chainlesschain 0.162.150 → 0.162.152

package/src/lib/plugin-runtime/install.js

@@ -29,7 +29,7 @@ import {
   discoverPlugins,
 } from "./scopes.js";
 import { verifyPluginManifest } from "../plugin-security.js";
-import { writePluginLock } from "./signature.js";
+import { writePluginLock, LOCK_FILENAME } from "./signature.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -97,6 +97,12 @@ export function installFromDirectory(srcDir, opts = {}) {
   _deps.mkdirSync(dest, { recursive: true });
   copyDirGuarded(src, dest, dest);
 
+  // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
+  // and may ship its own `.plugin-lock.json` (copied verbatim above) — on an
+  // unsigned install that forged lock would otherwise survive into the
+  // "immutable" version dir and defeat load-time requireSignedPlugins.
+  _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
+
   // Record the verified signature into the installed (immutable) version dir so
   // load-time enforcement can re-check it. The manifest was copied verbatim, so
   // its bytes/sha in `dest` match what we verified in `src`.
@@ -110,6 +116,8 @@ export function installFromDirectory(srcDir, opts = {}) {
       sha256: verification.sha256,
       publicKeySha256: verification.publicKeySha256,
       signatureVerified: verification.signatureVerified === true,
+      signatureBase64: verification.signatureBase64,
+      publicKeyPem: verification.publicKeyPem,
     });
   }
 
@@ -245,6 +253,17 @@ export function parseGitSource(raw) {
  * command line — no injection). Caller removes the temp dir's parent.
  */
 export function fetchGitRepo(url, ref) {
+  // git argv-injection guard: a value starting with "-" is parsed by git as an
+  // OPTION, not a URL/ref — e.g. a registry-supplied ref "-f" reaches
+  // `git checkout <ref>` on the full-clone retry path, and an option-looking
+  // url reaches `git clone`. Real git URLs/refs never start with "-"
+  // (check-ref-format forbids it), so reject instead of trying to escape.
+  if (String(url).startsWith("-")) {
+    throw new Error(`refusing git source that looks like an option: ${url}`);
+  }
+  if (ref != null && String(ref).startsWith("-")) {
+    throw new Error(`refusing git ref that looks like an option: ${ref}`);
+  }
   const base = _deps.mkdtempSync(path.join(os.tmpdir(), "cc-plugin-git-"));
   const dir = path.join(base, "repo");
   const run = (args) =>

package/src/lib/plugin-runtime/monitors.js

@@ -79,11 +79,27 @@ export function collectPluginMonitors(opts = {}) {
   for (const p of trusted) {
     if (!p.manifest || p.manifest.ok !== true) continue;
     const m = p.manifest.components?.monitors;
-    if (!m || !m.absPath) continue;
+    if (!m) continue;
     let parsed;
-    try {
-      parsed = JSON.parse(_deps.readFileSync(m.absPath, "utf8"));
-    } catch {
+    if (m.absPath) {
+      try {
+        parsed = JSON.parse(_deps.readFileSync(m.absPath, "utf8"));
+      } catch {
+        continue;
+      }
+    } else if (m.inline) {
+      // Monitors declared inline in plugin.json — the normalized component keeps
+      // only counts, so re-read the raw manifest for the actual entries (same
+      // approach as the MCP collector). Without this, inline monitors never spawn.
+      try {
+        const raw = JSON.parse(
+          _deps.readFileSync(p.manifest.manifestPath, "utf8"),
+        );
+        parsed = raw && typeof raw === "object" ? raw.monitors : null;
+      } catch {
+        continue;
+      }
+    } else {
       continue;
     }
     const list = Array.isArray(parsed?.monitors)

package/src/lib/plugin-runtime/policy.js

@@ -115,6 +115,19 @@ export function filterByManagedPolicy(plugins, managed) {
       continue;
     }
     if (requireSigned) {
+      // Fail closed when no signing keys are pinned: a lock's signature can be
+      // SELF-signed by whoever authored the plugin (the lock lives in a
+      // writable dir), so "signed by anyone" is not a guarantee. Without
+      // trustedPluginKeySha256 the gate would accept any self-signed drop-in.
+      if (!trustedKeys || trustedKeys.size === 0) {
+        dropped.push({
+          name: p.name,
+          reason:
+            "requireSignedPlugins: no trustedPluginKeySha256 fingerprints " +
+            "configured (fail-closed — pin the org's signing keys)",
+        });
+        continue;
+      }
       const v = verifyInstalledSignature(p, { trustedKeys });
       if (!v.signed) {
         dropped.push({

package/src/lib/plugin-runtime/remote-source.js

@@ -46,6 +46,39 @@ export function isRemoteSource(raw) {
   return /^https?:\/\//i.test(s) && /\.json(\?.*)?(#.*)?$/i.test(s);
 }
 
