Keep Malibu repair recovery fail closed under filesystem races

Align app-side repair admission with installer evidence and make rollback preserve mixed-content installs without blocking on special files.

Constraint: Legacy standalone installs may contain owner-private evidence, FIFOs or special files, and unrelated support content; repairs must fail closed without discarding user data.
Rejected: Path-based recursive copies and pre-verifier reads | they can block, race, or admit semantically invalid repairs.
Confidence: high
Scope-risk: broad
Directive: Keep app-side repair predicates and installer recovery snapshots descriptor-validated and semantically aligned.
Tested: xcodebuild test (331 tests); install upgrade evidence rollback matrix; provider upgrade transaction; transaction lock; launchd migration; watchdog rollback and health; referral handoff; watchdog inline drift; bash -n; git diff --check.
Not-tested: Fresh GitHub CI on this final head.

Author: Augustas11

ops/macprovider-watchdog/watchdog.sh

@@ -409,7 +409,7 @@ def verify_root():
                 raise RuntimeError(f"not_directory:{path}")
 
 def read_marker():
-    fd = os.open(pending, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    fd = os.open(pending, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
     try:
         raw = os.read(fd, 65536)
     finally:
@@ -508,7 +508,7 @@ def current_binary_version(path):
 
 def read_success_sentinel(path):
     reject_path(path)
-    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
     try:
         payload = json.loads(os.read(fd, 65536).decode("utf-8"))
     finally:
@@ -569,7 +569,7 @@ def process_success_sentinel(marker):
 
 def sha256(path):
     h = hashlib.sha256()
-    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
     try:
         while True:
             chunk = os.read(fd, 1024 * 1024)
@@ -1038,7 +1038,7 @@ def validate_malibu_app_backup(release_backup):
     state_st = reject_path(state_path)
     if not stat.S_ISREG(archive_st.st_mode) or not stat.S_ISREG(state_st.st_mode):
         raise RuntimeError("malibu_backup_not_regular")
-    fd = os.open(state_path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    fd = os.open(state_path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
     try:
         raw = os.read(fd, 65537)
     finally:
@@ -1150,7 +1150,7 @@ def fsync_release_tree(root_path):
         directories.append(current)
         for name in file_names:
             path = os.path.join(current, name)
-            fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+            fd = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
             try:
                 os.fsync(fd)
             finally:
@@ -1165,7 +1165,7 @@ def fsync_release_tree(root_path):
 def atomic_copy_binary(source, target, mode):
     temporary = os.path.join(os.path.dirname(target), f".macprovider-cli.rollback-restore-{uuid.uuid4()}")
     try:
-        source_fd = os.open(source, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+        source_fd = os.open(source, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_NOFOLLOW", 0))
         try:
             destination_fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_WRONLY | getattr(os, "O_NOFOLLOW", 0), mode)
             try:

phase3-binary/app/Sources/Malibu/Onboarding/LaunchProviderController.swift

@@ -536,6 +536,11 @@ struct StartupState: Equatable {
             homeDirectory: homeDirectory,
             fileManager: fm
         )
+        let launchdRepairEvidenceExists = Self.launchdRepairEvidenceExists(
+            paths: paths,
+            homeDirectory: homeDirectory,
+            fileManager: fm
+        )
 
         var backgroundProviderHealthy = false
         if ProviderConfig.readProviderID(paths: paths) != nil,
@@ -548,7 +553,7 @@ struct StartupState: Equatable {
                 homeDirectory: homeDirectory,
                 fileManager: fm
         )
-        let launchdJobNeedsRepair = launchdInstallEvidenceExists && providerRepairState.needsRepair
+        let launchdJobNeedsRepair = launchdRepairEvidenceExists && providerRepairState.needsRepair
         // A loaded provider label with an unexpected executable/plist is a
         // conflict even when the on-disk evidence is missing or unsafe. The
         // installer intentionally refuses label-only reclamation without a
@@ -568,7 +573,7 @@ struct StartupState: Equatable {
         // Do not gate watchdog inspection on a readable plist. A loaded job
         // whose plist disappeared or became unsafe is itself a manual
         // conflict; suppressing that state creates an endless repair loop.
-        let watchdogJobNeedsRepair = watchdogRepairState.needsRepair
+        let watchdogJobNeedsRepair = launchdRepairEvidenceExists && watchdogRepairState.needsRepair
         let watchdogNeedsManualIntervention = watchdogRepairState.requiresManualIntervention
 
         return StartupState(
@@ -637,6 +642,91 @@ struct StartupState: Equatable {
         return trusted(manifest) || trusted(launchd)
     }
 
