chainlesschain 0.162.149 → 0.162.150

package/src/commands/plugin.js

@@ -587,32 +587,83 @@ export function registerPluginCommand(program) {
 
   const SCOPES = "user|project|local";
 
-  // plugin add <source> — install from a local dir, git URL, or owner/repo
+  // plugin add <source> — install from a local dir, git URL, owner/repo, or a
+  // remote registry/manifest URL (with --name to pick from a multi-plugin index)
   plugin
     .command("add <source>")
     .description(
-      `Install a plugin from a local dir, git URL, or owner/repo[#ref] (scope: ${SCOPES})`,
+      `Install a plugin from a local dir, git URL, owner/repo[#ref], or registry URL (scope: ${SCOPES})`,
     )
     .option("--scope <scope>", "Install scope (user|project|local)", "user")
     .option("--force", "Reinstall over an existing immutable version")
     .option("--sha256 <hex>", "Expected SHA-256 of the manifest file")
     .option("--signature <path>", "Detached Ed25519 signature of the manifest")
     .option("--public-key <path>", "Public key for signature verification")
+    .option(
+      "--registry <url>",
+      "Resolve <source> as a plugin NAME in this registry URL",
+    )
+    .option(
+      "--name <plugin>",
+      "Plugin name to select from a multi-plugin registry",
+    )
+    .option("--token <token>", "Bearer token for a private registry")
     .option("--json", "Output as JSON")
     .action(async (source, options) => {
       const { installFromSource } =
         await import("../lib/plugin-runtime/install.js");
+
+      // Remote resolution: a registry/manifest URL (or --registry <url> with a
+      // plugin name) resolves to a git source the installer already handles.
+      let installSource = source;
+      let integritySha = null;
+      const { isRemoteSource, resolveRemoteSource } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      if (options.registry || isRemoteSource(source)) {
+        const url = options.registry || source;
+        // With --registry the positional arg is the plugin NAME; otherwise the
+        // URL is positional and --name selects.
+        const name = options.registry ? source : options.name;
+        let config = null;
+        try {
+          ({ loadConfig: config } = await import("../lib/config-manager.js"));
+          config = config();
+        } catch {
+          config = null; // config is optional — token can come from --token/env
+        }
+        try {
+          const resolved = await resolveRemoteSource(url, {
+            name,
+            token: options.token,
+            config,
+          });
+          installSource = resolved.source;
+          integritySha = resolved.sha256;
+          if (resolved.fromCache) {
+            logger.warn(
+              chalk.yellow(
+                "  ⚠ registry unreachable — using cached copy (offline)",
+              ),
+            );
+          }
+        } catch (err) {
+          logger.error(`Registry resolution failed: ${err.message}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
+
       const signature =
-        options.sha256 || options.signature || options.publicKey
+        options.sha256 || options.signature || options.publicKey || integritySha
           ? {
-              sha256: options.sha256,
+              sha256: options.sha256 || integritySha,
               signatureFile: options.signature,
               publicKeyFile: options.publicKey,
               requireSignature: Boolean(options.signature),
             }
           : null;
       try {
-        const res = installFromSource(source, {
+        const res = installFromSource(installSource, {
           scope: options.scope,
           cwd: process.cwd(),
           force: options.force === true,
@@ -635,6 +686,75 @@ export function registerPluginCommand(program) {
       }
     });
 
+  // plugin browse — browse the plugins offered by a remote registry (discovery)
+  plugin
+    .command("browse [query]")
+    .description(
+      "List plugins in a remote registry (--registry <url>); filter by [query]",
+    )
+    .requiredOption("--registry <url>", "Registry/manifest URL to browse")
+    .option("--token <token>", "Bearer token for a private registry")
+    .option("--json", "Output as JSON")
+    .action(async (query, options) => {
+      const { fetchRegistry, listRegistryPlugins, resolveRegistryToken } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      let config = null;
+      try {
+        const cm = await import("../lib/config-manager.js");
+        config = cm.loadConfig();
+      } catch {
+        config = null;
+      }
+      try {
+        const token = resolveRegistryToken(options.registry, {
+          token: options.token,
+          config,
+        });
+        const { registry, fromCache } = await fetchRegistry(options.registry, {
+          token,
+        });
+        let rows = listRegistryPlugins(registry);
+        if (query) {
+          const q = query.toLowerCase();
+          rows = rows.filter(
+            (r) =>
+              r.name.toLowerCase().includes(q) ||
+              (r.description || "").toLowerCase().includes(q),
+          );
+        }
+        if (options.json) {
+          console.log(JSON.stringify({ fromCache, plugins: rows }, null, 2));
+          return;
+        }
+        if (fromCache) {
+          logger.warn(
+            chalk.yellow(
+              "  ⚠ registry unreachable — showing cached copy (offline)",
+            ),
+          );
+        }
+        if (rows.length === 0) {
+          logger.info("No matching plugins in this registry.");
+          return;
+        }
+        logger.log(chalk.bold(`Plugins (${rows.length}):`));
+        for (const r of rows) {
+          const ver = r.version ? chalk.gray(` v${r.version}`) : "";
+          logger.log(
+            `  ${chalk.cyan(r.name)}${ver}  ${chalk.gray(r.description || r.source)}`,
+          );
+        }
+        logger.log(
+          chalk.gray(
+            `\nInstall with: cc plugin add <name> --registry ${options.registry}`,
+          ),
+        );
+      } catch (err) {
+        logger.error(`Registry search failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
   // plugin installed — list runtime-installed plugins across scopes
   plugin
     .command("installed")

