chainlesschain 0.162.123 → 0.162.124

package/src/harness/worktree-isolator.js

@@ -13,7 +13,9 @@ import { resolve } from "node:path";
 import {
   isGitRepo,
   gitExec,
+  gitExecArgs,
   assertSafeGitRef,
+  assertSafeGitPath,
 } from "../lib/git-integration.js";
 
 const WORKTREE_DIR = ".worktrees";
@@ -167,6 +169,7 @@ export function diffWorktree(repoDir, branchName, options = {}) {
   if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const base = options.baseBranch || "HEAD";
   const filePath = options.filePath || null;
+  if (filePath) assertSafeGitPath(filePath, "file path");
   const fileArg = filePath ? ` -- "${filePath}"` : "";
   const statOutput = gitExec(
     `diff ${base}...${branchName} --stat --numstat${fileArg}`,
@@ -223,14 +226,13 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
       const msg =
         options.message ||
         `feat: merge agent work from ${branchName} (squashed)`;
-      gitExec(`commit -m "${msg.replace(/"/g, '\\"')}"`, repoDir);
+      // Free-text message → argv (no shell) so `$()`/backticks/quotes in it
+      // can't inject a command (the old `-m "…"` only escaped `"`).
+      gitExecArgs(["commit", "-m", msg], repoDir);
     } else {
       const msg =
         options.message || `Merge branch '${branchName}' (agent task)`;
-      gitExec(
-        `merge ${branchName} --no-edit -m "${msg.replace(/"/g, '\\"')}"`,
-        repoDir,
-      );
+      gitExecArgs(["merge", branchName, "--no-edit", "-m", msg], repoDir);
     }
 
     if (deleteBranch) {
@@ -393,6 +395,7 @@ export function applyWorktreeAutomationCandidate(
   const conflictType = options.conflictType || null;
   const baseBranch = _resolveBaseBranchForMerge(repoDir, options.baseBranch);
 
+  if (filePath) assertSafeGitPath(filePath, "file path");
   if (!filePath) {
     throw new Error("filePath is required");
   }
@@ -514,8 +517,10 @@ export function worktreeLog(repoDir, branchName, baseBranch = "HEAD") {
 
 function _fileStatus(repoDir, base, branch, filePath) {
   try {
-    const output = gitExec(
-      `diff ${base}...${branch} --name-status -- "${filePath}"`,
+    // filePath here comes from git's conflict output (a tracked file name);
+    // pass it via argv so an exotic / maliciously-named file can't inject.
+    const output = gitExecArgs(
+      ["diff", `${base}...${branch}`, "--name-status", "--", filePath],
       repoDir,
     );
     const status = output.trim().charAt(0);
@@ -603,7 +608,10 @@ function _buildConflictSummary(repoDir, filePath, branchName) {
 
 function _conflictStatusCode(repoDir, filePath) {
   try {
-    const output = gitExec(`status --porcelain -- "${filePath}"`, repoDir);
+    const output = gitExecArgs(
+      ["status", "--porcelain", "--", filePath],
+      repoDir,
+    );
     const firstLine = output.split("\n").find((line) => line.trim());
     return firstLine ? firstLine.slice(0, 2) : "UU";
   } catch (_e) {
@@ -779,7 +787,10 @@ function _buildDiffPreview(repoDir, filePath, branchName) {
   };
 
   try {
-    const diff = gitExec(`diff HEAD...${branchName} -- "${filePath}"`, repoDir);
+    const diff = gitExecArgs(
+      ["diff", `HEAD...${branchName}`, "--", filePath],
+      repoDir,
+    );
     preview.snippet =
       diff.length > 2000
         ? `${diff.slice(0, 2000)}\n... [diff truncated]`

package/src/lib/agent-core.js

@@ -3,8 +3,11 @@ export {
   AGENT_TOOLS,
   AGENT_TOOL_REGISTRY,
   MAX_SUB_AGENT_DEPTH,
+  MAX_SUB_AGENTS_PER_RUN,
   MAX_TOOL_RESULT_CHARS,
   capToolResultString,
+  safeStringifyToolResult,
+  tokenizeShellWords,
   reloadSkills,
   getAgentToolDefinitions,
   getAgentToolDescriptors,

package/src/lib/autonomous-agent.js

@@ -8,6 +8,7 @@
  */
 
 import { EventEmitter } from "events";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 // Exported for test injection
 export const _deps = {
@@ -471,10 +472,10 @@ Reply with a JSON object: { "action": "retry|add_step|skip", "newParams": {...},
 
