chainlesschain 0.162.148 → 0.162.150

package/src/lib/plugin-runtime/settings.js

@@ -0,0 +1,119 @@
+/**
+ * Plugin `settings` component — a plugin's default configuration (Phase 3.3o).
+ *
+ * A plugin ships a `settings.json` with defaults. We contribute ONLY the safe,
+ * non-security config-override keys — `env` (default environment variables) and
+ * `model` (a default model) — as the LOWEST-priority layer: the user's own
+ * settings, the system environment, and managed settings ALL override them.
+ *
+ * SECURITY: a plugin's settings deliberately CANNOT contribute permission rules,
+ * hooks, MCP servers, or any security-relevant key — those either have their own
+ * dedicated (trust-gated) wiring or must come from the user/managed settings, so
+ * a plugin can never widen the permission envelope through `settings.json`. Even
+ * so, because `env` can influence tool behavior, collection is trust-gated:
+ * only user/local-scope and explicitly-trusted project plugins contribute.
+ */
+
+import fs from "fs";
+import { discoverPlugins } from "./scopes.js";
+import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
+
+export const _deps = { readFileSync: fs.readFileSync };
+
+/** Keys a plugin's settings.json is allowed to contribute (safe subset). */
+const SAFE_KEYS = new Set(["env", "model"]);
+
+/**
+ * Merge trusted plugins' settings.json into a safe defaults object. A later
+ * plugin (in discovery precedence) wins on an env-key / model clash.
+ *
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {{ env: Record<string,string>, model: string|null, sources: string[] }}
+ */
+export function collectPluginSettings(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return { env: {}, model: null, sources: [] };
+  }
+  const { trusted, skipped } = partitionByTrust(plugins);
+  warnUntrustedOnce(
+    skipped.filter((p) => p.manifest?.components?.settings).map((p) => p.name),
+    "settings",
+  );
+  const env = {};
+  let model = null;
+  const sources = [];
+  for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const s = p.manifest.components?.settings;
+    if (!s || !s.absPath) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(_deps.readFileSync(s.absPath, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      continue;
+    let contributed = false;
+    // ONLY the safe subset — everything else (permissions/hooks/mcp/…) ignored.
+    if (
+      SAFE_KEYS.has("env") &&
+      parsed.env &&
+      typeof parsed.env === "object" &&
+      !Array.isArray(parsed.env)
+    ) {
+      for (const [k, v] of Object.entries(parsed.env)) {
+        if (typeof v === "string") {
+          env[k] = v;
+          contributed = true;
+        }
+      }
+    }
+    if (
+      SAFE_KEYS.has("model") &&
+      typeof parsed.model === "string" &&
+      parsed.model.trim()
+    ) {
+      model = parsed.model.trim();
+      contributed = true;
+    }
+    if (contributed) sources.push(s.absPath);
+  }
+  return { env, model, sources };
+}
+
+/**
+ * Apply trusted plugins' default env vars to `env` (defaults to process.env) —
+ * but ONLY for keys not already set, so the user's / system's environment always
+ * wins. Session-scoped: returns `restore()` + the keys added.
+ *
+ * @param {object} [opts] { cwd, scopes, env }
+ * @returns {{ added: string[], model: string|null, restore: () => void }}
+ */
+export function applyPluginSettingsEnv(opts = {}) {
+  const env = opts.env || process.env;
+  const { env: pluginEnv, model } = collectPluginSettings({
+    cwd: opts.cwd,
+    scopes: opts.scopes,
+  });
+  const added = [];
+  for (const [k, v] of Object.entries(pluginEnv)) {
+    if (env[k] === undefined) {
+      env[k] = v;
+      added.push(k);
+    }
+  }
+  let restored = false;
+  return {
+    added,
+    model,
+    restore: () => {
+      if (restored) return;
+      restored = true;
+      for (const k of added) delete env[k];
+    },
+  };
+}