+    /// Repair is admitted only when Malibu can present the same durable
+    /// incumbent identity that install.sh requires before bypassing referral
+    /// admission. A stale plist or manifest by itself is onboarding evidence,
+    /// not proof that the existing provider can be safely repaired in place.
+    static func launchdRepairEvidenceExists(
+        paths: ProviderPaths = .current,
+        homeDirectory: URL = FileManager.default.homeDirectoryForCurrentUser,
+        fileManager: FileManager = .default
+    ) -> Bool {
+        let fm = fileManager
+        let configDirectory = paths.configFile.deletingLastPathComponent()
+        let providerIDURL = configDirectory.appendingPathComponent("provider_id")
+        let manifest = homeDirectory.appendingPathComponent(
+            "Library/Application Support/macprovider/install_manifest.json"
+        )
+        let launchd = homeDirectory.appendingPathComponent(
+            "Library/LaunchAgents/live.streamvc.macprovider.plist"
+        )
+        func trusted(_ url: URL, maxBytes: Int = 1024 * 1024) -> Bool {
+            InstalledProviderMonitor.isSafePrivateDirectoryChain(
+                url.deletingLastPathComponent(),
+                under: homeDirectory
+            ) && InstalledProviderMonitor.hasTrustedPrivateFile(
+                at: url,
+                maxBytes: maxBytes,
+                fileManager: fm
+            )
+        }
+        guard let configuredProviderID = ProviderConfig.readProviderID(paths: paths),
+              trusted(paths.configFile),
+              let savedProviderID = InstalledProviderMonitor.readOwnerPrivateRegularFile(
+                  providerIDURL,
+                  maxBytes: 64 * 1024,
+                  fileManager: fm
+              ),
+              String(decoding: savedProviderID, as: UTF8.self)
+                  .trimmingCharacters(in: .whitespacesAndNewlines) == configuredProviderID,
+              trusted(providerIDURL, maxBytes: 64 * 1024),
+              trusted(manifest),
+              trusted(launchd),
+              let manifestData = InstalledProviderMonitor.readOwnerPrivateRegularFile(
+                  manifest,
+                  maxBytes: 64 * 1024,
+                  fileManager: fm
+              ),
+              let manifestObject = try? JSONSerialization.jsonObject(with: manifestData),
+              let manifestValues = manifestObject as? [String: Any],
+              let installPrefix = manifestValues["install_prefix"] as? String,
+              let binaryPath = manifestValues["binary_path"] as? String,
+              let launchdLabels = manifestValues["launchd_labels"] as? [String],
+              let launchdPlists = manifestValues["launchd_plists"] as? [String] else {
+            return false
+        }
+        let installDirectory = URL(fileURLWithPath: installPrefix).standardizedFileURL
+        let expectedBinaryPath = installDirectory.appendingPathComponent("macprovider-cli").path
+        guard installPrefix == installDirectory.path,
+              InstalledProviderMonitor.isSupportedProviderInstallDirectory(
+                  installDirectory,
+                  under: homeDirectory
+              ),
+              binaryPath == expectedBinaryPath,
+              launchdLabels.contains(InstalledProviderMonitor.providerLaunchdLabel),
+              launchdPlists.contains(launchd.path),
+              let plistData = InstalledProviderMonitor.readOwnerPrivateRegularFile(
+                  launchd,
+                  maxBytes: 64 * 1024,
+                  fileManager: fm
+              ),
+              let plistObject = try? PropertyListSerialization.propertyList(
+                  from: plistData,
+                  options: [],
+                  format: nil
+              ),
+              let plistValues = plistObject as? [String: Any],
+              plistValues["Label"] as? String == InstalledProviderMonitor.providerLaunchdLabel else {
+            return false
+        }
+        let plistProgram = (plistValues["Program"] as? String)
+            ?? (plistValues["ProgramArguments"] as? [String])?.first
+        let legacyBinaryPath = homeDirectory
+            .appendingPathComponent(".local/bin/macprovider-cli")
+            .path
+        return plistProgram == binaryPath || plistProgram == legacyBinaryPath
+    }
+
     static func applyMigrationDecision(
         _ decision: MigrationDecision,
         paths: ProviderPaths = .current,

phase3-binary/app/Sources/Malibu/System/InstalledProviderMonitor.swift

@@ -164,13 +164,14 @@ enum InstalledProviderMonitor {
         case unavailable
         case notLoaded
         case validExecutable
+        case legacyExecutable(path: String)
         case missingExecutable(path: String)
         case unexpectedExecutable(path: String)
         case unexpectedPlist(path: String)
 
         var needsRepair: Bool {
             switch self {
-            case .missingExecutable:
+            case .legacyExecutable, .missingExecutable:
                 return true
             case .unavailable, .notLoaded, .validExecutable, .unexpectedExecutable, .unexpectedPlist:
                 return false
@@ -181,14 +182,15 @@ enum InstalledProviderMonitor {
             switch self {
             case .unexpectedExecutable, .unexpectedPlist:
                 return true
-            case .unavailable, .notLoaded, .validExecutable, .missingExecutable:
+            case .unavailable, .notLoaded, .validExecutable, .legacyExecutable, .missingExecutable:
                 return false
             }
         }
     }
 
