[cuihtlauac]

What & why

A captured approval trail showed every command arriving as argv = ["bash","-lc","<script>"]. That hollows out the gate two ways: the Resolves: line is always /usr/bin/bash (the real binaries are chosen by $PATH inside the script), and one root approval authorizes a whole bundle of effects hidden in a wall of text.

This generalizes a request's flat pipeline into a Plan tree the daemon executes directly — fork/exec per stage with pipes, redirections, env, per-stage run-as, and sequencing — with no shell on the privileged path. The load-bearing invariant: the structure the human approves is literally the structure that runs.

Implements backlog item "Structured composite-execution plan" (first increment). Rebased onto main (now includes the bell/blink work from #58); one commit.

Highlights

• Schema (src/protocol.rs): JSON-native op-tagged Plan enum — run, pipe, seq, redirect (incl. append + 2>&1), with-stdin-from, setenv, chdir, run-as ([ROOT]/[as user]), with-accepted-exit-codes, and an explicit system opaque escape hatch. Recursive validate_tree reuses the existing has_dangerous_chars gate on every leaf + depth/node bounds, inside the one ValidatedRequest::validate constructor (typestate preserved). A flat pipeline desugars into a Plan, so existing clients are unaffected; effective_privileged = privileged || plan-contains-run-as closes the unprivileged-smuggling-root gap.
• Executor (src/executor.rs): two passes (pure compile → leaf list + sequencing tree; run → pipe groups, seq short-circuit, one plan-wide deadline). Escalated leaves spawn as sudo [-u user] -- <literal argv> / pkexec [--user u] argv, never sudo sh -c. pipeline_to_shell and the pkexec sh -c branch are deleted. setenv is held to the env allowlist so it can't become a bypass.
• Prompt (src/tui.rs): every stage renders its run-as tag and its own resolved binary (fixing the vacuous single /usr/bin/bash line); system stages flagged opaque; a stage-count cap keeps [y/N] on-screen. Simple single commands keep the classic one-line form.
• Wiring (src/server.rs, src/mcp.rs): dispatch keys off effective privilege; structurally-invalid plans are rejected before prompting; audit logs are plan-aware; the MCP execute tool gained a plan parameter, documented with the actionable seq-short-circuit and sudo-in-pipe caveats.

Design decisions

• Per-leaf sudo (not a root daemon). The daemon stays same-uid; escalation is per-stage sudo/pkexec with literal argv. Removes the shell from the privileged path with no deployment or threat-model change. (A root-daemon + direct-setuid model is a future, separately-gated milestone.)
• One documented deviation: pipe stages keep setsid (a pipelined child can't interactively prompt, so it detaches and relies on cached credentials — matching prior behavior); a single escalated leaf uses setpgid + the foreground guard and can prompt. The sudo-credential-in-pipe consequence is documented in the code and backlog.

Tests

Rung-2 properties (render-vs-execute structural identity over random plans, compile totality, a structural no-shell-on-privileged-path check), a Kani leaf harness, tests/plan_exec.rs (incl. end-to-end through the real daemon), and wire-level plan validation tests. Full lib suite + integration green; strict clippy -D warnings clean; release build clean.

The one unrelated failing test in the suite is the pre-existing timing-flaky burst_connections_above_cap_get_busy_response (tracked separately).

🤖 Generated with Claude Code