package/src/lib/plugin-runtime/signature.js

@@ -0,0 +1,107 @@
+/**
+ * Plugin signature lock (Phase 3.3l — `requireSignedPlugins` load enforcement).
+ *
+ * `verifyPluginManifest` (../plugin-security.js) verifies a plugin manifest's
+ * SHA-256 + detached Ed25519 signature, but only at the moment of `cc plugin
+ * add/validate`. To enforce signing at LOAD time (an org's requireSignedPlugins),
+ * install records the verification result in a `.plugin-lock.json` inside the
+ * immutable version dir; discovery then re-checks it fail-closed.
+ *
+ * The lock records the manifest's sha256 + the signing key's fingerprint. At
+ * load we RE-HASH the on-disk manifest and compare — so a manifest tampered with
+ * after install (even inside the version dir) fails the check. The signature
+ * itself covers only the manifest file, not every component file — that is a
+ * known limitation (documented), an integrity anchor rather than a full
+ * supply-chain seal; the immutable version dir + this re-hash catch manifest
+ * tampering, which is where the component wiring is declared.
+ */
+
+import { createHash } from "node:crypto";
+import fs from "fs";
+import path from "path";
+
+const LOCK = ".plugin-lock.json";
+
+export const _deps = {
+  readFileSync: fs.readFileSync,
+  writeFileSync: fs.writeFileSync,
+  existsSync: fs.existsSync,
+};
+
+/** Record a verified signature into the version dir. */
+export function writePluginLock(
+  versionDir,
+  { manifestFile, sha256, publicKeySha256, signatureVerified },
+) {
+  const rel = path.relative(versionDir, manifestFile).replace(/\\/g, "/");
+  const lock = {
+    lockVersion: 1,
+    manifest: rel || "plugin.json",
+    sha256,
+    publicKeySha256: publicKeySha256 || null,
+    signatureVerified: signatureVerified === true,
+  };
+  _deps.writeFileSync(
+    path.join(versionDir, LOCK),
+    JSON.stringify(lock, null, 2),
+    "utf8",
+  );
+  return lock;
+}
+
+/** Read a version dir's signature lock, or null when absent/unreadable. */
+export function readPluginLock(versionDir) {
+  const p = path.join(versionDir, LOCK);
+  if (!_deps.existsSync(p)) return null;
+  try {
+    return JSON.parse(_deps.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Verify an installed plugin's recorded signature against its on-disk manifest.
+ * `signed:true` ONLY when a lock exists, was signature-verified, the manifest
+ * still hashes to the locked sha256 (tamper detection), and — when trustedKeys
+ * is a non-empty Set — the signing key fingerprint is among them.
+ *
+ * @param {{root:string}} plugin
+ * @param {object} [opts] { trustedKeys?: Set<string> }
+ * @returns {{ signed:boolean, reason?:string, publicKeySha256?:string }}
+ */
+export function verifyInstalledSignature(plugin, opts = {}) {
+  const lock = readPluginLock(plugin.root);
+  if (!lock) return { signed: false, reason: "no signature lock" };
+  if (lock.signatureVerified !== true) {
+    return { signed: false, reason: "lock is not signature-verified" };
+  }
+  const manifestFile = path.join(plugin.root, lock.manifest || "plugin.json");
+  if (!_deps.existsSync(manifestFile)) {
+    return { signed: false, reason: "locked manifest file is missing" };
+  }
+  let sha;
+  try {
+    sha = createHash("sha256")
+      .update(_deps.readFileSync(manifestFile))
+      .digest("hex");
+  } catch {
+    return { signed: false, reason: "manifest unreadable" };
+  }
+  if (sha.toLowerCase() !== String(lock.sha256 || "").toLowerCase()) {
+    return {
+      signed: false,
+      reason: "manifest tampered since install (sha256 mismatch)",
+    };
+  }
+  const trustedKeys = opts.trustedKeys;
+  if (trustedKeys && trustedKeys.size > 0) {
+    if (!lock.publicKeySha256 || !trustedKeys.has(lock.publicKeySha256)) {
+      return {
+        signed: false,
+        reason: `signing key not trusted (${lock.publicKeySha256 || "unsigned"})`,
+      };
+    }
+  }
+  return { signed: true, publicKeySha256: lock.publicKeySha256 };
+}

