chainlesschain 0.162.143 → 0.162.148

package/src/lib/code-review.js

@@ -0,0 +1,72 @@
+/**
+ * Code review utilities (ESM)
+ * Mirrors Claude Code /review behavior
+ * @module lib/code-review
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+
+/**
+ * Get git diff for review
+ * @param {string} target - Diff target (default: staged changes)
+ * @returns {string} diff output
+ */
+export function getGitDiff(target = "--staged") {
+  try {
+    return execSync(`git diff ${target}`, {
+      encoding: "utf8",
+      maxBuffer: 10 * 1024 * 1024,
+    });
+  } catch (err) {
+    logger.error(`Failed to get git diff: ${err.message}`);
+    return "";
+  }
+}
+
+/**
+ * Get list of changed files
+ * @param {string} target - Diff target
+ * @returns {string[]} changed files
+ */
+export function getChangedFiles(target = "--staged") {
+  try {
+    const output = execSync(`git diff ${target} --name-only`, {
+      encoding: "utf8",
+    });
+    return output.trim().split("\n").filter(Boolean);
+  } catch (err) {
+    logger.error(`Failed to get changed files: ${err.message}`);
+    return [];
+  }
+}
+
+/**
+ * Run code review on current changes
+ * @param {Object} options Review options
+ * @returns {Promise<Object>} review result
+ */
+export async function runCodeReview(options = {}) {
+  const target = options.target || "--staged";
+  const diff = getGitDiff(target);
+  const files = getChangedFiles(target);
+
+  if (files.length === 0) {
+    logger.info("No changed files to review");
+    return { reviewed: false, files: [], issues: [] };
+  }
+
+  logger.info(`Reviewing ${files.length} changed files...`);
+  files.forEach((f) => logger.info(`  - ${f}`));
+
+  return {
+    reviewed: true,
+    files,
+    diffSize: diff.length,
+    // Actual AI review will be handled by agent core
+    message:
+      "Code review request prepared. AI will analyze changes for bugs, security issues, and style problems.",
+  };
+}
+
+export default { getGitDiff, getChangedFiles, runCodeReview };

package/src/lib/did-manager.js

@@ -163,10 +163,12 @@ export function setDefaultIdentity(db, did) {
   const identity = getIdentity(db, did);
   if (!identity) return false;
 
-  db.prepare("UPDATE did_identities SET is_default = ? WHERE did LIKE ?").run(
-    0,
-    "%",
-  );
+  // Clear the current default(s). Match on is_default rather than `did LIKE '%'`
+  // so there's no wildcard pattern here that a reader/scanner could mistake for
+  // LIKE-injection — the target below is set via exact `did = ?` regardless.
+  db.prepare(
+    "UPDATE did_identities SET is_default = 0 WHERE is_default = 1",
+  ).run();
   db.prepare("UPDATE did_identities SET is_default = ? WHERE did = ?").run(
     1,
     identity.did,

package/src/lib/mcp-oauth.js

@@ -35,6 +35,7 @@ export const _deps = {
   sha256: (s) => crypto.createHash("sha256").update(s).digest(),
   createServer: (h) => http.createServer(h),
   openBrowser: defaultOpenBrowser,
+  spawn: (...a) => spawn(...a),
   now: () => Date.now(),
   // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -648,13 +649,29 @@ export async function ensureValidToken(
 
 // ── interactive orchestrator ──────────────────────────────────────────────
 
-function defaultOpenBrowser(url) {
-  const platform = process.platform;
-  const cmd =
-    platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+export function defaultOpenBrowser(url, platform = process.platform) {
+  // The authorize URL derives from REMOTE OAuth server metadata, so treat it
+  // as untrusted: only http(s) may reach the OS opener (no file:/ms-settings:/
+  // custom-scheme handlers), and it must never pass through cmd.exe's line
+  // parser — `cmd /c start "" <url>` truncates at the first unquoted `&` and
+  // EXECUTES the remainder as commands (query strings always contain `&`).
+  let parsed;
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  // win32: rundll32 is a plain executable — the URL arrives as a verbatim
+  // argv entry with no shell metacharacter interpretation.
+  const [cmd, args] =
+    platform === "win32"
+      ? ["rundll32", ["url.dll,FileProtocolHandler", parsed.href]]
+      : platform === "darwin"
+        ? ["open", [parsed.href]]
+        : ["xdg-open", [parsed.href]];
+  try {
+    const child = _deps.spawn(cmd, args, { stdio: "ignore", detached: true });
     child.unref?.();
     return true;
   } catch {

