Confine cache and evidence cleanup

Author: a19q3

crates/cellscript-tools/src/ckb_acceptance.rs

@@ -591,7 +591,7 @@ pub fn run(
         fs::create_dir_all(&run_dir)?;
         let report_root = run_dir.parent().context("managed acceptance run has no report root")?;
         let marker = format!("-{mode}-");
-        let removed = prune_run_directories(report_root, &run_dir, &marker)?;
+        let removed = prune_run_directories(root, report_root, &run_dir, &marker)?;
         if !removed.is_empty() {
             println!("CKB acceptance retention: pruned {} old {mode} run(s)", removed.len());
         }
@@ -603,7 +603,7 @@ pub fn run(
             eprintln!("CKB compile-only production evidence is not sufficient for external release; run without --compile-only for final hardening.");
         }
         if managed_run {
-            finalize_managed_run(&run_dir, &evidence.report_path, mode)?;
+            finalize_managed_run(root, &run_dir, &evidence.report_path, mode)?;
         }
         println!("CKB CellScript {mode} compile-only acceptance passed: {}", evidence.report_path.display());
         return Ok(0);
@@ -614,16 +614,16 @@ pub fn run(
         production_evidence::run(root, &evidence.report_path, Some(root), false)?;
     }
     if managed_run {
-        finalize_managed_run(&run_dir, &evidence.report_path, mode)?;
+        finalize_managed_run(root, &run_dir, &evidence.report_path, mode)?;
     }
     println!("CKB CellScript {mode} acceptance passed: {}", evidence.report_path.display());
     Ok(0)
 }
 
-fn finalize_managed_run(run_dir: &Path, report_path: &Path, mode: &str) -> Result<()> {
+fn finalize_managed_run(root: &Path, run_dir: &Path, report_path: &Path, mode: &str) -> Result<()> {
     let report_root = run_dir.parent().context("managed acceptance run has no report root")?;
     let marker = format!("-{mode}-");
-    let stats = deduplicate_run(report_root, run_dir, &marker)?;
+    let stats = deduplicate_run(root, report_root, run_dir, &marker)?;
     if stats.files > 0 {
         println!("CKB acceptance deduplication: hardlinked {} duplicate file(s), {} bytes", stats.files, stats.bytes);
     }
@@ -632,7 +632,7 @@ fn finalize_managed_run(run_dir: &Path, report_path: &Path, mode: &str) -> Resul
         .and_then(|bytes| serde_json::from_slice::<Value>(&bytes).ok())
         .and_then(|report| report.get("status").and_then(Value::as_str).map(ToOwned::to_owned))
         .unwrap_or_else(|| "unknown".to_owned());
-    write_latest_index(&report_root.join(format!("latest-{mode}.json")), report_path, "ckb-cellscript-acceptance", mode, &status)
+    write_latest_index(root, &report_root.join(format!("latest-{mode}.json")), report_path, "ckb-cellscript-acceptance", mode, &status)
 }
 
 #[cfg(test)]

crates/cellscript-tools/src/ckb_acceptance_live.rs

@@ -787,7 +787,7 @@ pub(crate) fn run(
     if !keep_node {
         replayer.devnet.stop();
         if !keep_gate_workdirs()? {
-            remove_directory_if_present(&replayer.devnet.ckb_dir.join("data"))?;
+            remove_directory_if_present(&evidence.run_dir, &replayer.devnet.ckb_dir.join("data"))?;
         }
     }
     Ok(())

crates/cellscript-tools/src/evidence_retention.rs

@@ -8,7 +8,7 @@
 
 use std::collections::BTreeMap;
 use std::env;
-use std::fs::{self, File};
+use std::fs::{self, File, OpenOptions};
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
 
@@ -57,10 +57,21 @@ fn file_name(path: &Path) -> Option<&str> {
     path.file_name().and_then(|name| name.to_str())
 }
 
