chainlesschain 0.162.148 → 0.162.149

package/src/harness/remote-session-push-xiaomi.js

@@ -0,0 +1,99 @@
+// Remote Session vendor push — Xiaomi (小米) push sender.
+//
+// A concrete implementation of the RemoteSessionPushDispatcher `sender` contract
+// for MIUI devices, using the Xiaomi Push server API. Unlike FCM/APNs there is
+// no JWT — auth is a static app AppSecret in the `Authorization: key=` header —
+// so this sender is a straight form-encoded POST over plain HTTPS with an
+// injectable `fetch` (default global), fully unit-testable with a fake
+// transport. The payload carries only routing ids (no session content).
+
+import { PushTokenUnregisteredError } from "./remote-session-push-errors.js";
+
+const DEFAULT_HOST = "https://api.xmpush.xiaomi.com";
+const SEND_PATH = "/v3/message/regid";
+
+// Xiaomi does not use a single canonical "unregistered" code; match the reason
+// text it returns for a stale/invalid registration id.
+const INVALID_TOKEN_RE = /invalid|not valid|unregist|not ?exist|无效|不存在/i;
+
+/** Sends one notification to a Xiaomi registration id. */
+export class XiaomiPushSender {
+  constructor(options = {}) {
+    if (!options.appSecret) {
+      throw new Error("XiaomiPushSender requires an appSecret");
+    }
+    if (!options.packageName) {
+      throw new Error("XiaomiPushSender requires a packageName");
+    }
+    this.appSecret = options.appSecret;
+    this.packageName = options.packageName;
+    this.host = options.host || DEFAULT_HOST;
+    this.fetch = options.fetch || globalThis.fetch;
+  }
+
+  /** Bound function matching the dispatcher's `sender` contract. */
+  get handler() {
+    return (payload) => this.send(payload);
+  }
+
+  async send({ token, notification, sessionId, clientId } = {}) {
+    if (!token) throw new Error("Xiaomi send requires a registration id");
+    const params = new URLSearchParams({
+      registration_id: token,
+      restricted_package_name: this.packageName,
+      pass_through: "0", // 0 = show a notification, 1 = data-only
+      notify_type: "-1", // default sound/vibrate
+      title: notification?.title || "Approval requested",
+      description: notification?.body || "A coding session needs your approval",
+    });
+    // Routing ids only — no session content.
+    const payload = { type: "remote-session.approval-request" };
+    if (sessionId != null) payload.sessionId = String(sessionId);
+    if (clientId != null) payload.clientId = String(clientId);
+    params.set("payload", JSON.stringify(payload));
+
+    const res = await this.fetch(`${this.host}${SEND_PATH}`, {
+      method: "POST",
+      headers: {
+        Authorization: `key=${this.appSecret}`,
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: params.toString(),
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.result === "ok" && Number(json.code) === 0) {
+      return { id: json.data?.id || null };
+    }
+    const reason = json.reason || json.description || `HTTP ${res.status}`;
+    if (INVALID_TOKEN_RE.test(String(reason))) {
+      throw new PushTokenUnregisteredError(
+        `Xiaomi registration id invalid: ${reason}`,
+      );
+    }
+    throw new Error(`Xiaomi push failed: ${reason}`);
+  }
+}
+
+/**
+ * Build a bound Xiaomi `sender` from env, or null when unconfigured.
+ *
+ * Xiaomi env:
+ *   CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_APP_SECRET
+ *   CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_PACKAGE_NAME
+ *   CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_HOST  (optional; e.g. the global host)
+ */
+export function createXiaomiPushSender(env = {}, options = {}) {
+  const appSecret =
+    options.appSecret || env.CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_APP_SECRET;
+  const packageName =
+    options.packageName ||
+    env.CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_PACKAGE_NAME;
+  if (!appSecret || !packageName) return null;
+  const host = options.host || env.CHAINLESSCHAIN_REMOTE_SESSION_XIAOMI_HOST;
+  return new XiaomiPushSender({
+    appSecret,
+    packageName,
+    host,
+    ...options,
+  }).handler;
+}

