrong program. Node's +// argv path (createPowerShellRunner) preserves runs of spaces, so only this hop needs base64. function buildElevationScript(powershellPath: string, encodedRepairScript: string): string { return `$ErrorActionPreference = 'Stop' try { @@ -257,7 +262,9 @@ function createPowerShellRunner(systemRoot?: string): PowerShellRunner { new Promise((resolve, reject) => { execFile( powershellPath, - ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodePowerShell(script)], + // Why: argv reaches CreateProcess with no shell in between, so the script needs no base64 + // armouring — and plain `-Command` keeps this off EDR's encoded-PowerShell heuristics. + ['-NoProfile', '-NonInteractive', '-Command', script], { encoding: 'utf8', timeout: timeoutMs, windowsHide: true, maxBuffer: 1024 * 1024 }, (error, stdout) => { if (error) { diff --git a/src/main/skills/skill-root-file-walk.test.ts b/src/main/skills/skill-root-file-walk.test.ts index 3ca80bdb495..ad84eced6b6 100644 --- a/src/main/skills/skill-root-file-walk.test.ts +++ b/src/main/skills/skill-root-file-walk.test.ts @@ -45,6 +45,34 @@ describe('findSkillFiles', () => { expect(found).toEqual([join(root, 'near', 'SKILL.md')]) }) + it('does not stat directory links beyond the depth bound but still follows in-bound links', async () => { + const base = await makeTree() + const root = join(base, 'skills') + const edge = join(root, 'a', 'b', 'c', 'd') + const target = join(base, 'linked') + await writeFileAt(join(edge, 'SKILL.md')) + await writeFileAt(join(target, 'SKILL.md')) + for (let index = 0; index < 32; index += 1) { + await symlink( + target, + join(edge, `link${index.toString().padStart(2, '0')}`), + process.platform === 'win32' ? 'junction' : 'dir' + ) + } + const statPaths: string[] = [] + onStat = async (path) => { + statPaths.push(path) + } + + expect(await findSkillFiles(root, 4)).toEqual([join(edge, 'SKILL.md')]) + expect(statPaths).toEqual([]) + expect(await findSkillFiles(root, 5)).toEqual([ + join(edge, 'SKILL.md'), + join(edge, 'link00', 'SKILL.md') + ]) + expect(statPaths).toHaveLength(32) + }) + it('returns nothing for a missing root rather than throwing', async () => { expect(await findSkillFiles(join(await makeTree(), 'absent'), 4)).toEqual([]) }) diff --git a/src/main/skills/skill-root-file-walk.ts b/src/main/skills/skill-root-file-walk.ts index 261a650a967..4be1843f602 100644 --- a/src/main/skills/skill-root-file-walk.ts +++ b/src/main/skills/skill-root-file-walk.ts @@ -43,9 +43,6 @@ export async function findSkillFiles( // indistinguishable from a genuinely small root, and a caller that cached it // would publish "these skills no longer exist". signal?.throwIfAborted() - if (!isWithinDepth(rootPath, dirPath, maxDepth)) { - return - } let resolvedDirPath: string try { resolvedDirPath = await realpath(dirPath) @@ -61,6 +58,8 @@ export async function findSkillFiles( if (!entries) { return } + // Directory entry names add one segment, so siblings share the depth verdict. + let childrenWithinDepth: boolean | undefined for (const entry of entries) { signal?.throwIfAborted() // Why: a staged sibling sits directly in a scanned root, so without this a @@ -86,10 +85,15 @@ export async function findSkillFiles( continue } if (entry.isDirectory()) { - await visit(entryPath) + if ((childrenWithinDepth ??= isWithinDepth(rootPath, entryPath, maxDepth))) { + await visit(entryPath) + } continue } - if (entry.isSymbolicLink()) { + if ( + entry.isSymbolicLink() && + (childrenWithinDepth ??= isWithinDepth(rootPath, entryPath, maxDepth)) + ) { // Why: users commonly symlink agent skill dirs across providers; follow // directory links but guard by realpath so recursive links cannot loop. let linksToDirectory = false diff --git a/src/main/speech/model-manager-stream-cleanup.test.ts b/src/main/speech/model-manager-stream-cleanup.test.ts index dcebaca37a3..34b7aa893d8 100644 --- a/src/main/speech/model-manager-stream-cleanup.test.ts +++ b/src/main/speech/model-manager-stream-cleanup.test.ts @@ -1,4 +1,4 @@ -import { mkdtempSync, rmSync } from 'node:fs' +import { mkdtempSync, readFileSync, rmSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { PassThrough } from 'node:stream' @@ -34,15 +34,17 @@ describe('ModelManager stream cleanup', () => { netRequestMock.mockReset() }) - it('removes response progress listeners after a model download finishes', async () => { + it('reuses the idle timer and removes progress listeners after a fragmented download', async () => { const dir = mkdtempSync(join(tmpdir(), 'orca-model-manager-')) + vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }) + const timeoutSpy = vi.spyOn(globalThis, 'setTimeout') try { const response = new PassThrough() as PassThrough & { statusCode: number headers: Record } response.statusCode = 200 - response.headers = { 'content-length': '4' } + response.headers = { 'content-length': '1000' } const responseHandlers: ((response: unknown) => void)[] = [] const request = { abort: vi.fn(() => request), @@ -66,16 +68,26 @@ describe('ModelManager stream cleanup', () => { const download = manager.downloadFile( 'https://example.com/model.bin', join(dir, 'model.bin'), - 4, + 1000, 'm', () => false ) - response.write(Buffer.from('ab')) - response.end(Buffer.from('cd')) + await vi.advanceTimersByTimeAsync(60_000) + for (let index = 0; index < 1000; index += 1) { + response.write(Buffer.from('a')) + } + await vi.advanceTimersByTimeAsync(119_999) + expect(request.abort).not.toHaveBeenCalled() + response.end() await expect(download).resolves.toBeUndefined() expect(response.listenerCount('data')).toBe(0) + expect(vi.getTimerCount()).toBe(0) + expect(readFileSync(join(dir, 'model.bin'), 'utf8')).toBe('a'.repeat(1000)) + expect(timeoutSpy.mock.calls.filter(([, delay]) => delay === 120_000)).toHaveLength(1) } finally { + timeoutSpy.mockRestore() + vi.useRealTimers() rmSync(dir, { recursive: true, force: true }) } }) diff --git a/src/main/speech/speech-model-http-download.ts b/src/main/speech/speech-model-http-download.ts index ae2bae9648e..3bd2f24ab97 100644 --- a/src/main/speech/speech-model-http-download.ts +++ b/src/main/speech/speech-model-http-download.ts @@ -71,8 +71,11 @@ export abstract class SpeechModelHttpDownload { request = null } const resetIdleTimeout = (): void => { - clearIdleTimeout() - idleTimeout = setTimeout(onRequestTimeout, DOWNLOAD_IDLE_TIMEOUT_MS) + if (idleTimeout) { + idleTimeout.refresh() + } else { + idleTimeout = setTimeout(onRequestTimeout, DOWNLOAD_IDLE_TIMEOUT_MS) + } } const resolveOnce = (): void => { if (settled) { diff --git a/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts b/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts new file mode 100644 index 00000000000..f87d1e6f778 --- /dev/null +++ b/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts @@ -0,0 +1,87 @@ +import { afterEach, describe, expect, it, vi } from 'vitest' +import { createSshFileStreamInactivityDeadline } from './ssh-file-stream-inactivity-deadline' +import type { SystemPowerLifecycleListener } from '../system-power-lifecycle' + +afterEach(() => { + vi.restoreAllMocks() + vi.useRealTimers() +}) + +describe('SSH file stream inactivity timer', () => { + it('reuses one timer while retaining the deadline of the latest chunk', () => { + vi.useFakeTimers() + const allocate = vi.spyOn(globalThis, 'setTimeout') + const onTimeout = vi.fn() + const unsubscribe = vi.fn() + const deadline = createSshFileStreamInactivityDeadline(onTimeout, (listener) => { + listener.onResume() + return unsubscribe + }) + deadline.reset() + vi.advanceTimersByTime(30_000) + for (let chunk = 0; chunk < 1000; chunk += 1) { + deadline.reset() + } + expect(allocate).toHaveBeenCalledTimes(1) + vi.advanceTimersByTime(59_999) + expect(onTimeout).not.toHaveBeenCalled() + vi.advanceTimersByTime(1) + expect(onTimeout).toHaveBeenCalledTimes(1) + deadline.clear() + expect(unsubscribe).toHaveBeenCalledTimes(1) + expect(vi.getTimerCount()).toBe(0) + }) + + it('releases on suspend and creates a fresh timer on resume', () => { + vi.useFakeTimers() + const allocate = vi.spyOn(globalThis, 'setTimeout') + const onTimeout = vi.fn() + let power!: SystemPowerLifecycleListener + const deadline = createSshFileStreamInactivityDeadline(onTimeout, (listener) => { + power = listener + listener.onResume() + return vi.fn() + }) + deadline.reset() + vi.advanceTimersByTime(30_000) + power.onSuspend() + for (let chunk = 0; chunk < 1000; chunk += 1) { + deadline.reset() + } + expect(vi.getTimerCount()).toBe(0) + vi.advanceTimersByTime(120_000) + expect(onTimeout).not.toHaveBeenCalled() + power.onResume() + expect(allocate).toHaveBeenCalledTimes(2) + vi.advanceTimersByTime(59_999) + expect(onTimeout).not.toHaveBeenCalled() + vi.advanceTimersByTime(1) + expect(onTimeout).toHaveBeenCalledTimes(1) + deadline.clear() + expect(vi.getTimerCount()).toBe(0) + }) + + it('clears the timer and subscription and supports a later reset', () => { + vi.useFakeTimers() + const onTimeout = vi.fn() + const unsubscribe = vi.fn() + const subscribe = vi.fn((listener: SystemPowerLifecycleListener) => { + listener.onResume() + return unsubscribe + }) + const deadline = createSshFileStreamInactivityDeadline(onTimeout, subscribe) + deadline.reset() + deadline.clear() + deadline.clear() + expect(unsubscribe).toHaveBeenCalledTimes(1) + expect(vi.getTimerCount()).toBe(0) + vi.advanceTimersByTime(120_000) + expect(onTimeout).not.toHaveBeenCalled() + deadline.reset() + expect(subscribe).toHaveBeenCalledTimes(2) + expect(vi.getTimerCount()).toBe(1) + deadline.clear() + expect(unsubscribe).toHaveBeenCalledTimes(2) + expect(vi.getTimerCount()).toBe(0) + }) +}) diff --git a/src/main/ssh/ssh-file-stream-inactivity-deadline.ts b/src/main/ssh/ssh-file-stream-inactivity-deadline.ts index 5470e8121fe..cbb9839f9b3 100644 --- a/src/main/ssh/ssh-file-stream-inactivity-deadline.ts +++ b/src/main/ssh/ssh-file-stream-inactivity-deadline.ts @@ -24,10 +24,13 @@ export function createSshFileStreamInactivityDeadline( } } const arm = (): void => { - clearTimer() if (suspended) { return } + if (timer) { + timer.refresh() + return + } timer = setTimeout(onTimeout, SSH_FILE_STREAM_INACTIVITY_TIMEOUT_MS) timer.unref?.() } diff --git a/src/main/ssh/ssh-git-response-stream-reader.ts b/src/main/ssh/ssh-git-response-stream-reader.ts index 6a50dc28a72..0a8b26aa779 100644 --- a/src/main/ssh/ssh-git-response-stream-reader.ts +++ b/src/main/ssh/ssh-git-response-stream-reader.ts @@ -90,7 +90,10 @@ export function requestGitStreamable( // killed, but a wedged stream (no frames arriving) rejects instead of // hanging the caller forever. const armInactivity = (): void => { - clearInactivity() + if (inactivityTimer) { + inactivityTimer.refresh() + return + } inactivityTimer = setTimeout(() => { fail( new GitResponseStreamError( diff --git a/src/main/ssh/ssh-git-stream-idle-timer.test.ts b/src/main/ssh/ssh-git-stream-idle-timer.test.ts new file mode 100644 index 00000000000..7cd5207c63a --- /dev/null +++ b/src/main/ssh/ssh-git-stream-idle-timer.test.ts @@ -0,0 +1,80 @@ +import { expect, it, vi } from 'vitest' +import type { SshChannelMultiplexer } from './ssh-channel-multiplexer' +import { requestGitStreamable } from './ssh-git-response-stream-reader' + +it.each(['end', 'abort', 'timeout'] as const)( + 'reuses the idle deadline across 1000 chunks and cleans up on %s', + async (finish) => { + vi.useFakeTimers() + const setTimer = vi.spyOn(globalThis, 'setTimeout') + try { + const listeners = new Map) => void>() + const controller = new AbortController() + const content = 'x'.repeat(998) + const encoded = Buffer.from(JSON.stringify(content)) + const notify = vi.fn() + const mux = { + request: vi.fn(async () => ({ + __orcaGitResponseStream: { streamId: 7, totalBytes: encoded.length, chunkCount: 1000 } + })), + isDisposed: () => false, + notify, + onDispose: () => () => {}, + onNotificationByMethod: ( + method: string, + callback: (params: Record) => void + ) => { + listeners.set(method, callback) + return () => listeners.delete(method) + } + } + const promise = requestGitStreamable( + mux as unknown as SshChannelMultiplexer, + 'git.diff', + {}, + { + signal: controller.signal + } + ) + const outcome = promise.then( + (value) => ({ value }), + (error: Error) => ({ error: error.message }) + ) + await vi.advanceTimersByTimeAsync(15_000) + for (let seq = 0; seq < encoded.length; seq++) { + listeners.get('git.responseChunk')!({ + streamId: 7, + seq, + data: encoded.subarray(seq, seq + 1).toString('base64') + }) + } + await vi.advanceTimersByTimeAsync(29_999) + expect(listeners.size).toBe(3) + expect(notify.mock.calls.filter(([method]) => method === 'git.responseAck')).toHaveLength( + 1000 + ) + const allocations = setTimer.mock.calls.filter(([, delay]) => delay === 30_000).length + if (finish === 'end') { + listeners.get('git.responseEnd')!({ streamId: 7 }) + expect(await outcome).toEqual({ value: content }) + } else if (finish === 'abort') { + controller.abort() + expect(await outcome).toEqual({ error: 'Request was cancelled' }) + } else { + await vi.advanceTimersByTimeAsync(1) + expect(await outcome).toEqual({ + error: 'Git response stream stalled (>30000ms without data)' + }) + } + expect(allocations).toBe(1) + expect(vi.getTimerCount()).toBe(0) + expect(listeners.size).toBe(0) + expect( + notify.mock.calls.filter(([method]) => method === 'git.cancelResponseStream') + ).toHaveLength(finish === 'end' ? 0 : 1) + } finally { + setTimer.mockRestore() + vi.useRealTimers() + } + } +) diff --git a/src/main/ssh/ssh-relay-deploy-helpers.ts b/src/main/ssh/ssh-relay-deploy-helpers.ts index a035133ddc5..f9a8f167752 100644 --- a/src/main/ssh/ssh-relay-deploy-helpers.ts +++ b/src/main/ssh/ssh-relay-deploy-helpers.ts @@ -209,6 +209,7 @@ export function waitForSentinel( const afterSentinelOffset = sentinelIdx + RELAY_SENTINEL_BUFFER.length - bufferedStdout.length const afterSentinel = data.subarray(Math.max(0, afterSentinelOffset)) + bufferedStdout = Buffer.alloc(0) if (afterSentinel.length > 0) { pendingAfterSentinel = afterSentinel @@ -258,7 +259,7 @@ export function waitForSentinel( return } - bufferedStdout = bufferedStdout.length === 0 ? data : Buffer.concat([bufferedStdout, data]) + bufferedStdout = startupStdout }) }) } diff --git a/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts b/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts new file mode 100644 index 00000000000..b05c8a71d92 --- /dev/null +++ b/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts @@ -0,0 +1,62 @@ +import { EventEmitter } from 'node:events' +import type { ClientChannel } from 'ssh2' +import { expect, it, vi } from 'vitest' +import { RELAY_SENTINEL } from './relay-protocol' +import { waitForSentinel } from './ssh-relay-deploy-helpers' + +it.each([1, 256])('copies each startup prefix once across %i chunks', async (chunks) => { + const channel = Object.assign(new EventEmitter(), { + stderr: new EventEmitter(), + stdin: { write: vi.fn(() => true) }, + close: vi.fn(), + pause: vi.fn(), + resume: vi.fn() + }) + const pending = waitForSentinel(channel as unknown as ClientChannel) + const chunk = Buffer.alloc((64 * 1024) / chunks, 120) + const concat = vi.spyOn(Buffer, 'concat') + let calls = 0 + let copied = 0 + try { + for (let i = 0; i < chunks; i++) { + channel.emit('data', chunk) + } + calls = concat.mock.calls.length + copied = concat.mock.calls.reduce( + (sum, [buffers]) => sum + buffers.reduce((bytes, buffer) => bytes + buffer.length, 0), + 0 + ) + } finally { + concat.mockRestore() + } + channel.emit('data', Buffer.from(`${RELAY_SENTINEL}first-frame`)) + const transport = await pending + const received: string[] = [] + transport.onData((bytes) => received.push(bytes.toString())) + expect(received).toEqual(['first-frame']) + expect(channel.close).not.toHaveBeenCalled() + expect(calls).toBe(chunks - 1) + expect(copied).toBe(chunk.length * ((chunks * (chunks + 1)) / 2 - 1)) +}) + +it.each(Array.from({ length: RELAY_SENTINEL.length + 1 }, (_, i) => i))( + 'preserves the marker and binary payload when split at byte %i', + async (split) => { + const channel = Object.assign(new EventEmitter(), { + stderr: new EventEmitter(), + stdin: { write: vi.fn(() => true) }, + close: vi.fn() + }) + const pending = waitForSentinel(channel as unknown as ClientChannel) + const marker = Buffer.from(RELAY_SENTINEL) + const payload = Buffer.from([0, 255, 128, 10, 13, 1]) + channel.emit('data', Buffer.alloc(63 * 1024, 120)) + channel.emit('data', marker.subarray(0, split)) + channel.emit('data', Buffer.concat([marker.subarray(split), payload])) + const transport = await pending + const received: Buffer[] = [] + transport.onData((bytes) => received.push(bytes)) + expect(Buffer.concat(received)).toEqual(payload) + expect(channel.close).not.toHaveBeenCalled() + } +) diff --git a/src/main/ssh/ssh-remote-powershell.test.ts b/src/main/ssh/ssh-remote-powershell.test.ts new file mode 100644 index 00000000000..f6ba6136378 --- /dev/null +++ b/src/main/ssh/ssh-remote-powershell.test.ts @@ -0,0 +1,164 @@ +import { describe, expect, it } from 'vitest' +import { join } from 'node:path' +import { scanSourceTree, stripComments } from '../../shared/source-scan/source-tree-scan' +import { powerShellCommand } from './ssh-remote-powershell' + +function decodePayload(command: string): string { + const encoded = command.match(/ -EncodedCommand (\S+)$/)?.[1] + if (!encoded) { + throw new Error(`no -EncodedCommand payload in: ${command}`) + } + return Buffer.from(encoded, 'base64').toString('utf16le') +} + +/** + * This one helper builds the command line for every remote-Windows SSH call site + * (relay deploy, install locks, upload staging, GC claim, browse, CLI launch), so + * its switches are worth pinning. + */ +describe('powerShellCommand', () => { + it('spells no -ExecutionPolicy switch', () => { + const command = powerShellCommand('exit 0') + const switches = command.replace(/ -EncodedCommand \S+$/, '') + + // Why: `-EncodedCommand` is not execution-policy gated — only `-File` is — so the switch + // was a no-op, and `-ExecutionPolicy Bypass` beside base64 is among the most heavily + // EDR-flagged PowerShell command lines there is. + expect(switches).not.toMatch(/-ExecutionPolicy/i) + expect(switches).not.toMatch(/Bypass/i) + expect(switches).toBe('powershell.exe -NoProfile -NonInteractive') + }) + + it('keeps the base64 payload the remote shell cannot rewrite', () => { + // Why: this string is re-parsed by the remote host's sshd DefaultShell, which is + // cmd.exe on a stock Windows OpenSSH install. Base64 is load-bearing here. + const command = powerShellCommand("Write-Output 'a & b' | Out-String") + + expect(command).toMatch( + /^powershell\.exe -NoProfile -NonInteractive -EncodedCommand [A-Za-z0-9+/=]+$/ + ) + expect(decodePayload(command)).toBe("Write-Output 'a & b' | Out-String") + }) +}) + +const MAIN_DIR = join(import.meta.dirname, '..') + +// Why: execution policy gates loading script FILES and nothing else, so dropping +// `-ExecutionPolicy Bypass` is a no-op exactly while no remote payload loads one. That +// invariant is what makes the switch safe to omit, and it was previously guarded by nothing: +// a future payload that dot-sourced or used `-File` would fail only on a remote host whose +// LocalMachine policy is Restricted/AllSigned. See the invariant note on `powerShellCommand`. +// Every pattern is case-insensitive: PowerShell switches and cmdlet names are, and Windows +// paths are, so `-file`, `import-module` and `DEPLOY.PS1` are all legitimate spellings that a +// case-sensitive pattern would wave through. Verified to add no false positive across the real +// importers. Each entry carries the fixtures it must catch AND the near-misses it must not, so +// a future tightening cannot quietly trade one for the other. +// +// Limit: this is a source-text scan, so a script file reached only through a variable +// (`& $scriptPath`) never appears in source and no pattern here can catch it — this narrows +// the hole rather than sealing it. The invariant note on `powerShellCommand` covers the rest. +// +// Matched against `stripComments`, the shared quote-tracking stripper, so a construct named in +// prose is not counted as code. A line-anchored regex pair cannot do this job: it either eats +// live code by pairing a `/*` inside a glob string with a later comment close, or — anchoring +// to avoid that — skips every trailing comment. Quote state is the only fix. +const POLICY_GATED_CONSTRUCTS = [ + { + label: 'a PowerShell script file (.ps1/.psm1)', + pattern: /\.psm?1\b/i, + catches: [ + `powerShellCommand("$script = 'C:\\tools\\deploy.ps1'")`, + `powerShellCommand("Import-Module '$dir\\orca.psm1'")`, + `powerShellCommand("& '$root\\DEPLOY.PS1'")` + ], + ignores: [`const build = 'artifact.ps10'`] + }, + { + label: 'Import-Module', + pattern: /\bImport-Module\b/i, + catches: [ + `powerShellCommand("Import-Module 'NetSecurity'")`, + `powerShellCommand("import-module $modulePath")` + ], + ignores: [`const name = 'Import-ModuleList'`] + }, + { + // Anchored to a token boundary: a bare /-File\b/i also matches `--credential-file`, + // `--log-file` and `--body-file`, which are real arguments in three of these importers. + label: 'the -File switch', + pattern: /(^|[\s'"`([{,])-File\b/i, + catches: [ + `runRemote("powershell.exe -NoProfile -File 'C:\\x.ps1'")`, + `runRemote("powershell.exe -file $scriptVar")`, + `runRemote(["-NoProfile", "-File", scriptVar])` + ], + ignores: [`fetchWith("--credential-file", path)`, `run("--log-file $p --body-file $b")`] + }, + { + // The quote/backtick prefixes matter: a dot-source in a generated payload usually sits at + // the very start of a TS string literal — `powerShellCommand(". '$x'")` — not after a `;`. + label: 'dot-sourcing', + pattern: /(^|[;{'"`]|\n)[ \t]*\.[ \t]+['"$]/, + catches: [ + `powerShellCommand(". '$profileScript'")`, + `powerShellCommand("$ErrorActionPreference = 'Stop'; . '$profile'")`, + `powerShellCommand(". $profileScript")` + ], + ignores: [ + `cp -a $sourcePath/. $destinationPath/`, + `Host key verification failed for $displayHost. $detail` + ] + } +] as const + +describe('remote PowerShell payload invariant', () => { + // `scanSourceTree` is the shared walk: it skips node_modules/dist/out/build/.git, + // dot-directories and `__fixtures__`, and excludes tests by the shared `isTestFile` (which + // also covers `.spec.ts`, `__tests__/` and `-test-harness.ts`). A hand-rolled walk that got + // any of those wrong would move the floor below, which is this guard's own goalpost. + const importers = scanSourceTree(MAIN_DIR).filter((file) => + file.source.includes('ssh-remote-powershell') + ) + + it('finds the modules that build remote payloads', () => { + // Guards the scan itself: a resolution change that emptied this list would make every + // assertion below vacuously pass. 15 importers today, re-derived against the shared walk. + expect(importers.length).toBeGreaterThan(10) + }) + + it.each(POLICY_GATED_CONSTRUCTS)('loads no remote payload through $label', ({ + label, + pattern + }) => { + const offenders = importers + .filter((file) => pattern.test(stripComments(file.source))) + .map((file) => file.relativePath) + + expect( + offenders, + `${offenders.join(', ')} uses ${label}, which IS execution-policy gated on the remote ` + + 'host. Do not restore `-ExecutionPolicy Bypass` to the command line (a GPO scope ' + + 'beats it). Set the policy in-payload at process scope instead — see the note on ' + + 'powerShellCommand.' + ).toEqual([]) + }) + + // Why: these patterns only earn trust if they fire on a real violation spelled the way a + // generated payload spells it — inside a TS string literal — and stay quiet on the near + // misses. Both halves are load-bearing: an earlier dot-source pattern passed a `;`-prefixed + // sample but missed `powerShellCommand(". '$x'")`, and the obvious case-insensitive fix for + // `-File` matches `--credential-file` in three real importers. A fixture written from the + // pattern confirms the pattern; these are written from the requirement. + it.each(POLICY_GATED_CONSTRUCTS)('detects $label wherever it is spelled', ({ + pattern, + catches, + ignores + }) => { + for (const sample of catches) { + expect(pattern.test(sample), `should catch: ${sample}`).toBe(true) + } + for (const sample of ignores) { + expect(pattern.test(sample), `should ignore: ${sample}`).toBe(false) + } + }) +}) diff --git a/src/main/ssh/ssh-remote-powershell.ts b/src/main/ssh/ssh-remote-powershell.ts index 420223ced29..31587bcc668 100644 --- a/src/main/ssh/ssh-remote-powershell.ts +++ b/src/main/ssh/ssh-remote-powershell.ts @@ -18,6 +18,27 @@ const WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS = 8_000 */ export type WindowsPowerShellExecutable = 'powershell.exe' | 'pwsh.exe' +// Why: `-EncodedCommand` is not execution-policy gated (only `-File` is), so `-ExecutionPolicy +// Bypass` was a no-op here — and it is one of the most heavily EDR-flagged PowerShell tokens. +// The base64 stays: this string is re-parsed by the remote host's default SSH shell, which may +// be cmd.exe, PowerShell, or bash. +// +// INVARIANT — no remote payload may load a PowerShell *script file*. +// +// Execution policy has only ever gated loading script files (2.0 through 7.x). Inline +// statements, `& some.exe` and `Add-Type -TypeDefinition` are never gated, which is what makes +// dropping the switch a no-op for every payload we send today — the compressed path below stays +// inline too, since `Invoke-Expression` on a decompressed string loads no file. Loading a script +// file is the one thing the dropped switch actually covered, so a payload that dot-sources, runs +// `& '.ps1'`, calls `Import-Module '.psm1'`, or passes `-File` would silently fail on a +// remote host whose LocalMachine policy is Restricted/AllSigned with no GPO — a break that +// surfaces on someone else's machine, not ours. +// +// If you ever need one, do NOT restore the command-line switch (it loses to a GPO scope anyway, +// so it never covered the locked-down case): set the policy in-payload at process scope, the way +// `buildWindowsStartupCommand` in src/shared/setup-agent-sequencing.ts does. +// +// Enforced by the ratchet in ssh-remote-powershell.test.ts, which scans every importer. export function powerShellCommand( script: string, executable: WindowsPowerShellExecutable = 'powershell.exe' @@ -38,7 +59,7 @@ export function powerShellCommand( } function encodedPowerShellCommand(script: string, executable: WindowsPowerShellExecutable): string { - return `${executable} -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}` + return `${executable} -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}` } /** Orca-prefixed names so the payload can never shadow the bootstrap's own state. */ diff --git a/src/main/window/createMainWindow-startup-reveal.test.ts b/src/main/window/createMainWindow-startup-reveal.test.ts index f103881ea83..bd7eeadc6b2 100644 --- a/src/main/window/createMainWindow-startup-reveal.test.ts +++ b/src/main/window/createMainWindow-startup-reveal.test.ts @@ -1,4 +1,4 @@ -import { beforeEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' vi.mock('electron', async () => (await import('./createMainWindow-test-harness')).electronModuleMock() @@ -22,6 +22,14 @@ import { withPlatform } from './createMainWindow-test-harness' +// These cases exercise foreground behavior against Electron mocks. +beforeEach(() => { + vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined) + vi.stubEnv('ORCA_E2E_HEADLESS', undefined) + vi.stubEnv('ORCA_E2E_HEADFUL', undefined) +}) +afterEach(() => vi.unstubAllEnvs()) + describe('createMainWindow', () => { beforeEach(() => { resetMainWindowMocks() diff --git a/src/main/window/dashboard-popout-window.test.ts b/src/main/window/dashboard-popout-window.test.ts index 86735811bb8..0e64d573f76 100644 --- a/src/main/window/dashboard-popout-window.test.ts +++ b/src/main/window/dashboard-popout-window.test.ts @@ -171,6 +171,14 @@ function makeStore(ui: Record = {}): { const RENDERER_URL = 'http://localhost:5173' +// These cases exercise foreground behavior against Electron mocks. +beforeEach(() => { + vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined) + vi.stubEnv('ORCA_E2E_HEADLESS', undefined) + vi.stubEnv('ORCA_E2E_HEADFUL', undefined) +}) +afterEach(() => vi.unstubAllEnvs()) + describe('createOrFocusDashboardPopout', () => { beforeEach(() => { instances.length = 0 diff --git a/src/main/window/focus-existing-window.test.ts b/src/main/window/focus-existing-window.test.ts index 9f5dc522150..697b423ab37 100644 --- a/src/main/window/focus-existing-window.test.ts +++ b/src/main/window/focus-existing-window.test.ts @@ -1,5 +1,5 @@ import type { App, BrowserWindow } from 'electron' -import { afterEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { focusExistingMainWindow } from './focus-existing-window' type FakeWindowOptions = { @@ -78,6 +78,12 @@ function makeTimer(): { } } +// These cases exercise foreground behavior against Electron mocks. +beforeEach(() => { + vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined) + vi.stubEnv('ORCA_E2E_HEADLESS', undefined) + vi.stubEnv('ORCA_E2E_HEADFUL', undefined) +}) afterEach(() => vi.unstubAllEnvs()) describe('focusExistingMainWindow', () => { diff --git a/src/main/windows/windows-command-line-recovery-health.test.ts b/src/main/windows/windows-command-line-recovery-health.test.ts new file mode 100644 index 00000000000..3791acf6c93 --- /dev/null +++ b/src/main/windows/windows-command-line-recovery-health.test.ts @@ -0,0 +1,59 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { + reportWindowsCommandLineRecoveryHealth, + resetWindowsCommandLineRecoveryHealthForTests +} from './windows-command-line-recovery-health' + +describe('windows command line recovery health', () => { + let warn: ReturnType + + beforeEach(() => { + resetWindowsCommandLineRecoveryHealthForTests() + warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + }) + afterEach(() => { + warn.mockRestore() + }) + + const selfRow = (commandLine: string): { pid: number; commandLine: string } => ({ + pid: process.pid, + commandLine + }) + + it('warns when the querying process has no command line of its own', () => { + // We can always open ourselves with PROCESS_QUERY_LIMITED_INFORMATION, so + // an empty self command line means the query is refused host-wide. + reportWindowsCommandLineRecoveryHealth([selfRow(''), { pid: 4, commandLine: '' }]) + + expect(warn).toHaveBeenCalledTimes(1) + expect(warn.mock.calls[0][0]).toContain('ProcessCommandLineInformation') + expect(warn.mock.calls[0][1]).toEqual({ processes: 2, withCommandLine: 0 }) + }) + + it('warns once per session, not once per scan', () => { + for (let i = 0; i < 5; i++) { + reportWindowsCommandLineRecoveryHealth([selfRow('')]) + } + expect(warn).toHaveBeenCalledTimes(1) + }) + + it('stays quiet when only other processes denied a handle', () => { + // Roughly a quarter of a real table denies access; that is not a fault. + const denied = Array.from({ length: 40 }, (_, index) => ({ + pid: index + 1, + commandLine: '' + })) + reportWindowsCommandLineRecoveryHealth([selfRow('node.exe --run'), ...denied]) + expect(warn).not.toHaveBeenCalled() + }) + + it('stays quiet when our own row is absent, which the caller rejects separately', () => { + reportWindowsCommandLineRecoveryHealth([{ pid: process.pid + 1, commandLine: '' }]) + expect(warn).not.toHaveBeenCalled() + }) + + it('treats a missing commandLine field the same as an empty one', () => { + reportWindowsCommandLineRecoveryHealth([{ pid: process.pid }]) + expect(warn).toHaveBeenCalledTimes(1) + }) +}) diff --git a/src/main/windows/windows-command-line-recovery-health.ts b/src/main/windows/windows-command-line-recovery-health.ts new file mode 100644 index 00000000000..173e8f5a969 --- /dev/null +++ b/src/main/windows/windows-command-line-recovery-health.ts @@ -0,0 +1,47 @@ +/** + * One warning, once per session, when command-line recovery has stopped working. + * + * The reader has no PEB fallback by design: falling back was a total-defeat + * vector, because any single anomalous NTSTATUS reinstated address-space reads + * for the life of the process. The cost of removing it is a cliff -- if + * `NtQueryInformationProcess(ProcessCommandLineInformation)` is refused, every + * command line comes back empty and agent identity matching silently degrades + * to image names, while the addon still loads and still enumerates, so every + * health check stays green. A cliff nobody can see is the failure mode this + * area keeps producing, so it gets a signal. + * + * The querying process is the unambiguous probe. A process can always open + * itself with `PROCESS_QUERY_LIMITED_INFORMATION`, so its own command line + * coming back empty means the query is refused host-wide -- not that some + * target denied a handle, which is normal for roughly a quarter of the table. + * That is why this keys on our own row rather than a fraction: no threshold to + * tune, and no false positive on a hardened box where most processes deny. + */ +type CommandLineRow = { pid: number; commandLine?: string } + +let warned = false + +export function reportWindowsCommandLineRecoveryHealth(rows: CommandLineRow[]): void { + if (warned) { + return + } + const self = rows.find((row) => row.pid === process.pid) + // No self row is a different failure, and the caller's own guard rejects it. + if (!self || (self.commandLine ?? '') !