chainlesschain 0.162.151 → 0.162.152

package/src/lib/agent-team/team-runner.js

@@ -30,6 +30,8 @@ export class TeamRunner {
     this.runTask = opts.runTask;
     this.teammates = opts.teammates > 0 ? Math.floor(opts.teammates) : 2;
     this.ttlMs = opts.ttlMs;
+    // Lease-renewal heartbeat cadence while a task runs (default ttl/3).
+    this.renewEveryMs = opts.renewEveryMs;
     this.onEvent = typeof opts.onEvent === "function" ? opts.onEvent : () => {};
     this.maxTasks = opts.maxTasks > 0 ? opts.maxTasks : 1000;
     this._now = opts.now || registry._now || (() => Date.now());
@@ -198,6 +200,28 @@ export class TeamRunner {
     this._setState(holder, "running", { key });
     this._emit("task:claimed", { key, holder, attempts: task.attempts });
     const renew = () => this.registry.renew(key, { holder, ttlMs: this.ttlMs });
+    // Heartbeat: the built-in executors (shell / agent / worktree) never call
+    // `renew` themselves, so before this ANY task outliving the lease TTL was
+    // indistinguishable from a crash — a peer could steal it and the SAME task
+    // would run twice concurrently. The runner owns the TTL, so it renews here
+    // for every executor. Stops itself once the lease is lost (renew rejected —
+    // keeping a lost lease alive would be lying to the registry).
+    const effectiveTtl =
+      this.ttlMs > 0 ? this.ttlMs : this.registry.defaultTtlMs || 60000;
+    const every = Math.max(
+      25,
+      Math.floor(this.renewEveryMs > 0 ? this.renewEveryMs : effectiveTtl / 3),
+    );
+    const heartbeat = setInterval(() => {
+      try {
+        const r = renew();
+        if (!r || r.ok !== true) clearInterval(heartbeat);
+      } catch {
+        clearInterval(heartbeat);
+      }
+    }, every);
+    // Never hold the process open just for a heartbeat.
+    if (typeof heartbeat.unref === "function") heartbeat.unref();
     // A teammate-scoped messaging handle: post to a peer / broadcast, and read
     // its own inbox (direct messages + unseen broadcasts).
     const inbox = this.mailbox ? this.mailbox.drain(holder) : [];
@@ -271,6 +295,7 @@ export class TeamRunner {
         attempts: outcome?.attempts,
       });
     } finally {
+      clearInterval(heartbeat);
       this._inFlight--;
     }
   }

package/src/lib/eval/tasks.js

@@ -30,6 +30,39 @@ const STRINGUTIL_V2 =
   "  return str.charAt(0).toUpperCase() + str.slice(1);\n" +
   "}\n";
 
