chainlesschain 0.162.148 → 0.162.150

package/src/lib/nostr-bridge.js

@@ -59,6 +59,59 @@ export function ensureNostrTables(db) {
   `);
 }
 
+/**
+ * Rehydrate the module-level _relays/_events Maps from the persisted
+ * nostr_relays/nostr_events tables. The `cc` CLI runs every command in a
+ * fresh process, so without this the Maps are empty on read and a relay/event
+ * added in a prior invocation is invisible (`cc nostr relays`/`events` show
+ * nothing; `dm-decrypt` can't find the DM). Call after ensureNostrTables(db).
+ * (_keypairs/_didMappings are intentionally ephemeral — no DB table.)
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _relays.clear();
+  _events.clear();
+
+  const relayRows = db.prepare(`SELECT * FROM nostr_relays`).all();
+  for (const row of relayRows) {
+    _relays.set(row.id, {
+      id: row.id,
+      url: row.url,
+      status: row.status,
+      lastConnected: row.last_connected ?? null,
+      eventCount: row.event_count ?? 0,
+      readEnabled: !!row.read_enabled,
+      writeEnabled: !!row.write_enabled,
+    });
+  }
+
+  const eventRows = db.prepare(`SELECT * FROM nostr_events`).all();
+  for (const row of eventRows) {
+    let tags = [];
+    try {
+      tags = row.tags ? JSON.parse(row.tags) : [];
+    } catch {
+      tags = [];
+    }
+    _events.set(row.id, {
+      id: row.id,
+      pubkey: row.pubkey,
+      kind: row.kind,
+      content: row.content,
+      tags,
+      sig: row.sig ?? "",
+      // write side stores createdAt as unix seconds; the column is an ISO
+      // string — convert back so the two process paths agree.
+      createdAt: row.created_at
+        ? Math.floor(new Date(row.created_at).getTime() / 1000)
+        : null,
+      relayUrl: row.relay_url ?? null,
+    });
+  }
+
+  return _relays.size + _events.size;
+}
+
 /* ── Relay Management ─────────────────────────────────────── */
 
 export function listRelays() {

package/src/lib/permission-engine.js

@@ -275,6 +275,24 @@ export function revokePermission(db, userDid, permission) {
   return result.changes > 0;
 }
 
+/**
+ * Is a grant still active given its stored `expires_at`?
+ *
+ * The previous check compared `expires_at > now` as ISO STRINGS. That is
+ * fail-open on unvalidated input: an unpadded date ("2026-7-5") or any
+ * non-numeric-leading garbage ("next year") sorts lexicographically AFTER a
+ * canonical `now` ('7'/'n' > '0'/'2'), so an already-expired or malformed
+ * time-limited grant silently became a PERMANENT grant. Compare numerically and
+ * treat an unparseable expiry as expired (fail closed) so a typo can never widen
+ * access. A null/empty `expires_at` means no expiry.
+ */
+function _grantActive(expiresAt, nowMs) {
+  if (!expiresAt) return true;
+  const t = Date.parse(expiresAt);
+  if (Number.isNaN(t)) return false;
+  return t > nowMs;
+}
+
 /**
  * Get all roles and direct permissions for a user.
  */
@@ -287,15 +305,15 @@ export function getUserPermissions(db, userDid) {
     .all(userDid);
 
   // Filter out expired grants
-  const now = new Date().toISOString();
-  const grants = allGrants.filter((g) => !g.expires_at || g.expires_at > now);
+  const nowMs = Date.now();
+  const grants = allGrants.filter((g) => _grantActive(g.expires_at, nowMs));
 
   // Get direct permissions (not expired)
   const allDirectPerms = db
     .prepare("SELECT * FROM rbac_direct_permissions WHERE user_did = ?")
     .all(userDid);
-  const directPerms = allDirectPerms.filter(
-    (d) => !d.expires_at || d.expires_at > now,
+  const directPerms = allDirectPerms.filter((d) =>
+    _grantActive(d.expires_at, nowMs),
   );
 
