feat: add authenticated Node runtime migration foundation by MrMaxie · Pull Request #56 · MrMaxie/cadder

MrMaxie · 2026-10-05T14:41:34Z

Summary

Add the TypeScript/Nub migration foundation with exact dependencies and isolated v2 runtime paths, owner-protected secrets and permissions, a lifetime SQLite lock, and protocol 3 mutual HMAC authentication with sequenced RPC frames.
Add native Windows, Linux and macOS runtime gates and disposable fixtures for exclusion, crash recovery, authentication failures and privilege boundaries.
Record the approved 2.0 target: equal npm and Node SEA distributions, with generated Node artifacts staged outside the checkout.
Resolve conflicts by merging current master and retaining its released Rust 1.0.5 runtime, security fixes, documentation and release pipeline. Historical 0.8 behavior evidence is pinned to its Git snapshot, not restored into production.

Validation

cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
mise run check: Rust, strict OpenSpec validation, documentation, existing npm package contracts and generated release workflow checks pass locally on Windows.
mise run docs-build
nub run check: typecheck, lint, formatting and all 29 tests pass; own-code line coverage is 90.30%, including runtime modules.
Native compiled-JS runtime smoke passes locally on Windows x64 without a TS loader after integration.
git diff --check; released Rust code and legacy packaging match master, with no generated Node JS committed.

The previous Node runtime matrix passed on Windows x64, Linux x64 and macOS arm64 at 1670f35, including real same-owner root-daemon contact and different-account denial on Unix. CI for the conflict-resolution head f850418 is separate and has been triggered; those earlier results do not substitute for its checks.

Notes

This is the migration foundation, not a shippable Cadder 2.0 application. Caddy integration, shim/platform adapters, history/logs, real Node CLI/TUI and both npm/SEA distributions remain pending.
Rust 1.0.5 and its existing release tooling remain operational during migration. The PR diff no longer restores the superseded Rust reset from the branch's older history.
Windows same-owner non-elevated contact with an elevated daemon and different-account denial still require the interactive Windows Sandbox gate. Preparation is not execution evidence. N2 remains open and Caddy porting waits for this gate.
Preparing the Sandbox package does not change host UAC policy, accounts, IIS bindings or autostart settings. Node test bundles and coverage reports remain outside the checkout.
The unchanged documentation dependency lock reports one high-severity audit advisory for http-cache-semantics; dependency remediation is outside this conflict-resolution change.
No merge into master, release tag, npm publication or GitHub release is included.

… backend mode

…adder

Introduced `cadderctl`, a command-line interface for non-interactive inspection and control of the Cadder daemon. This addition allows users to perform state queries, log retrieval, and manage entrypoints and domains without launching the TUI. Updated documentation to reflect the new CLI capabilities and its integration into the Cadder architecture.

Add a new local stdio cadder-mcp server with bounded inspect and management tools, MCP-specific redaction, and contract tests for unavailable-daemon behavior, action routing, and log safety. Extract a shared cadder-operator layer from cadderctl so CLI and MCP reuse daemon attach, query, toggle, and error-mapping logic, and update packaging and documentation to ship and explain the new MCP surface.

Add OpenSpec project rules and a reset-cadder-architecture change covering proposal, design, capability specs, and implementation tasks. This establishes the target daemon-owned runtime model before implementation cleanup.

Remove obsolete Backlog and unsupported product-surface artifacts in favor of OpenSpec-driven planning. Reshape the workspace around the daemon, shim, cadder operator client, shared protocol, docs, and xtask validation. Add runtime locking, IPC discovery and security policy, storage/history, autostart, IIS handoff, release docs validation, and focused contract tests.

Cover raw IPC registration history and fake IIS provider binding queries through daemon IPC. Add the explicit caddy shim command policy table, unsupported command rejection, and docs. Mark OpenSpec tasks 3.6 and 4.1 complete.

Remove the real Caddy fallback from managed caddy run recovery so the shim only registers through cadderd. Update shim tests and docs to reflect daemon-owned recovery, and mark OpenSpec task 4.2 complete.

Warn when read-only caddy shim commands delegate to real Caddy without a reachable cadderd backend. Document the distinction between real-Caddy inspection and Cadder runtime state, and mark OpenSpec task 4.3 complete.

Exercise CADDER_CADDY_SHIM_PATH through the RealCaddyResolver path lookup so PATH prefers a later real Caddy binary over the shim. Mark OpenSpec task 4.4 complete.

Use runner paths only in step contexts and verify Unix owner access to an elevated runtime and denial for a different account.

Keep TypeScript checkout line endings stable and run the outsider fixture from a shared temporary executable instead of the private macOS tool cache.

Provide read-only Sandbox inputs and explicit client privilege assertions while recording the passing native CI matrix separately from pending interactive UAC evidence.

Keep the released Rust 1.0.5 runtime, security fixes and release tooling as the operational migration baseline. Preserve the TypeScript runtime foundation and approved equal npm/SEA target, and scope Node source checks away from legacy release scripts.

Define requirement deltas, ordered migration tasks and acceptance gates for the TypeScript/Node replacement with equal npm and SEA distributions. Preserve the released CLI/TUI and eight-operation IPC scope instead of restoring history, IIS, autostart or machine output. Keep runtime acceptance and Rust removal evidence-gated.