package/src/commands/pqc.js

@@ -8,6 +8,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensurePQCTables,
+  loadFromDb,
   listKeys,
   generateKey,
   getMigrationStatus,
@@ -64,6 +65,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const keys = listKeys({ algorithm: options.algorithm });
         if (options.json) {
@@ -103,6 +105,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const key = generateKey(db, algorithm, options.purpose);
         logger.success("PQC key generated");
@@ -136,6 +139,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const plans = getMigrationStatus();
         if (options.json) {
@@ -204,6 +208,7 @@ export function registerPqcCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensurePQCTables(db);
+        loadFromDb(db);
 
         const plan = migrate(db, planName, options.source, targetAlgorithm);
         logger.success("Migration completed");

package/src/commands/reputation.js

@@ -9,6 +9,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureReputationTables,
+  loadFromDb as loadReputationFromDb,
   addObservation,
   computeScore,
   listScores,
@@ -44,6 +45,10 @@ function _dbFromCtx(ctx) {
   }
   const db = ctx.db.getDatabase();
   ensureReputationTables(db);
+  // Rehydrate the observation/run/analytics Maps from the reputation_* tables —
+  // without this every read is Map-only-empty in the fresh CLI process (scores
+  // read back 0, `status <runId>` throws "Optimization run not found").
+  loadReputationFromDb(db);
   return db;
 }
 
@@ -165,7 +170,11 @@ export function registerReputationCommand(program) {
       "Detection method (z_score|iqr)",
       "z_score",
     )
-    .option("-t, --threshold <n>", "Detection threshold", floatArg("--threshold"))
+    .option(
+      "-t, --threshold <n>",
+      "Detection threshold",
+      floatArg("--threshold"),
+    )
     .option(
       "-d, --decay <model>",
       "Decay model applied before detection",

package/src/commands/scim.js

@@ -9,6 +9,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureSCIMTables,
+  loadFromDb as loadScimFromDb,
   listUsers,
   createUser,
   getUser,
@@ -73,6 +74,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const result = listUsers();
         if (options.json) {
@@ -108,6 +110,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const user = createUser(db, username, options.name, options.email);
         logger.success("User created");
@@ -134,6 +137,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const user = getUser(userId);
         if (!user) {
@@ -168,6 +172,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         deleteUser(db, userId);
         logger.success(`User ${chalk.cyan(userId.slice(0, 8))} deleted`);
@@ -216,6 +221,7 @@ export function registerScimCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSCIMTables(db);
+        loadScimFromDb(db);
 
         const result = syncProvision(db, connectorId);
         logger.success(`Sync completed via ${chalk.cyan(result.connector)}`);

package/src/commands/session.js

@@ -61,6 +61,36 @@ import {
   readWorkflowSession,
 } from "../lib/workflow-state-reader.js";
 
+// DB sessions store `updated_at` as SQLite datetime('now') → "YYYY-MM-DD
+// HH:MM:SS" (UTC, space at index 10); JSONL sessions store toISOString() →
+// "YYYY-MM-DDTHH:MM:SS.sssZ" (UTC, 'T' at index 10). Both are UTC, so normalize
+// the space form to ISO-UTC and compare as epochs — a raw string compare
+// resolves at index 10 ('T' 0x54 > ' ' 0x20) and would rank every JSONL session
+// as newer than any same-date DB session regardless of the actual time.
+function _sessionEpoch(ts) {
+  if (typeof ts !== "string" || !ts) return 0;
+  const iso =
+    ts.includes(" ") && !ts.includes("T") ? ts.replace(" ", "T") + "Z" : ts;
+  const n = Date.parse(iso);
+  return Number.isFinite(n) ? n : 0;
+}
+
+export function rankSessions(sessions, limit) {
+  // Dedup by id, preferring the JSONL copy when a session exists in both stores
+  // (the original "JSONL takes precedence" intent, previously achieved only as
+  // a side effect of the buggy lexicographic sort). Then rank by real time.
+  const byId = new Map();
+  for (const s of sessions) {
+    const prev = byId.get(s.id);
+    if (!prev || (s._store === "jsonl" && prev._store !== "jsonl")) {
+      byId.set(s.id, s);
+    }
+  }
+  return [...byId.values()]
+    .sort((a, b) => _sessionEpoch(b.updated_at) - _sessionEpoch(a.updated_at))
+    .slice(0, limit);
+}
+
 export function registerSessionCommand(program) {
   const session = program
     .command("session")
@@ -98,16 +128,8 @@ export function registerSessionCommand(program) {
           );
         }
 