+/**
+ * Enforce HTTPS for registry URLs. The registry supplies BOTH the git source
+ * and its claimed sha256 — over plain HTTP a network MITM controls the two
+ * together, so the integrity check verifies nothing. Loopback is exempt (a
+ * local dev registry isn't MITM-able off-host); anything else needs the
+ * explicit opt-in (opts.allowInsecure / CC_PLUGIN_REGISTRY_ALLOW_HTTP=1).
+ */
+export function assertRegistryUrlSafe(url, { allowInsecure = false } = {}) {
+  let u;
+  try {
+    u = new URL(String(url));
+  } catch {
+    throw new Error(`invalid registry URL: ${url}`);
+  }
+  if (u.protocol === "https:") return;
+  if (u.protocol !== "http:") {
+    throw new Error(`registry URL must be http(s): ${url}`);
+  }
+  // WHATWG URL keeps the brackets on IPv6 hostnames — strip before comparing.
+  const host = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const loopback =
+    host === "localhost" || host === "127.0.0.1" || host === "::1";
+  const optIn =
+    allowInsecure === true || process.env.CC_PLUGIN_REGISTRY_ALLOW_HTTP === "1";
+  if (loopback || optIn) return;
+  throw new Error(
+    `plain-HTTP registry rejected: ${url} — a network MITM controls both the ` +
+      `source and its sha256, so the integrity check verifies nothing. Use ` +
+      `https, or opt in with --allow-insecure-registry / ` +
+      `CC_PLUGIN_REGISTRY_ALLOW_HTTP=1 on a trusted network.`,
+  );
+}
+
 /** Where a fetched registry is cached (content-addressed by its URL). */
 export function registryCachePath(url, cacheDir) {
   const dir =
@@ -93,6 +126,7 @@ export async function fetchRegistry(url, opts = {}) {
     timeoutMs = DEFAULT_TIMEOUT_MS,
     allowCache = true,
   } = opts;
+  assertRegistryUrlSafe(url, { allowInsecure: opts.allowInsecure });
   const cachePath = registryCachePath(url, cacheDir);
   const headers = { Accept: "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;

package/src/lib/plugin-runtime/signature.js

@@ -7,20 +7,24 @@
  * install records the verification result in a `.plugin-lock.json` inside the
  * immutable version dir; discovery then re-checks it fail-closed.
  *
- * The lock records the manifest's sha256 + the signing key's fingerprint. At
- * load we RE-HASH the on-disk manifest and compare — so a manifest tampered with
- * after install (even inside the version dir) fails the check. The signature
- * itself covers only the manifest file, not every component file — that is a
+ * The lock persists the DETACHED SIGNATURE + PUBLIC KEY themselves (lockVersion
+ * 2), and load-time verification re-runs the actual Ed25519 verify over the
+ * on-disk manifest bytes. The lock file lives in a writable plugin dir, so
+ * nothing in it can be TRUSTED — a recorded boolean or fingerprint could simply
+ * be forged by whoever authored the plugin. What a forger CANNOT do is produce a
+ * signature that verifies under a key the org has pinned via
+ * trustedPluginKeySha256 — which is why the key fingerprint used for the trust
+ * check is COMPUTED from the embedded public key, never read from the lock.
+ * The signature covers only the manifest file, not every component file — a
  * known limitation (documented), an integrity anchor rather than a full
- * supply-chain seal; the immutable version dir + this re-hash catch manifest
- * tampering, which is where the component wiring is declared.
+ * supply-chain seal; the manifest is where the component wiring is declared.
  */
 
-import { createHash } from "node:crypto";
+import { createHash, createPublicKey, verify } from "node:crypto";
 import fs from "fs";
 import path from "path";
 
