chainlesschain 0.162.124 → 0.162.126

package/src/lib/sandbox-v2.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 import { createRequire } from "module";
 
 const _require = createRequire(import.meta.url);
@@ -429,9 +430,9 @@ export function getSandbox(db, sandboxId) {
     id: row.id,
     agentId: row.agent_id,
     status: row.status,
-    permissions: JSON.parse(row.permissions || "{}"),
-    quota: JSON.parse(row.quota || "{}"),
-    resourceUsage: JSON.parse(row.resource_usage || "{}"),
+    permissions: safeJsonParse(row.permissions, {}),
+    quota: safeJsonParse(row.quota, {}),
+    resourceUsage: safeJsonParse(row.resource_usage, {}),
     createdAt: row.created_at,
   };
 }
@@ -609,9 +610,9 @@ export function restoreFromDb(db) {
       id: row.id,
       agentId: row.agent_id,
       status: row.status || "active",
-      permissions: JSON.parse(row.permissions || "{}"),
-      quota: JSON.parse(row.quota || "{}"),
-      resourceUsage: JSON.parse(row.resource_usage || "{}"),
+      permissions: safeJsonParse(row.permissions, {}),
+      quota: safeJsonParse(row.quota, {}),
+      resourceUsage: safeJsonParse(row.resource_usage, {}),
       createdAt: row.created_at || new Date(now).toISOString(),
       policy,
       createdAtMs: row.created_at_ms || now,

package/src/lib/search-command.js

@@ -0,0 +1,65 @@
+/**
+ * search-command — build the shell command for the agent `search_files` tool
+ * with the model/user-supplied pattern SAFELY embedded.
+ *
+ * The pattern flows into execSync (a real shell), so a raw interpolation
+ * (`grep -i "${pattern}"`) is a command-injection vector: a pattern like
+ * `x" ; curl evil ; "` runs arbitrary commands — and `search_files` is
+ * read-only + NOT confirm-gated, so it would bypass the `run_shell`
+ * ApprovalGate + credential guards entirely (reachable via prompt-injection).
+ * Raw interpolation is also semantically wrong: the shell would expand `$HOME`,
+ * backticks, globs, etc. in the pattern instead of searching for them literally.
+ *
+ * Fix: quote the pattern so every shell metacharacter is inert. The emitted
+ * commands (and therefore the output format `_ingestSearchOutput` parses) are
+ * otherwise unchanged.
+ */
+
+/** POSIX single-quote: wrap in '…' and escape any embedded ' as '\''. Single
+ *  quotes neutralize EVERY shell metacharacter, so nothing inside is expanded
+ *  or can break out. */
+export function shquotePosix(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * Build `{ cmd }` for a search, or `{ error }` when the pattern can't be made
+ * safe on the target platform.
+ *
+ * @param {object} a
+ * @param {string} a.pattern        the raw search pattern
+ * @param {boolean} a.isContent     content search (grep/findstr) vs filename
+ * @param {string} [a.platform=process.platform]
+ * @returns {{cmd:string}|{error:string}}
+ */
+export function buildSearchCommand({
+  pattern,
+  isContent,
+  platform = process.platform,
+}) {
+  const pat = String(pattern ?? "");
+
+  if (platform === "win32") {
+    // cmd.exe has no reliable way to escape an embedded double-quote, and the
+    // pattern is double-quoted below — so reject a literal `"` (rare in a search
+    // pattern; run_shell handles complex cases). Every OTHER metacharacter
+    // (& | < > ^ ( )) is literal INSIDE cmd double quotes, so quoting the
+    // pattern closes the injection while leaving the redirect (2>NUL) outside.
+    if (pat.includes('"')) {
+      return {
+        error: 'search pattern may not contain a double-quote (") on Windows',
+      };
+    }
+    return {
+      cmd: isContent
+        ? `findstr /s /i /n "${pat}" *`
+        : `dir /s /b "*${pat}*" 2>NUL`,
+    };
+  }
+
+  return {
+    cmd: isContent
+      ? `grep -r -l -i ${shquotePosix(pat)} . --include="*" 2>/dev/null | head -20`
+      : `find . -name ${shquotePosix(`*${pat}*`)} -type f 2>/dev/null | head -20`,
+  };
+}

package/src/lib/session-insights.js

@@ -31,7 +31,7 @@ function isToolError(event) {
   const r = event?.data?.result;
   return Boolean(
     event?.data?.error ||
-      (r && typeof r === "object" && (r.error || r.is_error || r.isError)),
+    (r && typeof r === "object" && (r.error || r.is_error || r.isError)),
   );
 }
 
