chainlesschain 0.162.122 → 0.162.124

package/src/lib/mcp-serve.js

@@ -17,7 +17,7 @@
 import http from "http";
 import fsDefault from "fs";
 import pathDefault from "path";
-import { randomBytes } from "crypto";
+import { randomBytes, timingSafeEqual } from "crypto";
 
 export const MAX_READ_BYTES = 200 * 1024;
 export const MAX_LIST_ENTRIES = 500;
@@ -29,14 +29,65 @@ export const _deps = { fs: fsDefault, path: pathDefault };
 
 /** Resolve `rel` inside `root`; throws on escape (.. traversal, abs paths out). */
 export function confine(root, rel, deps = _deps) {
-  const abs = deps.path.resolve(root, rel || ".");
-  const normRoot = deps.path.resolve(root);
-  if (abs !== normRoot && !abs.startsWith(normRoot + deps.path.sep)) {
+  const { path } = deps;
+  const fs = deps.fs;
+  const normRoot = path.resolve(root);
+  const abs = path.resolve(normRoot, rel || ".");
+  // Fast string guard: blocks `..` traversal and absolute-path escapes.
+  if (abs !== normRoot && !abs.startsWith(normRoot + path.sep)) {
     throw new Error(`path escapes serve root: ${rel}`);
   }
+  // Symlink guard: path.resolve does NOT follow symlinks, so a symlink INSIDE
+  // root pointing OUTSIDE would pass the string check yet the fs op (read/write/
+  // list) would escape the serve boundary — e.g. reading ~/.ssh through a
+  // workspace symlink, defeating a `--read-only` exposure. Resolve the real path
+  // of the deepest EXISTING ancestor (a not-yet-created file can't be a symlink)
+  // and re-check containment against the real root.
+  if (fs && typeof fs.realpathSync === "function") {
+    let realRoot;
+    try {
+      realRoot = fs.realpathSync(normRoot);
+    } catch {
+      return abs; // root itself unresolvable → the string guard is all we have
+    }
+    let probe = abs;
+    for (;;) {
+      let real;
+      try {
+        real = fs.realpathSync(probe);
+      } catch {
+        const parent = path.dirname(probe);
+        if (parent === probe) break; // reached fs root, nothing existed
+        probe = parent;
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
+        throw new Error(`path escapes serve root (symlink): ${rel}`);
+      }
+      break;
+    }
+  }
   return abs;
 }
 
+/**
+ * Constant-time check of an `Authorization: Bearer <token>` header against the
+ * expected token. A plain `!==` leaks timing that could let a caller recover the
+ * token byte-by-byte; hash-length differs are rejected up front (the token is a
+ * fixed-length random value, so its length is not secret), then `timingSafeEqual`
+ * compares the bytes. Mirrors the ws-server's token check.
+ */
+export function bearerMatches(authHeader, token) {
+  const prefix = "Bearer ";
+  if (typeof authHeader !== "string" || !authHeader.startsWith(prefix)) {
+    return false;
+  }
+  const a = Buffer.from(authHeader.slice(prefix.length), "utf-8");
+  const b = Buffer.from(String(token), "utf-8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 function ok(text) {
   return { content: [{ type: "text", text: String(text) }] };
 }
@@ -194,8 +245,7 @@ export function startMcpServe(opts = {}) {
       return send(405, rpcError(null, -32600, "POST only"));
     }
     if (token) {
-      const auth = req.headers.authorization || "";
-      if (auth !== `Bearer ${token}`) {
+      if (!bearerMatches(req.headers.authorization, token)) {
         return send(401, rpcError(null, -32001, "unauthorized"));
       }
     }

package/src/lib/orchestrator.js

@@ -27,6 +27,7 @@ import crypto from "crypto";
 import { AgentRouter } from "./agent-router.js";
 import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /* ---------- _deps injection (Vitest CJS mock pattern) ---------- */
 export const _deps = { execSync };
@@ -403,8 +404,9 @@ export class Orchestrator extends EventEmitter {
 
