fix(vscode): respect macOS process attachment policy

Author: CryZe

crates/splitscript-process-native/src/lib.rs

@@ -45,7 +45,7 @@ struct Process {
 impl Process {
     fn attach(pid: u32, path: Option<Box<str>>) -> io::Result<Self> {
         let native_pid = pid as Pid;
-        let handle = native_pid.try_into()?;
+        let handle = native_pid.try_into().map_err(process_attach_error)?;
         let now = Instant::now();
         Ok(Self {
             handle,
@@ -154,6 +154,19 @@ impl Process {
     }
 }
 
+#[cfg(target_os = "macos")]
+fn process_attach_error(_: io::Error) -> io::Error {
+    io::Error::new(
+        io::ErrorKind::PermissionDenied,
+        "macOS task_for_pid denied access; process memory attachment requires debugger authorization and a target that permits inspection",
+    )
+}
+
+#[cfg(not(target_os = "macos"))]
+const fn process_attach_error(error: io::Error) -> io::Error {
+    error
+}
+
 struct ProcessList {
     system: System,
     next_check: Instant,

editors/vscode/DEVELOPMENT.md

@@ -53,6 +53,11 @@ For a local build, `build-native.mjs` builds the bridge for the current supporte
 host. CI supplies a directory of prebuilt platform folders through
 `SPLITSCRIPT_NATIVE_ARTIFACTS`; `SPLITSCRIPT_REQUIRED_NATIVE_PLATFORMS` makes a
 missing artifact fail the build rather than silently producing a partial VSIX.
+The Windows and Linux jobs probe a spawned fixture end to end. GitHub-hosted
+macOS runners cannot provide interactive `task_for_pid` authorization, so the
+macOS jobs probe discovery, modules, mapped ranges, and Mach memory reads against
+the current Node process instead. This keeps native behavior covered without
+pretending that CI can grant permission to inspect another process.
 
 ## Worker architecture
 

editors/vscode/README.md

@@ -99,6 +99,9 @@ virtual workspaces.
   coalesced to at most five updates per second. The **Statistics** panel keeps
   a bounded window of 2,048 tick timings and provides reset and lazy Wasm-memory
   actions without stopping the runtime.
+  On macOS, attaching to another process uses `task_for_pid` and is subject to
+  the operating system's debugger authorization and target code-signing rules.
+  A denied attachment reports that permission boundary explicitly.
 - WASI snapshot preview1 (WASI 0.1) is available with a read-only filesystem
   below `/mnt`. Arguments and environment variables are deliberately empty,
   and filesystem-mutating operations return `NOTCAPABLE`.

editors/vscode/scripts/probe-native.mjs

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
-import { dirname, resolve } from 'node:path';
+import { basename, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
@@ -29,53 +29,108 @@ const native = require(resolve(
     platform,
     'splitscript_process_native.node',
 ));
-const fixtureName = process.platform === 'win32'
-    ? 'splitscript-process-fixture.exe'
-    : 'splitscript-process-fixture';
-const fixture = spawn(
-    resolve(repository, 'target', 'release', fixtureName),
-    [],
-    { stdio: ['pipe', 'pipe', 'inherit'] },
-);
 
-try {
-    const line = await firstLine(fixture.stdout);
-    const fields = Object.fromEntries(line.split(';').map(field => field.split('=', 2)));
-    const pid = Number(fields.pid);
-    const length = Number(fields.length);
-    assert(Number.isInteger(pid) && pid > 0);
-    assert(Number.isInteger(length) && length > 0);
+if (process.platform === 'darwin') {
+    probeCurrentProcess();
+} else {
+    await probeFixtureProcess();
+}
+
+function probeCurrentProcess() {
+    // GitHub-hosted macOS runners cannot grant the interactive debugger
+    // authorization that task_for_pid requires for another process. Attaching
+    // to the caller is always valid and still exercises the Mach memory path.
+    const processName = basename(process.execPath);
+    assert(native.listProcessesByName(processName).includes(process.pid));
 
-    assert(native.listProcessesByName(fixtureName).includes(pid));
+    const handle = native.attachByPid(process.pid);
+    try {
+        assert.equal(native.processId(handle), process.pid);
+        const processPath = native.processPath(handle);
+        assert.equal(typeof processPath, 'string');
+        assert.equal(basename(processPath), processName);
+        assert.equal(native.isOpen(handle), true);
+        assert(BigInt(native.moduleAddress(handle, processName)) > 0n);
+        assert(BigInt(native.moduleSize(handle, processName)) > 0n);
+        assert.equal(basename(native.modulePath(handle, processName)), processName);
+
+        const readable = firstReadableRange(native, handle);
+        const actual = native.readProcessMemory(handle, readable.address, 32);
+        assert.equal(actual.length, 32);
+    } finally {
+        assert.equal(native.detach(handle), true);
+        assert.equal(native.detach(handle), false);
+    }
+
+    console.log(
+        `Native ${platform} self-process probe passed: discovery, modules, ranges, and a 32-byte Mach memory read.`,
+    );
+}
 
