chainlesschain 0.162.156 → 0.162.158

package/src/lib/safe-mode.js

@@ -43,3 +43,43 @@ export function safeModeRequested(opts = {}, env = process.env) {
   const raw = env.CC_SAFE_MODE || env.CLAUDE_CODE_SAFE_MODE;
   return raw != null && /^(1|true|yes|on)$/i.test(String(raw).trim());
 }
+
+/**
+ * `cc agent --bare` — everything --safe-mode disables PLUS skills, plugins and
+ * MCP auto-connect: a minimal, fast agent surface for scripted invocations.
+ * The two extra env switches are consumed at the single chokepoints all
+ * loading funnels through (skill-loader `loadAll`, plugin-runtime
+ * `discoverPlugins`); MCP/IDE/PDH/JetBrains auto-connect are flipped off on
+ * the parsed options by the agent command itself (an explicit --mcp-config
+ * still loads — bare kills ambient auto-connects, not explicit input).
+ * Permission rules stay active, same as safe mode.
+ */
+export const BARE_MODE_EXTRA_SWITCHES = Object.freeze({
+  CC_SKILLS: "0", // every skill layer (list_skills/run_skill surface empties)
+  CC_PLUGINS: "0", // plugin runtime (hooks/monitors/MCP/LSP/bin/env/skills/agents)
+});
+
+/**
+ * Apply bare mode to an env: all safe-mode switches + the bare extras.
+ * @returns {string[]} the switch names applied (for the startup notice)
+ */
+export function applyBareMode(env = process.env) {
+  const applied = applySafeMode(env);
+  for (const [k, v] of Object.entries(BARE_MODE_EXTRA_SWITCHES)) {
+    env[k] = v;
+  }
+  return [...applied, ...Object.keys(BARE_MODE_EXTRA_SWITCHES)];
+}
+
+/**
+ * Whether bare mode is requested — the explicit `--bare` flag or the ambient
+ * `CC_BARE` env var (truthy values: 1 / true / yes / on).
+ * @param {{ bare?: boolean }} [opts]
+ * @param {object} [env=process.env]
+ * @returns {boolean}
+ */
+export function bareModeRequested(opts = {}, env = process.env) {
+  if (opts && opts.bare === true) return true;
+  const raw = env.CC_BARE;
+  return raw != null && /^(1|true|yes|on)$/i.test(String(raw).trim());
+}

