feat: support attaching token for launched process and cli launcher

Author: XOR-op

Cargo.lock

@@ -10,6 +10,8 @@ pub struct ProcessSchema {
     pub cmdline: String,
     pub cwd: String,
     pub parents: Vec<ProcessParentSchema>,
+    #[serde(skip_serializing_if = "Option::is_none", default)]
+    pub token: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone)]

boltapi/src/schema.rs

@@ -3,6 +3,7 @@ mod clean;
 mod request;
 mod request_uds;
 mod request_web;
+mod run;
 mod streaming;
 
 use crate::ProgramArgs;
@@ -201,6 +202,8 @@ pub(crate) enum MasterConnOptions {
 pub(crate) enum SubCommand {
     /// Start the main program
     Start(StartOptions),
+    /// Run a command with a tracking token
+    Run(run::RunOptions),
     /// Reload configurations
     Reload,
     /// Validate configurations
@@ -262,6 +265,10 @@ pub(crate) async fn controller_main(args: ProgramArgs) -> ! {
     #[cfg(windows)]
     let default_uds_path = Some(r"\\.\pipe\boltconn".to_string());
     match args.cmd {
+        SubCommand::Run(opts) => {
+            let code = run::run_with_token(opts);
+            exit(code as i32);
+        }
         SubCommand::Generate(GenerateOptions::Init(init)) => {
             fn create(init: InitOptions) -> anyhow::Result<()> {
                 let (config, data, _) =
@@ -442,6 +449,7 @@ pub(crate) async fn controller_main(args: ProgramArgs) -> ! {
             DnsOptions::Mapping { fake_ip } => requester.fake_ip_to_real(fake_ip).await,
         },
         SubCommand::Start(_)
+        | SubCommand::Run(_)
         | SubCommand::Generate(_)
         | SubCommand::Clean
         | SubCommand::Log

boltconn/src/cli/mod.rs

@@ -0,0 +1,51 @@
+use crate::platform::process::validate_and_encode_token;
+use clap::Args;
+
+#[derive(Debug, Args)]
+pub(crate) struct RunOptions {
+    /// Token string to assign to the launched process (must be non-empty and
+    /// base64-encode to at most 19 characters to satisfy the macOS shm name limit)
+    #[arg(short = 't', long = "token")]
+    pub token: String,
+    /// Command and arguments to execute
+    #[arg(trailing_var_arg = true, allow_hyphen_values = true)]
+    pub command: Vec<String>,
+}
+
+/// Set up the token and exec the command. Returns the child's exit code (or -1 on error).
+pub(crate) fn run_with_token(opts: RunOptions) -> i32 {
+    let encoded = match validate_and_encode_token(&opts.token) {
+        Ok(e) => e,
+        Err(msg) => {
+            eprintln!("boltconn run: invalid token: {}", msg);
+            return 1;
+        }
+    };
+
+    #[cfg(unix)]
+    if let Err(e) = crate::platform::process::setup_token_fd(&encoded) {
+        eprintln!("boltconn run: failed to set up token fd: {}", e);
+        return 1;
+    }
+
+    #[cfg(target_os = "windows")]
+    crate::platform::process::setup_token_env(&encoded);
+
+    let mut iter = opts.command.into_iter();
+    let program = match iter.next() {
+        Some(p) => p,
+        None => {
+            eprintln!("boltconn run: no command specified");
+            return 1;
+        }
+    };
+    let args: Vec<String> = iter.collect();
+
+    match std::process::Command::new(&program).args(&args).status() {
+        Ok(status) => status.code().unwrap_or(1),
+        Err(e) => {
+            eprintln!("boltconn run: failed to execute '{}': {}", program, e);
+            1
+        }
+    }
+}

boltconn/src/cli/run.rs

@@ -273,9 +273,9 @@ fn test_raw_root_cfg() {
 }
 
 #[test]
-fn test_dispatching_config_process_info_depth_defaults_to_one() {
+fn test_dispatching_config_process_info_depth_defaults_to_unlimited() {
     let config: DispatchingConfig = serde_yaml::from_str("{}").unwrap();
-    assert_eq!(config.process_info_depth, ProcessInfoDepth::Limited(1));
+    assert_eq!(config.process_info_depth, ProcessInfoDepth::Unlimited);
 }
 
 #[test]

boltconn/src/config/config.rs

@@ -172,6 +172,7 @@ impl Controller {
             cmdline: info.cmdline.clone(),
             cwd: info.cwd.clone(),
             parents,
+            token: info.token.clone(),
         }
     }
 

boltconn/src/external/controller.rs

@@ -98,6 +98,7 @@ struct InstrumentContext<'a> {
     time_hms_ms: String,
     time_datetime: String,
     time_datetime_ms: String,
+    process_token: String,
     process_parent_all_json: String,
 }
 