== '') { + return + } + warned = true + const recovered = rows.filter((row) => (row.commandLine ?? '') !== '').length + console.warn( + '[windows-process-table] command-line recovery is refused on this host: the querying ' + + 'process has no command line of its own, so NtQueryInformationProcess' + + '(ProcessCommandLineInformation) is failing for every process. Agent identity matching ' + + 'falls back to image names. A hooked ntdll that does not know class 60 is the usual cause.', + { processes: rows.length, withCommandLine: recovered } + ) +} + +/** Test-only: the warning is once per session, so cases must not inherit it. */ +export function resetWindowsCommandLineRecoveryHealthForTests(): void { + warned = false +} diff --git a/src/main/windows/windows-process-table.test.ts b/src/main/windows/windows-process-table.test.ts index 1aeeed6d1be..bb5eda24385 100644 --- a/src/main/windows/windows-process-table.test.ts +++ b/src/main/windows/windows-process-table.test.ts @@ -1,3 +1,6 @@ +import { mkdtempSync, rmSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import { __setWindowsProcessTableCimScanForTests, @@ -13,6 +16,7 @@ import { type WindowsProcessIdentityRow, type WindowsProcessRow } from './windows-process-table' +import { resetWindowsCommandLineRecoveryHealthForTests } from './windows-command-line-recovery-health' /** None | CreationTime, and CommandLine on top of it. Memory (1) is never asked for. */ const IDENTITY_FLAGS = 4 @@ -22,7 +26,9 @@ const getAllProcesses = vi.fn() // A real snapshot always contains the querying process; the reader rejects a // table without it, because that is what a blocked CreateToolhelp32Snapshot -// returns -- an empty list rather than an error. +// returns -- an empty list rather than an error. It also always carries our own +// command line, since a process can always open itself -- an empty one there is +// the host-wide-refusal signal, not a fixture detail. type NativeRow = { pid: number ppid: number @@ -31,7 +37,7 @@ type NativeRow = { creationTimeMs?: number } -const SELF: NativeRow = { pid: process.pid, ppid: 0, name: 'vitest.exe' } +const SELF: NativeRow = { pid: process.pid, ppid: 0, name: 'vitest.exe', commandLine: 'vitest.exe --run' } const NATIVE: NativeRow[] = [ SELF, { @@ -152,7 +158,7 @@ describe('windows process table', () => { it('maps native rows, defaulting an unreadable command line to empty', async () => { const rows = await readWindowsProcessTableFresh() expect(rows).toEqual([ - { pid: process.pid, ppid: 0, name: 'vitest.exe', command: '' }, + { pid: process.pid, ppid: 0, name: 'vitest.exe', command: 'vitest.exe --run' }, { pid: 100, ppid: 4, @@ -625,6 +631,7 @@ describe('resolving the native reader', () => { let platform: PropertyDescriptor | undefined const PACKAGE_SPECIFIER = '@vscode/windows-process-tree' const ADDON_SPECIFIER = './windows-process-tree.node' + const stagedAddonDirs: string[] = [] beforeEach(() => { platform = Object.getOwnPropertyDescriptor(process, 'platform') @@ -634,6 +641,9 @@ describe('resolving the native reader', () => { afterEach(() => { __setWindowsProcessTreeRequireForTests() __setWindowsProcessTableCimScanForTests() + for (const dir of stagedAddonDirs.splice(0)) { + rmSync(dir, { recursive: true, force: true }) + } if (platform) { Object.defineProperty(process, 'platform', platform) } @@ -668,7 +678,7 @@ describe('resolving the native reader', () => { }) const rows = await readWindowsProcessTableFresh() expect(rows).toEqual([ - { pid: process.pid, ppid: 0, name: 'vitest.exe', command: '' }, + { pid: process.pid, ppid: 0, name: 'vitest.exe', command: 'vitest.exe --run' }, { pid: 100, ppid: 4, @@ -743,6 +753,64 @@ describe('resolving the native reader', () => { expect(cimScan).toHaveBeenCalledTimes(1) }) + // A relay bundle and the addon staged beside it redeploy independently, so a + // host that never took a new bundle can still be loading the published + // prebuilt -- which binds fine and then walks every process's address space. + // The relay build asserts the symbol is absent; nothing did at load. + function withStagedAddonBinary( + bytes: string, + addon: unknown + ): ((specifier: string) => unknown) & { resolve: (specifier: string) => string } { + const dir = mkdtempSync(join(tmpdir(), 'orca-relay-addon-')) + const addonPath = join(dir, 'windows-process-tree.node') + writeFileSync(addonPath, bytes) + stagedAddonDirs.push(dir) + const resolve = (specifier: string): unknown => { + if (specifier === ADDON_SPECIFIER) { + return addon + } + throw new Error('MODULE_NOT_FOUND') + } + resolve.resolve = (specifier: string): string => { + if (specifier === ADDON_SPECIFIER) { + return addonPath + } + throw new Error('MODULE_NOT_FOUND') + } + return resolve + } + + it('refuses a staged relay addon still built from unpatched source', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const cimScan = vi + .fn() + .mockResolvedValue([ + { pid: process.pid, ppid: 0, name: 'node.exe', command: 'node relay.js' } + ]) + __setWindowsProcessTableCimScanForTests(cimScan) + const addon = addonReturning(NATIVE) + __setWindowsProcessTreeRequireForTests( + withStagedAddonBinary('MZ\0KERNEL32.dll\0ReadProcessMemory\0', addon) + ) + + await expect(readWindowsProcessTableFresh()).resolves.toHaveLength(1) + expect(addon.getProcessList).not.toHaveBeenCalled() + expect(cimScan).toHaveBeenCalledTimes(1) + expect(isWindowsProcessTableAvailable()).toBe(false) + expect(warn.mock.calls[0]?.[0]).toContain('ReadProcessMemory') + warn.mockRestore() + }) + + it('binds a staged relay addon whose binary carries no such import', async () => { + const addon = addonReturning(NATIVE) + __setWindowsProcessTreeRequireForTests( + withStagedAddonBinary('MZ\0ntdll.dll\0NtQueryInformationProcess\0', addon) + ) + + await expect(readWindowsProcessTableFresh()).resolves.toHaveLength(2) + expect(addon.getProcessList).toHaveBeenCalledTimes(1) + }) + it('never probes either specifier off Windows', async () => { Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' }) const resolve = vi.fn() @@ -751,3 +819,56 @@ describe('resolving the native reader', () => { expect(resolve).not.toHaveBeenCalled() }) }) + +// The cliff the removed PEB fallback leaves behind: a hooked ntdll that refuses +// class 60 empties every command line, and the addon still loads and still +// enumerates, so every health check the app has stays green. +describe('warning when command-line recovery is refused host-wide', () => { + let platform: PropertyDescriptor | undefined + let warn: ReturnType + + beforeEach(() => { + platform = Object.getOwnPropertyDescriptor(process, 'platform') + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + resetWindowsCommandLineRecoveryHealthForTests() + warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + }) + + afterEach(() => { + __setWindowsProcessTreeLoaderForTests() + warn.mockRestore() + if (platform) { + Object.defineProperty(process, 'platform', platform) + } + }) + + type NativeRow = { pid: number; ppid: number; name: string; commandLine?: string } + + function loaderReturning(rows: NativeRow[], commandLineFlag: number): void { + __setWindowsProcessTreeLoaderForTests(() => ({ + ProcessDataFlag: { None: 0, Memory: 1, CommandLine: commandLineFlag, CreationTime: 4 }, + getAllProcesses: (cb: (r: NativeRow[] | undefined) => void) => cb(rows) + })) + } + + it('warns once when our own row comes back with no command line', async () => { + loaderReturning([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }], 2) + await readWindowsProcessTableFresh() + await readWindowsProcessTableFresh() + expect(warn).toHaveBeenCalledTimes(1) + expect(warn.mock.calls[0][0]).toContain('ProcessCommandLineInformation') + }) + + it('stays quiet when our own command line came back', async () => { + loaderReturning(NATIVE, 2) + await readWindowsProcessTableFresh() + expect(warn).not.toHaveBeenCalled() + }) + + it('stays quiet when the read never asked for a command line', async () => { + // A reader that requests identity fields only must not read as a refusal. + loaderReturning([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }], 0) + await readWindowsProcessTableFresh() + expect(warn).not.toHaveBeenCalled() + }) +}) diff --git a/src/main/windows/windows-process-table.ts b/src/main/windows/windows-process-table.ts index 94c8dd3ed61..0a1acd7ae1c 100644 --- a/src/main/windows/windows-process-table.ts +++ b/src/main/windows/windows-process-table.ts @@ -1,5 +1,7 @@ +import { readFileSync } from 'node:fs' import { createRequire } from 'node:module' import { createProcessTableSnapshotReader } from '../../shared/process-table-snapshot-reader' +import { reportWindowsCommandLineRecoveryHealth } from './windows-command-line-recovery-health' import { readWindowsProcessRowsWithCim } from './windows-process-table-cim-scan' /** @@ -33,6 +35,10 @@ import { readWindowsProcessRowsWithCim } from './windows-process-table-cim-scan' * OpenProcess(...|VM_READ) it never read through. CommandLine's own read is no * longer a PEB walk either -- the patched addon asks the kernel, so identity is * now the only flag set that opens nothing at all. + * + * All Toolhelp32 rows assume the optional `windows-process-tree.node` addon. + * The desktop bundles it; no released relay carries it, so on an SSH host the + * CIM row is the operative number and the child process is not avoided at all. */ /** Everything a Toolhelp32 walk alone can answer. */ @@ -72,10 +78,15 @@ type WindowsProcessTreeModule = { const requireFromMain = createRequire(__filename) +/** `resolve` is optional so a test can inject a bare function for the require alone. */ +type NativeRequire = ((specifier: string) => unknown) & { + resolve?: (specifier: string) => string +} + // Why injectable: `createRequire` bypasses the module mocker, and the two // resolution steps below are the exact thing #15749 shipped untested -- the // relay suites replaced the loader wholesale, so nothing exercised the require. -let requireNative: (specifier: string) => unknown = requireFromMain +let requireNative: NativeRequire = requireFromMain /** * The bare addon a relay host receives, with no npm package around it. @@ -105,6 +116,42 @@ const PROCESS_DATA_FLAG = { None: 0, Memory: 1, CommandLine: 2 } as const /** Staged beside the relay bundle by build-relay; see RELAY_ARTIFACTS. */ const RELAY_ADDON_FILENAME = './windows-process-tree.node' +/** The import whose absence tells the patched binary from the published prebuilt. */ +const FLAGGED_ADDON_IMPORT = 'ReadProcessMemory' + +/** + * Refuse a staged relay addon built from unpatched source. + * + * The build asserts this on the artifact it produces, but a relay bundle and the + * addon beside it are redeployed independently: a host that has not taken a new + * bundle keeps whatever `.node` is already there, and the published prebuilt is + * node-addon-api, so it binds cleanly and then opens every process with + * `PROCESS_VM_READ` to walk its PEB -- the primitive MDE scores as credential + * dumping. Nothing checked that at load until here. + * + * Same predicate as `inspectWindowsProcessTreeAddon` in + * `config/scripts/windows-process-tree-gyp-rebuild.mjs`, which cannot be + * imported here: it is install-time tooling that pulls in node-gyp and + * `child_process`, and this module is bundled into the app and the relay. + * + * Falling back to the CIM scan is the correct loss: it is slower, and it is not + * the thing an EDR quarantines the host for. + */ +function stagedRelayAddonIsUnpatched(): boolean { + // No resolver means an injected test double, so there is no file to inspect. + // Production always has one, and a require that just succeeded proves the + // path is readable -- "cannot tell" here is never a real deployment. + const addonPath = requireNative.resolve?.(RELAY_ADDON_FILENAME) + if (!addonPath) { + return false + } + try { + return readFileSync(addonPath).includes(FLAGGED_ADDON_IMPORT) + } catch { + return false + } +} + let cachedModule: WindowsProcessTreeModule | null | undefined let moduleLoader: () => WindowsProcessTreeModule | null = loadWindowsProcessTree let cimScan: () => Promise = readWindowsProcessRowsWithCim @@ -149,8 +196,22 @@ function loadWindowsProcessTree(): WindowsProcessTreeModule | null { // Why check the shape: a truncated upload or an addon built for another // arch can load and still not answer. Binding to it would then reject every // read forever, where falling through reaches a scan that works. - cachedModule = - typeof addon?.getProcessList === 'function' ? adaptAddon(addon) : /* v8 ignore next */ null + if (typeof addon?.getProcessList !== 'function') { + /* v8 ignore next 2 */ + cachedModule = null + return cachedModule + } + if (stagedRelayAddonIsUnpatched()) { + console.warn( + `[windows-process-table] the addon staged beside the relay bundle still imports ` + + `${FLAGGED_ADDON_IMPORT}, so it was built from unpatched source and reads every ` + + 'process address space. Refusing it and falling back to the CIM scan; redeploy the ' + + 'relay so the staged addon is rebuilt.' + ) + cachedModule = null + return cachedModule + } + cachedModule = adaptAddon(addon) } catch { cachedModule = null } @@ -339,6 +400,10 @@ function readOneSnapshot(projection: ProcessRowProjection): Promise unknown -): void { +/** + * Test-only: substitute the require that resolves the package and the addon. + * + * Attach a `resolve` to the injected function to also exercise the staged-addon + * binary check; without one, the loader has no path to inspect. + */ +export function __setWindowsProcessTreeRequireForTests(resolve?: NativeRequire): void { requireNative = resolve ?? requireFromMain moduleLoader = loadWindowsProcessTree cachedModule = undefined diff --git a/src/main/windows/windows-process-tree-command-line-patch.test.ts b/src/main/windows/windows-process-tree-command-line-patch.test.ts new file mode 100644 index 00000000000..1eaa4459c9e --- /dev/null +++ b/src/main/windows/windows-process-tree-command-line-patch.test.ts @@ -0,0 +1,188 @@ +import { spawn } from 'node:child_process' +import { readFileSync } from 'node:fs' +import { createRequire } from 'node:module' +import { join, resolve } from 'node:path' +import { afterAll, beforeAll, describe, expect, it } from 'vitest' + +/** + * The command-line reader is a patch, not repo source, so its contract is + * asserted against the patch's post-image. MDE scored the addon for + * `OpenProcess(PROCESS_VM_READ)` + `ReadProcessMemory` over the whole process + * table on a timer; these cases exist so a patch refresh cannot quietly restore + * that primitive. + */ +const PATCH_PATH = resolve( + import.meta.dirname, + '../../../config/patches/@vscode__windows-process-tree@0.8.0.patch' +) + +/** Reconstruct a file as the patch leaves it: context plus added lines. */ +function patchedFile(patch: string, path: string): string { + const lines = patch.split('\n') + const start = lines.findIndex((line) => line.startsWith(`diff --git a/${path} `)) + if (start === -1) { + throw new Error(`${path} is not in the patch`) + } + const rest = lines.slice(start + 1) + const end = rest.findIndex((line) => line.startsWith('diff --git ')) + return ( + (end === -1 ? rest : rest.slice(0, end)) + // A context line for an empty source line is a bare space, and unified + // diffs may drop even that, so an empty string is context too. + .filter((line) => line === '' || line.startsWith(' ') || line.startsWith('+')) + .filter((line) => !line.startsWith('+++') && !line.startsWith('@@')) + .map((line) => line.slice(1)) + .join('\n') + ) +} + +const patch = readFileSync(PATCH_PATH, 'utf8') +const commandLineSource = patchedFile(patch, 'src/process_commandline.cc') +const processSource = patchedFile(patch, 'src/process.cc') + +describe('windows-process-tree command line patch', () => { + it('reads the command line through ProcessCommandLineInformation', () => { + // Class 60 is Windows 8.1+; Electron's floor is Windows 10, so every OS + // Orca supports has it. + expect(commandLineSource).toContain('kProcessCommandLineInformation = 60') + expect(commandLineSource).toContain('OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION') + }) + + it('resolves NtQueryInformationProcess dynamically rather than linking it', () => { + expect(commandLineSource).toContain('GetModuleHandleW(L"ntdll.dll")') + expect(commandLineSource).toContain('GetProcAddress(ntdll, "NtQueryInformationProcess")') + }) + + it('probes the buffer size before allocating, and caps it', () => { + // STATUS_INFO_LENGTH_MISMATCH / STATUS_BUFFER_TOO_SMALL carry the size. + expect(commandLineSource).toContain( + 'kStatusInfoLengthMismatch = static_cast(0xC0000004L)' + ) + expect(commandLineSource).toContain( + 'kStatusBufferTooSmall = static_cast(0xC0000023L)' + ) + expect(commandLineSource).toMatch( + /query\(process, kProcessCommandLineInformation, nullptr, 0, &size\)/ + ) + // UNICODE_STRING::Length is a USHORT, so a bogus size must not become a + // bad_alloc that fails the whole scan. + expect(commandLineSource).toContain('size > kMaxCommandLineBytes') + }) + + it('treats the returned UNICODE_STRING as untrusted', () => { + // A hooked ntdll is the environment this reader targets, so an unchecked + // Buffer/Length would be an over-read encoded straight into JS. The bound + // must be buffer.size(), not `size`, which the second query overwrites. + expect(commandLineSource).toContain('const unsigned char* end = begin + buffer.size()') + expect(commandLineSource).toMatch(/chars == nullptr \|\|/) + expect(commandLineSource).toMatch(/command_line->Length > static_cast\(end - chars\)/) + }) + + it('has no PEB fallback and no latch that could reinstate one', () => { + // The fallback used to be reachable from any single anomalous NTSTATUS, + // which on an EDR-hooked ntdll is the realistic case -- one stray status + // would have silently restored the primitive for the process lifetime. + expect(commandLineSource).not.toContain('ReadCommandLineFromPeb') + expect(commandLineSource).not.toContain('PROCESS_BASIC_INFORMATION') + expect(commandLineSource).not.toContain('InterlockedExchange') + expect(commandLineSource).not.toMatch(/ReadProcessMemory\(/) + }) + + it('acquires PROCESS_VM_READ nowhere in the addon', () => { + for (const source of [commandLineSource, processSource]) { + expect(source).not.toMatch(/OpenProcess\([^)]*PROCESS_VM_READ/) + expect(source).not.toMatch(/ReadProcessMemory\(/) + } + // Memory and CPU counters kept VM_READ and never read an address space. + expect(processSource.match(/OpenProcess\(PROCESS_QUERY_LIMITED_INFORMATION/g)).toHaveLength(2) + }) + + it('value-initializes ProcessInfo so memory is not stack garbage', () => { + // Measured before: 82 processes reported the same bogus working set. + expect(processSource).toContain('ProcessInfo pinfo{};') + }) +}) + +type Addon = { + getProcessList: ( + callback: (rows: { pid: number; commandLine?: string }[] | undefined) => void, + flags: number + ) => void +} + +const addonRequire = createRequire(import.meta.url) + +function loadAddon(): Addon { + const packageEntry = addonRequire.resolve('@vscode/windows-process-tree') + return addonRequire( + join(packageEntry, '..', '..', 'build', 'Release', 'windows_process_tree.node') + ) as Addon +} + +// Why fail rather than skip on win32: the published tarball ships a loadable +// prebuilt built from unpatched source, and both readers emit byte-identical +// strings, so a skipping suite would pass against the very binary this patch +// exists to keep out. On win32 the addon must be present, and it must be ours. +describe.runIf(process.platform === 'win32')('windows-process-tree command line addon', () => { + // Why not at collection time: a require that throws there fails the whole + // file, and the patch-text cases above need no binary at all -- a Windows + // checkout without a built addon would lose them to an unrelated failure. + let addon: Addon + beforeAll(() => { + addon = loadAddon() + }) + const children: { kill: () => void }[] = [] + afterAll(() => { + for (const child of children) { + try { + child.kill() + } catch { + // already gone + } + } + }) + + const scan = async (): Promise> => + new Promise((resolveScan) => { + addon.getProcessList((rows) => { + resolveScan(new Map((rows ?? []).map((row) => [row.pid, row.commandLine ?? '']))) + }, 2 /* ProcessDataFlag.CommandLine */) + }) + + it('was built from the patched source, not the published prebuild', () => { + // The patched reader never calls ReadProcessMemory, so the symbol is + // absent from its import table. This is the only check that tells the two + // binaries apart -- a bare require() cannot. + const packageEntry = addonRequire.resolve('@vscode/windows-process-tree') + const binary = readFileSync( + join(packageEntry, '..', '..', 'build', 'Release', 'windows_process_tree.node') + ) + expect(binary.includes('ReadProcessMemory')).toBe(false) + }) + + it('recovers command lines byte-for-byte, quoting and trailing spaces included', async () => { + const marker = `orca-cmdline-${Date.now()}` + // Quotes and trailing whitespace are exactly what a re-quoting bug eats. + const child = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 20000)', `"${marker}" `], { + windowsHide: true, + stdio: 'ignore' + }) + children.push(child) + await new Promise((r) => setTimeout(r, 400)) + + const rows = await scan() + const command = rows.get(child.pid!) + expect(command).toBeDefined() + expect(command).toContain(marker) + expect(command!.endsWith(' "') || command!.endsWith(' ')).toBe(true) + }) + + it('reports the querying process and most of the table', async () => { + const rows = await scan() + expect(rows.has(process.pid)).toBe(true) + const recovered = [...rows.values()].filter((command) => command.length > 0) + // Protected and cross-session processes legitimately deny a handle; a + // wholesale regression would show up as almost nothing recovered. + expect(recovered.length).toBeGreaterThan(rows.size * 0.25) + }) +}) diff --git a/src/relay/windows-port-scan.test.ts b/src/relay/windows-port-scan.test.ts index 139d3ede6be..9fb074180b9 100644 --- a/src/relay/windows-port-scan.test.ts +++ b/src/relay/windows-port-scan.test.ts @@ -1,22 +1,30 @@ -import { beforeEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' -const { execFileAsyncMock, execFileMock, promisifyCustom } = vi.hoisted(() => ({ - execFileAsyncMock: vi.fn(), - execFileMock: vi.fn(), - promisifyCustom: Symbol.for('nodejs.util.promisify.custom') -})) - -vi.mock('child_process', () => ({ - execFile: Object.assign(execFileMock, { - [promisifyCustom]: execFileAsyncMock - }) +const runProcessMock = vi.fn() +vi.mock('../shared/child-process/run-process', () => ({ + runProcess: (spec: unknown) => runProcessMock(spec) })) vi.mock('./relay-command-env', () => ({ buildRelayCommandEnv: () => ({ PATH: 'C:\\Windows\\System32' }) })) -const { scanWindowsListeningPorts } = await import('./windows-port-scan') +import { + __setWindowsProcessTableCimScanForTests, + __setWindowsProcessTreeLoaderForTests, + resetWindowsProcessTableForTests +} from '../main/windows/windows-process-table' +import { + resetWindowsPortScanDiagnosticsForTests, + scanWindowsListeningPorts +} from './windows-port-scan' + +type Spec = { + program: string + args?: readonly string[] + timeoutMs?: number | null + signal?: AbortSignal +} // The scanner drops any row whose pid is the relay process or its parent, so a fixture pid // that happens to match the vitest worker's own pid silently empties the result and the @@ -32,78 +40,365 @@ function pidUnlikeSelf(seed: number): number { return pid } -const POWERSHELL_PID = pidUnlikeSelf(1234) const NETSTAT_PID = pidUnlikeSelf(2468) +const SSHD_PID = pidUnlikeSelf(4321) +const POWERSHELL_PID = pidUnlikeSelf(1234) + +const NETSTAT_STDOUT = [ + ' Proto Local Address Foreign Address State PID', + ` TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING ${NETSTAT_PID}`, + ` TCP [::]:3000 [::]:0 LISTENING ${NETSTAT_PID}`, + ` TCP 0.0.0.0:4000 93.184.216.34:443 ESTABLISHED ${NETSTAT_PID}`, + ` UDP 0.0.0.0:5353 *:* ${NETSTAT_PID}`, + ` TCP 0.0.0.0:2222 0.0.0.0:0 LISTENING ${SSHD_PID}` +].join('\r\n') + +function ok(stdout: string): { + code: number + signal: null + stdout: string + stderr: string + timedOut: boolean +} { + return { code: 0, signal: null, stdout, stderr: '', timedOut: false } +} + +type NativeRow = { + pid: number + ppid: number + name: string + memory?: number + commandLine?: string + creationTimeMs?: number +} + +/** A native snapshot must contain the reader's own pid or the table rejects. */ +function nativeTable(rows: NativeRow[]) { + return () => ({ + ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 }, + getAllProcesses: (callback: (processes: NativeRow[] | undefined) => void) => + callback([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }, ...rows]) + }) +} + +function specs(): Spec[] { + return runProcessMock.mock.calls.map((call) => call[0] as Spec) +} describe('scanWindowsListeningPorts', () => { beforeEach(() => { - execFileAsyncMock.mockReset() + runProcessMock.mockReset() + resetWindowsPortScanDiagnosticsForTests() + resetWindowsProcessTableForTests() + __setWindowsProcessTreeLoaderForTests( + nativeTable([ + { pid: NETSTAT_PID, ppid: 4, name: 'node.exe' }, + { pid: SSHD_PID, ppid: 4, name: 'sshd.exe' } + ]) + ) }) - it('bounds the PowerShell scan with the caller abort signal and timeout', async () => { + afterEach(() => { + __setWindowsProcessTreeLoaderForTests() + __setWindowsProcessTableCimScanForTests() + resetWindowsProcessTableForTests() + }) + + it('reads netstat first and never starts PowerShell', async () => { const controller = new AbortController() - execFileAsyncMock.mockResolvedValueOnce({ - stdout: JSON.stringify({ + runProcessMock.mockResolvedValueOnce(ok(NETSTAT_STDOUT)) + + await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([ + { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' }, + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' } + ]) + + expect(specs()).toHaveLength(1) + expect(specs()[0].program).toMatch(/netstat\.exe$/) + // `-p tcp` is absent on purpose: on Windows it means IPv4-only and would + // hide every `[::]` listener. + expect(specs()[0].args).toEqual(['-ano']) + expect(specs()[0].signal).toBe(controller.signal) + expect(specs()[0].timeoutMs).toBe(5000) + }) + + it('keeps the sshd and self-pid filters working off native process names', async () => { + runProcessMock.mockResolvedValueOnce( + ok( + [ + NETSTAT_STDOUT, + ` TCP 0.0.0.0:9999 0.0.0.0:0 LISTENING ${process.pid}` + ].join('\r\n') + ) + ) + + const ports = await scanWindowsListeningPorts() + + // sshd.exe is matched despite the table's `.exe` spelling, and the relay's + // own listener never reaches a client. + expect(ports.map((port) => `${port.host}:${port.port}`)).toEqual([':::3000', '0.0.0.0:3000']) + }) + + it('still reports host/port/pid when no process table is readable', async () => { + runProcessMock.mockResolvedValueOnce(ok(NETSTAT_STDOUT)) + __setWindowsProcessTreeLoaderForTests(() => null) + __setWindowsProcessTableCimScanForTests(() => + Promise.reject(new Error('windows process table unavailable')) + ) + resetWindowsProcessTableForTests() + + await expect(scanWindowsListeningPorts()).resolves.toEqual([ + { host: '0.0.0.0', port: 2222, pid: SSHD_PID }, + { host: '::', port: 3000, pid: NETSTAT_PID }, + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID } + ]) + // Names were unavailable, so nothing else was spawned to go get them. + expect(specs()).toHaveLength(1) + }) + + it('falls back to PowerShell without an execution-policy override', async () => { + const controller = new AbortController() + runProcessMock + .mockResolvedValueOnce({ + code: 1, + signal: null, + stdout: '', + stderr: 'blocked', + timedOut: false + }) + .mockResolvedValueOnce( + ok( + JSON.stringify({ + host: '127.0.0.1', + port: 5173, + pid: POWERSHELL_PID, + processName: 'node' + }) + ) + ) + + await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([ + { host: '127.0.0.1', port: 5173, pid: POWERSHELL_PID, processName: 'node' - }), - stderr: '' - }) - - await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([ - { host: '127.0.0.1', port: 5173, pid: POWERSHELL_PID, processName: 'node' } + } ]) - expect(execFileAsyncMock).toHaveBeenCalledWith( - 'powershell.exe', - expect.arrayContaining(['-EncodedCommand', expect.any(String)]), - expect.objectContaining({ - signal: controller.signal, - timeout: 5000, - windowsHide: true - }) - ) + const powershell = specs()[1] + expect(powershell.program).toMatch(/powershell\.exe$/i) + expect(powershell.args?.slice(0, 3)).toEqual(['-NoProfile', '-NonInteractive', '-Command']) + expect(powershell.args).not.toContain('-ExecutionPolicy') + expect(powershell.args).not.toContain('-EncodedCommand') + expect(powershell.args).toHaveLength(4) + expect(powershell.args?.