package/src/lib/plugin-security.js

@@ -0,0 +1,128 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { loadManagedSettings } from "./settings-loader.cjs";
+
+function stringSet(value) {
+  return Array.isArray(value)
+    ? new Set(
+        value
+          .map((v) =>
+            typeof v === "string" ? v : v?.name || v?.source || v?.url || null,
+          )
+          .map((v) => String(v || "").trim())
+          .filter(Boolean),
+      )
+    : null;
+}
+
+export function enforcePluginPolicy(
+  { name, source = null, action = "install" },
+  managed,
+) {
+  if (!managed) return { allowed: true };
+  const denied = stringSet(managed.deniedPlugins) || new Set();
+  const allowed = stringSet(managed.allowedPlugins);
+  if (denied.has(name)) {
+    throw new Error(`plugin "${name}" is denied by managed settings`);
+  }
+  if (allowed && !allowed.has(name)) {
+    throw new Error(`plugin "${name}" is not in the managed allowlist`);
+  }
+
+  const blockedSources = new Set([
+    ...(stringSet(managed.blockedPluginSources) || []),
+    ...(stringSet(managed.blockedMarketplaces) || []),
+  ]);
+  const allowedSources = stringSet(managed.allowedPluginSources);
+  if (source && blockedSources.has(source)) {
+    throw new Error(`plugin source "${source}" is blocked by managed settings`);
+  }
+  if (action === "install" && allowedSources) {
+    if (!source) {
+      throw new Error(
+        "managed settings require --source for plugin installation",
+      );
+    }
+    if (!allowedSources.has(source)) {
+      throw new Error(
+        `plugin source "${source}" is not in the managed allowlist`,
+      );
+    }
+  }
+  return { allowed: true };
+}
+
+export function verifyPluginManifest({
+  manifestFile,
+  expectedSha256,
+  signatureFile,
+  publicKeyFile,
+  requireSignature = false,
+  trustedKeySha256 = null,
+  requireTrustedKey = false,
+}) {
+  if (!manifestFile) {
+    if (requireSignature) {
+      throw new Error("managed settings require a signed plugin manifest");
+    }
+    return null;
+  }
+  const bytes = readFileSync(manifestFile);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  if (
+    expectedSha256 &&
+    sha256.toLowerCase() !== String(expectedSha256).toLowerCase()
+  ) {
+    throw new Error(
+      `plugin manifest SHA-256 mismatch (expected ${expectedSha256}, got ${sha256})`,
+    );
+  }
+
+  const wantsSignature = requireSignature || signatureFile || publicKeyFile;
+  let signatureVerified = false;
+  if (wantsSignature) {
+    if (!signatureFile || !publicKeyFile) {
+      throw new Error(
+        "plugin signature verification requires --signature and --public-key",
+      );
+    }
+    const signature = readFileSync(signatureFile);
+    const publicKey = readFileSync(publicKeyFile, "utf8");
+    const keyObject = createPublicKey(publicKey);
+    const publicKeySha256 = createHash("sha256")
+      .update(keyObject.export({ type: "spki", format: "der" }))
+      .digest("hex");
+    const trusted = stringSet(trustedKeySha256);
+    if (requireTrustedKey && (!trusted || trusted.size === 0)) {
+      throw new Error(
+        "managed settings require trustedPluginKeySha256 fingerprints",
+      );
+    }
+    if (trusted && !trusted.has(publicKeySha256)) {
+      throw new Error(`plugin signing key is not trusted (${publicKeySha256})`);
+    }
+    signatureVerified = verify(null, bytes, keyObject, signature);
+    if (!signatureVerified) {
+      throw new Error("plugin manifest signature verification failed");
+    }
+  }
+  return {
+    bytes,
+    sha256,
+    signatureVerified,
+    publicKeySha256: signatureVerified
+      ? createHash("sha256")
+          .update(
+            createPublicKey(readFileSync(publicKeyFile, "utf8")).export({
+              type: "spki",
+              format: "der",
+            }),
+          )
+          .digest("hex")
+      : null,
+  };
+}
+
+export function loadPluginManagedPolicy(options = {}) {
+  return loadManagedSettings(options).settings;
+}

