feat(fleet): enforce generated environment boundary (#772)

packages/mosaic/framework/tools/fleet/start-tmux-holder.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# A holder may create only the configured named socket. Existing servers are
+# accepted only when their private install-derived ownership identity, exact
+# holder session, and complete approved global environment all match.
+
+MOSAIC_HOME=${MOSAIC_HOME:-$HOME/.config/mosaic}
+MOSAIC_TMUX_SOCKET=${MOSAIC_TMUX_SOCKET:-mosaic-fleet}
+MOSAIC_TMUX_HOLDER=${MOSAIC_TMUX_HOLDER:-_holder}
+OWNER_FILE="$MOSAIC_HOME/fleet/run/holder-owner"
+TMUX_BIN=/usr/bin/tmux
+
+fail() {
+  echo "ERROR: refusing unmanaged Mosaic tmux server on socket ${MOSAIC_TMUX_SOCKET}: $1" >&2
+  exit 64
+}
+
+[ -x "$TMUX_BIN" ] || fail "tmux binary is unavailable"
+[ -f "$OWNER_FILE" ] && [ ! -L "$OWNER_FILE" ] || fail "private ownership identity is missing"
+owner_mode=$(stat -c '%a' -- "$OWNER_FILE") || fail "private ownership identity is unreadable"
+(( (8#$owner_mode & 8#077) == 0 )) || fail "private ownership identity has unsafe permissions"
+MOSAIC_FLEET_OWNER=$(tr -d '\n' < "$OWNER_FILE")
+[[ "$MOSAIC_FLEET_OWNER" =~ ^[a-f0-9-]{36}$ ]] || fail "private ownership identity is malformed"
+
+_tmux() {
+  "$TMUX_BIN" -L "$MOSAIC_TMUX_SOCKET" "$@"
+}
+
+server_running() {
+  _tmux list-sessions >/dev/null 2>&1
+}
+
+assert_owned_server() {
+  _tmux has-session -t "=${MOSAIC_TMUX_HOLDER}:0.0" 2>/dev/null || fail "exact holder session is absent"
+  local environment
+  environment=$(_tmux show-environment -g 2>/dev/null) || fail "global environment is unreadable"
+  local expected
+  expected=$(printf '%s\n' \
+    "HOME=$HOME" \
+    'PATH=/usr/bin:/bin' \
+    "PWD=$HOME" \
+    "MOSAIC_FLEET_OWNER=$MOSAIC_FLEET_OWNER" \
+    "MOSAIC_TMUX_HOLDER=$MOSAIC_TMUX_HOLDER" \
+    "MOSAIC_TMUX_SOCKET=$MOSAIC_TMUX_SOCKET" | sort)
+  [ "$(printf '%s\n' "$environment" | sort)" = "$expected" ] || \
+    fail "global environment does not match the owned-server contract"
+}
+
+if server_running; then
+  assert_owned_server
+else
+  cd "$HOME" || fail "trusted home is unavailable"
+  # Start the tmux server itself under the approved environment. The holder pane
+  # receives the same closed environment rather than arbitrary server globals.
+  /usr/bin/env -i \
+    "HOME=$HOME" \
+    PATH=/usr/bin:/bin \
+    "MOSAIC_FLEET_OWNER=$MOSAIC_FLEET_OWNER" \
+    "MOSAIC_TMUX_HOLDER=$MOSAIC_TMUX_HOLDER" \
+    "MOSAIC_TMUX_SOCKET=$MOSAIC_TMUX_SOCKET" \
+    "$TMUX_BIN" -L "$MOSAIC_TMUX_SOCKET" new-session -d -s "$MOSAIC_TMUX_HOLDER" \
+    /usr/bin/env -i "HOME=$HOME" PATH=/usr/bin:/bin /bin/sh -c 'while true; do sleep 3600; done'
+fi