chainlesschain 0.162.125 → 0.162.127

package/src/lib/project-instructions.js

@@ -33,6 +33,7 @@
 import fsDefault from "fs";
 import pathDefault from "path";
 import osDefault from "os";
+import { credentialFileReason } from "./credential-guard.js";
 
 export const DEFAULT_MAX_FILE_BYTES = 48 * 1024; // per instruction/import file
 export const DEFAULT_MAX_TOTAL_BYTES = 192 * 1024; // whole block budget
@@ -321,6 +322,18 @@ export function loadProjectInstructions(opts = {}) {
       const resolved = path.resolve(baseDir, target);
       if (visited.has(resolved) || !isFile(fs, resolved)) continue; // silent:
       // non-files are decorative @tokens (npm scopes, emails), not imports.
+      // Refuse to import a credential / secret file. `cc agent` auto-loads
+      // project memory, so a cloned/untrusted repo's cc.md must NOT be able to
+      // pull `@~/.ssh/id_rsa` / `@../.env` into the LLM-bound system prompt
+      // (mirrors the read_file/run_shell credential guard).
+      const credReason = credentialFileReason(resolved);
+      if (credReason) {
+        visited.add(resolved); // don't re-warn on a second reference
+        warnings.push(
+          `refused @import of ${resolved} — ${credReason}; project memory must not pull secrets into the prompt`,
+        );
+        continue;
+      }
       visited.add(resolved);
       queue.push({ abs: resolved, scope: "import", depth: depth + 1 });
     }

package/src/lib/repl-denials.js

@@ -0,0 +1,137 @@
+/**
+ * repl-denials — record + render the policy denials seen during an agent run,
+ * so the interactive REPL's `/permissions denials` can review what got blocked
+ * AND a headless run (`cc agent -p`) can print an end-of-run summary (Claude-
+ * Code 2.1.193 parity: "auto-mode denial reasons … /permissions recent
+ * denials"). The helpers are generic (not REPL-specific) and shared by both.
+ *
+ * A *denial* is a tool call the agent was NOT allowed to run — blocked by the
+ * shell policy, an ApprovalGate tier, a settings permission rule, or a hook. It
+ * is distinct from a tool that ran and *failed* (non-zero exit, missing file):
+ * those carry an `error` but none of the denial markers below, so they are not
+ * recorded here.
+ *
+ * Pure + dependency-free so it unit-tests without the REPL runtime.
+ */
+
+/** Keep the most recent N denials per session (bounded ring buffer). */
+export const MAX_RECENT_DENIALS = 20;
+
+/** Error-message prefixes agent-core attaches to a blocked tool call. */
+const DENIAL_PREFIX = /^\s*\[(Shell Policy|Permission|ApprovalGate|Hook)\]/;
+
+/** Map a `[Prefix]` to a short `via` label when no structured field carries one. */
+function viaFromPrefix(errStr) {
+  const m = DENIAL_PREFIX.exec(errStr);
+  if (!m) return null;
+  return (
+    {
+      "Shell Policy": "shell-policy",
+      Permission: "settings",
+      ApprovalGate: "gate",
+      Hook: "hook",
+    }[m[1]] || "policy"
+  );
+}
+
+/**
+ * Classify a tool-result as a policy denial and extract a structured record,
+ * or return null when it is not a denial. Detection prefers the structured
+ * markers agent-core attaches (`approval.decision` / `policy.decision` /
+ * `shellCommandPolicy.allowed`) and falls back to the error-message prefix.
+ *
+ * @param {object} ev  { tool, result, error, argsSummary }
+ * @returns {{tool:string,summary:string,reason:string,via:string,rule:(string|null)}|null}
+ */
+export function classifyDenial(ev = {}) {
+  const { tool, result, error, argsSummary } = ev;
+  const errStr = String(error || (result && result.error) || "").trim();
+  const approval = result && result.approval;
+  const policy = result && result.policy;
+  const shellPol = result && result.shellCommandPolicy;
+  const denied =
+    (approval && approval.decision === "deny") ||
+    (policy && policy.decision === "deny") ||
+    (shellPol && shellPol.allowed === false) ||
+    DENIAL_PREFIX.test(errStr);
+  if (!denied) return null;
+  const via =
+    (approval && approval.via) ||
+    (policy && policy.via) ||
+    (shellPol ? "shell-policy" : viaFromPrefix(errStr)) ||
+    "policy";
+  const rule = (policy && policy.rule) || (shellPol && shellPol.ruleId) || null;
+  return {
+    tool: tool || "?",
+    summary: String(
+      argsSummary || (shellPol && shellPol.normalizedCommand) || "",
+    ).slice(0, 200),
+    reason: errStr || "(denied)",
+    via,
+    rule,
+  };
+}
+
+/** Two denials are "the same" attempt when tool + command + rule + via match. */
+function sameDenial(a, b) {
+  return (
+    a &&
+    b &&
+    a.tool === b.tool &&
+    a.summary === b.summary &&
+    a.via === b.via &&
+    a.rule === b.rule
+  );
+}
+
+/**
+ * Append a denial to a bounded most-recent-last ring buffer (mutates + returns
+ * it). Drops the oldest entries beyond `max`. No-op on a bad log/record.
+ *
+ * Consecutive identical denials are COALESCED: a model that hits a policy block
+ * usually retries the same command several times, which would otherwise flood
+ * the cap and evict other distinct denials. A repeat bumps the last entry's
+ * `count` and refreshes its `at` instead of appending.
+ */
+export function recordDenial(log, record, max = MAX_RECENT_DENIALS) {
+  if (!Array.isArray(log) || !record) return log;
+  const last = log[log.length - 1];
+  if (sameDenial(last, record)) {
+    last.count = (last.count || 1) + 1;
+    if (typeof record.at === "number") last.at = record.at;
+    return log;
+  }
+  log.push(record);
+  while (log.length > max) log.shift();
+  return log;
+}
+
+/**
+ * Render the denial log most-recent-first for `/permissions denials`. Times are
+ * relative ("12s ago") when a record carries a numeric `at`; `now` is injectable
+ * for deterministic tests.
+ *
+ * @param {Array} log
+ * @param {{now?:number}} [opts]
+ * @returns {string}
+ */
+export function formatDenials(log, opts = {}) {
+  const now = typeof opts.now === "number" ? opts.now : Date.now();
+  if (!Array.isArray(log) || log.length === 0) {
+    return "  (no tool calls were denied this session)";
+  }
+  const lines = [`  Recent denials (most recent first, ${log.length}):`];
+  for (let i = log.length - 1; i >= 0; i--) {
+    const d = log[i] || {};
+    const ago =
+      typeof d.at === "number"
+        ? ` · ${Math.max(0, Math.round((now - d.at) / 1000))}s ago`
+        : "";
+    const where = d.rule ? `${d.via}:${d.rule}` : d.via || "policy";
+    const what = d.summary ? `${d.tool} ${d.summary}` : d.tool || "?";
+    const times = d.count > 1 ? ` ×${d.count}` : "";
+    lines.push(`  • ${what}${times}  [${where}${ago}]`);
+    if (d.reason) lines.push(`      ${d.reason}`);
+  }
+  return lines.join("\n");
+}

package/src/lib/safe-json.js

@@ -0,0 +1,22 @@
+/**
+ * safeJsonParse — JSON.parse that returns `fallback` instead of throwing on
+ * malformed (or null/empty) input.
+ *
+ * Use it for DB columns parsed inside a list `.map()` / loop: an unguarded
+ * `JSON.parse(row.col)` lets ONE corrupt cell throw out of the whole function,
+ * crashing the entire list load (the unguarded-JSON.parse-in-list-loop bug
+ * class — a single bad row should be skipped, not fail every other row).
+ *
+ * @param {unknown} text      the raw string (or null/undefined)
+ * @param {*} [fallback=null] returned on null/empty/parse failure
+ * @returns {*}
+ */
+export function safeJsonParse(text, fallback = null) {
+  if (text == null || text === "") return fallback;
+  try {
+    const v = JSON.parse(text);
+    return v == null ? fallback : v;
+  } catch {
+    return fallback;
+  }
+}

package/src/lib/sandbox-v2.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 import { createRequire } from "module";
 
 const _require = createRequire(import.meta.url);
@@ -429,9 +430,9 @@ export function getSandbox(db, sandboxId) {
     id: row.id,
     agentId: row.agent_id,
     status: row.status,
-    permissions: JSON.parse(row.permissions || "{}"),
-    quota: JSON.parse(row.quota || "{}"),
-    resourceUsage: JSON.parse(row.resource_usage || "{}"),
+    permissions: safeJsonParse(row.permissions, {}),
+    quota: safeJsonParse(row.quota, {}),
+    resourceUsage: safeJsonParse(row.resource_usage, {}),
     createdAt: row.created_at,
   };
 }
@@ -609,9 +610,9 @@ export function restoreFromDb(db) {
       id: row.id,
       agentId: row.agent_id,
       status: row.status || "active",
-      permissions: JSON.parse(row.permissions || "{}"),
-      quota: JSON.parse(row.quota || "{}"),
-      resourceUsage: JSON.parse(row.resource_usage || "{}"),
+      permissions: safeJsonParse(row.permissions, {}),
+      quota: safeJsonParse(row.quota, {}),
+      resourceUsage: safeJsonParse(row.resource_usage, {}),
       createdAt: row.created_at || new Date(now).toISOString(),
       policy,
       createdAtMs: row.created_at_ms || now,

package/src/lib/search-command.js

@@ -0,0 +1,65 @@
+/**
+ * search-command — build the shell command for the agent `search_files` tool
+ * with the model/user-supplied pattern SAFELY embedded.
+ *
+ * The pattern flows into execSync (a real shell), so a raw interpolation
+ * (`grep -i "${pattern}"`) is a command-injection vector: a pattern like
+ * `x" ; curl evil ; "` runs arbitrary commands — and `search_files` is
+ * read-only + NOT confirm-gated, so it would bypass the `run_shell`
+ * ApprovalGate + credential guards entirely (reachable via prompt-injection).
+ * Raw interpolation is also semantically wrong: the shell would expand `$HOME`,
+ * backticks, globs, etc. in the pattern instead of searching for them literally.
+ *
+ * Fix: quote the pattern so every shell metacharacter is inert. The emitted
+ * commands (and therefore the output format `_ingestSearchOutput` parses) are
+ * otherwise unchanged.
+ */
+
+/** POSIX single-quote: wrap in '…' and escape any embedded ' as '\''. Single
+ *  quotes neutralize EVERY shell metacharacter, so nothing inside is expanded
+ *  or can break out. */
+export function shquotePosix(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * Build `{ cmd }` for a search, or `{ error }` when the pattern can't be made
+ * safe on the target platform.
+ *
+ * @param {object} a
+ * @param {string} a.pattern        the raw search pattern
+ * @param {boolean} a.isContent     content search (grep/findstr) vs filename
+ * @param {string} [a.platform=process.platform]
+ * @returns {{cmd:string}|{error:string}}
+ */
+export function buildSearchCommand({
+  pattern,
+  isContent,
+  platform = process.platform,
+}) {
+  const pat = String(pattern ?? "");
+
+  if (platform === "win32") {
+    // cmd.exe has no reliable way to escape an embedded double-quote, and the
+    // pattern is double-quoted below — so reject a literal `"` (rare in a search
+    // pattern; run_shell handles complex cases). Every OTHER metacharacter
+    // (& | < > ^ ( )) is literal INSIDE cmd double quotes, so quoting the
+    // pattern closes the injection while leaving the redirect (2>NUL) outside.
+    if (pat.includes('"')) {
+      return {
+        error: 'search pattern may not contain a double-quote (") on Windows',
+      };
+    }
+    return {
+      cmd: isContent
+        ? `findstr /s /i /n "${pat}" *`
+        : `dir /s /b "*${pat}*" 2>NUL`,
+    };
+  }
+
+  return {
+    cmd: isContent
+      ? `grep -r -l -i ${shquotePosix(pat)} . --include="*" 2>/dev/null | head -20`
+      : `find . -name ${shquotePosix(`*${pat}*`)} -type f 2>/dev/null | head -20`,
+  };
+}

package/src/lib/settings-hooks.cjs

@@ -27,6 +27,7 @@
 const path = require("node:path");
 const os = require("node:os");
 const fsDefault = require("node:fs");
+const crypto = require("node:crypto");
 const { SUGGEST_UMBRELLA } = require("./permission-rules.cjs");
 const { projectRootBase } = require("./project-root.cjs");
 
@@ -179,8 +180,140 @@ function collectHooks(hooksBlock, event, toolName) {
   return out;
 }
 
+/**
+ * Every command-hook in a parsed settings object, tagged with the event +
+ * matcher it fires under (so a fingerprint reflects WHEN it runs, not just the
+ * command string). Mirrors loadHooks' command-hook filter.
+ */
+function extractCommandHooks(data) {
+  const out = [];
+  const block =
+    data && data.hooks && typeof data.hooks === "object" ? data.hooks : null;
+  if (!block) return out;
+  for (const [event, groups] of Object.entries(block)) {
+    if (!Array.isArray(groups)) continue;
+    for (const g of groups) {
+      if (!g || typeof g !== "object" || !Array.isArray(g.hooks)) continue;
+      for (const h of g.hooks) {
+        if (h && h.type === "command" && h.command) {
+          out.push({
+            event,
+            matcher: g.matcher ?? null,
+            command: String(h.command),
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** `~/.chainlesschain/hook-trust.json` — remembered first-run acknowledgments. */
+function hookTrustStorePath() {
+  return path.join(_deps.homedir(), ".chainlesschain", "hook-trust.json");
+}
+
+function readHookTrustStore() {
+  try {
+    const f = hookTrustStorePath();
+    if (!_deps.fs.existsSync(f)) return {};
+    const parsed = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {}; // unreadable store → treat as nothing acknowledged
+  }
+}
+
+function writeHookTrustStore(store) {
+  try {
+    const f = hookTrustStorePath();
+    _deps.fs.mkdirSync(path.dirname(f), { recursive: true });
+    _deps.fs.writeFileSync(f, JSON.stringify(store, null, 2), "utf-8");
+    return true;
+  } catch {
+    return false; // best-effort — a failed write just re-shows the notice
+  }
+}
+
+/**
+ * First-run trust notice for project-sourced settings.json hooks (which run
+ * shell). The user's own `~/.claude/settings.json` and an explicit `--settings`
+ * file are trusted; only the project's `.claude/settings{,.local}.json` (project
+ * root + cwd) carry the cloned-repo auto-execution risk that Claude-Code 2.1.195
+ * gated ("untrusted project config must require explicit consent").
+ *
+ * Returns a one-line notice (and records an acknowledgment hash) the FIRST time
+ * a project's shell-running hooks are seen — and again only if those hooks
+ * change. Returns null when there are no project hooks, the hooks are unchanged
+ * since last acknowledged, or the notice is disabled (`CC_HOOK_TRUST_NOTICE=0`,
+ * or hooks themselves are off via `CC_SETTINGS_HOOKS=0`). Best-effort: a failed
+ * store write still returns the notice (shown again next run) rather than
+ * throwing — it must never abort agent startup.
+ *
+ * @returns {string|null}
+ */
+function projectHookTrustNotice({ cwd = process.cwd(), settingsFile } = {}) {
+  if (process.env.CC_HOOK_TRUST_NOTICE === "0") return null;
+  if (process.env.CC_SETTINGS_HOOKS === "0") return null; // hooks won't run anyway
+  const home = path.join(_deps.homedir(), ".claude", "settings.json");
+  const explicit = settingsFile ? path.resolve(cwd, settingsFile) : null;
+  const trusted = new Set([home, explicit].filter(Boolean));
+  const seen = new Set();
+  const projectFiles = settingsFiles(cwd, settingsFile).filter((f) => {
+    if (trusted.has(f) || seen.has(f)) return false;
+    seen.add(f);
+    return true;
+  });
+
+  const entries = [];
+  const contributing = [];
+  for (const f of projectFiles) {
+    let data;
+    try {
+      if (!_deps.fs.existsSync(f)) continue;
+      data = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    } catch {
+      continue; // malformed JSON is surfaced by loadHooks' own warn path
+    }
+    const cmds = extractCommandHooks(data);
+    if (cmds.length) {
+      entries.push(...cmds);
+      contributing.push(f);
+    }
+  }
+  if (entries.length === 0) return null;
+
+  const fingerprint = entries
+    .map((e) => `${e.event}${e.matcher ?? ""}${e.command}`)
+    .sort();
+  const hash = crypto
+    .createHash("sha256")
+    .update(JSON.stringify(fingerprint))
+    .digest("hex");
+  const key = projectRootBase(cwd, { fs: _deps.fs, path }) || cwd;
+
+  const store = readHookTrustStore();
+  if (store[key] && store[key].hash === hash) return null; // already acknowledged
+  store[key] = {
+    hash,
+    files: contributing,
+    count: entries.length,
+    at: new Date().toISOString(),
+  };
+  writeHookTrustStore(store); // best-effort acknowledgment
+
+  const fileList = contributing.map((f) => `    ${f}`).join("\n");
+  return (
+    `⚠ This project's .claude/settings.json defines ${entries.length} ` +
+    `shell-running hook(s) that auto-run on agent activity:\n${fileList}\n` +
+    `  Review them before trusting this repo. Shown once per change; ` +
+    `disable all hooks with CC_SETTINGS_HOOKS=0.`
+  );
+}
+
 module.exports = {
   loadHooks,
+  projectHookTrustNotice,
   collectHooks,
   compileMatcher,
   umbrellaFor,

package/src/lib/settings-loader.cjs

@@ -240,12 +240,16 @@ function loadSettingsConfig(opts = {}) {
 }
 
 /**
- * Read a top-level boolean setting across the layered `.claude/settings.json`
- * files (last/closest layer wins — same precedence as the permission rules).
- * Non-boolean values are ignored. Returns `undefined` when no layer sets it, so
- * a caller can distinguish "unset" from an explicit `false`.
+ * Read a boolean setting across the layered `.claude/settings.json` files
+ * (last/closest layer wins — same precedence as the permission rules). The key
+ * may be a dotted path for nested settings (e.g. `autoMode.classifyAllShell`);
+ * a plain key walks a one-element path, so existing callers are unaffected.
+ * Non-boolean values (and partial paths through a non-object) are ignored.
+ * Returns `undefined` when no layer sets it, so a caller can distinguish
+ * "unset" from an explicit `false`.
  *
- * @param {string} key  top-level settings key (e.g. "respondToBashCommands")
+ * @param {string} key  settings key or dotted path (e.g. "respondToBashCommands"
+ *                       or "autoMode.classifyAllShell")
  * @param {object} [opts]
  * @param {string} [opts.cwd=process.cwd()]
  * @param {string} [opts.settingsFile]
@@ -254,11 +258,16 @@ function loadSettingsConfig(opts = {}) {
  */
 function readBooleanSetting(key, opts = {}) {
   const cwd = opts.cwd || process.cwd();
+  const parts = String(key).split(".");
   let value;
   for (const file of settingsPaths(cwd, opts.settingsFile)) {
     const data = readSettingsFile(file, { onWarn: opts.onWarn });
-    if (data && typeof data[key] === "boolean") {
-      value = data[key]; // last (closest) layer wins
+    let node = data;
+    for (const p of parts) {
+      node = node && typeof node === "object" ? node[p] : undefined;
+    }
+    if (typeof node === "boolean") {
+      value = node; // last (closest) layer wins
     }
   }
   return value;

package/src/lib/social-graph.js

@@ -22,6 +22,7 @@
  */
 
 import { EventEmitter } from "events";
+import { safeJsonParse } from "./safe-json.js";
 
 /* ── Edge types ────────────────────────────────────────────── */
 
@@ -325,7 +326,8 @@ export function loadFromDb(db) {
     )
     .all();
   for (const row of rows) {
-    const metadata = row.metadata ? JSON.parse(row.metadata) : null;
+    // A single corrupt metadata cell must not crash the whole graph load.
+    const metadata = safeJsonParse(row.metadata, null);
     // Hydrate without re-emitting events (bulk load).
     _hydrateEdge({
       sourceDid: row.source_did,

package/src/lib/stream-retry.js

@@ -18,6 +18,33 @@ import { isAbortError } from "./abort-utils.js";
 export const STREAM_RETRY_MAX = 2;
 export const STREAM_RETRY_BASE_MS = 400;
 
+/**
+ * Hard ceiling on the *configurable* retry budget (Claude-Code 2.1.186:
+ * "CLAUDE_CODE_MAX_RETRIES capped at 15") — keeps a stray huge value from
+ * turning a dead endpoint into a multi-minute exponential-backoff hang.
+ */
+export const STREAM_RETRY_MAX_CAP = 15;
+
+/**
+ * Resolve the streaming-retry budget. Users can raise (or lower) the default
+ * via `CC_MAX_RETRIES` (native) or `CLAUDE_CODE_MAX_RETRIES` (Claude-Code
+ * parity); the value is clamped to `[0, STREAM_RETRY_MAX_CAP]`. Unset / blank /
+ * non-numeric falls back to the default `STREAM_RETRY_MAX`; a negative value
+ * clamps to 0 (retries disabled). `CC_MAX_RETRIES` wins when both are set.
+ *
+ * @param {Record<string,string|undefined>} [env=process.env]
+ * @returns {number}
+ */
+export function resolveStreamRetryMax(env = process.env) {
+  const raw = env.CC_MAX_RETRIES ?? env.CLAUDE_CODE_MAX_RETRIES;
+  if (raw == null || String(raw).trim() === "") return STREAM_RETRY_MAX;
+  const n = Number.parseInt(String(raw).trim(), 10);
+  if (!Number.isFinite(n)) return STREAM_RETRY_MAX;
+  if (n < 0) return 0;
+  if (n > STREAM_RETRY_MAX_CAP) return STREAM_RETRY_MAX_CAP;
+  return n;
+}
+
 /**
  * Is this error from a streaming chat request a transient API CONNECTION drop
  * that is safe to retry? True only for genuine network failures (reset /

package/src/lib/turn-context.js

@@ -30,6 +30,9 @@ function _git(cmd, cwd) {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 1500,
+        // `status --porcelain` on a dirty repo with many files can exceed the
+        // 1 MB execSync default → ENOBUFS → null → "(clean)" misreport below.
+        maxBuffer: 16 * 1024 * 1024,
       })
       .trim();
   } catch (_e) {
@@ -61,11 +64,18 @@ export function buildTurnContext({
   if (branch) {
     const head = _git("rev-parse --short HEAD", cwd);
     const status = _git("status --porcelain", cwd);
-    const dirty = status && status.length > 0;
-    const fileCount = dirty ? status.split("\n").filter(Boolean).length : 0;
-    lines.push(
-      `- git: ${branch}@${head || "?"}${dirty ? ` (${fileCount} uncommitted)` : " (clean)"}`,
-    );
+    // Distinguish "command failed" (null — timeout / huge output) from "" (truly
+    // clean): the old `status && …` reported a repo as "(clean)" whenever status
+    // couldn't be determined, which is a wrong signal to the model.
+    let stateLabel;
+    if (status === null) {
+      stateLabel = " (status unknown)";
+    } else if (status.length > 0) {
+      stateLabel = ` (${status.split("\n").filter(Boolean).length} uncommitted)`;
+    } else {
+      stateLabel = " (clean)";
+    }
+    lines.push(`- git: ${branch}@${head || "?"}${stateLabel}`);
   }
 
   if (sessionId) {