   // Collect all permissions by looking up each role

package/src/lib/plugin-monitor-supervisor.js

@@ -0,0 +1,238 @@
+/**
+ * PluginMonitorSupervisor — runs installed plugins' background monitors
+ * (Phase 3.3i / Phase 6 down payment). Two modes:
+ *
+ *   - longRunning: spawn the command ONCE and keep it alive (e.g. `tail -f`).
+ *   - interval:    re-run the command every `intervalMs`, capturing each run's
+ *                  output (e.g. a periodic health/log check).
+ *
+ * Captured stdout/stderr lines are buffered as structured records; the agent
+ * loop can `drainOutputs()` them and inject them into the next turn's context
+ * (Phase 6: "后台结果可在下一轮注入 additionalContext"). The supervisor owns
+ * its children and reaps ALL of them on `stopAll()` plus a `process.once('exit')`
+ * backstop, so no monitor process leaks past session end.
+ *
+ * Guardrails (Phase 6 "去重、并发上限、超时、进程回收"): a per-monitor id
+ * dedupes double-starts, `maxConcurrent` caps simultaneous interval runs, and
+ * `timeoutMs` kills a hung interval run. Commands run with shell:false (argv,
+ * never a shell string) — no injection.
+ *
+ * spawn is injected via `_deps` so the whole thing is unit-testable without
+ * real processes.
+ */
+
+import { spawn } from "node:child_process";
+
+export const _deps = { spawn };
+
+const DEFAULT_INTERVAL_MS = 60_000;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_CONCURRENT = 8;
+const OUTPUT_RING = 200; // max buffered output records before dropping oldest
+
+export class PluginMonitorSupervisor {
+  constructor(opts = {}) {
+    this.maxConcurrent = opts.maxConcurrent || DEFAULT_MAX_CONCURRENT;
+    this.defaultIntervalMs = opts.defaultIntervalMs || DEFAULT_INTERVAL_MS;
+    this.timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
+    this._spawn = opts.spawn || _deps.spawn;
+    // id -> { desc, timer?, child?, running }
+    this._monitors = new Map();
+    this._outputs = []; // structured records awaiting drain
+    this._runningIntervalRuns = 0;
+    this._stopped = false;
+    this._exitHook = () => this.stopAll();
+    this._exitHookInstalled = false;
+  }
+
+  /** True when at least one monitor is registered and not stopped. */
+  get size() {
+    return this._monitors.size;
+  }
+
+  /**
+   * Start a batch of monitor descriptors (from collectPluginMonitors). Skips a
+   * monitor whose id is already running (dedupe). Returns the ids started.
+   * @param {Array<object>} monitors
+   * @returns {string[]} ids actually started
+   */
+  start(monitors = []) {
+    if (this._stopped) return [];
+    const started = [];
+    for (const desc of monitors) {
+      if (!desc || !desc.id) continue;
+      if (this._monitors.has(desc.id)) continue; // dedupe double-start
+      const entry = { desc, timer: null, child: null, running: false };
+      this._monitors.set(desc.id, entry);
+      if (desc.mode === "longRunning") {
+        this._spawnLongRunning(entry);
+      } else {
+        // interval: run once immediately, then on a cadence.
+        const ms = desc.intervalMs || this.defaultIntervalMs;
+        this._runIntervalOnce(entry);
+        entry.timer = setInterval(() => this._runIntervalOnce(entry), ms);
+        if (typeof entry.timer.unref === "function") entry.timer.unref();
+      }
+      started.push(desc.id);
+    }
+    if (started.length > 0) this._installExitHook();
+    return started;
+  }
+
+  _installExitHook() {
+    if (this._exitHookInstalled) return;
+    this._exitHookInstalled = true;
+    // Backstop: if the caller forgets stopAll(), reap on process exit so no
+    // monitor process outlives the session.
+    process.once("exit", this._exitHook);
+  }
+
+  _record(desc, stream, text) {
+    const lines = String(text)
+      .split(/\r?\n/)
+      .filter((l) => l.length > 0);
+    for (const line of lines) {
+      this._outputs.push({
+        id: desc.id,
+        plugin: desc.plugin,
+        monitor: desc.name,
+        stream,
+        line,
+      });
+      if (this._outputs.length > OUTPUT_RING) this._outputs.shift();
+    }
+  }
+
+  _spawnLongRunning(entry) {
+    const { desc } = entry;
+    let child;
+    try {
+      child = this._spawn(desc.command, desc.args, {
+        cwd: desc.cwd,
+        env: desc.env ? { ...process.env, ...desc.env } : process.env,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (err) {
+      this._record(desc, "error", `spawn failed: ${err.message}`);
+      return;
+    }
+    entry.child = child;
+    child.stdout?.on("data", (d) =>
+      this._record(desc, "stdout", d.toString("utf8")),
+    );
+    child.stderr?.on("data", (d) =>
+      this._record(desc, "stderr", d.toString("utf8")),
+    );
+    child.on("error", (err) => this._record(desc, "error", err.message));
+    child.on("exit", (code) => {
+      entry.child = null;
+      this._record(desc, "exit", `longRunning monitor exited (code ${code})`);
+    });
+  }
+
+  _runIntervalOnce(entry) {
+    const { desc } = entry;
+    if (this._stopped) return;
+    if (entry.running) return; // previous run still in flight — skip this tick
+    if (this._runningIntervalRuns >= this.maxConcurrent) return; // cap
+    entry.running = true;
+    this._runningIntervalRuns++;
+    let child;
+    try {
+      child = this._spawn(desc.command, desc.args, {
+        cwd: desc.cwd,
+        env: desc.env ? { ...process.env, ...desc.env } : process.env,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (err) {
+      this._record(desc, "error", `spawn failed: ${err.message}`);
+      entry.running = false;
+      this._runningIntervalRuns--;
+      return;
+    }
+    entry.child = child;
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      if (killTimer) clearTimeout(killTimer);
+      entry.child = null;
+      entry.running = false;
+      this._runningIntervalRuns--;
+    };
+    const killTimer = setTimeout(() => {
+      this._record(
+        desc,
+        "error",
+        `interval run timed out after ${this.timeoutMs}ms`,
+      );
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        /* already gone */
+      }
+    }, this.timeoutMs);
+    if (typeof killTimer.unref === "function") killTimer.unref();
+    child.stdout?.on("data", (d) =>
+      this._record(desc, "stdout", d.toString("utf8")),
+    );
+    child.stderr?.on("data", (d) =>
+      this._record(desc, "stderr", d.toString("utf8")),
+    );
+    child.on("error", (err) => {
+      this._record(desc, "error", err.message);
+      finish();
+    });
+    child.on("exit", () => finish());
+  }
+
+  /**
+   * Take and clear all buffered monitor output records (for injection into the
+   * next agent turn). Returns [] when nothing has been captured.
+   */
+  drainOutputs() {
+    const out = this._outputs;
+    this._outputs = [];
+    return out;
+  }
+
+  /** Peek at buffered output without clearing it. */
+  peekOutputs() {
+    return this._outputs.slice();
+  }
+
+  /** Ids of every registered monitor. */
+  ids() {
+    return [...this._monitors.keys()];
+  }
+
+  /**
+   * Stop and reap EVERYTHING: clear interval timers, kill all children. Safe to
+   * call more than once. After this, `start` is a no-op.
+   */
+  stopAll() {
+    this._stopped = true;
+    for (const entry of this._monitors.values()) {
+      if (entry.timer) {
+        clearInterval(entry.timer);
+        entry.timer = null;
+      }
+      if (entry.child) {
+        try {
+          entry.child.kill("SIGTERM");
+        } catch {
+          /* already gone */
+        }
+        entry.child = null;
+      }
+    }
+    this._monitors.clear();
+    this._runningIntervalRuns = 0;
+    if (this._exitHookInstalled) {
+      process.removeListener("exit", this._exitHook);
+      this._exitHookInstalled = false;
+    }
+  }
+}