-fn matching_children(parent: &Path, current: &Path, marker: &str, directories: bool) -> Result<Vec<PathBuf>> {
+fn ensure_confined(root: &Path, path: &Path, label: &str) -> Result<()> {
+    let canonical_root = fs::canonicalize(root).with_context(|| format!("failed to resolve evidence root {}", root.display()))?;
+    let canonical_path = fs::canonicalize(path).with_context(|| format!("failed to resolve {label} {}", path.display()))?;
+    if !canonical_path.starts_with(&canonical_root) {
+        bail!("refusing to access {label} outside evidence root {}: {}", canonical_root.display(), canonical_path.display());
+    }
+    Ok(())
+}
+
+fn matching_children(root: &Path, parent: &Path, current: &Path, marker: &str, directories: bool) -> Result<Vec<PathBuf>> {
     if !parent.is_dir() {
         return Ok(Vec::new());
     }
+    ensure_confined(root, parent, "evidence directory")?;
+    ensure_confined(root, current, "current evidence path")?;
     let mut paths = Vec::new();
     for entry in fs::read_dir(parent).with_context(|| format!("failed to read evidence directory {}", parent.display()))? {
         let entry = entry?;
@@ -80,15 +91,15 @@ fn matching_children(parent: &Path, current: &Path, marker: &str, directories: b
     Ok(paths)
 }
 
-pub(crate) fn prune_run_directories(parent: &Path, current: &Path, marker: &str) -> Result<Vec<PathBuf>> {
+pub(crate) fn prune_run_directories(root: &Path, parent: &Path, current: &Path, marker: &str) -> Result<Vec<PathBuf>> {
     let Some(keep) = configured_keep_runs()? else {
         return Ok(Vec::new());
     };
-    prune_run_directories_with_limit(parent, current, marker, keep)
+    prune_run_directories_with_limit(root, parent, current, marker, keep)
 }
 
-fn prune_run_directories_with_limit(parent: &Path, current: &Path, marker: &str, keep: usize) -> Result<Vec<PathBuf>> {
-    let mut candidates = matching_children(parent, current, marker, true)?;
+fn prune_run_directories_with_limit(root: &Path, parent: &Path, current: &Path, marker: &str, keep: usize) -> Result<Vec<PathBuf>> {
+    let mut candidates = matching_children(root, parent, current, marker, true)?;
     let remove_from = keep.saturating_sub(1).min(candidates.len());
     let removed = candidates.split_off(remove_from);
     for path in &removed {
@@ -97,11 +108,11 @@ fn prune_run_directories_with_limit(parent: &Path, current: &Path, marker: &str,
     Ok(removed)
 }
 
-pub(crate) fn prune_report_files(parent: &Path, current: &Path, marker: &str) -> Result<Vec<PathBuf>> {
+pub(crate) fn prune_report_files(root: &Path, parent: &Path, current: &Path, marker: &str) -> Result<Vec<PathBuf>> {
     let Some(keep) = configured_keep_runs()? else {
         return Ok(Vec::new());
     };
-    let mut candidates = matching_children(parent, current, marker, false)?;
+    let mut candidates = matching_children(root, parent, current, marker, false)?;
     let remove_from = keep.saturating_sub(1).min(candidates.len());
     let removed = candidates.split_off(remove_from);
     for path in &removed {
@@ -169,8 +180,8 @@ fn replace_with_hardlink(source: &Path, destination: &Path, expected_hash: &[u8;
 /// Hardlink immutable files in `current` to byte-identical files in sibling
 /// evidence runs. Paths and bytes stay unchanged; unsupported filesystems
 /// simply retain separate copies.
-pub(crate) fn deduplicate_run(parent: &Path, current: &Path, marker: &str) -> Result<DedupStats> {
-    let siblings = matching_children(parent, current, marker, true)?;
+pub(crate) fn deduplicate_run(root: &Path, parent: &Path, current: &Path, marker: &str) -> Result<DedupStats> {
+    let siblings = matching_children(root, parent, current, marker, true)?;
     if !current.is_dir() {
         return Ok(DedupStats::default());
     }
@@ -207,12 +218,13 @@ pub(crate) fn deduplicate_run(parent: &Path, current: &Path, marker: &str) -> Re
     Ok(stats)
 }
 
-pub(crate) fn remove_directory_if_present(path: &Path) -> Result<bool> {
+pub(crate) fn remove_directory_if_present(root: &Path, path: &Path) -> Result<bool> {
     match fs::symlink_metadata(path) {
         Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => {
             bail!("refusing to remove non-directory gate work path {}", path.display())
         }
         Ok(_) => {
+            ensure_confined(root, path, "gate work directory")?;
             fs::remove_dir_all(path).with_context(|| format!("failed to remove gate work directory {}", path.display()))?;
             Ok(true)
         }
@@ -221,10 +233,13 @@ pub(crate) fn remove_directory_if_present(path: &Path) -> Result<bool> {
     }
 }
 
-pub(crate) fn write_latest_index(path: &Path, report_path: &Path, kind: &str, mode: &str, status: &str) -> Result<()> {
+pub(crate) fn write_latest_index(root: &Path, path: &Path, report_path: &Path, kind: &str, mode: &str, status: &str) -> Result<()> {
+    let parent = path.parent().context("latest evidence index has no parent")?;
+    ensure_confined(root, parent, "latest evidence index directory")?;
+    ensure_confined(root, report_path, "evidence report")?;
     let report_bytes = fs::read(report_path).with_context(|| format!("failed to read {}", report_path.display()))?;
     let report_sha256 = hex::encode(Sha256::digest(&report_bytes));
-    let relative = report_path.strip_prefix(path.parent().unwrap_or_else(|| Path::new("."))).unwrap_or(report_path);
+    let relative = report_path.strip_prefix(parent).unwrap_or(report_path);
     let index = serde_json::json!({
         "schema": "cellscript-local-evidence-index-v1",
         "kind": kind,
@@ -236,10 +251,27 @@ pub(crate) fn write_latest_index(path: &Path, report_path: &Path, kind: &str, mo
             "size_bytes": report_bytes.len(),
         },
     });
-    let mut output = File::create(path).with_context(|| format!("failed to write {}", path.display()))?;
-    serde_json::to_writer_pretty(&mut output, &index)?;
-    output.write_all(b"\n")?;
-    Ok(())
+    let temporary = parent.join(format!(
+        ".cellscript-latest-{}-{}-{}.tmp",
+        std::process::id(),
+        kind.replace(|character: char| !character.is_ascii_alphanumeric(), "_"),
+        mode.replace(|character: char| !character.is_ascii_alphanumeric(), "_")
+    ));
+    let write_result = (|| -> Result<()> {
+        let mut output = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&temporary)
+            .with_context(|| format!("failed to create temporary latest index {}", temporary.display()))?;
+        serde_json::to_writer_pretty(&mut output, &index)?;
+        output.write_all(b"\n")?;
+        output.sync_all()?;
+        fs::rename(&temporary, path).with_context(|| format!("failed to publish latest evidence index {}", path.display()))
+    })();
+    if write_result.is_err() {
+        let _ = fs::remove_file(&temporary);
+    }
+    write_result
 }
 
 #[cfg(test)]
@@ -262,7 +294,7 @@ mod tests {
         let current = parent.join("run-5-quick");
         fs::create_dir(&current).unwrap();
 
-        let removed = prune_run_directories_with_limit(&parent, &current, "-quick", 3).unwrap();
+        let removed = prune_run_directories_with_limit(&parent, &parent, &current, "-quick", 3).unwrap();
         assert_eq!(removed.len(), 1);
         assert!(current.is_dir());
         assert!(parent.join("run-3-quick").is_dir());
@@ -272,6 +304,33 @@ mod tests {
         fs::remove_dir_all(parent).unwrap();
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn pruning_refuses_a_symlinked_evidence_root() {
+        use std::os::unix::fs::symlink;
+
+        let parent = test_root("confined-prune");
+        let repository = parent.join("repository");
+        let outside = parent.join("outside");
+        fs::create_dir(&repository).unwrap();
+        fs::create_dir(&outside).unwrap();
+        fs::create_dir(outside.join("1-quick-old")).unwrap();
+        fs::create_dir(outside.join("2-quick-current")).unwrap();
+        symlink(&outside, repository.join("evidence")).unwrap();
+
+        let error = prune_run_directories_with_limit(
+            &repository,
+            &repository.join("evidence"),
+            &repository.join("evidence/2-quick-current"),
+            "-quick-",
+            1,
+        )
+        .unwrap_err();
+        assert!(error.to_string().contains("outside evidence root"));
+        assert!(outside.join("1-quick-old").is_dir());
+        fs::remove_dir_all(parent).unwrap();
+    }
+
     #[cfg(unix)]
     #[test]
     fn deduplication_preserves_paths_and_bytes() {
@@ -286,7 +345,7 @@ mod tests {
         fs::write(previous.join("artifact.elf"), &bytes).unwrap();
         fs::write(current.join("artifact.elf"), &bytes).unwrap();
 
