feat(plugins): add confinement foundations and host lifetime safeguards

.config/nextest.toml

@@ -107,6 +107,7 @@ binary_id(cyber-account)
 | binary_id(cyber-sandbox::bridge)
 | binary_id(cyber-sandbox::git_inspection)
 | binary_id(cyber-sandbox::plugin_copy)
+| binary_id(cyber-sandbox::native_exec)
 | binary_id(cyber-sandbox::proxy_shutdown)
 | binary_id(cyber-sandbox::windows_confine)
 | binary_id(cyber-sandbox::windows_job)

.github/workflows/ci.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # Commits that only touch root Markdown, docs/ or openspec/ skip the build and test
   # jobs; OpenSpec validation still runs for them.

.github/workflows/plugin-bootstrap-environment.yml

@@ -0,0 +1,292 @@
+name: Plugin bootstrap environment
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - crates/cyber-tools/src/plugin_host/**
+      - crates/cyber-app/tests/plugins.rs
+      - crates/cyber-sandbox/**
+      - .github/workflows/plugin-bootstrap-environment.yml
+      - Cargo.lock
+  push:
+    branches: [main]
+    paths:
+      - crates/cyber-tools/src/plugin_host/**
+      - crates/cyber-app/tests/plugins.rs
+      - crates/cyber-sandbox/**
+      - .github/workflows/plugin-bootstrap-environment.yml
+      - Cargo.lock
+
+permissions:
+  contents: read
+
+concurrency:
+  group: plugin-bootstrap-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  bootstrap:
+    name: Host bootstrap (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel, windows-latest]
+    env:
+      CARGO_INCREMENTAL: 0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.4.4'
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: 'v2.9.8'
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Linux sandbox prerequisites
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.*
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+      - name: Build distributed sandbox helper
+        shell: bash
+        run: cargo build --locked -p cyber-sandbox --bin cyber-sandbox-exec
+      - name: Verify explicit environment construction
+        shell: bash
+        run: cargo test --locked -p cyber-tools --lib plugin_host::environment
+      - name: Verify runtime search exclusions
+        shell: bash
+        run: cargo test --locked -p cyber-tools --lib plugin_host::runtime_search
+      - name: Verify missing runtime search guards are detected
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          source=crates/cyber-tools/src/plugin_host/runtime_search.rs
+          cp "$source" "$RUNNER_TEMP/runtime-search-positive.rs"
+          trap 'cp "$RUNNER_TEMP/runtime-search-positive.rs" "$source"' EXIT
+          python3 - "$source" <<'PY'
+          from pathlib import Path
+          import sys
+          path = Path(sys.argv[1])
+          text = path.read_text()
+          for before in ['excluded.iter().any(|root| directory.starts_with(root))',
+                         'excluded.iter().any(|root| candidate.starts_with(root))']:
+              assert text.count(before) == 1
+              text = text.replace(before, 'false')
+          path.write_text(text)
+          PY
+          name=project_and_package_path_entries_cannot_shadow_the_owner_runtime
+          if cargo test --locked -p cyber-tools --lib "plugin_host::runtime_search::tests::$name" -- --exact > "$RUNNER_TEMP/runtime-search-control.log" 2>&1; then
+            echo 'Missing runtime search guards unexpectedly passed' >&2
+            exit 1
+          fi
+          python3 - "$RUNNER_TEMP/runtime-search-control.log" "$name" <<'PY'
+          from pathlib import Path
+          import sys
+          text = Path(sys.argv[1]).read_text()
+          assert f'{sys.argv[2]} ... FAILED' in text, text
+          assert 'runtime selection receipt' in text, text
+          PY
+          cp "$RUNNER_TEMP/runtime-search-positive.rs" "$source"
+          cargo test --locked -p cyber-tools --lib plugin_host::runtime_search
+      - name: Verify same-group plugin child lifetime
+        if: runner.os != 'Windows'
+        shell: bash
+        run: cargo test --locked -p cyber-tools --lib plugin_host::settlement_tests
+      - name: Verify host resource lifetime controls
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          source=crates/cyber-tools/src/plugin_host/lifetime.rs
+          cp "$source" "$RUNNER_TEMP/plugin-lifetime-positive.rs"
+          trap 'cp "$RUNNER_TEMP/plugin-lifetime-positive.rs" "$source"' EXIT
+          for control in tree early-resources unknown-resources; do
+            cp "$RUNNER_TEMP/plugin-lifetime-positive.rs" "$source"
+            python3 - "$source" "$control" <<'PYCONTROL'
+          from pathlib import Path
+          import sys
+          path = Path(sys.argv[1]); text = path.read_text()
+          if sys.argv[2] == 'tree':
+              before, after = '.wait_tree()', '.wait()'
+          elif sys.argv[2] == 'early-resources':