@@ -131,6 +132,11 @@ impl<'a> InstrumentContext<'a> {
             time_hms_ms: now.format("%H:%M:%S%.3f").to_string(),
             time_datetime: now.format("%Y-%m-%d %H:%M:%S").to_string(),
             time_datetime_ms: now.format("%Y-%m-%d %H:%M:%S%.3f").to_string(),
+            process_token: info
+                .process_info
+                .as_ref()
+                .and_then(|p| p.token.clone())
+                .unwrap_or_else(|| NA_STR.to_string()),
             process_parent_all_json: Self::serialize_all_parents(info.process_info.as_ref()),
         }
     }
@@ -275,6 +281,7 @@ impl interpolator::Context for InstrumentContext<'_> {
                     .as_ref()
                     .map_or_else(Self::na, |info| Formattable::display(&info.pid)),
             ),
+            "process.token" => Some(Formattable::display(&self.process_token)),
             "process.parent.pid" => self.process_parent_field(0, "pid"),
             "process.parent.name" => self.process_parent_field(0, "name"),
             "process.parent.path" => self.process_parent_field(0, "path"),
@@ -295,7 +302,7 @@ fn test_instrument_formatting() {
 local_ip: {ip.local}, conn_type: {conn.type}, \
 inbound_type: {inbound.type}, inbound_port: {inbound.port}, inbound_user: {inbound.user}, \
 process_name: {process.name}, process_cmdline: {process.cmdline}, process_path: {process.path}, \
-process_pid: {process.pid}, process_parent_pid: {process.parent.pid}, \
+process_pid: {process.pid}, process_token: {process.token}, process_parent_pid: {process.parent.pid}, \
 process_parent_name: {process.parent.name}, process_parent_path: {process.parent.path}, \
 process_parent_cmdline: {process.parent.cmdline}, process_parent_indexed_name: {process.parents.0.name}, \
 process_parent_all_json: {process.parent.all.json}, \
@@ -324,7 +331,7 @@ time: {time.hms_ms}";
 local_ip: N/A, conn_type: tcp, \
 inbound_type: tun, inbound_port: N/A, inbound_user: N/A, \
 process_name: N/A, process_cmdline: N/A, process_path: N/A, \
-process_pid: N/A, process_parent_pid: N/A, \
+process_pid: N/A, process_token: N/A, process_parent_pid: N/A, \
 process_parent_name: N/A, process_parent_path: N/A, \
 process_parent_cmdline: N/A, process_parent_indexed_name: N/A, \
 process_parent_all_json: [], "
@@ -340,6 +347,7 @@ fn mock_process(pid: i32, name: &str, parent: ParentProcess) -> ProcessInfo {
         name: name.to_string(),
         cmdline: format!("{name} --serve"),
         cwd: format!("/tmp/{name}"),
+        token: None,
     }
 }
 
@@ -436,3 +444,24 @@ fn test_instrument_template_validation_accepts_parent_json() {
     let template = "ancestor={process.parent.all.json}";
     assert!(FormattingObject::new(template.to_string()).is_ok());
 }
+
+#[test]
+fn test_instrument_formatting_process_token() {
+    // token absent → N/A
+    let info = mock_conn_info(None);
+    let rendered = FormattingObject::format_inner("token={process.token}", &info).unwrap();
+    assert_eq!(rendered, "token=N/A");
+
+    // process present but no token → N/A
+    let process_no_token = mock_process(42, "curl", ParentProcess::None);
+    let info = mock_conn_info(Some(process_no_token));
+    let rendered = FormattingObject::format_inner("token={process.token}", &info).unwrap();
+    assert_eq!(rendered, "token=N/A");
+
+    // process present with token → token value
+    let mut process_with_token = mock_process(42, "curl", ParentProcess::None);
+    process_with_token.token = Some("python".to_string());
+    let info = mock_conn_info(Some(process_with_token));
+    let rendered = FormattingObject::format_inner("token={process.token}", &info).unwrap();
+    assert_eq!(rendered, "token=python");
+}

boltconn/src/instrument/action.rs

@@ -324,6 +324,7 @@ pub fn get_process_info(pid: i32, depth: ProcessInfoDepth) -> Option<ProcessInfo
         name,
         cmdline,
         cwd,
+        token: super::token::get_token_for_pid(pid),
     })
 }
 

boltconn/src/platform/process/linux.rs

@@ -138,6 +138,7 @@ pub fn get_process_info(pid: i32, depth: ProcessInfoDepth) -> Option<ProcessInfo
         name,
         cmdline,
         cwd,
+        token: super::token::get_token_for_pid(pid),
     })
 }
 

boltconn/src/platform/process/macos.rs

@@ -16,6 +16,13 @@ mod windows;
 #[cfg(target_os = "windows")]
 pub use windows::*;
 
+mod token;
+#[cfg(target_os = "windows")]
+pub use token::setup_token_env;
+#[cfg(unix)]
+pub use token::setup_token_fd;
+pub use token::validate_and_encode_token;
+
 use serde::de::{self, Visitor};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 
@@ -133,6 +140,8 @@ pub struct ProcessInfo {
     pub name: String,
     pub cmdline: String,
     pub cwd: String,
+    /// Bolt token assigned at launch via `boltconn run`, if present.
+    pub token: Option<String>,
 }
 
 impl ProcessInfo {