chainlesschain 0.162.150 → 0.162.151

package/src/lib/plugin-runtime/signature.js

@@ -77,6 +77,22 @@ export function verifyInstalledSignature(plugin, opts = {}) {
     return { signed: false, reason: "lock is not signature-verified" };
   }
   const manifestFile = path.join(plugin.root, lock.manifest || "plugin.json");
+  // `lock.manifest` is untrusted — it lives in the (writable) plugin dir. A lock
+  // pointing OUTSIDE the plugin root (`manifest: "../../secret"`) would make us
+  // re-hash an arbitrary file and, with a matching locked sha256, forge
+  // signed:true — which gates load-time requireSignedPlugins. A plugin's manifest
+  // is ALWAYS inside its own root, so reject any path that escapes it (boundary
+  // via path.relative, not startsWith — the sandbox-fs-policy pattern).
+  const rel = path.relative(
+    path.resolve(plugin.root),
+    path.resolve(manifestFile),
+  );
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+    return {
+      signed: false,
+      reason: "lock manifest path escapes the plugin root",
+    };
+  }
   if (!_deps.existsSync(manifestFile)) {
     return { signed: false, reason: "locked manifest file is missing" };
   }

package/src/lib/sandbox-egress-proxy.js

@@ -72,6 +72,42 @@ async function guardResolvedTarget(host, policy, lookup) {
   return { ok: true, ip: typeof first === "string" ? first : first.address };
 }
 
+/**
+ * Parse a CONNECT request target ("host:port") into `{ host, port }`. A naive
+ * `split(":")` mangles IPv6 literals — `[2001:db8::1]:8443` would yield host
+ * `"[2001"` and a NaN port that silently defaults to 443, so even an IP-pinned
+ * tunnel connects to the WRONG port (and, when unpinned, the wrong host). Handle
+ * the bracketed-IPv6, bare-IPv6, and `name[:port]` forms explicitly. Port
+ * defaults to 443 (the CONNECT/HTTPS default).
+ */
+export function parseConnectTarget(target) {
+  const s = String(target == null ? "" : target).trim();
+  const toPort = (v) => {
+    const n = parseInt(v, 10);
+    return Number.isInteger(n) && n > 0 && n <= 65535 ? n : 443;
+  };
+  // Bracketed IPv6: "[::1]" or "[::1]:8443"
+  if (s.startsWith("[")) {
+    const end = s.indexOf("]");
+    if (end > 0) {
+      const host = s.slice(1, end);
+      const rest = s.slice(end + 1); // "" or ":8443"
+      return { host, port: rest.startsWith(":") ? toPort(rest.slice(1)) : 443 };
+    }
+    // malformed bracket — fall through to the generic handling
+  }
+  // Bare IPv6 literal (2+ colons, no brackets) → no port component to split off.
+  if ((s.match(/:/g) || []).length > 1) {
+    return { host: s, port: 443 };
+  }
+  // "name:port" (rsplit on the single colon) or bare "name".
+  const idx = s.lastIndexOf(":");
+  if (idx > 0) {
+    return { host: s.slice(0, idx), port: toPort(s.slice(idx + 1)) };
+  }
+  return { host: s, port: 443 };
+}
+
 /**
  * Build the proxy env vars a child process needs to route through the proxy.
  * `NO_PROXY` is intentionally empty so nothing bypasses the filter.
@@ -204,8 +240,8 @@ export function createEgressProxy(policy = {}, opts = {}) {
         clientSocket.end();
         return;
       }
-      const [host, portStr] = req.url.split(":");
-      const port = parseInt(portStr, 10) || 443;
+      // Parse host:port properly (IPv6 literals break a naive split).
+      const { host, port } = parseConnectTarget(req.url);
       // Connect to the pinned validated IP so a rebind at connect time can't
       // swap in a private address between our check and the socket.
       const upstream = net.connect(port, ip || host, () => {

package/src/lib/sandbox-network-policy.js

@@ -60,6 +60,24 @@ function anyMatch(host, patterns) {
   return (patterns || []).some((p) => matchesDomain(host, p));
 }
 