-        // Deduplicate by id (JSONL takes precedence), sort by updated_at
-        const seen = new Set();
-        sessions = sessions
-          .sort((a, b) => (b.updated_at > a.updated_at ? 1 : -1))
-          .filter((s) => {
-            if (seen.has(s.id)) return false;
-            seen.add(s.id);
-            return true;
-          })
-          .slice(0, limit);
+        // Deduplicate by id (JSONL takes precedence) and rank by real time.
+        sessions = rankSessions(sessions, limit);
 
         if (options.json) {
           console.log(JSON.stringify(sessions, null, 2));

package/src/commands/siem.js

@@ -8,6 +8,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureSIEMTables,
+  loadFromDb as loadSiemFromDb,
   listTargets,
   addTarget,
   exportLogs,
@@ -46,6 +47,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         const targets = listTargets();
         if (options.json) {
@@ -83,6 +85,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         const target = addTarget(db, type, url, options.format);
         logger.success("SIEM target added");
@@ -111,6 +114,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         // Export with simulated log batch
         const result = exportLogs(db, targetId, [
@@ -146,6 +150,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         const stats = getSIEMStats();
         if (options.json) {
@@ -251,6 +256,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         let config = {};
         try {
@@ -286,6 +292,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         console.log(JSON.stringify(removeTarget(db, targetId), null, 2));
 
@@ -308,6 +315,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         console.log(
           JSON.stringify(setTargetStatus(db, targetId, status), null, 2),
@@ -334,6 +342,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         let logs = [];
         try {
@@ -368,6 +377,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         console.log(JSON.stringify(getSIEMStatsV2(), null, 2));
 
@@ -390,6 +400,7 @@ export function registerSiemCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSIEMTables(db);
+        loadSiemFromDb(db);
 
         console.log(JSON.stringify(listTargetsByStatus(status), null, 2));
 

package/src/commands/sla.js

@@ -9,6 +9,7 @@ import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureSlaTables,
+  loadFromDb as loadSlaFromDb,
   listTiers,
   createSLA,
   listSLAs,
@@ -50,6 +51,7 @@ function _dbFromCtx(ctx) {
   }
   const db = ctx.db.getDatabase();
   ensureSlaTables(db);
+  loadSlaFromDb(db);
   return db;
 }
 
@@ -81,7 +83,11 @@ export function registerSlaCommand(program) {
     .command("create <org-id>")
     .description("Create a new SLA contract")
     .option("-t, --tier <tier>", "SLA tier (gold|silver|bronze)", "silver")
-    .option("-d, --duration <ms>", "Contract duration in ms", intArg("--duration"))
+    .option(
+      "-d, --duration <ms>",
+      "Contract duration in ms",
+      intArg("--duration"),
+    )
     .option("-f, --fee <amount>", "Monthly fee", parseFloat, 0)
     .option("--json", "Output as JSON")
     .action(async (orgId, options) => {
@@ -337,7 +343,11 @@ export function registerSlaCommand(program) {
   sla
     .command("report <sla-id>")
     .description("Generate an SLA compliance report")
-    .option("--start <ms>", "Start of window (ms since epoch)", intArg("--start"))
+    .option(
+      "--start <ms>",
+      "Start of window (ms since epoch)",
+      intArg("--start"),
+    )
     .option("--end <ms>", "End of window (ms since epoch)", intArg("--end"))
     .option("--json", "Output as JSON")
     .action(async (slaId, options) => {
@@ -380,6 +390,7 @@ export function registerSlaCommand(program) {
     try {
       const db = ctx.db.getDatabase();
       ensureSlaTables(db);
+      loadSlaFromDb(db);
       return await fn(db);
     } finally {
       await shutdown();
@@ -461,7 +472,11 @@ export function registerSlaCommand(program) {
     .command("create-v2 <org-id>")
     .description("Create a V2 SLA contract (enforces per-org active cap)")
     .option("-t, --tier <tier>", "gold|silver|bronze", "silver")
-    .option("-d, --duration <ms>", "Contract duration in ms", intArg("--duration"))
+    .option(
+      "-d, --duration <ms>",
+      "Contract duration in ms",
+      intArg("--duration"),
+    )
     .option("-f, --fee <amount>", "Monthly fee", floatArg("--fee"))
     .option("--json", "Output as JSON")
     .action(async (orgId, options) => {

