diff --git a/apps/desktop/src/App.test.tsx b/apps/desktop/src/App.test.tsx index cc20aa3..5577b1e 100644 --- a/apps/desktop/src/App.test.tsx +++ b/apps/desktop/src/App.test.tsx @@ -612,6 +612,54 @@ describe("request workbench", () => { expect(screen.getByRole("button", { name: "Remove trust" })).toBeInTheDocument(); }); + it("keeps CA trust retryable after the user rejects the system prompt", async () => { + const user = userEvent.setup(); + window.__TAURI_INTERNALS__ = {}; + const untrusted = structuredClone(fixture) as unknown as WorkspaceBootstrap; + untrusted.capture.mode = "proxy"; + untrusted.capture.profile = "Explicit TLS proxy"; + untrusted.capture.endpoint = "http://127.0.0.1:43125"; + untrusted.capture.certificateAuthority = { + state: "ready", + canManageTrust: true, + fingerprintSha256: "AA:BB:CC:DD", + subject: "mitmproxy", + validFromUnixMs: 1_577_836_800_000, + validUntilUnixMs: 4_070_908_800_000, + privateMaterial: "restricted", + trust: "not_trusted", + detail: null, + }; + const trusted = structuredClone(untrusted); + trusted.capture.certificateAuthority.trust = "trusted"; + let installAttempts = 0; + vi.mocked(invoke).mockImplementation(async (command) => { + if (command === "bootstrap_workspace") return structuredClone(untrusted); + if (command === "install_certificate_authority_trust") { + installAttempts += 1; + if (installAttempts === 1) { + throw new Error("certificate trust update failed: the user cancelled the security prompt"); + } + return structuredClone(trusted); + } + throw new Error(`Unexpected command: ${command}`); + }); + + render(); + await user.click(await screen.findByRole("button", { name: "Trust CA" })); + + expect(await screen.findByRole("alert")).toHaveTextContent("user cancelled"); + expect(screen.getByText("Ready · not trusted")).toBeInTheDocument(); + expect(screen.getByRole("button", { name: "Proxy" })).toHaveAttribute("aria-pressed", "true"); + const retry = screen.getByRole("button", { name: "Trust CA" }); + expect(retry).toBeEnabled(); + + await user.click(retry); + expect(await screen.findByText("Ready · trusted")).toBeInTheDocument(); + expect(screen.getByRole("button", { name: "Remove trust" })).toBeInTheDocument(); + expect(installAttempts).toBe(2); + }); + it("removes certificate trust and accepts the safe gateway fallback", async () => { const user = userEvent.setup(); window.__TAURI_INTERNALS__ = {}; diff --git a/crates/sidecar-runtime/src/lib.rs b/crates/sidecar-runtime/src/lib.rs index d47c937..bae4853 100644 --- a/crates/sidecar-runtime/src/lib.rs +++ b/crates/sidecar-runtime/src/lib.rs @@ -810,19 +810,46 @@ fn macos_install_certificate(certificate_der: &[u8]) -> io::Result { (certificate, added) } }; - if let Err(error) = settings.set_trust_settings_always(&certificate) { - if added_to_keychain { - let _ = certificate.delete(); - } - return Err(macos_security_error( - "set user certificate trust", - error.code(), - )); - } + set_macos_trust_with_new_certificate_cleanup( + added_to_keychain, + || { + settings + .set_trust_settings_always(&certificate) + .map_err(|error| macos_security_error("set