chainlesschain 0.162.151 → 0.162.153

package/src/lib/eval/tasks.js

@@ -30,6 +30,39 @@ const STRINGUTIL_V2 =
   "  return str.charAt(0).toUpperCase() + str.slice(1);\n" +
   "}\n";
 
+// Harness files the agent is told NOT to edit, shared by setup and check so the
+// check can byte-compare them (same anti-cheat as STRINGUTIL_V2 above). A mere
+// presence-regex is neuterable: prepending `console.log('ALL OK');
+// process.exit(0)` keeps the assertion text present while never running it.
+const RUN_CHECKS_MJS = [
+  "import { sum } from './calc.js';",
+  "const cases = [[1,2,3],[10,5,15],[0,0,0]];",
+  "for (const [a,b,want] of cases) {",
+  "  if (sum(a,b) !== want) {",
+  "    console.error(`FAIL sum(${a},${b})=${sum(a,b)} want ${want}`);",
+  "    process.exit(1);",
+  "  }",
+  "}",
+  "console.log('ALL OK');",
+  "",
+].join("\n");
+
+const BUILD_MJS =
+  'import { banner } from "./app.mjs";\n' +
+  'if (banner() !== "v1.0.0") {\n' +
+  '  console.error("BUILD FAIL: " + banner());\n' +
+  "  process.exit(1);\n" +
+  "}\n" +
+  'console.log("BUILD OK");\n';
+
+const RUN_MJS =
+  'import { label } from "./app.mjs";\n' +
+  'if (label("hello") !== "Hello") {\n' +
+  '  console.error("FAIL: " + label("hello"));\n' +
+  "  process.exit(1);\n" +
+  "}\n" +
+  'console.log("OK");\n';
+
 export const BUILTIN_TASKS = [
   {
     id: "create-file",
@@ -134,32 +167,22 @@ export const BUILTIN_TASKS = [
       );
       fs.writeFileSync(
         path.join(dir, "run-checks.mjs"),
-        [
-          "import { sum } from './calc.js';",
-          "const cases = [[1,2,3],[10,5,15],[0,0,0]];",
-          "for (const [a,b,want] of cases) {",
-          "  if (sum(a,b) !== want) {",
-          "    console.error(`FAIL sum(${a},${b})=${sum(a,b)} want ${want}`);",
-          "    process.exit(1);",
-          "  }",
-          "}",
-          "console.log('ALL OK');",
-          "",
-        ].join("\n"),
+        RUN_CHECKS_MJS,
         "utf8",
       );
     },
     check: (dir) => {
-      // Objective: the test harness must actually pass. Guard against the agent
-      // "fixing" it by neutering run-checks.mjs — require the assertions to
-      // still be present.
+      // Objective: the test harness must actually pass. Byte-compare the
+      // harness — a presence-regex alone is neuterable (prepend an early
+      // `console.log('ALL OK'); process.exit(0)` and the assertion text is
+      // still there but never runs).
       const checks = read(dir, "run-checks.mjs");
       if (checks == null)
         return { pass: false, detail: "run-checks.mjs missing" };
-      if (!/sum\(a,\s*b\)\s*!==\s*want/.test(checks)) {
+      if (checks !== RUN_CHECKS_MJS) {
         return {
           pass: false,
-          detail: "run-checks.mjs assertions were altered",
+          detail: "run-checks.mjs was edited (fix calc.js instead)",
         };
       }
       try {
@@ -487,23 +510,19 @@ export const BUILTIN_TASKS = [
           'export function banner() {\n  return "v" + VERSION;\n}\n',
         "utf8",
       );
-      fs.writeFileSync(
-        path.join(dir, "build.mjs"),
-        'import { banner } from "./app.mjs";\n' +