package/src/lib/pr-create.js

@@ -0,0 +1,108 @@
+/**
+ * Pull request creation utilities (ESM)
+ * Mirrors Claude Code /pr behavior
+ * @module lib/pr-create
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+
+/**
+ * Get current git branch
+ * @returns {string} branch name
+ */
+export function getCurrentBranch() {
+  try {
+    return execSync("git rev-parse --abbrev-ref HEAD", {
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    return "main";
+  }
+}
+
+/**
+ * Get remote URL
+ * @returns {string|null}
+ */
+export function getRemoteUrl() {
+  try {
+    return execSync("git remote get-url origin", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract GitHub owner/repo from remote URL
+ * @returns {{owner: string, repo: string}|null}
+ */
+export function parseGitHubRepo() {
+  const url = getRemoteUrl();
+  if (!url) return null;
+
+  // Handle SSH and HTTPS URLs
+  const match = url.match(/github\.com[:/]([^/]+)\/([^/.]+)(\.git)?/);
+  if (!match) return null;
+
+  return { owner: match[1], repo: match[2] };
+}
+
+/**
+ * Prepare pull request
+ * @param {Object} options PR options
+ * @returns {Promise<Object>} PR creation result
+ */
+export async function preparePullRequest(options = {}) {
+  const branch = getCurrentBranch();
+  const repo = parseGitHubRepo();
+
+  // Check for uncommitted changes
+  const status = execSync("git status --porcelain", { encoding: "utf8" });
+  const hasChanges = status.trim().length > 0;
+
+  if (hasChanges && !options.skipStash) {
+    logger.warn(
+      "You have uncommitted changes. Commit or stash before creating PR.",
+    );
+  }
+
+  // Get commit messages for PR body
+  const defaultBase = options.base || "main";
+  const logRange = `${defaultBase}...${branch}`;
+  let commitLog = "";
+  try {
+    commitLog = execSync(`git log ${logRange} --oneline`, { encoding: "utf8" });
+  } catch {
+    commitLog = "";
+  }
+
+  const prUrl = repo
+    ? `https://github.com/${repo.owner}/${repo.repo}/compare/${defaultBase}...${branch}?expand=1`
+    : null;
+
+  logger.info(`Branch: ${branch}`);
+  logger.info(`Base: ${defaultBase}`);
+  if (prUrl) {
+    logger.info(`Open PR in browser: ${prUrl}`);
+  }
+
+  return {
+    prepared: true,
+    branch,
+    base: defaultBase,
+    repo,
+    commitLog,
+    prUrl,
+    hasUncommittedChanges: hasChanges,
+    message:
+      "PR draft prepared. AI will help generate title and body from commits.",
+  };
+}
+
+export default {
+  getCurrentBranch,
+  getRemoteUrl,
+  parseGitHubRepo,
+  preparePullRequest,
+};

package/src/lib/publish-workspace.js

@@ -0,0 +1,107 @@
+/**
+ * Publish workspace packages to npm (ESM)
+ * Mirrors Claude Code /publish behavior
+ * @module lib/publish-workspace
+ */
+
+import { execSync } from "child_process";
+import { logger } from "./logger.js";
+import path from "path";
+import fs from "fs";
+
+/**
+ * Get all workspace packages
+ * @returns {Array<{name: string, path: string, version: string}>}
+ */
+export function getWorkspacePackages() {
+  try {
+    const rootPkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+    const packages = [];
+
+    // Handle workspaces config
+    const workspaces = rootPkg.workspaces?.packages || rootPkg.workspaces || [];
+    for (const pattern of workspaces) {
+      // Simple glob handling for basic patterns
+      const dir = pattern.replace(/\*+/g, "");
+      if (fs.existsSync(dir)) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isDirectory()) {
+            const pkgPath = path.join(dir, entry.name);
+            const pkgFile = path.join(pkgPath, "package.json");
+            if (fs.existsSync(pkgFile)) {
+              const pkg = JSON.parse(fs.readFileSync(pkgFile, "utf8"));
+              if (pkg.name && !pkg.private) {
+                packages.push({
+                  name: pkg.name,
+                  path: pkgPath,
+                  version: pkg.version,
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+
+    return packages;
+  } catch (err) {
+    logger.error(`Failed to get workspace packages: ${err.message}`);
+    return [];
+  }
+}
+
+/**
+ * Publish a single package
+ * @param {Object} pkg Package info
+ * @param {Object} options Publish options
+ * @returns {boolean} success
+ */
+export function publishPackage(pkg, options = {}) {
+  try {
+    logger.info(`Publishing ${pkg.name}@${pkg.version}...`);
+    let cmd = "npm publish";
+    if (options.tag) cmd += ` --tag ${options.tag}`;
+    if (options.access) cmd += ` --access ${options.access}`;
+
+    execSync(cmd, {
+      cwd: pkg.path,
+      stdio: "inherit",
+      encoding: "utf8",
+    });
+    logger.succeed(`Published ${pkg.name}@${pkg.version}`);
+    return true;
+  } catch (err) {
+    logger.error(`Failed to publish ${pkg.name}: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Publish all changed workspace packages
+ * @param {Object} options Options
+ * @returns {Promise<boolean>} success
+ */
+export async function publishWorkspace(options = {}) {
+  const packages = getWorkspacePackages();
+  if (packages.length === 0) {
+    logger.info("No publishable packages found");
+    return true;
+  }
+
+  logger.info(`Found ${packages.length} publishable packages`);
+  let allSucceeded = true;
+
+  for (const pkg of packages) {
+    if (options.dryRun) {
+      logger.info(`[dry-run] Would publish ${pkg.name}@${pkg.version}`);
+      continue;
+    }
+    const ok = publishPackage(pkg, options);
+    if (!ok) allSucceeded = false;
+  }
+
+  return allSucceeded;
+}
+
+export default { getWorkspacePackages, publishPackage, publishWorkspace };