package/src/lib/plugin-runtime/__tests__/remote-source.test.js

@@ -0,0 +1,256 @@
+/**
+ * remote-source tests — resolving a plugin from a hosted registry/manifest URL,
+ * with private-token auth and an offline cache. `fetch` and fs are injected via
+ * `_deps` so nothing hits the network or the real disk.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  isRemoteSource,
+  validateRegistry,
+  resolvePluginEntry,
+  listRegistryPlugins,
+  resolveRegistryToken,
+  fetchRegistry,
+  resolveRemoteSource,
+  registryCachePath,
+  _deps,
+} from "../remote-source.js";
+
+const REGISTRY = {
+  name: "acme",
+  plugins: [
+    {
+      name: "toml-tools",
+      source: "https://github.com/x/toml.git",
+      ref: "v1.0.0",
+      version: "1.0.0",
+      description: "TOML LSP",
+      sha256: "abc123",
+    },
+    { name: "py-helpers", source: "owner/py-helpers" },
+  ],
+};
+
+/** A fake in-memory fs + fetch wired into _deps. */
+function install(fakes = {}) {
+  const files = new Map(fakes.files || []);
+  _deps.existsSync = (p) => files.has(String(p));
+  _deps.readFileSync = (p) => {
+    if (!files.has(String(p))) throw new Error("ENOENT");
+    return files.get(String(p));
+  };
+  _deps.writeFileSync = (p, text) => files.set(String(p), text);
+  _deps.mkdirSync = () => {};
+  if (fakes.fetch) _deps.fetch = fakes.fetch;
+  return files;
+}
+
+/** Build a fetch that returns JSON once, then throws (to test caching). */
+function okThenOffline(body) {
+  let calls = 0;
+  return vi.fn(async () => {
+    calls++;
+    if (calls === 1) {
+      return { ok: true, status: 200, text: async () => JSON.stringify(body) };
+    }
+    throw new Error("ECONNREFUSED");
+  });
+}
+
+let orig;
+beforeEach(() => {
+  orig = { ..._deps };
+  delete process.env.CC_PLUGIN_REGISTRY_TOKEN;
+});
+afterEach(() => {
+  Object.assign(_deps, orig);
+  vi.restoreAllMocks();
+  delete process.env.CC_PLUGIN_REGISTRY_TOKEN;
+});
+
+describe("isRemoteSource", () => {
+  it("recognizes http(s) .json URLs", () => {
+    expect(isRemoteSource("https://x.com/registry.json")).toBe(true);
+    expect(isRemoteSource("http://x.com/a/b.json?ref=1")).toBe(true);
+  });
+  it("rejects local dirs, git URLs, and owner/repo", () => {
+    expect(isRemoteSource("./plugins/foo")).toBe(false);
+    expect(isRemoteSource("https://github.com/x/foo.git")).toBe(false);
+    expect(isRemoteSource("owner/repo")).toBe(false);
+  });
+});
+
+describe("validateRegistry", () => {
+  it("accepts a multi-plugin index", () => {
+    expect(validateRegistry(REGISTRY).plugins).toHaveLength(2);
+  });
+  it("wraps a single-plugin manifest into a one-entry registry", () => {
+    const r = validateRegistry({
+      name: "solo",
+      source: "owner/solo",
+      ref: "v2",
+    });
+    expect(r.plugins).toEqual([
+      { name: "solo", source: "owner/solo", ref: "v2" },
+    ]);
+  });
+  it("rejects garbage and entries missing name/source", () => {
+    expect(() => validateRegistry(null)).toThrow(/not a JSON object/);
+    expect(() => validateRegistry({ foo: 1 })).toThrow(
+      /plugins.*array.*source/,
+    );
+    expect(() => validateRegistry({ plugins: [{ name: "x" }] })).toThrow(
+      /missing name\/source/,
+    );
+  });
+});
+
+describe("resolvePluginEntry", () => {
+  it("selects by name", () => {
+    expect(resolvePluginEntry(REGISTRY, "py-helpers").source).toBe(
+      "owner/py-helpers",
+    );
+  });
+  it("auto-selects the sole plugin when name omitted", () => {
+    const solo = { plugins: [REGISTRY.plugins[0]] };
+    expect(resolvePluginEntry(solo).name).toBe("toml-tools");
+  });
+  it("requires a name when the registry has many", () => {
+    expect(() => resolvePluginEntry(REGISTRY)).toThrow(/pick one with --name/);
+  });
+  it("lists options when the name is unknown", () => {
+    expect(() => resolvePluginEntry(REGISTRY, "nope")).toThrow(
+      /not found.*toml-tools, py-helpers/s,
+    );
+  });
+});
+
+describe("resolveRegistryToken", () => {
+  it("prefers an explicit token, then env, then per-host config", () => {
+    expect(
+      resolveRegistryToken("https://h/r.json", { token: "explicit" }),
+    ).toBe("explicit");
+    process.env.CC_PLUGIN_REGISTRY_TOKEN = "envtok";
+    expect(resolveRegistryToken("https://h/r.json", {})).toBe("envtok");
+    delete process.env.CC_PLUGIN_REGISTRY_TOKEN;
+    const config = { plugins: { registryTokens: { "priv.co": "cfgtok" } } };
+    expect(resolveRegistryToken("https://priv.co/r.json", { config })).toBe(
+      "cfgtok",
+    );
+    expect(
+      resolveRegistryToken("https://other.co/r.json", { config }),
+    ).toBeNull();
+  });
+});
+
+describe("fetchRegistry", () => {
+  it("fetches, validates, and caches; sends a bearer token when given", async () => {
+    const fetch = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify(REGISTRY),
+    }));
+    install({ fetch });
+    const { registry, fromCache } = await fetchRegistry("https://h/r.json", {
+      token: "t",
+      cacheDir: "/cache",
+    });
+    expect(fromCache).toBe(false);
+    expect(registry.plugins).toHaveLength(2);
+    const [, init] = fetch.mock.calls[0];
+    expect(init.headers.Authorization).toBe("Bearer t");
+  });
+
+  it("falls back to the offline cache when the network fails", async () => {
+    const fetch = okThenOffline(REGISTRY);
+    install({ fetch });
+    // 1st call populates the cache
+    await fetchRegistry("https://h/r.json", { cacheDir: "/cache" });
+    // 2nd call: network throws → served from cache
+    const { registry, fromCache } = await fetchRegistry("https://h/r.json", {
+      cacheDir: "/cache",
+    });
+    expect(fromCache).toBe(true);
+    expect(registry.plugins).toHaveLength(2);
+  });
+
+  it("throws on HTTP error with no cache", async () => {
+    const fetch = vi.fn(async () => ({
+      ok: false,
+      status: 404,
+      statusText: "Not Found",
+      text: async () => "",
+    }));
+    install({ fetch });
+    await expect(
+      fetchRegistry("https://h/missing.json", { cacheDir: "/cache" }),
+    ).rejects.toThrow(/HTTP 404/);
+  });
+
+  it("throws when offline and nothing is cached", async () => {
+    const fetch = vi.fn(async () => {
+      throw new Error("ENOTFOUND");
+    });
+    install({ fetch });
+    await expect(
+      fetchRegistry("https://h/r.json", { cacheDir: "/cache" }),
+    ).rejects.toThrow(/no offline cache/);
+  });
+});
+
+describe("resolveRemoteSource", () => {
+  it("resolves a named entry to a git source string with a #ref and carries sha256", async () => {
+    const fetch = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify(REGISTRY),
+    }));
+    install({ fetch });
+    const r = await resolveRemoteSource("https://h/r.json", {
+      name: "toml-tools",
+      cacheDir: "/cache",
+    });
+    expect(r.source).toBe("https://github.com/x/toml.git#v1.0.0");
+    expect(r.sha256).toBe("abc123");
+    expect(r.fromCache).toBe(false);
+  });
+
+  it("omits the #ref when the entry has none", async () => {
+    const fetch = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify(REGISTRY),
+    }));
+    install({ fetch });
+    const r = await resolveRemoteSource("https://h/r.json", {
+      name: "py-helpers",
+      cacheDir: "/cache",
+    });
+    expect(r.source).toBe("owner/py-helpers");
+    expect(r.ref).toBeNull();
+  });
+});
+
+describe("listRegistryPlugins", () => {
+  it("flattens entries for display", () => {
+    const rows = listRegistryPlugins(REGISTRY);
+    expect(rows.map((r) => r.name)).toEqual(["toml-tools", "py-helpers"]);
+    expect(rows[0]).toMatchObject({
+      version: "1.0.0",
+      ref: "v1.0.0",
+      description: "TOML LSP",
+    });
+  });
+});
+
+describe("registryCachePath", () => {
+  it("is stable and content-addressed by URL", () => {
+    const a = registryCachePath("https://h/r.json", "/cache");
+    const b = registryCachePath("https://h/r.json", "/cache");
+    const c = registryCachePath("https://h/OTHER.json", "/cache");
+    expect(a).toBe(b);
+    expect(a).not.toBe(c);
+    expect(a.endsWith(".json")).toBe(true);
+  });
+});

package/src/lib/plugin-runtime/agents.js

@@ -0,0 +1,51 @@
+/**
+ * Discover installed plugins' agent-definition directories so `discoverAgents`
+ * can expose them as named subagents (Phase 3.3h — plugin Agent component
+ * reaches the agent chain).
+ *
+ * A plugin ships subagents under `<pluginRoot>/agents/<name>.md` (the same
+ * markdown-with-frontmatter shape as `.claude/agents/*.md`), so each installed
+ * plugin's `agents/` directory becomes an extra agent-scan layer. Only plugins
+ * whose manifest fully validated (`manifest.ok`) contribute.
+ *
+ * NOT trust-gated: an agent definition is declarative (a system prompt + an
+ * optional tool ALLOW-list + model — it can only narrow, never expand,
+ * capability) and runs only when the user invokes it BY NAME (`cc agents run …`),
+ * exactly like a skill. It is never auto-executed at startup (unlike a hook), so
+ * it carries the same trust as a skill's SKILL.md, which is also not gated. The
+ * code-bearing components (hooks/LSP/MCP) remain trust-gated.
+ */
+
+import fs from "fs";
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+
+export const _deps = { existsSync: fs.existsSync };
+
+/**
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{ name, scope, version, dir }>} one entry per plugin that has
+ *   an `agents/` directory; `dir` is that directory (a scan root for
+ *   discoverAgents' walkMd).
+ */
+export function discoverPluginAgentLayers(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const p of plugins) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const agentsDir = path.join(p.root, "agents");
+    if (!_deps.existsSync(agentsDir)) continue;
+    out.push({
+      name: p.name,
+      scope: p.scope,
+      version: p.version,
+      dir: agentsDir,
+    });
+  }
+  return out;
+}