package/src/index.js

@@ -17,6 +17,8 @@ import { registerAskCommand } from "./commands/ask.js";
 import { registerLlmCommand } from "./commands/llm.js";
 import { registerHubCommand } from "./commands/hub.js";
 import { registerAndroidCommand } from "./commands/android.js";
+import { registerEvalCommand } from "./commands/eval.js";
+import { registerTeamCommand } from "./commands/team.js";
 import {
   registerAgentCommand,
   registerSubAgentV2Command,
@@ -58,6 +60,7 @@ import { registerRCacheCommand } from "./commands/rcache.js";
 import { registerSessionCommand } from "./commands/session.js";
 import { registerCostCommand } from "./commands/cost.js";
 import { registerContextCommand } from "./commands/context.js";
+import { registerCodeIntelCommand } from "./commands/codeintel.js";
 import { registerCheckpointCommand } from "./commands/checkpoint.js";
 import { registerGoalCommand } from "./commands/goal.js";
 import { registerCommandCommand } from "./commands/command.js";
@@ -428,6 +431,8 @@ export function createProgram(opts = {}) {
   registerHubCommand(program);
   registerAndroidCommand(program);
   registerAgentCommand(program);
+  registerEvalCommand(program);
+  registerTeamCommand(program);
   registerSubAgentV2Command(program);
   registerExecBackendV2Command(program);
   registerTodoV2Command(program);
@@ -468,6 +473,7 @@ export function createProgram(opts = {}) {
   registerSessionCommand(program);
   registerCostCommand(program);
   registerContextCommand(program);
+  registerCodeIntelCommand(program);
   registerCheckpointCommand(program);
   registerGoalCommand(program);
   registerCommandCommand(program);

package/src/lib/agent-core.js

@@ -42,4 +42,6 @@ export {
   _toAnthropicMessages,
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,
+  _resetFileFreshness,
+  disposeSharedCodeIntel,
 } from "../runtime/agent-core.js";

package/src/lib/agent-sandbox.js

@@ -1,29 +1,107 @@
 /** OS-isolated shell execution for the coding agent. */
 import { spawnSync } from "node:child_process";
 import path from "node:path";
+import { proxyEnv } from "./sandbox-egress-proxy.js";
 
 export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
 export const _deps = { spawnSync };
 
+function stringList(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.map((entry) => String(entry || "").trim()).filter(Boolean),
+    ),
+  ];
+}
+
+function resolvePolicyPaths(entries, cwd) {
+  return stringList(entries).map((entry) => {
+    if (entry.startsWith("~/")) {
+      return path.resolve(
+        process.env.HOME || process.env.USERPROFILE || "",
+        entry.slice(2),
+      );
+    }
+    return path.resolve(cwd, entry);
+  });
+}
+
+export function normalizeSandboxPolicy(settings = {}, cwd = process.cwd()) {
+  const filesystem = settings.filesystem || {};
+  const network = settings.network || {};
+  return {
+    allowRead: resolvePolicyPaths(filesystem.allowRead, cwd),
+    denyRead: resolvePolicyPaths(filesystem.denyRead, cwd),
+    allowWrite: resolvePolicyPaths(filesystem.allowWrite, cwd),
+    denyWrite: resolvePolicyPaths(filesystem.denyWrite, cwd),
+    allowedDomains: stringList(network.allowedDomains),
+    deniedDomains: stringList(network.deniedDomains),
+    excludedCommands: stringList(settings.excludedCommands),
+    allowUnsandboxedCommands: settings.allowUnsandboxedCommands !== false,
+    failIfUnavailable: settings.failIfUnavailable === true,
+  };
+}
+
 export function normalizeAgentSandbox(value, options = {}) {
-  if (!value) return null;
+  const settings = options.settings || {};
+  if (!value && settings.enabled !== true) return null;
+  if (value === false || settings.enabled === false) return null;
   const image =
     typeof value === "string" && value.trim() && value !== "true"
       ? value.trim()
       : DEFAULT_SANDBOX_IMAGE;
   return {
-    engine: "docker",
-    image,
+    engine: settings.engine || "docker",
+    image: settings.image || image,
     cwd: path.resolve(options.cwd || process.cwd()),
-    network: options.network === true,
+    network: options.network === true || settings.network === true,
+    policy: normalizeSandboxPolicy(settings, options.cwd || process.cwd()),
   };
 }
 