package/src/lib/resume-session.js

@@ -0,0 +1,111 @@
+/**
+ * Session resume utilities (ESM)
+ * Mirrors Claude Code /resume behavior
+ * @module lib/resume-session
+ */
+
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { logger } from "./logger.js";
+
+const SESSION_DIR = path.join(os.homedir(), ".chainlesschain", "sessions");
+
+/**
+ * List recent chat sessions
+ * @param {number} limit Maximum sessions to return
+ * @returns {Array<Object>} list of sessions
+ */
+export function listSessions(limit = 10) {
+  try {
+    if (!fs.existsSync(SESSION_DIR)) {
+      return [];
+    }
+
+    const files = fs
+      .readdirSync(SESSION_DIR)
+      .filter((f) => f.endsWith(".json"))
+      .map((f) => {
+        const filePath = path.join(SESSION_DIR, f);
+        const stat = fs.statSync(filePath);
+        let summary = "";
+        try {
+          const data = JSON.parse(fs.readFileSync(filePath, "utf8"));
+          summary = data.summary || data.title || f.replace(".json", "");
+        } catch {
+          summary = f.replace(".json", "");
+        }
+        return {
+          id: f.replace(".json", ""),
+          file: filePath,
+          mtime: stat.mtimeMs,
+          summary,
+        };
+      })
+      .sort((a, b) => b.mtime - a.mtime)
+      .slice(0, limit);
+
+    return files;
+  } catch (err) {
+    logger.debug(`Error listing sessions: ${err.message}`);
+    return [];
+  }
+}
+
+/**
+ * Load a session by ID
+ * @param {string} sessionId
+ * @returns {Object|null} session data
+ */
+export function loadSession(sessionId) {
+  try {
+    const filePath = path.join(SESSION_DIR, `${sessionId}.json`);
+    if (!fs.existsSync(filePath)) {
+      return null;
+    }
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (err) {
+    logger.error(`Error loading session ${sessionId}: ${err.message}`);
+    return null;
+  }
+}
+
+/**
+ * Get the most recent session
+ * @returns {Object|null}
+ */
+export function getLatestSession() {
+  const sessions = listSessions(1);
+  return sessions.length > 0 ? loadSession(sessions[0].id) : null;
+}
+
+/**
+ * Resume a chat session
+ * @param {string} [sessionId] Optional session ID (resumes latest if not provided)
+ * @returns {Promise<Object>} resume result
+ */
+export async function resumeSession(sessionId) {
+  let session;
+  if (sessionId) {
+    session = loadSession(sessionId);
+    if (!session) {
+      return { success: false, message: `Session ${sessionId} not found` };
+    }
+  } else {
+    session = getLatestSession();
+    if (!session) {
+      return { success: false, message: "No previous sessions found" };
+    }
+  }
+
+  return {
+    success: true,
+    sessionId: session.id || sessionId,
+    messageCount: session.messages?.length || 0,
+    summary: session.summary,
+    session,
+    message: "Session loaded. Continue chatting to resume the conversation.",
+  };
+}
+
+export default { listSessions, loadSession, getLatestSession, resumeSession };

package/src/lib/session-manager.js

@@ -7,6 +7,7 @@
 
 import { createHash } from "crypto";
 import { safeJsonParse } from "./safe-json.js";
+import { likePrefix } from "./sql-like.js";
 
 function ensureSessionsTable(db) {
   db.exec(`
@@ -115,10 +116,13 @@ export function getSession(db, sessionId) {
     .prepare("SELECT * FROM llm_sessions WHERE id = ?")
     .get(sessionId);
 
-  if (!session) {
+  if (!session && sessionId) {
+    // Prefix match as a fallback. Escape LIKE metachars (% _ \) in the id and
+    // pair with ESCAPE '\' so a value containing them can't wildcard-match the
+    // WRONG session — getSession resolves the id that resume writes back to.
     session = db
-      .prepare("SELECT * FROM llm_sessions WHERE id LIKE ? LIMIT 1")
-      .get(`${sessionId}%`);
+      .prepare("SELECT * FROM llm_sessions WHERE id LIKE ? ESCAPE '\\' LIMIT 1")
+      .get(likePrefix(sessionId));
   }
 
   if (!session) return null;