package/src/lib/shell-selector.cjs

@@ -0,0 +1,203 @@
+"use strict";
+
+/**
+ * shell-selector — Windows / PowerShell first-class shell selection
+ * (gap-analysis P1 #8).
+ *
+ * Decides WHICH shell a `run_shell` command (or a settings hook with a
+ * `shell` field) executes under:
+ *
+ *   - per-call:   run_shell `{ shell: "powershell" | "pwsh" | "cmd" | "default" }`
+ *   - configured: settings `shell.windowsDefault` ("cmd" | "powershell" | "pwsh",
+ *                 layered .claude/settings.json, closest wins) or the
+ *                 CC_WINDOWS_SHELL env var (wins over settings)
+ *   - default:    unchanged platform default (cmd.exe via ComSpec on Windows,
+ *                 /bin/sh elsewhere) — the unconfigured path is byte-identical.
+ *
+ * PowerShell runs go through explicit argv (`powershell.exe -NoProfile
+ * [-ExecutionPolicy <p>] -Command <command>`), NOT `shell: "powershell.exe"`,
+ * so the enterprise ExecutionPolicy override (settings
+ * `shell.powershell.executionPolicy`) can be applied per-invocation without
+ * touching machine state. The policy value is validated against the fixed
+ * PowerShell enum — a settings typo can NOT smuggle extra argv.
+ *
+ * Scope notes:
+ *   - `windowsDefault` only applies on win32 (hence the name). A per-call
+ *     `pwsh` request is honored on any platform (PowerShell 7 is
+ *     cross-platform); `powershell`/`cmd` requests outside Windows fall back
+ *     to the platform default with a note.
+ *   - `-ExecutionPolicy` is only attached on win32 (POSIX pwsh has no policy).
+ *   - Hooks opt in per-hook via `{ "shell": "powershell" }` — the configured
+ *     windowsDefault deliberately does NOT rewrite existing hooks.
+ */
+
+const settingsLoader = require("./settings-loader.cjs");
+
+const SHELL_KINDS = Object.freeze(["default", "cmd", "powershell", "pwsh"]);
+
+/** The fixed PowerShell ExecutionPolicy enum (canonical casing). */
+const EXECUTION_POLICIES = Object.freeze([
+  "Restricted",
+  "AllSigned",
+  "RemoteSigned",
+  "Unrestricted",
+  "Bypass",
+  "Undefined",
+]);
+
+/** Normalize a shell kind; unknown/empty → null (fail to default). */
+function normalizeShellKind(value) {
+  if (typeof value !== "string") return null;
+  const v = value.trim().toLowerCase();
+  if (v === "powershell.exe" || v === "windowspowershell") return "powershell";
+  if (v === "pwsh.exe") return "pwsh";
+  if (v === "cmd.exe") return "cmd";
+  return SHELL_KINDS.includes(v) ? v : null;
+}
+
+/** Normalize an ExecutionPolicy to canonical casing; unknown → null. */
+function normalizeExecutionPolicy(value) {
+  if (typeof value !== "string") return null;
+  const v = value.trim().toLowerCase();
+  return EXECUTION_POLICIES.find((p) => p.toLowerCase() === v) || null;
+}
+
+/**
+ * Layered `shell` settings: `{ windowsDefault, powershell: { executionPolicy } }`.
+ * Closest layer wins per key; invalid values are ignored (fail-to-default).
+ * CC_WINDOWS_SHELL env overrides the settings-provided windowsDefault.
+ *
+ * @param {{ cwd?: string, env?: object, settingsFile?: string, onWarn?: Function }} [opts]
+ * @returns {{ windowsDefault: string|null, executionPolicy: string|null, files: string[] }}
+ */
+// Per-process memo: run_shell resolves the config on EVERY call, and the
+// layered settings walk is filesystem I/O. A short TTL keeps mid-session
+// settings edits honored without re-reading per tool call.
+const _configCache = new Map(); // key → { at, value }
+const CONFIG_CACHE_TTL_MS = 3000;
+
+function loadShellConfig(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const env = opts.env || process.env;
+  const cacheable = !opts.env && !opts.onWarn;
+  const cacheKey = cacheable ? `${cwd}|${opts.settingsFile || ""}` : null;
+  if (cacheKey) {
+    const hit = _configCache.get(cacheKey);
+    if (hit && Date.now() - hit.at < CONFIG_CACHE_TTL_MS) return hit.value;
+  }
+  let windowsDefault = null;
+  let executionPolicy = null;
+  const files = [];
+  try {
+    for (const file of settingsLoader.settingsPaths(cwd, opts.settingsFile)) {
+      const data = settingsLoader.readSettingsFile(file, {
+        onWarn: opts.onWarn,
+      });
+      const shell = data && typeof data === "object" ? data.shell : null;
+      if (!shell || typeof shell !== "object" || Array.isArray(shell)) continue;
+      const kind = normalizeShellKind(shell.windowsDefault);