@@ -46,11 +46,18 @@ export function analyzeSession(events, sessionId) {
   const evs = Array.isArray(events) ? events : [];
   const start = evs.find((e) => e && e.type === "session_start");
 
-  const stamps = evs
-    .map((e) => Number(e?.timestamp))
-    .filter((t) => Number.isFinite(t) && t > 0);
-  const startedAt = stamps.length ? Math.min(...stamps) : null;
-  const endedAt = stamps.length ? Math.max(...stamps) : null;
+  // Single-pass min/max (NOT Math.min(...stamps)): spreading a per-event array
+  // throws RangeError "Maximum call stack size exceeded" past ~130k elements, so
+  // a long session would crash `cc insights`. A reduce-style scan is O(n) and
+  // size-independent.
+  let startedAt = null;
+  let endedAt = null;
+  for (const e of evs) {
+    const t = Number(e?.timestamp);
+    if (!Number.isFinite(t) || t <= 0) continue;
+    if (startedAt == null || t < startedAt) startedAt = t;
+    if (endedAt == null || t > endedAt) endedAt = t;
+  }
   const durationMs =
     startedAt != null && endedAt != null ? endedAt - startedAt : 0;
 

package/src/lib/session-usage.js

@@ -13,6 +13,12 @@ import {
   listJsonlSessions,
 } from "../harness/jsonl-session-store.js";
 
+// Injectable disk seams (tests override). readEvents skips malformed JSON lines
+// but does NOT guard readFileSync, so an unreadable session file (EACCES /
+// EISDIR / a Windows lock / an ENOENT race after existsSync) throws — which
+// allSessionsUsage tolerates per-session below.
+export const _deps = { readEvents, listJsonlSessions };
+
 const USAGE_EVENT_TYPES = new Set([
   "token_usage",
   "assistant_message",
@@ -138,7 +144,7 @@ export function aggregateUsage(events) {
  * Roll up usage for a single JSONL session.
  */
 export function sessionUsage(sessionId) {
-  const events = readEvents(sessionId);
+  const events = _deps.readEvents(sessionId);
   const agg = aggregateUsage(events);
   return { sessionId, ...agg };
 }
@@ -147,8 +153,19 @@ export function sessionUsage(sessionId) {
  * Roll up usage across every JSONL session on disk.
  */
 export function allSessionsUsage({ limit = 1000 } = {}) {
-  const sessions = listJsonlSessions({ limit });
-  const perSession = sessions.map((s) => sessionUsage(s.id));
+  const sessions = _deps.listJsonlSessions({ limit });
+  // One unreadable / corrupt session file (sessionUsage → readEvents →
+  // readFileSync can throw on EACCES/EISDIR/lock) must NOT abort the whole
+  // roll-up. Skip the failed session and report how many were skipped.
+  const perSession = [];
+  let skipped = 0;
+  for (const s of sessions || []) {
+    try {
+      perSession.push(sessionUsage(s.id));
+    } catch {
+      skipped++;
+    }
+  }
 
   const total = {
     inputTokens: 0,
@@ -191,6 +208,7 @@ export function allSessionsUsage({ limit = 1000 } = {}) {
 
   return {
     sessions: perSession,
+    skipped,
     total,
     byModel: Array.from(byKey.values()).sort(
       (a, b) => b.totalTokens - a.totalTokens,

package/src/lib/settings-hooks.cjs

@@ -27,6 +27,7 @@
 const path = require("node:path");
 const os = require("node:os");
 const fsDefault = require("node:fs");
+const crypto = require("node:crypto");
 const { SUGGEST_UMBRELLA } = require("./permission-rules.cjs");
 const { projectRootBase } = require("./project-root.cjs");
 
@@ -179,8 +180,140 @@ function collectHooks(hooksBlock, event, toolName) {
   return out;
 }
 
+/**
+ * Every command-hook in a parsed settings object, tagged with the event +
+ * matcher it fires under (so a fingerprint reflects WHEN it runs, not just the
+ * command string). Mirrors loadHooks' command-hook filter.
+ */
+function extractCommandHooks(data) {
+  const out = [];
+  const block =
+    data && data.hooks && typeof data.hooks === "object" ? data.hooks : null;
+  if (!block) return out;
+  for (const [event, groups] of Object.entries(block)) {
+    if (!Array.isArray(groups)) continue;
+    for (const g of groups) {
+      if (!g || typeof g !== "object" || !Array.isArray(g.hooks)) continue;
+      for (const h of g.hooks) {
+        if (h && h.type === "command" && h.command) {
+          out.push({
+            event,
+            matcher: g.matcher ?? null,
+            command: String(h.command),
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** `~/.chainlesschain/hook-trust.json` — remembered first-run acknowledgments. */
+function hookTrustStorePath() {
+  return path.join(_deps.homedir(), ".chainlesschain", "hook-trust.json");
+}
+
+function readHookTrustStore() {
+  try {
+    const f = hookTrustStorePath();
+    if (!_deps.fs.existsSync(f)) return {};
+    const parsed = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {}; // unreadable store → treat as nothing acknowledged
+  }
+}
+
+function writeHookTrustStore(store) {
+  try {
+    const f = hookTrustStorePath();
+    _deps.fs.mkdirSync(path.dirname(f), { recursive: true });
+    _deps.fs.writeFileSync(f, JSON.stringify(store, null, 2), "utf-8");
+    return true;
+  } catch {
+    return false; // best-effort — a failed write just re-shows the notice
+  }
+}
+
+/**
+ * First-run trust notice for project-sourced settings.json hooks (which run
+ * shell). The user's own `~/.claude/settings.json` and an explicit `--settings`
+ * file are trusted; only the project's `.claude/settings{,.local}.json` (project
+ * root + cwd) carry the cloned-repo auto-execution risk that Claude-Code 2.1.195
+ * gated ("untrusted project config must require explicit consent").
+ *
+ * Returns a one-line notice (and records an acknowledgment hash) the FIRST time
+ * a project's shell-running hooks are seen — and again only if those hooks
+ * change. Returns null when there are no project hooks, the hooks are unchanged
+ * since last acknowledged, or the notice is disabled (`CC_HOOK_TRUST_NOTICE=0`,
+ * or hooks themselves are off via `CC_SETTINGS_HOOKS=0`). Best-effort: a failed
+ * store write still returns the notice (shown again next run) rather than
+ * throwing — it must never abort agent startup.
+ *
+ * @returns {string|null}
+ */
+function projectHookTrustNotice({ cwd = process.cwd(), settingsFile } = {}) {
+  if (process.env.CC_HOOK_TRUST_NOTICE === "0") return null;
+  if (process.env.CC_SETTINGS_HOOKS === "0") return null; // hooks won't run anyway
+  const home = path.join(_deps.homedir(), ".claude", "settings.json");
+  const explicit = settingsFile ? path.resolve(cwd, settingsFile) : null;
+  const trusted = new Set([home, explicit].filter(Boolean));
+  const seen = new Set();
+  const projectFiles = settingsFiles(cwd, settingsFile).filter((f) => {
+    if (trusted.has(f) || seen.has(f)) return false;
+    seen.add(f);
+    return true;
+  });
+
+  const entries = [];
+  const contributing = [];
+  for (const f of projectFiles) {
+    let data;
+    try {
+      if (!_deps.fs.existsSync(f)) continue;
+      data = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    } catch {
+      continue; // malformed JSON is surfaced by loadHooks' own warn path
+    }
+    const cmds = extractCommandHooks(data);
+    if (cmds.length) {
+      entries.push(...cmds);
+      contributing.push(f);
+    }
+  }
+  if (entries.length === 0) return null;
+
+  const fingerprint = entries
+    .map((e) => `${e.event}${e.matcher ?? ""}${e.command}`)
+    .sort();
+  const hash = crypto
+    .createHash("sha256")
+    .update(JSON.stringify(fingerprint))
+    .digest("hex");
+  const key = projectRootBase(cwd, { fs: _deps.fs, path }) || cwd;
+
+  const store = readHookTrustStore();
+  if (store[key] && store[key].hash === hash) return null; // already acknowledged
+  store[key] = {
+    hash,
+    files: contributing,
+    count: entries.length,
+    at: new Date().toISOString(),
+  };
+  writeHookTrustStore(store); // best-effort acknowledgment
+
+  const fileList = contributing.map((f) => `    ${f}`).join("\n");
+  return (
+    `⚠ This project's .claude/settings.json defines ${entries.length} ` +
+    `shell-running hook(s) that auto-run on agent activity:\n${fileList}\n` +
+    `  Review them before trusting this repo. Shown once per change; ` +
+    `disable all hooks with CC_SETTINGS_HOOKS=0.`
+  );
+}
+
 module.exports = {
   loadHooks,
+  projectHookTrustNotice,
   collectHooks,
   compileMatcher,
   umbrellaFor,