-const LOCK = ".plugin-lock.json";
+export const LOCK_FILENAME = ".plugin-lock.json";
 
 export const _deps = {
   readFileSync: fs.readFileSync,
@@ -31,18 +35,29 @@ export const _deps = {
 /** Record a verified signature into the version dir. */
 export function writePluginLock(
   versionDir,
-  { manifestFile, sha256, publicKeySha256, signatureVerified },
+  {
+    manifestFile,
+    sha256,
+    publicKeySha256,
+    signatureVerified,
+    signatureBase64,
+    publicKeyPem,
+  },
 ) {
   const rel = path.relative(versionDir, manifestFile).replace(/\\/g, "/");
   const lock = {
-    lockVersion: 1,
+    lockVersion: 2,
     manifest: rel || "plugin.json",
     sha256,
     publicKeySha256: publicKeySha256 || null,
     signatureVerified: signatureVerified === true,
+    // The material load-time enforcement actually re-verifies. Without these a
+    // lock is just self-asserted JSON and counts as unsigned.
+    signatureBase64: signatureBase64 || null,
+    publicKeyPem: publicKeyPem || null,
   };
   _deps.writeFileSync(
-    path.join(versionDir, LOCK),
+    path.join(versionDir, LOCK_FILENAME),
     JSON.stringify(lock, null, 2),
     "utf8",
   );
@@ -51,7 +66,7 @@ export function writePluginLock(
 
 /** Read a version dir's signature lock, or null when absent/unreadable. */
 export function readPluginLock(versionDir) {
-  const p = path.join(versionDir, LOCK);
+  const p = path.join(versionDir, LOCK_FILENAME);
   if (!_deps.existsSync(p)) return null;
   try {
     return JSON.parse(_deps.readFileSync(p, "utf8"));
@@ -62,9 +77,11 @@ export function readPluginLock(versionDir) {
 
 /**
  * Verify an installed plugin's recorded signature against its on-disk manifest.
- * `signed:true` ONLY when a lock exists, was signature-verified, the manifest
- * still hashes to the locked sha256 (tamper detection), and — when trustedKeys
- * is a non-empty Set — the signing key fingerprint is among them.
+ * `signed:true` ONLY when a lock exists, carries real signature material, the
+ * embedded Ed25519 signature VERIFIES over the on-disk manifest bytes, and —
+ * when trustedKeys is a non-empty Set — the signing key's COMPUTED fingerprint
+ * is among them. Every field of the lock is treated as attacker-writable; the
+ * only trust anchors are the cryptographic verify and the caller's trustedKeys.
  *
  * @param {{root:string}} plugin
  * @param {object} [opts] { trustedKeys?: Set<string> }
@@ -77,31 +94,87 @@ export function verifyInstalledSignature(plugin, opts = {}) {
     return { signed: false, reason: "lock is not signature-verified" };
   }
   const manifestFile = path.join(plugin.root, lock.manifest || "plugin.json");
+  // `lock.manifest` is untrusted — it lives in the (writable) plugin dir. A lock
+  // pointing OUTSIDE the plugin root (`manifest: "../../secret"`) would make us
+  // re-hash an arbitrary file and, with a matching locked sha256, forge
+  // signed:true — which gates load-time requireSignedPlugins. A plugin's manifest
+  // is ALWAYS inside its own root, so reject any path that escapes it (boundary
+  // via path.relative, not startsWith — the sandbox-fs-policy pattern).
+  const rel = path.relative(
+    path.resolve(plugin.root),
+    path.resolve(manifestFile),
+  );
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+    return {
+      signed: false,
+      reason: "lock manifest path escapes the plugin root",
+    };
+  }
   if (!_deps.existsSync(manifestFile)) {
     return { signed: false, reason: "locked manifest file is missing" };
   }
-  let sha;
+  let bytes;
   try {
-    sha = createHash("sha256")
-      .update(_deps.readFileSync(manifestFile))
-      .digest("hex");
+    bytes = _deps.readFileSync(manifestFile);
   } catch {
     return { signed: false, reason: "manifest unreadable" };
   }
+  const sha = createHash("sha256").update(bytes).digest("hex");
   if (sha.toLowerCase() !== String(lock.sha256 || "").toLowerCase()) {
     return {
       signed: false,
       reason: "manifest tampered since install (sha256 mismatch)",
     };
   }
+  // A lock without real signature material is unverifiable, and therefore
+  // worthless as a signing gate: `signatureVerified:true` is just a JSON field
+  // anyone can write. Legacy (lockVersion 1) locks land here too — reinstalling
+  // the plugin with --signature re-records a verifiable lock.
+  if (!lock.signatureBase64 || !lock.publicKeyPem) {
+    return {
+      signed: false,
+      reason:
+        "lock lacks signature material (legacy or hand-written lock — " +
+        "reinstall the plugin with --signature to re-record it)",
+    };
+  }
+  let keyObject;
+  let publicKeySha256;
+  try {
+    keyObject = createPublicKey(lock.publicKeyPem);
+    // Fingerprint is COMPUTED from the embedded key — the lock's own
+    // publicKeySha256 field is attacker-writable and never used for trust.
+    publicKeySha256 = createHash("sha256")
+      .update(keyObject.export({ type: "spki", format: "der" }))
+      .digest("hex");
+  } catch {
+    return { signed: false, reason: "lock public key is not a valid key" };
+  }
+  let sigOk = false;
+  try {
+    sigOk = verify(
+      null,
+      bytes,
+      keyObject,
+      Buffer.from(String(lock.signatureBase64), "base64"),
+    );
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) {
+    return {
+      signed: false,
+      reason: "recorded signature does not verify over the on-disk manifest",
+    };
+  }
   const trustedKeys = opts.trustedKeys;
   if (trustedKeys && trustedKeys.size > 0) {
-    if (!lock.publicKeySha256 || !trustedKeys.has(lock.publicKeySha256)) {
+    if (!trustedKeys.has(publicKeySha256)) {
       return {
         signed: false,
-        reason: `signing key not trusted (${lock.publicKeySha256 || "unsigned"})`,
+        reason: `signing key not trusted (${publicKeySha256})`,
       };
     }
   }
-  return { signed: true, publicKeySha256: lock.publicKeySha256 };
+  return { signed: true, publicKeySha256 };
 }