Normalize the Node primary token default owner only after safe journal preflight and before SQLite admission. Keep strict existing-path checks and verify native readback without changing privileges or ACLs. Cover fail-closed ordering with regressions and record the real Windows Sandbox SQLite/Caddy lifecycle proof. Final Node check passes 812 tests with 96.16 percent own-source line coverage; completed-product and distribution gates remain open.

Connect durable state and project sessions to the daemon, CLI, TUI and shim. Add compiled npm and standalone SEA candidates with shared native acceptance, retaining the Rust baseline until platform and privilege gates pass.

Use physical fixture paths and distinct executable directories, drain fake-Caddy output before exit, and serialize Windows native fixtures. Add the actual-product Sandbox privilege procedure while keeping its interactive acceptance open.

Retain the OS cause when owned-group observation fails and report direct lsof probes when the native listener check cannot find its owner.

Read valid lsof output when one requested protocol has no matches, and cover real TCP and UDP owners. Include shared setup assets in npm and SEA packages and verify actual Caddy rollback after a SQLite write refusal.

MrMaxie added 17 commits June 16, 2026 18:03

chore: update task status and refine acceptance criteria for detached…

496ed96

… backend mode

refactor: implement detached backend mode with explicit control for C…

f45870d

…adder

docs: define OpenSpec architecture reset

a1859dc

Add OpenSpec project rules and a reset-cadder-architecture change covering proposal, design, capability specs, and implementation tasks. This establishes the target daemon-owned runtime model before implementation cleanup.

test: add daemon contract coverage and shim policy

9829b5c

Cover raw IPC registration history and fake IIS provider binding queries through daemon IPC. Add the explicit caddy shim command policy table, unsupported command rejection, and docs. Mark OpenSpec tasks 3.6 and 4.1 complete.

fix: keep managed shim runs on daemon path

f1d1afe

Remove the real Caddy fallback from managed caddy run recovery so the shim only registers through cadderd. Update shim tests and docs to reflect daemon-owned recovery, and mark OpenSpec task 4.2 complete.

fix: label read-only shim inspection output

2ace61a

Warn when read-only caddy shim commands delegate to real Caddy without a reachable cadderd backend. Document the distinction between real-Caddy inspection and Cadder runtime state, and mark OpenSpec task 4.3 complete.

test: cover real Caddy shim exclusion

a10c63a

Exercise CADDER_CADDY_SHIM_PATH through the RealCaddyResolver path lookup so PATH prefers a later real Caddy binary over the shim. Mark OpenSpec task 4.4 complete.

feat: add authenticated Node runtime migration foundation

5f4ca9e

fix: run native runtime gates in CI

963c77d

Use runner paths only in step contexts and verify Unix owner access to an elevated runtime and denial for a different account.

fix: bootstrap the published Nub package in CI

198c1a8

fix: make runtime gates portable across native runners

e1c400e

Keep TypeScript checkout line endings stable and run the outsider fixture from a shared temporary executable instead of the private macOS tool cache.

test: budget for native Windows ACL checks

8246d2e

test: prepare isolated Windows privilege acceptance gate

1670f35

Provide read-only Sandbox inputs and explicit client privilege assertions while recording the passing native CI matrix separately from pending interactive UAC evidence.

MrMaxie changed the title ~~feat: reset architecture and add authenticated Node runtime foundation~~ feat: add authenticated Node runtime migration foundation Oct 5, 2026

MrMaxie added 12 commits October 5, 2026 19:37

docs: record accepted Node contracts and migration evidence

76bec63

feat: close Node RPC contracts and isolate installation runtimes

0c1a5e6

feat: add secure Caddy adapters and owned configuration lifecycle

31b88e1

feat: implement Node product and candidate distributions

5b4daee

Connect durable state and project sessions to the daemon, CLI, TUI and shim. Add compiled npm and standalone SEA candidates with shared native acceptance, retaining the Rust baseline until platform and privilege gates pass.

test: make native migration checks portable

86eb714

Use physical fixture paths and distinct executable directories, drain fake-Caddy output before exit, and serialize Windows native fixtures. Add the actual-product Sandbox privilege procedure while keeping its interactive acceptance open.

test: expose native macOS failure diagnostics

0180d68

Retain the OS cause when owned-group observation fails and report direct lsof probes when the native listener check cannot find its owner.

fix: preserve macOS socket owners and complete candidate assets

5432a48

Read valid lsof output when one requested protocol has no matches, and cover real TCP and UDP owners. Include shared setup assets in npm and SEA packages and verify actual Caddy rollback after a SQLite write refusal.

test: verify one npm artifact and native terminal journeys

e3be920

fix: support cold Windows startup and explicit Unix owners

281d07d

test: exercise packaged TUI lifecycle in native terminals

78700fc

test: use a portable native PTY for Unix product checks

e0a391b

Navigation Menu

Repository navigation

feat: add authenticated Node runtime migration foundation - #56

feat: add authenticated Node runtime migration foundation#56
MrMaxie wants to merge 30 commits into
masterfrom
feat/node-runtime-migration

MrMaxie commented Oct 5, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MrMaxie commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Notes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MrMaxie commented Oct 5, 2026 •

edited

Loading