 /** Extract the first JSON array from an LLM response string. */
 function _extractJson(text) {
-  const match = text.match(/\[[\s\S]*\]/);
-  return match ? match[0] : "[]";
+  // Balanced extraction stops at the first complete array, so trailing prose
+  // (or a second array) no longer over-captures into an unparseable string.
+  return firstBalancedJson(text, "[") || "[]";
 }
 
 /** Parse error lines from CI output (test failures, lint errors). */

package/src/lib/process-manager.js

@@ -58,6 +58,17 @@ export function startApp(options = {}) {
   return child.pid;
 }
 
+/**
+ * Parse a PID-file's contents into a valid positive integer, or null.
+ * A corrupt / empty / partially-written file must not yield NaN — that NaN
+ * would otherwise flow into `taskkill /PID NaN` or `process.kill(NaN, …)`,
+ * which silently fails to act on the real process.
+ */
+export function parsePid(content) {
+  const pid = parseInt(String(content).trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
 export function stopApp() {
   const pidFile = getPidFilePath();
 
@@ -66,7 +77,16 @@ export function stopApp() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    logger.warn("PID file is empty or corrupt; removing it.");
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     if (isWindows()) {
@@ -90,7 +110,15 @@ export function isAppRunning() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     process.kill(pid, 0);
@@ -104,7 +132,7 @@ export function isAppRunning() {
 export function getAppPid() {
   const pidFile = getPidFilePath();
   if (!existsSync(pidFile)) return null;
-  return parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  return parsePid(readFileSync(pidFile, "utf-8"));
 }
 
 function findExecutable(binDir, extension) {

package/src/lib/repl-completer.js

@@ -32,6 +32,20 @@ export function extractAtPrefix(line) {
   return m ? { prefix: m[2] } : null;
 }
 
+/**
+ * In `!` bash mode (the line starts with `!`), the trailing whitespace-delimited
+ * token completes to a filesystem path (Claude-Code 2.1.193 bash-mode file
+ * autocomplete). Returns `{ prefix }` — the token with any leading `!` stripped
+ * (so `!cat src/fo` → `src/fo`, `!scr` → `scr`) — or null when not in bash mode.
+ */
+export function extractBashPathPrefix(line) {
+  if (!/^\s*!/.test(line || "")) return null;
+  const m = /(\S*)$/.exec(line || "");
+  let tok = m ? m[1] : "";
+  if (tok.startsWith("!")) tok = tok.slice(1); // `!src/fo` → `src/fo`
+  return { prefix: tok };
+}
+
 /** Normalize to forward slashes (what @refs use on every platform). */
 function fwd(p) {
   return String(p).replace(/\\/g, "/");
@@ -183,6 +197,21 @@ export function makeAtCompleter(opts = {}) {
         return [hits, line];
       }
     }
+    // `!` bash-mode file-path completion (Claude-Code 2.1.193 parity): the
+    // trailing token completes to filesystem paths under cwd — a shell command
+    // runs from cwd, so this uses the filesystem candidate set only (not the
+    // editor's open-file list). Checked before @refs so a `@` inside a bash
+    // command (e.g. `!grep @x file`) still completes the trailing path token.
+    const bash = extractBashPathPrefix(line);
+    if (bash) {
+      const fromFs = fileCandidates(bash.prefix, {
+        cwd: getCwd(),
+        deps: opts.deps,
+      });
+      // readline replaces the trailing `prefix` with the chosen path, leaving
+      // the `!` and the rest of the command intact.
+      return [fromFs.slice(0, MAX_CANDIDATES), bash.prefix];
+    }
     const at = extractAtPrefix(line);
     if (!at) return [[], line];
     refreshIde(); // async top-up for the NEXT tab; this one uses the cache

package/src/lib/repl-rewind.js

@@ -161,6 +161,64 @@ export function buildResumeRecap(messages, { previewChars = 160 } = {}) {
   return lines;
 }
 