   _parseSteps(text) {
     try {
-      // Extract JSON array from response
-      const match = text.match(/\[[\s\S]*\]/);
-      if (match) {
-        return JSON.parse(match[0]);
+      // Extract the first balanced JSON array from the response
+      const jsonText = firstBalancedJson(text, "[");
+      if (jsonText) {
+        return JSON.parse(jsonText);
       }
     } catch (_err) {
       // Parse failure
@@ -484,8 +485,8 @@ Reply with a JSON object: { "action": "retry|add_step|skip", "newParams": {...},
 
   _parseJSON(text) {
     try {
-      const match = text.match(/\{[\s\S]*\}/);
-      if (match) return JSON.parse(match[0]);
+      const jsonText = firstBalancedJson(text, "{");
+      if (jsonText) return JSON.parse(jsonText);
     } catch (_err) {
       // Parse failure
     }

package/src/lib/chat-intent-service.js

@@ -18,6 +18,7 @@
  */
 
 import { chatWithStreaming, chatStream } from "./chat-core.js";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 const DEFAULT_INTENT_TIMEOUT_MS = 15000;
 
@@ -76,8 +77,9 @@ function extractJson(content) {
   if (fenced) return fenced[1].trim();
   const generic = content.match(/```\s*([\s\S]*?)```/);
   if (generic) return generic[1].trim();
-  const bare = content.match(/\{[\s\S]*\}/);
-  return bare ? bare[0] : null;
+  // Balanced extraction stops at the first complete object instead of the old
+  // greedy /\{[\s\S]*\}/, which over-captured trailing prose with a stray }.
+  return firstBalancedJson(content, "{");
 }
 
 /**

package/src/lib/checkpoint-store.js

@@ -256,6 +256,29 @@ export function createCheckpoint(cwd = process.cwd(), opts = {}) {
       /* non-critical */
     }
 
+    // Bound the session's checkpoint history when asked. Auto-checkpointing
+    // (one ref per mutating tool) passes a cap so a long agentic run can't
+    // accumulate unbounded refs — which also keeps nextId's per-create
+    // for-each-ref scan bounded. Best-effort: pruning never fails the
+    // checkpoint, and the dropped commit objects stay reachable via newer
+    // checkpoints' parent chain (only addressability by id is lost for the
+    // oldest entries). Manual `cc checkpoint create` omits the cap → unbounded.
+    if (Number.isFinite(opts.maxPerSession) && opts.maxPerSession > 0) {
+      try {
+        const rows = listRefs(root, session); // oldest-first (creatordate)
+        const excess = rows.length - opts.maxPerSession;
+        for (let i = 0; i < excess; i++) {
+          try {
+            git(["update-ref", "-d", rows[i].ref], { cwd: root });
+          } catch {
+            /* best-effort — a failed prune never affects the new checkpoint */
+          }
+        }
+      } catch {
+        /* pruning is entirely best-effort */
+      }
+    }
+
     return { id, ref, commit, tree, parent, label, session, createdAt, files };
   } finally {
     rmQuiet(tmpIndex);

package/src/lib/credential-guard.js

@@ -51,6 +51,12 @@ const CREDENTIAL_BASENAMES = new Set([
   "id_dsa",
   "id_ecdsa",
   "id_ed25519", // private SSH keys (the `.pub` siblings have a different basename)
+  "id_ecdsa_sk",
+  "id_ed25519_sk", // FIDO/security-key SSH keys
+  ".htpasswd", // web-server basic-auth hashes
+  "kubeconfig", // bare KUBECONFIG file (the ~/.kube/config form is matched below)
+  ".terraformrc", // Terraform registry/API tokens
+  "terraform.rc",
 ]);
 