-    /// A readable plist is not enough to attach Malibu to a loaded job. Repair
-    /// is reserved for a managed job whose executable is missing; an unloaded
+    /// A readable plist is not enough to attach Malibu to a loaded job. Legacy
+    /// standalone executables are repairable stale ownership, while unknown
+    /// executable/plist identities remain manual conflicts. An unloaded
     /// managed plist is still inspected so a stale binary cannot dead-end startup.
     static func launchdServiceRepairState(
         uid: uid_t = getuid(),
@@ -233,6 +235,9 @@ enum InstalledProviderMonitor {
             guard isOwnerPrivateExecutable(atPath: plistIdentity.program) else {
                 return .missingExecutable(path: plistIdentity.program)
             }
+            if plistIdentity.program == legacyProgram {
+                return .legacyExecutable(path: plistIdentity.program)
+            }
             return .notLoaded
         }
         guard let identity = parseLaunchdServiceIdentity(inspection.output) else {
@@ -263,6 +268,9 @@ enum InstalledProviderMonitor {
         guard isOwnerPrivateExecutable(atPath: identity.program) else {
             return .missingExecutable(path: identity.program)
         }
+        if identity.program == legacyProgram {
+            return .legacyExecutable(path: identity.program)
+        }
         return .validExecutable
     }
 
@@ -292,7 +300,7 @@ enum InstalledProviderMonitor {
         fileManager: FileManager
     ) -> Data? {
         let descriptor = url.path.withCString {
-            Darwin.open($0, O_RDONLY | O_CLOEXEC | O_NOFOLLOW)
+            Darwin.open($0, O_RDONLY | O_NONBLOCK | O_CLOEXEC | O_NOFOLLOW)
         }
         guard descriptor >= 0 else { return nil }
         defer { _ = Darwin.close(descriptor) }
@@ -354,7 +362,7 @@ enum InstalledProviderMonitor {
 
     static func isOwnerPrivateExecutable(atPath path: String) -> Bool {
         let descriptor = path.withCString {
-            Darwin.open($0, O_RDONLY | O_CLOEXEC | O_NOFOLLOW)
+            Darwin.open($0, O_RDONLY | O_NONBLOCK | O_CLOEXEC | O_NOFOLLOW)
         }
         guard descriptor >= 0 else { return false }
         defer { _ = Darwin.close(descriptor) }

phase3-binary/app/Sources/Malibu/System/LogTailReader.swift

@@ -152,6 +152,8 @@ final class LogTailReader: ObservableObject {
               (fileInfo.st_mode & S_IFMT) == S_IFREG,
               fileInfo.st_uid == getuid(),
               Int(fileInfo.st_nlink) == 1,
+              fileInfo.st_mode & (S_IWGRP | S_IWOTH) == 0,
+              hasNoExtendedACL(descriptor),
               fileInfo.st_size >= 0 else {
             return nil
         }
@@ -199,6 +201,15 @@ final class LogTailReader: ObservableObject {
         return ReadResult(offset: nextOffset, pendingFragment: parsed.pendingFragment, lines: parsed.lines)
     }
 
+    private nonisolated static func hasNoExtendedACL(_ descriptor: Int32) -> Bool {
+        errno = 0
+        guard let acl = acl_get_fd_np(descriptor, ACL_TYPE_EXTENDED) else {
+            return errno == 0 || errno == ENOENT
+        }
+        _ = acl_free(UnsafeMutableRawPointer(acl))
+        return false
+    }
+
     nonisolated private static func parseChunk(
         _ chunk: String,
         pendingFragment: String,

phase3-binary/app/Sources/Malibu/System/ProviderConfig.swift

@@ -23,22 +23,92 @@ enum ProviderConfig {
     }
 
     static func readProviderID(paths: ProviderPaths = .current) -> String? {
-        guard let contents = try? String(contentsOf: paths.configFile) else { return nil }
+        guard let contents = readTrustedConfigContents(paths: paths) else { return nil }
         return parseTopLevelValue(named: "provider_id", from: contents)
     }
 
