chainlesschain 0.162.148 → 0.162.150

package/src/commands/plugin.js

@@ -495,6 +495,480 @@ export function registerPluginCommand(program) {
         process.exit(1);
       }
     });
+
+  // plugin validate — parse a plugin's unified manifest and report every
+  // component it contributes (skills/agents/hooks/mcp/lsp/monitors/bin/settings),
+  // plus path-traversal / schema problems. Optional signature/hash verification
+  // reuses the real crypto in plugin-security. No DB, no install — pure inspection.
+  plugin
+    .command("validate <dir>")
+    .description("Validate a plugin manifest and list its components")
+    .option("--sha256 <hex>", "Expected SHA-256 of the manifest file")
+    .option("--signature <path>", "Detached Ed25519 signature of the manifest")
+    .option("--public-key <path>", "Public key for signature verification")
+    .option("--json", "Output as JSON")
+    .action(async (dir, options) => {
+      const { parsePluginManifest, summarizeComponents } =
+        await import("../lib/plugin-runtime/manifest.js");
+      const manifest = parsePluginManifest(dir);
+
+      // Optional integrity/signature check on the manifest file itself.
+      // verifyPluginManifest THROWS on any mismatch/failure and returns a
+      // details object on success — so a caught error means verification failed.
+      let verification = null;
+      if (manifest.manifestPath && (options.sha256 || options.signature)) {
+        try {
+          const v = verifyPluginManifest({
+            manifestFile: manifest.manifestPath,
+            expectedSha256: options.sha256,
+            signatureFile: options.signature,
+            publicKeyFile: options.publicKey,
+          });
+          verification = {
+            ok: true,
+            sha256: v?.sha256 || null,
+            signatureVerified: v?.signatureVerified === true,
+          };
+        } catch (err) {
+          verification = { ok: false, reason: err.message };
+          manifest.ok = false;
+          manifest.errors.push(`manifest verification failed: ${err.message}`);
+        }
+      }
+
+      const counts = summarizeComponents(manifest);
+
+      if (options.json) {
+        console.log(
+          JSON.stringify(
+            { ...manifest, componentCounts: counts, verification },
+            null,
+            2,
+          ),
+        );
+        if (!manifest.ok) process.exitCode = 1;
+        return;
+      }
+
+      const m = manifest.metadata || {};
+      logger.log(
+        chalk.bold(`Plugin: `) +
+          `${chalk.cyan(m.name || "(no name)")} ${chalk.gray("v" + (m.version || "?"))}`,
+      );
+      if (m.description) logger.log(chalk.gray("  " + m.description));
+      logger.log(
+        chalk.gray(`  manifest: ${manifest.manifestPath || "(none)"}`),
+      );
+      logger.log(chalk.bold("\nComponents:"));
+      for (const [kind, n] of Object.entries(counts)) {
+        const mark = n > 0 ? chalk.green(String(n)) : chalk.gray("0");
+        logger.log(`  ${kind.padEnd(10)} ${mark}`);
+      }
+      if (verification) {
+        logger.log(
+          chalk.bold("\nVerification: ") +
+            (verification.ok ? chalk.green("passed") : chalk.red("FAILED")),
+        );
+      }
+      for (const w of manifest.warnings) logger.log(chalk.yellow(`  ⚠ ${w}`));
+      for (const e of manifest.errors) logger.log(chalk.red(`  ✖ ${e}`));
+      if (manifest.ok) {
+        logger.success("\nManifest is valid.");
+      } else {
+        logger.error("\nManifest is INVALID.");
+        process.exitCode = 1;
+      }
+    });
+
+  // ── unified plugin runtime install lifecycle (Phase 3) ──
+  // These operate on the scope version dirs (user/project/local), independent
+  // of the legacy DB-backed `install/list/remove` above. A plugin installed
+  // here has its skills/hooks/lsp components picked up by the agent.
+
+  const SCOPES = "user|project|local";
+
+  // plugin add <source> — install from a local dir, git URL, owner/repo, or a
+  // remote registry/manifest URL (with --name to pick from a multi-plugin index)
+  plugin
+    .command("add <source>")
+    .description(
+      `Install a plugin from a local dir, git URL, owner/repo[#ref], or registry URL (scope: ${SCOPES})`,
+    )
+    .option("--scope <scope>", "Install scope (user|project|local)", "user")
+    .option("--force", "Reinstall over an existing immutable version")
+    .option("--sha256 <hex>", "Expected SHA-256 of the manifest file")
+    .option("--signature <path>", "Detached Ed25519 signature of the manifest")