 export function executeSandboxedShell(command, sandbox, options = {}) {
-  if (!sandbox || sandbox.engine !== "docker") {
+  if (!sandbox || !["docker", "bubblewrap"].includes(sandbox.engine)) {
     throw new Error("A supported agent sandbox configuration is required");
   }
   const hostCwd = path.resolve(options.cwd || sandbox.cwd);
+  const policy = sandbox.policy || normalizeSandboxPolicy({}, hostCwd);
+  // An egress proxy (see sandbox-egress-proxy.js) ENFORCES the domain allow/deny
+  // policy: the caller starts it and passes `{ env }` here, and the sandboxed
+  // process routes its HTTP(S) traffic through it. Without a proxy, a
+  // domain-restricted network request has no enforcement point, so we refuse
+  // rather than grant unrestricted access.
+  const egress = options.egressProxy || null;
+  if (
+    (policy.allowedDomains.length || policy.deniedDomains.length) &&
+    sandbox.network &&
+    !egress
+  ) {
+    return {
+      stdout: "",
+      stderr:
+        "Domain-restricted sandbox networking requires a configured sandbox proxy; refusing unrestricted network access",
+      exitCode: 1,
+      failedToStart: true,
+    };
+  }
+  if (sandbox.engine === "bubblewrap") {
+    return executeBubblewrapShell(command, sandbox, options, hostCwd, policy);
+  }
+  if (
+    policy.allowRead.length ||
+    policy.denyRead.length ||
+    policy.allowWrite.length ||
+    policy.denyWrite.length
+  ) {
+    return {
+      stdout: "",
+      stderr:
+        "The Docker sandbox backend cannot enforce fine-grained filesystem policy; use engine=bubblewrap",
+      exitCode: 1,
+      failedToStart: true,
+    };
+  }
   const args = ["run", "--rm", "--init"];
   if (!sandbox.network) args.push("--network", "none");
   args.push("--mount", `type=bind,source=${hostCwd},target=/workspace`);
@@ -31,6 +109,17 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   if (process.platform !== "win32" && process.getuid && process.getgid) {
     args.push("--user", `${process.getuid()}:${process.getgid()}`);
   }
+  // Route egress through the host proxy so the domain policy is enforced. The
+  // container reaches the host proxy via host.docker.internal (mapped to the
+  // gateway on Linux via host-gateway); the caller builds `egress.env` with that
+  // hostname (proxyEnv(port, "host.docker.internal")).
+  if (egress && egress.port && sandbox.network) {
+    args.push("--add-host", "host.docker.internal:host-gateway");
+    const penv = proxyEnv(egress.port, "host.docker.internal");
+    for (const [k, v] of Object.entries(penv)) {
+      args.push("--env", `${k}=${v}`);
+    }
+  }
   const env = options.env || {};
   for (const key of ["CLAUDECODE", "CC_SESSION_ID", "CLAUDE_CODE_SESSION_ID"]) {
     if (env[key] != null) args.push("--env", `${key}=${env[key]}`);
@@ -61,6 +150,65 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   };
 }
 
+function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
+  const args = [
+    "--die-with-parent",
+    "--new-session",
+    "--unshare-all",
+    "--ro-bind",
+    "/",
+    "/",
+    "--bind",
+    hostCwd,
+    hostCwd,
+    "--chdir",
+    hostCwd,
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+  ];
+  if (sandbox.network) args.push("--share-net");
+  for (const target of policy.allowWrite) args.push("--bind", target, target);
+  for (const target of policy.denyWrite) args.push("--ro-bind", target, target);
+  for (const target of policy.denyRead) args.push("--tmpfs", target);
+  args.push("--", "sh", "-lc", String(command || ""));
+  // bwrap `--share-net` shares the host network namespace, so the egress proxy
+  // is reachable at 127.0.0.1 directly — merge its env into the child's.
+  const egress = options.egressProxy || null;
+  const bwrapEnv =
+    egress && egress.port && sandbox.network
+      ? { ...(options.env || {}), ...proxyEnv(egress.port, "127.0.0.1") }
+      : options.env;
+  const result = _deps.spawnSync("bwrap", args, {
+    cwd: hostCwd,
+    env: bwrapEnv,
+    encoding: "utf8",
+    timeout: options.timeout,
+    maxBuffer: options.maxBuffer,
+    windowsHide: true,
+  });
+  if (result.error) {
+    return {
+      stdout: result.stdout || "",
+      stderr:
+        result.error.code === "ENOENT"
+          ? "bubblewrap is not installed"
+          : result.error.message,
+      exitCode: typeof result.status === "number" ? result.status : 1,
+      failedToStart: true,
+    };
+  }
+  return {
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: typeof result.status === "number" ? result.status : 1,
+    signal: result.signal || null,
+  };
+}
+
 export function sandboxSummary(sandbox) {
   if (!sandbox) return null;
   return {
@@ -68,5 +216,13 @@ export function sandboxSummary(sandbox) {
     image: sandbox.image,
     network: sandbox.network ? "enabled" : "disabled",
     workspace: "read-write",
+    policy: {
+      additionalReadPaths: sandbox.policy?.allowRead?.length || 0,
+      additionalWritePaths: sandbox.policy?.allowWrite?.length || 0,
+      networkRestricted:
+        Boolean(sandbox.policy?.allowedDomains?.length) ||
+        Boolean(sandbox.policy?.deniedDomains?.length),
+      failIfUnavailable: sandbox.policy?.failIfUnavailable === true,
+    },
   };
 }