+              before = 'if let Some(held) = self.held.take() {\n            let _reply = schedule(held);'
+              after = 'if let Some(mut held) = self.held.take() {\n            held.resources.take();\n            let _reply = schedule(held);'
+          else:
+              before, after = 'std::mem::forget(resources);', 'drop(resources);'
+          assert text.count(before) == 1
+          path.write_text(text.replace(before, after))
+          PYCONTROL
+            query=same_group_child
+            if [[ "$control" == early-resources ]]; then query=plugin_host::settlement_tests::abandoned_initialization_keeps_scratch_until_cleanup_waits; fi
+            if [[ "$control" == unknown-resources ]]; then query=plugin_host::settlement_tests::unconfirmed_wait_retains_resources_without_signalling_cached_group; fi
+            if cargo test --locked -p cyber-tools --lib "$query" > "$RUNNER_TEMP/plugin-lifetime-$control-control.log" 2>&1; then
+              echo "Missing $control lifetime guard unexpectedly passed" >&2
+              exit 1
+            fi
+            python3 - "$RUNNER_TEMP/plugin-lifetime-$control-control.log" "$control" <<'PYCONTROL'
+          from pathlib import Path
+          import re, sys
+          text = re.sub(r'\x1b\[[0-?]*[ -/]*[@-~]', '', Path(sys.argv[1]).read_text())
+          cases = {
+              'tree': (['crashed_host_stops_its_same_group_child_and_releases_scratch',
+                        'acknowledged_shutdown_stops_a_same_group_child_after_leader_exit'],
+                       'plugin descendant retained stdout after host settlement'),
+              'early-resources': (['abandoned_initialization_keeps_scratch_until_cleanup_waits'],
+                                  'scratch removed before cleanup waiter ran'),
+              'unknown-resources': (['unconfirmed_wait_retains_resources_without_signalling_cached_group'],
+                                    'unconfirmed wait deleted host scratch'),
+          }
+          names, reason = cases[sys.argv[2]]
+          for name in names: assert name + ' ... FAILED' in text, text
+          assert reason in text, text
+          PYCONTROL
+          done
+          cp "$RUNNER_TEMP/plugin-lifetime-positive.rs" "$source"
+          cargo test --locked -p cyber-tools --lib plugin_host::settlement_tests
+      - name: Verify non-consuming proxy revocation
+        shell: bash
+        run: cargo test --locked -p cyber-sandbox --lib proxy::tests
+      - name: Verify bundled runtime startup receipts
+        shell: bash
+        run: |
+          set -euo pipefail
+          bun --version
+          deno --version
+          cargo test --locked -p cyber-tools --lib plugin_host::launch -- --include-ignored
+      - name: Verify missing runtime startup filters are detected
+        shell: bash
+        run: |
+          set -euo pipefail
+          source=crates/cyber-tools/src/plugin_host/launch.rs
+          cp "$source" "$RUNNER_TEMP/runtime-startup-positive.rs"
+          trap 'cp "$RUNNER_TEMP/runtime-startup-positive.rs" "$source"' EXIT
+          for runtime in bun deno; do
+            cp "$RUNNER_TEMP/runtime-startup-positive.rs" "$source"
+            python3 - "$runtime" <<'PY'
+          import sys
+          from pathlib import Path
+          path = Path('crates/cyber-tools/src/plugin_host/launch.rs')
+          text = path.read_text()
+          start = text.index('fn bun_arguments(' if sys.argv[1] == 'bun' else 'fn deno_arguments(')
+          end = text.index('\nfn deno_arguments(' if sys.argv[1] == 'bun' else '\nfn runtime_config(', start)
+          body = text[start:end]
+          flag, replacement = ('"--no-env-file".into(),', '') if sys.argv[1] == 'bun' else ('vec!["--no-config".into()]', 'Vec::new()')
+          assert body.count(flag) == 1
+          body = body.replace(flag, replacement)
+          path.write_text(text[:start] + body + text[end:])
+          PY
+            if [[ "$runtime" == bun ]]; then
+              name=bun_starts_bundled_rpc_without_project_preloads_or_dotenv
+            else
+              name=deno_starts_bundled_rpc_without_project_configuration_or_lock_changes
+            fi
+            if cargo test --locked -p cyber-tools --lib "plugin_host::launch::startup_tests::$name" -- --ignored --exact > "$RUNNER_TEMP/runtime-$runtime-control.log" 2>&1; then
+              cat "$RUNNER_TEMP/runtime-$runtime-control.log"
+              echo "Missing $runtime startup filter unexpectedly passed" >&2
+              exit 1
+            fi
+            cat "$RUNNER_TEMP/runtime-$runtime-control.log"
+            python3 - "$RUNNER_TEMP/runtime-$runtime-control.log" "$name" <<'PY'
+          import re, sys
+          from pathlib import Path
+          text = re.sub(r'\x1b\[[0-?]*[ -/]*[@-~]', '', Path(sys.argv[1]).read_text())