[3]).toContain('Get-NetTCPConnection') + expect(powershell.signal).toBe(controller.signal) + expect(powershell.timeoutMs).toBe(5000) }) - it('bounds the netstat fallback with the same abort signal and timeout', async () => { - const controller = new AbortController() - execFileAsyncMock + it('tries pwsh when Windows PowerShell cannot answer, then gives up empty', async () => { + runProcessMock + .mockResolvedValueOnce(ok('')) .mockRejectedValueOnce(new Error('powershell unavailable')) .mockRejectedValueOnce(new Error('pwsh unavailable')) - .mockResolvedValueOnce({ - stdout: [ - ' Proto Local Address Foreign Address State PID', - ` TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING ${NETSTAT_PID}` - ].join('\r\n'), - stderr: '' - }) - await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([ - { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID } + await expect(scanWindowsListeningPorts()).resolves.toEqual([]) + + expect(specs().map((spec) => spec.program)).toEqual([ + expect.stringMatching(/netstat\.exe$/), + expect.stringMatching(/powershell\.exe$/i), + 'pwsh.exe' ]) - - expect(execFileAsyncMock).toHaveBeenLastCalledWith( - 'netstat.exe', - ['-ano', '-p', 'tcp'], - expect.objectContaining({ - signal: controller.signal, - timeout: 5000, - windowsHide: true - }) - ) }) - it('does not start the netstat fallback after the scan is cancelled', async () => { + it('gives up rather than falling back once the scan is cancelled', async () => { const controller = new AbortController() controller.abort() - execFileAsyncMock.mockRejectedValueOnce( - Object.assign(new Error('cancelled'), { name: 'AbortError' }) - ) + runProcessMock.mockResolvedValueOnce({ + code: null, + signal: null, + stdout: '', + stderr: '', + timedOut: false + }) await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([]) - expect(execFileAsyncMock).toHaveBeenCalledTimes(1) + expect(runProcessMock).toHaveBeenCalledTimes(1) + }) + + // `LISTENING` ships in netstat.exe.mui, picked by UI language, so no env can + // pin it. Without the shape-based re-read a German host parses zero rows, + // reads that as a blocked reader, and runs the flagged payload every 12-30s. + it('reads a localized host by socket shape rather than the state word', async () => { + runProcessMock.mockResolvedValueOnce( + ok( + [ + 'Aktive Verbindungen', + '', + ' Proto Lokale Adresse Remoteadresse Status PID', + ' TCP 0.0.0.0:135 0.0.0.0:0 ABHÖREN 1116', + ` TCP 0.0.0.0:3000 0.0.0.0:0 ABHÖREN ${NETSTAT_PID}`, + ` TCP [::]:3000 [::]:0 ABHÖREN ${NETSTAT_PID}`, + ` TCP 192.168.0.5:52000 93.184.216.34:443 HERGESTELLT ${NETSTAT_PID}` + ].join('\r\n') + ) + ) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([ + { host: '0.0.0.0', port: 135, pid: 1116 }, + { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' }, + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' } + ]) + expect(specs()).toHaveLength(1) + }) + + // The gap the state-word cases cannot cover: on a localized host BOUND is as + // unreadable as ABHÖREN, so shape alone would publish 8080 as a listener. + // Listeners dominate, and that is what separates them. + it('drops a BOUND socket that shape alone would promote on a localized host', async () => { + runProcessMock.mockResolvedValueOnce( + ok( + [ + ` TCP 0.0.0.0:3000 0.0.0.0:0 ABHÖREN ${NETSTAT_PID}`, + ` TCP [::]:3000 [::]:0 ABHÖREN ${NETSTAT_PID}`, + ` TCP 0.0.0.0:8080 0.0.0.0:0 GEBUNDEN ${NETSTAT_PID}`, + ` TCP 192.168.0.5:52000 93.184.216.34:443 HERGESTELLT ${NETSTAT_PID}` + ].join('\r\n') + ) + ) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([ + { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' }, + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' } + ]) + }) + + // Only on an exact tie does shape have nothing left to go on, and then it + // keeps both rather than guessing — no worse than reading shape alone. + it('keeps every tied zero-peer state when none dominates', async () => { + runProcessMock.mockResolvedValueOnce( + ok( + [ + ` TCP 0.0.0.0:3000 0.0.0.0:0 ABHÖREN ${NETSTAT_PID}`, + ` TCP 0.0.0.0:8080 0.0.0.0:0 GEBUNDEN ${NETSTAT_PID}` + ].join('\r\n') + ) + ) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([ + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' }, + { host: '0.0.0.0', port: 8080, pid: NETSTAT_PID, processName: 'node' } + ]) + }) + + // Windows prints BOUND with a zero peer too, so the shape test must stay the + // fallback: a host with at least one readable LISTENING row never reaches it. + it('does not promote a BOUND socket on a host whose state word parsed', async () => { + runProcessMock.mockResolvedValueOnce( + ok( + [ + ` TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING ${NETSTAT_PID}`, + ` TCP 0.0.0.0:8080 0.0.0.0:0 BOUND ${NETSTAT_PID}` + ].join('\r\n') + ) + ) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([ + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' } + ]) + }) + + // A capped read exits 0 and its head parses, and netstat orders IPv4 TCP + // before IPv6 TCP, so publishing the head would drop every `[::]` listener. + it('refuses a netstat table that hit the capture cap', async () => { + const filler = Array.from( + { length: 60_000 }, + (_, index) => + ` TCP 10.0.0.1:${1000 + (index % 5000)} 10.0.0.2:443 TIME_WAIT 4` + ).join('\r\n') + runProcessMock + .mockResolvedValueOnce(ok(`${NETSTAT_STDOUT}\r\n${filler}`.slice(0, 4 * 1024 * 1024))) + .mockResolvedValueOnce(ok('[]')) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([]) + + // Fell through instead of publishing the IPv4 head it could still parse. + expect(specs()).toHaveLength(2) + expect(specs()[1].args).toContain('-Command') + }) + + it('does not wait on the shared process table once the scan is cancelled', async () => { + const controller = new AbortController() + const getAllProcesses = vi.fn() + __setWindowsProcessTreeLoaderForTests(() => ({ + ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 }, + getAllProcesses + })) + resetWindowsProcessTableForTests() + // netstat answered, then the request was abandoned before names were needed. + runProcessMock.mockImplementationOnce(() => { + controller.abort() + return Promise.resolve(ok(NETSTAT_STDOUT)) + }) + + await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([ + // Unnamed, so the sshd row survives its own filter — the cost of not + // waiting, and strictly better than blocking an abandoned request. + { host: '0.0.0.0', port: 2222, pid: SSHD_PID }, + { host: '::', port: 3000, pid: NETSTAT_PID }, + { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID } + ]) + expect(getAllProcesses).not.toHaveBeenCalled() + }) + + // The relay daemon's stderr is what installRelayLogRotation routes into + // relay.log, so a fall-through logged anywhere else is a fall-through nobody + // can diagnose. Pin the stream, not just the fact that something was called. + it('reports leaving the native path on the relay diagnostic stream, once', async () => { + const lines: string[] = [] + const stderr = vi + .spyOn(process.stderr, 'write') + .mockImplementation((chunk: string | Uint8Array) => { + lines.push(String(chunk)) + return true + }) + try { + runProcessMock.mockResolvedValue(ok('')) + await scanWindowsListeningPorts() + await scanWindowsListeningPorts() + // A second, different fault on the same host must still be heard: one + // flag for the whole module would have swallowed it. + runProcessMock.mockResolvedValue(ok('x'.repeat(4 * 1024 * 1024))) + await scanWindowsListeningPorts() + await scanWindowsListeningPorts() + } finally { + stderr.mockRestore() + } + + const reported = lines.filter((line) => line.includes('[ports] netstat unusable')) + expect(reported).toHaveLength(2) + expect(reported[0]).toContain('no listening row parsed') + expect(reported[1]).toContain('truncated') + // relayLogLine's ISO stamp: an unplaceable line cannot be read against the + // reconnect flaps around it. + expect(reported[0]).toMatch(/^\d{4}-\d{2}-\d{2}T[\d:.]+Z /) + }) + + it('treats a netstat timeout as unanswered and falls through', async () => { + runProcessMock + .mockResolvedValueOnce({ + code: null, + signal: 'SIGKILL', + stdout: '', + stderr: '', + timedOut: true + }) + .mockResolvedValueOnce(ok('[]')) + + await expect(scanWindowsListeningPorts()).resolves.toEqual([]) + + expect(specs()).toHaveLength(2) }) }) diff --git a/src/relay/windows-port-scan.ts b/src/relay/windows-port-scan.ts index f26a2bb172a..f99fce4a087 100644 --- a/src/relay/windows-port-scan.ts +++ b/src/relay/windows-port-scan.ts @@ -1,84 +1,231 @@ -import { execFile } from 'node:child_process' -import { promisify } from 'node:util' +import { readWindowsProcessTable } from '../main/windows/windows-process-table' +import { runProcess } from '../shared/child-process/run-process' +import { + windowsPowerShellPath, + windowsSystem32Binary +} from '../shared/child-process/windows-system-binary' import { getProcessOutputFields } from '../shared/process-output-field-scanner' -import { encodePowerShellCommand } from '../shared/powershell-command-encoding' import type { DetectedPort } from './port-scan-handler' import { buildRelayCommandEnv } from './relay-command-env' +import { relayLogLine } from './relay-diagnostic-log' const SYSTEM_PORTS_TO_EXCLUDE = new Set([22]) const MAX_DETECTED_PORTS = 50 const WINDOWS_PORT_SCAN_TIMEOUT_MS = 5_000 -const execFileAsync = promisify(execFile) +// Wide enough for `netstat -ano` on a busy host: it prints every connection, not +// just the listeners, and a truncated table silently drops the tail. +const WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES = 4 * 1024 * 1024 +/** + * Listening TCP ports, attributed to their owning process. + * + * `netstat.exe -ano` answers all of it except the process name, which comes + * from the shared process table -- so this scan starts no PowerShell of its + * own. One still runs on a released relay: without the optional + * `windows-process-tree.node` addon (built only by dev-channel-win-build.yml, + * so no release carries it) that table falls back to a CIM scan that forks one + * `powershell.exe`. That scan is TTL-shared with pane naming, so a relay with a + * live pane pays nothing extra for it. + * + * The EDR win is therefore the shape, not the absence of PowerShell. The + * retired payload ran `-ExecutionPolicy Bypass -EncodedCommand ` + * wrapping `Get-NetTCPConnection` joined to `Get-Process`: base64 beside a + * policy override is the highest-weighted token pair Defender for Endpoint + * scores on a PowerShell command line, and listing listeners with their owners + * reads as network discovery (T1049) on top of it. The shared CIM scan carries + * neither token. That payload survives only as the last resort below, without + * the override. + */ export async function scanWindowsListeningPorts(signal?: AbortSignal): Promise { + const netstatPorts = await readWindowsNetstatPorts(signal) + if (netstatPorts) { + return normalizeWindowsDetectedPorts(await attachWindowsProcessNames(netstatPorts, signal)) + } + if (signal?.aborted) { + return [] + } try { const json = await runWindowsPortScanPowerShell(signal) return normalizeWindowsDetectedPorts(parseWindowsPowerShellPortRows(json)) } catch { - if (signal?.aborted) { - return [] - } - try { - const { stdout } = await execFileAsync('netstat.exe', ['-ano', '-p', 'tcp'], { - env: buildRelayCommandEnv(), - encoding: 'utf-8', - signal, - timeout: WINDOWS_PORT_SCAN_TIMEOUT_MS, - windowsHide: true - }) - return normalizeWindowsDetectedPorts(parseWindowsNetstatOutput(stdout)) - } catch { - return [] - } + return [] } } -async function runWindowsPortScanPowerShell(signal?: AbortSignal): Promise { - const script = [ - "$ErrorActionPreference = 'Stop'", - '$connections = Get-NetTCPConnection -State Listen -ErrorAction Stop', - '$items = foreach ($connection in $connections) {', - ' $name = $null', - ' try {', - ' $process = Get-Process -Id $connection.OwningProcess -ErrorAction Stop', - ' $name = $process.ProcessName', - ' } catch {}', - ' [pscustomobject]@{', - ' host = [string]$connection.LocalAddress', - ' port = [int]$connection.LocalPort', - ' pid = [int]$connection.OwningProcess', - ' processName = $name', - ' }', - '}', - '$items | ConvertTo-Json -Compress -Depth 3' - ].join('\n') - const encoded = encodePowerShellCommand(script) - const lastError: unknown[] = [] +/** Rows, or null when netstat could not answer and the fallback should run. */ +async function readWindowsNetstatPorts(signal?: AbortSignal): Promise { + let stdout: string + try { + const result = await runProcess({ + program: windowsSystem32Binary('netstat.exe'), + // No `-p tcp`: on Windows that protocol name means TCP over IPv4 only, so + // it hides every `[::]` listener the retired PowerShell payload reported. + args: ['-ano'], + env: buildRelayCommandEnv(), + timeoutMs: WINDOWS_PORT_SCAN_TIMEOUT_MS, + maxOutputBytes: WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES, + signal + }) + if (result.timedOut || result.code !== 0) { + return null + } + // A capped read still exits 0 and its head still parses, so nothing + // downstream can tell a partial table from a whole one. netstat prints IPv4 + // TCP, then IPv6 TCP, then UDP, so the rows lost first are exactly the + // `[::]` listeners that dropping `-p tcp` above exists to keep. Refuse the + // whole read rather than publish its head. + if (Buffer.byteLength(result.stdout) >= WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES) { + reportWindowsNetstatUnusable('output hit the capture cap and was truncated') + return null + } + stdout = result.stdout + } catch { + return null + } + const ports = parseWindowsNetstatOutput(stdout) + // Windows always has a listener (RPC endpoint mapper, SMB), so an exit-0 scan + // that parses to nothing is a reader that was blocked, not an idle host. + if (ports.length === 0) { + reportWindowsNetstatUnusable('exited 0 but no listening row parsed') + return null + } + return ports +} - for (const binary of ['powershell.exe', 'pwsh.exe']) { - try { - const { stdout } = await execFileAsync( - binary, - ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded], - { - env: buildRelayCommandEnv(), - encoding: 'utf-8', - maxBuffer: 1024 * 1024, - signal, - timeout: WINDOWS_PORT_SCAN_TIMEOUT_MS, - windowsHide: true - } +/** Reasons already reported. A fixed two-value vocabulary, so it cannot grow. */ +const reportedNetstatFailures = new Set() + +/** + * Say once why the scan left the native path. + * + * Both fall-throughs are permanent when they are wrong — the host stays on the + * PowerShell payload, or on nothing, for the life of the relay — and the scan + * repeats every 12-30s, so this logs one line rather than a stream. + * + * Through relayLogLine, not console.warn: this only ever runs in the detached + * daemon, whose stderr installRelayLogRotation routes into the relay.log that + * the remote-diagnostics tail reads. An untimestamped line in that file cannot + * be placed against the reconnect flaps around it (#7773), and "since when" is + * most of what this line is for. + */ +function reportWindowsNetstatUnusable(reason: string): void { + // Per reason, not per module: a host that parses nothing today and truncates + // tomorrow has two different faults, and one flag would hide the second. + if (reportedNetstatFailures.has(reason)) { + return + } + reportedNetstatFailures.add(reason) + relayLogLine(`[ports] netstat unusable on this host (${reason}); falling back to PowerShell`) +} + +/** Test-only: re-arm the one-shot so each case can observe its own line. */ +export function resetWindowsPortScanDiagnosticsForTests(): void { + reportedNetstatFailures.clear() +} + +/** + * Fill in owning-process names from the shared process-table snapshot. + * + * Names are optional data — the panel renders host/port/pid without them — so a + * host that cannot read the table keeps its rows. This shares whatever scan the + * table already runs rather than avoiding one, and on a relay that scan is a + * `powershell.exe` CIM query -- no released relay carries the native addon, so + * that is the path every SSH host takes, not a fallback. + * See docs/reference/windows-process-enumeration.md. + * + * Only `name` is read here, so this wants `readWindowsProcessIdentityTable` + * once #17866 lands -- on the detailed reader it would pay per-process handles + * for a field it discards. + * + * Best-effort by design: the snapshot is shared and TTL-cached, so it can + * predate netstat and hand a recycled PID its previous owner's name. Only + * labels read this field, and a fresh read would cost every caller a scan. + */ +async function attachWindowsProcessNames( + ports: DetectedPort[], + signal?: AbortSignal +): Promise { + const pids = new Set(ports.flatMap((port) => (port.pid == null ? [] : [port.pid]))) + // The shared snapshot takes no signal and must not be cancelled on one + // caller's behalf, so an abandoned scan declines to wait for it instead. + if (pids.size === 0 || signal?.aborted) { + return ports + } + let names: Map + try { + const rows = await readWindowsProcessTable() + names = new Map( + rows.flatMap((row) => + pids.has(row.pid) && row.name ? [[row.pid, stripExecutableSuffix(row.name)] as const] : [] ) - return stdout + ) + } catch { + return ports + } + return ports.map((port) => { + const processName = port.pid == null ? undefined : names.get(port.pid) + return processName ? { ...port, processName } : port + }) +} + +// The process table reports `sshd.exe`; the retired `Get-Process` payload +// reported `sshd`. The sshd filter below and every client that already renders +// these rows read the bare name, so keep publishing that spelling. +function stripExecutableSuffix(name: string): string { + return name.replace(/\.exe$/i, '') +} + +/** + * Single line so it survives as one argv element regardless of how the + * shell-less spawn hands it to PowerShell's `-Command` parser. Exported so + * windows-port-scan.win32.test.ts can run it: a missing `;` between statements + * is a parse error the mocked tests cannot see. + */ +export const WINDOWS_PORT_SCAN_SCRIPT = [ + "$ErrorActionPreference = 'Stop';", + 'Get-NetTCPConnection -State Listen | ForEach-Object {', + '$connection = $_; $name = $null;', + 'try { $name = (Get-Process -Id $connection.OwningProcess -ErrorAction Stop).ProcessName } catch { };', + '[pscustomobject]@{ host = [string]$connection.LocalAddress; port = [int]$connection.LocalPort;', + 'pid = [int]$connection.OwningProcess; processName = $name }', + '} | ConvertTo-Json -Compress -Depth 3' +].join(' ') + +async function runWindowsPortScanPowerShell(signal?: AbortSignal): Promise { + let lastError: unknown + + for (const program of [windowsPowerShellPath(), 'pwsh.exe']) { + try { + const result = await runProcess({ + program, + // No `-ExecutionPolicy` override: the policy gates script *files*, never + // `-Command`. Verified on Windows 11 — `-ExecutionPolicy Restricted + // -Command` still runs, while `-File` against an unsigned .ps1 does not. + args: ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_PORT_SCAN_SCRIPT], + env: buildRelayCommandEnv(), + timeoutMs: WINDOWS_PORT_SCAN_TIMEOUT_MS, + maxOutputBytes: WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES, + signal + }) + if (signal?.aborted) { + throw new Error('windows port scan aborted') + } + if (result.timedOut || result.code !== 0) { + lastError ??= new Error( + `windows port scan PowerShell failed (code=${result.code} timedOut=${result.timedOut})` + ) + continue + } + return result.stdout } catch (error) { if (signal?.aborted) { throw error } - lastError.push(error) + lastError ??= error } } - throw lastError[0] ?? new Error('PowerShell unavailable') + throw lastError ?? new Error('PowerShell unavailable') } export function parseWindowsPowerShellPortRows(json: string): DetectedPort[] { @@ -98,26 +245,85 @@ export function parseWindowsPowerShellPortRows(json: string): DetectedPort[] { return rows.flatMap((row) => parseWindowsPortRow(row)) } +/** + * Listening rows, on a host in any UI language. + * + * `LISTENING` is not in `netstat.exe` — it lives in + * `System32\\netstat.exe.mui` beside `ESTABLISHED` and `Proto`, and MUI + * selection follows the UI language, so the pinned-locale env in + * relay-command-env.ts cannot reach it. A German host prints `ABHÖREN` and the + * word test finds nothing at all. + * + * The shape is language-independent: a listening socket has no peer, so its + * foreign address is `0.0.0.0:0` / `[::]:0`, and on every state Windows prints + * with a real peer that port is non-zero. Shape stays the fallback because the + * converse does not hold — `BOUND` and `CLOSED` print a zero peer too, and on a + * localized host their words are just as unreadable as the listening one. + */ export function parseWindowsNetstatOutput(output: string): DetectedPort[] { - const rows: DetectedPort[] = [] + const { rows, tcpRows } = scanWindowsNetstatTcpRows(output) + const byStateWord = rows.filter((row) => row.state === 'LISTENING') + if (byStateWord.length > 0 || tcpRows === 0) { + return byStateWord.map((row) => row.port) + } + return readDominantZeroPeerState(rows) +} + +/** + * Of the zero-peer states, keep only the one that dominates. + * + * Shape alone would publish a phantom listener: one `BOUND` socket among real + * listeners looks identical to them once the state word is unreadable. But it + * cannot dominate — listeners outnumber those transients by roughly 50:1 on a + * real host (51 against 0 here), so the largest zero-peer group is the + * listening one. An exact tie keeps every tied group rather than guessing, + * which is no worse than reading shape alone. + * + * A majority rule inverts if the majority is wrong: enough transient zero-peer + * sockets and the phantoms win, publishing those and dropping the real + * listeners. The hatch is to return [] here and defer to the PowerShell reader, + * which reads the state word instead of inferring it. + */ +function readDominantZeroPeerState(rows: NetstatTcpRow[]): DetectedPort[] { + const countByState = new Map() + for (const row of rows) { + if (row.zeroPeer) { + countByState.set(row.state, (countByState.get(row.state) ?? 0) + 1) + } + } + const largest = Math.max(0, ...countByState.values()) + const dominant = new Set( + [...countByState].filter(([, count]) => count === largest).map(([state]) => state) + ) + return rows.flatMap((row) => (row.zeroPeer && dominant.has(row.state) ? [row.port] : [])) +} + +type NetstatTcpRow = { state: string; zeroPeer: boolean; port: DetectedPort } + +/** `tcpRows` separates a localized host from one with genuinely no TCP output. */ +function scanWindowsNetstatTcpRows(output: string): { rows: NetstatTcpRow[]; tcpRows: number } { + const rows: NetstatTcpRow[] = [] + let tcpRows = 0 for (const line of output.split(/\r?\n/)) { const fields = getProcessOutputFields(line, 5) if (fields.length < 5 || fields[0].toUpperCase() !== 'TCP') { continue } - if (fields[3].toUpperCase() !== 'LISTENING') { - continue - } + tcpRows += 1 const hostPort = parseWindowsNetstatAddress(fields[1]) const pid = Number.parseInt(fields[4], 10) if (!hostPort || !Number.isSafeInteger(pid) || pid <= 0) { continue } - rows.push({ ...hostPort, pid }) + rows.push({ + state: fields[3].toUpperCase(), + zeroPeer: readWindowsNetstatPort(fields[2]) === 0, + port: { ...hostPort, pid } + }) } - return rows + return { rows, tcpRows } } function parseWindowsPortRow(row: unknown): DetectedPort[] { @@ -165,13 +371,20 @@ function readInteger(value: unknown): number | undefined { return Number.isSafeInteger(parsed) ? parsed : undefined } -function parseWindowsNetstatAddress(value: string): { host: string; port: number } | null { - const ipv6Match = /^\[(.*)\]:(\d+)$/.exec(value) - const portText = ipv6Match?.[2] ?? value.slice(value.lastIndexOf(':') + 1) +/** Port alone, keeping 0 — the foreign-address test above turns on that value. */ +function readWindowsNetstatPort(value: string): number | null { + const ipv6Match = /^\[.*\]:(\d+)$/.exec(value) + const portText = ipv6Match?.[1] ?? value.slice(value.lastIndexOf(':') + 1) const port = Number.parseInt(portText, 10) - if (!Number.isSafeInteger(port) || port <= 0) { + return Number.isSafeInteger(port) ? port : null +} + +function parseWindowsNetstatAddress(value: string): { host: string; port: number } | null { + const port = readWindowsNetstatPort(value) + if (port == null || port <= 0) { return null } + const ipv6Match = /^\[(.*)\]:\d+$/.exec(value) if (ipv6Match) { return { host: ipv6Match[1], port } } diff --git a/src/relay/windows-port-scan.win32.test.ts b/src/relay/windows-port-scan.win32.test.ts new file mode 100644 index 00000000000..976f477cd9c --- /dev/null +++ b/src/relay/windows-port-scan.win32.test.ts @@ -0,0 +1,52 @@ +import { describe, expect, it } from 'vitest' +import { runProcess } from '../shared/child-process/run-process' +import { windowsPowerShellPath } from '../shared/child-process/windows-system-binary' +import { + WINDOWS_PORT_SCAN_SCRIPT, + parseWindowsPowerShellPortRows, + scanWindowsListeningPorts +} from './windows-port-scan' + +/** + * The mocked suite pins the argv; this pins that the argv works. + * + * Both halves are things a mock cannot see: netstat's real column layout (a + * `-p tcp` here silently drops every `[::]` listener), and whether the joined + * one-line PowerShell script even parses — a missing `;` between statements is + * a ParserError, and the fallback would then be dead on the day it is needed. + * + * Runs only on win32; skipped elsewhere. + */ +const describeOnWindows = process.platform === 'win32' ? describe : describe.skip + +describeOnWindows('windows port scan against the real host', () => { + it('finds listeners over both address families through netstat', async () => { + const ports = await scanWindowsListeningPorts() + + expect(ports.length).toBeGreaterThan(0) + for (const port of ports) { + expect(port.port).toBeGreaterThan(0) + expect(port.host.length).toBeGreaterThan(0) + } + // Windows binds RPC/SMB dual-stack, so both families must be represented. + expect(ports.some((port) => port.host.includes(':'))).toBe(true) + expect(ports.some((port) => !port.host.includes(':'))).toBe(true) + // Names come from the shared process table, never from a shell of our own. + expect(ports.some((port) => port.processName)).toBe(true) + // The table spells them `svchost.exe`; clients have always seen `svchost`. + expect(ports.every((port) => !port.processName?.endsWith('.exe'))).toBe(true) + }, 30_000) + + it('runs the de-escalated PowerShell fallback command line', async () => { + const result = await runProcess({ + program: windowsPowerShellPath(), + args: ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_PORT_SCAN_SCRIPT], + timeoutMs: 20_000 + }) + + // No stderr assertion: an autoload or first-run banner writes there without + // the scan having failed. + expect(result.code).toBe(0) + expect(parseWindowsPowerShellPortRows(result.stdout).length).toBeGreaterThan(0) + }, 30_000) +}) diff --git a/src/renderer/src/components/editor/rich-markdown-review-annotations.ts b/src/renderer/src/components/editor/rich-markdown-review-annotations.ts index 619d128bb65..90bd170a5c1 100644 --- a/src/renderer/src/components/editor/rich-markdown-review-annotations.ts +++ b/src/renderer/src/components/editor/rich-markdown-review-annotations.ts @@ -139,7 +139,7 @@ export function getRichMarkdownAnnotationHighlightRangesForComment( comment: DiffComment, markdownSourceLineOffset: number, // Why optional: callers looping over comments pass one shared build. - prebuiltBlocks?: RichMarkdownCommentBlock[] + prebuiltBlocks?: readonly RichMarkdownCommentBlock[] ): RichMarkdownAnnotationHighlightRange[] { const blocks = prebuiltBlocks ?? buildRichMarkdownCommentBlocks(editor) const selectedText = comment.selectedText?.trim() @@ -192,13 +192,15 @@ export function getRichMarkdownCommentAnchorTop( block: RichMarkdownCommentBlock, containerRect: DOMRect, containerScrollTop: number, - markdownSourceLineOffset: number + markdownSourceLineOffset: number, + prebuiltBlocks?: readonly RichMarkdownCommentBlock[] ): number | null { try { const ranges = getRichMarkdownAnnotationHighlightRangesForComment( editor, comment, - markdownSourceLineOffset + markdownSourceLineOffset, + prebuiltBlocks ) // Why: range notes should sort by the start of the selected text. Anchoring // to the end puts overlapping ranges with the same final line in creation diff --git a/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts b/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts index c54996d0ffa..4fdc12a51b9 100644 --- a/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts +++ b/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts @@ -1,9 +1,7 @@ import type { Editor } from '@tiptap/react' import type { DiffComment } from '../../../../shared/diff-comment-types' -import { - buildRichMarkdownCommentBlocks, - getRichMarkdownCommentAnchorTop -} from './rich-markdown-review-annotations' +import { getRichMarkdownCommentAnchorTop } from './rich-markdown-review-annotations' +import { getRichMarkdownReviewRailBlocks } from './rich-markdown-review-rail-blocks' import { stackRichMarkdownReviewNotePositions, type RichMarkdownReviewNotePosition @@ -23,7 +21,7 @@ export function measureRichMarkdownReviewNotePositions({ markdownSourceLineOffset }: MeasureRichMarkdownReviewNotePositionsOptions): RichMarkdownReviewNotePosition[] { const containerRect = container.getBoundingClientRect() - const blocks = buildRichMarkdownCommentBlocks(editor) + const blocks = getRichMarkdownReviewRailBlocks(editor) const nextPositions = markdownComments .map((comment): RichMarkdownReviewNotePosition | null => { const bodyLineNumber = Math.max(1, comment.lineNumber - markdownSourceLineOffset) @@ -39,7 +37,8 @@ export function measureRichMarkdownReviewNotePositions({ block, containerRect, container.scrollTop, - markdownSourceLineOffset + markdownSourceLineOffset, + blocks ) return top === null ? null : { comment, top } }) diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts new file mode 100644 index 00000000000..7090769f71f --- /dev/null +++ b/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts @@ -0,0 +1,154 @@ +// @vitest-environment happy-dom +// Run: ORCA_REVIEW_RAIL_BENCH=1 pnpm test src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts +import { expect, it, vi } from 'vitest' +import { Editor as TiptapEditor } from '@tiptap/core' +import { createRichMarkdownExtensions } from './rich-markdown-extensions' +import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport' +import { measureRichMarkdownReviewNotePositions } from './rich-markdown-review-note-positioning' + +// Baseline measurement body from the parent revision, before sharing source blocks. +import type { Editor } from '@tiptap/react' +import type { DiffComment } from '../../../../shared/diff-comment-types' +import { + buildRichMarkdownCommentBlocks, + getRichMarkdownCommentAnchorTop +} from './rich-markdown-review-annotations' +import { + stackRichMarkdownReviewNotePositions, + type RichMarkdownReviewNotePosition +} from './rich-markdown-review-note-layout' + +type MeasureRichMarkdownReviewNotePositionsOptions = { + container: HTMLDivElement + editor: Editor + markdownComments: DiffComment[] + markdownSourceLineOffset: number +} + +function measureBaseline({ + container, + editor, + markdownComments, + markdownSourceLineOffset +}: MeasureRichMarkdownReviewNotePositionsOptions): RichMarkdownReviewNotePosition[] { + const containerRect = container.getBoundingClientRect() + const blocks = buildRichMarkdownCommentBlocks(editor) + const nextPositions = markdownComments + .map((comment): RichMarkdownReviewNotePosition | null => { + const bodyLineNumber = Math.max(1, comment.lineNumber - markdownSourceLineOffset) + const block = blocks.find( + (candidate) => candidate.startLine <= bodyLineNumber && bodyLineNumber <= candidate.endLine + ) + if (!block) { + return null + } + const top = getRichMarkdownCommentAnchorTop( + editor, + comment, + block, + containerRect, + container.scrollTop, + markdownSourceLineOffset + ) + return top === null ? null : { comment, top } + }) + .filter((position): position is RichMarkdownReviewNotePosition => position !== null) + return stackRichMarkdownReviewNotePositions( + nextPositions, + measureReviewNoteHeights(container, nextPositions) + ) +} + +function measureReviewNoteHeights( + container: HTMLDivElement, + positions: RichMarkdownReviewNotePosition[] +): Map { + const measuredHeights = new Map() + for (const pos of positions) { + const el = container.querySelector(`[data-rich-markdown-review-note-id="${pos.comment.id}"]`) + if (el) { + measuredHeights.set(pos.comment.id, el.getBoundingClientRect().height) + } + } + return measuredHeights +} + +it.skipIf(process.env.ORCA_REVIEW_RAIL_BENCH !== '1')( + 'benchmarks full review rail measurements', + () => { + for (const blockCount of [250, 1000]) { + const editor = new TiptapEditor({ + element: document.createElement('div'), + extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }), + content: { + type: 'doc', + content: Array.from({ length: blockCount }, (_, index) => ({ + type: 'paragraph', + content: [{ type: 'text', text: `Paragraph ${index} with reviewable content.` }] + })) + } + }) + try { + vi.spyOn(editor.view, 'coordsAtPos').mockReturnValue({ + top: 100, + bottom: 120, + left: 0, + right: 10 + }) + const container = document.createElement('div') + const markdownComments: DiffComment[] = Array.from({ length: 5 }, (_, index) => ({ + id: `note-${index}`, + worktreeId: 'workspace', + filePath: 'notes.md', + source: 'markdown', + lineNumber: 1 + index * 40, + body: 'Review', + createdAt: index, + side: 'modified' + })) + const args = { editor, container, markdownComments, markdownSourceLineOffset: 0 } + const serialize = vi.spyOn(editor.markdown!, 'serialize') + const baseline = measureBaseline(args) + const baselineCalls = serialize.mock.calls.length + serialize.mockClear() + expect(measureRichMarkdownReviewNotePositions(args)).toEqual(baseline) + const coldCalls = serialize.mock.calls.length + serialize.mockClear() + expect(measureRichMarkdownReviewNotePositions(args)).toEqual(baseline) + const warmCalls = serialize.mock.calls.length + serialize.mockRestore() + const time = (run: () => unknown) => { + const start = performance.now() + for (let index = 0; index < 20; index++) { + run() + } + return (performance.now() - start) / 20 + } + const before: number[] = [] + const after: number[] = [] + for (let round = 0; round < 5; round++) { + before.push(time(() => measureBaseline(args))) + after.push(time(() => measureRichMarkdownReviewNotePositions(args))) + } + const median = (values: number[]) => values.sort((a, b) => a - b)[2]! + const result = { + blockCount, + comments: markdownComments.length, + beforeMs: median(before), + afterMs: median(after), + baselineCalls, + coldCalls, + warmCalls + } + process.stdout.write(`${JSON.stringify(result)}\n`) + expect(baselineCalls).toBe((2 * blockCount - 1) * 6) + expect(coldCalls).toBe(2 * blockCount - 1) + expect(warmCalls).toBe(0) + } finally { + editor.destroy() + vi.restoreAllMocks() + } + } + }, + 120_000 +) diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts new file mode 100644 index 00000000000..18c00a47fb5 --- /dev/null +++ b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts @@ -0,0 +1,139 @@ +// @vitest-environment happy-dom +import { afterEach, describe, expect, it, vi } from 'vitest' +import { Editor, type JSONContent } from '@tiptap/core' +import type { DiffComment } from '../../../../shared/diff-comment-types' +import { createRichMarkdownExtensions } from './rich-markdown-extensions' +import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport' +import { buildRichMarkdownCommentBlocks } from './rich-markdown-review-annotations' +import { getRichMarkdownReviewRailBlocks } from './rich-markdown-review-rail-blocks' +import { measureRichMarkdownReviewNotePositions } from './rich-markdown-review-note-positioning' + +const editors: Editor[] = [] + +function createEditor( + content: string | JSONContent = '# Heading\n\nFirst paragraph\n\n- One\n- Two' +) { + const editor = new Editor({ + element: document.createElement('div'), + extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }), + content, + ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {}) + }) + editors.push(editor) + // Settle the trailing-node plugin before measuring selection-only transactions. + editor.view.dispatch(editor.state.tr.setMeta('addToHistory', false)) + return editor +} + +afterEach(() => { + for (const editor of editors.splice(0)) { + editor.destroy() + } + vi.restoreAllMocks() +}) + +describe('review rail source block reuse', () => { + it.each([ + '```ts\nconst value = 1\n\nvalue++\n```\n\nAfter code', + '| First | Second |\n| --- | --- |\n| one | two |\n\nAfter table', + '