package/src/lib/plugin-security.js

@@ -80,16 +80,19 @@ export function verifyPluginManifest({
 
   const wantsSignature = requireSignature || signatureFile || publicKeyFile;
   let signatureVerified = false;
+  let signature = null;
+  let publicKeyPem = null;
+  let publicKeySha256 = null;
   if (wantsSignature) {
     if (!signatureFile || !publicKeyFile) {
       throw new Error(
         "plugin signature verification requires --signature and --public-key",
       );
     }
-    const signature = readFileSync(signatureFile);
-    const publicKey = readFileSync(publicKeyFile, "utf8");
-    const keyObject = createPublicKey(publicKey);
-    const publicKeySha256 = createHash("sha256")
+    signature = readFileSync(signatureFile);
+    publicKeyPem = readFileSync(publicKeyFile, "utf8");
+    const keyObject = createPublicKey(publicKeyPem);
+    publicKeySha256 = createHash("sha256")
       .update(keyObject.export({ type: "spki", format: "der" }))
       .digest("hex");
     const trusted = stringSet(trustedKeySha256);
@@ -110,16 +113,12 @@ export function verifyPluginManifest({
     bytes,
     sha256,
     signatureVerified,
-    publicKeySha256: signatureVerified
-      ? createHash("sha256")
-          .update(
-            createPublicKey(readFileSync(publicKeyFile, "utf8")).export({
-              type: "spki",
-              format: "der",
-            }),
-          )
-          .digest("hex")
-      : null,
+    publicKeySha256: signatureVerified ? publicKeySha256 : null,
+    // The raw signature material, so the installer can persist it and load-time
+    // enforcement can CRYPTOGRAPHICALLY re-verify (not merely trust a recorded
+    // boolean, which a hand-written lock file could forge).
+    signatureBase64: signatureVerified ? signature.toString("base64") : null,
+    publicKeyPem: signatureVerified ? publicKeyPem : null,
   };
 }
 

package/src/lib/sandbox-egress-proxy.js

@@ -72,6 +72,42 @@ async function guardResolvedTarget(host, policy, lookup) {
   return { ok: true, ip: typeof first === "string" ? first : first.address };
 }
 
+/**
+ * Parse a CONNECT request target ("host:port") into `{ host, port }`. A naive
+ * `split(":")` mangles IPv6 literals — `[2001:db8::1]:8443` would yield host
+ * `"[2001"` and a NaN port that silently defaults to 443, so even an IP-pinned
+ * tunnel connects to the WRONG port (and, when unpinned, the wrong host). Handle
+ * the bracketed-IPv6, bare-IPv6, and `name[:port]` forms explicitly. Port
+ * defaults to 443 (the CONNECT/HTTPS default).
+ */
+export function parseConnectTarget(target) {
+  const s = String(target == null ? "" : target).trim();
+  const toPort = (v) => {
+    const n = parseInt(v, 10);
+    return Number.isInteger(n) && n > 0 && n <= 65535 ? n : 443;
+  };
+  // Bracketed IPv6: "[::1]" or "[::1]:8443"
+  if (s.startsWith("[")) {
+    const end = s.indexOf("]");
+    if (end > 0) {
+      const host = s.slice(1, end);
+      const rest = s.slice(end + 1); // "" or ":8443"
+      return { host, port: rest.startsWith(":") ? toPort(rest.slice(1)) : 443 };
+    }
+    // malformed bracket — fall through to the generic handling
+  }
+  // Bare IPv6 literal (2+ colons, no brackets) → no port component to split off.
+  if ((s.match(/:/g) || []).length > 1) {
+    return { host: s, port: 443 };
+  }
+  // "name:port" (rsplit on the single colon) or bare "name".
+  const idx = s.lastIndexOf(":");
+  if (idx > 0) {
+    return { host: s.slice(0, idx), port: toPort(s.slice(idx + 1)) };
+  }
+  return { host: s, port: 443 };
+}
+
 /**
  * Build the proxy env vars a child process needs to route through the proxy.
  * `NO_PROXY` is intentionally empty so nothing bypasses the filter.
@@ -204,8 +240,8 @@ export function createEgressProxy(policy = {}, opts = {}) {
         clientSocket.end();
         return;
       }
-      const [host, portStr] = req.url.split(":");
-      const port = parseInt(portStr, 10) || 443;
+      // Parse host:port properly (IPv6 literals break a naive split).
+      const { host, port } = parseConnectTarget(req.url);
       // Connect to the pinned validated IP so a rebind at connect time can't
       // swap in a private address between our check and the socket.
       const upstream = net.connect(port, ip || host, () => {

package/src/lib/sandbox-network-policy.js

@@ -60,6 +60,24 @@ function anyMatch(host, patterns) {
   return (patterns || []).some((p) => matchesDomain(host, p));
 }
 
+/**
+ * If `h` is an IPv4-mapped IPv6 address, return the embedded IPv4 in dotted
+ * form; else null. Handles both the dotted tail ("::ffff:127.0.0.1", how a user
+ * might type it) and the compressed-hex tail ("::ffff:7f00:1", how Node's URL
+ * parser serializes it). The hex tail is two 16-bit groups = the 32-bit IPv4.
+ */
+function mappedIpv4Tail(h) {
+  const dotted = h.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  if (dotted) return dotted[1];
+  const hex = h.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
+  }
+  return null;
+}
+
 /** Private / loopback / link-local / cloud-metadata target? (SSRF guard) */
 export function isPrivateHost(host) {
   if (!host) return false;
@@ -70,10 +88,14 @@ export function isPrivateHost(host) {
   // IPv6 loopback / unique-local / link-local.
   if (h === "::1" || h === "::") return true;
   if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true; // fc00::/7 unique-local
-  if (/^fe80:/i.test(h)) return true; // link-local
-  // IPv4-mapped IPv6 (::ffff:127.0.0.1) — check the tail.
-  const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  const ipv4 = mapped ? mapped[1] : h;
+  if (/^fe[89ab][0-9a-f]:/i.test(h)) return true; // fe80::/10 link-local (fe80–febf)
+  // IPv4-mapped IPv6 — check the embedded IPv4 tail. Node's WHATWG URL parser
+  // serializes "[::ffff:127.0.0.1]" as COMPRESSED HEX ("::ffff:7f00:1"), never
+  // dotted-decimal, so we must decode BOTH forms or the guard is dead code for
+  // any URL/bracketed input (loopback, private ranges, AND 169.254.169.254 all
+  // sail through — confirmed SSRF bypass). Bare non-URL hosts may still arrive
+  // dotted, so keep that form too.
+  const ipv4 = mappedIpv4Tail(h) || h;
   const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (m) {
     const [a, b] = [Number(m[1]), Number(m[2])];

package/src/lib/telemetry/span-recorder.js

@@ -20,6 +20,23 @@ function spanId() {
   return _seq.toString(16).padStart(16, "0");
 }
 
