chainlesschain 0.162.154 → 0.162.155

package/src/lib/background-session-transport.js

@@ -0,0 +1,315 @@
+/**
+ * background-session-transport — local control channel for interactive attach.
+ *
+ * The background-agent worker hosts a per-session NDJSON server on a local
+ * pipe (Windows named pipe / POSIX domain socket). `cc attach <id>` connects
+ * to it to send follow-up prompts into the running session and receive
+ * lifecycle events (turn-started / turn-ended / idle), turning the log-only
+ * attach into a real interactive takeover.
+ *
+ * Auth model: the worker generates a random token, stored in the 0600 state
+ * file next to the pipe path. A client must open with
+ * `{type:"hello", token}` — anything else (or a wrong token, or silence for
+ * 5s) destroys the connection. Named pipes are reachable by other local
+ * users on Windows, so possession of the state file IS the capability.
+ *
+ * Protocol (one JSON object per line, both directions):
+ *   client → worker: {type:"hello", token} · {type:"prompt", text}
+ *                    · {type:"status"} · {type:"stop"} · {type:"detach"}
+ *   worker → client: {type:"hello", ...status} · {type:"accepted", queued}
+ *                    · {type:"status", ...status} · {type:"error", message}
+ *                    · {type:"turn-started"|"turn-ended"|"idle", ...}
+ */
+
+import net from "node:net";
+import { unlinkSync } from "node:fs";
+import { join } from "node:path";
+
+const HELLO_TIMEOUT_MS = 5000;
+const MAX_LINE_BYTES = 1024 * 1024;
+
+/** Pipe endpoint for a session id (Windows named pipe / POSIX socket file). */
+export function transportPipePath(id, dir) {
+  if (process.platform === "win32") return `\\\\.\\pipe\\cc-bg-${id}`;
+  return join(dir, `${id}.sock`);
+}
+
+/**
+ * NDJSON line framing with a carry buffer — a chunk boundary can split a
+ * line, so the remainder must carry into the next chunk instead of being
+ * parsed (and dropped) as its own line.
+ */
+export function createNdjsonReader(onMessage, onError = () => {}) {
+  let carry = "";
+  return (chunk) => {
+    carry += chunk.toString("utf8");
+    if (carry.length > MAX_LINE_BYTES) {
+      carry = "";
+      onError(new Error("line too long"));
+      return;
+    }
+    let index;
+    while ((index = carry.indexOf("\n")) !== -1) {
+      const line = carry.slice(0, index).replace(/\r$/, "");
+      carry = carry.slice(index + 1);
+      if (!line.trim()) continue;
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch (error) {
+        onError(error);
+        continue;
+      }
+      onMessage(message);
+    }
+  };
+}
+
+function writeMessage(socket, message) {
+  if (!socket || socket.destroyed) return false;
+  try {
+    socket.write(`${JSON.stringify(message)}\n`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Start the worker-side control server.
+ *
+ * @param {object} opts
+ * @param {string} opts.id background agent id
+ * @param {string} opts.dir backgroundAgentsDir() (POSIX socket location)
+ * @param {string} opts.token shared secret from the session state file
+ * @param {(text:string)=>{queued:number}} opts.onPrompt queue a follow-up
+ *        prompt; throw to reject (message is relayed to the client)
+ * @param {()=>void} [opts.onStop] kill the current agent turn
+ * @param {(count:number)=>void} [opts.onClientChange]
+ * @param {()=>object} [opts.getStatus] session status payload for hello/status
+ * @returns {Promise<{pipePath:string, clientCount:()=>number,
+ *          broadcast:(msg:object)=>void, close:()=>Promise<void>}>}
+ */
+export function startBackgroundSessionServer(opts) {
+  const { id, dir, token, onPrompt, onStop, onClientChange, getStatus } = opts;
+  const pipePath = opts.pipePath || transportPipePath(id, dir);
+  if (process.platform !== "win32") {
+    try {
+      unlinkSync(pipePath); // stale socket from a crashed prior worker
+    } catch {
+      /* fine — usually ENOENT */
+    }
+  }
+  const clients = new Set();
+  const notifyClients = () => {
+    try {
+      onClientChange?.(clients.size);
+    } catch {
+      /* observer errors never take the server down */
+    }
+  };
+
+  const server = net.createServer((socket) => {
+    let authed = false;
+    const helloTimer = setTimeout(() => {
+      if (!authed) socket.destroy();
+    }, HELLO_TIMEOUT_MS);
+    helloTimer.unref?.();
+
+    socket.on(
+      "data",
+      createNdjsonReader(
+        (message) => {
+          if (!authed) {
+            if (message.type === "hello" && message.token === token) {
+              authed = true;
+              clearTimeout(helloTimer);
+              clients.add(socket);
+              writeMessage(socket, {
+                type: "hello",
+                ...(getStatus ? getStatus() : { id }),
+              });
+              notifyClients();
+            } else {
+              socket.destroy();
+            }
+            return;
+          }
+          switch (message.type) {
+            case "prompt": {
+              const text = String(message.text || "").trim();
+              if (!text) {
+                writeMessage(socket, {
+                  type: "error",
+                  message: "prompt text is empty",
+                });
+                return;
+              }
+              try {
+                const result = onPrompt(text);
+                writeMessage(socket, {
+                  type: "accepted",
+                  queued: result?.queued ?? 1,
+                });
+              } catch (error) {
+                writeMessage(socket, {
+                  type: "error",
+                  message: error?.message || String(error),
+                });
+              }
+              return;
+            }
+            case "status": {
+              writeMessage(socket, {
+                type: "status",
+                ...(getStatus ? getStatus() : { id }),
+              });
+              return;
+            }
+            case "stop": {
+              try {
+                onStop?.();
+                writeMessage(socket, { type: "stopping" });
+              } catch (error) {
+                writeMessage(socket, {
+                  type: "error",
+                  message: error?.message || String(error),
+                });
+              }
+              return;
+            }
+            case "detach": {
+              socket.end();
+              return;
+            }
+            default:
+              writeMessage(socket, {
+                type: "error",
+                message: `unknown message type: ${message.type}`,
+              });
+          }
+        },
+        () => {
+          // Unparseable input on an authed connection is a broken client —
+          // and on an unauthed one, a probe. Either way, drop it.