Toggle\n\nInside\n\n
\n\nAfter toggle' + ])('preserves multiline block boundaries for %s', (source) => { + const editor = createEditor(source) + expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(buildRichMarkdownCommentBlocks(editor)) + }) + + it('preserves block lines and reuses them after selection-only transactions', () => { + const editor = createEditor() + const expected = buildRichMarkdownCommentBlocks(editor) + const serialize = vi.spyOn(editor.markdown!, 'serialize') + const blocks = getRichMarkdownReviewRailBlocks(editor) + expect(blocks).toEqual(expected) + expect(serialize).toHaveBeenCalledTimes(2 * editor.state.doc.childCount - 1) + serialize.mockClear() + editor.commands.setTextSelection(3) + expect(getRichMarkdownReviewRailBlocks(editor)).toBe(blocks) + expect(serialize).not.toHaveBeenCalled() + }) + + it('rebuilds after edits and undo while keeping editors isolated', () => { + const editor = createEditor() + const original = getRichMarkdownReviewRailBlocks(editor) + editor.commands.insertContentAt(1, 'changed\ntext') + const changed = getRichMarkdownReviewRailBlocks(editor) + expect(changed).not.toBe(original) + expect(changed).toEqual(buildRichMarkdownCommentBlocks(editor)) + editor.commands.undo() + expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(original) + expect(getRichMarkdownReviewRailBlocks(createEditor())).not.toBe(original) + }) + + it('invalidates an in-place serializer replacement and a manager replacement', () => { + const editor = createEditor() + const original = getRichMarkdownReviewRailBlocks(editor) + const serialize = editor.markdown!.serialize.bind(editor.markdown) + vi.spyOn(editor.markdown!, 'serialize').mockImplementation( + (content) => `${serialize(content)}\nextra line` + ) + const changed = getRichMarkdownReviewRailBlocks(editor) + expect(changed).not.toEqual(original) + expect(changed).toEqual(buildRichMarkdownCommentBlocks(editor)) + editor.markdown = createEditor().markdown + expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(original) + }) + + it('does not reuse fallback lines after a missing serializer becomes available', () => { + const editor = createEditor() + const markdown = editor.markdown + editor.markdown = undefined + const fallback = getRichMarkdownReviewRailBlocks(editor) + expect(fallback).toEqual(buildRichMarkdownCommentBlocks(editor)) + editor.markdown = markdown + expect(getRichMarkdownReviewRailBlocks(editor)).not.toEqual(fallback) + expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(buildRichMarkdownCommentBlocks(editor)) + }) + + it('avoids serialization for every comment and repeated scroll while refreshing geometry', () => { + const editor = createEditor() + let sourceTop = 100 + const coords = vi.spyOn(editor.view, 'coordsAtPos').mockImplementation(() => ({ + top: sourceTop, + bottom: sourceTop + 20, + left: 0, + right: 10 + })) + const container = document.createElement('div') + const comment: DiffComment = { + id: 'note', + worktreeId: 'workspace', + filePath: 'notes.md', + source: 'markdown', + lineNumber: 1, + body: 'Review', + createdAt: 1, + side: 'modified' + } + const markdownComments = Array.from({ length: 5 }, (_, index) => ({ + ...comment, + id: `note-${index}`, + selectedText: index === 0 ? 'Heading' : undefined + })) + const serialize = vi.spyOn(editor.markdown!, 'serialize') + const measure = () => + measureRichMarkdownReviewNotePositions({ + editor, + container, + markdownComments, + markdownSourceLineOffset: 0 + }) + expect(measure()[0]?.top).toBe(100) + expect(serialize).toHaveBeenCalledTimes(2 * editor.state.doc.childCount - 1) + serialize.mockClear() + sourceTop = 200 + container.scrollTop = 30 + for (let index = 0; index < 60; index++) { + expect(measure()[0]?.top).toBe(230) + } + expect(serialize).not.toHaveBeenCalled() + expect(coords).toHaveBeenCalledTimes(61 * markdownComments.length) + }) +}) diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts new file mode 100644 index 00000000000..35dd1bb9eb5 --- /dev/null +++ b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts @@ -0,0 +1,31 @@ +import type { Editor } from '@tiptap/core' +import { + buildRichMarkdownCommentBlocks, + type RichMarkdownCommentBlock +} from './rich-markdown-review-annotations' + +type ReviewRailBlocks = { + doc: Editor['state']['doc'] + markdown: Editor['markdown'] + serialize: NonNullable['serialize'] | undefined + blocks: readonly RichMarkdownCommentBlock[] +} + +// Keep only the current document per editor; scrolling changes geometry, not source lines. +const blocksByEditor = new WeakMap() + +export function getRichMarkdownReviewRailBlocks( + editor: Editor +): readonly RichMarkdownCommentBlock[] { + const doc = editor.state.doc + const markdown = editor.markdown + const serialize = markdown?.serialize + const cached = blocksByEditor.get(editor) + if (cached?.doc === doc && cached.markdown === markdown && cached.serialize === serialize) { + return cached.blocks + } + + const blocks = buildRichMarkdownCommentBlocks(editor) + blocksByEditor.set(editor, { doc, markdown, serialize, blocks }) + return blocks +} diff --git a/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts new file mode 100644 index 00000000000..8859d8c4b2e --- /dev/null +++ b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts @@ -0,0 +1,93 @@ +import { Schema } from '@tiptap/pm/model' +import { describe, expect, it, vi } from 'vitest' +import { findRichMarkdownSearchMatches } from './rich-markdown-search' +import { createRichMarkdownSearchMatchesCache } from './rich-markdown-search-matches-cache' + +const schema = new Schema({ + nodes: { + doc: { content: 'paragraph+' }, + paragraph: { content: 'text*' }, + text: {} + } +}) + +function createDoc(text = 'Beta beta betas', count = 1) { + return schema.node( + 'doc', + null, + Array.from({ length: count }, () => schema.node('paragraph', null, schema.text(text))) + ) +} + +describe('rich markdown search match reuse', () => { + it('keeps separate live and debounced results without rewalking the document', () => { + const doc = createDoc() + const find = createRichMarkdownSearchMatchesCache() + const walk = vi.spyOn(doc, 'nodesBetween') + const highlighted = find(doc, 'beta') + const live = find(doc, 'betas') + for (let index = 0; index < 100; index++) { + expect(find(doc, 'beta')).toBe(highlighted) + expect(find(doc, 'betas')).toBe(live) + } + expect(walk).toHaveBeenCalledTimes(2) + }) + + it('keys by document and both matching options', () => { + const find = createRichMarkdownSearchMatchesCache() + const doc = createDoc() + const anyCase = find(doc, 'beta') + expect(find(doc, 'beta', { matchCase: false, wholeWord: false })).toBe(anyCase) + for (const options of [ + { matchCase: true }, + { wholeWord: true }, + { matchCase: true, wholeWord: true } + ]) { + expect(find(doc, 'beta', options)).toEqual( + findRichMarkdownSearchMatches(doc, 'beta', options) + ) + } + const changedDoc = createDoc('A different beta') + expect(find(changedDoc, 'beta')).toEqual(findRichMarkdownSearchMatches(changedDoc, 'beta')) + expect(find(doc, 'beta')).not.toBe(anyCase) + }) + + it('bounds retained results to two queries for one document', () => { + const find = createRichMarkdownSearchMatchesCache() + const doc = createDoc() + const first = find(doc, 'beta') + find(doc, 'Beta') + find(doc, 'betas') + expect(find(doc, 'beta')).not.toBe(first) + }) +}) + +it.skipIf(process.env.ORCA_SEARCH_CACHE_BENCH !== '1')( + 'benchmarks repeated live-match checks', + () => { + for (const blockCount of [250, 1000]) { + const doc = createDoc('Beta beta betas with searchable content', blockCount) + const find = createRichMarkdownSearchMatchesCache() + const expected = findRichMarkdownSearchMatches(doc, 'beta') + expect(find(doc, 'beta')).toEqual(expected) + const measure = (run: () => unknown) => { + const samples: number[] = [] + for (let round = 0; round < 5; round++) { + const start = performance.now() + for (let index = 0; index < 100; index++) { + run() + } + samples.push((performance.now() - start) / 100) + } + return samples.sort((a, b) => a - b)[2]! + } + const beforeMs = measure(() => + findRichMarkdownSearchMatches(doc, 'beta').some((match) => match.touchesReadOnlyAtom) + ) + const afterMs = measure(() => find(doc, 'beta').some((match) => match.touchesReadOnlyAtom)) + process.stdout.write( + `${JSON.stringify({ blockCount, matchCount: expected.length, beforeMs, afterMs })}\n` + ) + } + } +) diff --git a/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts new file mode 100644 index 00000000000..1b057881356 --- /dev/null +++ b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts @@ -0,0 +1,36 @@ +import type { Node as ProseMirrorNode } from '@tiptap/pm/model' +import type { TextMatchOptions } from './markdown-preview-search' +import { findRichMarkdownSearchMatches, type RichMarkdownSearchMatch } from './rich-markdown-search' + +type CachedMatches = { + query: string + matchCase: boolean + wholeWord: boolean + matches: RichMarkdownSearchMatch[] +} + +export function createRichMarkdownSearchMatchesCache(): typeof findRichMarkdownSearchMatches { + let previousDoc: ProseMirrorNode | undefined + let entries: CachedMatches[] = [] + + return (doc, query, options: TextMatchOptions = {}, stats) => { + if (doc !== previousDoc) { + previousDoc = doc + entries = [] + } + const matchCase = options.matchCase ?? false + const wholeWord = options.wholeWord ?? false + const existing = entries.find( + (entry) => + entry.query === query && entry.matchCase === matchCase && entry.wholeWord === wholeWord + ) + if (existing) { + return existing.matches + } + + const matches = findRichMarkdownSearchMatches(doc, query, options, stats) + // The live replacement guard and debounced highlights can have different queries. + entries = [...entries.slice(-1), { query, matchCase, wholeWord, matches }] + return matches + } +} diff --git a/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx b/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx new file mode 100644 index 00000000000..3aa0cea32dd --- /dev/null +++ b/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx @@ -0,0 +1,135 @@ +// @vitest-environment happy-dom +import { act, renderHook } from '@testing-library/react' +import { Schema, type Node as ProseMirrorNode } from '@tiptap/pm/model' +import { EditorState } from '@tiptap/pm/state' +import type { Editor } from '@tiptap/react' +import { afterEach, describe, expect, it, vi } from 'vitest' +import * as visibleText from './rich-markdown-visible-text-map' +import { useRichMarkdownSearch } from './useRichMarkdownSearch' + +vi.mock('@/store', () => ({ + useAppStore: (select: (state: unknown) => unknown) => select({ keybindings: {} }) +})) + +const schema = new Schema({ + nodes: { + doc: { content: 'paragraph+' }, + paragraph: { content: 'inline*' }, + text: { group: 'inline' }, + atom: { + group: 'inline', + inline: true, + atom: true, + attrs: { label: {} }, + leafText: (node) => node.attrs.label + } + } +}) + +function createDoc(atomLabel = 'locked') { + return schema.node( + 'doc', + null, + schema.node('paragraph', null, [ + schema.text('beta beta '), + schema.node('atom', { label: atomLabel }) + ]) + ) +} + +function mountSearch() { + let state = EditorState.create({ doc: createDoc() }) + const listeners = new Set<() => void>() + const editor = { + get state() { + return state + }, + commands: { focus: vi.fn() }, + on: (_event: string, listener: () => void) => listeners.add(listener), + off: (_event: string, listener: () => void) => listeners.delete(listener), + registerPlugin: vi.fn(), + unregisterPlugin: vi.fn(), + view: { + dispatch: (tr: EditorState['tr']) => { + state = state.apply(tr) + if (tr.docChanged) { + listeners.forEach((listener) => listener()) + } + } + } + } as unknown as Editor + const hook = renderHook(() => + useRichMarkdownSearch({ + editor, + rootRef: { current: null }, + scrollContainerRef: { current: null } + }) + ) + return { + hook, + editor, + replaceDocSilently: (doc: ProseMirrorNode) => { + state = EditorState.create({ doc }) + } + } +} + +afterEach(() => { + vi.useRealTimers() + vi.restoreAllMocks() +}) + +describe('live rich markdown search reuse', () => { + it('does not rescan while typing replacement text, navigating, or publishing debounced highlights', () => { + vi.useFakeTimers() + const walk = vi.spyOn(visibleText, 'createRichMarkdownVisibleTextMap') + const { hook } = mountSearch() + act(() => hook.result.current.openSearch()) + act(() => hook.result.current.searchActions.setSearchQuery('beta')) + expect(walk).toHaveBeenCalledTimes(1) + act(() => vi.advanceTimersByTime(150)) + expect(hook.result.current.searchState.matchCount).toBe(2) + for (let index = 0; index < 20; index++) { + act(() => hook.result.current.searchActions.setReplaceQuery(`replacement ${index}`)) + act(() => hook.result.current.searchActions.moveToMatch(1)) + } + expect(walk).toHaveBeenCalledTimes(1) + act(() => hook.result.current.searchActions.closeSearch()) + act(() => hook.result.current.openSearch()) + act(() => hook.result.current.searchActions.setSearchQuery('beta')) + expect(walk).toHaveBeenCalledTimes(2) + hook.unmount() + }) + + it('uses the immediate query for atom guards and replacements during the debounce window', () => { + vi.useFakeTimers() + const { hook, editor } = mountSearch() + act(() => hook.result.current.openSearch()) + act(() => hook.result.current.searchActions.setSearchQuery('beta')) + act(() => vi.advanceTimersByTime(150)) + act(() => hook.result.current.searchActions.setSearchQuery('locked')) + expect(hook.result.current.searchState.matchCount).toBe(2) + expect(hook.result.current.searchState.replaceDisabled).toBe(true) + const doc = editor.state.doc + act(() => hook.result.current.searchActions.replaceAllMatches()) + expect(editor.state.doc).toBe(doc) + act(() => hook.result.current.searchActions.setSearchQuery('beta')) + act(() => hook.result.current.searchActions.setReplaceQuery('changed')) + act(() => hook.result.current.searchActions.replaceAllMatches()) + expect(editor.state.doc.textContent).toBe('changed changed locked') + hook.unmount() + }) + + it('checks the latest document even before an editor update reaches React', () => { + vi.useFakeTimers() + const { hook, editor, replaceDocSilently } = mountSearch() + act(() => hook.result.current.openSearch()) + act(() => hook.result.current.searchActions.setSearchQuery('beta')) + act(() => vi.advanceTimersByTime(150)) + replaceDocSilently(createDoc('beta')) + const doc = editor.state.doc + act(() => hook.result.current.searchActions.replaceCurrentMatch()) + expect(editor.state.doc).toBe(doc) + hook.unmount() + }) +}) diff --git a/src/renderer/src/components/editor/useRichMarkdownSearch.ts b/src/renderer/src/components/editor/useRichMarkdownSearch.ts index 2508505b85b..1a0f132e67c 100644 --- a/src/renderer/src/components/editor/useRichMarkdownSearch.ts +++ b/src/renderer/src/components/editor/useRichMarkdownSearch.ts @@ -1,5 +1,4 @@ -import { useCallback, useEffect, useMemo, useRef, useState } from 'react' -import type { RefObject } from 'react' +import { useCallback, useEffect, useMemo, useRef, useState, type RefObject } from 'react' import type { Editor } from '@tiptap/react' import { TextSelection } from '@tiptap/pm/state' import { getShortcutPlatform } from '@/lib/shortcut-platform' @@ -14,6 +13,7 @@ import { findRichMarkdownSearchMatches, richMarkdownSearchPluginKey } from './rich-markdown-search' +import { createRichMarkdownSearchMatchesCache } from './rich-markdown-search-matches-cache' export function useRichMarkdownSearch({ editor, @@ -27,6 +27,13 @@ export function useRichMarkdownSearch({ const searchInputRef = useRef(null) const keybindings = useAppStore((state) => state.keybindings) const [isSearchOpen, setIsSearchOpen] = useState(false) + const findMatches = useMemo( + () => + editor && isSearchOpen + ? createRichMarkdownSearchMatchesCache() + : findRichMarkdownSearchMatches, + [editor, isSearchOpen] + ) const [isReplaceMode, setIsReplaceMode] = useState(false) const [searchQuery, setSearchQuery] = useState('') const [replaceQuery, setReplaceQuery] = useState('') @@ -57,13 +64,13 @@ export function useRichMarkdownSearch({ if (!editor || !isSearchOpen || !searchRequestQuery) { return [] } - return findRichMarkdownSearchMatches(editor.state.doc, searchRequestQuery, { + return findMatches(editor.state.doc, searchRequestQuery, { matchCase, wholeWord }) // searchRevision is bumped on ProseMirror doc edits to trigger recomputation // eslint-disable-next-line react-hooks/exhaustive-deps - }, [editor, isSearchOpen, searchRequestQuery, searchRevision, matchCase, wholeWord]) + }, [editor, findMatches, isSearchOpen, searchRequestQuery, searchRevision, matchCase, wholeWord]) const matchCount = matches.length @@ -78,11 +85,11 @@ export function useRichMarkdownSearch({ } // Why: replace mutates document ranges immediately, so it must use the // current input value instead of the debounced highlight match set. - return findRichMarkdownSearchMatches(editor.state.doc, searchQuery, { + return findMatches(editor.state.doc, searchQuery, { matchCase, wholeWord }) - }, [editor, isSearchOpen, matchCase, searchQuery, wholeWord]) + }, [editor, findMatches, isSearchOpen, matchCase, searchQuery, wholeWord]) // Why: mirror the guard used by replaceCurrentMatch/replaceAllMatches so the // disabled state never disagrees with what a click will actually do during the diff --git a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts index e93928bf4fd..688683bce13 100644 --- a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts +++ b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts @@ -37,6 +37,66 @@ describe('selectDeletionRoots', () => { const other = node('/repo/a.ts/impossible-child') expect(selectDeletionRoots([file, other])).toEqual([file, other]) }) + + it('reads directory membership once per selected node, including file-only selections', () => { + let directoryReads = 0 + const nodes = Array.from({ length: 1_000 }, (_, index) => ({ + ...node(`/repo/file-${index}.ts`), + get isDirectory() { + directoryReads += 1 + return false + } + })) + const selected = selectDeletionRoots(nodes) + expect(directoryReads).toBe(nodes.length) + expect(selected).not.toBe(nodes) + selected.forEach((entry, index) => expect(entry).toBe(nodes[index])) + }) + + it('preserves order, node identity and host ownership when children precede parents', () => { + const child = node('/repo/docs/guide.md') + const first = { ...node('/repo/first.ts'), operationOwner: { kind: 'local' as const } } + const parent = { + ...node('/repo/docs', true), + operationOwner: { kind: 'ssh' as const, connectionId: 'ssh-owner' } + } + const last = { + ...node('/repo/last.ts'), + operationOwner: { kind: 'unresolved' as const } + } + const nodes = [child, first, parent, last] + const selected = selectDeletionRoots(nodes) + expect(selected).toEqual([first, parent, last]) + expect(selected[0]).toBe(first) + expect(selected[1]).toBe(parent) + expect(selected[2]).toBe(last) + expect(nodes).toEqual([child, first, parent, last]) + }) + + it('keeps repeated references but excludes distinct directories with the same path', () => { + const dir = node('/repo/docs', true) + expect(selectDeletionRoots([dir, dir])).toEqual([dir, dir]) + expect(selectDeletionRoots([dir, { ...dir }])).toEqual([]) + const file = node('/repo/docs') + expect(selectDeletionRoots([file, dir])).toEqual([dir]) + }) + + it.each([ + ['/repo/docs/', '/repo/docs/guide.md', '/repo/docs-other/guide.md'], + ['C:\\Repo\\Docs\\', 'c:/repo/docs/guide.md', 'C:/Repo/Docs-other/guide.md'], + ['\\\\Server\\Share\\Docs', '//server/share/docs/guide.md', '//server/other/docs/guide.md'] + ])('retains path boundaries for %s', (parentPath, childPath, outsidePath) => { + const parent = node(parentPath, true) + const child = node(childPath) + const outside = node(outsidePath) + expect(selectDeletionRoots([outside, child, parent])).toEqual([outside, parent]) + }) + + it('keeps case-distinct POSIX paths', () => { + const parent = node('/repo/Docs', true) + const outside = node('/repo/docs/guide.md') + expect(selectDeletionRoots([outside, parent])).toEqual([outside, parent]) + }) }) describe('runBatchDeletion', () => { diff --git a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts index 63a5d029739..5f052bec588 100644 --- a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts +++ b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts @@ -5,11 +5,9 @@ import type { TreeNode } from './file-explorer-types' // already removes the child, and issuing both requests races on the // now-missing path and produces spurious errors. export function selectDeletionRoots(nodes: TreeNode[]): TreeNode[] { + const directories = nodes.filter((node) => node.isDirectory) return nodes.filter( - (n) => - !nodes.some( - (other) => other !== n && other.isDirectory && isPathEqualOrDescendant(n.path, other.path) - ) + (n) => !directories.some((other) => other !== n && isPathEqualOrDescendant(n.path, other.path)) ) } diff --git a/src/renderer/src/components/right-sidebar/file-explorer-entries.ts b/src/renderer/src/components/right-sidebar/file-explorer-entries.ts index 4e5b6e7b423..f21116c7822 100644 --- a/src/renderer/src/components/right-sidebar/file-explorer-entries.ts +++ b/src/renderer/src/components/right-sidebar/file-explorer-entries.ts @@ -9,8 +9,5 @@ function isDotfileSegment(segment: string): boolean { } export function isDotfileRelativePath(relativePath: string): boolean { - return relativePath - .split(/[\\/]+/) - .filter(Boolean) - .some(isDotfileSegment) + return relativePath.split(/[\\/]+/).some(isDotfileSegment) } diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts b/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts index 13daf0c9f20..391bdf10693 100644 --- a/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts +++ b/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts @@ -199,16 +199,25 @@ async function applySnapshot( store: TestStore, snap: RemoteWorkspaceObservedSnapshot ): Promise { - await applyDirectSshRemoteWorkspaceSnapshot({ - store, - snapshot: snap, - token: token(snap.revision), - arrival: 1, - isArrivalCurrent: () => true, - isPreparationTokenCurrent: () => true, - waitForWorkspaceSessionReady: async () => true, - finalizeHydratedTerminals: () => 0 - }) + vi.useFakeTimers() + try { + const pending = applyDirectSshRemoteWorkspaceSnapshot({ + store, + snapshot: snap, + token: token(snap.revision), + arrival: 1, + isArrivalCurrent: () => true, + isPreparationTokenCurrent: () => true, + waitForWorkspaceSessionReady: async () => true, + finalizeHydratedTerminals: () => 0 + }) + // Exercise the real placement deadline without spending ten wall-clock seconds per snapshot. + await vi.advanceTimersByTimeAsync(10_000) + await pending + } finally { + vi.clearAllTimers() + vi.useRealTimers() + } } function adoptedTabIds(store: TestStore): string[] { diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts index bc0082c03ce..7d9f662ffe0 100644 --- a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts +++ b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts @@ -680,7 +680,15 @@ describe('createRemoteWorkspaceTargetSync', () => { ] }) - await harness.sync.applyUnsolicitedSnapshot('target-a', incoming) + vi.useFakeTimers() + try { + const pending = harness.sync.applyUnsolicitedSnapshot('target-a', incoming) + await vi.advanceTimersByTimeAsync(10_000) + await pending + } finally { + harness.sync.stop() + vi.useRealTimers() + } const merged = hydrateTabsSession.mock.calls[0][0] expect(merged.tabsByWorktree).toEqual({ diff --git a/src/renderer/src/lib/palette-match/match-field-allocation.test.ts b/src/renderer/src/lib/palette-match/match-field-allocation.test.ts new file mode 100644 index 00000000000..5b0021d2e71 --- /dev/null +++ b/src/renderer/src/lib/palette-match/match-field-allocation.test.ts @@ -0,0 +1,90 @@ +import { describe, expect, it, vi } from 'vitest' +import { + indexPaletteField, + type PaletteIdentifierKind, + type PaletteFieldProfile +} from './indexed-field' +import { matchPaletteField } from './match-field' +import { createPaletteQueryToken } from './palette-query' + +describe('palette field quality allocation', () => { + it.each(['scan', 's', '123', 'scna', 'zzz'])( + 'does not allocate a Set per field for %s', + (query) => { + const profiles: PaletteFieldProfile[] = [ + 'structured-label', + 'identifier', + 'path', + 'prose', + 'exact-alias' + ] + const fields = Array.from({ length: 1_000 }, (_, i) => + indexPaletteField({ + id: String(i), + profile: profiles[i % profiles.length], + text: 'scan daily 1234 workspace', + ...(i % 2 === 0 ? { identifier: { kind: 'number' as const } } : {}) + })! + ) + const token = createPaletteQueryToken(query, 0) + let allocations = 0 + const NativeSet = globalThis.Set + class CountedSet extends NativeSet { + constructor(values?: Iterable | null) { + super(values) + allocations++ + } + } + vi.stubGlobal('Set', CountedSet) + try { + for (const field of fields) { + matchPaletteField(field, token) + } + } finally { + vi.unstubAllGlobals() + } + expect(allocations).toBe(0) + } + ) +}) + +describe('palette quality restrictions remain local to each match', () => { + it.each(['number', 'version', 'date', 'port', 'sha', 'key'])( + 'preserves prefix permissions for %s', + (kind) => { + const field = indexPaletteField({ + id: 'id', + profile: 'identifier', + text: '12345', + identifier: { kind } + })! + const prefix = createPaletteQueryToken('123', 0) + const exact = createPaletteQueryToken('12345', 0) + const expected = ['port', 'sha', 'key'].includes(kind) + ? { quality: 'field-prefix', ranges: [{ start: 0, end: 3 }] } + : null + expect(matchPaletteField(field, prefix)).toEqual(expected) + expect(matchPaletteField(field, exact)).toEqual({ + quality: 'field-exact', + ranges: [{ start: 0, end: 5 }] + }) + expect(matchPaletteField(field, prefix)).toEqual(expected) + } + ) + + it.each(['structured-label', 'identifier', 'path', 'prose', 'exact-alias'])( + 'preserves typo restrictions for %s without mutating the profile', + (profile) => { + const field = indexPaletteField({ id: 'id', profile, text: 'scan' })! + expect(matchPaletteField(field, createPaletteQueryToken('s', 0))).toEqual({ + quality: 'field-prefix', + ranges: [{ start: 0, end: 1 }] + }) + expect(matchPaletteField(field, createPaletteQueryToken('scam', 0))).toEqual( + ['structured-label', 'prose'].includes(profile) + ? { quality: 'typo', ranges: [{ start: 0, end: 4 }] } + : null + ) + } + ) +}) diff --git a/src/renderer/src/lib/palette-match/match-field.ts b/src/renderer/src/lib/palette-match/match-field.ts index f9015ec49a5..1744219524c 100644 --- a/src/renderer/src/lib/palette-match/match-field.ts +++ b/src/renderer/src/lib/palette-match/match-field.ts @@ -32,7 +32,7 @@ const SIGILS = new Set(['#', '!']) function allowedQualities( field: PaletteIndexedField, token: PaletteQueryToken -): ReadonlySet { +): readonly PaletteMatchQuality[] { let qualities = paletteProfileAllowedQualities(field.profile) if (field.identifier && !identifierKindAllowsPrefix(field.identifier.kind)) { qualities = qualities.filter((quality) => !PREFIX_QUALITIES.has(quality)) @@ -43,7 +43,7 @@ function allowedQualities( if (token.isIdentifierLike) { qualities = qualities.filter((quality) => quality !== 'typo') } - return new Set(qualities) + return qualities } /** `#123` must not reach a GitLab MR, and `!123` must not reach a GitHub PR. */ @@ -83,15 +83,15 @@ function toRanges(field: PaletteIndexedField, start: number, end: number): reado function matchLiteral( field: PaletteIndexedField, token: PaletteQueryToken, - qualities: ReadonlySet + qualities: readonly PaletteMatchQuality[] ): PaletteFieldMatch | null { const normalized = field.text.normalized const text = token.text - if (qualities.has('field-exact') && normalized === text) { + if (qualities.includes('field-exact') && normalized === text) { return { quality: 'field-exact', ranges: toRanges(field, 0, normalized.length) } } - if (qualities.has('word-exact')) { + if (qualities.includes('word-exact')) { const word = field.words.find((entry) => entry.text === text) if (word) { return { quality: 'word-exact', ranges: toRanges(field, word.start, word.end) } @@ -101,10 +101,10 @@ function matchLiteral( return { quality: 'word-exact', ranges: toRanges(field, atom.start, atom.end) } } } - if (qualities.has('field-prefix') && normalized.startsWith(text)) { + if (qualities.includes('field-prefix') && normalized.startsWith(text)) { return { quality: 'field-prefix', ranges: toRanges(field, 0, text.length) } } - if (qualities.has('word-prefix')) { + if (qualities.includes('word-prefix')) { const word = field.words.find((entry) => entry.text.startsWith(text)) const atom = field.atoms.find((entry) => normalized.startsWith(text, entry.start)) const start = word && atom ? Math.min(word.start, atom.start) : (word?.start ?? atom?.start) @@ -117,13 +117,13 @@ function matchLiteral( if (literalIndex === -1) { return null } - if (qualities.has('boundary-substring') && isWordStart(field, literalIndex)) { + if (qualities.includes('boundary-substring') && isWordStart(field, literalIndex)) { return { quality: 'boundary-substring', ranges: toRanges(field, literalIndex, literalIndex + text.length) } } - if (qualities.has('literal-substring')) { + if (qualities.includes('literal-substring')) { return { quality: 'literal-substring', ranges: toRanges(field, literalIndex, literalIndex + text.length) @@ -135,9 +135,9 @@ function matchLiteral( function matchCompact( field: PaletteIndexedField, token: PaletteQueryToken, - qualities: ReadonlySet + qualities: readonly PaletteMatchQuality[] ): PaletteFieldMatch | null { - if (!qualities.has('compact') || token.compact.length < MIN_COMPACT_LENGTH) { + if (!qualities.includes('compact') || token.compact.length < MIN_COMPACT_LENGTH) { return null } for (const atom of field.atoms) { @@ -152,9 +152,9 @@ function matchCompact( function matchTypo( field: PaletteIndexedField, token: PaletteQueryToken, - qualities: ReadonlySet + qualities: readonly PaletteMatchQuality[] ): PaletteFieldMatch | null { - if (!qualities.has('typo') || !token.isLetterOnly || !isPaletteTypoCandidate(token.text)) { + if (!qualities.includes('typo') || !token.isLetterOnly || !isPaletteTypoCandidate(token.text)) { return null } for (const word of field.words) { diff --git a/src/renderer/src/lib/session-write-subscriber-allocation.test.ts b/src/renderer/src/lib/session-write-subscriber-allocation.test.ts index 9681af5a973..74c9c6db968 100644 --- a/src/renderer/src/lib/session-write-subscriber-allocation.test.ts +++ b/src/renderer/src/lib/session-write-subscriber-allocation.test.ts @@ -90,6 +90,34 @@ afterEach(() => { }) describe('session write subscriber allocation', () => { + it.each(['tabsByWorktree', 'unifiedTabsByWorktree'] as const)( + 'remembers an equivalent %s source before unrelated writes', + (field) => { + const harness = createHarness() + try { + harness.write(() => ({ [field]: { 'wt-1': [] } })) + vi.advanceTimersByTime(500) + harness.persisted.length = 0 + + harness.write(() => ({ [field]: { 'wt-1': [] } })) + const calls = countFilterCalls(() => { + for (let write = 0; write < 200; write += 1) { + harness.write(() => ({ runtimePaneTitlesByTabId: {} })) + } + }) + expect(calls).toBe(0) + vi.advanceTimersByTime(500) + expect(harness.persisted).toHaveLength(0) + + harness.write(() => ({ activeTabId: 'next-tab' })) + vi.advanceTimersByTime(500) + expect(harness.persisted).toHaveLength(1) + } finally { + harness.dispose() + } + } + ) + it('allocates nothing for store writes that touch no session field', () => { const harness = createHarness() try { diff --git a/src/renderer/src/lib/session-write-subscriber.ts b/src/renderer/src/lib/session-write-subscriber.ts index e0e366ef6ba..d54675e15ab 100644 --- a/src/renderer/src/lib/session-write-subscriber.ts +++ b/src/renderer/src/lib/session-write-subscriber.ts @@ -233,12 +233,13 @@ export function createSessionWriteSubscriber({ prev === null ? [...SESSION_RELEVANT_FIELDS] : SESSION_RELEVANT_FIELDS.filter((key) => prev?.