+// One trace per recorder (a "run"). The OTLP/OTel spec treats an ALL-ZERO
+// traceId as INVALID, so a strict collector would drop every span exported with
+// `"0".repeat(32)` — defeating toOtlp()'s purpose. A bare counter is non-zero
+// but resets every PROCESS, so successive CLI runs all exported trace
+// `000…001` and a collector merged them into one giant trace. Prefix the
+// counter with per-process entropy (start time + pid — RNG-free, so ids stay
+// deterministic WITHIN a run) to make traces practically unique ACROSS runs.
+const _traceBase = (
+  Date.now().toString(16).padStart(12, "0") +
+  (process.pid >>> 0).toString(16).padStart(8, "0")
+).slice(0, 20);
+let _traceSeq = 0;
+function newTraceId() {
+  _traceSeq = (_traceSeq + 1) % Number.MAX_SAFE_INTEGER;
+  return _traceBase + _traceSeq.toString(16).padStart(12, "0"); // 32 hex, never all-zero
+}
+
 export class TelemetryRecorder {
   constructor({
     now = () => Date.now(),
@@ -27,6 +44,7 @@ export class TelemetryRecorder {
   } = {}) {
     this._now = typeof now === "function" ? now : () => now;
     this.serviceName = serviceName;
+    this.traceId = newTraceId(); // one trace per recorder (valid non-zero id)
     this._spans = []; // completed spans
     this._counters = new Map(); // name → { total, byAttr }
     this._failures = new Map(); // category → count
@@ -171,12 +189,16 @@ export class TelemetryRecorder {
             {
               scope: { name: "chainlesschain.cli" },
               spans: this._spans.map((s) => ({
-                traceId: "0".repeat(32),
+                traceId: this.traceId,
                 spanId: s.id,
                 parentSpanId: s.parentId || "",
                 name: s.name,
-                startTimeUnixNano: s.startTime * 1e6,
-                endTimeUnixNano: s.endTime * 1e6,
+                // proto3 JSON mapping: (s)fixed64/(u)int64 fields MUST be
+                // decimal STRINGS — ms×1e6 ≈ 1.8e18 exceeds 2^53, so a JSON
+                // number both violates the OTLP/JSON spec (strict collectors
+                // reject the span) and quantizes (~256 ns spacing).
+                startTimeUnixNano: String(Math.round(s.startTime * 1e6)),
+                endTimeUnixNano: String(Math.round(s.endTime * 1e6)),
                 status: { code: s.status === "error" ? 2 : 1 },
                 attributes: Object.entries(s.attributes).map(([k, v]) => ({
                   key: k,
@@ -189,7 +211,7 @@ export class TelemetryRecorder {
                 })),
                 events: s.events.map((e) => ({
                   name: e.name,
-                  timeUnixNano: e.time * 1e6,
+                  timeUnixNano: String(Math.round(e.time * 1e6)),
                   attributes: Object.entries(e.attributes).map(([k, v]) => ({
                     key: k,
                     value: { stringValue: String(v) },

package/src/repl/agent-repl.js

@@ -64,7 +64,10 @@ import {
   PromptCompressor,
   getContextWindow,
 } from "../harness/prompt-compressor.js";
-import { buildAutoPinPredicate } from "../runtime/auto-pin.js";
+import {
+  buildAutoPinPredicate,
+  resolveAutoPinOption,
+} from "../runtime/auto-pin.js";
 import { feature } from "../lib/feature-flags.js";
 import { recordCompressionMetric } from "../lib/compression-telemetry.js";
 import {
@@ -417,15 +420,16 @@ export async function startAgentRepl(options = {}) {
   // Unset → agent-core's 180s default (matches cc chat/ask). Set to 0 to
   // disable. Left undefined here means "use the default".
   let _streamStallTimeoutMs;
-  // Auto-pin (OPT-IN, off by default): when set, compaction pins the original
-  // task. Resolved from config `context.autoPin` or CC_AUTO_PIN=1; falsy → the
-  // compress calls below pass no pin predicate (byte-identical default).
-  let _autoPinOpt;
+  // Auto-pin (default ON since 2026-07-07): compaction pins the original task
+  // (first user turn) so it survives context compression. Resolution order:
+  // CC_AUTO_PIN env ("1"/"0") > config `context.autoPin` (true/false/object) >
+  // default on. See resolveAutoPinOption.
+  let _autoPinCfgValue;
   try {
     const { loadConfig } = await import("../lib/config-manager.js");
     const _cfg = loadConfig();
     _visionModel = _cfg?.llm?.visionModel || undefined;
-    _autoPinOpt = _cfg?.context?.autoPin;
+    _autoPinCfgValue = _cfg?.context?.autoPin;
     const raw = _cfg?.llm?.streamStallTimeoutMs;
     const t = Number(raw);
     // Accept 0 (explicit disable) — only ignore absent/invalid values.
@@ -483,8 +487,8 @@ export async function startAgentRepl(options = {}) {
   if (feature("PROMPT_COMPRESSOR")) {
     _compressor = new PromptCompressor({ model, provider });
   }
-  if (process.env.CC_AUTO_PIN === "1") _autoPinOpt = _autoPinOpt || true;
-  // Compaction options shared by /compact + auto-compact. Adds the opt-in
+  const _autoPinOpt = resolveAutoPinOption({ config: _autoPinCfgValue });
+  // Compaction options shared by /compact + auto-compact. Adds the
   // pin predicate only when auto-pin is enabled; otherwise byte-identical.
   const _compactOpts = (msgs) => {
     const base = { preserveToolPairs: true };