 // Extensions whose BYTES are the secret (private keys / cert bundles / keyrings).
@@ -67,6 +73,7 @@ const CREDENTIAL_PATH_RE = [
   /[\\/]\.docker[\\/]config\.json$/i,
   /[\\/]\.config[\\/]gh[\\/]hosts\.yml$/i, // GitHub CLI OAuth token
   /[\\/]\.gnupg[\\/]/i, // GPG keyring directory
+  /service[-_]account[^\\/]*\.json$/i, // GCP service-account key JSON
 ];
 
 // secret(s).{json,yml,yaml,env,txt}

package/src/lib/git-integration.js

@@ -2,7 +2,7 @@
  * Git integration — wraps system git commands for knowledge base versioning.
  */
 
-import { execSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
 import { existsSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
 
@@ -41,6 +41,62 @@ export function assertSafeGitRef(ref, label = "git ref") {
   }
 }
 
+/**
+ * Validate a repo-relative file path before it is interpolated into a shell git
+ * command (e.g. `diff … -- "${filePath}"`). Double-quoting does NOT neutralize
+ * `$()` / backticks / a closing `"`, so an unsanitized path from a WS frame is a
+ * shell-injection vector. Allow only ordinary path characters (no shell
+ * metacharacters), reject absolute paths, a leading `-` (flag injection), and
+ * `..` (traversal). Exported for reuse + tests.
+ *
+ * @param {string} p
+ * @param {string} [label="file path"]
+ */
+export function assertSafeGitPath(p, label = "file path") {
+  if (typeof p !== "string" || p.length === 0) {
+    throw new Error(`Invalid ${label}: expected a non-empty string`);
+  }
+  if (
+    !/^[A-Za-z0-9._/+@=, -]+$/.test(p) || // safe path chars only — no shell metachars
+    p.startsWith("-") || // no flag injection (e.g. `-- --output=…`)
+    p.startsWith("/") || // no absolute path (posix)
+    /^[A-Za-z]:/.test(p) || // no absolute path (windows drive)
+    p.includes("..") // no traversal / range tricks
+  ) {
+    throw new Error(`Unsafe ${label}: ${JSON.stringify(p)}`);
+  }
+}
+
+/**
+ * Run git with an ARGV array (no shell) — for commands that carry free-text the
+ * caller can't allowlist (a commit / merge message). spawnSync passes each arg
+ * verbatim, so `$()`, backticks, quotes, and `;` in the message are inert
+ * instead of being interpreted by a shell as they would be through `gitExec`.
+ * Throws git's stderr on failure, mirroring `gitExec`'s contract.
+ *
+ * @param {string[]} args
+ * @param {string} cwd
+ * @param {object} [opts] { input }
+ * @returns {string} trimmed stdout
+ */
+export function gitExecArgs(args, cwd, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    input: opts.input,
+  });
+  if (res.error) throw res.error;
+  if (res.status !== 0) {
+    const stderr = (res.stderr || res.stdout || "").toString().trim();
+    throw new Error(
+      stderr || `git ${args.join(" ")} failed (exit ${res.status})`,
+    );
+  }
+  return (res.stdout || "").toString().trim();
+}
+
 /**
  * Run a git command and return stdout.
  */

package/src/lib/hook-runner.cjs

@@ -107,7 +107,17 @@ function tryParseDecision(stdout) {
  *            nonBlockingError?:boolean, error?:string }}
  */
 function runCommandHook(command, input = {}, opts = {}) {
-  const { timeout = 60000, cwd, event } = opts;
+  const { cwd, event } = opts;
+  // spawnSync is SYNCHRONOUS — it blocks the whole agent until the hook returns
+  // or its timeout fires. Node treats a 0/undefined timeout as UNLIMITED, so a
+  // missing, zero, NaN, or negative value (e.g. a malformed settings.json
+  // `timeout`) would let a hung hook freeze the agent forever. Guarantee a
+  // positive, bounded timeout regardless of the caller's value (already in ms).
+  const _rawTimeout = Number(opts.timeout);
+  const timeout =
+    Number.isFinite(_rawTimeout) && _rawTimeout > 0
+      ? Math.min(_rawTimeout, 600000)
+      : 60000;
   if (!command) {
     return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
   }