+// Harness files the agent is told NOT to edit, shared by setup and check so the
+// check can byte-compare them (same anti-cheat as STRINGUTIL_V2 above). A mere
+// presence-regex is neuterable: prepending `console.log('ALL OK');
+// process.exit(0)` keeps the assertion text present while never running it.
+const RUN_CHECKS_MJS = [
+  "import { sum } from './calc.js';",
+  "const cases = [[1,2,3],[10,5,15],[0,0,0]];",
+  "for (const [a,b,want] of cases) {",
+  "  if (sum(a,b) !== want) {",
+  "    console.error(`FAIL sum(${a},${b})=${sum(a,b)} want ${want}`);",
+  "    process.exit(1);",
+  "  }",
+  "}",
+  "console.log('ALL OK');",
+  "",
+].join("\n");
+
+const BUILD_MJS =
+  'import { banner } from "./app.mjs";\n' +
+  'if (banner() !== "v1.0.0") {\n' +
+  '  console.error("BUILD FAIL: " + banner());\n' +
+  "  process.exit(1);\n" +
+  "}\n" +
+  'console.log("BUILD OK");\n';
+
+const RUN_MJS =
+  'import { label } from "./app.mjs";\n' +
+  'if (label("hello") !== "Hello") {\n' +
+  '  console.error("FAIL: " + label("hello"));\n' +
+  "  process.exit(1);\n" +
+  "}\n" +
+  'console.log("OK");\n';
+
 export const BUILTIN_TASKS = [
   {
     id: "create-file",
@@ -134,32 +167,22 @@ export const BUILTIN_TASKS = [
       );
       fs.writeFileSync(
         path.join(dir, "run-checks.mjs"),
-        [
-          "import { sum } from './calc.js';",
-          "const cases = [[1,2,3],[10,5,15],[0,0,0]];",
-          "for (const [a,b,want] of cases) {",
-          "  if (sum(a,b) !== want) {",
-          "    console.error(`FAIL sum(${a},${b})=${sum(a,b)} want ${want}`);",
-          "    process.exit(1);",
-          "  }",
-          "}",
-          "console.log('ALL OK');",
-          "",
-        ].join("\n"),
+        RUN_CHECKS_MJS,
         "utf8",
       );
     },
     check: (dir) => {
-      // Objective: the test harness must actually pass. Guard against the agent
-      // "fixing" it by neutering run-checks.mjs — require the assertions to
-      // still be present.
+      // Objective: the test harness must actually pass. Byte-compare the
+      // harness — a presence-regex alone is neuterable (prepend an early
+      // `console.log('ALL OK'); process.exit(0)` and the assertion text is
+      // still there but never runs).
       const checks = read(dir, "run-checks.mjs");
       if (checks == null)
         return { pass: false, detail: "run-checks.mjs missing" };
-      if (!/sum\(a,\s*b\)\s*!==\s*want/.test(checks)) {
+      if (checks !== RUN_CHECKS_MJS) {
         return {
           pass: false,
-          detail: "run-checks.mjs assertions were altered",
+          detail: "run-checks.mjs was edited (fix calc.js instead)",
         };
       }
       try {
@@ -487,23 +510,19 @@ export const BUILTIN_TASKS = [
           'export function banner() {\n  return "v" + VERSION;\n}\n',
         "utf8",
       );
-      fs.writeFileSync(
-        path.join(dir, "build.mjs"),
-        'import { banner } from "./app.mjs";\n' +
-          'if (banner() !== "v1.0.0") {\n' +
-          '  console.error("BUILD FAIL: " + banner());\n' +
-          "  process.exit(1);\n" +
-          "}\n" +
-          'console.log("BUILD OK");\n',
-        "utf8",
-      );
+      fs.writeFileSync(path.join(dir, "build.mjs"), BUILD_MJS, "utf8");
     },
     check: (dir) => {
       const build = read(dir, "build.mjs");
       if (build == null) return { pass: false, detail: "build.mjs missing" };
-      // Guard: fix the modules, don't neuter the build harness.
-      if (!/banner\(\)\s*!==\s*"v1\.0\.0"/.test(build)) {
-        return { pass: false, detail: "build.mjs assertion was altered" };
+      // Guard: fix the modules, don't neuter the build harness. Byte-compare —
+      // a presence-regex is satisfiable by a rewritten build.mjs that defines
+      // its own banner() and never imports app.mjs.
+      if (build !== BUILD_MJS) {
+        return {
+          pass: false,
+          detail: "build.mjs was edited (reconcile config.mjs/app.mjs instead)",
+        };
       }
       try {
         const out = execFileSync(process.execPath, ["build.mjs"], {
@@ -534,7 +553,7 @@ export const BUILTIN_TASKS = [
       "`capitalize` export was renamed to `toTitle` (same behavior). Do all of: " +
       "(1) bump stringutil to ^2.0.0 in package.json; (2) update app.mjs to " +
       "import and use `toTitle` instead of `capitalize`; (3) do NOT edit " +
-      "stringutil.mjs. Afterwards `node run.mjs` must print OK.",
+      "stringutil.mjs or run.mjs. Afterwards `node run.mjs` must print OK.",
     setup: (dir) => {
       fs.writeFileSync(
         path.join(dir, "package.json"),
@@ -558,16 +577,7 @@ export const BUILTIN_TASKS = [
           "export function label(s) {\n  return capitalize(s);\n}\n",
         "utf8",
       );
-      fs.writeFileSync(
-        path.join(dir, "run.mjs"),
-        'import { label } from "./app.mjs";\n' +
-          'if (label("hello") !== "Hello") {\n' +
-          '  console.error("FAIL: " + label("hello"));\n' +
-          "  process.exit(1);\n" +
-          "}\n" +
-          'console.log("OK");\n',
-        "utf8",
-      );
+      fs.writeFileSync(path.join(dir, "run.mjs"), RUN_MJS, "utf8");
     },
     check: (dir) => {
       // The dependency is vendored — the agent must adapt the caller, NOT edit
@@ -580,6 +590,17 @@ export const BUILTIN_TASKS = [
           detail: "the stringutil dependency was edited (adapt the caller)",
         };
       }
+      // The run harness is equally off-limits: without this guard an agent
+      // could overwrite run.mjs with `console.log("OK")` and pass the textual
+      // checks below without app.mjs ever being executed.
+      const runner = read(dir, "run.mjs");
+      if (runner == null) return { pass: false, detail: "run.mjs missing" };
+      if (runner !== RUN_MJS) {
+        return {
+          pass: false,
+          detail: "run.mjs was edited (adapt app.mjs/package.json instead)",
+        };
+      }
       const pkg = read(dir, "package.json");
       if (pkg == null || !/"stringutil"\s*:\s*"[\^~]?2\./.test(pkg)) {
         return {