+          socket.destroy();
+        },
+      ),
+    );
+
+    const drop = () => {
+      clearTimeout(helloTimer);
+      if (clients.delete(socket)) notifyClients();
+    };
+    socket.on("close", drop);
+    socket.on("error", drop);
+  });
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(pipePath, () => {
+      server.removeListener("error", reject);
+      server.on("error", () => {
+        /* post-listen errors must not crash the worker */
+      });
+      resolve({
+        pipePath,
+        clientCount: () => clients.size,
+        broadcast: (message) => {
+          for (const socket of clients) writeMessage(socket, message);
+        },
+        close: () =>
+          new Promise((done) => {
+            for (const socket of clients) socket.destroy();
+            clients.clear();
+            server.close(() => {
+              if (process.platform !== "win32") {
+                try {
+                  unlinkSync(pipePath);
+                } catch {
+                  /* already gone */
+                }
+              }
+              done();
+            });
+          }),
+      });
+    });
+  });
+}
+
+/**
+ * Client side: connect, authenticate, and expose send/close. Resolves only
+ * after the server's hello ack — so a resolved connection is usable.
+ *
+ * @param {object} opts
+ * @param {string} opts.pipePath from the session state file `transport.pipe`
+ * @param {string} opts.token from the session state file `transport.token`
+ * @param {(msg:object)=>void} [opts.onEvent] server-pushed messages
+ * @param {()=>void} [opts.onClose]
+ * @returns {Promise<{send:(msg:object)=>boolean, close:()=>void, hello:object}>}
+ */
+export function connectBackgroundSession(opts) {
+  const { pipePath, token, onEvent, onClose, timeoutMs = 5000 } = opts;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const socket = net.connect(pipePath);
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        socket.destroy();
+        reject(new Error("session transport handshake timed out"));
+      }
+    }, timeoutMs);
+    timer.unref?.();
+
+    socket.on(
+      "data",
+      createNdjsonReader((message) => {
+        if (!settled) {
+          if (message.type === "hello") {
+            settled = true;
+            clearTimeout(timer);
+            resolve({
+              hello: message,
+              send: (msg) => writeMessage(socket, msg),
+              close: () => {
+                writeMessage(socket, { type: "detach" });
+                socket.end();
+              },
+            });
+          }
+          return;
+        }
+        try {
+          onEvent?.(message);
+        } catch {
+          /* rendering errors never kill the connection */
+        }
+      }),
+    );
+    socket.on("connect", () => {
+      writeMessage(socket, { type: "hello", token });
+    });
+    socket.on("error", (error) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        reject(error);
+      }
+    });
+    socket.on("close", () => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        reject(new Error("session transport closed during handshake"));
+      } else {
+        try {
+          onClose?.();
+        } catch {
+          /* observer errors are not connection errors */
+        }
+      }
+    });
+  });
+}

package/src/lib/permission-denial-store.js

@@ -0,0 +1,159 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { getHomeDir } from "./paths.js";
+import { MAX_RECENT_DENIALS, formatDenialChain } from "./repl-denials.js";
+
+export const RECENT_DENIALS_VERSION = 1;
+export const DEFAULT_RECENT_DENIAL_LIMIT = 100;
+
+export const _deps = {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+  getHomeDir,
+  now: () => Date.now(),
+};
+
+export function recentDenialsPath() {
+  return join(_deps.getHomeDir(), "recent-denials.json");
+}
+
+function emptyStore() {
+  return { version: RECENT_DENIALS_VERSION, denials: [] };
+}
+
+function readStore(file = recentDenialsPath()) {
+  if (!_deps.existsSync(file)) return emptyStore();
+  try {
+    const parsed = JSON.parse(_deps.readFileSync(file, "utf8"));
+    return {
+      version: RECENT_DENIALS_VERSION,
+      denials: Array.isArray(parsed?.denials) ? parsed.denials : [],
+    };
+  } catch {
+    return emptyStore();
+  }
+}
+
+function writeStore(store, file = recentDenialsPath()) {
+  _deps.mkdirSync(dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  _deps.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n", "utf8");
+  _deps.renameSync(tmp, file);
+}
+
+function normalizeRecord(record, metadata = {}) {
+  if (!record || typeof record !== "object") return null;
+  return {
+    at: typeof record.at === "number" ? record.at : _deps.now(),
+    tool: String(record.tool || "?"),
+    summary: String(record.summary || ""),
+    reason: String(record.reason || ""),
+    via: String(record.via || "policy"),
+    rule: record.rule == null ? null : String(record.rule),
+    count: Number.isFinite(record.count) && record.count > 1 ? record.count : 1,
+    sessionId: metadata.sessionId || record.sessionId || null,
+    permissionMode: metadata.permissionMode || record.permissionMode || null,
+    cwd: metadata.cwd || record.cwd || null,
+    source: metadata.source || record.source || "agent",
+    // Layer-by-layer explanation (settings-rules → shell-policy →
+    // approval-gate) when the denial carried one; null for older records.