-          'if (banner() !== "v1.0.0") {\n' +
-          '  console.error("BUILD FAIL: " + banner());\n' +
-          "  process.exit(1);\n" +
-          "}\n" +
-          'console.log("BUILD OK");\n',
-        "utf8",
-      );
+      fs.writeFileSync(path.join(dir, "build.mjs"), BUILD_MJS, "utf8");
     },
     check: (dir) => {
       const build = read(dir, "build.mjs");
       if (build == null) return { pass: false, detail: "build.mjs missing" };
-      // Guard: fix the modules, don't neuter the build harness.
-      if (!/banner\(\)\s*!==\s*"v1\.0\.0"/.test(build)) {
-        return { pass: false, detail: "build.mjs assertion was altered" };
+      // Guard: fix the modules, don't neuter the build harness. Byte-compare —
+      // a presence-regex is satisfiable by a rewritten build.mjs that defines
+      // its own banner() and never imports app.mjs.
+      if (build !== BUILD_MJS) {
+        return {
+          pass: false,
+          detail: "build.mjs was edited (reconcile config.mjs/app.mjs instead)",
+        };
       }
       try {
         const out = execFileSync(process.execPath, ["build.mjs"], {
@@ -534,7 +553,7 @@ export const BUILTIN_TASKS = [
       "`capitalize` export was renamed to `toTitle` (same behavior). Do all of: " +
       "(1) bump stringutil to ^2.0.0 in package.json; (2) update app.mjs to " +
       "import and use `toTitle` instead of `capitalize`; (3) do NOT edit " +
-      "stringutil.mjs. Afterwards `node run.mjs` must print OK.",
+      "stringutil.mjs or run.mjs. Afterwards `node run.mjs` must print OK.",
     setup: (dir) => {
       fs.writeFileSync(
         path.join(dir, "package.json"),
@@ -558,16 +577,7 @@ export const BUILTIN_TASKS = [
           "export function label(s) {\n  return capitalize(s);\n}\n",
         "utf8",
       );
-      fs.writeFileSync(
-        path.join(dir, "run.mjs"),
-        'import { label } from "./app.mjs";\n' +
-          'if (label("hello") !== "Hello") {\n' +
-          '  console.error("FAIL: " + label("hello"));\n' +
-          "  process.exit(1);\n" +
-          "}\n" +
-          'console.log("OK");\n',
-        "utf8",
-      );
+      fs.writeFileSync(path.join(dir, "run.mjs"), RUN_MJS, "utf8");
     },
     check: (dir) => {
       // The dependency is vendored — the agent must adapt the caller, NOT edit
@@ -580,6 +590,17 @@ export const BUILTIN_TASKS = [
           detail: "the stringutil dependency was edited (adapt the caller)",
         };
       }
+      // The run harness is equally off-limits: without this guard an agent
+      // could overwrite run.mjs with `console.log("OK")` and pass the textual
+      // checks below without app.mjs ever being executed.
+      const runner = read(dir, "run.mjs");
+      if (runner == null) return { pass: false, detail: "run.mjs missing" };
+      if (runner !== RUN_MJS) {
+        return {
+          pass: false,
+          detail: "run.mjs was edited (adapt app.mjs/package.json instead)",
+        };
+      }
       const pkg = read(dir, "package.json");
       if (pkg == null || !/"stringutil"\s*:\s*"[\^~]?2\./.test(pkg)) {
         return {

package/src/lib/eval/trend.js

@@ -84,7 +84,13 @@ function ordered(records) {
  * }}
  */
 export function computeTrend(runs, { regressionThreshold = 0 } = {}) {
-  const norm = ordered((runs || []).map((r) => summarizeRun(r)));
+  // A dry-run record is always 0% (the no-op agent creates nothing) — folding
+  // it in would flag every previously-passing task as a regression (or, in the
+  // other direction, fake an "all fixed" jump). Smoke-testing with
+  // `--dry-run --history` must not poison the release gate.
+  const norm = ordered(
+    (runs || []).filter((r) => r?.dryRun !== true).map((r) => summarizeRun(r)),
+  );
   const history = norm.map((r) => r.passRate);
   if (norm.length === 0) {
     return {

package/src/lib/lsp/__tests__/lsp-client.test.js

@@ -225,14 +225,20 @@ describe("uri <-> path", () => {
 describe("normalizeUri", () => {
   it("lowercases the windows drive letter so client/server keys match", () => {
     // path.resolve yields C:, servers echo c: — must collapse to one key
-    expect(normalizeUri("file:///C%3A/proj/a.ts")).toBe(
-      "file:///c%3A/proj/a.ts",
-    );
-    expect(normalizeUri("file:///c%3A/proj/a.ts")).toBe(
-      "file:///c%3A/proj/a.ts",
-    );
+    expect(normalizeUri("file:///C%3A/proj/a.ts")).toBe("file:///c:/proj/a.ts");
+    expect(normalizeUri("file:///c%3A/proj/a.ts")).toBe("file:///c:/proj/a.ts");
     expect(normalizeUri("file:///C:/proj/a.ts")).toBe("file:///c:/proj/a.ts");
   });
+  it("collapses the %3A and bare-colon drive forms to ONE key (gopls)", () => {
+    // The client sends percent-encoded didOpen URIs (file:///C%3A/…);
+    // tsserver/pyright echo that form back, but gopls REWRITES to a bare
+    // colon (file:///C:/…). Before this canonicalization the two forms were
+    // distinct diagnostics-Map keys, so every gopls publish missed the
+    // didOpen key and `cc code-intel diag` on Go was permanently empty.
+    const ours = normalizeUri("file:///C%3A/Users/u/goproj/broken.go");
+    const goplsPublished = normalizeUri("file:///C:/Users/u/goproj/broken.go");
+    expect(ours).toBe(goplsPublished);
+  });
   it("leaves POSIX file URIs unchanged", () => {
     expect(normalizeUri("file:///home/u/a.ts")).toBe("file:///home/u/a.ts");
   });

package/src/lib/lsp/code-intelligence.js

@@ -85,11 +85,15 @@ export class CodeIntelligence {
   async references(filePath, line, col, { includeDeclaration = true } = {}) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/references", {
-      textDocument: { uri: ready.uri },
-      position: toLspPosition({ line, col }),
-      context: { includeDeclaration },
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/references",
+      {
+        textDocument: { uri: ready.uri },
+        position: toLspPosition({ line, col }),
+        context: { includeDeclaration },
+      },
+    );
     return { available: true, locations: this._normalizeLocations(result) };
   }
 
@@ -97,7 +101,7 @@ export class CodeIntelligence {
   async hover(filePath, line, col) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/hover", {
+    const result = await this._readRequest(ready.client, "textDocument/hover", {
       textDocument: { uri: ready.uri },
       position: toLspPosition({ line, col }),
     });
@@ -108,9 +112,13 @@ export class CodeIntelligence {
   async documentSymbols(filePath) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/documentSymbol", {
-      textDocument: { uri: ready.uri },
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/documentSymbol",
+      {
+        textDocument: { uri: ready.uri },
+      },
+    );
     return {
       available: true,
       symbols: this._normalizeSymbols(result, ready.uri),
@@ -124,7 +132,9 @@ export class CodeIntelligence {
     if (!seed) return unavailable("no indexable file found to start a server");
     const ready = await this.manager.ensureFor(seed, this._ensureOpts);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("workspace/symbol", { query });
+    const result = await this._readRequest(ready.client, "workspace/symbol", {
+      query,
+    });
     return { available: true, symbols: this._normalizeSymbols(result) };
   }
 
@@ -160,7 +170,8 @@ export class CodeIntelligence {
     const caps = ready.client.serverCapabilities || {};
     if (caps.diagnosticProvider) {
       try {
-        const report = await ready.client.request(
+        const report = await this._readRequest(
+          ready.client,
           "textDocument/diagnostic",
           { textDocument: { uri: ready.uri } },
           { timeoutMs },
@@ -182,11 +193,15 @@ export class CodeIntelligence {
   async renamePreview(filePath, line, col, newName) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request("textDocument/rename", {
-      textDocument: { uri: ready.uri },
-      position: toLspPosition({ line, col }),
-      newName,
-    });
+    const result = await this._readRequest(
+      ready.client,
+      "textDocument/rename",
+      {
+        textDocument: { uri: ready.uri },
+        position: toLspPosition({ line, col }),
+        newName,
+      },
+    );
     return { available: true, edits: this._normalizeWorkspaceEdit(result) };
   }
 
@@ -196,10 +211,33 @@ export class CodeIntelligence {
 
   // ---- internals ----
 
+  /**
+   * Issue an idempotent READ request with a bounded ContentModified retry.
+   * LSP -32801 (ContentModified) means "server state changed mid-request —
+   * the result would be stale, ask again"; rust-analyzer emits it freely
+   * while its index is still settling after didOpen. Read-only queries can
+   * always be retried; mutating requests must NOT go through here.
+   */
+  async _readRequest(client, method, params, opts) {
+    let lastErr;
+    for (let attempt = 0; attempt < 4; attempt++) {
+      try {
+        return await client.request(method, params, opts);
+      } catch (err) {
+        const contentModified =
+          err?.code === -32801 || /content modified/i.test(err?.message || "");
+        if (!contentModified) throw err;
+        lastErr = err;
+        await new Promise((r) => setTimeout(r, 500 * (attempt + 1)));
+      }
+    }
+    throw lastErr;
+  }
+
   async _locationQuery(method, filePath, line, col) {
     const ready = await this._ensure(filePath);
     if (ready.unavailable) return unavailable(ready.reason);
-    const result = await ready.client.request(method, {
+    const result = await this._readRequest(ready.client, method, {
       textDocument: { uri: ready.uri },
       position: toLspPosition({ line, col }),
     });

package/src/lib/lsp/lsp-client.js

@@ -297,9 +297,15 @@ export function pathToFileUri(p) {
  */
 export function normalizeUri(uri) {
   if (!uri) return uri;
+  // Canonicalize BOTH the drive-letter case AND the colon encoding. Servers
+  // differ in the form they publish back: tsserver/pyright echo the client's
+  // percent-encoded `c%3A/…`, but gopls rewrites to a bare `C:/…` — keeping
+  // the incoming colon form made the two forms distinct Map keys, so every
+  // gopls publishDiagnostics missed the didOpen key and Go diagnostics were
+  // permanently empty regardless of timeout.
   return String(uri).replace(
     /^(file:\/\/\/)([A-Za-z])(%3[Aa]|:)/,
-    (_m, p, drive, colon) => p + drive.toLowerCase() + colon,
+    (_m, p, drive) => p + drive.toLowerCase() + ":",
   );
 }
 

package/src/lib/plugin-runtime/install.js

@@ -29,7 +29,7 @@ import {
   discoverPlugins,
 } from "./scopes.js";
 import { verifyPluginManifest } from "../plugin-security.js";
-import { writePluginLock } from "./signature.js";
+import { writePluginLock, LOCK_FILENAME } from "./signature.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -97,6 +97,12 @@ export function installFromDirectory(srcDir, opts = {}) {
   _deps.mkdirSync(dest, { recursive: true });
   copyDirGuarded(src, dest, dest);
 
+  // A lock may ONLY exist if THIS installer wrote it. The source is untrusted
+  // and may ship its own `.plugin-lock.json` (copied verbatim above) — on an
+  // unsigned install that forged lock would otherwise survive into the
+  // "immutable" version dir and defeat load-time requireSignedPlugins.
+  _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
+
   // Record the verified signature into the installed (immutable) version dir so
   // load-time enforcement can re-check it. The manifest was copied verbatim, so
   // its bytes/sha in `dest` match what we verified in `src`.
@@ -110,6 +116,8 @@ export function installFromDirectory(srcDir, opts = {}) {
       sha256: verification.sha256,
       publicKeySha256: verification.publicKeySha256,
       signatureVerified: verification.signatureVerified === true,
+      signatureBase64: verification.signatureBase64,
+      publicKeyPem: verification.publicKeyPem,
     });
   }
 
@@ -245,6 +253,17 @@ export function parseGitSource(raw) {
  * command line — no injection). Caller removes the temp dir's parent.
  */
 export function fetchGitRepo(url, ref) {
+  // git argv-injection guard: a value starting with "-" is parsed by git as an
+  // OPTION, not a URL/ref — e.g. a registry-supplied ref "-f" reaches
+  // `git checkout <ref>` on the full-clone retry path, and an option-looking
+  // url reaches `git clone`. Real git URLs/refs never start with "-"
+  // (check-ref-format forbids it), so reject instead of trying to escape.
+  if (String(url).startsWith("-")) {
+    throw new Error(`refusing git source that looks like an option: ${url}`);
+  }
+  if (ref != null && String(ref).startsWith("-")) {
+    throw new Error(`refusing git ref that looks like an option: ${ref}`);
+  }
   const base = _deps.mkdtempSync(path.join(os.tmpdir(), "cc-plugin-git-"));
   const dir = path.join(base, "repo");
   const run = (args) =>

package/src/lib/plugin-runtime/policy.js

@@ -115,6 +115,19 @@ export function filterByManagedPolicy(plugins, managed) {
       continue;
     }
     if (requireSigned) {
+      // Fail closed when no signing keys are pinned: a lock's signature can be
+      // SELF-signed by whoever authored the plugin (the lock lives in a
+      // writable dir), so "signed by anyone" is not a guarantee. Without
+      // trustedPluginKeySha256 the gate would accept any self-signed drop-in.
+      if (!trustedKeys || trustedKeys.size === 0) {
+        dropped.push({
+          name: p.name,
+          reason:
+            "requireSignedPlugins: no trustedPluginKeySha256 fingerprints " +
+            "configured (fail-closed — pin the org's signing keys)",
+        });
+        continue;
+      }
       const v = verifyInstalledSignature(p, { trustedKeys });
       if (!v.signed) {
         dropped.push({

package/src/lib/plugin-runtime/remote-source.js

@@ -46,6 +46,39 @@ export function isRemoteSource(raw) {
   return /^https?:\/\//i.test(s) && /\.json(\?.*)?(#.*)?$/i.test(s);
 }
 
+/**
+ * Enforce HTTPS for registry URLs. The registry supplies BOTH the git source
+ * and its claimed sha256 — over plain HTTP a network MITM controls the two
+ * together, so the integrity check verifies nothing. Loopback is exempt (a
+ * local dev registry isn't MITM-able off-host); anything else needs the
+ * explicit opt-in (opts.allowInsecure / CC_PLUGIN_REGISTRY_ALLOW_HTTP=1).
+ */
+export function assertRegistryUrlSafe(url, { allowInsecure = false } = {}) {
+  let u;
+  try {
+    u = new URL(String(url));
+  } catch {
+    throw new Error(`invalid registry URL: ${url}`);
+  }
+  if (u.protocol === "https:") return;
+  if (u.protocol !== "http:") {
+    throw new Error(`registry URL must be http(s): ${url}`);
+  }
+  // WHATWG URL keeps the brackets on IPv6 hostnames — strip before comparing.
+  const host = u.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const loopback =
+    host === "localhost" || host === "127.0.0.1" || host === "::1";
+  const optIn =
+    allowInsecure === true || process.env.CC_PLUGIN_REGISTRY_ALLOW_HTTP === "1";
+  if (loopback || optIn) return;
+  throw new Error(
+    `plain-HTTP registry rejected: ${url} — a network MITM controls both the ` +
+      `source and its sha256, so the integrity check verifies nothing. Use ` +
+      `https, or opt in with --allow-insecure-registry / ` +
+      `CC_PLUGIN_REGISTRY_ALLOW_HTTP=1 on a trusted network.`,
+  );
+}
+
 /** Where a fetched registry is cached (content-addressed by its URL). */
 export function registryCachePath(url, cacheDir) {
   const dir =
@@ -93,6 +126,7 @@ export async function fetchRegistry(url, opts = {}) {
     timeoutMs = DEFAULT_TIMEOUT_MS,
     allowCache = true,
   } = opts;
+  assertRegistryUrlSafe(url, { allowInsecure: opts.allowInsecure });
   const cachePath = registryCachePath(url, cacheDir);
   const headers = { Accept: "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;

package/src/lib/plugin-runtime/signature.js

@@ -7,20 +7,24 @@
  * install records the verification result in a `.plugin-lock.json` inside the
  * immutable version dir; discovery then re-checks it fail-closed.
  *
- * The lock records the manifest's sha256 + the signing key's fingerprint. At
- * load we RE-HASH the on-disk manifest and compare — so a manifest tampered with
- * after install (even inside the version dir) fails the check. The signature
- * itself covers only the manifest file, not every component file — that is a
+ * The lock persists the DETACHED SIGNATURE + PUBLIC KEY themselves (lockVersion
+ * 2), and load-time verification re-runs the actual Ed25519 verify over the
+ * on-disk manifest bytes. The lock file lives in a writable plugin dir, so
+ * nothing in it can be TRUSTED — a recorded boolean or fingerprint could simply
+ * be forged by whoever authored the plugin. What a forger CANNOT do is produce a
+ * signature that verifies under a key the org has pinned via
+ * trustedPluginKeySha256 — which is why the key fingerprint used for the trust
+ * check is COMPUTED from the embedded public key, never read from the lock.
+ * The signature covers only the manifest file, not every component file — a
  * known limitation (documented), an integrity anchor rather than a full
- * supply-chain seal; the immutable version dir + this re-hash catch manifest
- * tampering, which is where the component wiring is declared.
+ * supply-chain seal; the manifest is where the component wiring is declared.
  */
 
-import { createHash } from "node:crypto";
+import { createHash, createPublicKey, verify } from "node:crypto";
 import fs from "fs";
 import path from "path";
 
-const LOCK = ".plugin-lock.json";
+export const LOCK_FILENAME = ".plugin-lock.json";
 
 export const _deps = {
   readFileSync: fs.readFileSync,
@@ -31,18 +35,29 @@ export const _deps = {
 /** Record a verified signature into the version dir. */
 export function writePluginLock(
   versionDir,
-  { manifestFile, sha256, publicKeySha256, signatureVerified },
+  {
+    manifestFile,
+    sha256,
+    publicKeySha256,
+    signatureVerified,
+    signatureBase64,
+    publicKeyPem,
+  },
 ) {
   const rel = path.relative(versionDir, manifestFile).replace(/\\/g, "/");
   const lock = {
-    lockVersion: 1,
+    lockVersion: 2,
     manifest: rel || "plugin.json",
     sha256,
     publicKeySha256: publicKeySha256 || null,
     signatureVerified: signatureVerified === true,
+    // The material load-time enforcement actually re-verifies. Without these a
+    // lock is just self-asserted JSON and counts as unsigned.
+    signatureBase64: signatureBase64 || null,
+    publicKeyPem: publicKeyPem || null,
   };
   _deps.writeFileSync(
-    path.join(versionDir, LOCK),
+    path.join(versionDir, LOCK_FILENAME),
     JSON.stringify(lock, null, 2),
     "utf8",
   );
@@ -51,7 +66,7 @@ export function writePluginLock(
 