+    .option("--public-key <path>", "Public key for signature verification")
+    .option(
+      "--registry <url>",
+      "Resolve <source> as a plugin NAME in this registry URL",
+    )
+    .option(
+      "--name <plugin>",
+      "Plugin name to select from a multi-plugin registry",
+    )
+    .option("--token <token>", "Bearer token for a private registry")
+    .option("--json", "Output as JSON")
+    .action(async (source, options) => {
+      const { installFromSource } =
+        await import("../lib/plugin-runtime/install.js");
+
+      // Remote resolution: a registry/manifest URL (or --registry <url> with a
+      // plugin name) resolves to a git source the installer already handles.
+      let installSource = source;
+      let integritySha = null;
+      const { isRemoteSource, resolveRemoteSource } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      if (options.registry || isRemoteSource(source)) {
+        const url = options.registry || source;
+        // With --registry the positional arg is the plugin NAME; otherwise the
+        // URL is positional and --name selects.
+        const name = options.registry ? source : options.name;
+        let config = null;
+        try {
+          ({ loadConfig: config } = await import("../lib/config-manager.js"));
+          config = config();
+        } catch {
+          config = null; // config is optional — token can come from --token/env
+        }
+        try {
+          const resolved = await resolveRemoteSource(url, {
+            name,
+            token: options.token,
+            config,
+          });
+          installSource = resolved.source;
+          integritySha = resolved.sha256;
+          if (resolved.fromCache) {
+            logger.warn(
+              chalk.yellow(
+                "  ⚠ registry unreachable — using cached copy (offline)",
+              ),
+            );
+          }
+        } catch (err) {
+          logger.error(`Registry resolution failed: ${err.message}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
+
+      const signature =
+        options.sha256 || options.signature || options.publicKey || integritySha
+          ? {
+              sha256: options.sha256 || integritySha,
+              signatureFile: options.signature,
+              publicKeyFile: options.publicKey,
+              requireSignature: Boolean(options.signature),
+            }
+          : null;
+      try {
+        const res = installFromSource(installSource, {
+          scope: options.scope,
+          cwd: process.cwd(),
+          force: options.force === true,
+          signature,
+        });
+        if (options.json) {
+          console.log(JSON.stringify(res, null, 2));
+        } else {
+          logger.success(
+            `Installed ${res.name} v${res.version} (${res.scope} scope)` +
+              (res.signatureVerified ? chalk.green(" ✔ signed") : ""),
+          );
+          logger.log(chalk.gray(`  → ${res.dir}`));
+          for (const w of res.warnings || [])
+            logger.log(chalk.yellow(`  ⚠ ${w}`));
+        }
+      } catch (err) {
+        logger.error(`Install failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  // plugin browse — browse the plugins offered by a remote registry (discovery)
+  plugin
+    .command("browse [query]")
+    .description(
+      "List plugins in a remote registry (--registry <url>); filter by [query]",
+    )
+    .requiredOption("--registry <url>", "Registry/manifest URL to browse")
+    .option("--token <token>", "Bearer token for a private registry")
+    .option("--json", "Output as JSON")
+    .action(async (query, options) => {
+      const { fetchRegistry, listRegistryPlugins, resolveRegistryToken } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      let config = null;
+      try {
+        const cm = await import("../lib/config-manager.js");
+        config = cm.loadConfig();
+      } catch {
+        config = null;
+      }
+      try {
+        const token = resolveRegistryToken(options.registry, {
+          token: options.token,
+          config,
+        });
+        const { registry, fromCache } = await fetchRegistry(options.registry, {
+          token,
+        });
+        let rows = listRegistryPlugins(registry);
+        if (query) {
+          const q = query.toLowerCase();
+          rows = rows.filter(
+            (r) =>
+              r.name.toLowerCase().includes(q) ||
+              (r.description || "").toLowerCase().includes(q),
+          );
+        }
+        if (options.json) {
+          console.log(JSON.stringify({ fromCache, plugins: rows }, null, 2));
+          return;
+        }
+        if (fromCache) {
+          logger.warn(
+            chalk.yellow(
+              "  ⚠ registry unreachable — showing cached copy (offline)",
+            ),
+          );
+        }
+        if (rows.length === 0) {
+          logger.info("No matching plugins in this registry.");
+          return;
+        }
+        logger.log(chalk.bold(`Plugins (${rows.length}):`));
+        for (const r of rows) {
+          const ver = r.version ? chalk.gray(` v${r.version}`) : "";
+          logger.log(
+            `  ${chalk.cyan(r.name)}${ver}  ${chalk.gray(r.description || r.source)}`,
+          );
+        }
+        logger.log(
+          chalk.gray(
+            `\nInstall with: cc plugin add <name> --registry ${options.registry}`,
+          ),
+        );
+      } catch (err) {
+        logger.error(`Registry search failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  // plugin installed — list runtime-installed plugins across scopes
+  plugin
+    .command("installed")
+    .description("List plugins installed in the unified runtime (scope dirs)")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      const { listInstalled } =
+        await import("../lib/plugin-runtime/install.js");
+      const rows = listInstalled({ cwd: process.cwd() });
+      if (options.json) {
+        console.log(JSON.stringify(rows, null, 2));
+        return;
+      }
+      if (rows.length === 0) {
+        logger.info("No plugins installed. Add one with: cc plugin add <dir>");
+        return;
+      }
+      const { isPluginTrusted } =
+        await import("../lib/plugin-runtime/trust.js");
+      logger.log(chalk.bold(`Installed plugins (${rows.length}):`));
+      for (const r of rows) {
+        const ok = r.ok ? chalk.green("✔") : chalk.red("✖");
+        const trust = isPluginTrusted(r)
+          ? chalk.green("trusted")
+          : chalk.yellow("untrusted");
+        logger.log(
+          `  ${ok} ${chalk.cyan(r.name)} v${r.version} ${chalk.gray(`[${r.scope}]`)} ${trust}`,
+        );
+      }
+    });
+
+  // plugin trust <name> — allow a plugin's code-bearing components to run
+  plugin
+    .command("trust <name>")
+    .description("Trust a plugin so its hooks / LSP servers may run")
+    .option("--scope <scope>", "Scope of the plugin", "project")
+    .option("--list", "List all trusted plugins instead")
+    .action(async (name, options) => {
+      const { trustPlugin, listTrust } =
+        await import("../lib/plugin-runtime/trust.js");
+      const { getActiveVersion } =
+        await import("../lib/plugin-runtime/install.js");
+      if (options.list) {
+        for (const t of listTrust()) {
+          logger.log(`  ${chalk.cyan(t.name)} v${t.version} [${t.scope}]`);
+        }
+        return;
+      }
+      const version = getActiveVersion(name, {
+        scope: options.scope,
+        cwd: process.cwd(),
+      });
+      if (!version) {
+        logger.error(`${name} is not installed at ${options.scope} scope`);
+        process.exitCode = 1;
+        return;
+      }
+      trustPlugin(name, { scope: options.scope, version });
+      logger.success(`Trusted ${name} v${version} (${options.scope} scope)`);
+    });
+
+  // plugin untrust <name> — revoke trust
+  plugin
+    .command("untrust <name>")
+    .description(
+      "Revoke trust for a plugin (its hooks / LSP servers stop running)",
+    )
+    .option("--scope <scope>", "Scope of the plugin", "project")
+    .action(async (name, options) => {
+      const { untrustPlugin } = await import("../lib/plugin-runtime/trust.js");
+      const res = untrustPlugin(name, { scope: options.scope });
+      if (res.removed) {
+        logger.success(`Revoked trust for ${name} (${options.scope} scope)`);
+      } else {
+        logger.info(`${name} was not trusted at ${options.scope} scope`);
+      }
+    });
+
+  // plugin monitors — list (and optionally run) trusted plugins' background
+  // monitors. `--run --seconds N` actually starts the supervisor for N seconds,
+  // prints captured output, then reaps everything (verifies no leaked process).
+  plugin
+    .command("monitors")
+    .description("List installed plugins' background monitors (trusted only)")
+    .option("--json", "Output as JSON")
+    .option("--run", "Actually run the monitors for a few seconds, then reap")
+    .option("--seconds <n>", "With --run: how long to run", "3")
+    .action(async (options) => {
+      const { collectPluginMonitors } =
+        await import("../lib/plugin-runtime/monitors.js");