package/src/lib/plugin-runtime/skills.js

@@ -0,0 +1,43 @@
+/**
+ * Discover installed plugins' skill directories so the skill-loader can expose
+ * them to the agent (Phase 3.3 — plugin Skill component reaches the agent).
+ *
+ * A plugin ships skills under `<pluginRoot>/skills/<name>/SKILL.md` (the same
+ * `<group>/<skill>/SKILL.md` layout every skill layer uses), so each installed
+ * plugin's `skills/` directory becomes an extra skill layer. Only plugins whose
+ * manifest fully validated (`manifest.ok`) contribute — a plugin with a
+ * traversal/schema error in ANY component loads nothing.
+ */
+
+import fs from "fs";
+import path from "path";
+import { discoverPlugins } from "./scopes.js";
+
+export const _deps = { existsSync: fs.existsSync };
+
+/**
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {Array<{ name, scope, version, path }>} one entry per plugin that has
+ *   a `skills/` directory; `path` is that directory (a scan root for the loader).
+ */
+export function discoverPluginSkillLayers(opts = {}) {
+  let plugins = [];
+  try {
+    plugins = discoverPlugins({ cwd: opts.cwd, scopes: opts.scopes });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const p of plugins) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
+    const skillsDir = path.join(p.root, "skills");
+    if (!_deps.existsSync(skillsDir)) continue;
+    out.push({
+      name: p.name,
+      scope: p.scope,
+      version: p.version,
+      path: skillsDir,
+    });
+  }
+  return out;
+}

package/src/lib/plugin-runtime/trust.js

@@ -0,0 +1,140 @@
+/**
+ * Plugin trust gating (Phase 3.3f) — decide whether a plugin's CODE-BEARING
+ * components (hooks that run shell, LSP servers that spawn binaries) are allowed
+ * to execute.
+ *
+ * Threat model: `cc plugin add owner/repo` and, worse, a cloned repo that ships
+ * a project-scope plugin under `.chainlesschain/plugins/`, could run arbitrary
+ * commands the moment the agent starts. So:
+ *
+ *   - user / local scope  → TRUSTED. The developer installed it on their own
+ *     machine (same consent model as an npm dependency's lifecycle scripts).
+ *   - project scope       → UNTRUSTED until the user explicitly trusts it, since
+ *     it can arrive with a git clone. Trust is pinned to the exact version, so a
+ *     later version bump re-requires consent.
+ *
+ * Trust is recorded in the USER data dir (never in the repo), keyed by
+ * `<scope>:<name>` → { version, trustedAt }.
+ *
+ * Only code execution is gated here. Declarative components (skills are prompts,
+ * mcp/settings are config) load regardless; this is specifically about not
+ * running untrusted SHELL/binaries behind the user's back.
+ */
+
+import fs from "fs";
+import path from "path";
+import { getElectronUserDataDir } from "../paths.js";
+
+export const _deps = {
+  existsSync: fs.existsSync,
+  readFileSync: fs.readFileSync,
+  writeFileSync: fs.writeFileSync,
+  mkdirSync: fs.mkdirSync,
+  now: () => new Date().toISOString(),
+  // Path of the trust store; injectable so unit tests never touch the real
+  // user-data dir.
+  storePath: () => path.join(getElectronUserDataDir(), "plugin-trust.json"),
+};
+
+const AUTO_TRUSTED_SCOPES = new Set(["user", "local"]);
+
+export function loadTrustStore() {
+  try {
+    const p = _deps.storePath();
+    if (!_deps.existsSync(p)) return {};
+    const data = JSON.parse(_deps.readFileSync(p, "utf8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+function saveTrustStore(store) {
+  const p = _deps.storePath();
+  _deps.mkdirSync(path.dirname(p), { recursive: true });
+  _deps.writeFileSync(p, JSON.stringify(store, null, 2), "utf8");
+}
+
+function trustKey(scope, name) {
+  return `${scope}:${name}`;
+}
+
+/**
+ * May this plugin's code-bearing components run?
+ * @param {{ scope, name, version }} plugin
+ */
+export function isPluginTrusted(plugin) {
+  if (!plugin || !plugin.name) return false;
+  if (AUTO_TRUSTED_SCOPES.has(plugin.scope)) return true;
+  const entry = loadTrustStore()[trustKey(plugin.scope, plugin.name)];
+  return Boolean(entry && entry.version === plugin.version);
+}
+
+/** Trust a plugin (records the exact version). */
+export function trustPlugin(name, { scope = "project", version } = {}) {
+  if (!version) throw new Error("trustPlugin requires a version");
+  const store = loadTrustStore();
+  store[trustKey(scope, name)] = { version, trustedAt: _deps.now() };
+  saveTrustStore(store);
+  return { name, scope, version };
+}
+
+/** Revoke trust for a plugin at a scope. */
+export function untrustPlugin(name, { scope = "project" } = {}) {
+  const store = loadTrustStore();
+  const key = trustKey(scope, name);
+  const existed = Object.prototype.hasOwnProperty.call(store, key);
+  delete store[key];
+  saveTrustStore(store);
+  return { name, scope, removed: existed };
+}
+
+/** All trust entries (for `cc plugin trust --list`). */
+export function listTrust() {
+  return Object.entries(loadTrustStore()).map(([key, v]) => {
+    const idx = key.indexOf(":");
+    return {
+      scope: key.slice(0, idx),
+      name: key.slice(idx + 1),
+      version: v?.version || null,
+      trustedAt: v?.trustedAt || null,
+    };
+  });
+}
+
+/**
+ * Split discovered plugins into those whose code may run and those gated out.
+ * @returns {{ trusted: any[], skipped: any[] }}
+ */
+export function partitionByTrust(plugins) {
+  const trusted = [];
+  const skipped = [];
+  for (const p of plugins || []) {
+    (isPluginTrusted(p) ? trusted : skipped).push(p);
+  }
+  return { trusted, skipped };
+}
+
+// One-time stderr notice so a user isn't mystified when a project plugin's
+// hooks/servers silently don't run. Guarded so it prints at most once per
+// (component-kind) per process.
+const _warned = new Set();
+export function warnUntrustedOnce(names, kind) {
+  if (!names || names.length === 0) return;
+  if (_warned.has(kind)) return;
+  _warned.add(kind);
+  const list = [...new Set(names)].join(", ");
+  try {
+    process.stderr.write(
+      `[plugins] skipped ${kind} from untrusted project plugin(s): ${list}\n` +
+        `          run \`cc plugin trust <name>\` to enable them.\n`,
+    );
+  } catch {
+    /* stderr notice is best-effort */
+  }
+}
+
+/** Test hook: reset the one-time warning guard. */
+export function _resetTrustWarnings() {
+  _warned.clear();
+}