+/**
+ * Snapshot the live conversation so a later `/rewind clear` can restore it
+ * (Claude-Code 2.1.191: "/rewind support for resuming a conversation from
+ * before /clear was run"). Drops the system prompt (index 0, re-added on
+ * restore) and copies the checkpoint marks. Returns null when there is nothing
+ * worth stashing (empty conversation) so a no-op /clear can't clobber an
+ * existing restorable snapshot.
+ *
+ * @param {Array} messages
+ * @param {Array} [marks]
+ * @returns {{messages:Array, marks:Array}|null}
+ */
+export function snapshotClearedConversation(messages, marks) {
+  const body = (messages || []).slice(1);
+  if (body.length === 0) return null;
+  return {
+    messages: body.slice(),
+    marks: Array.isArray(marks) ? marks.slice() : [],
+  };
+}
+
+/**
+ * Restore a conversation stashed by /clear, swapping it IN PLACE with the
+ * current (post-clear) conversation so the restore is itself undoable. Keeps
+ * `messages[0]` (the system prompt). Returns the new stash (the swapped-out
+ * current state, or null when it was empty) plus counts, or null when there is
+ * nothing to restore.
+ *
+ * @param {Array} messages  live conversation (index 0 = system prompt, kept)
+ * @param {Array} marks     live checkpoint marks array (mutated in place)
+ * @param {{messages:Array, marks:Array}|null} cleared  stash from /clear
+ * @returns {{restored:number, stashed:number, newCleared:{messages:Array,marks:Array}|null}|null}
+ */
+export function restoreClearedConversation(messages, marks, cleared) {
+  if (
+    !cleared ||
+    !Array.isArray(cleared.messages) ||
+    cleared.messages.length === 0
+  ) {
+    return null;
+  }
+  const curMsgs = (messages || []).slice(1);
+  const curMarks = Array.isArray(marks) ? marks.slice() : [];
+  // Replace messages[1..] with the stashed conversation (system prompt kept).
+  messages.splice(1, messages.length - 1, ...cleared.messages);
+  if (Array.isArray(marks)) {
+    marks.splice(0, marks.length, ...(cleared.marks || []));
+  }
+  const newCleared = curMsgs.length
+    ? { messages: curMsgs, marks: curMarks }
+    : null;
+  return {
+    restored: cleared.messages.length,
+    stashed: curMsgs.length,
+    newCleared,
+  };
+}
+
 /** Render the picker list (shared by /rewind and double-Esc). */
 export function renderTurnList(turns) {
   if (!turns.length) return "  (no user turns yet)";

package/src/lib/repl-vim.js

@@ -248,7 +248,7 @@ const bell = (state, patch = {}) => ({
  *                   with line/cursor; `submit:true` ⇒ run the line.
  */
 export function feedNormalKey(state, ch, key = {}) {
-  const s = { ...state, message: null };
+  const s = { ...state, message: null, notice: null };
   const line = s.line;
 
   // Enter → submit the line (parity with insert-mode Enter).
@@ -420,6 +420,18 @@ export function feedNormalKey(state, ch, key = {}) {
     case "t":
     case "T":
       return { ...s, awaitChar: { kind: ch }, count: String(count) };
+    case "/":
+    case "?":
+      // cc's NORMAL mode has no prompt-history search (readline owns history in
+      // INSERT mode). A user pressing `/` here most likely wants a slash
+      // command, so hint how to reach one instead of an opaque bell
+      // (Claude-Code 2.1.191: "hint how to reach slash commands").
+      return {
+        ...s,
+        count: "",
+        notice:
+          "NORMAL /: press i, then type /command (slash commands run in insert mode; history = ↑ or Ctrl-R)",
+      };
     default: {
       // Pure motions (h l 0 ^ $ w b e) and Backspace/arrows mapped to h/l.
       let motionCh = ch;