package/src/lib/eval/trend.js

@@ -84,7 +84,13 @@ function ordered(records) {
  * }}
  */
 export function computeTrend(runs, { regressionThreshold = 0 } = {}) {
-  const norm = ordered((runs || []).map((r) => summarizeRun(r)));
+  // A dry-run record is always 0% (the no-op agent creates nothing) — folding
+  // it in would flag every previously-passing task as a regression (or, in the
+  // other direction, fake an "all fixed" jump). Smoke-testing with
+  // `--dry-run --history` must not poison the release gate.
+  const norm = ordered(
+    (runs || []).filter((r) => r?.dryRun !== true).map((r) => summarizeRun(r)),
+  );
   const history = norm.map((r) => r.passRate);
   if (norm.length === 0) {
     return {

package/src/lib/lsp/__tests__/lsp-client.test.js

@@ -225,14 +225,20 @@ describe("uri <-> path", () => {
 describe("normalizeUri", () => {
   it("lowercases the windows drive letter so client/server keys match", () => {
     // path.resolve yields C:, servers echo c: — must collapse to one key
-    expect(normalizeUri("file:///C%3A/proj/a.ts")).toBe(
-      "file:///c%3A/proj/a.ts",
-    );
-    expect(normalizeUri("file:///c%3A/proj/a.ts")).toBe(
-      "file:///c%3A/proj/a.ts",
-    );
+    expect(normalizeUri("file:///C%3A/proj/a.ts")).toBe("file:///c:/proj/a.ts");
+    expect(normalizeUri("file:///c%3A/proj/a.ts")).toBe("file:///c:/proj/a.ts");
     expect(normalizeUri("file:///C:/proj/a.ts")).toBe("file:///c:/proj/a.ts");
   });
+  it("collapses the %3A and bare-colon drive forms to ONE key (gopls)", () => {
+    // The client sends percent-encoded didOpen URIs (file:///C%3A/…);
+    // tsserver/pyright echo that form back, but gopls REWRITES to a bare
+    // colon (file:///C:/…). Before this canonicalization the two forms were
+    // distinct diagnostics-Map keys, so every gopls publish missed the
+    // didOpen key and `cc code-intel diag` on Go was permanently empty.
+    const ours = normalizeUri("file:///C%3A/Users/u/goproj/broken.go");
+    const goplsPublished = normalizeUri("file:///C:/Users/u/goproj/broken.go");
+    expect(ours).toBe(goplsPublished);
+  });
   it("leaves POSIX file URIs unchanged", () => {
     expect(normalizeUri("file:///home/u/a.ts")).toBe("file:///home/u/a.ts");
   });

package/src/lib/lsp/code-intelligence.js

@@ -85,11 +85,15 @@ export class CodeIntelligence {
   async references(filePath, line, col, { includeDeclaration = true } = {}) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/references", {
-      textDocument: { uri: ready.uri },
-      position: toLspPosition({ line, col }),
-      context: { includeDeclaration },
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/references",
+      {
+        textDocument: { uri: ready.uri },
+        position: toLspPosition({ line, col }),
+        context: { includeDeclaration },
+      },
+    );
     return { available: true, locations: this._normalizeLocations(result) };
   }
 
@@ -97,7 +101,7 @@ export class CodeIntelligence {
   async hover(filePath, line, col) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/hover", {
+    const result = await this._readRequest(ready.client, "textDocument/hover", {
       textDocument: { uri: ready.uri },
       position: toLspPosition({ line, col }),
     });
@@ -108,9 +112,13 @@ export class CodeIntelligence {
   async documentSymbols(filePath) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/documentSymbol", {
-      textDocument: { uri: ready.uri },
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/documentSymbol",
+      {
+        textDocument: { uri: ready.uri },
+      },
+    );
     return {
       available: true,
       symbols: this._normalizeSymbols(result, ready.uri),
@@ -124,7 +132,9 @@ export class CodeIntelligence {
     if (!seed) return unavailable("no indexable file found to start a server");
     const ready = await this.manager.ensureFor(seed, this._ensureOpts);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("workspace/symbol", { query });
+    const result = await this._readRequest(ready.client, "workspace/symbol", {
+      query,
+    });
     return { available: true, symbols: this._normalizeSymbols(result) };
   }
 
@@ -160,7 +170,8 @@ export class CodeIntelligence {
     const caps = ready.client.serverCapabilities || {};
     if (caps.diagnosticProvider) {
       try {
-        const report = await ready.client.request(
+        const report = await this._readRequest(
+          ready.client,
           "textDocument/diagnostic",
           { textDocument: { uri: ready.uri } },
           { timeoutMs },
@@ -182,11 +193,15 @@ export class CodeIntelligence {
   async renamePreview(filePath, line, col, newName) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/rename", {
-      textDocument: { uri: ready.uri },
-      position: toLspPosition({ line, col }),
-      newName,
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/rename",
+      {
+        textDocument: { uri: ready.uri },
+        position: toLspPosition({ line, col }),
+        newName,
+      },
+    );
     return { available: true, edits: this._normalizeWorkspaceEdit(result) };
   }
 
@@ -196,10 +211,33 @@ export class CodeIntelligence {
 
   // ---- internals ----
 
+  /**
+   * Issue an idempotent READ request with a bounded ContentModified retry.
+   * LSP -32801 (ContentModified) means "server state changed mid-request —
+   * the result would be stale, ask again"; rust-analyzer emits it freely
+   * while its index is still settling after didOpen. Read-only queries can
+   * always be retried; mutating requests must NOT go through here.
+   */
+  async _readRequest(client, method, params, opts) {
+    let lastErr;
+    for (let attempt = 0; attempt < 4; attempt++) {
+      try {
+        return await client.request(method, params, opts);
+      } catch (err) {
+        const contentModified =
+          err?.code === -32801 || /content modified/i.test(err?.message || "");
+        if (!contentModified) throw err;
+        lastErr = err;
+        await new Promise((r) => setTimeout(r, 500 * (attempt + 1)));
+      }
+    }
+    throw lastErr;
+  }
+
   async _locationQuery(method, filePath, line, col) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request(method, {
+    const result = await this._readRequest(ready.client, method, {
       textDocument: { uri: ready.uri },
       position: toLspPosition({ line, col }),
     });

package/src/lib/lsp/lsp-client.js

@@ -297,9 +297,15 @@ export function pathToFileUri(p) {
  */
 export function normalizeUri(uri) {
   if (!uri) return uri;
+  // Canonicalize BOTH the drive-letter case AND the colon encoding. Servers
+  // differ in the form they publish back: tsserver/pyright echo the client's
+  // percent-encoded `c%3A/…`, but gopls rewrites to a bare `C:/…` — keeping
+  // the incoming colon form made the two forms distinct Map keys, so every
+  // gopls publishDiagnostics missed the didOpen key and Go diagnostics were
+  // permanently empty regardless of timeout.
   return String(uri).replace(
     /^(file:\/\/\/)([A-Za-z])(%3[Aa]|:)/,
-    (_m, p, drive, colon) => p + drive.toLowerCase() + colon,
+    (_m, p, drive) => p + drive.toLowerCase() + ":",
   );
 }
 

package/src/lib/plugin-runtime/install.js

@@ -29,7 +29,7 @@ import {
   discoverPlugins,
 } from "./scopes.js";
 import { verifyPluginManifest } from "../plugin-security.js";
-import { writePluginLock } from "./signature.js";
+import { writePluginLock, LOCK_FILENAME } from "./signature.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -97,6 +97,12 @@ export function installFromDirectory(srcDir, opts = {}) {
   _deps.mkdirSync(dest, { recursive: true });
   copyDirGuarded(src, dest, dest);
 
+  // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
+  // and may ship its own `.plugin-lock.json` (copied verbatim above) — on an
+  // unsigned install that forged lock would otherwise survive into the
+  // "immutable" version dir and defeat load-time requireSignedPlugins.
+  _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
+
   // Record the verified signature into the installed (immutable) version dir so
   // load-time enforcement can re-check it. The manifest was copied verbatim, so
   // its bytes/sha in `dest` match what we verified in `src`.
@@ -110,6 +116,8 @@ export function installFromDirectory(srcDir, opts = {}) {
       sha256: verification.sha256,
       publicKeySha256: verification.publicKeySha256,
       signatureVerified: verification.signatureVerified === true,
+      signatureBase64: verification.signatureBase64,
+      publicKeyPem: verification.publicKeyPem,
     });
   }
 
@@ -245,6 +253,17 @@ export function parseGitSource(raw) {
  * command line — no injection). Caller removes the temp dir's parent.
  */
 export function fetchGitRepo(url, ref) {
+  // git argv-injection guard: a value starting with "-" is parsed by git as an
+  // OPTION, not a URL/ref — e.g. a registry-supplied ref "-f" reaches
+  // `git checkout <ref>` on the full-clone retry path, and an option-looking
+  // url reaches `git clone`. Real git URLs/refs never start with "-"
+  // (check-ref-format forbids it), so reject instead of trying to escape.
+  if (String(url).startsWith("-")) {
+    throw new Error(`refusing git source that looks like an option: ${url}`);
+  }
+  if (ref != null && String(ref).startsWith("-")) {
+    throw new Error(`refusing git ref that looks like an option: ${ref}`);
+  }
   const base = _deps.mkdtempSync(path.join(os.tmpdir(), "cc-plugin-git-"));
   const dir = path.join(base, "repo");
   const run = (args) =>

package/src/lib/plugin-runtime/policy.js

@@ -115,6 +115,19 @@ export function filterByManagedPolicy(plugins, managed) {
       continue;
     }
     if (requireSigned) {
+      // Fail closed when no signing keys are pinned: a lock's signature can be
+      // SELF-signed by whoever authored the plugin (the lock lives in a
+      // writable dir), so "signed by anyone" is not a guarantee. Without
+      // trustedPluginKeySha256 the gate would accept any self-signed drop-in.
+      if (!trustedKeys || trustedKeys.size === 0) {
+        dropped.push({
+          name: p.name,
+          reason:
+            "requireSignedPlugins: no trustedPluginKeySha256 fingerprints " +
+            "configured (fail-closed — pin the org's signing keys)",
+        });
+        continue;
+      }
       const v = verifyInstalledSignature(p, { trustedKeys });
       if (!v.signed) {
         dropped.push({

package/src/lib/plugin-runtime/remote-source.js

@@ -46,6 +46,39 @@ export function isRemoteSource(raw) {
   return /^https?:\/\//i.test(s) && /\.json(\?.*)?(#.*)?$/i.test(s);
 }
 
+/**
+ * Enforce HTTPS for registry URLs. The registry supplies BOTH the git source
+ * and its claimed sha256 — over plain HTTP a network MITM controls the two
+ * together, so the integrity check verifies nothing. Loopback is exempt (a
+ * local dev registry isn't MITM-able off-host); anything else needs the
+ * explicit opt-in (opts.allowInsecure / CC_PLUGIN_REGISTRY_ALLOW_HTTP=1).
+ */
+export function assertRegistryUrlSafe(url, { allowInsecure = false } = {}) {
+  let u;
+  try {
+    u = new URL(String(url));
+  } catch {
+    throw new Error(`invalid registry URL: ${url}`);
+  }
+  if (u.protocol === "https:") return;
+  if (u.protocol !== "http:") {
+    throw new Error(`registry URL must be http(s): ${url}`);
+  }
+  // WHATWG URL keeps the brackets on IPv6 hostnames — strip before comparing.
+  const host = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const loopback =
+    host === "localhost" || host === "127.0.0.1" || host === "::1";
+  const optIn =
+    allowInsecure === true || process.env.CC_PLUGIN_REGISTRY_ALLOW_HTTP === "1";
+  if (loopback || optIn) return;
+  throw new Error(
+    `plain-HTTP registry rejected: ${url} — a network MITM controls both the ` +
+      `source and its sha256, so the integrity check verifies nothing. Use ` +
+      `https, or opt in with --allow-insecure-registry / ` +
+      `CC_PLUGIN_REGISTRY_ALLOW_HTTP=1 on a trusted network.`,
+  );
+}
+
 /** Where a fetched registry is cached (content-addressed by its URL). */
 export function registryCachePath(url, cacheDir) {
   const dir =
@@ -93,6 +126,7 @@ export async function fetchRegistry(url, opts = {}) {
     timeoutMs = DEFAULT_TIMEOUT_MS,
     allowCache = true,
   } = opts;
+  assertRegistryUrlSafe(url, { allowInsecure: opts.allowInsecure });
   const cachePath = registryCachePath(url, cacheDir);
   const headers = { Accept: "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;