package/src/lib/interactive-planner.js

@@ -9,6 +9,7 @@
 
 import { EventEmitter } from "events";
 import { createHash } from "crypto";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /**
  * Plan session statuses
@@ -345,12 +346,12 @@ Keep plans concise (3-8 steps). Use appropriate tools for each step.`;
     ]);
 
     const content = response?.message?.content || response?.content || "";
-    const jsonMatch = content.match(/\{[\s\S]*\}/);
-    if (!jsonMatch) {
+    const jsonText = firstBalancedJson(content, "{");
+    if (!jsonText) {
       throw new Error("Failed to parse plan from LLM response");
     }
 
-    return JSON.parse(jsonMatch[0]);
+    return JSON.parse(jsonText);
   }
 
   /**

package/src/lib/json-schema-output.js

@@ -80,6 +80,48 @@ export function validateAgainstSchema(value, schema, path = "$") {
   return errors;
 }
 
+/**
+ * Return the first *balanced* JSON object/array substring in `text`, honoring
+ * string literals so braces inside strings don't throw off the depth count.
+ *
+ * Unlike a greedy `/\{[\s\S]*\}/` match (which spans to the LAST bracket and
+ * over-captures trailing prose or a second object — making JSON.parse throw),
+ * this stops at the first complete top-level value.
+ *
+ * @param {string} text
+ * @param {"{"|"["} [only] restrict to object- or array-openers when set
+ * @returns {string|null} the balanced substring, or null if none is found
+ */
+export function firstBalancedJson(text, only) {
+  const s = String(text || "");
+  for (let i = 0; i < s.length; i++) {
+    const open = s[i];
+    if (open !== "{" && open !== "[") continue;
+    if (only && open !== only) continue;
+    const close = open === "{" ? "}" : "]";
+    let depth = 0;
+    let inStr = false;
+    let esc = false;
+    for (let j = i; j < s.length; j++) {
+      const c = s[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === "\\") esc = true;
+        else if (c === '"') inStr = false;
+        continue;
+      }
+      if (c === '"') inStr = true;
+      else if (c === open) depth++;
+      else if (c === close) {
+        depth--;
+        if (depth === 0) return s.slice(i, j + 1);
+      }
+    }
+    // opener at i never closed — try the next opener
+  }
+  return null;
+}
+
 /** Pull a JSON payload out of an LLM reply (bare, fenced, or embedded). */
 export function extractJsonPayload(text) {
   const raw = String(text || "").trim();
@@ -87,6 +129,11 @@ export function extractJsonPayload(text) {
   tries.push(raw);
   const fence = /```(?:json)?\s*([\s\S]*?)```/i.exec(raw);
   if (fence) tries.push(fence[1].trim());
+  // Prefer a balanced run (stops at the first complete value) over the greedy
+  // first-bracket..last-bracket slice below, which over-captures on trailing
+  // prose or a second object.
+  const balanced = firstBalancedJson(raw);
+  if (balanced) tries.push(balanced);
   const firstObj = raw.indexOf("{");
   const lastObj = raw.lastIndexOf("}");
   if (firstObj !== -1 && lastObj > firstObj)

package/src/lib/learning/reflection-engine.js

@@ -12,6 +12,7 @@
  */
 
 import { extractToolNames } from "./skill-synthesizer.js";
+import { firstBalancedJson } from "../json-schema-output.js";
 
 // ── _deps for test injection ────────────────────────
 const _deps = {
@@ -268,9 +269,9 @@ export class ReflectionEngine {
     try {
       const messages = buildReflectionPrompt(reportData);
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-improver.js

@@ -12,6 +12,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -374,9 +375,9 @@ export class SkillImprover {
     if (!this.llmChat) return null;
     try {
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-synthesizer.js

@@ -17,6 +17,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -258,9 +259,9 @@ export class SkillSynthesizer {
 
     try {
       // Try to parse JSON from response
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }