chainlesschain 0.162.154 → 0.162.155

package/src/lib/auto-mode-config.js

@@ -0,0 +1,396 @@
+import settingsLoader from "./settings-loader.cjs";
+
+const { loadManagedSettings, readSettingsFile, settingsPaths } = settingsLoader;
+
+export const AUTO_MODE_SCHEMA = "chainlesschain.auto-mode/v1";
+
+export const AUTO_MODE_DEFAULTS = Object.freeze({
+  schema: AUTO_MODE_SCHEMA,
+  mode: "auto",
+  sessionPolicy: "trusted",
+  nonInteractiveConfirm: "deny",
+  interactiveConfirm: "ask",
+  precedence: Object.freeze([
+    "managed-settings",
+    "permission-rules.deny",
+    "permission-rules.ask",
+    "permission-rules.allow",
+    "shell-policy",
+    "approval-gate",
+    "hooks",
+  ]),
+  decisions: Object.freeze([
+    Object.freeze({
+      match: Object.freeze({ riskLevel: "low" }),
+      decision: "allow",
+      reason: "read-only and low-risk tools do not require approval",
+    }),
+    Object.freeze({
+      match: Object.freeze({ riskLevel: "medium" }),
+      decision: "allow",
+      reason: "auto maps to the trusted ApprovalGate policy",
+    }),
+    Object.freeze({
+      match: Object.freeze({ riskLevel: "high" }),
+      decision: "ask",
+      nonInteractiveDecision: "deny",
+      reason: "dangerous execution still needs approval",
+    }),
+  ]),
+  settings: Object.freeze({
+    classifyAllShell: false,
+  }),
+});
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function isPlainObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value);
+}
+
+function autoModeFromSettings(data) {
+  if (!isPlainObject(data?.autoMode)) return null;
+  return clone(data.autoMode);
+}
+
+/**
+ * Layered merge for `autoMode` settings. NOT mergeSandboxSettings: that
+ * helper's array branch stringifies elements (`map(String)`) for sandbox
+ * allowlists, which destroys array-form `decisions` rule objects into
+ * "[object Object]". Here `decisions` arrays are an ORDERED RULE LIST — a
+ * closer layer replaces the whole list; everything else keeps the familiar
+ * closer-scalar-wins / deep-object-merge semantics.
+ */
+function mergeAutoModeSettings(base, overlay) {
+  const out = isPlainObject(base) ? clone(base) : {};
+  for (const [key, value] of Object.entries(overlay || {})) {
+    if (Array.isArray(value)) {
+      out[key] = clone(value);
+    } else if (isPlainObject(value)) {
+      out[key] = mergeAutoModeSettings(out[key], value);
+    } else if (["string", "boolean", "number"].includes(typeof value)) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+export function loadAutoModeConfig(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  let effective = clone(AUTO_MODE_DEFAULTS.settings);
+  const files = [];
+
+  for (const file of settingsPaths(cwd, opts.settingsFile)) {
+    const data = readSettingsFile(file, { onWarn: opts.onWarn });
+    const autoMode = autoModeFromSettings(data);
+    if (!autoMode) continue;
+    effective = mergeAutoModeSettings(effective, autoMode);
+    files.push(file);
+  }
+
+  const managed = loadManagedSettings(opts);
+  let managedFile = null;
+  if (managed.settings) {
+    const autoMode = autoModeFromSettings(managed.settings);
+    if (autoMode) {
+      effective = mergeAutoModeSettings(effective, autoMode);
+      managedFile = managed.file;
+      files.push(managed.file);
+    }
+  }
+
+  return {
+    schema: AUTO_MODE_SCHEMA,
+    defaults: clone(AUTO_MODE_DEFAULTS.settings),
+    effective,
+    files,
+    managedFile,
+  };
+}
+
+export function autoModeDefaultsDocument() {
+  return clone(AUTO_MODE_DEFAULTS);
+}
+
+const RISK_LEVELS = Object.freeze(["low", "medium", "high"]);
+const DECISION_VALUES = Object.freeze(["allow", "ask", "deny"]);
+
+function normalizeDecisionValue(value) {
+  const v = typeof value === "string" ? value.toLowerCase() : null;
+  if (v === "confirm") return "ask";
+  return DECISION_VALUES.includes(v) ? v : null;
+}
+
+function defaultDecisionMap() {
+  const map = {};
+  for (const rule of AUTO_MODE_DEFAULTS.decisions) {
+    map[rule.match.riskLevel] = {
+      decision: rule.decision,
+      reason: rule.reason,
+      source: "default",
+    };
+  }
+  return map;
+}
+
+/**
+ * Compile a shell-style glob (`*` wildcard only) into an anchored RegExp.