+          assert f'{sys.argv[2]} ... FAILED' in text
+          assert 'project startup code ran before the approved entry' in text or 'runtime startup failed' in text
+          PY
+          done
+          cp "$RUNNER_TEMP/runtime-startup-positive.rs" "$source"
+          cargo test --locked -p cyber-tools --lib plugin_host::launch -- --include-ignored
+      - name: Verify prepared workspace boundary is required
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          source=crates/cyber-sandbox/src/plugin_image.rs
+          cp "$source" "$RUNNER_TEMP/workspace-boundary-positive.rs"
+          trap 'cp "$RUNNER_TEMP/workspace-boundary-positive.rs" "$source"' EXIT
+          python3 - <<'PYCONTROL'
+          from pathlib import Path
+          path = Path('crates/cyber-sandbox/src/plugin_image.rs')
+          text = path.read_text()
+          original = 'const NAME: &str = "package.json";'
+          assert text.count(original) == 1
+          path.write_text(text.replace(original, 'const NAME: &str = "without-boundary.json";'))
+          PYCONTROL
+          name=deno_starts_bundled_rpc_without_project_configuration_or_lock_changes
+          if cargo test --locked -p cyber-tools --lib "plugin_host::launch::startup_tests::$name" -- --ignored --exact > "$RUNNER_TEMP/workspace-boundary-control.log" 2>&1; then
+            cat "$RUNNER_TEMP/workspace-boundary-control.log"
+            echo 'Missing-workspace-boundary control unexpectedly passed' >&2
+            exit 1
+          fi
+          cat "$RUNNER_TEMP/workspace-boundary-control.log"
+          python3 - "$RUNNER_TEMP/workspace-boundary-control.log" <<'PYCONTROL'
+          from pathlib import Path
+          import re, sys
+          text = re.sub(r'\x1b\[[0-?]*[ -/]*[@-~]', '', Path(sys.argv[1]).read_text())
+          assert 'deno_starts_bundled_rpc_without_project_configuration_or_lock_changes ... FAILED' in text
+          assert 'runtime startup failed' in text
+          PYCONTROL
+          cp "$RUNNER_TEMP/workspace-boundary-positive.rs" "$source"
+          cargo test --locked -p cyber-tools --lib plugin_host::launch -- --include-ignored
+      - name: Verify real production plugin hosts
+        if: runner.os != 'Windows'
+        shell: bash
+        run: cargo test --locked -p cyber-app --test plugins
+      - name: Verify unsafe tool overlays fail the production regression
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          source=crates/cyber-tools/src/plugin_host/launch.rs
+          cp "$source" "$RUNNER_TEMP/plugin-launch-positive.rs"
+          trap 'cp "$RUNNER_TEMP/plugin-launch-positive.rs" "$source"' EXIT
+          python3 - <<'PY'
+          from pathlib import Path
+          path = Path('crates/cyber-tools/src/plugin_host/launch.rs')
+          text = path.read_text()
+          original = '        let environment =\n            super::environment::build(plugin.name, plugin.root, &scratch.path, &wrapped.env);'
+          assert text.count(original) == 1
+          replacement = original.replace('let environment =', 'let mut environment =') + '\n        environment.extend(launch.config.env.set.clone());'
+          path.write_text(text.replace(original, replacement))
+          PY
+          if cargo test --locked -p cyber-app --test plugins plugin_bootstrap_environment_ignores_tool_overlays_and_owns_home -- --exact > "$RUNNER_TEMP/plugin-overlay-control.log" 2>&1; then
+            cat "$RUNNER_TEMP/plugin-overlay-control.log"
+            echo 'Unsafe-overlay control unexpectedly passed' >&2
+            exit 1
+          fi
+          cat "$RUNNER_TEMP/plugin-overlay-control.log"
+          python3 - "$RUNNER_TEMP/plugin-overlay-control.log" <<'PY'
+          import re, sys
+          from pathlib import Path
+          text = re.sub(r'\x1b\[[0-?]*[ -/]*[@-~]', '', Path(sys.argv[1]).read_text())
+          assert 'plugin_bootstrap_environment_ignores_tool_overlays_and_owns_home ... FAILED' in text
+          assert 'inspect_bootstrap was not advertised' in text or 'assertion `left == right` failed' in text
+          PY
+          cp "$RUNNER_TEMP/plugin-launch-positive.rs" "$source"
+          cargo test --locked -p cyber-app --test plugins plugin_bootstrap_environment_ignores_tool_overlays_and_owns_home -- --exact
+      - name: Retain unsafe-overlay counterexample
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: plugin-overlay-control-${{ matrix.os }}
+          path: |
+            ${{ runner.temp }}/plugin-overlay-control.log
+            ${{ runner.temp }}/runtime-bun-control.log
+            ${{ runner.temp }}/runtime-deno-control.log
+            ${{ runner.temp }}/workspace-boundary-control.log
+            ${{ runner.temp }}/runtime-search-control.log
+            ${{ runner.temp }}/plugin-lifetime-*-control.log
+          if-no-files-found: warn
+          retention-days: 14