5 Commits

Include renames

Author	SHA1	Message	Date
KRATOS	90014210d2	fix(daemon): publish status files atomically (#949) ... * fix(daemon): publish status files atomically * fix(daemon): bind status publication to directory handle * fix(daemon): validate status directory access * fix(daemon): accept current token directory owner * fix(daemon): migrate owned runtime directories safely * fix(daemon): open Windows security handle relatively * fix(daemon): use current NT directory object * fix(observability): harden existing crash directories * fix(security): bind crash report creation to private root * fix(observability): atomically publish crash reports * fix(observability): preserve committed crash reports * fix(observability): revalidate committed crash path * fix(daemon): secure runtime lifecycle boundaries * fix(daemon): bind status ownership through cleanup * fix(daemon): preserve Windows status security * fix(daemon): retain trusted runtime root for lifecycle * fix(daemon): roll back redirected socket binds * fix(daemon): address status publication review	2026-09-12 18:18:12 +05:30
KRATOSandgnanam1990	f7ee189ba5	fix: resolve 15 findings from the 2026-06-20 deep audit (#281) ... * docs(audit): 2026-06-20 deep adversarial audit report Audit-only deliverable (no source changed). Fresh origin/main (bfbdbb1) deep read across 13 subsystems with per-finding adversarial re-verification, plus reconciliation of the 2026-06-10/2026-06-13 audits. Result: build/vet clean; race detector finds 0 data races (67/68 pkgs; the 3 internal/tools failures are -race-only timing flakes). 35 surviving findings (1 high, 15 medium, 17 low, 2 info); 64 prior findings fixed, 14 partial, 12 still-open. * fix(providerhealth): strip credentials on cross-host redirect (AUDIT-M10) The connectivity probe's CheckRedirect re-validated the redirect host against the SSRF blocklist but never stripped auth headers. Go's stdlib only auto-strips Authorization/Cookie/WWW-Authenticate on a host change — not x-api-key, x-goog-api-key, or custom provider headers — so a baseURL that 3xx-redirects to an attacker-controlled public host received the provider API key verbatim. Thread the exact set of auth-bearing header names (kind default + profile AuthHeader + CustomHeaders keys + well-known) into the client and Header.Del them whenever the redirect target's host:port differs from the original. Regression test asserts the creds are dropped cross-host and kept same-host. * fix(sessions): fsync events.jsonl append for crash durability (AUDIT-M12) appendEventLocked wrote the event into the page cache and returned success, then durably wrote (fsync'd) the derived metadata. A crash after the metadata fsync but before the events.jsonl page flushed left metadata.EventCount ahead of the log — silently dropping the last appended event, including the checkpoint a /rewind targets. Add file.Sync() before Close so the log is at least as durable as the metadata derived from it. (Note: the fsync itself has no portable unit-test seam; covered by the existing sessions append/durability suite for no-regression.) * fix(cron): DST fall-back double-fire + claim double-grant (AUDIT-M4, AUDIT-M5) M4: fireJob/claimFire computed the next slot from the raw sub-second now(), so schedule.Next's DST fall-back collapse guard (which only engages for a minute-aligned 'after') never fired — a daily job in the repeated wall-clock hour ran twice on the fall-back day. Feed sched.Next a minute-truncated instant at the claim and the post-exec advance (the due-check still uses the real instant so sub-minute NextRunAt jobs are unaffected). M5: claimFire left NextRunAt unchanged when the schedule couldn't advance (unparseable/exhausted spec), so two concurrent schedulers both saw the job due and both fired it. Pause the job inside the same locked claim instead: the winner still fires once and the post-exec keeps it paused; the loser sees a non-active job and is refused. Tests: claimFire double-claim on an unadvanceable job (second refused, job paused) and a DST fall-back daily job advancing past the repeat (not re-firing it). * fix(daemon): bound the control handshake + track bridge conns for Shutdown (AUDIT-M7, M8, I1) The remote bridge clears the connection deadline before handing the conn to Server.ServeConn, and