package/src/lib/pqc-manager.js

@@ -178,6 +178,70 @@ export function ensurePQCTables(db) {
   `);
 }
 
+/**
+ * Rehydrate _keys/_migrations from the persisted pqc_keys/pqc_migration_status
+ * tables. The `cc` CLI runs every command in a fresh process, so without this
+ * the Maps start empty and a key generated / migration run in a prior
+ * invocation is invisible (`cc pqc keys` reports "No PQC keys" and `cc pqc
+ * migration-status` is empty even when the rows exist; `cc pqc migrate` counts
+ * sourceKeys off the empty Map and reports "Migrated 0/0" while real keys sit
+ * unmigrated). Call after ensurePQCTables(db). NOTE: this module holds only
+ * public-key inventory metadata — there is no private key or sign/verify path
+ * here — so the impact is inventory visibility + migration accounting, not
+ * crypto verification.
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _keys.clear();
+  _migrations.clear();
+
+  const keyRows = db.prepare(`SELECT * FROM pqc_keys`).all();
+  for (const row of keyRows) {
+    let metadata = {};
+    try {
+      metadata = row.metadata ? JSON.parse(row.metadata) : {};
+    } catch {
+      metadata = {};
+    }
+    // Derived fields (family/publicKeyBytes/signatureBytes) come from the
+    // algorithm spec, not the DB — reconstruct them exactly as generateKey does.
+    const spec = ALGORITHM_SPECS[row.algorithm] || {};
+    _keys.set(row.id, {
+      id: row.id,
+      algorithm: row.algorithm,
+      family: spec.family ?? null,
+      purpose: row.purpose,
+      publicKey: row.public_key,
+      keySize: row.key_size ?? spec.keySize ?? 0,
+      publicKeyBytes: spec.publicKeyBytes ?? null,
+      signatureBytes: spec.signatureBytes ?? null,
+      hybridMode: !!row.hybrid_mode,
+      classicalAlgorithm: row.classical_algorithm ?? null,
+      status: row.status,
+      metadata,
+      createdAt: row.created_at ?? null,
+    });
+  }
+
+  const migRows = db.prepare(`SELECT * FROM pqc_migration_status`).all();
+  for (const row of migRows) {
+    _migrations.set(row.id, {
+      id: row.id,
+      planName: row.plan_name,
+      sourceAlgorithm: row.source_algorithm,
+      targetAlgorithm: row.target_algorithm,
+      totalKeys: row.total_keys ?? 0,
+      migratedKeys: row.migrated_keys ?? 0,
+      status: row.status,
+      startedAt: row.started_at ?? null,
+      completedAt: row.completed_at ?? null,
+      errorMessage: row.error_message ?? null,
+    });
+  }
+
+  return _keys.size + _migrations.size;
+}
+
 /* ── Key Management ───────────────────────────────────────── */
 