 /** Read a version dir's signature lock, or null when absent/unreadable. */
 export function readPluginLock(versionDir) {
-  const p = path.join(versionDir, LOCK);
+  const p = path.join(versionDir, LOCK_FILENAME);
   if (!_deps.existsSync(p)) return null;
   try {
     return JSON.parse(_deps.readFileSync(p, "utf8"));
@@ -62,9 +77,11 @@ export function readPluginLock(versionDir) {
 
 /**
  * Verify an installed plugin's recorded signature against its on-disk manifest.
- * `signed:true` ONLY when a lock exists, was signature-verified, the manifest
- * still hashes to the locked sha256 (tamper detection), and — when trustedKeys
- * is a non-empty Set — the signing key fingerprint is among them.
+ * `signed:true` ONLY when a lock exists, carries real signature material, the
+ * embedded Ed25519 signature VERIFIES over the on-disk manifest bytes, and —
+ * when trustedKeys is a non-empty Set — the signing key's COMPUTED fingerprint
+ * is among them. Every field of the lock is treated as attacker-writable; the
+ * only trust anchors are the cryptographic verify and the caller's trustedKeys.
  *
  * @param {{root:string}} plugin
  * @param {object} [opts] { trustedKeys?: Set<string> }
@@ -96,28 +113,68 @@ export function verifyInstalledSignature(plugin, opts = {}) {
   if (!_deps.existsSync(manifestFile)) {
     return { signed: false, reason: "locked manifest file is missing" };
   }
-  let sha;
+  let bytes;
   try {
-    sha = createHash("sha256")
-      .update(_deps.readFileSync(manifestFile))
-      .digest("hex");
+    bytes = _deps.readFileSync(manifestFile);
   } catch {
     return { signed: false, reason: "manifest unreadable" };
   }
+  const sha = createHash("sha256").update(bytes).digest("hex");
   if (sha.toLowerCase() !== String(lock.sha256 || "").toLowerCase()) {
     return {
       signed: false,
       reason: "manifest tampered since install (sha256 mismatch)",
     };
   }
+  // A lock without real signature material is unverifiable, and therefore
+  // worthless as a signing gate: `signatureVerified:true` is just a JSON field
+  // anyone can write. Legacy (lockVersion 1) locks land here too — reinstalling
+  // the plugin with --signature re-records a verifiable lock.
+  if (!lock.signatureBase64 || !lock.publicKeyPem) {
+    return {
+      signed: false,
+      reason:
+        "lock lacks signature material (legacy or hand-written lock — " +
+        "reinstall the plugin with --signature to re-record it)",
+    };
+  }
+  let keyObject;
+  let publicKeySha256;
+  try {
+    keyObject = createPublicKey(lock.publicKeyPem);
+    // Fingerprint is COMPUTED from the embedded key — the lock's own
+    // publicKeySha256 field is attacker-writable and never used for trust.
+    publicKeySha256 = createHash("sha256")
+      .update(keyObject.export({ type: "spki", format: "der" }))
+      .digest("hex");
+  } catch {
+    return { signed: false, reason: "lock public key is not a valid key" };
+  }
+  let sigOk = false;
+  try {
+    sigOk = verify(
+      null,
+      bytes,
+      keyObject,
+      Buffer.from(String(lock.signatureBase64), "base64"),
+    );
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) {
+    return {
+      signed: false,
+      reason: "recorded signature does not verify over the on-disk manifest",
+    };
+  }
   const trustedKeys = opts.trustedKeys;
   if (trustedKeys && trustedKeys.size > 0) {
-    if (!lock.publicKeySha256 || !trustedKeys.has(lock.publicKeySha256)) {
+    if (!trustedKeys.has(publicKeySha256)) {
       return {
         signed: false,
-        reason: `signing key not trusted (${lock.publicKeySha256 || "unsigned"})`,
+        reason: `signing key not trusted (${publicKeySha256})`,
       };
     }
   }
-  return { signed: true, publicKeySha256: lock.publicKeySha256 };
+  return { signed: true, publicKeySha256 };
 }