the local socket set none, so handleConn's two ReadControl handshake calls could block forever — an authenticated-but-idle remote peer pinned a bridge connection slot (32 of them exhaust the bridge), and the local path had the same unbounded read. Set a handshake deadline in handleConn and clear it before the (long-lived) streaming dispatch (M7, I1). ServeConn also bypassed trackConn, so Shutdown's conns-close sweep couldn't close a remote conn stalled in that handshake read. Track/untrack it like the local accept loop does (M8). Tests: handleConn returns under a shortened handshake deadline when the peer never sends hello; Shutdown closes a ServeConn'd conn well under the 10s deadline. * fix(swarm): atomic rename-with-verify mailbox stale-lock break (AUDIT-M13) The stale-break compared two consecutive reads of the SAME lock file (string(data) == string(stale)), so the equality was always true and gave no protection: two waiters could both observe a stale lock and both os.Remove it while a third recreated it via O_EXCL, leaving two live writers to the same per-agent inbox (split-brain). Replace with the proven rename-with-verify used by the cron/hooks/oauth locks: rename the stale file aside (only one racer wins the rename), re-check the moved file's mtime is still stale before deleting, and rename it back if a holder rotated a fresh lock in the gap. Tests: a genuinely stale lock is reclaimed (no .stale.* leftover); a fresh held lock is never broken. (The double-break race itself is not deterministically unit-testable; the fix mirrors the cron/hooks/oauth pattern.) * fix(streamjson): anchor api_key redaction so prose isn't mangled (AUDIT-M1) The api_key secret pattern used ["'=:\s]+ as the delimiter class, so a bare space after the marker counted — 'the api_key: foo setting' and 'apiKey value spans' had the following word replaced with [REDACTED] in every emitted stream-json event (text deltas, tool output, final answer). Require a real assignment delimiter (= or :) and a credential-length body, mirroring the already-anchored sk-/bearer patterns. Prose survives; real api_key=... secrets still redact. * fix(tools): snapshot exec-session lastUsedAt under its lock to fix prune race (AUDIT-L15) sessionToPruneLocked sorted on execSession.lastUsedAt while holding only manager.mu, but touch() writes lastUsedAt under session.mu — a data race on a time.Time that could torn-read and mis-select the prune victim. Snapshot each session's lastUsedAt via a session.mu-guarded getter before sorting (lock order stays manager.mu -> session.mu; no path takes them the other way). Adds a -race regression test driving touch() concurrently with the prune selection. * fix(swarm): release per-job context on MaxRuns completion (AUDIT-L13) Scheduler.run returned on MaxRuns completion without calling job.cancel(), so the job's derived context (and the goroutine context.WithCancel spawns to propagate parent cancellation) leaked until the whole scheduler was cancelled at session end. Add defer job.cancel() (idempotent with Cancel/Close) so it is released on every exit path. * fix(agent): route post-compaction and max-turns connects through streamWithReconnect (AUDIT-L1) The main turn connect already retries transient disconnects via streamWithReconnect, but the post-compaction retry connect, the reactive mid-stream reconnect, and finalAnswerAfterMaxTurns called provider.StreamCompletion directly — a single transient hiccup on those (e.g. the final summary after a long autonomous/cron run, or the turn right after a context-limit compaction) failed the whole run with no retry. All three are pre-content connects, so routing them through the helper carries no OnText-duplication risk. * fix(cli): reject trailing args after --skip-permissions-unsafe (AUDIT-L3) zero --skip-permissions-unsafe "fix bug" silently discarded the prompt and launched the interactive TUI, so a scripted one-shot unsafe invocation appeared to hang. Reject any trailing positional arg loudly (after checking for a misplaced --add-dir first, which keeps its specific error), pointing users at the working form: zero exec --skip-permissions-unsafe -p "...". * fix(provideroauth): error on present-but-wrong-shape chatgpt account-id claim (AUDIT-L11) extractChatGPTAccountID returned ("", nil) both when the