package/src/runtime/__tests__/auto-pin.test.js

@@ -1,13 +1,14 @@
 /**
- * auto-pin policy tests — the OPT-IN compaction pin policy. Verifies it is off
- * by default (returns null → caller passes no predicate → byte-identical), and
- * when enabled pins the original task (first user turn) plus explicit pins,
- * honoring the token cap.
+ * auto-pin policy tests. The PREDICATE layer stays opt-valued (null when the
+ * resolved option is falsy → byte-identical compaction); the EFFECTIVE default
+ * is decided by resolveAutoPinOption — ON since 2026-07-07, opt out via
+ * CC_AUTO_PIN=0 or config context.autoPin=false.
  */
 
 import { describe, it, expect } from "vitest";
 import {
   resolveAutoPinConfig,
+  resolveAutoPinOption,
   buildAutoPinPredicate,
   describeAutoPin,
 } from "../auto-pin.js";
@@ -102,3 +103,25 @@ describe("describeAutoPin", () => {
     );
   });
 });
+
+describe("resolveAutoPinOption (effective default — ON since 2026-07-07)", () => {
+  it("defaults ON when nothing is set", () => {
+    expect(resolveAutoPinOption({ env: undefined, config: undefined })).toBe(
+      true,
+    );
+  });
+  it("CC_AUTO_PIN=0 opts out; =1 forces on over a config false", () => {
+    expect(resolveAutoPinOption({ env: "0", config: true })).toBe(false);
+    expect(resolveAutoPinOption({ env: "1", config: false })).toBe(true);
+  });
+  it("config false opts out; a config object passes through", () => {
+    expect(resolveAutoPinOption({ env: undefined, config: false })).toBe(false);
+    const cfg = { maxPinTokens: 99 };
+    expect(resolveAutoPinOption({ env: undefined, config: cfg })).toBe(cfg);
+  });
+  it("an explicit --auto-pin flag wins over everything", () => {
+    expect(resolveAutoPinOption({ flag: true, env: "0", config: false })).toBe(
+      true,
+    );
+  });
+});

package/src/runtime/auto-pin.js

@@ -23,6 +23,25 @@
 
 const DEFAULT_MAX_PIN_TOKENS = 2000;
 
+/**
+ * Resolve the EFFECTIVE auto-pin setting from (highest precedence first):
+ *   1. an explicit CLI flag (`--auto-pin` → force on),
+ *   2. the CC_AUTO_PIN env var ("1" on / "0" off),
+ *   3. the config value (`context.autoPin`: true | false | {…}),
+ *   4. the default — **ON** (product decision 2026-07-07): pinning the
+ *      original task through compaction costs a bounded slice of context
+ *      (maxPinTokens, default 2000) but prevents goal drift in long sessions.
+ * Opt out with CC_AUTO_PIN=0 or `context.autoPin: false` in config.
+ */
+export function resolveAutoPinOption({ flag, env, config } = {}) {
+  if (flag === true) return true;
+  const e = env !== undefined ? env : process.env.CC_AUTO_PIN;
+  if (e === "0") return false;
+  if (e === "1") return true;
+  if (config !== undefined && config !== null) return config;
+  return true;
+}
+
 /**
  * Normalize the opt-in value into a config object, or null when auto-pin is off.
  * Accepts: falsy (off), `true` (defaults on), or a config object