package/src/commands/social.js

@@ -10,6 +10,7 @@ import { parseJsonOption } from "../lib/parse-json-option.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
 import {
   ensureSocialTables,
+  loadFromDb as loadSocialFromDb,
   addContact,
   listContacts,
   deleteContact,
@@ -131,6 +132,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const c = addContact(
           db,
@@ -161,6 +163,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const contacts = listContacts();
         if (options.json) {
@@ -193,6 +196,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         deleteContact(db, contactId);
         logger.success(`Contact deleted`);
@@ -216,6 +220,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const c = showContact(contactId);
         if (options.json) {
@@ -250,6 +255,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const f = addFriend(db, contactId);
         logger.success(`Friend request sent (${f.status})`);
@@ -273,6 +279,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const friends = listFriends();
         if (options.json) {
@@ -305,6 +312,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         removeFriend(db, contactId);
         logger.success("Friend removed");
@@ -328,6 +336,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const pending = pendingRequests();
         if (options.json) {
@@ -365,6 +374,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const p = publishPost(db, content, options.author);
         logger.success("Post published");
@@ -390,6 +400,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const posts = listPosts({ author: options.author });
         if (options.json) {
@@ -422,6 +433,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const p = likePost(db, postId);
         logger.success(`Post liked (${p.likes} total)`);
@@ -449,6 +461,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const msg = sendChatMessage(db, recipient, message, options.sender);
         logger.success(`Message sent to ${chalk.cyan(recipient)}`);
@@ -474,9 +487,15 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const messages = getChatMessages(threadId, {
-          limit: numericOption(options.limit, { name: "--limit", integer: true, min: 1, fallback: 50 }),
+          limit: numericOption(options.limit, {
+            name: "--limit",
+            integer: true,
+            min: 1,
+            fallback: 50,
+          }),
         });
         if (options.json) {
           console.log(JSON.stringify(messages, null, 2));
@@ -507,6 +526,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const threads = getChatThreads();
         if (options.json) {
@@ -542,6 +562,7 @@ export function registerSocialCommand(program) {
         }
         const db = ctx.db.getDatabase();
         ensureSocialTables(db);
+        loadSocialFromDb(db);
 
         const stats = getSocialStats();
         if (options.json) {
@@ -967,10 +988,22 @@ export function registerSocialCommand(program) {
           directed: !!options.directed,
           edgeTypes: _splitEdgeTypes(options.edgeTypes),
           weights: {
-            degree: numericOption(options.wDegree, { name: "--w-degree", fallback: 0.25 }),
-            closeness: numericOption(options.wCloseness, { name: "--w-closeness", fallback: 0.25 }),
-            betweenness: numericOption(options.wBetweenness, { name: "--w-betweenness", fallback: 0.25 }),
-            eigenvector: numericOption(options.wEigenvector, { name: "--w-eigenvector", fallback: 0.25 }),
+            degree: numericOption(options.wDegree, {
+              name: "--w-degree",
+              fallback: 0.25,
+            }),
+            closeness: numericOption(options.wCloseness, {
+              name: "--w-closeness",
+              fallback: 0.25,
+            }),
+            betweenness: numericOption(options.wBetweenness, {
+              name: "--w-betweenness",
+              fallback: 0.25,
+            }),
+            eigenvector: numericOption(options.wEigenvector, {
+              name: "--w-eigenvector",
+              fallback: 0.25,
+            }),
           },
         });
         if (options.json) console.log(JSON.stringify(scores, null, 2));

package/src/commands/sso.js

@@ -72,8 +72,16 @@ import {
 } from "../lib/sso-manager.js";
 
 function _dbFromCtx(cmd) {
-  const root = cmd?.parent?.parent ?? cmd?.parent;
-  return root?._db;
+  // The preAction hook stores the opened db on the `sso` command node, which is
+  // an action subcommand's direct parent. The previous `cmd.parent.parent`
+  // resolved to the ROOT program node (never assigned _db) because that fallback
+  // `?? cmd.parent` never fires for a 3-level tree — so the handle was always
+  // undefined and every db.prepare() crashed. Walk up to the first node carrying
+  // _db instead.
+  for (let node = cmd; node; node = node.parent) {
+    if (node._db) return node._db;
+  }
+  return undefined;
 }
 
 async function _prepare(cmd) {