id_token had no account-id claim AND when OpenAI's auth namespace was present but the account id was missing/empty/non-string. The latter is a claim-shape change: the caller only warns on a non-nil error, so it silently omitted the chatgpt-account-id header and every Codex call 401'd with no diagnostic, indistinguishable from an expired token. Return an error for the present-but-unusable case so the login warning fires; a genuinely absent claim still soft-skips ("", nil). * test(tools): widen exec-session poll windows so the suite is -race-clean (AUDIT report §2) Three exec-session timing tests assumed a 250ms-sleep / immediate child would finish within a fixed 1000ms yield. Under -race the child (the race-instrumented test binary) starts slowly enough to overrun it, so the tool correctly returned a still-running session_id instead of an exit_code and the asserts failed — the non-green -race suite the audit flagged in §2. collect() returns as soon as the session completes, so widening the poll window to 30s makes them deterministic under -race without slowing the passing case. Test-only; no behavior change. * docs(audit): mark remediation status (fixed/deferred/skipped) for the 2026-06-20 audit * docs(audit): strip trailing whitespace from the report (fix git diff --check) * fix(tools): drain PTY output before marking an exec session done (AUDIT-M14) A TTY exec session's stdout was copied into the buffer by a fire-and-forget io.Copy goroutine, but startSession's Wait goroutine called markDone (and then removed the session) as soon as command.Wait() returned — before that goroutine had necessarily drained the master FD. The command's final output chunk (e.g. a test runner's last PASS/FAIL line) could be lost on exit, and since the exited session is removed it could not be polled back. This also surfaced as the flaky TestExecCommandTTYSessionAcceptsInputOnLinux on loaded CI. Make the PTY cleanup (called after command.Wait, before markDone) join the copy goroutine before closing the master: the child has exited so the master EOFs once io.Copy finishes draining; waiting for that (bounded by bashWaitDelay) guarantees all output is buffered before the session is marked done. Closing the master first would truncate the unread tail, so the join precedes the Close. Linux-only path (exec_pty_linux.go); verified via GOOS=linux build+vet (the TTY test only runs on linux/CI). * docs(audit): mark M14 fixed (PTY drain) in remediation status --------- Co-authored-by: gnanam1990 <[email protected]>	2026-06-21 00:44:23 +05:30
KRATOS	fbbfdbf3f2	Harden background daemon: stdout integrity, lifecycle, and single-instance lock (#274) ... * harden background daemon: stdout integrity, lifecycle, single-instance lock Deep review of internal/daemon (worker pool, launcher, control server, session fan-out, single-instance lock) found and fixes a stdout-integrity bug plus several lifecycle/locking hazards. Each fix has a regression test; the daemon suite passes under -race. Worker stdout integrity - Replace the capped bufio.Scanner (64 KiB) on a worker's stdout with an uncapped bufio.Reader: a legitimately large stream-json line from our own trusted worker is no longer silently dropped (the 1 MiB cap belongs to untrusted network frames, not this local pipe). - Surface a stdout read error as a run failure instead of swallowing it as a clean success, and kill the worker first so it can't block writing to the now-unread pipe and hang Wait. Control-server lifecycle - Track open connections and close them on Shutdown so a single idle/hostile client can no longer wedge drain (and SIGTERM cleanup) forever. - Guard the listener with a mutex and re-check the shutdown signal after bind so a shutdown requested in the bind window is not lost. - Honor shutdown during buffered-history replay too. Session fan-out - A slow subscriber that drops live lines now receives a namespaced gap notice when its channel drains, instead of silently losing output. - Hold the session lock across the (non-blocking) broadcast sends to close a latent send-on-closed-channel panic when a subscriber cancels mid-send. Single-instance lock - Reclaim a stale lock with an atomic rename-with-verify instead of a blind remove, so two instances starting at once cannot both reclaim and end up both holding