+ * Case-sensitive on purpose: match patterns are user-vetted capabilities and
+ * a looser match could over-authorize.
+ */
+function compileGlob(pattern) {
+  const escaped = String(pattern)
+    .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    .replace(/\\\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+
+/**
+ * Resolve the effective decision rules for `--permission-mode auto`.
+ *
+ * Accepts `autoMode.decisions` in two shapes:
+ *   - object: `{ "medium": "ask", "high": { "decision": "deny", "reason": "…" } }`
+ *     (riskLevel-level overrides only)
+ *   - array (same shape as the defaults document):
+ *     `[{ "match": { "riskLevel": "medium" }, "decision": "ask", "reason": "…" }]`
+ *     Array rules may additionally match on `tool` (exact name) and/or
+ *     `commandPattern` (a `*` glob against the shell command). Rules with a
+ *     tool/commandPattern are FINE-GRAINED: they are tried in declaration
+ *     order before the riskLevel map, first full match wins.
+ *
+ * Invalid risk levels / decision values / non-string patterns are ignored
+ * (fail to defaults) so a typo in settings.json can never loosen NOR silently
+ * break the gate.
+ *
+ * @param {object} [effectiveSettings] merged `autoMode` settings
+ * @returns {{
+ *   map: Record<string,{decision:string,reason:string,source:string}>,
+ *   rules: Array<{match:object,decision:string,reason:string,_test:(ctx:object)=>boolean}>,
+ *   customized: boolean,
+ * }}
+ */
+export function resolveAutoModeDecisions(effectiveSettings = {}) {
+  const map = defaultDecisionMap();
+  const rules = [];
+  let customized = false;
+
+  const raw = effectiveSettings?.decisions;
+  const entries = [];
+  if (Array.isArray(raw)) {
+    for (const rule of raw) {
+      if (!isPlainObject(rule)) continue;
+      const match = isPlainObject(rule.match) ? rule.match : {};
+      const decision = normalizeDecisionValue(rule.decision);
+      if (!decision) continue;
+      const hasTool = typeof match.tool === "string" && match.tool.trim();
+      const hasPattern =
+        typeof match.commandPattern === "string" && match.commandPattern.trim();
+      if (hasTool || hasPattern) {
+        // Fine-grained rule: tried in order before the riskLevel map.