-    const handle = native.attachByPid(pid);
-    assert.equal(native.processId(handle), pid);
-    assert.match(native.processPath(handle), new RegExp(`${escapeRegExp(fixtureName)}$`, 'i'));
-    assert.equal(native.isOpen(handle), true);
-    assert(BigInt(native.moduleAddress(handle, fixtureName)) > 0n);
-    assert(BigInt(native.moduleSize(handle, fixtureName)) > 0n);
-    assert.match(
-        native.modulePath(handle, fixtureName),
-        new RegExp(`${escapeRegExp(fixtureName)}$`, 'i'),
+async function probeFixtureProcess() {
+    const fixtureName = process.platform === 'win32'
+        ? 'splitscript-process-fixture.exe'
+        : 'splitscript-process-fixture';
+    const fixture = spawn(
+        resolve(repository, 'target', 'release', fixtureName),
+        [],
+        { stdio: ['pipe', 'pipe', 'inherit'] },
     );
+
+    try {
+        const line = await firstLine(fixture.stdout);
+        const fields = Object.fromEntries(line.split(';').map(field => field.split('=', 2)));
+        const pid = Number(fields.pid);
+        const length = Number(fields.length);
+        assert(Number.isInteger(pid) && pid > 0);
+        assert(Number.isInteger(length) && length > 0);
+
+        assert(native.listProcessesByName(fixtureName).includes(pid));
+
+        const handle = native.attachByPid(pid);
+        assert.equal(native.processId(handle), pid);
+        assert.match(native.processPath(handle), new RegExp(`${escapeRegExp(fixtureName)}$`, 'i'));
+        assert.equal(native.isOpen(handle), true);
+        assert(BigInt(native.moduleAddress(handle, fixtureName)) > 0n);
+        assert(BigInt(native.moduleSize(handle, fixtureName)) > 0n);
+        assert.match(
+            native.modulePath(handle, fixtureName),
+            new RegExp(`${escapeRegExp(fixtureName)}$`, 'i'),
+        );
+        const rangeCount = native.memoryRangeCount(handle);
+        assert(rangeCount > 0);
+        assert(BigInt(native.memoryRangeAddress(handle, 0)) > 0n);
+        assert(BigInt(native.memoryRangeSize(handle, 0)) > 0n);
+        assert(BigInt(native.memoryRangeFlags(handle, 0)) > 0n);
+        const actual = native.readProcessMemory(handle, fields.address, length);
+        assert.equal(Buffer.from(actual).toString('utf8'), fields.expected);
+        assert.equal(native.detach(handle), true);
+        assert.equal(native.detach(handle), false);
+        const namedHandle = native.attachByName(fixtureName);
+        assert.equal(native.processId(namedHandle), pid);
+        assert.equal(native.detach(namedHandle), true);
+        console.log(
+            `Native ${platform} process probe passed: discovery, modules, ranges, and ${length}-byte read from PID ${pid}.`,
+        );
+    } finally {
+        fixture.stdin.end('\n');
+        await new Promise(resolvePromise => fixture.once('exit', resolvePromise));
+    }
+}
+
+function firstReadableRange(native, handle) {
     const rangeCount = native.memoryRangeCount(handle);
     assert(rangeCount > 0);
-    assert(BigInt(native.memoryRangeAddress(handle, 0)) > 0n);
-    assert(BigInt(native.memoryRangeSize(handle, 0)) > 0n);
-    assert(BigInt(native.memoryRangeFlags(handle, 0)) > 0n);
-    const actual = native.readProcessMemory(handle, fields.address, length);
-    assert.equal(Buffer.from(actual).toString('utf8'), fields.expected);
-    assert.equal(native.detach(handle), true);
-    assert.equal(native.detach(handle), false);
-    const namedHandle = native.attachByName(fixtureName);
-    assert.equal(native.processId(namedHandle), pid);
-    assert.equal(native.detach(namedHandle), true);
-    console.log(
-        `Native ${platform} process probe passed: discovery, modules, ranges, and ${length}-byte read from PID ${pid}.`,
-    );
-} finally {
-    fixture.stdin.end('\n');
-    await new Promise(resolvePromise => fixture.once('exit', resolvePromise));
+    for (let index = 0; index < rangeCount; index++) {
+        const address = native.memoryRangeAddress(handle, index);
+        const size = BigInt(native.memoryRangeSize(handle, index));
+        const flags = BigInt(native.memoryRangeFlags(handle, index));
+        if ((flags & 2n) !== 0n && size >= 32n) {
+            assert(BigInt(address) > 0n);
+            return { address };
+        }
+    }
+    assert.fail('the current process has no readable 32-byte memory range');
 }
 
 async function firstLine(stream) {