the lock; a holder that reacquires in the gap is restored. Client + pool - Bound the control handshake with an I/O deadline so a peer that never replies can't wedge Dial/NewClientConn. - Key the active-worker map by a monotonic id rather than PID (the OS reuses PIDs the instant a worker exits). - Group-terminate on context cancel so a stuck worker's children are not orphaned. * daemon: add -race regression test for the Session.Line lock-hold invariant Session.Line holds s.mu across its non-blocking subscriber sends so cancel()/ finish() cannot close a subscriber channel mid-send (send-on-closed-channel panic). That invariant had no concurrency test. Add one that drives Line concurrently with Subscribe/cancel and finish; it panics with a data race if the lock-hold is reverted and passes with it (verified both ways under -race).	2026-06-20 22:21:28 +05:30
KRATOS	f857c4afb4	feat(daemon): TLS remote bridge — authenticated network access to the daemon (#211) ... * feat(daemon): TLS remote bridge — authenticated network access to the daemon Add internal/daemon/remote: an OPT-IN, TLS-only network bridge on top of the local daemon. A remote client drives the SAME SessionManager/Pool over the network behind bearer-token auth, reusing the daemon's framing and dispatch unchanged. The local Unix-socket daemon stays the default and is unchanged. - Bridge: per accepted TLS connection, authenticate THEN hand to the daemon's control dispatch via the new Server.ServeConn seam — a remote session runs under the same sandbox/risk model as a local one (never bypasses it). - Authenticator + TokenAuthenticator: constant-time bearer-token check, token from $ZERO_DAEMON_REMOTE_TOKEN or a file; optional attestation hook (no-op default). Auth happens before any control frame; failure closes the connection after a small backoff; tokens are never logged. - RemoteClient (DialRemote): verified TLS dial (never InsecureSkipVerify) + auth handshake, then the existing daemon.Client via the new NewClientConn seam, so remote and local share one protocol. - Fail-closed: TLS mandatory (refuses without cert/key), a configurable min-protocol-version floor, the 1 MiB frame cap reused, and a bounded concurrent-connection cap that refuses overflow. - CLI: `zero daemon serve-remote --addr --tls-cert --tls-key`; `run`/`attach` gain `--remote <addr> [--token --ca-cert --server-name]`. Daemon seams added (additive, behavior unchanged): Server.ServeConn, NewClientConn. SessionLink (event POST) and git-bundle repo transfer are documented follow-ups. Tests cover auth accept/reject (env + file), TLS-required, cert verification, version floor, run/status/attach round-trip, re-attach resumption, connection cap, and ListenAndServeTLS/Close. Gates: gofmt / vet / build (host+linux+ windows) / test -race / staticcheck (no new) / govulncheck (0) / deadcode (no new) all pass. * swarm: de-flake TestMailboxConcurrentSends on Windows CI The 200-way concurrent-send stress test inherited from the swarm package timed out on Windows CI (103/200 sends hit the 10s lock timeout): the lock's 20ms retry sleep starves waiters when Windows file ops are slow under heavy contention. Shorten the retry to 2ms (a freed lock is re-acquired promptly) and raise the test's lock timeout to 60s so a legitimately-slow CI never times a send out. Passes repeatedly under -race. (CI de-flake of a test that surfaced on #210's Windows smoke; functionally unrelated to the OAuth changes.) * remote: address CodeRabbit re-review (TLS dial + Close idempotency) - client: replace the deprecated, non-cancellation-aware tls.DialWithDialer with a context-aware tls.Dialer.DialContext (resolves the golangci-lint noctx CI blocker; the context bounds the dial + TLS handshake). - bridge: Close now clears b.listener under the lock, so a repeat Close is a no-op instead of returning a closed-listener error (matches its doc). Test asserts a double Close succeeds. Gates: gofmt/vet/build(host+linux+windows)/test -race/staticcheck(no new)/ govulncheck(0)/deadcode(no new) all pass.	2026-06-15 18:48:07 +05:30