package/src/lib/settings-hooks.cjs

@@ -132,9 +132,18 @@ function compileMatcher(pattern) {
       /* fall through to wildcard */
     }
   }
-  if (pattern.includes("|")) {
-    const ms = pattern.split("|").map((p) => compileMatcher(p.trim()));
-    return (v) => ms.some((m) => m(v));
+  // OR-separated alternatives: pipe `Edit|Write` AND comma `Bash,PowerShell`
+  // (Claude-Code 2.1.191: comma-separated matchers silently never fired). Empty
+  // segments (trailing `Bash,` / `Edit|`) are dropped so they can't collapse to
+  // a match-everything matcher. Regex `/…/` matchers are handled above, so a
+  // comma inside `{1,3}` is never split here.
+  if (pattern.includes("|") || pattern.includes(",")) {
+    const ms = pattern
+      .split(/[|,]/)
+      .map((p) => p.trim())
+      .filter(Boolean)
+      .map((p) => compileMatcher(p));
+    return ms.length ? (v) => ms.some((m) => m(v)) : () => false;
   }
   const esc = pattern
     .replace(/[.+^${}()[\]\\]/g, "\\$&")

package/src/lib/slot-filler.js

@@ -8,6 +8,7 @@
  */
 
 import { EventEmitter } from "events";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /**
  * Required slots per intent type — must be filled before execution.
@@ -341,9 +342,9 @@ Keep values concise (single words or short strings).`;
       ]);
 
       const content = response?.message?.content || response?.content || "";
-      const jsonMatch = content.match(/\{[\s\S]*\}/);
-      if (jsonMatch) {
-        const parsed = JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(content, "{");
+      if (jsonText) {
+        const parsed = JSON.parse(jsonText);
         // Filter out null values
         const result = {};
         for (const [key, value] of Object.entries(parsed)) {

package/src/lib/sub-agent-context.js

@@ -74,6 +74,9 @@ export class SubAgentContext {
     this.inheritedContext = options.inheritedContext || null;
     this.allowedTools = options.allowedTools || null; // null = all
     this.depth = options.depth || 1; // nesting level (parent main loop = 0)
+    // Shared run-wide TOTAL-sub-agent counter (one object across the whole tree)
+    // so this sub-agent's own spawns draw from the same breadth pool.
+    this.subAgentBudget = options.subAgentBudget || null;
     this.cwd = options.cwd || process.cwd();
     this.status = "active";
     this.result = null;
@@ -252,6 +255,9 @@ export class SubAgentContext {
       cwd: this.cwd,
       // Nesting level: lets a nested spawn_sub_agent see — and cap — its depth.
       subAgentDepth: this.depth,
+      // Shared total-sub-agent counter so a nested spawn_sub_agent draws from
+      // (and is bounded by) the run's single breadth pool.
+      subAgentBudget: this.subAgentBudget,
       ...loopOptions,
     };
     if (this.iterationBudget) {

package/src/lib/web-fetch.js

@@ -7,6 +7,7 @@
 
 import http from "http";
 import https from "https";
+import { lookup as dnsLookup } from "dns";
 import { URL } from "url";
 
 const DEFAULT_MAX_BYTES = 2_000_000;
@@ -139,7 +140,46 @@ function stripTags(html) {
   return String(html).replace(/<[^>]+>/g, "");
 }
 