+/**
+ * If `h` is an IPv4-mapped IPv6 address, return the embedded IPv4 in dotted
+ * form; else null. Handles both the dotted tail ("::ffff:127.0.0.1", how a user
+ * might type it) and the compressed-hex tail ("::ffff:7f00:1", how Node's URL
+ * parser serializes it). The hex tail is two 16-bit groups = the 32-bit IPv4.
+ */
+function mappedIpv4Tail(h) {
+  const dotted = h.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  if (dotted) return dotted[1];
+  const hex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
+  }
+  return null;
+}
+
 /** Private / loopback / link-local / cloud-metadata target? (SSRF guard) */
 export function isPrivateHost(host) {
   if (!host) return false;
@@ -70,10 +88,14 @@ export function isPrivateHost(host) {
   // IPv6 loopback / unique-local / link-local.
   if (h === "::1" || h === "::") return true;
   if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true; // fc00::/7 unique-local
-  if (/^fe80:/i.test(h)) return true; // link-local
-  // IPv4-mapped IPv6 (::ffff:127.0.0.1) — check the tail.
-  const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  const ipv4 = mapped ? mapped[1] : h;
+  if (/^fe[89ab][0-9a-f]:/i.test(h)) return true; // fe80::/10 link-local (fe80–febf)
+  // IPv4-mapped IPv6 — check the embedded IPv4 tail. Node's WHATWG URL parser
+  // serializes "[::ffff:127.0.0.1]" as COMPRESSED HEX ("::ffff:7f00:1"), never
+  // dotted-decimal, so we must decode BOTH forms or the guard is dead code for
+  // any URL/bracketed input (loopback, private ranges, AND 169.254.169.254 all
+  // sail through — confirmed SSRF bypass). Bare non-URL hosts may still arrive
+  // dotted, so keep that form too.
+  const ipv4 = mappedIpv4Tail(h) || h;
   const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (m) {
     const [a, b] = [Number(m[1]), Number(m[2])];

package/src/lib/telemetry/span-recorder.js

@@ -20,6 +20,16 @@ function spanId() {
   return _seq.toString(16).padStart(16, "0");
 }
 
+// One trace per recorder (a "run"). The OTLP/OTel spec treats an ALL-ZERO
+// traceId as INVALID, so a strict collector would drop every span exported with
+// `"0".repeat(32)` — defeating toOtlp()'s purpose. Derive a non-zero, monotonic
+// (RNG-free, snapshot-replayable) 32-hex traceId per recorder instead.
+let _traceSeq = 0;
+function newTraceId() {
+  _traceSeq = (_traceSeq + 1) % Number.MAX_SAFE_INTEGER;
+  return _traceSeq.toString(16).padStart(32, "0"); // never all-zero (starts at 1)
+}
+
 export class TelemetryRecorder {
   constructor({
     now = () => Date.now(),
@@ -27,6 +37,7 @@ export class TelemetryRecorder {
   } = {}) {
     this._now = typeof now === "function" ? now : () => now;
     this.serviceName = serviceName;
+    this.traceId = newTraceId(); // one trace per recorder (valid non-zero id)
     this._spans = []; // completed spans
     this._counters = new Map(); // name → { total, byAttr }
     this._failures = new Map(); // category → count
@@ -171,7 +182,7 @@ export class TelemetryRecorder {
             {
               scope: { name: "chainlesschain.cli" },
               spans: this._spans.map((s) => ({
-                traceId: "0".repeat(32),
+                traceId: this.traceId,
                 spanId: s.id,
                 parentSpanId: s.parentId || "",
                 name: s.name,

package/src/assets/web-panel/assets/Terminal-CD132d2Y.js

@@ -1,3 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./xterm-BZcWGsqw.js","./markdown-CsiA8-E5.js","./markdown-Dfs9RUU9.css","./addon-fit-CK6X9sAG.js","./xterm-DFuMZ0ql.css"])))=>i.map(i=>d[i]);
-import{u as fe,_ as me,d as B,e as U}from"./index-DfgCdFrN.js";import{I as z,J as x,U as _,Q as D,S as K,K as T,V as R,c as A,F as Q,Z,R as E,o as G,f as H,w as $,n as V,b as ee,r as S,P as y,_ as ve,a2 as we,a3 as he,a4 as _e}from"./vendor-BMxUs6UX.js";import{R as ye,b as pe,as as ge}from"./icons-BsDmGpcT.js";const k=new Map,C=new Map,N=new Set,F=new Set;let te=!1;function xe(c){te||(te=!0,c.onMessage(o=>{if(!(!o||typeof o.type!="string")){if(o.type==="terminal.stdout"){const{sessionId:s,data:e,seq:i}=o.payload||{};if(!s)return;let w;try{const d=atob(e||""),f=new Uint8Array(d.length);for(let n=0;n<d.length;n++)f[n]=d.charCodeAt(n);w=new TextDecoder("utf-8").decode(f)}catch{w=""}const u={sessionId:s,data:w,seq:i};k.get(s)?.forEach(d=>d(u)),N.forEach(d=>d(u))}else if(o.type==="terminal.exit"){const{sessionId:s,exitCode:e,signal:i}=o.payload||{};if(!s)return;const w={sessionId:s,exitCode:e,signal:i};C.get(s)?.forEach(u=>u(w)),F.forEach(u=>u(w))}}}))}function ne(c){const o=new TextEncoder().encode(c);let s="";for(let e=0;e<o.length;e++)s+=String.fromCharCode(o[e]);return btoa(s)}function ae(c){const o=atob(c||""),s=new Uint8Array(o.length);for(let e=0;e<o.length;e++)s[e]=o.charCodeAt(e);return new TextDecoder("utf-8").decode(s)}function oe(){const c=fe();xe(c);async function o(n={}){const a=await c.sendRaw({type:"terminal.create",payload:{shell:n.shell,cwd:n.cwd,env:n.env,cols:n.cols,rows:n.rows}});if(a.ok===!1)throw new Error(a.error||"terminal_create_failed");return a.result??a}async function s(){const n=await c.sendRaw({type:"terminal.list",payload:{}});if(n.ok===!1)throw new Error(n.error||"terminal_list_failed");const a=n.result??n;return Array.isArray(a.sessions)?a.sessions:[]}async function e(n,a){const r=await c.sendRaw({type:"terminal.stdin",payload:{sessionId:n,data:ne(String(a))}});if(r.ok===!1)throw new Error(r.error||"terminal_stdin_failed");return r.result??r}async function i(n,a,r){const h=await c.sendRaw({type:"terminal.resize",payload:{sessionId:n,cols:a,rows:r}});if(h.ok===!1)throw new Error(h.error||"terminal_resize_failed");return h.result??h}async function w(n){const a=await c.sendRaw({type:"terminal.close",payload:{sessionId:n}});if(a.ok===!1)throw new Error(a.error||"terminal_close_failed");return a.result??a}async function u(n,a=0){const r=await c.sendRaw({type:"terminal.history",payload:{sessionId:n,fromSeq:a}});if(r.ok===!1)throw new Error(r.error||"terminal_history_failed");const h=r.result??r;return{truncated:!!h.truncated,chunks:(h.chunks||[]).map(L=>({seq:L.seq,data:ae(L.data)}))}}function d(n,a){return n?(k.has(n)||k.set(n,new Set),k.get(n).add(a),()=>{k.get(n)?.delete(a),k.get(n)?.size===0&&k.delete(n)}):(N.add(a),()=>N.delete(a))}function f(n,a){return n?(C.has(n)||C.set(n,new Set),C.get(n).add(a),()=>{C.get(n)?.delete(a),C.get(n)?.size===0&&C.delete(n)}):(F.add(a),()=>F.delete(a))}return{create:o,list:s,stdin:e,resize:i,close:w,history:u,onStdout:d,onExit:f,_internal:{stdoutSubs:k,exitSubs:C,toBase64Utf8:ne,fromBase64Utf8:ae}}}const Se={__name:"Terminal",setup(c,{expose:o}){o();const s=oe(),e=S([]),i=S(null),w=S("pwsh"),u=S(!1),d=S(!1),f=S(""),n=S(""),a=S([]),r=[{value:"pwsh",label:"PowerShell"},{value:"cmd",label:"CMD"},{value:"bash",label:"Bash"},{value:"wsl",label:"WSL"}],h=ee(()=>e.value.find(t=>t.id===i.value));function