KRATOS	135e3c5657	feat(daemon): zero daemon — worker pool + session supervisor over a local control socket (#203) ... * feat(daemon): add `zero daemon` — worker pool + session supervisor over a local control socket Adds internal/daemon + `zero daemon start|stop|status|run|attach`: a long-running local service that supervises a pool of headless `zero exec` workers and routes multiple agent sessions to them over an owner-only Unix-domain control socket. Additive — interactive and one-shot exec are unchanged. Reuses zero's building blocks: - internal/background: ConfigureChildProcessGroup (process-group setup) + TerminateProcess (cross-platform terminate) for worker kill/drain. The pool does its own os/exec and uses background only for those helpers. - internal/streamjson: the worker speaks stream-json on stdout; the daemon forwards those lines to clients. - internal/cli exec: a worker is `zero exec --output-format stream-json`. Pieces (reimplemented in Go from a reference daemon): - protocol.go: framed control codec — 4-byte BE length + 1 kind byte, 1 MiB cap, JSON control messages, version negotiation. - pool.go + backoff.go: bounded worker pool — at-least-once dispatch with exponential backoff+jitter retry capped by MaxAttempts, EXIT_TEMPFAIL(75)/ EXIT_PERMANENT(76) handling, graceful drain + kill-timeout. zero's exec is one-shot, so workers are on-demand (one session per worker = the lease), not warm long-lived slots (a persistent worker mode is a follow-up). - session.go: SessionManager — sessionID->worker routing, lease (one active request per worker), queue when the pool is full, per-session output buffer for attach + metrics. - server.go + lock.go + socket.go + paths.go: single-instance PID-file lock with stale-lock (dead-PID) recovery, status file, owner-only socket, accept loop; cleans up lock/socket/status on exit. - launcher.go: production worker launcher. client.go: control-socket client. Security model: - Control socket is LOCAL-ONLY (AF_UNIX loopback file, never a TCP port) and owner-only: socket 0600 + parent dir 0700 on POSIX (Windows relies on the per-user profile ACL; a dedicated pipe ACL is a follow-up). - Workers stay sandboxed: the launcher SCRUBS the sandbox re-entrancy markers (ZERO_SANDBOXED / ZERO_SANDBOX_BACKEND) from each worker's env so the worker re-establishes its OWN sandbox instead of inheriting a pass-through plan, while propagating the rest of the policy config/env. The daemon never bypasses the sandbox. - Control frames over the 1 MiB cap are rejected before allocation. Robustness: a crashed worker never takes down the daemon (backoff+jitter retry, MaxAttempts cap, EXIT_PERMANENT stops retry); drain gives a grace window then force-kills stragglers; a stale lock from an unclean exit is reclaimed. Out of scope (follow-up): remote session-linking; warm pre-spawned persistent workers; Windows named-pipe ACL. Tests: protocol round-trip + oversize/unknown-kind rejection; backoff bounds; pool spawn/retry-backoff/permanent/cap/queue/drain; session lease/route/queue/ attach; lock single-instance + stale recovery; launcher env-scrub (incl. an end-to-end check that the spawned worker process receives scrubbed env); server e2e start->run->stream-json->status->attach->stop with a fake worker; CLI usage/validation/not-running paths. Live-verified start/status/stop (0600 socket, 0700 dir, file cleanup). Platform files behind explicit //go:build tags. * daemon: address review — help listing, extra-arg rejection, lock write error, bounded sessions - cli/app.go: list `daemon` in `zero --help` so the command is discoverable. - cli/daemon: `stop`/`status` reject extra arguments; `attach` rejects more than one session id (fail fast on typos instead of silently ignoring tokens). - daemon/lock: check the PID fmt.Fprintf error — a partial/failed write would leave a malformed lock file that another process reads as stale and wrongly reclaims, breaking the single-instance guarantee; on write failure remove the file and return the error. - daemon/session: bound the registry with MaxSessions (default 256) — evict the oldest FINISHED sessions once past the cap so a long-running daemon doesn't accumulate sessions without limit; running/queued sessions are never evicted, so attach-after-finish for recent sessions is preserved. Tests: CLI extra-arg rejection; finished-over-cap eviction + running-never-evicted. Gates: gofmt, vet, build, test (incl -race), staticcheck (no new), govulncheck (0), deadcode (no new), GOOS=linux+windows cross-compile.	2026-06-14 22:16:37 +05:30