-async function _doRequest(parsed, { maxBytes, timeout, headers }) {
+/**
+ * A `lookup` for http(s).request that resolves the hostname and REJECTS the
+ * connection if any resolved IP is private/loopback/link-local. checkAllowed
+ * only inspects the URL's literal hostname, so a public-looking domain that
+ * DNS-resolves to an internal IP (e.g. 169.254.169.254 cloud metadata) would
+ * otherwise sail through — classic DNS-based SSRF. Because Node connects to the
+ * exact address this returns, it also closes the DNS-rebinding TOCTOU window.
+ * Returns a Node-style lookup fn; `allowPrivateHosts` opts out (same flag as
+ * checkAllowed).
+ */
+export function makeSafeLookup(allowPrivateHosts, deps = _deps) {
+  const lookup = deps.lookup || dnsLookup;
+  return (hostname, options, callback) => {
+    const cb = typeof options === "function" ? options : callback;
+    const opts = typeof options === "function" ? {} : options || {};
+    lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+      if (err) return cb(err);
+      const list = Array.isArray(addresses) ? addresses : [];
+      if (list.length === 0) {
+        return cb(new Error(`could not resolve host: ${hostname}`));
+      }
+      if (!allowPrivateHosts) {
+        for (const a of list) {
+          if (isPrivateHost(a.address)) {
+            return cb(
+              new Error(`private/loopback resolved IP blocked: ${a.address}`),
+            );
+          }
+        }
+      }
+      const chosen = list[0];
+      cb(null, chosen.address, chosen.family);
+    });
+  };
+}
+
+async function _doRequest(
+  parsed,
+  { maxBytes, timeout, headers, allowPrivateHosts },
+) {
   const lib = parsed.protocol === "https:" ? https : http;
   return new Promise((resolve, reject) => {
     const req = lib.request(
@@ -149,6 +189,10 @@ async function _doRequest(parsed, { maxBytes, timeout, headers }) {
         hostname: parsed.hostname,
         port: parsed.port || (parsed.protocol === "https:" ? 443 : 80),
         path: parsed.pathname + parsed.search,
+        // Resolve-and-check: reject the connection if the host resolves to a
+        // private IP (DNS-SSRF + rebinding guard). String-host check is in
+        // checkAllowed; this covers the resolved address.
+        lookup: makeSafeLookup(allowPrivateHosts),
         headers: {
           "User-Agent": "ChainlessChain-Agent/1.0",
           Accept: "*/*",
@@ -210,7 +254,12 @@ export async function webFetch(url, options = {}) {
   let redirects = 0;
   let response;
   while (true) {
-    response = await _doRequest(parsed, { maxBytes, timeout, headers });
+    response = await _doRequest(parsed, {
+      maxBytes,
+      timeout,
+      headers,
+      allowPrivateHosts: config.allowPrivateHosts,
+    });
     if (!response.redirect) break;
     if (++redirects > maxRedirects) {
       return { error: "too many redirects" };
@@ -250,7 +299,9 @@ export async function webFetch(url, options = {}) {
   };
 }
 
-export const _deps = { http, https };
+// `lookup` is injectable so tests can resolve a domain to a private IP without
+// real network; production uses the system resolver.
+export const _deps = { http, https, lookup: dnsLookup };
 
 // ===== V2 Surface: Web Fetch governance overlay (CLI v0.142.0) =====
 export const WFET_TARGET_MATURITY_V2 = Object.freeze({

package/src/lib/workflow-engine.js

@@ -37,6 +37,22 @@ export const TEMPLATE_TYPE = Object.freeze({
   TEST_SUITE: "test_suite",
 });
 
+/**
+ * Parse a JSON column from a DB row without throwing. A truncated write, a
+ * manual edit, or a schema-drift row would otherwise make `JSON.parse` throw and
+ * crash the whole operation — and for list/map callers, ONE corrupt row would
+ * hide every other workflow. On bad/missing JSON we return `fallback` so a
+ * single bad row degrades to an empty/null value instead of poisoning the call.
+ */
+export function _safeParse(json, fallback) {
+  if (json == null) return fallback;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return fallback;
+  }
+}
+
 /**
  * Ensure workflow tables exist in the database.
  */
@@ -183,7 +199,7 @@ export function getWorkflow(db, workflowId) {
     .prepare("SELECT * FROM workflows WHERE id = ?")
     .get(workflowId);
   if (!row) return null;
-  return { ...row, dag: JSON.parse(row.dag) };
+  return { ...row, dag: _safeParse(row.dag, null) };
 }
 