package/src/lib/settings-loader.cjs

@@ -240,12 +240,16 @@ function loadSettingsConfig(opts = {}) {
 }
 
 /**
- * Read a top-level boolean setting across the layered `.claude/settings.json`
- * files (last/closest layer wins — same precedence as the permission rules).
- * Non-boolean values are ignored. Returns `undefined` when no layer sets it, so
- * a caller can distinguish "unset" from an explicit `false`.
+ * Read a boolean setting across the layered `.claude/settings.json` files
+ * (last/closest layer wins — same precedence as the permission rules). The key
+ * may be a dotted path for nested settings (e.g. `autoMode.classifyAllShell`);
+ * a plain key walks a one-element path, so existing callers are unaffected.
+ * Non-boolean values (and partial paths through a non-object) are ignored.
+ * Returns `undefined` when no layer sets it, so a caller can distinguish
+ * "unset" from an explicit `false`.
  *
- * @param {string} key  top-level settings key (e.g. "respondToBashCommands")
+ * @param {string} key  settings key or dotted path (e.g. "respondToBashCommands"
+ *                       or "autoMode.classifyAllShell")
  * @param {object} [opts]
  * @param {string} [opts.cwd=process.cwd()]
  * @param {string} [opts.settingsFile]
@@ -254,11 +258,16 @@ function loadSettingsConfig(opts = {}) {
  */
 function readBooleanSetting(key, opts = {}) {
   const cwd = opts.cwd || process.cwd();
+  const parts = String(key).split(".");
   let value;
   for (const file of settingsPaths(cwd, opts.settingsFile)) {
     const data = readSettingsFile(file, { onWarn: opts.onWarn });
-    if (data && typeof data[key] === "boolean") {
-      value = data[key]; // last (closest) layer wins
+    let node = data;
+    for (const p of parts) {
+      node = node && typeof node === "object" ? node[p] : undefined;
+    }
+    if (typeof node === "boolean") {
+      value = node; // last (closest) layer wins
     }
   }
   return value;

package/src/lib/social-graph.js

@@ -22,6 +22,7 @@
  */
 
 import { EventEmitter } from "events";
+import { safeJsonParse } from "./safe-json.js";
 
 /* ── Edge types ────────────────────────────────────────────── */
 
@@ -325,7 +326,8 @@ export function loadFromDb(db) {
     )
     .all();
   for (const row of rows) {
-    const metadata = row.metadata ? JSON.parse(row.metadata) : null;
+    // A single corrupt metadata cell must not crash the whole graph load.
+    const metadata = safeJsonParse(row.metadata, null);
     // Hydrate without re-emitting events (bulk load).
     _hydrateEdge({
       sourceDid: row.source_did,

package/src/lib/status-line.cjs

@@ -48,7 +48,10 @@ function loadStatusLineConfig({ cwd = process.cwd(), settingsFile } = {}) {
       cfg = {
         type: sl.type || "command",
         command: sl.command,
-        padding: Number(sl.padding) || 0,
+        // Clamp to [0,80]: a non-finite/huge padding (e.g. "1e999" → Infinity,
+        // or 999999999) would make " ".repeat(padding) at render time throw
+        // RangeError on every REPL prompt, bricking the status line.
+        padding: Math.max(0, Math.min(80, Math.floor(Number(sl.padding)) || 0)),
       };
     } else if (sl === false || sl === null) {
       cfg = null; // an explicit disable in a higher layer wins

package/src/lib/stream-retry.js

@@ -18,6 +18,33 @@ import { isAbortError } from "./abort-utils.js";
 export const STREAM_RETRY_MAX = 2;
 export const STREAM_RETRY_BASE_MS = 400;
 