+    chain: Array.isArray(record.chain) ? record.chain : null,
+  };
+}
+
+function sameRecentDenial(a, b) {
+  return (
+    a &&
+    b &&
+    a.tool === b.tool &&
+    a.summary === b.summary &&
+    a.via === b.via &&
+    a.rule === b.rule &&
+    a.sessionId === b.sessionId &&
+    a.permissionMode === b.permissionMode &&
+    a.cwd === b.cwd &&
+    a.source === b.source
+  );
+}
+
+function parseLimit(value, fallback = DEFAULT_RECENT_DENIAL_LIMIT) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
+}
+
+export function appendRecentDenials(records, metadata = {}, options = {}) {
+  const incoming = Array.isArray(records) ? records : [records];
+  const normalized = incoming
+    .map((record) => normalizeRecord(record, metadata))
+    .filter(Boolean);
+  if (!normalized.length) return readRecentDenials(options);
+
+  const max = parseLimit(options.max || options.limit);
+  const file = options.file || recentDenialsPath();
+  const store = readStore(file);
+  for (const record of normalized) {
+    const last = store.denials[store.denials.length - 1];
+    if (sameRecentDenial(last, record)) {
+      last.count = (last.count || 1) + (record.count || 1);
+      last.at = record.at;
+      if (record.reason) last.reason = record.reason;
+    } else {
+      store.denials.push(record);
+    }
+  }
+  while (store.denials.length > max) store.denials.shift();
+  writeStore(store, file);
+  return store.denials.slice(-Math.min(max, store.denials.length));
+}
+
+export function readRecentDenials(options = {}) {
+  const max = parseLimit(options.limit);
+  const store = readStore(options.file || recentDenialsPath());
+  return store.denials.slice(-Math.min(max, store.denials.length));
+}
+
+export function clearRecentDenials(options = {}) {
+  const file = options.file || recentDenialsPath();
+  writeStore(emptyStore(), file);
+  return { file, cleared: true };
+}
+
+export function formatRecentDenials(records, options = {}) {
+  const now = typeof options.now === "number" ? options.now : _deps.now();
+  const denials = Array.isArray(records) ? records : [];
+  if (!denials.length) return "  (no recent policy denials)";
+  const lines = [
+    `  Recent policy denials (most recent first, ${denials.length}):`,
+  ];
+  for (let i = denials.length - 1; i >= 0; i--) {
+    const d = denials[i] || {};
+    const ago =
+      typeof d.at === "number"
+        ? ` · ${Math.max(0, Math.round((now - d.at) / 1000))}s ago`
+        : "";
+    const where = d.rule ? `${d.via}:${d.rule}` : d.via || "policy";
+    const what = d.summary ? `${d.tool} ${d.summary}` : d.tool || "?";
+    const times = d.count > 1 ? ` x${d.count}` : "";
+    const session = d.sessionId ? ` · session ${d.sessionId}` : "";
+    const mode = d.permissionMode ? ` · mode ${d.permissionMode}` : "";
+    lines.push(`  - ${what}${times}  [${where}${session}${mode}${ago}]`);
+    if (d.cwd) lines.push(`      cwd: ${d.cwd}`);
+    const chainLine = formatDenialChain(d.chain);
+    if (chainLine) lines.push(`      chain: ${chainLine}`);
+    if (d.reason) lines.push(`      ${d.reason}`);
+  }
+  return lines.join("\n");
+}
+
+export function recentDenialRetentionLimit() {
+  return Math.max(DEFAULT_RECENT_DENIAL_LIMIT, MAX_RECENT_DENIALS);
+}