 /**
@@ -196,7 +212,7 @@ export function listWorkflows(db) {
     .all();
   return rows.map((row) => ({
     ...row,
-    dag: JSON.parse(row.dag),
+    dag: _safeParse(row.dag, null),
   }));
 }
 
@@ -222,6 +238,11 @@ export function executeWorkflow(db, workflowId, input = {}) {
   if (!workflow) {
     throw new Error(`Workflow not found: ${workflowId}`);
   }
+  if (!Array.isArray(workflow.dag) || workflow.dag.length === 0) {
+    // _safeParse yields null for a corrupt `dag` column — give a clear error
+    // instead of an opaque NPE in topologicalSort.
+    throw new Error(`Workflow ${workflowId} has a corrupt or empty DAG`);
+  }
 
   const execId = `exec-${crypto.randomBytes(8).toString("hex")}`;
   const stages = workflow.dag;
@@ -321,7 +342,7 @@ export function pauseExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "paused",
     timestamp: new Date().toISOString(),
@@ -354,7 +375,7 @@ export function resumeExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "resumed",
     timestamp: new Date().toISOString(),
@@ -387,7 +408,7 @@ export function rollbackExecution(db, executionId) {
     executionId,
   );
 
-  const log = JSON.parse(exec.log || "[]");
+  const log = _safeParse(exec.log, []);
   log.push({
     action: "rolled_back",
     timestamp: new Date().toISOString(),
@@ -415,7 +436,7 @@ export function getExecutionLog(db, executionId) {
     id: exec.id,
     workflowId: exec.workflow_id,
     status: exec.status,
-    log: JSON.parse(exec.log || "[]"),
+    log: _safeParse(exec.log, []),
     startedAt: exec.started_at,
     completedAt: exec.completed_at,
   };
@@ -688,7 +709,7 @@ export function createCheckpoint(db, executionId) {
     currentStage: exec.current_stage,
     capturedAt: new Date().toISOString(),
   };
-  const nodeStates = JSON.parse(exec.log || "[]");
+  const nodeStates = _safeParse(exec.log, []);
 
   db.prepare(
     `INSERT INTO workflow_checkpoints (id, execution_id, workflow_id, state_snapshot, node_states, created_at)
@@ -722,8 +743,8 @@ export function listCheckpoints(db, executionId) {
     id: row.id,
     executionId: row.execution_id,
     workflowId: row.workflow_id,
-    snapshot: JSON.parse(row.state_snapshot || "{}"),
-    nodeStates: JSON.parse(row.node_states || "[]"),
+    snapshot: _safeParse(row.state_snapshot, {}),
+    nodeStates: _safeParse(row.node_states, []),
     createdAt: row.created_at,
   }));
 }
@@ -750,8 +771,8 @@ export function rollbackToCheckpoint(db, executionId, checkpointId) {
     throw new Error(`Execution not found: ${executionId}`);
   }
 
-  const snapshot = JSON.parse(cp.state_snapshot || "{}");
-  const nodeStates = JSON.parse(cp.node_states || "[]");
+  const snapshot = _safeParse(cp.state_snapshot, {});
+  const nodeStates = _safeParse(cp.node_states, []);
 
   const restoredLog = [
     ...nodeStates,
@@ -792,6 +813,9 @@ export function setBreakpoint(db, workflowId, nodeId, condition = null) {
   if (!workflow) {
     throw new Error(`Workflow not found: ${workflowId}`);
   }
+  if (!Array.isArray(workflow.dag)) {
+    throw new Error(`Workflow ${workflowId} has a corrupt DAG`);
+  }
   const nodeExists = workflow.dag.some((s) => s.id === nodeId);
   if (!nodeExists) {
     throw new Error(`Node ${nodeId} not in workflow ${workflowId}`);