user certificate trust", error.code())) + }, + || match certificate.delete() { + Ok(()) => Ok(()), + Err(error) if error.code() == ERR_SEC_ITEM_NOT_FOUND => Ok(()), + Err(error) => Err(macos_security_error( + "remove rejected certificate from login keychain", + error.code(), + )), + }, + )?; macos_wait_for_user_trust(certificate_der, Some(CertificateTrustState::Trusted))?; Ok(true) } +#[cfg(any(target_os = "macos", test))] +fn set_macos_trust_with_new_certificate_cleanup( + added_to_keychain: bool, + set_trust: impl FnOnce() -> io::Result<()>, + remove_new_certificate: impl FnOnce() -> io::Result<()>, +) -> io::Result<()> { + let Err(trust_error) = set_trust() else { + return Ok(()); + }; + if !added_to_keychain { + return Err(trust_error); + } + match remove_new_certificate() { + Ok(()) => Err(trust_error), + Err(cleanup_error) => Err(io::Error::other(format!( + "{trust_error}; newly added certificate cleanup failed: {cleanup_error}" + ))), + } +} + #[cfg(target_os = "macos")] fn macos_uninstall_certificate(certificate_der: &[u8]) -> io::Result { let user_certificate = macos_domain_certificate_trust(Domain::User, certificate_der)?; @@ -879,7 +906,7 @@ fn macos_wait_for_user_trust( } } -#[cfg(target_os = "macos")] +#[cfg(any(target_os = "macos", test))] fn macos_security_error(action: &str, code: i32) -> io::Error { let detail = match code { -128 | -60_006 => "the user cancelled the security prompt", @@ -1963,6 +1990,50 @@ MAoGCCqGSM49BAMCA0gAMEUCIQC1PB8+NumezrQf5unFGhVeufUcyw/sjH6p1aqs )); } + #[test] + fn macos_ca_refusal_cleans_new_certificate_and_reports_cleanup_failure() { + use std::cell::Cell; + + let removed = Cell::new(false); + let error = set_macos_trust_with_new_certificate_cleanup( + true, + || Err(macos_security_error("set user certificate trust", -128)), + || { + removed.set(true); + Ok(()) + }, + ) + .expect_err("cancelled trust must fail"); + assert!(removed.get()); + assert!(error.to_string().contains("user cancelled")); + + removed.set(false); + let _ = set_macos_trust_with_new_certificate_cleanup( + false, + || Err(macos_security_error("set user certificate trust", -128)), + || { + removed.set(true); + Ok(()) + }, + ) + .expect_err("pre-existing certificate trust refusal must fail"); + assert!( + !removed.get(), + "pre-existing certificates must be preserved" + ); + + let error = set_macos_trust_with_new_certificate_cleanup( + true, + || Err(macos_security_error("set user certificate trust", -60_006)), + || Err(io::Error::other("fault-injected keychain cleanup refusal")), + ) + .expect_err("failed cleanup must remain actionable"); + let detail = error.to_string(); + assert!(detail.contains("user cancelled")); + assert!(detail.contains("newly added certificate cleanup failed")); + assert!(detail.contains("fault-injected keychain cleanup refusal")); + } + #[cfg(windows)] #[test] fn windows_certificate_store_lifecycle_is_exact_and_idempotent() { diff --git a/docs/progress.html b/docs/progress.html index 6e32850..a9a264e 100644 --- a/docs/progress.html +++ b/docs/progress.html @@ -99,7 +99,7 @@

