Merge pull request #162 from h1d3mun3/fix/macos-sweep-path-pin

fix(macos): pin PATH on the share sweep's guest round trip

Author: h1d3mun3

augur

@@ -3835,7 +3835,31 @@ _refresh_macos_shares_locked() {
     (( n > 2000 )) && [[ "$quiet" != quiet ]] && info "Refreshing ${n} changed shared file(s) in the guest — this takes a moment."
 
     # One round trip: the program is an argument, so stdin stays free for the NUL-separated list.
-    out="$(ssh_macos "$vm" "python3 -c '$(_macos_msync_program)' ${_MACOS_SWEEP_TRIES} ${_MACOS_SWEEP_DETAIL}" < "$list" 2>&1)" || {
+    #
+    # PATH-PINNED, for the reason verify_macos_egress_locked already pins its own probes (augur:1748-
+    # 1755): augur's `~/.augur-env` puts `$HOME/.local/bin` FIRST in the PATH of every guest shell,
+    # including the non-login shell `ssh <host> <cmd>` runs, which still sources `~/.zshenv`. A guest
+    # that plants `~/.local/bin/python3` therefore chooses what this call returns.
+    #
+    # WHAT THAT WOULD BUY, and why this site matters more than the tripwire's three: this is the
+    # MECHANISM, not the check. A shadowed interpreter here can print `ok=N` while invalidating
+    # nothing, so the operator is told their edit landed when it did not — and the edit that did not
+    # land may be the one tightening the rules on a guest that is misbehaving. It runs at four attach
+    # points AND every `AUGUR_MACOS_REFRESH_INTERVAL` seconds for the life of the VM, unattended,
+    # where verify_macos_share_freshness runs twice per `up`. Shadowing only the CHECK would make the
+    # self-test lie while real sweeps still worked; shadowing THIS stops the sweeps.
+    #
+    # `/usr/bin/python3` is on the sealed, read-only system volume with SIP on, so a project clone
+    # cannot replace it and this cannot cause a false "not found" — measured on a 26.6 guest: `/` is
+    # `apfs, sealed, local, read-only`, `csrutil status: enabled`, and `ls -lO /usr/bin/python3` shows
+    # `restricted`. (An earlier draft of this comment said the reason was the clone's lack of sudo.
+    # That is false — augur:3202-3204 uses password sudo against project VMs — and the seal is why.)
+    #
+    # NOT A COMPLETE ANSWER, deliberately stated so nobody reads it as one: PATH pinning does not stop
+    # a shell FUNCTION or an alias. `python3() { … }` in `~/.zshenv` — the file augur itself appends
+    # to — defeats this, measured. It removes the cheapest PATH-resolved vector and matches the
+    # sibling; it does not make the guest's answer trustworthy. The sibling's pin has the same hole.
+    out="$(ssh_macos "$vm" "export PATH=/usr/bin:/bin:/usr/sbin:/sbin; python3 -c '$(_macos_msync_program)' ${_MACOS_SWEEP_TRIES} ${_MACOS_SWEEP_DETAIL}" < "$list" 2>&1)" || {
         warn "Could not refresh the guest's view of the shared files: ${out%%$'\n'*}"
         warn "  Host-side edits may not be visible in the guest (issues #124/#135). \`down --macos && up --macos\` clears it."
         rm -f "$pending" "$list" 2>/dev/null || true