L(t){return t?t.slice(0,8):""}let O=null,M=null;async function I(){if(O)return{xtermMod:O,fitAddonMod:M};try{O=await U(()=>import("./xterm-BZcWGsqw.js").then(t=>t.x),__vite__mapDeps([0,1,2]),import.meta.url),M=await U(()=>import("./addon-fit-CK6X9sAG.js").then(t=>t.a),__vite__mapDeps([3,1,2]),import.meta.url),await U(()=>Promise.resolve({}),__vite__mapDeps([4]),import.meta.url)}catch(t){throw n.value="xterm 资源加载失败："+(t?.message||"未知错误"),t}return{xtermMod:O,fitAddonMod:M}}async function q(t){await V();const{xtermMod:l,fitAddonMod:p}=await I(),b=a.value.find(v=>v?.dataset?.sessionId===t.id);if(!b)return;const m=new l.Terminal({cursorBlink:!0,fontFamily:'Consolas, "Courier New", monospace',fontSize:13,theme:{background:"#1e1e1e",foreground:"#d4d4d4"},convertEol:!1}),P=new p.FitAddon;m.loadAddon(P),m.open(b);try{P.fit()}catch{}t.xterm=m,t.fitAddon=P;const ie=m.onData(v=>{s.stdin(t.id,v).catch(g=>{String(g?.message||"").includes("dangerous_keyword_blocked")?B.warning("该命令被桌面端拦截（高危关键字）"):B.error("stdin 失败: "+(g?.message||g))})}),ce=s.onStdout(t.id,({data:v,seq:g})=>{t.lastSeq=g,m.write(v)}),de=s.onExit(t.id,({exitCode:v,signal:g})=>{t.alive=!1,t.exitCode=v,t.signal=g,m.writeln(`\r
-\x1B[33m[session exited, code=${v}, signal=${g??"-"}]\x1B[0m`)});t.offs=()=>{try{ie.dispose?.()}catch{}ce(),de()};try{const{chunks:v,truncated:g}=await s.history(t.id,0);g&&m.writeln("\x1B[2m[history truncated — earlier output was evicted]\x1B[0m");for(const J of v)m.write(J.data),t.lastSeq=J.seq}catch(v){m.writeln(`\x1B[31m[history fetch failed: ${v?.message||v}]\x1B[0m`)}const j=new ResizeObserver(()=>{try{P.fit(),s.resize(t.id,m.cols,m.rows).catch(()=>{})}catch{}});j.observe(b);const ue=t.offs;t.offs=()=>{try{j.disconnect()}catch{}ue()}}async function re(){u.value=!0,f.value="";try{const t=await s.create({shell:w.value,cols:80,rows:24}),l={id:t.sessionId,shell:t.shell,cwd:"",alive:!0,lastSeq:0,exitCode:null,xterm:null,fitAddon:null,offs:()=>{}};e.value.push(l),i.value=l.id,await q(l)}catch(t){f.value=t?.message||String(t)}finally{u.value=!1}}async function se(t){try{await s.close(t)}catch(l){f.value=l?.message||String(l)}setTimeout(()=>W(t),500)}function W(t){const l=e.value.findIndex(b=>b.id===t);if(l===-1)return;const p=e.value[l];try{p.offs?.()}catch{}try{p.xterm?.dispose?.()}catch{}e.value.splice(l,1),i.value===t&&(i.value=e.value[0]?.id||null)}function le(t){i.value=t,V(()=>{const l=e.value.find(p=>p.id===t);try{l?.fitAddon?.fit()}catch{}})}async function X(){d.value=!0,f.value="";try{const t=await s.list();for(const l of t){const p=e.value.find(m=>m.id===l.id);if(p){p.alive=l.alive,p.lastSeq=l.lastSeq;continue}const b={id:l.id,shell:l.shell,cwd:l.cwd,alive:l.alive,lastSeq:l.lastSeq,exitCode:null,xterm:null,fitAddon:null,offs:()=>{}};e.value.push(b),await q(b)}!i.value&&e.value.length>0&&(i.value=e.value[0].id)}catch(t){f.value=t?.message||String(t)}finally{d.value=!1}}G(async()=>{await X()}),H(()=>{for(const t of e.value){try{t.offs?.()}catch{}try{t.xterm?.dispose?.()}catch{}}}),$(i,()=>{V(()=>{const t=h.value;try{t?.fitAddon?.fit()}catch{}})});const Y={term:s,sessions:e,activeId:i,newShell:w,creating:u,loadingList:d,error:f,warning:n,xtermContainers:a,shellOptions:r,active:h,shortId:L,get xtermMod(){return O},set xtermMod(t){O=t},get fitAddonMod(){return M},set fitAddonMod(t){M=t},loadXterm:I,mountXterm:q,onCreate:re,onClose:se,removeSession:W,activate:le,refreshList:X,ref:S,computed:ee,onMounted:G,onBeforeUnmount:H,nextTick:V,watch:$,get message(){return B},get PlusOutlined(){return ge},get CloseOutlined(){return