5. 当前迭代：S5 / S6

PAR-007token、成本和语义指纹Done100%Codex / TBD2026-07-17四厂商 reported usage 归一化、显式 estimated 估算、版本化价格匹配、未知价格留空与 BLAKE3-256 语义指纹完成 TST-001协议 fixture 与 golden testsDone100%Codex / TBD2026-07-17版本化能力矩阵覆盖 OpenAI、Anthropic、Gemini 与 Ollama 的请求、响应、流式、工具、多模态、错误和 Raw fallback；声明均由 fixture 与 golden 验证 TST-002Gateway/Proxy 集成测试In progress82%Codex / TBD2026-08-25认证 IPC、暂停丢弃、真实模式切换与进程树清理、压缩、流式脱敏、非目标 TLS、HTTP/2 基线一致性及 Windows CA 精确增删通过；真实 sidecar 在客户端取消后保持存活，IPC 停止消费且 72 个事件超过容量 64 时，36 个目标响应仍在 15 秒内完成；真实 ROOT 往返和其余协议一致性待扩展 - TST-003平台故障注入In progress70%Codex / TBD2026-08-25Windows/macOS 强杀恢复、活 owner 防误恢复、sidecar 独立退出回退和端口冲突拒绝已通过；PAC 原状态下应用与同步回滚双重失败会交由独立 watchdog 恢复；readiness token 不复用 IPC token，错误 listener 与旧 addon 不会触发系统代理切换；CA 拒绝与 macOS helper 故障矩阵待完成 + TST-003平台故障注入In progress75%Codex / TBD2026-08-25Windows/macOS 强杀恢复、活 owner 防误恢复、sidecar 独立退出回退和端口冲突拒绝已通过；PAC 原状态下应用与同步回滚双重失败会交由独立 watchdog 恢复；macOS 用户拒绝 CA 信任时清理本次新增证书，清理失败返回双重错误，桌面保持 not trusted 并允许重试；macOS helper 故障矩阵待完成 REL-002诊断与支持包In progress75%Codex / Support Owner TBD2026-09-22版本化 JSON 支持包可预览、复制和保存，包含不带请求标识的兼容诊断树；256 KiB code-only journal 与最近 100 条事件接入，排除 Prompt、Raw 和日志详情；支持处理流程待完成 SPIKE-001Gateway 流式透明转发验证Done100%Codex / TBD2026-07-14双向流式、取消传递、头清理与稳定 502 集成测试通过 SPIKE-002mitmproxy sidecar IPC/打包验证Done100%Codex / TBD2026-07-14凭据清理、IPC、打包与真实转发通过 @@ -123,7 +123,7 @@

6. 后续迭代承诺

S2CAP-001/002、PAR-002/003、APP-003DoneGateway、OpenAI 解析与千条实时工作台全部通过验收 S3PAR-004、APP-004、TST-001、DAT-002Done双厂商 Inspector、能力矩阵与数据生命周期全部通过验收 S4CAP-003~005、TST-002In progresssidecar bundle、桌面运行时、协议矩阵、Proxy 取消/背压、跨平台 CA 状态及两平台用户级信任生命周期已实现；签名、其余协议一致性与交互式验收待推进 - S5CAP-006/007、SEC-002/003、APP-006、TST-003In progressSEC-002、CAP-007 完成，IPC 抗阻塞、双模式 OS PID 归因、readiness 身份校验和兼容诊断树已接入；继续 macOS helper、OS socket ACL、PAC 与 CA 拒绝故障注入 + S5CAP-006/007、SEC-002/003、APP-006、TST-003In progressSEC-002、CAP-007 完成，IPC 抗阻塞、双模式 OS PID 归因、readiness 身份校验、PAC/CA 拒绝恢复和兼容诊断树已接入；继续 macOS helper 与 OS socket ACL S6PAR-005~007、APP-005Done四厂商适配器、token/成本/指纹、全文搜索和结构/文本 Compare 全部完成 S7TST-004、性能、可访问性、诊断与保留Not started功能冻结 S8SEC-004、REL-001/002、安全评审In progresscode-only 诊断与支持包已接入；签名更新、安装回滚、支持流程与安全评审待推进 @@ -222,6 +222,7 @@

11. 决策与变更记录

2026-07-18Test / ProxyTST-002 取消与背压矩阵完成单元测试以阻塞 IPC worker 和容量 1 队列证明满队列 submit 立即失败；首次 IPC 失败会清空 backlog、熔断 10 秒并自动探测恢复；真实打包 sidecar 在 IPC listener 停止消费后承受 36 个目标请求、72 个捕获事件和一次客户端取消，转发响应保持一致且进程继续存活；两个结论成为 Python 与 Rust bundle 强制合同Codex 2026-07-18Security / RecoveryTST-003 sidecar 端口冲突关闭桌面为每次启动生成与 IPC token 隔离的 256-bit readiness token；打包 addon 在保留域名内部终止版本化探针，Rust runtime 常量时间核对响应后才判定 ready；普通 listener、错误 token、旧 addon 和端口抢占均失败并清理进程树，系统代理不会切换到未知进程Codex 2026-07-18Recovery / Fault injectionTST-003 PAC 双重失败恢复完成代理应用部分写入且进程内回滚失败时不再删除 armed journal；owner 主动关闭控制通道并等待独立 watchdog 按预加载 PAC 快照恢复，独立恢复也失败时保留 journal 并返回完整三段错误Codex + 2026-07-18Certificate / Fault injectionTST-003 CA 拒绝恢复完成macOS 用户拒绝信任时删除本次刚加入登录钥匙串的证书；删除也失败时同时报告拒绝与残留清理错误；桌面保持 not trusted、显示原因并允许用户再次触发系统信任流程Codex 后续范围、架构、日期或资源变化均在此追加，并链接对应 ADR/会议结论。 diff --git a/docs/threat-model.html b/docs/threat-model.html index 9de8042..35bfd6c 100644 --- a/docs/threat-model.html +++ b/docs/threat-model.html @@ -47,8 +47,8 @@