+      const monitors = collectPluginMonitors({ cwd: process.cwd() });
+      if (options.json && !options.run) {
+        console.log(JSON.stringify(monitors, null, 2));
+        return;
+      }
+      if (monitors.length === 0) {
+        logger.info(
+          "No monitors from trusted plugins. (Untrusted project plugins are skipped — `cc plugin trust <name>`.)",
+        );
+        return;
+      }
+      logger.log(chalk.bold(`Plugin monitors (${monitors.length}):`));
+      for (const m of monitors) {
+        const cadence =
+          m.mode === "interval"
+            ? `every ${m.intervalMs || 60000}ms`
+            : "long-running";
+        logger.log(
+          `  ${chalk.cyan(m.id)} ${chalk.gray(`[${m.scope}]`)} ${m.command} ${m.args.join(" ")} ${chalk.gray(`(${cadence})`)}`,
+        );
+      }
+      if (!options.run) return;
+
+      const { PluginMonitorSupervisor } =
+        await import("../lib/plugin-monitor-supervisor.js");
+      const secs = Math.max(1, parseInt(options.seconds, 10) || 3);
+      const sup = new PluginMonitorSupervisor();
+      const started = sup.start(monitors);
+      logger.log(
+        chalk.gray(`\nRunning ${started.length} monitor(s) for ${secs}s…`),
+      );
+      await new Promise((r) => setTimeout(r, secs * 1000));
+      const out = sup.drainOutputs();
+      sup.stopAll();
+      logger.log(chalk.bold(`Captured ${out.length} output line(s):`));
+      for (const rec of out.slice(0, 50)) {
+        logger.log(
+          `  ${chalk.gray(`[${rec.monitor}/${rec.stream}]`)} ${rec.line}`,
+        );
+      }
+      logger.success("Monitors reaped — no process left running.");
+    });
+
+  // plugin uninstall <name> — remove a plugin (or one version) from a scope
+  plugin
+    .command("uninstall <name>")
+    .description(`Uninstall a runtime plugin from a scope (${SCOPES})`)
+    .option("--scope <scope>", "Scope to remove from", "user")
+    .option("--version <version>", "Remove only this version (default: all)")
+    .action(async (name, options) => {
+      const { uninstall } = await import("../lib/plugin-runtime/install.js");
+      try {
+        const res = uninstall(name, {
+          scope: options.scope,
+          cwd: process.cwd(),
+          version: options.version,
+        });
+        logger.success(
+          `Uninstalled ${name} (${res.removed.join(", ") || "nothing"}) from ${options.scope} scope`,
+        );
+      } catch (err) {
+        logger.error(`Uninstall failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  // plugin upgrade <source> — re-fetch a source and install its newer version
+  plugin
+    .command("upgrade <source>")
+    .description(
+      "Update a runtime plugin from its source (local dir or git); repoints .active",
+    )
+    .option("--scope <scope>", `Scope to update in (${SCOPES})`, "user")
+    .option("--force", "Reinstall even if the version is unchanged")
+    .action(async (source, options) => {
+      const { updatePlugin } = await import("../lib/plugin-runtime/install.js");
+      try {
+        const res = updatePlugin(source, {
+          scope: options.scope,
+          cwd: process.cwd(),
+          force: options.force,
+        });
+        if (res.updated) {
+          logger.success(
+            `Updated ${res.name}: ${res.previousVersion ? `v${res.previousVersion} → ` : ""}v${res.version} (${options.scope} scope)`,
+          );
+        } else if (res.reinstalled) {
+          logger.success(
+            `Reinstalled ${res.name} v${res.version} (${options.scope} scope)`,
+          );
+        } else {
+          logger.info(
+            `${res.name} is already up to date at v${res.version} (use --force to reinstall)`,
+          );
+        }
+      } catch (err) {
+        logger.error(`Upgrade failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  // plugin use <name> <version> — pin the active version (rollback / switch)
+  plugin
+    .command("use <name> <version>")
+    .description("Pin a plugin's active version (rollback or switch)")
+    .option("--scope <scope>", "Scope", "user")
+    .action(async (name, version, options) => {
+      const { setActiveVersion } =
+        await import("../lib/plugin-runtime/install.js");
+      try {
+        setActiveVersion(name, version, {
+          scope: options.scope,
+          cwd: process.cwd(),
+        });
+        logger.success(
+          `${name} active version → v${version} (${options.scope} scope)`,
+        );
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  return plugin;
 }
 