+/**
+ * Hard ceiling on the *configurable* retry budget (Claude-Code 2.1.186:
+ * "CLAUDE_CODE_MAX_RETRIES capped at 15") — keeps a stray huge value from
+ * turning a dead endpoint into a multi-minute exponential-backoff hang.
+ */
+export const STREAM_RETRY_MAX_CAP = 15;
+
+/**
+ * Resolve the streaming-retry budget. Users can raise (or lower) the default
+ * via `CC_MAX_RETRIES` (native) or `CLAUDE_CODE_MAX_RETRIES` (Claude-Code
+ * parity); the value is clamped to `[0, STREAM_RETRY_MAX_CAP]`. Unset / blank /
+ * non-numeric falls back to the default `STREAM_RETRY_MAX`; a negative value
+ * clamps to 0 (retries disabled). `CC_MAX_RETRIES` wins when both are set.
+ *
+ * @param {Record<string,string|undefined>} [env=process.env]
+ * @returns {number}
+ */
+export function resolveStreamRetryMax(env = process.env) {
+  const raw = env.CC_MAX_RETRIES ?? env.CLAUDE_CODE_MAX_RETRIES;
+  if (raw == null || String(raw).trim() === "") return STREAM_RETRY_MAX;
+  const n = Number.parseInt(String(raw).trim(), 10);
+  if (!Number.isFinite(n)) return STREAM_RETRY_MAX;
+  if (n < 0) return 0;
+  if (n > STREAM_RETRY_MAX_CAP) return STREAM_RETRY_MAX_CAP;
+  return n;
+}
+
 /**
  * Is this error from a streaming chat request a transient API CONNECTION drop
  * that is safe to retry? True only for genuine network failures (reset /

package/src/lib/sub-agent-context.js

@@ -365,6 +365,15 @@ export class SubAgentContext {
       return this.result;
     }
 
+    // If the loop already force-completed (abort signal or token budget),
+    // preserve that result. The normal completion below would otherwise
+    // overwrite the cancellation / budget marker with a plain summary of
+    // whatever was streamed so far — the parent agent would then mistake a
+    // truncated/cancelled run for a clean one.
+    if (this.status !== "active") {
+      return this.result;
+    }
+
     // Summarize the result
     const summary = this.summarize(lastContent);
 

package/src/lib/turn-context.js

@@ -30,6 +30,9 @@ function _git(cmd, cwd) {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 1500,
+        // `status --porcelain` on a dirty repo with many files can exceed the
+        // 1 MB execSync default → ENOBUFS → null → "(clean)" misreport below.
+        maxBuffer: 16 * 1024 * 1024,
       })
       .trim();
   } catch (_e) {
@@ -61,11 +64,18 @@ export function buildTurnContext({
   if (branch) {
     const head = _git("rev-parse --short HEAD", cwd);
     const status = _git("status --porcelain", cwd);
-    const dirty = status && status.length > 0;
-    const fileCount = dirty ? status.split("\n").filter(Boolean).length : 0;
-    lines.push(
-      `- git: ${branch}@${head || "?"}${dirty ? ` (${fileCount} uncommitted)` : " (clean)"}`,
-    );
+    // Distinguish "command failed" (null — timeout / huge output) from "" (truly
+    // clean): the old `status && …` reported a repo as "(clean)" whenever status
+    // couldn't be determined, which is a wrong signal to the model.
+    let stateLabel;
+    if (status === null) {
+      stateLabel = " (status unknown)";
+    } else if (status.length > 0) {
+      stateLabel = ` (${status.split("\n").filter(Boolean).length} uncommitted)`;
+    } else {
+      stateLabel = " (clean)";
+    }
+    lines.push(`- git: ${branch}@${head || "?"}${stateLabel}`);
   }
 
   if (sessionId) {