+        const riskLevel =
+          typeof match.riskLevel === "string" &&
+          RISK_LEVELS.includes(match.riskLevel.toLowerCase())
+            ? match.riskLevel.toLowerCase()
+            : null;
+        const tool = hasTool ? match.tool.trim() : null;
+        const pattern = hasPattern ? match.commandPattern.trim() : null;
+        const regex = pattern ? compileGlob(pattern) : null;
+        const reason =
+          typeof rule.reason === "string" && rule.reason.trim()
+            ? rule.reason.trim()
+            : `autoMode.decisions rule matches ${[
+                tool ? `tool=${tool}` : null,
+                pattern ? `command=${pattern}` : null,
+                riskLevel ? `risk=${riskLevel}` : null,
+              ]
+                .filter(Boolean)
+                .join(" ")} → ${decision}`;
+        rules.push({
+          match: {
+            ...(riskLevel ? { riskLevel } : {}),
+            ...(tool ? { tool } : {}),
+            ...(pattern ? { commandPattern: pattern } : {}),
+          },
+          decision,
+          reason,
+          _test: (ctx) => {
+            if (riskLevel) {
+              const r = RISK_LEVELS.includes(ctx.riskLevel)
+                ? ctx.riskLevel
+                : "low";
+              if (r !== riskLevel) return false;
+            }
+            if (tool && ctx.tool !== tool) return false;
+            if (regex && !regex.test(String(ctx.args?.command ?? ""))) {
+              return false;
+            }
+            return true;
+          },
+        });
+        customized = true;
+        continue;
+      }
+      entries.push([match.riskLevel, rule.decision, rule.reason]);
+    }
+  } else if (isPlainObject(raw)) {
+    for (const [riskLevel, value] of Object.entries(raw)) {
+      if (isPlainObject(value)) {
+        entries.push([riskLevel, value.decision, value.reason]);
+      } else {
+        entries.push([riskLevel, value, undefined]);
+      }
+    }
+  }
+
+  for (const [riskLevelRaw, decisionRaw, reasonRaw] of entries) {
+    const riskLevel =
+      typeof riskLevelRaw === "string" ? riskLevelRaw.toLowerCase() : null;
+    if (!RISK_LEVELS.includes(riskLevel)) continue;
+    const decision = normalizeDecisionValue(decisionRaw);
+    if (!decision) continue;
+    const reason =
+      typeof reasonRaw === "string" && reasonRaw.trim()
+        ? reasonRaw.trim()
+        : `autoMode.decisions maps ${riskLevel} risk to ${decision}`;
+    if (map[riskLevel].decision !== decision) customized = true;
+    map[riskLevel] = { decision, reason, source: "settings" };
+  }
+
+  return { map, rules, customized };
+}
+
+/**
+ * Wrap a session-core ApprovalGate so `--permission-mode auto` consults the
+ * user-configured riskLevel → decision map instead of the fixed trusted-policy
+ * tier. Only wired when `resolveAutoModeDecisions` reports `customized` — the
+ * unconfigured path keeps the byte-identical trusted mapping.
+ *
+ * The wrapper cannot up-authorize hard shell-policy denies: those return from
+ * `evaluateShellCommandWithApproval` before the gate is ever consulted.
+ *
+ * @param {object} inner session-core ApprovalGate (or compatible)
+ * @param {ReturnType<typeof resolveAutoModeDecisions>} resolved
+ * @param {{ isActive?: () => boolean }} [opts] `isActive` lets a host that can
+ *        switch permission modes mid-session (the REPL) leave the wrapper
+ *        installed permanently and toggle it: when it returns false, decide()
+ *        delegates untouched to the inner gate. Omitted → always active
+ *        (headless runs pick the mode once per process).
+ */
+export function createAutoModeApprovalGate(inner, resolved, opts = {}) {
+  const map = resolved?.map || defaultDecisionMap();
+  const rules = Array.isArray(resolved?.rules) ? resolved.rules : [];
+  const isActive =
+    typeof opts.isActive === "function" ? opts.isActive : () => true;
+  let confirm = null;
+
+  return {
+    isAutoModeGate: true,
+    setSessionPolicy(sessionId, policy) {
+      return inner?.setSessionPolicy?.(sessionId, policy);
+    },
+    getSessionPolicy(sessionId) {
+      return inner?.getSessionPolicy?.(sessionId);
+    },
+    clearSessionPolicy(sessionId) {
+      return inner?.clearSessionPolicy?.(sessionId);
+    },
+    setConfirmer(fn) {
+      confirm = typeof fn === "function" ? fn : null;
+      inner?.setConfirmer?.(fn);
+    },
+    hasConfirmer() {
+      return typeof confirm === "function";
+    },
+    async decide(ctx = {}) {
+      if (!isActive()) return inner.decide(ctx);
+      const riskLevel = RISK_LEVELS.includes(ctx.riskLevel)
+        ? ctx.riskLevel
+        : "low";
+      // Fine-grained rules (tool / commandPattern) run in declaration order
+      // before the riskLevel map — first full match wins.
+      let rule = null;
+      for (const candidate of rules) {
+        let matched = false;
+        try {
+          matched = candidate._test({ ...ctx, riskLevel });
+        } catch {
+          matched = false; // a broken matcher never decides anything
+        }
+        if (matched) {
+          rule = {
+            decision: candidate.decision,
+            reason: candidate.reason,
+            source: "settings",
+            match: candidate.match,
+          };
+          break;
+        }
+      }
+      if (!rule) {
+        const fromMap = map[riskLevel];
+        rule = {
+          decision: fromMap.decision,
+          reason: fromMap.reason,
+          source: fromMap.source,
+        };
+      }
+      const common = {
+        policy: "auto-mode",
+        riskLevel,
+        reason: rule.reason,
+        rule: {
+          riskLevel,
+          decision: rule.decision,
+          source: rule.source,
+          ...(rule.match ? { match: rule.match } : {}),
+        },
+      };
+      if (rule.decision === "allow") {
+        return {
+          decision: "allow",
+          via: "auto-mode-config",
+          base: "allow",
+          ...common,
+        };
+      }
+      if (rule.decision === "deny") {
+        return {
+          decision: "deny",
+          via: "auto-mode-config",
+          base: "deny",
+          ...common,
+        };
+      }
+      // ask — same confirm semantics as the session-core gate: no confirmer
+      // means fail-closed deny (headless installs a deny-confirmer anyway).
+      if (typeof confirm !== "function") {
+        return {
+          decision: "deny",
+          via: "no-confirmer",
+          base: "confirm",
+          ...common,
+        };
+      }
+      let ok = false;
+      try {
+        ok = await confirm(ctx);
+      } catch (error) {
+        return {
+          decision: "deny",
+          via: "confirm-error",
+          base: "confirm",
+          error,
+          ...common,
+        };
+      }
+      return {
+        decision: ok ? "allow" : "deny",
+        via: ok ? "user-confirm" : "user-deny",
+        base: "confirm",
+        ...common,
+      };
+    },
+  };
+}

package/src/lib/background-agent-supervisor.js

@@ -17,6 +17,23 @@ import { getHomeDir } from "./paths.js";
 
 export const _deps = { spawn, spawnSync };
 
+export const DEFAULT_HEARTBEAT_INTERVAL_MS = 5000;
+export const DEFAULT_HEARTBEAT_STALE_MS = 120000;
+
+function nowMs(options = {}) {
+  return typeof options.now === "number" ? options.now : Date.now();
+}
+
+function heartbeatStaleMs(options = {}) {
+  const configured =
+    options.heartbeatStaleMs ||
+    process.env.CC_BACKGROUND_AGENT_HEARTBEAT_STALE_MS;
+  const n = Number(configured);
+  return Number.isFinite(n) && n > 0
+    ? Math.floor(n)
+    : DEFAULT_HEARTBEAT_STALE_MS;
+}
+
 export function backgroundAgentsDir() {
   const dir =
     process.env.CC_BACKGROUND_AGENTS_DIR ||
@@ -73,12 +90,43 @@ export function isProcessAlive(pid) {
   }
 }
 
-export function effectiveBackgroundAgentState(state) {
+export function normalizeBackgroundAgentTitle(title) {
+  const value = String(title || "").trim();
+  if (!value) throw new Error("Background agent title cannot be empty");
+  return value.slice(0, 160);
+}
+
+export function effectiveBackgroundAgentState(state, options = {}) {
   if (!state) return null;
-  if (state.status === "running" && !isProcessAlive(state.pid)) {
-    return { ...state, status: "lost", endedAt: state.endedAt || Date.now() };
+  if (state.status !== "running") return state;
+  const t = nowMs(options);
+  let next = state;
+  if (
+    Number.isFinite(Number(state.heartbeatAt)) &&
+    t - Number(state.heartbeatAt) > heartbeatStaleMs(options)
+  ) {
+    next = {
+      ...state,
+      status: "lost",
+      endedAt: state.endedAt || t,
+      lostReason: "heartbeat-stale",
+    };
+  } else if (!isProcessAlive(state.pid)) {
+    next = {
+      ...state,
+      status: "lost",
+      endedAt: state.endedAt || t,
+      lostReason: "process-exited",
+    };
   }
-  return state;
+  if (next !== state && options.persist !== false) {
+    try {
+      writeBackgroundAgentState(next);
+    } catch {
+      /* best-effort; callers still get the corrected state */
+    }
+  }
+  return next;
 }
 
 export function listBackgroundAgents(options = {}) {
@@ -86,17 +134,137 @@ export function listBackgroundAgents(options = {}) {
     .filter((name) => name.endsWith(".json") && !name.includes(".job."))
     .map((name) => readBackgroundAgentState(name.slice(0, -5)))
     .filter(Boolean)
-    .map(effectiveBackgroundAgentState)
+    .map((state) => effectiveBackgroundAgentState(state, options))
     .filter((state) => options.all || state.status === "running")
     .sort((a, b) => (b.startedAt || 0) - (a.startedAt || 0));
 }
 
+function sleepSyncMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const until = Date.now() + ms;
+    while (Date.now() < until) {
+      /* fallback busy-wait — only a few ms */
+    }
+  }
+}
+
+export function renameBackgroundAgent(id, title, options = {}) {
+  const state = effectiveBackgroundAgentState(readBackgroundAgentState(id), {
+    now: options.now,
+    heartbeatStaleMs: options.heartbeatStaleMs,
+  });
+  if (!state) throw new Error(`Background agent not found: ${id}`);
+  const normalized = normalizeBackgroundAgentTitle(title);
+  const renamedAt = typeof options.now === "number" ? options.now : Date.now();
+  // The worker persists state via read-modify-write (heartbeat / transport /
+  // turn merges). A rename that lands inside one of those read→write windows
+  // gets clobbered by the worker's stale snapshot — so verify after a short
+  // beat and re-apply onto the freshest state (bounded retries; the window is
+  // milliseconds wide, worst during worker startup's write burst).
+  let next = { ...state, title: normalized, renamedAt };
+  for (let attempt = 0; attempt < 4; attempt++) {
+    writeBackgroundAgentState(next);
+    sleepSyncMs(15);
+    const current = readBackgroundAgentState(id) || next;
+    if (current.title === normalized) {
+      return { ...current, title: normalized, renamedAt };
+    }
+    next = { ...current, title: normalized, renamedAt };
+  }
+  writeBackgroundAgentState(next);
+  return next;
+}
+
+/**
+ * Build the follow-up argv template for interactive attach turns: the launch
+ * argv minus every token that carried the FIRST turn's prompt (positional
+ * task words, `-p/--print` and its inline value). The worker appends
+ * `["-p", "<follow-up text>"]` per turn, so all remaining flags (model,
+ * permission-mode, session id, …) keep applying to later turns.
+ *
+ * @param {string[]} argv the background child argv (before any piped-prompt
+ *        token is appended)
+ * @param {object} [opts]
+ * @param {string[]} [opts.positionalTokens] raw positional prompt tokens
+ * @param {string|null} [opts.printValue] inline `-p <value>` text, when the
+ *        prompt came from --print
+ */
+export function buildFollowUpArgv(argv, opts = {}) {
+  const positionalLeft = Array.isArray(opts.positionalTokens)
+    ? [...opts.positionalTokens]
+    : [];
+  const printValue =
+    typeof opts.printValue === "string" && opts.printValue.trim()
+      ? opts.printValue
+      : null;
+  const out = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-p" || arg === "--print") {
+      if (printValue !== null && argv[i + 1] === printValue) i++;
+      continue;
+    }
+    // equals-form: --print=<value> carries the prompt in the same token
+    if (
+      printValue !== null &&
+      arg.startsWith("--print=") &&
+      arg.slice("--print=".length) === printValue
+    ) {
+      continue;
+    }
+    if (positionalLeft.length && arg === positionalLeft[0]) {
+      positionalLeft.shift();
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
+
+/**
+ * Continue a finished/crashed background session as a NEW background session
+ * on the same conversation (`cc daemon resume <id> <prompt>`). The original
+ * launch argv is intentionally NOT persisted (it may carry secrets), so the
+ * resume runs a minimal `agent --session <sid> -p <prompt>` — model/provider
+ * come from config defaults, and the headless runner replays the JSONL
+ * transcript for the session id.
+ */
+export function resumeBackgroundAgent(id, prompt, options = {}) {
+  const state = effectiveBackgroundAgentState(readBackgroundAgentState(id), {
+    now: options.now,
+    heartbeatStaleMs: options.heartbeatStaleMs,
+  });
+  if (!state) throw new Error(`Background agent not found: ${id}`);
+  if (state.status === "running") {
+    throw new Error(
+      `Background agent ${id} is still running — use cc attach ${id} to send follow-up prompts instead`,
+    );
+  }
+  if (!state.sessionId) {
+    throw new Error(`Background agent ${id} has no session id to resume from`);
+  }
+  const text = String(prompt || "").trim();
+  if (!text) throw new Error("resume requires a prompt");
+  const argv = ["agent", "--session", state.sessionId, "-p", text];
+  return launchBackgroundAgent({
+    argv,
+    cwd: options.cwd || state.cwd || process.cwd(),
+    sessionId: state.sessionId,
+    title: options.title || state.title || text.slice(0, 100),
+    cliEntry: options.cliEntry,
+    followUpArgv: ["agent", "--session", state.sessionId],
+  });
+}
+
 export function launchBackgroundAgent({
   argv,
   cwd,
   sessionId,
   title,
   cliEntry,
+  followUpArgv,
 }) {
   const id = createBackgroundAgentId();
   const dir = backgroundAgentsDir();
@@ -112,8 +280,30 @@ export function launchBackgroundAgent({
     title: title || "Background agent",
     cliEntry: cliEntry || process.argv[1],
     logFile: logPath(id),
+    // Present = interactive attach can start follow-up turns; absent = the
+    // transport rejects prompts (log-only session).
+    ...(Array.isArray(followUpArgv) ? { followUpArgv } : {}),
   };
   writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });
+  // Write the initial state BEFORE spawning so the worker's own merges (the
+  // transport endpoint lands within its first ~100ms) can never be clobbered
+  // by a late launcher write racing the worker.
+  const state = {
+    id,
+    sessionId,
+    title: job.title,
+    cwd,
+    pid: null,
+    workerPid: null,
+    agentPid: null,
+    status: "running",
+    startedAt: Date.now(),
+    heartbeatAt: Date.now(),
+    endedAt: null,
+    exitCode: null,
+    logFile: job.logFile,
+  };
+  writeBackgroundAgentState(state);
   let child;
   try {
     child = _deps.spawn(process.execPath, [worker, jobFile], {
@@ -124,23 +314,18 @@ export function launchBackgroundAgent({
     });
   } catch (error) {
     rmSync(jobFile, { force: true });
+    rmSync(statePath(id), { force: true });
     throw error;
   }
   child.unref();
-  const state = {
-    id,
-    sessionId,
-    title: job.title,
-    cwd,
+  const current = readBackgroundAgentState(id) || state;
+  const withPid = {
+    ...current,
     pid: child.pid,
-    status: "running",
-    startedAt: Date.now(),
-    endedAt: null,
-    exitCode: null,
-    logFile: job.logFile,
+    workerPid: child.pid,
   };
-  writeBackgroundAgentState(state);
-  return state;
+  writeBackgroundAgentState(withPid);
+  return withPid;
 }
 
 export function readBackgroundAgentLog(id, options = {}) {