 // === Iter26 V2 governance overlay ===

package/src/commands/pqc.js

@@ -8,6 +8,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensurePQCTables,
+  loadFromDb,
   listKeys,
   generateKey,
   getMigrationStatus,
@@ -64,6 +65,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const keys = listKeys({ algorithm: options.algorithm });
         if (options.json) {
@@ -103,6 +105,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const key = generateKey(db, algorithm, options.purpose);
         logger.success("PQC key generated");
@@ -136,6 +139,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const plans = getMigrationStatus();
         if (options.json) {
@@ -204,6 +208,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const plan = migrate(db, planName, options.source, targetAlgorithm);
         logger.success("Migration completed");

package/src/commands/reputation.js

@@ -9,6 +9,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureReputationTables,
+  loadFromDb as loadReputationFromDb,
   addObservation,
   computeScore,
   listScores,
@@ -44,6 +45,10 @@ function _dbFromCtx(ctx) {
   }
   const db = ctx.db.getDatabase();
   ensureReputationTables(db);
+  // Rehydrate the observation/run/analytics Maps from the reputation_* tables —
+  // without this every read is Map-only-empty in the fresh CLI process (scores
+  // read back 0, `status <runId>` throws "Optimization run not found").
+  loadReputationFromDb(db);
   return db;
 }
 
@@ -165,7 +170,11 @@ export function registerReputationCommand(program) {
       "Detection method (z_score|iqr)",
       "z_score",
     )
-    .option("-t, --threshold <n>", "Detection threshold", floatArg("--threshold"))
+    .option(
+      "-t, --threshold <n>",
+      "Detection threshold",
+      floatArg("--threshold"),
+    )
     .option(
       "-d, --decay <model>",
       "Decay model applied before detection",

package/src/commands/scim.js

@@ -9,6 +9,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureSCIMTables,
+  loadFromDb as loadScimFromDb,
   listUsers,
   createUser,
   getUser,
@@ -73,6 +74,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const result = listUsers();
         if (options.json) {
@@ -108,6 +110,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const user = createUser(db, username, options.name, options.email);
         logger.success("User created");
@@ -134,6 +137,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const user = getUser(userId);
         if (!user) {
@@ -168,6 +172,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         deleteUser(db, userId);
         logger.success(`User ${chalk.cyan(userId.slice(0, 8))} deleted`);
@@ -216,6 +221,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const result = syncProvision(db, connectorId);
         logger.success(`Sync completed via ${chalk.cyan(result.connector)}`);

package/src/commands/session.js

@@ -61,6 +61,36 @@ import {
   readWorkflowSession,
 } from "../lib/workflow-state-reader.js";
 
+// DB sessions store `updated_at` as SQLite datetime('now') → "YYYY-MM-DD
+// HH:MM:SS" (UTC, space at index 10); JSONL sessions store toISOString() →
+// "YYYY-MM-DDTHH:MM:SS.sssZ" (UTC, 'T' at index 10). Both are UTC, so normalize
+// the space form to ISO-UTC and compare as epochs — a raw string compare
+// resolves at index 10 ('T' 0x54 > ' ' 0x20) and would rank every JSONL session
+// as newer than any same-date DB session regardless of the actual time.
+function _sessionEpoch(ts) {
+  if (typeof ts !== "string" || !ts) return 0;
+  const iso =
+    ts.includes(" ") && !ts.includes("T") ? ts.replace(" ", "T") + "Z" : ts;
+  const n = Date.parse(iso);
+  return Number.isFinite(n) ? n : 0;
+}
+
+export function rankSessions(sessions, limit) {
+  // Dedup by id, preferring the JSONL copy when a session exists in both stores
+  // (the original "JSONL takes precedence" intent, previously achieved only as
+  // a side effect of the buggy lexicographic sort). Then rank by real time.
+  const byId = new Map();
+  for (const s of sessions) {
+    const prev = byId.get(s.id);
+    if (!prev || (s._store === "jsonl" && prev._store !== "jsonl")) {
+      byId.set(s.id, s);
+    }
+  }
+  return [...byId.values()]
+    .sort((a, b) => _sessionEpoch(b.updated_at) - _sessionEpoch(a.updated_at))
+    .slice(0, limit);
+}
+
 export function registerSessionCommand(program) {
   const session = program
     .command("session")
@@ -98,16 +128,8 @@ export function registerSessionCommand(program) {
           );
         }
 
-        // Deduplicate by id (JSONL takes precedence), sort by updated_at
-        const seen = new Set();
-        sessions = sessions
-          .sort((a, b) => (b.updated_at > a.updated_at ? 1 : -1))
-          .filter((s) => {
-            if (seen.has(s.id)) return false;
-            seen.add(s.id);
-            return true;
-          })
-          .slice(0, limit);
+        // Deduplicate by id (JSONL takes precedence) and rank by real time.
+        sessions = rankSessions(sessions, limit);
 
         if (options.json) {
           console.log(JSON.stringify(sessions, null, 2));