-        let stats = deduplicate_run(&parent, &current, "-production").unwrap();
+        let stats = deduplicate_run(&parent, &parent, &current, "-production").unwrap();
         assert_eq!(stats, DedupStats { files: 1, bytes: DEDUP_MIN_BYTES });
         assert_eq!(fs::read(current.join("artifact.elf")).unwrap(), bytes);
         assert_eq!(
@@ -308,7 +367,7 @@ mod tests {
         fs::write(current.join("left.json"), &bytes).unwrap();
         fs::write(current.join("right.json"), &bytes).unwrap();
 
-        let stats = deduplicate_run(&parent, &current, "-bounded").unwrap();
+        let stats = deduplicate_run(&parent, &parent, &current, "-bounded").unwrap();
         assert_eq!(stats, DedupStats { files: 1, bytes: DEDUP_MIN_BYTES });
         assert_eq!(fs::metadata(current.join("left.json")).unwrap().ino(), fs::metadata(current.join("right.json")).unwrap().ino());
         fs::remove_dir_all(parent).unwrap();

crates/cellscript-tools/src/strict_backend.rs

@@ -314,9 +314,9 @@ pub fn run(root: &Path, mode: &str) -> Result<i32> {
         .with_context(|| format!("failed to write {}", report_path.display()))?;
     if managed_report {
         let latest = report_parent.join(format!("latest-{mode}.json"));
-        write_latest_index(&latest, &report_path, "strict-backend-audit", mode, if passed { "passed" } else { "failed" })?;
+        write_latest_index(root, &latest, &report_path, "strict-backend-audit", mode, if passed { "passed" } else { "failed" })?;
         let marker = format!("strict-backend-audit-{mode}-");
-        let removed = prune_report_files(report_parent, &report_path, &marker)?;
+        let removed = prune_report_files(root, report_parent, &report_path, &marker)?;
         if !removed.is_empty() {
             println!("strict backend audit retention: pruned {} old {mode} report(s)", removed.len());
         }

crates/cellscript-tools/src/syntax_combo.rs

@@ -1257,7 +1257,7 @@ pub fn run(root: &Path, mode: &str, seed: u64, budget: Option<usize>, case_name:
     let run_dir = report_root.join(format!("{timestamp}-{mode}-{seed}"));
     fs::create_dir_all(&run_dir)?;
     let retention_marker = format!("-{mode}-");
-    let pruned = prune_run_directories(&report_root, &run_dir, &retention_marker)?;
+    let pruned = prune_run_directories(root, &report_root, &run_dir, &retention_marker)?;
     if !pruned.is_empty() {
         println!("syntax-combo-audit retention: pruned {} old {mode} run(s)", pruned.len());
     }
@@ -1325,10 +1325,11 @@ pub fn run(root: &Path, mode: &str, seed: u64, budget: Option<usize>, case_name:
     write_reports(&run_dir, &report, &failures)?;
     if !retain_intermediates {
         for child in ["cases", "parse_reject", "fmt", "asm", "meta", "shrink"] {
-            remove_directory_if_present(&run_dir.join(child))?;
+            remove_directory_if_present(root, &run_dir.join(child))?;
         }
     }
     write_latest_index(
+        root,
         &report_root.join(format!("latest-{mode}.json")),
         &run_dir.join("report.json"),
         "syntax-combo-audit",

docs/releases/CELLSCRIPT_0_25_RELEASE_NOTES.md

@@ -99,6 +99,22 @@ one-to-one correspondence, fresh identity, and capacity rules for
 `BoundedList`/`create_each`. Builder evidence is not accepted as a replacement
 for those on-chain checks.
 