[key] !== next[key]) + // Equivalent projections still consume the new source identities. + prevTabsSource = state.tabsByWorktree + prevUnifiedTabsSource = state.unifiedTabsByWorktree if (changedFields.length === 0 && pendingChangedFields.size === 0) { return } prev = next - prevTabsSource = state.tabsByWorktree - prevUnifiedTabsSource = state.unifiedTabsByWorktree for (const field of changedFields) { pendingChangedFields.add(field) } diff --git a/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts b/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts new file mode 100644 index 00000000000..95edbadbf58 --- /dev/null +++ b/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts @@ -0,0 +1,198 @@ +/** + * A live publisher can return to a worktree after another one briefly owned it, and the epoch it + * returns under is already in `retired`. The fence rejects that frame — correctly, because it + * cannot tell it apart from a delayed frame queued by a dead generation — so the drop has to be + * repaired from authority instead of being final. + * + * The sequence below is the measured one: a renderer publication, a `removed:` retraction, a + * headless rebuild whose version restarts at 1, then the same renderer epoch returning at a higher + * version carrying a newly published chat tab. + */ + +import { afterEach, describe, expect, it, vi } from 'vitest' +import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types' +import type { Tab } from '../../../shared/tab-types' +import { + applyLocalStructuredSessionTabSnapshots, + resetLocalStructuredSessionVersionForTests +} from './local-structured-session-tabs-sync' +import { localStructuredSessionEpochHistoryByWorktree } from './local-structured-session-tabs-sync/inventory-generation-fence' +import type { WebSessionTabsSyncState } from './web-session-tabs-sync' +import { resetWebSessionFocusIntentForTests } from './web-session-focus-intent' + +const WORKTREE = 'folder:ws-1' +const ROOT_GROUP = 'local-root-group' +const RENDERER_EPOCH = 'renderer:53c8f87d' +const HEADLESS_EPOCH = 'headless:pty-backed:mtovsn3x' +const REMOVED_EPOCH = 'removed:mtovryl4' + +afterEach(() => { + resetWebSessionFocusIntentForTests() + resetLocalStructuredSessionVersionForTests() +}) + +/** + * The worktree must stay "known" or the trailing cursor sweep deletes its epoch history every + * round and nothing ever accumulates in `retired` — which makes this whole scenario vacuous. + */ +function stateWithCoordinatorTerminal(): WebSessionTabsSyncState { + const terminalTab: Tab = { + id: 'u-term-1', + entityId: 'term-1', + groupId: ROOT_GROUP, + worktreeId: WORKTREE, + contentType: 'terminal', + label: 'Terminal 1', + customLabel: null, + color: null, + sortOrder: 0, + createdAt: 1 + } + return { + activeBrowserTabId: null, + activeBrowserTabIdByWorktree: {}, + activeFileId: null, + activeFileIdByWorktree: {}, + activeGroupIdByWorktree: { [WORKTREE]: ROOT_GROUP }, + activeTabId: 'u-term-1', + activeTabIdByWorktree: { [WORKTREE]: 'u-term-1' }, + activeTabType: 'terminal', + activeTabTypeByWorktree: { [WORKTREE]: 'terminal' }, + activeWorktreeId: WORKTREE, + agentStatusByPaneKey: {}, + agentStatusEpoch: 0, + browserCertificateFailuresByPageId: {}, + browserPagesByWorkspace: {}, + browserTabsByWorktree: {}, + folderWorkspaces: [{ id: 'ws-1', name: 'ws', folderPath: '/tmp/ws' }], + groupsByWorktree: { + [WORKTREE]: [ + { id: ROOT_GROUP, worktreeId: WORKTREE, activeTabId: 'u-term-1', tabOrder: ['u-term-1'] } + ] + }, + layoutByWorktree: { [WORKTREE]: { type: 'leaf', groupId: ROOT_GROUP } }, + openFiles: [], + ptyIdsByTabId: { 'term-1': ['pty-1'] }, + remoteBrowserPageHandlesByPageId: {}, + tabBarOrderByWorktree: {}, + tabsByWorktree: {}, + terminalLayoutsByTabId: {}, + unifiedTabsByWorktree: { [WORKTREE]: [terminalTab] }, + unreadTerminalTabs: {}, + sortEpoch: 0 + } as unknown as WebSessionTabsSyncState +} + +function frame( + publicationEpoch: string, + snapshotVersion: number, + sessionId: string | null +): RuntimeMobileSessionTabsResult { + const id = sessionId ? `agent-session:${sessionId}` : null + return { + worktree: WORKTREE, + publicationEpoch, + snapshotVersion, + activeGroupId: ROOT_GROUP, + activeTabId: null, + activeTabType: null, + tabGroups: [{ id: ROOT_GROUP, activeTabId: null, tabOrder: id ? [id] : [] }], + tabs: id + ? [ + { + type: 'agent-session', + id, + title: 'Claude Chat', + sessionId, + agent: 'claude', + isActive: false + } + ] + : [] + } as RuntimeMobileSessionTabsResult +} + +function chatTabs(state: WebSessionTabsSyncState): string[] { + return (state.unifiedTabsByWorktree[WORKTREE] ?? []) + .filter((tab) => tab.contentType === 'agent-session') + .map((tab) => tab.label) +} + +/** Everything up to and including the drop; returns the state the repair has to fix. */ +function replayUntilDrop( + onRetiredEpochDrop?: (worktreeId: string, publicationEpoch: string) => void +): WebSessionTabsSyncState { + let state = stateWithCoordinatorTerminal() + state = applyLocalStructuredSessionTabSnapshots(state, [frame(RENDERER_EPOCH, 6, null)]) + state = applyLocalStructuredSessionTabSnapshots(state, [frame(REMOVED_EPOCH, 0, null)]) + state = applyLocalStructuredSessionTabSnapshots(state, [frame(HEADLESS_EPOCH, 1, null)]) + return applyLocalStructuredSessionTabSnapshots( + state, + [frame(RENDERER_EPOCH, 7, 'claude-1')], + undefined, + undefined, + onRetiredEpochDrop ? { onRetiredEpochDrop } : {} + ) +} + +describe('retired-epoch repair for a returning publisher', () => { + it('POSITIVE CONTROL: the same frame lands when no epoch has been retired', () => { + const applied = applyLocalStructuredSessionTabSnapshots(stateWithCoordinatorTerminal(), [ + frame(RENDERER_EPOCH, 7, 'claude-1') + ]) + + expect(chatTabs(applied)).toEqual(['Claude Chat']) + }) + + it('drops the returning publisher and reports it to the repair lane', () => { + const onRetiredEpochDrop = vi.fn() + + const dropped = replayUntilDrop(onRetiredEpochDrop) + + expect(chatTabs(dropped)).toEqual([]) + expect(onRetiredEpochDrop).toHaveBeenCalledWith(WORKTREE, RENDERER_EPOCH) + }) + + it('lands the tab when the authoritative census re-delivers the same frame', () => { + const dropped = replayUntilDrop() + expect(chatTabs(dropped)).toEqual([]) + + const repaired = applyLocalStructuredSessionTabSnapshots( + dropped, + [frame(RENDERER_EPOCH, 7, 'claude-1')], + undefined, + undefined, + { authoritative: true } + ) + + expect(chatTabs(repaired)).toEqual(['Claude Chat']) + }) + + it('a non-authoritative redelivery stays dropped, so only authority repairs it', () => { + const dropped = replayUntilDrop() + + const redelivered = applyLocalStructuredSessionTabSnapshots(dropped, [ + frame(RENDERER_EPOCH, 7, 'claude-1') + ]) + + expect(chatTabs(redelivered)).toEqual([]) + }) + + it('revives only the epoch authority names, leaving other generations fenced', () => { + const dropped = replayUntilDrop() + applyLocalStructuredSessionTabSnapshots( + dropped, + [frame(RENDERER_EPOCH, 7, 'claude-1')], + undefined, + undefined, + { authoritative: true } + ) + + // The census named the renderer epoch current, so the headless generation it displaced is now + // the retired one — and a delayed frame from it must still be rejected. + const history = localStructuredSessionEpochHistoryByWorktree.get(WORKTREE) + expect(history?.current).toBe(RENDERER_EPOCH) + expect(history?.retired).toContain(HEADLESS_EPOCH) + expect(history?.retired).not.toContain(RENDERER_EPOCH) + }) +}) diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts index af756458707..136e4fa2e30 100644 --- a/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts +++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts @@ -21,9 +21,13 @@ export function restoreLocalStructuredSessionTabsOnce( ) } -/** Fetch the current host inventory even after the startup restore has settled. */ +/** Fetch the current host inventory even after the startup restore has settled. + * + * `authoritative` is opt-in and belongs to the repair lane alone: the startup restore stays + * fenced exactly as before, so nothing about first paint changes. */ export function refreshLocalStructuredSessionTabs( - expectedGeneration = localStructuredSessionGeneration() + expectedGeneration = localStructuredSessionGeneration(), + options: { authoritative?: boolean } = {} ): Promise { return window.api.runtime .call({ method: 'session.tabs.listAll', params: {} }) @@ -34,7 +38,7 @@ export function refreshLocalStructuredSessionTabs( const result = response.result as { snapshots?: RuntimeMobileSessionTabsResult[] } const snapshots = result.snapshots ?? [] if (isCurrentLocalStructuredSessionGeneration(expectedGeneration)) { - applyStructuredSessionTabSnapshots(snapshots) + applyStructuredSessionTabSnapshots(snapshots, undefined, options) } return snapshots }) diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts new file mode 100644 index 00000000000..563a7c3598b --- /dev/null +++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts @@ -0,0 +1,121 @@ +/** + * The repair lane must not become worse than the bug it fixes: a publisher that keeps re-sending a + * retired epoch would otherwise drive an unbounded refetch loop, and a cap that never decays would + * hide a chat tab for the renderer's lifetime after a run of transient RPC failures. + */ + +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { localStructuredSessionEpochHistoryByWorktree } from './inventory-generation-fence' +import { + forgetRetiredEpochRepairsOutside, + resetRetiredEpochRepairsForTests, + scheduleRetiredEpochRepair +} from './retired-epoch-repair' + +const WORKTREE = 'folder:ws-1' +const EPOCH = 'renderer:53c8f87d' + +const runRepair = vi.fn(async (_generation: number) => undefined) + +function markRetired(): void { + localStructuredSessionEpochHistoryByWorktree.set(WORKTREE, { + current: 'headless:pty-backed:x', + retired: [EPOCH] + }) +} + +beforeEach(() => { + vi.useFakeTimers() + runRepair.mockReset() + runRepair.mockImplementation(async () => undefined) + resetRetiredEpochRepairsForTests() + localStructuredSessionEpochHistoryByWorktree.clear() +}) + +afterEach(() => { + resetRetiredEpochRepairsForTests() + localStructuredSessionEpochHistoryByWorktree.clear() + vi.useRealTimers() +}) + +describe('retired-epoch repair scheduling', () => { + it('asks the host once for a burst of drops on one worktree', async () => { + markRetired() + + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + expect(runRepair).not.toHaveBeenCalled() + + await vi.advanceTimersByTimeAsync(300) + + expect(runRepair).toHaveBeenCalledTimes(1) + }) + + it('stops after a bounded number of attempts and says so', async () => { + markRetired() + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + + // The epoch stays retired, so every refresh counts as a failed repair. + for (let attempt = 0; attempt < 6; attempt += 1) { + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + await vi.advanceTimersByTimeAsync(5000) + } + + expect(runRepair).toHaveBeenCalledTimes(3) + expect(warn).toHaveBeenCalledWith( + '[structured-session-tabs] retired publication epoch still unrepaired', + expect.objectContaining({ worktree: WORKTREE, publicationEpoch: EPOCH }) + ) + warn.mockRestore() + }) + + it('decays the cap instead of latching, so a later drop is still repairable', async () => { + markRetired() + vi.spyOn(console, 'warn').mockImplementation(() => {}) + + for (let attempt = 0; attempt < 4; attempt += 1) { + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + await vi.advanceTimersByTimeAsync(5000) + } + expect(runRepair).toHaveBeenCalledTimes(3) + + // A quiet minute later the worktree gets its budget back rather than staying hidden forever. + await vi.advanceTimersByTimeAsync(60_000) + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + await vi.advanceTimersByTimeAsync(300) + + expect(runRepair).toHaveBeenCalledTimes(4) + }) + + it('rearms once a repair actually revives the epoch', async () => { + markRetired() + runRepair.mockImplementation(async () => { + localStructuredSessionEpochHistoryByWorktree.set(WORKTREE, { + current: EPOCH, + retired: ['headless:pty-backed:x'] + }) + }) + + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + await vi.advanceTimersByTimeAsync(300) + expect(runRepair).toHaveBeenCalledTimes(1) + + markRetired() + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + await vi.advanceTimersByTimeAsync(300) + + expect(runRepair).toHaveBeenCalledTimes(2) + }) + + it('forgets repair state for worktrees that no longer exist', async () => { + markRetired() + scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair) + + forgetRetiredEpochRepairsOutside(new Set(['folder:other'])) + await vi.advanceTimersByTimeAsync(5000) + + // The pending refetch for the vanished worktree is cancelled, not merely orphaned. + expect(runRepair).not.toHaveBeenCalled() + }) +}) diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts new file mode 100644 index 00000000000..1916fb21546 --- /dev/null +++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts @@ -0,0 +1,131 @@ +/** + * Repairing a structured session snapshot the retired-epoch fence rejected. + * + * The fence is right to reject a subscription frame carrying a retired epoch — it cannot tell that + * frame apart from a delayed one queued by a dead publisher generation, whose version can be + * higher than the live cursor. What it cannot do is notice when the epoch's publisher is actually + * still alive and has simply returned after another publisher briefly owned the worktree. + * + * So the drop is not treated as final: it schedules one authoritative `session.tabs.listAll`, whose + * answer settles which epoch is current. If the epoch really is dead the census changes nothing; if + * it is live, the census carries it and the tab lands. The fence itself is never relaxed for + * subscription frames. + * + * The refresh is injected rather than imported so this module depends on nothing that in turn + * depends on the snapshot apply — which is what lets the apply prune this module's state. + */ + +import { + isCurrentLocalStructuredSessionGeneration, + localStructuredSessionEpochHistoryByWorktree, + localStructuredSessionGeneration +} from './inventory-generation-fence' + +/** Bounded so a publisher that keeps re-sending a retired epoch cannot drive an endless refetch. */ +const MAX_REPAIR_ATTEMPTS = 3 +const BASE_REPAIR_DELAY_MS = 250 +const MAX_REPAIR_DELAY_MS = 5000 +/** + * The cap decays rather than latching. A run of transient RPC failures must not hide a chat tab for + * the renderer's lifetime; once a worktree has been quiet this long, a fresh drop is a fresh + * problem and gets its full budget back. + */ +const REPAIR_ATTEMPT_DECAY_MS = 60_000 + +type RepairState = { + attempts: number + lastAttemptAt: number + timer: ReturnType | null +} + +export type RetiredEpochRepairRunner = (expectedGeneration: number) => Promise + +const repairsByWorktree = new Map() + +function repairState(worktreeId: string, now: number): RepairState { + const existing = repairsByWorktree.get(worktreeId) + if (!existing) { + const created: RepairState = { attempts: 0, lastAttemptAt: now, timer: null } + repairsByWorktree.set(worktreeId, created) + return created + } + if (now - existing.lastAttemptAt >= REPAIR_ATTEMPT_DECAY_MS) { + existing.attempts = 0 + } + return existing +} + +/** + * Schedules the authoritative refetch for a dropped snapshot, coalescing repeat drops for the same + * worktree into the one already pending. + */ +export function scheduleRetiredEpochRepair( + worktreeId: string, + publicationEpoch: string, + runRepair: RetiredEpochRepairRunner +): void { + const now = Date.now() + const state = repairState(worktreeId, now) + if (state.timer !== null) { + return + } + if (state.attempts >= MAX_REPAIR_ATTEMPTS) { + console.warn('[structured-session-tabs] retired publication epoch still unrepaired', { + worktree: worktreeId, + publicationEpoch, + attempts: state.attempts, + retryAfterMs: Math.max(0, REPAIR_ATTEMPT_DECAY_MS - (now - state.lastAttemptAt)) + }) + return + } + const generation = localStructuredSessionGeneration() + const delay = Math.min(BASE_REPAIR_DELAY_MS * 2 ** state.attempts, MAX_REPAIR_DELAY_MS) + state.attempts += 1 + state.lastAttemptAt = now + state.timer = setTimeout(() => { + state.timer = null + if (!isCurrentLocalStructuredSessionGeneration(generation)) { + repairsByWorktree.delete(worktreeId) + return + } + void runRepair(generation) + .then(() => { + // Why re-check rather than trust the call: a refresh that succeeds without reviving the + // epoch has not repaired anything, and counting it as success would loop forever. + const stillRetired = + localStructuredSessionEpochHistoryByWorktree + .get(worktreeId) + ?.retired.includes(publicationEpoch) ?? false + if (!stillRetired) { + repairsByWorktree.delete(worktreeId) + } + }) + .catch((error) => { + console.warn('[structured-session-tabs] retired-epoch repair refresh failed', error) + }) + }, delay) +} + +/** + * Drops repair state for worktrees that no longer exist, alongside the publisher cursors it + * shadows — without this every deleted worktree leaks an entry for the renderer's lifetime. + */ +export function forgetRetiredEpochRepairsOutside(knownWorktreeIds: ReadonlySet): void { + for (const [worktreeId, state] of repairsByWorktree) { + if (!knownWorktreeIds.has(worktreeId)) { + if (state.timer !== null) { + clearTimeout(state.timer) + } + repairsByWorktree.delete(worktreeId) + } + } +} + +export function resetRetiredEpochRepairsForTests(): void { + for (const state of repairsByWorktree.values()) { + if (state.timer !== null) { + clearTimeout(state.timer) + } + } + repairsByWorktree.clear() +} diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts index fc254de62dc..ad0d99bfeac 100644 --- a/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts +++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts @@ -7,7 +7,9 @@ import { } from '../web-session-tabs-sync' import type { WebSessionTabsSyncState } from '../web-session-tabs-sync' import { + hasRetiredValue, noteRetiredValue, + reviveRetiredValue, sameSessionTabsPublicationLineage } from '../web-session-tabs-sync/publisher-identity-fences' import { @@ -21,16 +23,30 @@ import { localStructuredSessionVersionByWorktree, supersedeLocalStructuredSessionGeneration } from './inventory-generation-fence' +import { forgetRetiredEpochRepairsOutside } from './retired-epoch-repair' import { projectLocalStructuredSessionTabs } from './snapshot-projection' export const LOCAL_STRUCTURED_SESSION_OWNER = 'local-structured-session' +export type StructuredSessionSnapshotApplyOptions = { + /** + * Marks these snapshots as an authoritative `session.tabs.listAll` response, which exempts them + * from the retired-epoch fence. A census is the synchronous answer to a request we just issued, + * so it cannot be the delayed frame from a dead generation that the fence exists to reject — + * whereas a subscription frame can be, and stays fenced. + */ + authoritative?: boolean + /** Called for each snapshot the retired-epoch fence rejects; the repair lane listens here. */ + onRetiredEpochDrop?: (worktreeId: string, publicationEpoch: string) => void +} + export function applyStructuredSessionTabSnapshots( snapshots: readonly RuntimeMobileSessionTabsResult[], - owner = LOCAL_STRUCTURED_SESSION_OWNER + owner = LOCAL_STRUCTURED_SESSION_OWNER, + options: StructuredSessionSnapshotApplyOptions = {} ): void { const settleStructuredSessionMirror = applyWebSessionTabsStorePatch( - (state) => applyLocalStructuredSessionTabSnapshots(state, snapshots, owner), + (state) => applyLocalStructuredSessionTabSnapshots(state, snapshots, owner, undefined, options), { frames: [] } ) settleStructuredSessionMirror() @@ -65,7 +81,8 @@ export function applyLocalStructuredSessionTabSnapshots< state: State, snapshots: readonly RuntimeMobileSessionTabsResult[], owner = LOCAL_STRUCTURED_SESSION_OWNER, - now = Date.now() + now = Date.now(), + options: StructuredSessionSnapshotApplyOptions = {} ): State { let next = state for (const snapshot of snapshots) { @@ -78,8 +95,17 @@ export function applyLocalStructuredSessionTabSnapshots< prior && sameSessionTabsPublicationLineage(prior.publicationEpoch, snapshot.publicationEpoch) ) const epochHistory = localStructuredSessionEpochHistoryByWorktree.get(snapshot.worktree) - if (epochHistory?.retired.includes(snapshot.publicationEpoch) && !sharesLineage) { - continue + // Why not just drop: an epoch is retired whenever another publisher takes over the worktree, + // but a live publisher can return after transient interlopers (a `removed:` retraction, then a + // headless rebuild), and the structured publish inherits the worktree's existing epoch rather + // than minting its own. So a retired epoch is not proof of a dead generation — only authority + // can settle it, and the repair lane goes and asks. + if (hasRetiredValue(epochHistory, snapshot.publicationEpoch) && !sharesLineage) { + if (!options.authoritative) { + options.onRetiredEpochDrop?.(snapshot.worktree, snapshot.publicationEpoch) + continue + } + reviveRetiredValue(epochHistory, snapshot.publicationEpoch) } if (prior && sharesLineage && snapshot.snapshotVersion <= prior.snapshotVersion) { continue @@ -114,5 +140,6 @@ export function applyLocalStructuredSessionTabSnapshots< localStructuredSessionEpochHistoryByWorktree.delete(worktreeId) } } + forgetRetiredEpochRepairsOutside(knownWorktreeIds) return next } diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts index b074cfb1c41..fef55f07a16 100644 --- a/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts +++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts @@ -9,7 +9,20 @@ import { refreshLocalStructuredSessionTabs, restoreLocalStructuredSessionTabsOnce } from './inventory-refresh' -import { applyStructuredSessionTabSnapshots } from './snapshot-apply' +import { scheduleRetiredEpochRepair } from './retired-epoch-repair' +import { + applyStructuredSessionTabSnapshots, + type StructuredSessionSnapshotApplyOptions +} from './snapshot-apply' + +// The refresh is supplied here rather than imported by the repair lane, so nothing the snapshot +// apply depends on depends back on it. +const REPAIR_DROPPED_EPOCHS: StructuredSessionSnapshotApplyOptions = { + onRetiredEpochDrop: (worktreeId, publicationEpoch) => + scheduleRetiredEpochRepair(worktreeId, publicationEpoch, (generation) => + refreshLocalStructuredSessionTabs(generation, { authoritative: true }) + ) +} type SessionTabsEvent = | (RuntimeMobileSessionTabsResult & { type: 'snapshot' | 'updated' }) @@ -84,9 +97,9 @@ export async function startLocalStructuredSessionTabsSync(args: { } const event = response.result as SessionTabsEvent if (event.type === 'snapshots') { - applyStructuredSessionTabSnapshots(event.snapshots) + applyStructuredSessionTabSnapshots(event.snapshots, undefined, REPAIR_DROPPED_EPOCHS) } else if (event.type === 'snapshot' || event.type === 'updated') { - applyStructuredSessionTabSnapshots([event]) + applyStructuredSessionTabSnapshots([event], undefined, REPAIR_DROPPED_EPOCHS) } else if (event.type === 'end' && generation === subscriptionGeneration) { // Reattach with one refresh so a runtime-restart boundary cannot strand stale tabs. subscriptionGeneration += 1 diff --git a/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts b/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts index 96ebe2293c6..fbab01b591b 100644 --- a/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts +++ b/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts @@ -36,6 +36,19 @@ export function noteRetiredValue( return history } +/** + * Un-retires one value, leaving every other retired generation fenced. + * + * Only an authority that names the value current may call this; reviving on a delayed frame's own + * say-so is exactly the resurrection `retired` exists to prevent. + */ +export function reviveRetiredValue(history: RetiredValueHistory | undefined, value: string): void { + const index = history?.retired.indexOf(value) ?? -1 + if (history && index >= 0) { + history.retired.splice(index, 1) + } +} + function normalizeSessionTabsRuntimeId(runtimeId: unknown): string | undefined { if (typeof runtimeId !== 'string') { return undefined diff --git a/src/renderer/src/startup/startup-ssh-connection-restore.test.ts b/src/renderer/src/startup/startup-ssh-connection-restore.test.ts index 3464816d0d8..3f74655454a 100644 --- a/src/renderer/src/startup/startup-ssh-connection-restore.test.ts +++ b/src/renderer/src/startup/startup-ssh-connection-restore.test.ts @@ -146,6 +146,7 @@ describe('restoreSshConnectionsForStartup', () => { }) it('does not push a connected background target back into the deferred list', async () => { + vi.useFakeTimers() installWindowApi([target('ssh-active'), target('ssh-bg')]) // The active host never answers and times out; the background host connects first. harness.connect.mockImplementation((targetId: string) => @@ -154,7 +155,7 @@ describe('restoreSshConnectionsForStartup', () => { : new Promise(() => {}) ) - await restoreSshConnectionsForStartup({ + const restore = restoreSshConnectionsForStartup({ connectionIds: ['ssh-active', 'ssh-bg'], blockingConnectionIds: ['ssh-active'], setDeferredSshReconnectTargets: harness.setDeferredSshReconnectTargets, @@ -162,11 +163,14 @@ describe('restoreSshConnectionsForStartup', () => { publishSshConnectionState: harness.publishSshConnectionState }) + await vi.advanceTimersByTimeAsync(15_000) + await restore + expect(harness.removeDeferredSshReconnectTarget).toHaveBeenCalledWith('ssh-bg') // The timed-out rewrite must not resurrect the reachable background target: a deferred // connected target sends fresh panes down the cold-restore path instead of the normal one. expect(harness.setDeferredSshReconnectTargets).toHaveBeenLastCalledWith(['ssh-active']) - }, 30_000) + }) it('keeps passphrase targets deferred and never dials them', async () => { installWindowApi([target('ssh-key', true), target('ssh-bg')]) diff --git a/src/renderer/src/store/slices/tab-group-reference-repair.test.ts b/src/renderer/src/store/slices/tab-group-reference-repair.test.ts new file mode 100644 index 00000000000..a7cb3dca125 --- /dev/null +++ b/src/renderer/src/store/slices/tab-group-reference-repair.test.ts @@ -0,0 +1,54 @@ +import { describe, expect, it } from 'vitest' +import type { TabGroup } from '../../../../shared/tab-types' +import { appendOwnedTabIdsToGroups } from './tab-group-reference-repair' + +function group(id: string, tabOrder: string[]): TabGroup { + return { id, worktreeId: 'workspace', activeTabId: null, tabOrder, recentTabIds: [] } +} + +describe('appendOwnedTabIdsToGroups', () => { + it('preserves existing order, duplicates, and untouched group identities', () => { + const complete = group('complete', ['b', 'a', 'a']) + const missing = group('missing', ['stale', 'c']) + const unowned = group('unowned', ['external']) + const owners = new Map([ + ['a', 'complete'], + ['b', 'complete'], + ['d', 'missing'], + ['c', 'missing'], + ['e', 'missing'], + ['elsewhere', 'absent'] + ]) + const result = appendOwnedTabIdsToGroups([complete, missing, unowned], owners) + expect(result).toEqual([complete, { ...missing, tabOrder: ['stale', 'c', 'd', 'e'] }, unowned]) + expect(result[0]).toBe(complete) + expect(result[2]).toBe(unowned) + expect(missing.tabOrder).toEqual(['stale', 'c']) + }) + + it.each([false, true])('bounds saved-order reads with missing tabs: %s', (missing) => { + const count = 1_000 + const ids = Array.from({ length: count }, (_, i) => `tab-${i}`) + let reads = 0 + const order = new Proxy(ids, { + get(target, property, receiver) { + if (typeof property === 'string' && /^\d+$/.test(property)) { + reads++ + } + return Reflect.get(target, property, receiver) + } + }) + const original = group('group', order) + const ownedIds = missing ? ids.map((id) => `missing-${id}`) : ids + const result = appendOwnedTabIdsToGroups( + [original], + new Map(ownedIds.map((id) => [id, original.id])) + ) + const repairReads = reads + expect(result[0].tabOrder).toEqual(missing ? [...ids, ...ownedIds] : ids) + if (!missing) { + expect(result[0]).toBe(original) + } + expect(repairReads).toBeLessThanOrEqual(count * 2) + }) +}) diff --git a/src/renderer/src/store/slices/tab-group-reference-repair.ts b/src/renderer/src/store/slices/tab-group-reference-repair.ts index 2bf1c468093..77d6dd38c81 100644 --- a/src/renderer/src/store/slices/tab-group-reference-repair.ts +++ b/src/renderer/src/store/slices/tab-group-reference-repair.ts @@ -72,7 +72,8 @@ export function appendOwnedTabIdsToGroups( if (!ownedTabIds) { return group } - const missingTabIds = ownedTabIds.filter((tabId) => !group.tabOrder.includes(tabId)) + const orderedTabIds = new Set(group.tabOrder) + const missingTabIds = ownedTabIds.filter((tabId) => !orderedTabIds.has(tabId)) return missingTabIds.length > 0 ? { ...group, tabOrder: [...group.tabOrder, ...missingTabIds] } : group diff --git a/src/shared/agent-hook-listener/transcript-reader.test.ts b/src/shared/agent-hook-listener/transcript-reader.test.ts new file mode 100644 index 00000000000..83780b08388 --- /dev/null +++ b/src/shared/agent-hook-listener/transcript-reader.test.ts @@ -0,0 +1,70 @@ +import { describe, expect, it } from 'vitest' +import { findLastExtractedTranscriptLineText } from './transcript-reader' +import { extractAssistantTextFromLine } from './transcript-entry-text' + +function expectedLines(text: string): string[] { + return text + .split('\n') + .toReversed() + .map((line) => line.trim()) + .filter((line) => line.length > 0) +} + +describe('backward transcript line extraction', () => { + it.each(['', '\n', '\n\n', '\r\n', ' \t\r\n', '\na\n', 'a\nb', '😀\r\n漢字'])( + 'visits each nonblank line once in reverse order for %j', + (text) => { + const seen: string[] = [] + expect( + findLastExtractedTranscriptLineText(text, (line) => { + seen.push(line) + return undefined + }) + ).toBeUndefined() + expect(seen).toEqual(expectedLines(text)) + } + ) + + it('preserves line order and early return across generated delimiters', () => { + let seed = 29 + const fragments = ['a', '\n', '\r\n', ' ', '\t', '😀', '\u2028', '\0'] + for (let sample = 0; sample < 1000; sample++) { + let text = '' + for (let i = 0; i < sample % 100; i++) { + seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0 + text += fragments[seed % fragments.length] + } + const lines = expectedLines(text) + const stop = sample % (lines.length + 1) + const seen: string[] = [] + const result = findLastExtractedTranscriptLineText(text, (line) => { + seen.push(line) + return seen.length === stop + 1 ? line : undefined + }) + expect(seen).toEqual(lines.slice(0, stop + 1)) + expect(result).toBe(lines[stop]) + } + }) + + it('returns the newest assistant message behind a long tool line', () => { + const message = JSON.stringify({ role: 'assistant', content: 'latest 😀' }) + const tool = JSON.stringify({ role: 'tool', content: 'x'.repeat(256 * 1024) }) + expect( + findLastExtractedTranscriptLineText( + `\n{"role":"assistant","content":"older"}\r\n${message}\r\n${tool}\n`, + extractAssistantTextFromLine + ) + ).toBe('latest 😀') + }) + + it('treats an empty extracted string as a result and stops before older lines', () => { + const seen: string[] = [] + expect( + findLastExtractedTranscriptLineText('older\nlatest\n', (line) => { + seen.push(line) + return '' + }) + ).toBe('') + expect(seen).toEqual(['latest']) + }) +}) diff --git a/src/shared/agent-hook-listener/transcript-reader.ts b/src/shared/agent-hook-listener/transcript-reader.ts index f9b1472384e..89df71da2df 100644 --- a/src/shared/agent-hook-listener/transcript-reader.ts +++ b/src/shared/agent-hook-listener/transcript-reader.ts @@ -88,10 +88,8 @@ export function findLastExtractedTranscriptLineText( ): string | undefined { let lineEnd = text.length - for (let index = text.length - 1; index >= -1; index--) { - if (index >= 0 && text.charCodeAt(index) !