sluicify v0.4.1

Added

• sluicify-native installs and runs on arm64 Linux as on x64: the package carries both
  addons, each built and smoke-tested against a live broker on a runner of its architecture.

sluicify v0.4.0

Added

• sluice serve --rules-dir <dir> --socket-dir <dir> serves every
  <name>.rules on its own socket, <socket-dir>/<name>/sluice.sock,
  from one process, and follows files added, changed and removed.
• sluice check --rules-dir <dir>.
• A listing request: sluicify --list <socket> and list() in
  sluicify-native print each rule's command line, the comment lines
  above it, and what each slot accepts.
• ERR_TOO_LARGE (-9): a listing longer than 64 KiB.

Changed

• sluicify-native requires Node ≥ 22.
• A request with no arguments is a listing request; it was ERR_PROTO.
• The broker says reloaded <file> after SIGHUP, where it said
  reload OK.

sluicify v0.3.1

Added

• sluicify-native, the Node addon, is published on npm for linux x64.

sluicify v0.3.0

Changed

• A bare-name rule matches only an argv[0] equal to its name, and an
  absolute rule only its exact path. A caller sending a path for a
  bare-name rule (/usr/bin/git for git) now gets ERR_NO_RULE.

sluicify v0.2.2

Added

• sluicify --version / -V and --help / -h, as the first argument
  only; after the socket path every argument belongs to the command.

sluicify v0.2.1

Changed

• README and REFERENCE: new "Auditing rules" section — how a rule ends up
  granting more than intended, with counter-examples and a per-rule
  procedure to follow before a rule goes live.
• The README tutorial and examples/sluice.rules use only closed rules:
  none runs a file the caller can write, and git and systemctl run
  with --no-pager.

sluicify v0.2.0

Upgrading

• Every slot needs a regex or an allow_any entry; a rules file with a
  bare slot no longer parses. Run the new sluice check on your rules
  before restarting the broker.
• Slot values starting with - are refused unless the slot is listed
  in allow_dash.
• Clients that interpret wire status: -5 is no longer sent (signal
  deaths are 128 + signo); handle -7 (ERR_TIMEOUT) and -8
  (ERR_PEER).

Security

• Slot regexes are anchored as ^(?:…)$, so every branch of an
  alternation must match the whole value and a trailing \$ is not
  taken for an end anchor.
• Every slot needs a regex unless listed in allow_any, and values
  starting with - are refused unless the slot is listed in
  allow_dash (reject reason option_like).
• Fds passed with a malformed request or the wrong fd count are closed
  instead of leaking in the broker.
• Received fds are close-on-exec atomically (MSG_CMSG_CLOEXEC), so a
  concurrent spawn can't inherit another caller's stdio.
• sluice serve refuses to start when another broker is listening on
  the socket path, instead of unlinking it.

Added

• allow_dash and allow_any rule attributes. sluice check lists
  every slot they widen.
• $HOME and $XDG_RUNTIME_DIR (also ${…}) expand in logfile,
  stdoutfile, stderrfile and cwd, once at parse or SIGHUP
  reload. Any other $VAR, or an unset one, is a parse error.
• Wire status ERR_TIMEOUT (-7) when a rule timeout fires; sluicify
  and the example clients exit 124 for it.
• Wire status ERR_PEER (-8) when the caller's SO_PEERCRED can't be
  read (reject reason peer_unknown).
• Manifest: "resolved" (the binary executed) on start events;
  "signal", "timed_out" and "drain_timeout" on exit events when
  set.

Changed

• A child killed by a signal reports 128 + signo.
• With stdoutfile/stderrfile, the reply goes out when the child
  exits. Output from background processes still holding the pipe is
  captured until they close it, or until the rule's timeout + 2 s; the
  exit event is written then.
• An executable that doesn't resolve via exec_path is a reject
  (exe_unresolved) instead of a start/exit pair.
• Rule attribute values: a value starting with a quote is one quoted
  word and may contain ;. Otherwise quotes are literal and ; starts
  a comment unless written \;.
• A per-rule logfile is a parse error.
• sluicify prints one actionable line per error, e.g. No matching rule for command: <cmd> or Broker not running: no socket at <path>.

Removed

• Wire status ERR_SIGNALED (-5).

Fixed

• Spawned children no longer inherit SIGHUP blocked and SIGPIPE
  ignored.
• A timeout is enforced by polling when pidfd_open or poll fails
  (e.g. EMFILE), instead of killing the child at once or never.
• A panicking connection handler or a failed thread spawn no longer
  leaks a concurrency slot or stops the accept loop.
• Requests with trailing bytes, or truncated by the receive buffer, are
  rejected.
• sluice check reports the number of slots, not of slot regexes.
• sluicify reports a non-UTF-8 argument instead of panicking.