pe},get ReloadOutlined(){return ye},get useTerminal(){return oe}};return Object.defineProperty(Y,"__isScriptSetup",{enumerable:!1,value:!0}),Y}},be={class:"terminal-page"},ke={class:"terminal-header"},Ce={class:"page-sub"},Ae={class:"terminal-body"},Ee={class:"session-tabs"},Oe=["onClick"],Te={class:"session-shell"},Re={class:"session-id"},Me={key:0,class:"session-empty"},ze={class:"xterm-host"},Le=["data-session-id"],Pe={key:0,class:"xterm-placeholder"},De={key:1,class:"terminal-footer"},Ve={key:0,class:"footer-exit"};function qe(c,o,s,e,i,w){const u=z("a-tag"),d=z("a-select"),f=z("a-button"),n=z("a-space"),a=z("a-alert");return y(),x("div",be,[_("div",ke,[_("div",null,[o[3]||(o[3]=_("h2",{class:"page-title"},"远程终端",-1)),_("p",Ce,[o[2]||(o[2]=D(" 桌面端托管的 PTY 会话；Android 端可远程操控同一通道 ",-1)),e.warning?(y(),K(u,{key:0,color:"orange",style:{"margin-left":"8px"}},{default:T(()=>[D(E(e.warning),1)]),_:1})):R("v-if",!0)])]),A(n,null,{default:T(()=>[A(d,{value:e.newShell,"onUpdate:value":o[0]||(o[0]=r=>e.newShell=r),style:{width:"130px"},size:"small",options:e.shellOptions},null,8,["value"]),A(f,{type:"primary",size:"small",loading:e.creating,onClick:e.onCreate},{icon:T(()=>[A(e.PlusOutlined)]),default:T(()=>[o[4]||(o[4]=D(" 新会话 ",-1))]),_:1},8,["loading"]),A(f,{size:"small",loading:e.loadingList,onClick:e.refreshList},{icon:T(()=>[A(e.ReloadOutlined)]),default:T(()=>[o[5]||(o[5]=D(" 刷新 ",-1))]),_:1},8,["loading"])]),_:1})]),e.error?(y(),K(a,{key:0,message:e.error,type:"error","show-icon":"",closable:"",style:{"margin-bottom":"12px"},onClose:o[1]||(o[1]=r=>e.error="")},null,8,["message"])):R("v-if",!0),_("div",Ae,[_("div",Ee,[(y(!0),x(Q,null,Z(e.sessions,r=>(y(),x("div",{key:r.id,class:ve(["session-tab",{active:r.id===e.activeId,dead:!r.alive}]),onClick:h=>e.activate(r.id)},[_("span",Te,E(r.shell),1),_("span",Re,E(e.shortId(r.id)),1),A(e.CloseOutlined,{class:"session-close",onClick:we(h=>e.onClose(r.id),["stop"])},null,8,["onClick"])],10,Oe))),128)),e.sessions.length===0?(y(),x("div",Me,' 点击 "新会话" 创建第一个终端 ')):R("v-if",!0)]),_("div",ze,[(y(!0),x(Q,null,Z(e.sessions,r=>he((y(),x("div",{key:r.id,ref_for:!0,ref:"xtermContainers","data-session-id":r.id,class:"xterm-container"},null,8,Le)),[[_e,r.id===e.activeId]])),128)),e.sessions.length===0?(y(),x("div",Pe,[...o[6]||(o[6]=[_("span",null,"无活跃会话",-1)])])):R("v-if",!0)])]),e.active?(y(),x("div",De,[_("span",null,E(e.active.shell)+" · "+E(e.active.cwd||"(默认 cwd)")+" · seq "+E(e.active.lastSeq),1),e.active.alive?R("v-if",!0):(y(),x("span",Ve,"已退出 (code="+E(e.active.exitCode??"-")+")",1))])):R("v-if",!0)])}const Fe=me(Se,[["render",qe],["__scopeId","data-v-65366a29"],["__file","/tmp/cc-web-panel-1VVfY7/repo/packages/web-panel/src/views/Terminal.vue"]]);export{Fe as default};

package/src/assets/web-panel/assets/devWarning-WDr3_M_N.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-DfgCdFrN.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-Dwix3p4g.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-BdM70oda.js";import{a0 as t}from"./index-DfgCdFrN.js";import"./vendor-BMxUs6UX.js";import"./responsiveObserve-wruHk-h5.js";import"./useFlexGapSupport-BxPcq6pj.js";import"./styleChecker-CRa-GZpX.js";import"./index-Cj0OZ-37.js";import"./icons-BsDmGpcT.js";const l=t(o);export{l as default};

package/src/assets/web-panel/assets/index-SHaoZ0CA.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-CH-bDkzs.js";import{a0 as t}from"./index-DfgCdFrN.js";import"./vendor-BMxUs6UX.js";import"./index-Cj0OZ-37.js";import"./icons-BsDmGpcT.js";const s=t(o);export{s as default};