tests/41_macos_share_refresh.sh

@@ -56,9 +56,26 @@ SSHLOG="$TMPD/sshlog"       # the remote command string, one per call
 STDINLOG="$TMPD/stdinlog"   # the NUL-separated path list it was fed
 : > "$SSHLOG"; : > "$STDINLOG"
 SSH_OUT="ok=3"; SSH_RC=0
-ssh_macos() {                 # only ever driven with the piped `python3 -c` shape here
+ssh_macos() {
     printf '%s\n' "$*" >> "$SSHLOG"
-    cat > "$STDINLOG"
+    # ONLY THE SWEEP IS PIPED FROM THE HOST. Its NUL-separated list arrives on this function's stdin;
+    # nothing else in this file does that. The header used to say "only ever driven with the piped
+    # `python3 -c` shape here" and an unconditional `cat` was correct while that held — it stopped
+    # holding when the mode-reconcile arms began driving `cmd_claude_macos` and `cmd_shell_macos`,
+    # which reach this stub as `-t` interactive shapes with nothing piped. There the `cat` drains
+    # whatever stdin the SUITE inherited: /dev/null under CI (invisible), a TTY on a developer's
+    # terminal (`make offline-tests` stops dead with no error and no timeout). That is precisely the
+    # failure tests/39 exists for, and it was live on main — see its header for the two files that
+    # shipped in this state before.
+    #
+    # `printf %s` is excluded ahead of the `python3 -c` arm rather than after it because the freshness
+    # tripwire's probes carry BOTH: their pipe is inside the remote command string, so from here they
+    # are unpiped like the interactive shapes. Matching `python3 -c` alone would regrow the bug the
+    # first time this file drives them.
+    case "$*" in
+        *"printf %s"*)  : ;;                    # tripwire probes — the pipe is REMOTE, not from us
+        *"python3 -c"*) cat > "$STDINLOG" ;;    # the sweep — the list comes from the host
+    esac
     printf '%s' "$SSH_OUT"
     return "$SSH_RC"
 }
@@ -300,6 +317,26 @@ if tail -1 "$SSHLOG" | grep -q " ${_MACOS_SWEEP_TRIES} ${_MACOS_SWEEP_DETAIL}$";
     ok "the retry count and the detail cap are passed, in that order"
 else fail "the retry count and the detail cap are passed, in that order" "$(tail -1 "$SSHLOG")"; fi
 
+section "the sweep's interpreter cannot be shadowed through PATH"
+
+# THE MECHANISM, NOT THE CHECK. augur's own ~/.augur-env puts $HOME/.local/bin FIRST in the PATH of
+# every guest shell — including the non-login shell `ssh <host> <cmd>` runs, which still sources
+# ~/.zshenv — so an unpinned `python3` here is chosen by the guest. Shadowing the freshness tripwire
+# would make the self-test lie while real sweeps still worked; shadowing THIS makes the sweep print
+# `ok=N` while invalidating nothing, and the edit that then never lands may be the operator tightening
+# the rules on a guest that is misbehaving. verify_macos_egress_locked pins its own probes for the
+# same reason (augur:1748-1755); this arm is what keeps the two from drifting apart again.
+#
+# Asserted on the FIRST line, before `python3`, because order is the property: a pin appended after
+# the interpreter has already resolved is not a pin.
+if head -1 "$SSHLOG" | grep -q "export PATH=/usr/bin:/bin:/usr/sbin:/sbin; *python3 -c "; then
+    ok "the sweep pins PATH to system dirs ahead of \`python3\`"
+else fail "the sweep pins PATH to system dirs ahead of \`python3\`" "a guest-planted ~/.local/bin/python3 would decide what this round trip reports: $(head -1 "$SSHLOG")"; fi
+# The pin must not have cost the protocol: the program is still an ARGUMENT (stdin stays free for the
+# NUL list), and _macos_msync_program still contains no single quote of its own.
+if [[ "$(tr -dc '\0' < "$STDINLOG" | wc -c | tr -d ' ')" -gt 0 ]]; then ok "…without disturbing the NUL-separated list on stdin"
+else fail "…without disturbing the NUL-separated list on stdin" "the pin was added in a way that consumed stdin or broke the quoting"; fi
+
 section "--share-refresh off stops the sweep — at every call site at once"
 
 # `off` is enforced INSIDE refresh_macos_shares rather than by an `if` copied to the four attach call