威胁台账

TM-02捕获非目标应用或端点Rust/Python 共用精确 host、POST method 与 path pattern 策略Profile UI 与自定义端点策略管理 TM-03本机其他进程伪造、读取或阻塞 IPCIPC 0.4 仅限 loopback；每次 Proxy 会话生成 256-bit token 并常量时间比较；Windows/macOS/Linux 首连接通过 OS socket 表绑定已启动 sidecar PID，Linux 仅接受精确 socket inode 的唯一 owner；sidecar 在服务端 ACK 前保持连接；认证帧 1 KiB、Envelope 4 MiB；要求 mitmproxy 来源声明；连接全流程 2 秒未完成即释放；临时归因端点严格限制为同地址族 loopback 且不进入 Envelope；旧协议 bundle 启动前拒绝用户级 socket ACL；插件启用后的 WASI 最小权限 TM-04数据库文件被离线读取SQLCipher、WAL、迁移、加密备份、错误密钥、DB/WAL canary 与跨平台 OS 凭据库 CI锁定状态与 key 丢失恢复体验 - TM-05本地 CA 私钥泄露或残留信任每设备 CA、跨平台私钥权限检查、指纹 UI、Windows CurrentUser 与 macOS User 幂等卸载已实现两平台交互式验收；发布前独立安全评审 - TM-06崩溃后系统代理残留Windows/macOS 强杀恢复实验；Windows 桌面已接入私有 journal、watchdog、启动恢复和活 owner 校验；sidecar 单独退出会按代际恢复代理并回退 Gateway；端口占用者无法通过独立 256-bit readiness token 校验，冲突启动会清理进程树且不会切换系统代理macOS 特权 helper；PAC 与 CA 拒绝故障注入 + TM-05本地 CA 私钥泄露或残留信任每设备 CA、跨平台私钥权限检查、指纹 UI、Windows CurrentUser 与 macOS User 幂等卸载已实现；macOS 信任拒绝会清理本次新增证书，桌面保持未信任并允许重试两平台交互式验收；发布前独立安全评审 + TM-06崩溃后系统代理残留Windows/macOS 强杀恢复实验；Windows 桌面已接入私有 journal、watchdog、启动恢复和活 owner 校验；sidecar 单独退出会按代际恢复代理并回退 Gateway；端口占用者无法通过独立 256-bit readiness token 校验，冲突启动会清理进程树且不会切换系统代理；PAC 双重失败由 watchdog 恢复macOS 特权 helper TM-07sidecar 或更新包被替换打包 manifest 含 SHA-256签名、SBOM、启动前 hash 校验；发布硬门槛 TM-08复制或导出泄露秘密单请求、最多 200 条批量导出及支持包均强制扫描与完整预览；版本化 corpus 覆盖 36 个敏感字段名、17 类文本 secret 及近似反例，Rust/Python/Web 一致性回归通过；稳定占位符、策略版本、SHA-256 防陈旧和只新建文件已实现独立安全评审与 corpus 持续维护 TM-09恶意 Prompt 触发 UI 注入React 默认转义、Tauri CSPRaw 仅纯文本、URL 不自动执行、XSS fixture