+## Bounded Local Evidence Storage
+
+Compiler caches and local gate evidence no longer grow without a default
+bound. Incremental caches keep the 32 most recently used identities per root;
+managed syntax, strict-backend, and CKB-acceptance streams keep three runs per
+mode. Successful syntax audits discard reproducible per-case intermediates,
+and production acceptance removes its transient Cargo target and stopped-node
+database while preserving the reports and verified artifacts that identify the
+run. Matching large files are hardlinked only after SHA-256 comparison.
+
+`latest-<mode>.json` indexes retain the exact report path, hash, size, and
+status. Operators can override the bounds for an external archiver or a debug
+session. Automatic retention and `cellc clean --cache` are confined to their
+workspace/evidence roots and reject symlinked managed path components instead
+of following them outside the repository.
+
 ## Validation Before Release
 
 The implementation is not release-complete until the generated surface and

src/cli/commands.rs

@@ -822,8 +822,10 @@ fn collect_workspace_incremental_caches(root: &Path, caches: &mut Vec<PathBuf>)
         }
         let name = entry.file_name();
         if name == ".cell" {
-            let cache = path.join("build/cache");
-            if cache.is_dir() {
+            let build = path.join("build");
+            let Some(build) = managed_directory_if_present(&build)? else { continue };
+            let cache = build.join("cache");
+            if let Some(cache) = managed_directory_if_present(&cache)? {
                 caches.push(cache);
             }
             continue;
@@ -836,6 +838,50 @@ fn collect_workspace_incremental_caches(root: &Path, caches: &mut Vec<PathBuf>)
     Ok(())
 }
 
+fn managed_directory_if_present(path: &Path) -> Result<Option<PathBuf>> {
+    match std::fs::symlink_metadata(path) {
+        Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => Err(CompileError::without_span(format!(
+            "refusing managed cache path with a symlink or non-directory component: '{}'",
+            path.display()
+        ))),
+        Ok(_) => Ok(Some(path.to_path_buf())),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn ensure_workspace_directory_for_removal(workspace_root: &Path, path: &Path) -> Result<PathBuf> {
+    let canonical_root = std::fs::canonicalize(workspace_root)?;
+    let absolute = if path.is_absolute() { path.to_path_buf() } else { canonical_root.join(path) };
+    let canonical_path = std::fs::canonicalize(&absolute)?;
+    if !canonical_path.starts_with(&canonical_root) {
+        return Err(CompileError::without_span(format!(
+            "refusing to clean path outside workspace '{}': '{}'",
+            canonical_root.display(),
+            canonical_path.display()
+        )));
+    }
+    let relative = absolute
+        .strip_prefix(&canonical_root)
+        .map_err(|_| CompileError::without_span(format!("refusing non-workspace clean path '{}'", absolute.display())))?;
+    let mut cursor = canonical_root;
+    for component in relative.components() {
+        let std::path::Component::Normal(component) = component else {
+            return Err(CompileError::without_span(format!("refusing non-canonical clean path '{}'", path.display())));
+        };
+        cursor.push(component);
+        let metadata = std::fs::symlink_metadata(&cursor)?;
+        if metadata.file_type().is_symlink() {
+            return Err(CompileError::without_span(format!("refusing to clean through symlink '{}'", cursor.display())));
+        }
+    }
+    let metadata = std::fs::symlink_metadata(&canonical_path)?;
+    if !metadata.is_dir() {
+        return Err(CompileError::without_span(format!("refusing to clean non-directory path '{}'", path.display())));
+    }
+    Ok(canonical_path)
+}
+
 impl CommandExecutor {
     #[cfg(not(feature = "vm-runner"))]
     fn experimental_command(name: &str, detail: &str) -> Result<()> {
@@ -1724,6 +1770,7 @@ impl CommandExecutor {
     }
 
     fn clean(args: CleanArgs) -> Result<()> {
+        let workspace_root = std::fs::canonicalize(".")?;
         let mut paths = vec![PathBuf::from("target"), PathBuf::from(".cell/cache")];
         if args.cache {
             collect_workspace_incremental_caches(Path::new("."), &mut paths)?;
@@ -1734,11 +1781,8 @@ impl CommandExecutor {
 
         for path in paths {
             if path.exists() {
-                let metadata = std::fs::symlink_metadata(&path)?;
-                if metadata.file_type().is_symlink() || !metadata.is_dir() {
-                    return Err(CompileError::without_span(format!("refusing to clean non-directory path '{}'", path.display())));
-                }
-                std::fs::remove_dir_all(&path)?;
+                let removable = ensure_workspace_directory_for_removal(&workspace_root, &path)?;
+                std::fs::remove_dir_all(removable)?;
                 removed_paths.push(path.to_string_lossy().into_owned());
             }
         }