+    /// Read the shared config through a nonblocking, no-follow descriptor so a
+    /// malformed or replaced config path cannot wedge startup before the
+    /// caller's trust checks run. The installer applies the same owner/private
+    /// regular-file contract before using this identity for repair.
+    private static func readTrustedConfigContents(paths: ProviderPaths) -> String? {
+        let maxBytes = 1024 * 1024
+        let configDirectory = paths.configFile.deletingLastPathComponent()
+        let homeDirectory = configDirectory
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+        guard InstalledProviderMonitor.isSafePrivateDirectoryChain(
+            configDirectory,
+            under: homeDirectory
+        ) else {
+            return nil
+        }
+        let descriptor = paths.configFile.path.withCString {
+            Darwin.open($0, O_RDONLY | O_NONBLOCK | O_CLOEXEC | O_NOFOLLOW)
+        }
+        guard descriptor >= 0 else { return nil }
+        defer { _ = Darwin.close(descriptor) }
+
+        var before = stat()
+        guard Darwin.fstat(descriptor, &before) == 0,
+              (before.st_mode & S_IFMT) == S_IFREG,
+              before.st_uid == getuid(),
+              before.st_nlink == 1,
+              before.st_mode & (S_IWGRP | S_IWOTH) == 0,
+              before.st_size >= 0,
+              before.st_size <= off_t(maxBytes),
+              hasNoExtendedACL(descriptor) else {
+            return nil
+        }
+        var data = Data()
+        data.reserveCapacity(Int(before.st_size))
+        var buffer = [UInt8](repeating: 0, count: min(64 * 1024, maxBytes))
+        while data.count < Int(before.st_size) {
+            let count = buffer.withUnsafeMutableBytes { storage in
+                Darwin.read(descriptor, storage.baseAddress, storage.count)
+            }
+            guard count > 0 else { return nil }
+            data.append(buffer, count: count)
+        }
+        var after = stat()
+        var pathInfo = stat()
+        guard Darwin.fstat(descriptor, &after) == 0,
+              Darwin.lstat(paths.configFile.path, &pathInfo) == 0,
+              after.st_dev == before.st_dev,
+              after.st_ino == before.st_ino,
+              after.st_size == before.st_size,
+              after.st_mtimespec.tv_sec == before.st_mtimespec.tv_sec,
+              after.st_mtimespec.tv_nsec == before.st_mtimespec.tv_nsec,
+              after.st_ctimespec.tv_sec == before.st_ctimespec.tv_sec,
+              after.st_ctimespec.tv_nsec == before.st_ctimespec.tv_nsec,
+              (pathInfo.st_dev, pathInfo.st_ino) == (before.st_dev, before.st_ino),
+              hasNoExtendedACL(descriptor),
+              data.count == Int(before.st_size) else {
+            return nil
+        }
+        return String(data: data, encoding: .utf8)
+    }
+
+    private static func hasNoExtendedACL(_ descriptor: Int32) -> Bool {
+        guard let acl = acl_get_fd_np(descriptor, ACL_TYPE_EXTENDED) else {
+            return errno == 0 || errno == ENOENT
+        }
+        acl_free(UnsafeMutableRawPointer(acl))
+        return false
+    }
+
     static func hasProviderToken(paths: ProviderPaths = .current) -> Bool {
-        guard let contents = try? String(contentsOf: paths.configFile) else { return false }
+        guard let contents = readTrustedConfigContents(paths: paths) else { return false }
         return parseTopLevelValue(named: "provider_token", from: contents) != nil
     }
 
     static func readModel(paths: ProviderPaths = .current) -> String? {
-        guard let contents = try? String(contentsOf: paths.configFile) else { return nil }
+        guard let contents = readTrustedConfigContents(paths: paths) else { return nil }
         return parseTopLevelValue(named: "model", from: contents)
     }
 
     static func readHTTPPort(paths: ProviderPaths = .current) -> Int? {
-        guard let contents = try? String(contentsOf: paths.configFile),
+        guard let contents = readTrustedConfigContents(paths: paths),
               let value = parseTopLevelValue(named: "port", from: contents),
               let port = Int(value),
               (1024...65535).contains(port) else {
@@ -48,7 +118,7 @@ enum ProviderConfig {
     }
 
     static func readLinkState(paths: ProviderPaths = .current) -> LinkState? {
-        guard let contents = try? String(contentsOf: paths.configFile),
+        guard let contents = readTrustedConfigContents(paths: paths),
               let value = parseTopLevelValue(named: "link_state", from: contents)
         else {
             return nil
@@ -63,7 +133,7 @@ enum ProviderConfig {
         paths: ProviderPaths = .current,
         environment: [String: String] = ProcessInfo.processInfo.environment
     ) -> Bool {
-        let contents = try? String(contentsOf: paths.configFile)
+        let contents = readTrustedConfigContents(paths: paths)
         return automaticUpdatesEnabled(configContents: contents, environment: environment)
     }
 
@@ -187,7 +257,7 @@ enum ProviderConfig {
     }
 
     static func validateServeConfigShape(paths: ProviderPaths = .current) throws {
-        guard let contents = try? String(contentsOf: paths.configFile) else {
+        guard let contents = readTrustedConfigContents(paths: paths) else {
             throw ServeConfigError.missingField("config.yaml")
         }
         let config = try AutotuneServeConfig(