== 10) { - continue - } + while (lineEnd > 0) { + const index = text.lastIndexOf('\n', lineEnd - 1) const line = text.slice(index + 1, lineEnd).trim() if (line.length > 0) { diff --git a/src/shared/browser-network-tunnel-stream-framing.test.ts b/src/shared/browser-network-tunnel-stream-framing.test.ts index 75eb07d0996..621f297a525 100644 --- a/src/shared/browser-network-tunnel-stream-framing.test.ts +++ b/src/shared/browser-network-tunnel-stream-framing.test.ts @@ -55,6 +55,98 @@ describe('browser network tunnel stream framing', () => { ) }) + it.each([1, 2, 3, 16, 256, 4096, 65556])( + 'preserves maximum-size frames split into %i-byte chunks', + (chunkSize) => { + const payload = Uint8Array.from({ length: 65552 }, (_, index) => index % 251) + const encoded = encodeBrowserNetworkTunnelStreamFrame(payload) + const frames: Uint8Array[] = [] + const onError = vi.fn() + const decoder = new BrowserNetworkTunnelStreamFrameDecoder( + (frame) => frames.push(frame), + onError + ) + for (let offset = 0; offset < encoded.length; offset += chunkSize) { + decoder.feed(encoded.subarray(offset, offset + chunkSize)) + } + expect(frames).toEqual([payload]) + expect(onError).not.toHaveBeenCalled() + } + ) + + it('copies fragmented bytes once instead of recopying the growing carry', () => { + const encoded = encodeBrowserNetworkTunnelStreamFrame(new Uint8Array(65536)) + const decoder = new BrowserNetworkTunnelStreamFrameDecoder( + () => {}, + () => {} + ) + const originalSet = Uint8Array.prototype.set + let copiedBytes = 0 + const set = vi + .spyOn(Uint8Array.prototype, 'set') + .mockImplementation(function (this: Uint8Array, source, offset) { + copiedBytes += source.length + originalSet.call(this, source, offset) + }) + try { + for (const byte of encoded) { + decoder.feed(new Uint8Array([byte])) + } + expect(copiedBytes).toBe(encoded.length) + } finally { + set.mockRestore() + } + }) + + it('owns partial input and emitted frames independently of caller buffers', () => { + const frames: Uint8Array[] = [] + const decoder = new BrowserNetworkTunnelStreamFrameDecoder( + (frame) => frames.push(frame), + () => {} + ) + const first = new Uint8Array([0, 0, 0, 3, 1]) + decoder.feed(first) + first.fill(255) + const rest = new Uint8Array([2, 3]) + decoder.feed(rest) + rest.fill(255) + decoder.feed(encodeBrowserNetworkTunnelStreamFrame(new Uint8Array([4]))) + expect(frames).toEqual([new Uint8Array([1, 2, 3]), new Uint8Array([4])]) + }) + + it('enforces the retained cap before decoding complete frames in a feed', () => { + const onFrame = vi.fn() + const onError = vi.fn() + const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError, 16, 8) + decoder.feed(new Uint8Array([0, 0])) + decoder.feed(new Uint8Array([0, 1, 7, 0, 0, 0, 1])) + decoder.feed(new Uint8Array([8])) + expect(onFrame).not.toHaveBeenCalled() + expect(onError).toHaveBeenCalledExactlyOnceWith( + expect.objectContaining({ message: 'browser_tunnel_stream_buffer_overflow' }) + ) + }) + + it('counts the retained header and payload against the exact cap', () => { + const onFrame = vi.fn() + const onError = vi.fn() + const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError, 16, 7) + decoder.feed(new Uint8Array([0, 0, 0, 3, 1])) + decoder.feed(new Uint8Array([2, 3])) + expect(onFrame).toHaveBeenCalledExactlyOnceWith(new Uint8Array([1, 2, 3])) + expect(onError).not.toHaveBeenCalled() + }) + + it('stops decoding coalesced frames when the callback closes the decoder', () => { + const onFrame = vi.fn(() => decoder.close()) + const onError = vi.fn() + const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError) + decoder.feed(new Uint8Array([0, 0, 0, 1, 7, 0, 0, 0, 1, 8])) + decoder.feed(new Uint8Array([0, 0, 0, 1, 9])) + expect(onFrame).toHaveBeenCalledExactlyOnceWith(new Uint8Array([7])) + expect(onError).not.toHaveBeenCalled() + }) + it('serializes writes and rejects bounded queue overflow', () => { const callbacks: ((error?: Error | null) => void)[] = [] const writes: Uint8Array[] = [] diff --git a/src/shared/browser-network-tunnel-stream-framing.ts b/src/shared/browser-network-tunnel-stream-framing.ts index 734a304520c..042224253ee 100644 --- a/src/shared/browser-network-tunnel-stream-framing.ts +++ b/src/shared/browser-network-tunnel-stream-framing.ts @@ -15,7 +15,10 @@ export function encodeBrowserNetworkTunnelStreamFrame(frame: Uint8Array): Uint8A } export class BrowserNetworkTunnelStreamFrameDecoder { - private retained = new Uint8Array() + private readonly header = new Uint8Array(LENGTH_BYTES) + private headerBytes = 0 + private frame: Uint8Array | null = null + private frameBytes = 0 private closed = false constructor( @@ -29,30 +32,50 @@ export class BrowserNetworkTunnelStreamFrameDecoder { if (this.closed || chunk.byteLength === 0) { return } - if (this.retained.byteLength + chunk.byteLength > this.maxRetainedBytes) { + if (this.headerBytes + this.frameBytes + chunk.byteLength > this.maxRetainedBytes) { this.fail(new Error('browser_tunnel_stream_buffer_overflow')) return } - const combined = new Uint8Array(this.retained.byteLength + chunk.byteLength) - combined.set(this.retained) - combined.set(chunk, this.retained.byteLength) let offset = 0 - while (combined.byteLength - offset >= LENGTH_BYTES) { - const length = new DataView( - combined.buffer, - combined.byteOffset + offset, - LENGTH_BYTES - ).getUint32(0, false) - if (length === 0 || length > this.maxFrameBytes) { - this.fail(new Error('browser_tunnel_stream_frame_invalid')) + while (offset < chunk.byteLength) { + if (this.headerBytes < LENGTH_BYTES) { + let length: number + if (this.headerBytes === 0 && chunk.byteLength - offset >= LENGTH_BYTES) { + length = new DataView(chunk.buffer, chunk.byteOffset + offset, LENGTH_BYTES).getUint32( + 0, + false + ) + this.headerBytes = LENGTH_BYTES + offset += LENGTH_BYTES + } else { + const count = Math.min(LENGTH_BYTES - this.headerBytes, chunk.byteLength - offset) + this.header.set(chunk.subarray(offset, offset + count), this.headerBytes) + this.headerBytes += count + offset += count + if (this.headerBytes < LENGTH_BYTES) { + return + } + length = new DataView(this.header.buffer).getUint32(0, false) + } + if (length === 0 || length > this.maxFrameBytes) { + this.fail(new Error('browser_tunnel_stream_frame_invalid')) + return + } + this.frame = new Uint8Array(length) + } + const frame = this.frame! + const count = Math.min(frame.byteLength - this.frameBytes, chunk.byteLength - offset) + frame.set(chunk.subarray(offset, offset + count), this.frameBytes) + this.frameBytes += count + offset += count + if (this.frameBytes < frame.byteLength) { return } - const end = offset + LENGTH_BYTES + length - if (end > combined.byteLength) { - break - } + this.frame = null + this.frameBytes = 0 + this.headerBytes = 0 try { - this.onFrame(combined.slice(offset + LENGTH_BYTES, end)) + this.onFrame(frame) } catch (error) { this.fail(error instanceof Error ? error : new Error(String(error))) return @@ -60,14 +83,14 @@ export class BrowserNetworkTunnelStreamFrameDecoder { if (this.closed) { return } - offset = end } - this.retained = combined.slice(offset) } close(): void { this.closed = true - this.retained = new Uint8Array() + this.frame = null + this.frameBytes = 0 + this.headerBytes = 0 } private fail(error: Error): void { diff --git a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt index 929cc4f10ad..fd8502d8913 100644 --- a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt +++ b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt @@ -176,7 +176,6 @@ src/relay/git-stdout-stream.ts src/relay/preflight-handler.ts src/relay/pty-shell-utils.ts src/relay/subprocess-tree-termination.ts -src/relay/windows-port-scan.ts src/relay/workspace-space-scan.ts src/shared/ephemeral-vm-recipe-process.ts src/shared/ephemeral-vm-recipe-runner.ts @@ -184,5 +183,4 @@ src/shared/fish-binary-requirement.ts src/shared/process-table-snapshot-reader.ts src/shared/pty-slave-line-discipline-echo.ts src/shared/ripgrep-process-availability.ts -src/shared/secure-path-windows-acl.ts src/shared/shell-process-readiness.ts diff --git a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt index a657002a8ff..068f9a8a96f 100644 --- a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt +++ b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt @@ -60,7 +60,6 @@ relay/fs-list-files-fallback-chain.ts relay/git-handler.ts relay/pty-shell-utils.ts relay/subprocess-tree-termination.ts -relay/windows-port-scan.ts relay/workspace-space-scan.ts shared/fish-binary-requirement.ts shared/process-table-snapshot-reader.ts diff --git a/src/shared/child-process/child-process-import-boundary.test.ts b/src/shared/child-process/child-process-import-boundary.test.ts index 32c6c9d890e..678bc53c4d0 100644 --- a/src/shared/child-process/child-process-import-boundary.test.ts +++ b/src/shared/child-process/child-process-import-boundary.test.ts @@ -29,7 +29,7 @@ const CHILD_PROCESS_IMPORT_ALLOWLIST: readonly string[] = readFileSync( * May only ever be DECREASED, and only by migrating a file off * `node:child_process`. Raising it is never the fix. */ -const DIRECT_IMPORTER_PIN = 158 +const DIRECT_IMPORTER_PIN = 157 const IMPORT_PATTERN = /(?:from\s+['"]node:child_process['"]|from\s+['"]child_process['"]|require\(\s*['"]node:child_process['"]|require\(\s*['"]child_process['"])/ diff --git a/src/shared/child-process/windows-console-visibility.test.ts b/src/shared/child-process/windows-console-visibility.test.ts index 596728fa245..f135fc10555 100644 --- a/src/shared/child-process/windows-console-visibility.test.ts +++ b/src/shared/child-process/windows-console-visibility.test.ts @@ -34,7 +34,7 @@ const ALLOWLIST: readonly string[] = readAllowlist( * the allowlist does not bound this: a swap (one file fixed and delisted, one * new file added with its entry) satisfies both membership assertions. */ -const UNHIDDEN_SPAWNER_PIN = 66 +const UNHIDDEN_SPAWNER_PIN = 65 const CHILD_PROCESS_IMPORT = /from\s+['"](?:node:)?child_process['"]|require\(\s*['"](?:node:)?child_process['"]/ diff --git a/src/shared/child-process/windows-system-binary.ts b/src/shared/child-process/windows-system-binary.ts index f74b8fa7200..1efeef50c79 100644 --- a/src/shared/child-process/windows-system-binary.ts +++ b/src/shared/child-process/windows-system-binary.ts @@ -1,4 +1,7 @@ -import { join } from 'node:path' +// Why win32 and not the host `join`: these are Windows paths and are only ever spawned on Windows, +// but they are also built off-platform (tests, and any code that plans a Windows command from a +// POSIX host), where the host separator produces the mixed `C:\Windows/System32/whoami.exe`. +import { win32 as pathWin32 } from 'node:path' /** * Absolute paths for the Windows system binaries Orca shells out to. @@ -17,12 +20,12 @@ function systemRoot(env: NodeJS.ProcessEnv = process.env): string { } export function windowsPowerShellPath(env: NodeJS.ProcessEnv = process.env): string { - return join(systemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') + return pathWin32.join(systemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') } export function windowsSystem32Binary( fileName: string, env: NodeJS.ProcessEnv = process.env ): string { - return join(systemRoot(env), 'System32', fileName) + return pathWin32.join(systemRoot(env), 'System32', fileName) } diff --git a/src/shared/quick-open-filter.test.ts b/src/shared/quick-open-filter.test.ts index 1d96bc1744f..c481a1e8854 100644 --- a/src/shared/quick-open-filter.test.ts +++ b/src/shared/quick-open-filter.test.ts @@ -102,6 +102,43 @@ describe('buildExcludePathPrefixes', () => { }) describe('shouldExcludeQuickOpenRelPath', () => { + it('matches the original filter across boundary and Unicode path combinations', () => { + const paths = [ + '', + '/', + 'a', + 'a/', + 'a//', + 'ab', + 'a/b', + 'a\\b', + 'A/b', + '界/😀', + '界/😀x', + 'a[1]/x', + 'a./x' + ] + for (const prefix of paths) { + for (const relPath of paths) { + const expected = + relPath === prefix || (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) + expect(shouldExcludeQuickOpenRelPath(relPath, [prefix])).toBe(expected) + } + } + }) + + it('preserves normalized Windows and UNC exclusion boundaries', () => { + for (const [root, excluded] of [ + ['C:\\Repo', 'C:\\Repo\\trees\\one'], + ['\\\\server\\share\\repo', '\\\\server\\share\\repo\\trees\\one'] + ]) { + const prefixes = buildExcludePathPrefixes(root, [excluded]) + expect(prefixes).toEqual(['trees/one']) + expect(shouldExcludeQuickOpenRelPath('trees/one/file.ts', prefixes)).toBe(true) + expect(shouldExcludeQuickOpenRelPath('trees/one-more/file.ts', prefixes)).toBe(false) + } + }) + it('matches exact and boundary paths only', () => { expect(shouldExcludeQuickOpenRelPath('packages/app', ['packages/app'])).toBe(true) expect(shouldExcludeQuickOpenRelPath('packages/app/x.ts', ['packages/app'])).toBe(true) diff --git a/src/shared/quick-open-filter.ts b/src/shared/quick-open-filter.ts index 9d5bebd80b3..b7592657a11 100644 --- a/src/shared/quick-open-filter.ts +++ b/src/shared/quick-open-filter.ts @@ -119,7 +119,7 @@ export function shouldExcludeQuickOpenRelPath( if (relPath === prefix) { return true } - if (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) { + if (relPath[prefix.length] === '/' && relPath.startsWith(prefix)) { return true } } diff --git a/src/shared/relay-frame-buffer.test.ts b/src/shared/relay-frame-buffer.test.ts new file mode 100644 index 00000000000..55dd744e57a --- /dev/null +++ b/src/shared/relay-frame-buffer.test.ts @@ -0,0 +1,69 @@ +import { describe, expect, it, vi } from 'vitest' +import { RelayFrameBuffer } from './relay-frame-buffer' + +describe('RelayFrameBuffer', () => { + it('preserves a byte stream across fragmented peeks, takes, discards and drains', () => { + const buffer = new RelayFrameBuffer() + let expected = Buffer.alloc(0) + for (let step = 0; step < 5000; step += 1) { + const chunk = Buffer.from([step % 256, (step + 1) % 256, (step + 2) % 256]) + buffer.append(chunk) + expected = Buffer.concat([expected, chunk]) + if (step % 3 === 0) { + const count = Math.min(expected.length, 5) + expect(buffer.peek(count).subarray(0, count)).toEqual(expected.subarray(0, count)) + expect(buffer.take(count)).toEqual(expected.subarray(0, count)) + expected = expected.subarray(count) + } + if (step % 7 === 0) { + const count = Math.min(expected.length, 4) + buffer.discard(count) + expected = expected.subarray(count) + } + if (step % 101 === 0) { + expect(buffer.drain()).toEqual(expected) + expected = Buffer.alloc(0) + } + expect(buffer.length).toBe(expected.length) + } + expect(buffer.drain()).toEqual(expected) + expect(buffer.drain()).toEqual(Buffer.alloc(0)) + }) + + it('releases consumed references and amortizes storage compaction in a large backlog', () => { + const buffer = new RelayFrameBuffer() + const chunks = Array.from({ length: 32768 }, (_, index) => Buffer.from([index % 256])) + for (const chunk of chunks) { + buffer.append(chunk) + } + const shifted = vi.spyOn(Array.prototype, 'shift') + let shiftCount: number + try { + buffer.discard(16000) + shiftCount = shifted.mock.calls.length + } finally { + shifted.mockRestore() + } + expect(shiftCount).toBe(0) + const storage = buffer as unknown as { chunks: (Buffer | undefined)[]; head: number } + expect(storage.chunks.slice(0, storage.head).every((chunk) => chunk === undefined)).toBe(true) + expect(buffer.take(1000)).toEqual(Buffer.concat(chunks.slice(16000, 17000))) + expect(storage.chunks.length).toBeLessThan(chunks.length) + expect(buffer.drain()).toEqual(Buffer.concat(chunks.slice(17000))) + expect(storage.chunks).toHaveLength(0) + expect(buffer.length).toBe(0) + }) + + it('keeps single-chunk views and clears partial data before reuse', () => { + const buffer = new RelayFrameBuffer() + const chunk = Buffer.from('abcdef') + buffer.append(chunk) + expect(buffer.peek(2)).toBe(chunk) + const taken = buffer.take(2) + expect(taken.buffer).toBe(chunk.buffer) + expect(taken.toString()).toBe('ab') + buffer.clear() + buffer.append(Buffer.from('fresh')) + expect(buffer.drain().toString()).toBe('fresh') + }) +}) diff --git a/src/shared/relay-frame-buffer.ts b/src/shared/relay-frame-buffer.ts index 5083804f1e1..a851426c6d8 100644 --- a/src/shared/relay-frame-buffer.ts +++ b/src/shared/relay-frame-buffer.ts @@ -1,5 +1,6 @@ export class RelayFrameBuffer { - private chunks: Buffer[] = [] + private chunks: (Buffer | undefined)[] = [] + private head = 0 private bytes = 0 get length(): number { @@ -13,23 +14,28 @@ export class RelayFrameBuffer { clear(): void { this.chunks = [] + this.head = 0 this.bytes = 0 } drain(): Buffer { - const out = this.chunks.length === 1 ? this.chunks[0] : Buffer.concat(this.chunks, this.bytes) + const out = + this.chunks.length - this.head === 1 + ? this.chunks[this.head]! + : Buffer.concat(this.chunks.slice(this.head) as Buffer[], this.bytes) this.clear() return out } peek(count: number): Buffer { - const first = this.chunks[0] + const first = this.chunks[this.head]! if (first.length >= count) { return first } const out = Buffer.allocUnsafe(count) let copied = 0 - for (const part of this.chunks) { + for (let index = this.head; index < this.chunks.length; index += 1) { + const part = this.chunks[index]! copied += part.copy(out, copied, 0, Math.min(part.length, count - copied)) if (copied >= count) { break @@ -39,43 +45,56 @@ export class RelayFrameBuffer { } take(count: number): Buffer { - const first = this.chunks[0] + const first = this.chunks[this.head]! if (first.length === count) { - this.chunks.shift() + this.removeHead() this.bytes -= count return first } if (first.length > count) { - this.chunks[0] = first.subarray(count) + this.chunks[this.head] = first.subarray(count) this.bytes -= count return first.subarray(0, count) } const out = Buffer.allocUnsafe(count) let copied = 0 while (copied < count) { - const part = this.chunks[0] + const part = this.chunks[this.head]! const take = Math.min(part.length, count - copied) part.copy(out, copied, 0, take) copied += take if (take === part.length) { - this.chunks.shift() + this.removeHead() } else { - this.chunks[0] = part.subarray(take) + this.chunks[this.head] = part.subarray(take) } } this.bytes -= count return out } + private removeHead(): void { + this.chunks[this.head] = undefined + this.head += 1 + // Amortize compaction without retaining consumed buffers. + if ( + this.head === this.chunks.length || + (this.head >= 1024 && this.head * 2 >= this.chunks.length) + ) { + this.chunks = this.chunks.slice(this.head) + this.head = 0 + } + } + discard(count: number): void { let remaining = count while (remaining > 0) { - const part = this.chunks[0] + const part = this.chunks[this.head]! if (part.length <= remaining) { - this.chunks.shift() + this.removeHead() remaining -= part.length } else { - this.chunks[0] = part.subarray(remaining) + this.chunks[this.head] = part.subarray(remaining) remaining = 0 } } diff --git a/src/shared/secure-file.test.ts b/src/shared/secure-file.test.ts index d7b7e9e4415..2439c6d2137 100644 --- a/src/shared/secure-file.test.ts +++ b/src/shared/secure-file.test.ts @@ -1,24 +1,73 @@ -import { execFile, execFileSync } from 'node:child_process' import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { runProcess, runProcessSync } from './child-process/run-process' +import { mayAttemptHardening } from './secure-path-hardening-retry-budget' import { __getSecureFileHardeningCacheStateForTests, __resetSecureFileHardenedPathsForTests, __resetSecureFileWindowsUserSidForTests, hardenExistingSecureFile, hardenSecurePath, + isUnreadableError, writeSecureFile } from './secure-file' const posixModeIt = process.platform === 'win32' ? it.skip : it -vi.mock('child_process', () => ({ - execFileSync: vi.fn(), - execFile: vi.fn() +vi.mock('./child-process/run-process', () => ({ + runProcess: vi.fn(), + runProcessSync: vi.fn() })) +const OK = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false } +const USER_SID = 'S-1-5-21-1000' + +type FakeSpec = { program: string; args?: readonly string[] } + +/** Paths the fake considers already hardened, with the ACE flags the grant pass used. */ +const hardenedByFake = new Map() + +/** Paths whose verify pass should answer with a DACL that is not the intended one. */ +const forcedBadSddl = new Map() + +/** + * Stands in for icacls. `/save` really writes a UTF-16LE SDDL file, because the code under test + * reads that file back off disk — which also means these tests exercise the real SDDL parser + * rather than a restatement of it. + */ +function fakeIcacls(spec: FakeSpec): typeof OK { + const args = spec.args ?? [] + const path = args[0] ?? '' + const grantIndex = args.indexOf('/grant:r') + if (grantIndex !== -1) { + const grant = args[grantIndex + 1]! + hardenedByFake.set(path, grant.includes('(OI)(CI)') ? 'OICI' : '') + return OK + } + const saveIndex = args.indexOf('/save') + if (saveIndex === -1) { + return OK // /reset + } + writeFileSync(args[saveIndex + 1]!, fakeSddl(path), 'utf16le') + return OK +} + +function fakeSddl(path: string): string { + const forced = forcedBadSddl.get(path) + if (forced) { + return `name\r\n${forced}\r\n` + } + const aceFlags = hardenedByFake.get(path) + if (aceFlags === undefined) { + // Never hardened: the inherited DACL a fresh file carries, so the first verify must fail. + return `name\r\nD:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;${USER_SID})\r\n` + } + const ace = (sid: string): string => `(A;${aceFlags};FA;;;${sid})` + return `name\r\nD:PAI${ace('BA')}${ace('SY')}${ace(USER_SID)}\r\n` +} + describe('hardenSecurePath', () => { const originalSystemRoot = process.env.SystemRoot const originalWindir = process.env.WINDIR @@ -30,24 +79,19 @@ describe('hardenSecurePath', () => { delete process.env.WINDIR __resetSecureFileWindowsUserSidForTests() __resetSecureFileHardenedPathsForTests() - vi.mocked(execFileSync).mockReset() - vi.mocked(execFile).mockReset() - // execFileSync handles whoami.exe (SID lookup) and the SYNCHRONOUS PowerShell file-ACL - // path used by writeSecureFile. The directory + read-path re-harden use async execFile. - vi.mocked(execFileSync).mockImplementation((file) => { - if (file === 'C:\\Windows\\System32\\whoami.exe') { - return '"USER","S-1-5-21-1000"' + vi.mocked(runProcessSync).mockReset() + vi.mocked(runProcess).mockReset() + hardenedByFake.clear() + forcedBadSddl.clear() + // runProcessSync serves whoami.exe (SID lookup) and the SYNCHRONOUS icacls file-ACL path + // used by writeSecureFile. Directory + read-path re-hardens use async runProcess. + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program === 'C:\\Windows\\System32\\whoami.exe') { + return { ...OK, stdout: `"USER","${USER_SID}"` } } - // Synchronous PowerShell ACL apply succeeds (returns empty stdout). - return '' - }) - // Directory + read-path PowerShell is called asynchronously; simulate immediate success - vi.mocked(execFile).mockImplementation((_file, _args, _opts, callback) => { - if (typeof callback === 'function') { - callback(null, '', '') - } - return {} as ReturnType + return fakeIcacls(spec) }) + vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec))) }) afterEach(() => { @@ -71,64 +115,358 @@ describe('hardenSecurePath', () => { } }) - it('rewrites Windows ACLs through the system PowerShell path', () => { + it('rewrites Windows ACLs through icacls, purging explicit ACEs before granting', async () => { hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', { isDirectory: false, platform: 'win32' }) + await flushAsyncAcl() // whoami.exe called synchronously to obtain SID - expect(execFileSync).toHaveBeenNthCalledWith( - 1, - 'C:\\Windows\\System32\\whoami.exe', - ['/user', '/fo', 'csv', '/nh'], - expect.objectContaining({ encoding: 'utf-8' }) - ) - // PowerShell called asynchronously - const [powershellFile, powershellArgs, powershellOptions] = vi.mocked(execFile).mock.calls[0]! - expect(powershellFile).toBe('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe') - expect(powershellArgs).toEqual( - expect.arrayContaining([ - '-NoProfile', - '-NonInteractive', - '-ExecutionPolicy', - 'Bypass', - 'C:\\Users\\me\\.orca\\secret.json', - 'S-1-5-21-1000', - '0' - ]) - ) - const script = (powershellArgs as string[])[5]! - expect(script).toContain('SetAccessRuleProtection($true, $false)') - expect(script).toContain('RemoveAccessRuleSpecific') - expect(script).toContain('Unexpected ACL entry') - expect(powershellOptions).toEqual(expect.objectContaining({ windowsHide: true, timeout: 5000 })) - }) - - it('adds inheritable rules when hardening a Windows directory', () => { - hardenSecurePath('C:\\Users\\me\\.orca', { isDirectory: true, platform: 'win32' }) - - const powershellArgs = vi.mocked(execFile).mock.calls[0]![1] as string[] - expect(powershellArgs.at(-1)).toBe('1') - expect(powershellArgs[5]).toContain('ContainerInherit') - expect(powershellArgs[5]).toContain('ObjectInherit') - }) - - it('keeps Windows hardening best-effort when ACL rewriting fails', () => { - // Simulate async PowerShell failure — the callback receives an error - vi.mocked(execFile).mockImplementationOnce((_file, _args, _opts, callback) => { - if (typeof callback === 'function') { - callback(new Error('access denied'), '', '') - } - return {} as ReturnType + expect(vi.mocked(runProcessSync).mock.calls[0]![0]).toMatchObject({ + program: 'C:\\Windows\\System32\\whoami.exe', + args: ['/user', '/fo', 'csv', '/nh'] }) + const specs = vi.mocked(runProcess).mock.calls.map(([spec]) => spec) + expect(specs.every((spec) => spec.program === 'C:\\Windows\\System32\\icacls.exe')).toBe(true) + // Verify runs first, so an already-correct DACL is never rewritten. + expect(specs[0]!.args?.slice(0, 2)).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/save']) + expect(specs[1]!.args).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/reset', '/q']) + expect(specs[2]!.args).toEqual([ + 'C:\\Users\\me\\.orca\\secret.json', + '/inheritance:r', + '/grant:r', + `*${USER_SID}:(F)`, + '/grant:r', + '*S-1-5-18:(F)', + '/grant:r', + '*S-1-5-32-544:(F)', + '/q' + ]) + // The apply is read back: a loosened ACL has to be detectable, not just overwritten. + expect(specs[3]!.args?.slice(0, 2)).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/save']) + expect(specs[2]!.timeoutMs).toBe(5000) + }) + + // BLOCKING 1: re-running /reset on an already-correct DACL restores the inherited (broader) one + // for the few ms until the grant pass lands, for no gain. A correct DACL must be left alone. + it('leaves an already-correct ACL untouched instead of rewriting it', async () => { + const target = 'C:\\Users\\me\\.orca\\secret.json' + hardenedByFake.set(target, '') + + hardenSecurePath(target, { isDirectory: false, platform: 'win32' }) + await flushAsyncAcl() + + const specs = vi.mocked(runProcess).mock.calls.map(([spec]) => spec) + expect(specs).toHaveLength(1) + expect(specs[0]!.args).toContain('/save') + expect(specs.some((spec) => spec.args?.includes('/reset'))).toBe(false) + expect(specs.some((spec) => spec.args?.includes('/grant:r'))).toBe(false) + }) + + // BLOCKING 3: the verify pass must check *identity*, not just rule count, inheritance and rights. + // Granting Everyone full control satisfies all three of those and is the failure it exists for. + it.each([ + ['full control to Everyone', 'D:PAI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;WD)', 'S-1-1-0'], + ['a deny rule', `D:PAI(D;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'unexpected D rule'], + ['an unprotected DACL', `D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'not protected'], + [ + 'a surviving inherited rule', + `D:PAI(A;ID;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, + 'inherited' + ], + ['read-only rights', `D:PAI(A;;FR;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'not full control'] + ])('rejects a verified DACL granting %s', async (_label, sddl, expected) => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const target = 'C:\\Users\\me\\.orca\\secret.json' + forcedBadSddl.set(target, sddl) + + hardenSecurePath(target, { isDirectory: false, platform: 'win32' }) + await flushAsyncAcl() + + expect(warn).toHaveBeenCalledWith( + '[secure-path.windows-acl] failed to restrict path', + expect.objectContaining({ + stage: 'verify', + detail: expect.stringContaining(expected) + }) + ) + warn.mockRestore() + }) + + /** + * Evicting the cache on every failed apply is the #4901 storm wearing a different hat: the env + * store re-hardens on the *read* path at ~2/s, so on a host where hardening legitimately cannot + * work (FAT32, network path, restricted token) that is two icacls spawns and two warnings a + * second, forever. + * + * The curve itself is pinned in secure-path-hardening-retry-budget.test.ts; what matters here is + * that the read path is actually wired to it. + */ + it('collapses a failing read-path poll to a single attempt', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + const targetPath = writeFailingHardenTarget() + + for (let read = 0; read < 25; read++) { + hardenExistingSecureFile(targetPath) + await flushAsyncAcl() + } + + expect(attemptsFor(targetPath)).toHaveLength(1) + warn.mockRestore() + }) + + /** + * A budget that expires rather than latching: three transient failures used to abandon a path + * for the life of the process, so one AV scan or momentary lock left every later credential + * write unprotected on a host where hardening would now succeed. + */ + it('re-probes a long-failing path once its backoff has elapsed', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + const targetPath = writeFailingHardenTarget() + let clock = performance.now() + const now = vi.spyOn(performance, 'now').mockImplementation(() => clock) + + // A day of failing, well past any fixed cap, stepping by more than the 30-minute ceiling. + for (let step = 0; step < 48; step++) { + hardenExistingSecureFile(targetPath) + await flushAsyncAcl() + clock += 31 * 60_000 + } + + expect(attemptsFor(targetPath)).toHaveLength(48) + now.mockRestore() + warn.mockRestore() + }) + + it('reports recovery when a previously throttled path hardens again', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const info = vi.spyOn(console, 'info').