 export function listKeys(filter = {}) {

package/src/lib/reputation-optimizer.js

@@ -509,6 +509,107 @@ export function _resetState() {
   _maxConcurrentOptimizations = DEFAULT_MAX_CONCURRENT_OPTIMIZATIONS;
 }
 
+/**
+ * Rehydrate the in-memory Maps from the persisted reputation_* tables. The CLI
+ * runs each `cc reputation` subcommand in a fresh node process, so
+ * _observations/_runs/_analytics start empty every invocation. Every write
+ * dual-writes (Map + INSERT into reputation_observations/
+ * reputation_optimization_runs/reputation_analytics) but every read
+ * (computeScore/listScores/detectAnomalies/getOptimizationStatus/getAnalytics/
+ * listOptimizationRuns/applyOptimizedParams + the V2 drivers) is Map-only and
+ * nothing SELECTed the tables back — so observed scores read back as 0, `list`/
+ * `runs`/`anomalies` were always empty, and `status`/`complete`/`apply <runId>`
+ * threw "Optimization run not found" for a run that genuinely exists on disk.
+ * Call after ensureReputationTables(db).
+ *
+ * Non-persisted fields default safely: run.history=[] (V1), errorMessage=null.
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureReputationTables(db);
+  _observations.clear();
+  _runs.clear();
+  _analytics.clear();
+
+  for (const r of db
+    .prepare(
+      `SELECT observation_id, did, score, kind, weight, recorded_at
+         FROM reputation_observations ORDER BY recorded_at ASC`,
+    )
+    .all()) {
+    if (!_observations.has(r.did)) _observations.set(r.did, []);
+    _observations.get(r.did).push({
+      observationId: r.observation_id,
+      did: r.did,
+      score: Number(r.score),
+      kind: r.kind,
+      weight: Number(r.weight),
+      recordedAt: Number(r.recorded_at),
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT run_id, objective, iterations, param_space, best_params, best_score,
+              status, created_at, completed_at
+         FROM reputation_optimization_runs ORDER BY created_at ASC`,
+    )
+    .all()) {
+    // One corrupt param/params cell must not sink the whole run list.
+    let paramSpace = {};
+    let bestParams = null;
+    try {
+      paramSpace = r.param_space ? JSON.parse(r.param_space) : {};
+    } catch {
+      paramSpace = {};
+    }
+    try {
+      bestParams = r.best_params ? JSON.parse(r.best_params) : null;
+    } catch {
+      bestParams = null;
+    }
+    _runs.set(r.run_id, {
+      runId: r.run_id,
+      objective: r.objective,
+      iterations: Number(r.iterations),
+      paramSpace,
+      bestParams,
+      bestScore: r.best_score == null ? null : Number(r.best_score),
+      errorMessage: null,
+      status: r.status,
+      createdAt: Number(r.created_at),
+      completedAt: r.completed_at == null ? null : Number(r.completed_at),
+      history: [],
+      _seq: ++_seq,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT analytics_id, run_id, reputation_distribution, anomalies, recommendations, created_at
+         FROM reputation_analytics ORDER BY created_at ASC`,
+    )
+    .all()) {
+    const parse = (v, fallback) => {
+      try {
+        return v ? JSON.parse(v) : fallback;
+      } catch {
+        return fallback;
+      }
+    };
+    _analytics.set(r.run_id, {
+      analyticsId: r.analytics_id,
+      runId: r.run_id,
+      reputationDistribution: parse(r.reputation_distribution, {}),
+      anomalies: parse(r.anomalies, []),
+      recommendations: parse(r.recommendations, []),
+      createdAt: Number(r.created_at),
+    });
+  }
+
+  return _observations.size + _runs.size + _analytics.size;
+}
+
 /* ═══════════════════════════════════════════════════════════════
  * V2 (Phase 60) — Frozen enums + async optimization lifecycle +
  * concurrency limiter + patch-merged setRunStatus + stats-v2.