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + const targetPath = writeFailingHardenTarget() + let clock = performance.now() + const now = vi.spyOn(performance, 'now').mockImplementation(() => clock) + + // Three failures to reach the announced degraded state, each past its own backoff. + for (const wait of [0, 61_000, 121_000]) { + clock += wait + hardenExistingSecureFile(targetPath) + await flushAsyncAcl() + } + expect(throttleReports(warn, targetPath)).toHaveLength(1) + + // The transient condition clears; the next re-probe must notice. + clock += 5 * 60_000 + vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec))) + hardenExistingSecureFile(targetPath) + await flushAsyncAcl() + + expect(info).toHaveBeenCalledWith( + '[secure-path.windows-acl] path hardening recovered', + expect.objectContaining({ targetPath, stage: 'recovered' }) + ) + now.mockRestore() + info.mockRestore() + warn.mockRestore() + }) + + /** + * The write path is exempt from the budget, but it was also invisible to it: a successful write + * left the failure record standing, so the read path went on backing off for up to 30 minutes + * after the host had demonstrably recovered, and no `recovered` transition came from this lane. + */ + it('clears the read-path backoff when the exempt write path succeeds', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + const info = vi.spyOn(console, 'info').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + const targetPath = writeFailingHardenTarget() + let clock = performance.now() + const now = vi.spyOn(performance, 'now').mockImplementation(() => clock) + + // Three read-path failures: the path is throttled and its next re-probe is minutes away. + for (const wait of [0, 61_000, 121_000]) { + clock += wait + hardenExistingSecureFile(targetPath) + await flushAsyncAcl() + } + expect(mayAttemptHardening(targetPath)).toBe(false) + + // The host recovers and a credential is written. The synchronous apply succeeds (runProcessSync + // was never made to fail), so the read path must stop backing off. + writeSecureFile(targetPath, 'contents') + + expect(mayAttemptHardening(targetPath)).toBe(true) + expect(info).toHaveBeenCalledWith( + '[secure-path.windows-acl] path hardening recovered', + expect.objectContaining({ targetPath, stage: 'recovered' }) + ) + now.mockRestore() + info.mockRestore() + warn.mockRestore() + }) + + /** + * The SID lookup's own one-minute latch, which is the read-path budget's twin and strictly + * worse: a failed lookup makes the plan null, disabling the *synchronous write* path too — so + * the write-path exemption that recovers the budget cannot recover this. Measured against the + * wall clock, a backwards step held it shut for the whole length of the step. + */ + it('re-probes the user SID after a backwards clock step', () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + let clock = performance.now() + const now = vi.spyOn(performance, 'now').mockImplementation(() => clock) + let wallClock = Date.parse('2026-01-01T00:00:00Z') + const wallNow = vi.spyOn(Date, 'now').mockImplementation(() => wallClock) + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) + tempDirs.push(userDataPath) + const targetPath = join(userDataPath, 'secret.json') + let sidLookupFails = true + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program === 'C:\\Windows\\System32\\whoami.exe') { + return sidLookupFails ? { ...OK, code: 1 } : { ...OK, stdout: `"USER","${USER_SID}"` } + } + return fakeIcacls(spec) + }) + + // No SID, so no plan, so hardening is off entirely — not merely throttled. + expect(writeSecureFile(targetPath, 'first')).toBe(false) + + // A minute of real time passes while the wall clock steps back a year. + clock += 61_000 + wallClock -= 365 * 24 * 60 * 60_000 + sidLookupFails = false + + expect(writeSecureFile(targetPath, 'second')).toBe(true) + wallNow.mockRestore() + now.mockRestore() + warn.mockRestore() + }) + + // Scoped to one path: the parent directory is hardened too, and reports its own transition. + function throttleReports(warn: ReturnType, targetPath: string): unknown[] { + return warn.mock.calls.filter((call) => { + const entry = call[1] as { stage?: string; targetPath?: string } | undefined + return entry?.stage === 'throttled' && entry.targetPath === targetPath + }) + } + + function writeFailingHardenTarget(): string { + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) + tempDirs.push(userDataPath) + const targetPath = join(userDataPath, 'secret.json') + writeFileSync(targetPath, '{}') + vi.mocked(runProcess).mockResolvedValue({ ...OK, code: 5, stderr: 'Access is denied.' }) + return targetPath + } + + function attemptsFor(targetPath: string): { args?: readonly string[] }[] { + return getHardenAclCalls().filter((spec) => getAclTarget(spec) === targetPath) + } + + // /c makes icacls exit 0 while printing "Failed processing 1 files" — a silent no-op by another route. + it('never passes the icacls /c continue-on-error flag', async () => { + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) + tempDirs.push(userDataPath) + // Cover both runners: the write path is synchronous, the directory re-harden is not. + writeSecureFile(join(userDataPath, 'secret.json'), 'contents') + hardenSecurePath('C:\\Users\\me\\.orca\\other.json', { + isDirectory: false, + platform: 'win32' + }) + await flushAsyncAcl() + + const specs = [ + ...vi.mocked(runProcess).mock.calls.map(([spec]) => spec), + ...vi.mocked(runProcessSync).mock.calls.map(([spec]) => spec) + ] + expect(specs.length).toBeGreaterThan(4) + for (const spec of specs) { + expect(spec.args).not.toContain('/c') + } + }) + + it('adds inheritable rules when hardening a Windows directory', async () => { + hardenSecurePath('C:\\Users\\me\\.orca', { isDirectory: true, platform: 'win32' }) + await flushAsyncAcl() + + const grantArgs = vi + .mocked(runProcess) + .mock.calls.map(([spec]) => spec.args as string[]) + .find((args) => args.includes('/grant:r'))! + expect(grantArgs).toContain(`*${USER_SID}:(OI)(CI)(F)`) + expect(grantArgs).toContain('*S-1-5-18:(OI)(CI)(F)') + }) + + it('keeps Windows hardening best-effort when ACL rewriting fails', async () => { + vi.mocked(runProcess).mockRejectedValue(new Error('access denied')) + expect(() => hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', { isDirectory: false, platform: 'win32' }) ).not.toThrow() + await expect(flushAsyncAcl()).resolves.toBeUndefined() + }) + + // The old PowerShell command line never reached the grant step at all, so a failure had to be + // visible somewhere; "best effort" may not mean "undetectable". + it('logs when a Windows ACL apply fails instead of swallowing it', async () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + vi.mocked(runProcess).mockResolvedValue({ ...OK, code: 5, stderr: 'Access is denied.' }) + + hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', { + isDirectory: false, + platform: 'win32' + }) + await flushAsyncAcl() + + expect(warn).toHaveBeenCalledWith( + '[secure-path.windows-acl] failed to restrict path', + expect.objectContaining({ + targetPath: 'C:\\Users\\me\\.orca\\secret.json', + stage: 'reset', + detail: 'Access is denied.' + }) + ) + warn.mockRestore() + }) + + it('reports a failed synchronous ACL apply to the caller and the log', () => { + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}) + Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program === 'C:\\Windows\\System32\\whoami.exe') { + return { ...OK, stdout: '"USER","S-1-5-21-1000"' } + } + return { ...OK, code: 5, stderr: 'Access is denied.' } + }) + const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) + tempDirs.push(userDataPath) + + writeSecureFile(join(userDataPath, 'secret.json'), 'contents') + + expect(warn).toHaveBeenCalledWith( + '[secure-path.windows-acl] failed to restrict path', + expect.objectContaining({ stage: 'reset', detail: 'Access is denied.' }) + ) + warn.mockRestore() + }) + + // Paths past MAX_PATH make icacls report "cannot find the path specified"; the extended prefix is the escape. + it('uses the extended-length prefix for paths past MAX_PATH', async () => { + const longPath = `C:\\Users\\me\\.orca\\${'d'.repeat(300)}\\secret.json` + hardenSecurePath(longPath, { isDirectory: false, platform: 'win32' }) + await flushAsyncAcl() + + for (const [spec] of vi.mocked(runProcess).mock.calls) { + expect(spec.args![0]).toBe(`\\\\?\\${longPath}`) + } }) it('caches successful existing-file hardening within a process', () => { @@ -142,8 +480,8 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(targetPath) // dir hardened once (path-cached), file hardened once (metadata-cached) — 2 total - expect(getPowerShellCalls()).toHaveLength(2) - expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([userDataPath, targetPath]) + expect(getHardenAclCalls()).toHaveLength(2) + expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath, targetPath]) }) it('LRU-evicts Windows file hardening entries and safely re-hardens an evicted path', () => { @@ -165,8 +503,8 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(paths[0]!) - const fileTargets = getPowerShellCalls() - .map(getPowerShellTarget) + const fileTargets = getHardenAclCalls() + .map(getAclTarget) .filter((path) => paths.includes(path)) expect(fileTargets).toEqual([...paths, paths[0]]) expect(__getSecureFileHardeningCacheStateForTests().paths).toMatchObject({ @@ -196,8 +534,8 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(files[0]!) - const directoryTargets = getPowerShellCalls() - .map(getPowerShellTarget) + const directoryTargets = getHardenAclCalls() + .map(getAclTarget) .filter((path) => directories.includes(path)) expect(directoryTargets).toEqual([...directories, directories[0]]) expect(__getSecureFileHardeningCacheStateForTests().directories).toMatchObject({ @@ -218,12 +556,8 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(targetPath) // call 1: dir + file. call 2: dir skipped (path-cached), file re-hardened (new mtime) - expect(getPowerShellCalls()).toHaveLength(3) - expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([ - userDataPath, - targetPath, - targetPath - ]) + expect(getHardenAclCalls()).toHaveLength(3) + expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath, targetPath, targetPath]) }) it('keeps post-rename target hardening on every write while caching the directory', () => { @@ -236,19 +570,19 @@ describe('hardenSecurePath', () => { writeSecureFile(targetPath, 'second') // The DIRECTORY is hardened async + path-cached: exactly once across both writes. - const asyncTargets = getPowerShellCalls().map(getPowerShellTarget) + const asyncTargets = getHardenAclCalls().map(getAclTarget) expect(asyncTargets).toEqual([userDataPath]) // The credential FILES (tmpFile + renamed target) are hardened SYNCHRONOUSLY on each write. // write 1: tmpFile(1) + targetFile(1) = 2; write 2: tmpFile(1) + targetFile(1) = 2; total 4. - const syncTargets = getSyncPowerShellCalls().map(getPowerShellTarget) + const syncTargets = getSyncHardenAclCalls().map(getAclTarget) expect(syncTargets).toHaveLength(4) expect(syncTargets.filter((entry) => entry === targetPath)).toHaveLength(2) // No directory should be hardened via the synchronous path. expect(syncTargets.filter((entry) => entry === userDataPath)).toHaveLength(0) }) - // Regression test: #4901 — env-store reads at ~2×/s caused a PowerShell storm because the + // Regression test: #4901 — env-store reads at ~2×/s caused an ACL-spawn storm because the // parent directory mtime churned (every secure write updates it), so the mtime-keyed cache // never matched. Directories must be path-cached for the process lifetime. it('does not re-harden the parent directory when its mtime changes between reads', async () => { @@ -268,9 +602,7 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(targetPath) // The parent directory must be hardened exactly ONCE despite its mtime changing - const dirCalls = getPowerShellCalls().filter( - (call) => getPowerShellTarget(call) === userDataPath - ) + const dirCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === userDataPath) expect(dirCalls).toHaveLength(1) }) @@ -285,27 +617,25 @@ describe('hardenSecurePath', () => { hardenExistingSecureFile(targetPath) hardenExistingSecureFile(targetPath) - const fileCalls = getPowerShellCalls().filter( - (call) => getPowerShellTarget(call) === targetPath - ) + const fileCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === targetPath) expect(fileCalls).toHaveLength(1) }) - it('applies the read-path ACL asynchronously without blocking (async execFile)', () => { + it('applies the read-path ACL asynchronously without blocking (async runProcess)', () => { hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', { isDirectory: false, platform: 'win32' }) - // The default (read/dir) path must launch PowerShell via execFile (async), never sync. - expect(getSyncPowerShellCalls()).toHaveLength(0) - expect(getPowerShellCalls()).toHaveLength(1) + // The default (read/dir) path must launch icacls via runProcess (async), never sync. + expect(getSyncHardenAclCalls()).toHaveLength(0) + expect(getHardenAclCalls()).toHaveLength(1) }) // Security regression guard (#5006 review finding): writeSecureFile must restrict the // credential FILE's ACL SYNCHRONOUSLY before returning. On Windows writeFileSync({mode}) // is a no-op, so an async file ACL would leave the credential briefly readable under the - // parent's inherited (broader) ACL for the ~1-1.5s PowerShell cold-start window. + // parent's inherited (broader) ACL for the duration of the spawn. it('hardens the credential file synchronously while keeping the directory async', () => { Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' }) const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) @@ -315,13 +645,13 @@ describe('hardenSecurePath', () => { writeSecureFile(targetPath, 'contents') // Directory: async only. - expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([userDataPath]) + expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath]) // File (tmpFile + renamed target): synchronous only — no async file ACL window. - const syncTargets = getSyncPowerShellCalls().map(getPowerShellTarget) + const syncTargets = getSyncHardenAclCalls().map(getAclTarget) expect(syncTargets).toContain(targetPath) expect(syncTargets.filter((entry) => entry === userDataPath)).toHaveLength(0) // The final published target's ACL must have been applied via the synchronous path. - expect(getPowerShellCalls().map(getPowerShellTarget)).not.toContain(targetPath) + expect(getHardenAclCalls().map(getAclTarget)).not.toContain(targetPath) }) // Nit #1 (review): the synchronous file path must cache as hardened ONLY on confirmed @@ -333,30 +663,30 @@ describe('hardenSecurePath', () => { tempDirs.push(userDataPath) const targetPath = join(userDataPath, 'secret.json') - // First write: the synchronous PowerShell ACL apply throws for every powershell call. - vi.mocked(execFileSync).mockImplementation((file) => { - if (file === 'C:\\Windows\\System32\\whoami.exe') { - return '"USER","S-1-5-21-1000"' + // First write: the synchronous icacls ACL apply throws for every icacls call. + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program === 'C:\\Windows\\System32\\whoami.exe') { + return { ...OK, stdout: '"USER","S-1-5-21-1000"' } } throw new Error('access denied') }) expect(() => writeSecureFile(targetPath, 'first')).not.toThrow() - const firstWriteTargetCalls = getSyncPowerShellCalls() - .map(getPowerShellTarget) + const firstWriteTargetCalls = getSyncHardenAclCalls() + .map(getAclTarget) .filter((entry) => entry === targetPath) expect(firstWriteTargetCalls).toHaveLength(1) // Second write: ACL apply now succeeds. Because the failed apply was NOT cached, the // target file is hardened again rather than skipped. - vi.mocked(execFileSync).mockImplementation((file) => { - if (file === 'C:\\Windows\\System32\\whoami.exe') { - return '"USER","S-1-5-21-1000"' + vi.mocked(runProcessSync).mockImplementation((spec) => { + if (spec.program === 'C:\\Windows\\System32\\whoami.exe') { + return { ...OK, stdout: '"USER","S-1-5-21-1000"' } } - return '' + return OK }) writeSecureFile(targetPath, 'second') - const allTargetCalls = getSyncPowerShellCalls() - .map(getPowerShellTarget) + const allTargetCalls = getSyncHardenAclCalls() + .map(getAclTarget) .filter((entry) => entry === targetPath) expect(allTargetCalls).toHaveLength(2) }) @@ -374,15 +704,13 @@ describe('hardenSecurePath', () => { writeSecureFile(join(userDataPath, `secret-${i}.json`), `contents-${i}`) } - const dirCalls = getPowerShellCalls().filter( - (call) => getPowerShellTarget(call) === userDataPath - ) + const dirCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === userDataPath) expect(dirCalls).toHaveLength(1) }) - // win32-only guard: on non-win32 platforms no PowerShell is ever spawned (sync or async); + // win32-only guard: on non-win32 platforms no icacls is ever spawned (sync or async); // POSIX hardening uses chmodSync only. - it('never spawns PowerShell on non-win32 platforms', () => { + it('never spawns icacls on non-win32 platforms', () => { Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' }) const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-')) tempDirs.push(userDataPath) @@ -391,8 +719,8 @@ describe('hardenSecurePath', () => { writeSecureFile(targetPath, 'contents') hardenExistingSecureFile(targetPath) - expect(getPowerShellCalls()).toHaveLength(0) - expect(getSyncPowerShellCalls()).toHaveLength(0) + expect(getHardenAclCalls()).toHaveLength(0) + expect(getSyncHardenAclCalls()).toHaveLength(0) }) posixModeIt('re-hardens a POSIX directory when its metadata changes after caching', () => { @@ -440,22 +768,51 @@ describe('hardenSecurePath', () => { }) }) -const POWERSHELL_SUFFIX = 'WindowsPowerShell\\v1.0\\powershell.exe' - -// Async PowerShell calls (directory hardening + read-path file re-harden). -function getPowerShellCalls(): unknown[][] { - return vi.mocked(execFile).mock.calls.filter(([file]) => String(file).endsWith(POWERSHELL_SUFFIX)) +/** + * Every harden opens with a `/save` verify; one that has work to do then runs `/reset`, `/grant:r` + * and a closing `/save`. Counting only the *opening* verify keeps "one harden = one entry" + * regardless of which of the two shapes it took. + */ +function hardenInitiations(specs: FakeSpec[]): { args?: readonly string[] }[] { + const initiations: { args?: readonly string[] }[] = [] + const awaitingClosingVerify = new Set() + for (const spec of specs) { + if (!spec.program.endsWith('icacls.exe')) { + continue + } + const path = spec.args?.[0] ?? '' + if (spec.args?.includes('/grant:r')) { + awaitingClosingVerify.add(path) + } else if (spec.args?.includes('/save')) { + if (awaitingClosingVerify.has(path)) { + awaitingClosingVerify.delete(path) + } else { + initiations.push(spec) + } + } + } + return initiations } -// Synchronous PowerShell calls (credential-file ACL on the write path). -function getSyncPowerShellCalls(): unknown[][] { - return vi - .mocked(execFileSync) - .mock.calls.filter(([file]) => String(file).endsWith(POWERSHELL_SUFFIX)) +// Async icacls calls (directory hardening + read-path file re-harden). +function getHardenAclCalls(): { args?: readonly string[] }[] { + return hardenInitiations(vi.mocked(runProcess).mock.calls.map(([spec]) => spec)) } -function getPowerShellTarget(call: unknown[]): string { - return (call[1] as string[])[6]! +// Synchronous icacls calls (credential-file ACL on the write path). +function getSyncHardenAclCalls(): { args?: readonly string[] }[] { + return hardenInitiations(vi.mocked(runProcessSync).mock.calls.map(([spec]) => spec)) +} + +function getAclTarget(spec: { args?: readonly string[] }): string { + return spec.args![0]! +} + +// The async harden awaits three icacls passes, so let the chain settle before asserting on it. +async function flushAsyncAcl(): Promise { + for (let i = 0; i < 4; i++) { + await new Promise((resolve) => setTimeout(resolve, 0)) + } } async function waitForFileTimestampTick(): Promise { @@ -465,3 +822,37 @@ async function waitForFileTimestampTick(): Promise { function statMode(path: string): number { return statSync(path).mode & 0o777 } + +describe('isUnreadableError', () => { + const withCode = (code: string): NodeJS.ErrnoException => Object.assign(new Error(code), { code }) + + // The hardened-DACL case this predicate was written for. + it('reports a denied read', () => { + expect(isUnreadableError(withCode('EPERM'))).toBe(true) + expect(isUnreadableError(withCode('EACCES'))).toBe(true) + }) + + /** + * The likelier half on Windows: antivirus holding a credential open during startup yields + * EBUSY, and fd exhaustion yields EMFILE. Neither says the bytes were read, so neither may + * license a regenerate-and-overwrite. + */ + it('reports a read that never reached the contents for any other reason', () => { + expect(isUnreadableError(withCode('EBUSY'))).toBe(true) + expect(isUnreadableError(withCode('EMFILE'))).toBe(true) + expect(isUnreadableError(withCode('ENFILE'))).toBe(true) + expect(isUnreadableError(withCode('EIO'))).toBe(true) + }) + + /** + * The other side of the distinction, and the reason this is an allow list rather than + * "everything except ENOENT": a missing file licenses creating one, and bytes that were read + * and did not parse are the self-heal these stores exist to perform. + */ + it('does not report a missing file or a parse failure', () => { + expect(isUnreadableError(withCode('ENOENT'))).toBe(false) + expect(isUnreadableError(new SyntaxError('Unexpected end of JSON input'))).toBe(false) + expect(isUnreadableError(withCode('EISDIR'))).toBe(false) + expect(isUnreadableError(undefined)).toBe(false) + }) +}) diff --git a/src/shared/secure-file.ts b/src/shared/secure-file.ts index 639630c7c65..c04ea9afe5b 100644 --- a/src/shared/secure-file.ts +++ b/src/shared/secure-file.ts @@ -13,9 +13,15 @@ import { } from 'node:fs' import { dirname } from 'node:path' import { + DEFAULT_HARDENING_CACHE_BOUNDS, SecurePathHardeningCache, type SecurePathHardeningCacheBounds } from './secure-path-hardening-cache' +import { + configureHardeningRetryBudget, + mayAttemptHardening, + recordHardeningOutcome +} from './secure-path-hardening-retry-budget' import { bestEffortRestrictWindowsPath, resetSecureFileWindowsUserSidForTests, @@ -33,24 +39,14 @@ type HardenedPathCacheEntry = { birthtimeMs: number } -export const SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES = 1024 -export const SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES = 64 * 1024 -export const SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES = 512 * 1024 - -const DEFAULT_HARDENING_CACHE_BOUNDS: SecurePathHardeningCacheBounds = { - maxEntries: SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES, - maxKeyBytes: SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES, - maxTotalKeyBytes: SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES -} - const UNSUPPORTED_DIRECTORY_FSYNC_CODES = new Set(['EINVAL', 'ENOTSUP', 'EOPNOTSUPP']) -// Why: PowerShell hardening (~1-1.5s) stalls the main thread, so cache idempotent re-hardens per process. +// Why: hardening spawns icacls synchronously (once when the DACL already verifies, four times when it must be rewritten), so cache idempotent re-hardens per process. let hardenedPathsThisProcess = new SecurePathHardeningCache( DEFAULT_HARDENING_CACHE_BOUNDS ) -// Why: child writes constantly bump a dir's mtime, so cache dirs by path (not metadata) to avoid a PowerShell spawn every read (#4901). +// Why: child writes constantly bump a dir's mtime, so cache dirs by path (not metadata) to avoid an icacls spawn every read (#4901). // Limitation: a dir deleted+recreated in-process won't re-harden; fine since we never delete our secure dirs at runtime. let hardenedDirectoryPathsThisProcess = new SecurePathHardeningCache( DEFAULT_HARDENING_CACHE_BOUNDS @@ -61,9 +57,13 @@ function hardenSecureDirectoryOnce(dirPath: string): void { if (hardenedDirectoryPathsThisProcess.get(dirPath)) { return } - applySecurePathRestriction(dirPath, true, process.platform, false) - // Cache even though the async ACL may still be in flight — dir restriction is best-effort, no retry. + // Cache before the ACL lands so concurrent writes don't restorm; a failure drops it, under the retry budget. hardenedDirectoryPathsThisProcess.set(dirPath, true) + applySecurePathRestriction(dirPath, true, process.platform, false, (restricted) => { + if (!restricted) { + hardenedDirectoryPathsThisProcess.delete(dirPath) + } + }) } function hardenSecurePathOnce(targetPath: string, isDirectory: boolean): boolean { @@ -81,26 +81,50 @@ function hardenSecurePathOnce(targetPath: string, isDirectory: boolean): boolean return true } // Why: async re-harden is safe here — read path hardens each file at most once/process; new files harden synchronously on the write path. - if (applySecurePathRestriction(targetPath, isDirectory, process.platform, false)) { + const outcome = applySecurePathRestriction( + targetPath, + isDirectory, + process.platform, + false, + (restricted) => { + if (!restricted) { + hardenedPathsThisProcess.delete(targetPath) + } + } + ) + if (outcome !== 'failed') { rememberHardenedPath(targetPath, isDirectory) return true } return false } -export function writeSecureJsonFile(targetPath: string, value: unknown): void { - writeSecureFile(targetPath, JSON.stringify(value, null, 2)) +/** Returns false when the file was written but its permissions could not be restricted. */ +export function writeSecureJsonFile(targetPath: string, value: unknown): boolean { + return writeSecureFile(targetPath, JSON.stringify(value, null, 2)) } -export function writeDurableSecureJsonFile(targetPath: string, value: unknown): void { - writeSecureFile(targetPath, JSON.stringify(value, null, 2), { durable: true }) +/** Returns false when the file was written but its permissions could not be restricted. */ +export function writeDurableSecureJsonFile(targetPath: string, value: unknown): boolean { + return writeSecureFile(targetPath, JSON.stringify(value, null, 2), { durable: true }) } +/** + * Writes `contents` and restricts the result to the current user. + * + * Returns whether the restriction actually took. Hardening stays best-effort — it fails + * legitimately on FAT32, network paths and restricted tokens, and must not break a write — but + * the outcome is now reported rather than assumed, so a caller storing a credential can react. + * + * The return value covers the *file* only. The parent directory is hardened fire-and-forget — on + * Windows that lane is async and answers `pending` regardless — so a `true` here says nothing + * about the directory's ACL. + */ export function writeSecureFile( targetPath: string, contents: string, options: { durable?: boolean } = {} -): void { +): boolean { const dir = dirname(targetPath) if (!existsSync(dir)) { mkdirSync(dir, { recursive: true, mode: 0o700 }) @@ -118,15 +142,18 @@ export function writeSecureFile( fsyncFileSync(tmpFile) } // Why: writeFileSync mode is a no-op on Windows, so restrict the credential's ACL synchronously before the rename publishes it under inherited ACLs. - applySecurePathRestriction(tmpFile, false, process.platform, true) + const stagedOutcome = applySecurePathRestriction(tmpFile, false, process.platform, true) renameSync(tmpFile, targetPath) // Why: these hold auth credentials, so the published path must stay current-user only; cache only on confirmed success so failures retry. - if (applySecurePathRestriction(targetPath, false, process.platform, true)) { + // The staged file's protected DACL survives the rename, so this pass usually just verifies it. + const publishedOutcome = applySecurePathRestriction(targetPath, false, process.platform, true) + if (publishedOutcome === 'applied') { rememberHardenedPath(targetPath, false) } if (options.durable) { bestEffortFsyncDirectorySync(dir) } + return stagedOutcome === 'applied' && publishedOutcome === 'applied' } catch (error) { rmSync(tmpFile, { force: true }) throw error @@ -164,6 +191,34 @@ export function bestEffortFsyncDirectorySync(directory: string): void { } } +/** + * Errors that mean the contents were never seen, so they say nothing about what the file holds. + * + * `ENOENT` is deliberately absent: "there is no file" genuinely licenses creating one. So is a + * parse failure, which means the bytes WERE read and were garbage - the self-heal these stores + * were built for. The distinction is "could not read it" versus "read it and it was garbage". + * + * Why it matters: a reader that treats every failure as corruption regenerates the file, and the + * regeneration succeeds - `renameSync` over an unreadable file needs `FILE_DELETE_CHILD` on the + * parent, not `DELETE` on the file - so the original is destroyed by the code meant to heal it. + * `EPERM`/`EACCES` is the hardened-DACL case: a file granting a SID this process does not hold, + * reachable through a relocated user-data path, a share or roaming profile, a restored backup + * under a new local SID, or a half-applied harden. The rest are transient and, on Windows, more + * likely than that: `EBUSY` is what antivirus produces by holding a file open at the moment of a + * read, which for a credential read on the startup path is an ordinary Tuesday. + */ +export function isUnreadableError(error: unknown): boolean { + const code = (error as NodeJS.ErrnoException | null)?.code + return ( + code === 'EPERM' || + code === 'EACCES' || + code === 'EBUSY' || + code === 'EMFILE' || + code === 'ENFILE' || + code === 'EIO' + ) +} + export function hardenExistingSecureFile(targetPath: string): void { const dir = dirname(targetPath) if (existsSync(dir)) { @@ -191,24 +246,48 @@ export function hardenSecurePath( ) } -/** Applies hardening; async Windows calls only report that best-effort ACL work was accepted. */ +/** + * `pending` is the honest answer for the async Windows branch: it has not happened yet, and + * reporting it as `applied` is what let a dead ACL look like a working one. The real outcome + * arrives through `onAsyncSettled`. + */ +type HardeningOutcome = 'applied' | 'pending' | 'failed' + function applySecurePathRestriction( targetPath: string, isDirectory: boolean, platform: NodeJS.Platform, - sync: boolean -): boolean { + sync: boolean, + onAsyncSettled?: (restricted: boolean) => void +): HardeningOutcome { if (platform === 'win32') { if (sync) { + // Why no retry floor here: the write path is user-driven, not polled, and a failed apply + // must still be retried on the next write of the same credential. // Why: apply the ACL synchronously so the credential file isn't briefly readable under inherited ACLs (writeFileSync mode is a no-op on Windows). - return restrictWindowsPathSync(targetPath, isDirectory) + const restricted = restrictWindowsPathSync(targetPath, isDirectory) + if (restricted) { + // Success only: this is how a recovered host clears the read path's backoff (and reports + // `recovered`). Recording a failure here would put the exempt lane back under the budget. + recordHardeningOutcome(targetPath, true) + } + return restricted ? 'applied' : 'failed' } - // Why: dir/read-path re-harden runs async to avoid blocking the main thread (#4901); return true optimistically since it's best-effort. - bestEffortRestrictWindowsPath(targetPath, isDirectory) - return true + // Why the floor: this is the read path, polled at ~2/s (#4901). Retrying every failure there + // is the same storm the cache exists to prevent. + if (!mayAttemptHardening(targetPath)) { + onAsyncSettled?.(false) + return 'failed' + } + // Why: dir/read-path re-harden runs async to avoid blocking the main thread (#4901). + bestEffortRestrictWindowsPath(targetPath, isDirectory, (restricted) => { + recordHardeningOutcome(targetPath, restricted) + onAsyncSettled?.(restricted) + }) + return 'pending' } chmodSync(targetPath, isDirectory ? 0o700 : 0o600) - return true + return 'applied' } /** Caches the current metadata snapshot for a just-hardened path, or clears it if the path is gone. */ @@ -275,6 +354,7 @@ export function __resetSecureFileHardenedPathsForTests( ): void { hardenedPathsThisProcess = new SecurePathHardeningCache(bounds) hardenedDirectoryPathsThisProcess = new SecurePathHardeningCache(bounds) + configureHardeningRetryBudget(bounds) } export function __getSecureFileHardeningCacheStateForTests(): { diff --git a/src/shared/secure-path-hardening-cache.ts b/src/shared/secure-path-hardening-cache.ts index 3ec32de4f8b..eb1f7200bf9 100644 --- a/src/shared/secure-path-hardening-cache.ts +++ b/src/shared/secure-path-hardening-cache.ts @@ -4,6 +4,21 @@ export type SecurePathHardeningCacheBounds = { maxTotalKeyBytes: number } +export const SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES = 1024 +export const SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES = 64 * 1024 +export const SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES = 512 * 1024 + +/** + * The bounds every hardening cache uses unless a caller overrides them. They live here rather + * than with one consumer so a cache can default itself instead of depending on some other module + * being imported first. + */ +export const DEFAULT_HARDENING_CACHE_BOUNDS: SecurePathHardeningCacheBounds = { + maxEntries: SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES, + maxKeyBytes: SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES, + maxTotalKeyBytes: SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES +} + type RetainedSecurePath = { value: T keyBytes: number diff --git a/src/shared/secure-path-hardening-report.ts b/src/shared/secure-path-hardening-report.ts new file mode 100644 index 00000000000..45408da0317 --- /dev/null +++ b/src/shared/secure-path-hardening-report.ts @@ -0,0 +1,43 @@ +/** + * Where path-hardening outcomes are announced, kept apart from the code that applies them so the + * retry budget can report degradation and recovery without importing the Windows ACL lane. + */ +export type SecurePathHardeningReport = { + targetPath: string + /** + * `throttled` and `recovered` mark entering and leaving the rate-limited degraded state; + * `settle` is the async lane's own callback failing, which is a caller bug rather than a host one. + */ + stage: 'sid-lookup' | 'reset' | 'grant' | 'verify' | 'settle' | 'throttled' | 'recovered' + detail: string +} + +/** + * Why a hook: hardening runs in the Electron main process, which is GUI-subsystem on Windows and + * owns no console, so `console.warn` reaches nothing in a packaged build. The main process + * installs a reporter that routes into the diagnostic trace; the console default keeps dev runs + * and the CLI readable. + */ +const consoleReporter = (entry: SecurePathHardeningReport): void => { + if (entry.stage === 'recovered') { + console.info('[secure-path.windows-acl] path hardening recovered', entry) + return + } + console.warn('[secure-path.windows-acl] failed to restrict path', entry) +} + +let reportEntry: (entry: SecurePathHardeningReport) => void = consoleReporter + +export function setSecurePathHardeningReporter( + reporter: ((entry: SecurePathHardeningReport) => void) | null +): void { + reportEntry = reporter ?? consoleReporter +} + +export function reportSecurePathHardening( + targetPath: string, + stage: SecurePathHardeningReport['stage'], + detail: string +): void { + reportEntry({ targetPath, stage, detail: detail.trim().slice(0, 500) }) +} diff --git a/src/shared/secure-path-hardening-retry-budget.test.ts b/src/shared/secure-path-hardening-retry-budget.test.ts new file mode 100644 index 00000000000..e2b76b7cec1 --- /dev/null +++ b/src/shared/secure-path-hardening-retry-budget.test.ts @@ -0,0 +1,174 @@ +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { + configureHardeningRetryBudget, + hardeningRetryDelayMs, + mayAttemptHardening, + recordHardeningOutcome +} from './secure-path-hardening-retry-budget' +import { + setSecurePathHardeningReporter, + type SecurePathHardeningReport +} from './secure-path-hardening-report' + +const PATH = 'C:\\Users\\me\\.orca\\secret.json' +const OTHER = 'C:\\Users\\me\\.orca\\other.json' +const MINUTE = 60_000 + +describe('secure path hardening retry budget', () => { + /** Elapsed monotonic time, which is what the budget measures. */ + let clock = 0 + /** The wall clock, which it must not measure: it steps backwards on real machines. */ + let wallClock = 0 + let reports: SecurePathHardeningReport[] = [] + + beforeEach(() => { + clock = 1_000_000 + wallClock = Date.parse('2026-01-01T00:00:00Z') + vi.spyOn(performance, 'now').mockImplementation(() => clock) + vi.spyOn(Date, 'now').mockImplementation(() => wallClock) + reports = [] + setSecurePathHardeningReporter((entry) => reports.push(entry)) + configureHardeningRetryBudget({ + maxEntries: 64, + maxKeyBytes: 4096, + maxTotalKeyBytes: 65_536 + }) + }) + + afterEach(() => { + setSecurePathHardeningReporter(null) + vi.restoreAllMocks() + }) + + /** Drives the loop the read path drives: attempt when allowed, record the failure, advance. */ + function pollUntil(elapsedMs: number, stepMs: number, restricted = false): number[] { + const attemptedAt: number[] = [] + const startedAt = clock + while (clock - startedAt <= elapsedMs) { + if (mayAttemptHardening(PATH)) { + attemptedAt.push(clock - startedAt) + recordHardeningOutcome(PATH, restricted) + } + clock += stepMs + wallClock += stepMs + } + return attemptedAt + } + + it('doubles the delay after each consecutive failure, up to the ceiling', () => { + expect(hardeningRetryDelayMs(1)).toBe(1 * MINUTE) + expect(hardeningRetryDelayMs(2)).toBe(2 * MINUTE) + expect(hardeningRetryDelayMs(3)).toBe(4 * MINUTE) + expect(hardeningRetryDelayMs(4)).toBe(8 * MINUTE) + expect(hardeningRetryDelayMs(5)).toBe(16 * MINUTE) + // Ceiling reached, and it stays there however long the host has been broken. + expect(hardeningRetryDelayMs(6)).toBe(30 * MINUTE) + expect(hardeningRetryDelayMs(50)).toBe(30 * MINUTE) + expect(hardeningRetryDelayMs(5000)).toBe(30 * MINUTE) + }) + + it('allows the first attempt for a path it has never seen', () => { + expect(mayAttemptHardening(PATH)).toBe(true) + }) + + // The #4901 condition: the env store re-hardens on the read path about twice a second. + it('collapses a read-path poll to a single attempt in the first minute', () => { + const attemptedAt = pollUntil(55_000, 500) + + expect(attemptedAt).toEqual([0]) + }) + + it('re-probes on the documented curve rather than on every read', () => { + // Six hours of polling every 30s: 720 reads, and only the backoff decides how many run. + const attemptedAt = pollUntil(6 * 60 * MINUTE, 30_000) + + // 0, +1, +2, +4, +8, +16, then every 30 minutes forever. + expect(attemptedAt.slice(0, 6).map((ms) => ms / MINUTE)).toEqual([0, 1, 3, 7, 15, 31]) + const trailingGaps = attemptedAt + .slice(-4) + .map((ms, index, all) => (all[index + 1]! - ms) / MINUTE) + expect(trailingGaps.slice(0, -1)).toEqual([30, 30, 30]) + }) + + // The failure this replaced: three transient failures used to disable a path until restart. + it('never abandons a path, however long it has been failing', () => { + pollUntil(30 * 24 * 60 * MINUTE, 15 * MINUTE) + + // A month of failures later, the very next elapsed ceiling still re-probes. + clock += 31 * MINUTE + expect(mayAttemptHardening(PATH)).toBe(true) + }) + + /** + * The same latch by another route. NTP corrections, VM snapshot restores and a user changing the + * clock all step `Date.now()` backwards; measured against the wall clock that makes the elapsed + * time negative, so the path stayed below its delay for the whole length of the step — a year, + * here — which is exactly the permanent abandonment the backoff exists to remove. + */ + it('re-probes after a backwards clock step rather than waiting for the wall clock', () => { + pollUntil(6 * 60 * MINUTE, 30_000) + + wallClock -= 365 * 24 * 60 * MINUTE + clock += 31 * MINUTE + + expect(mayAttemptHardening(PATH)).toBe(true) + }) + + it('announces the degraded state once, not once per failure', () => { + pollUntil(6 * 60 * MINUTE, 30_000) + + const throttled = reports.filter((entry) => entry.stage === 'throttled') + expect(throttled).toHaveLength(1) + expect(throttled[0]).toMatchObject({ targetPath: PATH, stage: 'throttled' }) + }) + + it('announces recovery when a throttled path hardens again, and resets the curve', () => { + pollUntil(10 * MINUTE, 30_000) + expect(reports.filter((entry) => entry.stage === 'throttled')).toHaveLength(1) + + recordHardeningOutcome(PATH, true) + + expect(reports.filter((entry) => entry.stage === 'recovered')).toMatchObject([ + { targetPath: PATH, stage: 'recovered' } + ]) + // Record cleared: the next failure starts at the floor rather than the ceiling. + expect(mayAttemptHardening(PATH)).toBe(true) + recordHardeningOutcome(PATH, false) + clock += 59_000 + expect(mayAttemptHardening(PATH)).toBe(false) + clock += 2_000 + expect(mayAttemptHardening(PATH)).toBe(true) + }) + + it('stays silent about recovery for a path that never reached the degraded state', () => { + recordHardeningOutcome(PATH, false) + recordHardeningOutcome(PATH, true) + + expect(reports).toEqual([]) + }) + + it('budgets each path separately', () => { + recordHardeningOutcome(PATH, false) + + expect(mayAttemptHardening(PATH)).toBe(false) + expect(mayAttemptHardening(OTHER)).toBe(true) + }) + + /** + * The state every other test here configures away: a module instance nobody has called + * `configureHardeningRetryBudget` on, which is what a second importer gets. It used to throw, + * and from the async lane that throw is an unhandled rejection rather than a caught error, so + * "the budget is unconfigured" surfaced as a dead main process. Nothing is imported here but + * the module itself — importing `secure-file.ts` is what used to hide this. + */ + it('defaults its bounds when nothing configured it', async () => { + vi.resetModules() + const budget = await import('./secure-path-hardening-retry-budget.js') + + expect(budget.mayAttemptHardening(PATH)).toBe(true) + expect(() => budget.recordHardeningOutcome(PATH, false)).not.toThrow() + // Proof it recorded into a real cache rather than merely not throwing. + expect(budget.mayAttemptHardening(PATH)).toBe(false) + expect(budget.mayAttemptHardening(OTHER)).toBe(true) + }) +}) diff --git a/src/shared/secure-path-hardening-retry-budget.ts b/src/shared/secure-path-hardening-retry-budget.ts new file mode 100644 index 00000000000..9dfd93f02f3 --- /dev/null +++ b/src/shared/secure-path-hardening-retry-budget.ts @@ -0,0 +1,100 @@ +import { + DEFAULT_HARDENING_CACHE_BOUNDS, + SecurePathHardeningCache, + type SecurePathHardeningCacheBounds +} from './secure-path-hardening-cache' +import { reportSecurePathHardening } from './secure-path-hardening-report' + +type HardeningFailureRecord = { at: number; attempts: number } + +/** + * How often a path whose hardening keeps failing may be retried. + * + * Why throttle at all: the env store re-hardens on the *read* path at ~2/s (#4901), so retrying + * every failure is an icacls-and-log storm on hosts where hardening cannot work — FAT32/exFAT have + * no ACLs, and network paths, redirected profiles and restricted tokens refuse. + * + * Why exponential and not a cap: a cap that never expires latches a *transient* failure — one AV + * scan or momentary lock and the path is abandoned for the life of the process, which can be days. + * Backoff bounds the rate without ever bounding the lifetime. It settles at ~2 attempts/hour on a + * permanently incapable host, which matters because the budget is per path and there are several + * secure files; a fixed one-minute floor would leave a standing five-figure daily spawn count for + * work that will never succeed. + * + * Why slowing it down is close to free: the synchronous write path is deliberately *not* + * throttled, so a host that recovers hardens on its very next credential write. This read-path + * re-probe is a backstop, not the recovery mechanism. + */ +const HARDENING_RETRY_FLOOR_MS = 60_000 +const HARDENING_RETRY_CEILING_MS = 30 * 60_000 + +/** + * Why not `Date.now`: an NTP correction, a VM snapshot restore or a user changing the clock steps + * the wall clock backwards, which made the elapsed time negative and held every path below its + * delay until the clock caught up — a year, for a year-long step. That is the permanent latch this + * backoff exists to remove. Elapsed monotonic time cannot go backwards. + */ +const monotonicNowMs = (): number => performance.now() + +/** Consecutive failures before the degraded state is announced. */ +const HARDENING_THROTTLE_ANNOUNCE_AFTER = 3 + +/** Exported so the tests pin the real curve rather than a copy of it. */ +export function hardeningRetryDelayMs(attempts: number): number { + return Math.min(HARDENING_RETRY_FLOOR_MS * 2 ** (attempts - 1), HARDENING_RETRY_CEILING_MS) +} + +let hardeningFailures: SecurePathHardeningCache | null = null + +/** + * Why it defaults instead of throwing: this used to require `configureHardeningRetryBudget` first, + * and the only thing keeping that contract was import order — one module configured it at module + * scope and happened to be the sole importer. Any second importer got a throw, and from the async + * lane that throw lands in a `.then` handler as an unhandled rejection, which takes the Electron + * main process down. A retry budget is not worth a crash, and a default is not worth a caller. + */ +function failures(): SecurePathHardeningCache { + hardeningFailures ??= new SecurePathHardeningCache( + DEFAULT_HARDENING_CACHE_BOUNDS + ) + return hardeningFailures +} + +/** Overrides the default bounds. Optional: nothing has to call this before the budget is used. */ +export function configureHardeningRetryBudget(bounds: SecurePathHardeningCacheBounds): void { + hardeningFailures = new SecurePathHardeningCache(bounds) +} + +export function mayAttemptHardening(targetPath: string): boolean { + const failure = failures().get(targetPath) + if (!failure) { + return true + } + // No cap: once the backoff elapses the path is re-probed, however long it has been failing. + return monotonicNowMs() - failure.at >= hardeningRetryDelayMs(failure.attempts) +} + +export function recordHardeningOutcome(targetPath: string, restricted: boolean): void { + const previous = failures().get(targetPath) + if (restricted) { + failures().delete(targetPath) + if (previous && previous.attempts >= HARDENING_THROTTLE_ANNOUNCE_AFTER) { + reportSecurePathHardening( + targetPath, + 'recovered', + `hardening succeeded again after ${previous.attempts} consecutive failures` + ) + } + return + } + const attempts = (previous?.attempts ?? 0) + 1 + failures().set(targetPath, { at: monotonicNowMs(), attempts }) + // Fires exactly once: attempts only rises, and a success clears the record entirely. + if (attempts === HARDENING_THROTTLE_ANNOUNCE_AFTER) { + reportSecurePathHardening( + targetPath, + 'throttled', + `hardening failed ${attempts} times; backing off toward one retry per ${HARDENING_RETRY_CEILING_MS / 60_000} minutes until it succeeds` + ) + } +} diff --git a/src/shared/secure-path-windows-acl.ts b/src/shared/secure-path-windows-acl.ts index 4d61dff79e1..ac0aac0d1ce 100644 --- a/src/shared/secure-path-windows-acl.ts +++ b/src/shared/secure-path-windows-acl.ts @@ -1,144 +1,351 @@ -import { execFile, execFileSync } from 'node:child_process' -import { win32 as pathWin32 } from 'node:path' +import { randomBytes } from 'node:crypto' +import { readFileSync, rmSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join, win32 as pathWin32 } from 'node:path' +import { runProcess, runProcessSync } from './child-process/run-process' +import { windowsSystem32Binary } from './child-process/windows-system-binary' +import { + reportSecurePathHardening, + type SecurePathHardeningReport +} from './secure-path-hardening-report' +import { localDomainSidOf, parseSddlDacl } from './windows-security-descriptor' -let cachedWindowsUserSid: string | null | undefined +const ACL_TIMEOUT_MS = 5000 -function buildWindowsRestrictAclArgs( - targetPath: string, - currentUserSid: string, +/** SYSTEM and the local Administrators group: they can take ownership regardless, so denying them buys nothing. */ +const LOCAL_SYSTEM_SID = 'S-1-5-18' +const BUILTIN_ADMINISTRATORS_SID = 'S-1-5-32-544' + +const WINDOWS_SID_PATTERN = /^S-1-\d+(?:-\d+)+$/ + +type AclPlan = { + program: string + /** The path as icacls must receive it, already extended-length prefixed when needed. */ + icaclsPath: string isDirectory: boolean -): string[] { - return [ - '-NoProfile', - '-NonInteractive', - '-ExecutionPolicy', - 'Bypass', - '-Command', - WINDOWS_RESTRICT_ACL_SCRIPT, - targetPath, - currentUserSid, - isDirectory ? '1' : '0' - ] + allowedSids: string[] + /** Resolves the machine-relative aliases `/save` emits; null when the user SID is not one. */ + localDomainSid: string | null + resetArgs: string[] + grantArgs: string[] } -export function bestEffortRestrictWindowsPath(targetPath: string, isDirectory: boolean): void { - const currentUserSid = getCurrentWindowsUserSid() - if (!currentUserSid) { +function buildAclPlan(targetPath: string, currentUserSid: string, isDirectory: boolean): AclPlan { + const icaclsPath = toIcaclsPath(targetPath) + // Directories propagate to children (artifact-intent files rely on inheritance); files take no flags. + const rights = isDirectory ? '(OI)(CI)(F)' : '(F)' + const allowedSids = [...new Set([currentUserSid, LOCAL_SYSTEM_SID, BUILTIN_ADMINISTRATORS_SID])] + return { + program: windowsSystem32Binary('icacls.exe'), + icaclsPath, + isDirectory, + allowedSids, + localDomainSid: localDomainSidOf(currentUserSid), + // `/reset` purges explicit ACEs, which `/inheritance:r` leaves in place — a planted + // `Everyone:(R)` survives the grant pass otherwise. The two cannot be combined in one call. + resetArgs: [icaclsPath, '/reset', '/q'], + // Never add /c: it makes icacls exit 0 on "Failed processing 1 files", a silent no-op by another route. + grantArgs: [ + icaclsPath, + '/inheritance:r', + ...allowedSids.flatMap((sid) => ['/grant:r', `*${sid}:${rights}`]), + '/q' + ] + } +} + +function verifyArgs(plan: AclPlan, savePath: string): string[] { + return [plan.icaclsPath, '/save', savePath, '/q'] +} + +function sddlSavePath(): string { + return join(tmpdir(), `orca-acl-${process.pid}-${randomBytes(6).toString('hex')}.sddl`) +} + +/** + * Judges a `/save` result. Returns a failure reason, or null when the DACL on disk is exactly the + * intended one — protected, granting full control to the allowed SIDs and to nobody else. + */ +function evaluateSavedAcl( + plan: AclPlan, + result: { code: number | null; stderr: string }, + savePath: string +): string | null { + if (result.code !== 0) { + return result.stderr.trim() || `icacls exited ${result.code}` + } + let sddl: string + try { + // icacls writes the descriptor as UTF-16LE, which sidesteps the OEM codepage its stdout uses. + sddl = readFileSync(savePath, 'utf16le') + } catch { + return 'icacls saved no security descriptor' + } + return validateHardenedDacl(sddl, plan) +} + +function validateHardenedDacl(sddl: string, plan: AclPlan): string | null { + const dacl = parseSddlDacl(sddl, plan.localDomainSid ?? undefined) + if (!dacl) { + return 'no DACL in the saved security descriptor' + } + if (!dacl.isProtected) { + return 'DACL is not protected; the parent still propagates into it' + } + // Exactly these, in any order: a directory's rules must be inheritable and nothing else. + const expectedFlags = plan.isDirectory ? ['OI', 'CI'] : [] + const observed = new Set() + for (const ace of dacl.aces) { + if (ace.type !== 'A') { + return `unexpected ${ace.type} rule for ${ace.sid}` + } + if (ace.flags.includes('ID')) { + return `inherited rule survived for ${ace.sid}` + } + if (ace.rights !== 'FA') { + return `rule for ${ace.sid} grants ${ace.rights || 'nothing'}, not full control` + } + // The whole set, not just OI. (OI) without (CI) leaves subdirectories unprotected, and + // adding (IO) makes every rule inherit-only, so the directory object itself grants nobody + // anything and Orca cannot even write into it. Both used to be repaired blindly on every + // pass; since hardening short-circuits on a DACL that verifies, whatever this accepts stays. + if ( + ace.flags.length !== expectedFlags.length || + !expectedFlags.every((flag) => ace.flags.includes(flag)) + ) { + return `wrong inheritance flags (${ace.flags.join('') || 'none'}) for ${ace.sid}` + } + observed.add(ace.sid) + } + // Identity, not just shape: a count check alone accepts a granted SID swapped for another. + // Unexpected principals are reported before missing ones — "Everyone has full control" is the + // headline, and a substitution always produces both. + for (const sid of observed) { + if (!plan.allowedSids.includes(sid)) { + return `unexpected rule for ${sid}` + } + } + for (const sid of plan.allowedSids) { + if (!observed.has(sid)) { + return `missing rule for ${sid}` + } + } + return null +} + +/** + * icacls resolves through the MAX_PATH-limited API and fails with "cannot find the path + * specified" past 259 characters; the extended prefix is the documented escape. + */ +function toIcaclsPath(targetPath: string): string { + if (targetPath.length < 260 || targetPath.startsWith('\\\\?\\')) { + return targetPath + } + const normalized = pathWin32.normalize(targetPath) + if (/^[A-Za-z]:\\/.test(normalized)) { + return `\\\\?\\${normalized}` + } + if (normalized.startsWith('\\\\')) { + return `\\\\?\\UNC\\${normalized.slice(2)}` + } + return targetPath +} + +function report( + targetPath: string, + stage: SecurePathHardeningReport['stage'], + detail: string +): void { + reportSecurePathHardening(targetPath, stage, detail) +} + +/** + * Applies the ACL without blocking. `onSettled` reports the real outcome, which the return value + * cannot: the caller's cache must not keep claiming a path is hardened when the apply failed. + */ +export function bestEffortRestrictWindowsPath( + targetPath: string, + isDirectory: boolean, + onSettled?: (restricted: boolean) => void +): void { + const plan = planFor(targetPath, isDirectory) + if (!plan) { + onSettled?.(false) return } - // Why: async to avoid blocking the main thread — sync PowerShell cold-start (~1-1.5s) on the frequent read path stormed it (#4901). - execFile( - getWindowsSystemToolPath('WindowsPowerShell\\v1.0\\powershell.exe'), - buildWindowsRestrictAclArgs(targetPath, currentUserSid, isDirectory), - { - windowsHide: true, - timeout: 5000 - }, - () => { - // Why: ignore errors — hardening is best-effort; PowerShell ACL APIs may be unavailable or locked down. + // Why async: hardening runs on the read path, and blocking it on a spawn stormed the main thread (#4901). + // Why both arms and a terminal catch: a bare `void p.then(fn)` makes a rejected `restrictAsync` + // *and* a throw from `onSettled` itself an unhandled rejection, which Node's default turns into + // a main-process crash — the exact opposite of what the reporter hook exists for. `false` is the + // right value on the error arm: it drops the path from the caller's cache and leaves it retryable. + void restrictAsync(targetPath, plan) + .then(onSettled, () => onSettled?.(false)) + .catch((error: unknown) => reportSettlementThrow(targetPath, error)) +} + +/** + * The last frame before an unhandled rejection, so it must not throw either — and the reporter it + * calls is a caller-installed hook, which is the one thing here that plausibly does. + */ +function reportSettlementThrow(targetPath: string, error: unknown): void { + try { + report(targetPath, 'settle', `hardening settlement callback threw: ${String(error)}`) + } catch { + // Nothing left to report through; losing one diagnostic beats crashing the main process. + } +} + +async function restrictAsync(targetPath: string, plan: AclPlan): Promise { + // Verify first: a path that already reads back correct needs no write at all. Re-running + // `/reset` on a correct DACL would briefly restore the inherited (broader) one for no gain. + if ((await verifyAsync(plan)) === null) { + return true + } + for (const [stage, args] of [ + ['reset', plan.resetArgs], + ['grant', plan.grantArgs] + ] as const) { + try { + const result = await runProcess({ program: plan.program, args, timeoutMs: ACL_TIMEOUT_MS }) + if (result.code !== 0) { + report(targetPath, stage, result.stderr || `icacls exited ${result.code}`) + return false + } + } catch (error) { + report(targetPath, stage, String(error)) + return false } - ) + } + const invalid = await verifyAsync(plan) + if (invalid) { + report(targetPath, 'verify', invalid) + return false + } + return true +} + +async function verifyAsync(plan: AclPlan): Promise { + const savePath = sddlSavePath() + try { + const result = await runProcess({ + program: plan.program, + args: verifyArgs(plan, savePath), + timeoutMs: ACL_TIMEOUT_MS + }) + return evaluateSavedAcl(plan, result, savePath) + } catch (error) { + return String(error) + } finally { + discard(savePath) + } } export function restrictWindowsPathSync(targetPath: string, isDirectory: boolean): boolean { + const plan = planFor(targetPath, isDirectory) + if (!plan) { + return false + } + // Why sync: the file must not be published until its ACL is actually restricted (read path stays async, #4901). + if (verifySync(plan) === null) { + return true + } + for (const [stage, args] of [ + ['reset', plan.resetArgs], + ['grant', plan.grantArgs] + ] as const) { + try { + const result = runProcessSync({ program: plan.program, args, timeoutMs: ACL_TIMEOUT_MS }) + if (result.code !== 0) { + report(targetPath, stage, result.stderr || `icacls exited ${result.code}`) + return false + } + } catch (error) { + // Why not fatal: a failed ACL apply must not crash the write; false leaves the path uncached to retry later. + report(targetPath, stage, String(error)) + return false + } + } + const invalid = verifySync(plan) + if (invalid) { + report(targetPath, 'verify', invalid) + return false + } + return true +} + +function verifySync(plan: AclPlan): string | null { + const savePath = sddlSavePath() + try { + const result = runProcessSync({ + program: plan.program, + args: verifyArgs(plan, savePath), + timeoutMs: ACL_TIMEOUT_MS + }) + return evaluateSavedAcl(plan, result, savePath) + } catch (error) { + return String(error) + } finally { + discard(savePath) + } +} + +function discard(savePath: string): void { + try { + rmSync(savePath, { force: true }) + } catch { + // The descriptor holds no secrets; a leftover temp file is not worth reporting. + } +} + +function planFor(targetPath: string, isDirectory: boolean): AclPlan | null { const currentUserSid = getCurrentWindowsUserSid() if (!currentUserSid) { - return false - } - // Why: file must not be published until its ACL is actually restricted, so block and report real success (read path stays async, #4901). - try { - execFileSync( - getWindowsSystemToolPath('WindowsPowerShell\\v1.0\\powershell.exe'), - buildWindowsRestrictAclArgs(targetPath, currentUserSid, isDirectory), - { - stdio: ['ignore', 'ignore', 'ignore'], - windowsHide: true, - timeout: 5000 - } - ) - return true - } catch { - // Why: best-effort — a failed ACL apply must not crash the write; false leaves the path uncached to retry later. - return false + report(targetPath, 'sid-lookup', 'could not resolve the current user SID') + return null } + return buildAclPlan(targetPath, currentUserSid, isDirectory) } -const WINDOWS_RESTRICT_ACL_SCRIPT = ` -$ErrorActionPreference = 'Stop' -$path = $args[0] -$currentUserSid = $args[1] -$isDirectory = $args[2] -eq '1' -$allowedSidTexts = @($currentUserSid, 'S-1-5-18', 'S-1-5-32-544') -$allowedSids = @{} -foreach ($sidText in $allowedSidTexts) { - $allowedSids[$sidText] = $true -} -$acl = Get-Acl -LiteralPath $path -$acl.SetAccessRuleProtection($true, $false) -foreach ($rule in @($acl.Access)) { - [void]$acl.RemoveAccessRuleSpecific($rule) -} -$inheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::None -if ($isDirectory) { - $inheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit -} -foreach ($sidText in $allowedSidTexts) { - $sid = [System.Security.Principal.SecurityIdentifier]::new($sidText) - $rule = [System.Security.AccessControl.FileSystemAccessRule]::new( - $sid, - [System.Security.AccessControl.FileSystemRights]::FullControl, - $inheritanceFlags, - [System.Security.AccessControl.PropagationFlags]::None, - [System.Security.AccessControl.AccessControlType]::Allow - ) - [void]$acl.AddAccessRule($rule) -} -Set-Acl -LiteralPath $path -AclObject $acl -$verifiedAcl = Get-Acl -LiteralPath $path -if (-not $verifiedAcl.AreAccessRulesProtected) { - throw 'ACL inheritance is still enabled' -} -$fullControl = [System.Security.AccessControl.FileSystemRights]::FullControl -foreach ($rule in @($verifiedAcl.Access)) { - $sid = $rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value - if (-not $allowedSids.ContainsKey($sid)) { - throw "Unexpected ACL entry $sid" - } - if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { - throw "Unexpected ACL deny entry $sid" - } - if (($rule.FileSystemRights -band $fullControl) -ne $fullControl) { - throw "ACL entry $sid does not grant FullControl" - } -} -`.trim() +let cachedWindowsUserSid: string | null = null +let sidLookupFailedAt: number | null = null +const SID_LOOKUP_RETRY_MS = 60_000 +/** + * Why monotonic and not `Date.now`: a backwards wall-clock step held this window open until the + * clock caught up, and this latch is worse than the read-path budget's — a failed lookup makes + * `planFor` return null, which disables the synchronous *write* path too, so the write-path + * exemption that recovers from that one cannot recover from this. + */ +const monotonicNowMs = (): number => performance.now() + +/** + * Only a well-formed SID is cached for the process lifetime. A failure is cached for a minute: + * caching it forever let one transient `whoami` hiccup disable hardening until restart. + */ function getCurrentWindowsUserSid(): string | null { - if (cachedWindowsUserSid !== undefined) { + if (cachedWindowsUserSid) { return cachedWindowsUserSid } - try { - const output = execFileSync( - getWindowsSystemToolPath('whoami.exe'), - ['/user', '/fo', 'csv', '/nh'], - { - encoding: 'utf-8', - stdio: ['ignore', 'pipe', 'ignore'], - windowsHide: true, - timeout: 5000 - } - ).trim() - const columns = parseCsvLine(output) - cachedWindowsUserSid = columns[1] ?? null - } catch { - cachedWindowsUserSid = null + if (sidLookupFailedAt !== null && monotonicNowMs() - sidLookupFailedAt < SID_LOOKUP_RETRY_MS) { + return null } - return cachedWindowsUserSid -} - -function getWindowsSystemToolPath(relativeSystem32Path: string): string { - const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows' - return pathWin32.join(systemRoot, 'System32', relativeSystem32Path) + try { + const result = runProcessSync({ + program: windowsSystem32Binary('whoami.exe'), + args: ['/user', '/fo', 'csv', '/nh'], + timeoutMs: ACL_TIMEOUT_MS + }) + const candidate = result.code === 0 ? parseCsvLine(result.stdout.trim())[1] : undefined + if (candidate && WINDOWS_SID_PATTERN.test(candidate)) { + cachedWindowsUserSid = candidate + sidLookupFailedAt = null + return candidate + } + } catch { + // Fall through to the failure record below. + } + sidLookupFailedAt = monotonicNowMs() + return null } function parseCsvLine(line: string): string[] { @@ -146,5 +353,6 @@ function parseCsvLine(line: string): string[] { } export function resetSecureFileWindowsUserSidForTests(): void { - cachedWindowsUserSid = undefined + cachedWindowsUserSid = null + sidLookupFailedAt = null } diff --git a/src/shared/secure-path-windows-acl.win32.test.ts b/src/shared/secure-path-windows-acl.win32.test.ts new file mode 100644 index 00000000000..7ae193d70c5 --- /dev/null +++ b/src/shared/secure-path-windows-acl.win32.test.ts @@ -0,0 +1,404 @@ +import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest' +import { runProcessSync } from './child-process/run-process' +import { windowsSystem32Binary } from './child-process/windows-system-binary' +import { + setSecurePathHardeningReporter, + type SecurePathHardeningReport +} from './secure-path-hardening-report' +import { + bestEffortRestrictWindowsPath, + resetSecureFileWindowsUserSidForTests, + restrictWindowsPathSync +} from './secure-path-windows-acl' +import { removeTreeSync } from './windows-transient-lock-removal' + +/** + * The half of the proof a mocked argv test cannot give. + * + * The shipped bug was not a wrong argv — it was an argv the *callee* never + * received: `powershell.exe -Command