+      if (kind) windowsDefault = kind;
+      const pol = normalizeExecutionPolicy(shell.powershell?.executionPolicy);
+      if (pol) executionPolicy = pol;
+      files.push(file);
+    }
+  } catch {
+    /* settings are best-effort — never fail shell resolution over them */
+  }
+  const envKind = normalizeShellKind(env.CC_WINDOWS_SHELL);
+  if (envKind) windowsDefault = envKind;
+  const value = { windowsDefault, executionPolicy, files };
+  if (cacheKey) _configCache.set(cacheKey, { at: Date.now(), value });
+  return value;
+}
+
+/** Test hook: drop the config memo. */
+function _clearShellConfigCache() {
+  _configCache.clear();
+}
+
+/**
+ * Build the explicit argv for a PowerShell invocation of `command`.
+ * @param {string} command
+ * @param {"powershell"|"pwsh"} kind
+ * @param {{ executionPolicy?: string|null, platform?: string }} [opts]
+ * @returns {{ file: string, argv: string[] }}
+ */
+function buildPowershellArgv(command, kind, opts = {}) {
+  const platform = opts.platform || process.platform;
+  const file = kind === "pwsh" ? "pwsh" : "powershell.exe";
+  const policy =
+    platform === "win32"
+      ? normalizeExecutionPolicy(opts.executionPolicy)
+      : null;
+  return {
+    file,
+    argv: [
+      "-NoProfile",
+      ...(policy ? ["-ExecutionPolicy", policy] : []),
+      "-Command",
+      String(command ?? ""),
+    ],
+  };
+}
+
+/**
+ * Resolve how to run one shell command.
+ *
+ * Precedence: per-call `requested` > configured windowsDefault (win32 only)
+ * > platform default. Returns either the default-shell marker (caller keeps
+ * its existing exec/spawn `shell: true` path — byte-identical) or an explicit
+ * `{ file, argv }` PowerShell invocation.
+ *
+ * @param {{ command: string, requested?: string, cwd?: string, env?: object,
+ *           platform?: string, settingsFile?: string,
+ *           config?: { windowsDefault?: string|null, executionPolicy?: string|null } }} opts
+ * @returns {{ kind: string, useDefaultShell: boolean, file?: string,
+ *            argv?: string[], note?: string }}
+ */
+function resolveShellInvocation(opts = {}) {
+  const platform = opts.platform || process.platform;
+  const config = opts.config || loadShellConfig(opts);
+  const requested = normalizeShellKind(opts.requested);
+  let kind =
+    requested ||
+    (platform === "win32" ? config.windowsDefault : null) ||
+    "default";
+  let note;
+
+  if (kind === "cmd") {
+    if (platform === "win32") {
+      // cmd IS the Windows default shell — take the untouched default path so
+      // an explicit `shell:"cmd"` opt-out of a PowerShell windowsDefault stays
+      // byte-identical to the historical behavior.
+      return { kind: "cmd", useDefaultShell: true };
+    }
+    note = "cmd is Windows-only; using the platform default shell";
+    return { kind: "default", useDefaultShell: true, note };
+  }
+  if (kind === "powershell" && platform !== "win32") {
+    // Windows PowerShell 5.1 doesn't exist off-Windows; pwsh might.
+    note =
+      "powershell (5.1) is Windows-only; using the platform default shell (request pwsh for PowerShell 7)";
+    return { kind: "default", useDefaultShell: true, note };
+  }
+  if (kind === "powershell" || kind === "pwsh") {
+    const { file, argv } = buildPowershellArgv(opts.command, kind, {
+      executionPolicy: config.executionPolicy,
+      platform,
+    });
+    return { kind, useDefaultShell: false, file, argv };
+  }
+  return { kind: "default", useDefaultShell: true };
+}
+
+module.exports = {
+  SHELL_KINDS,
+  EXECUTION_POLICIES,
+  normalizeShellKind,
+  normalizeExecutionPolicy,
+  loadShellConfig,
+  buildPowershellArgv,
+  resolveShellInvocation,
+  _clearShellConfigCache,
+};

package/src/lib/skill-loader.js

@@ -68,6 +68,19 @@ export function bundledSkillsDisabled(opts = {}) {
   }
 }
 
+/**
+ * Whether ALL skill layers are disabled — `cc agent --bare` sets CC_SKILLS=0
+ * (safe-mode "feature=0 disables" convention). Single gate: `loadAll` is the
+ * one place every layer funnels through, so this empties list_skills /
+ * run_skill / persona auto-activation in one check.
+ * @param {{ env?: object }} [opts]
+ * @returns {boolean}
+ */
+export function allSkillsDisabled(opts = {}) {
+  const raw = (opts.env || process.env).CC_SKILLS;
+  return raw != null && /^(0|false|no|off)$/i.test(String(raw).trim());
+}
+
 /** Layer names in priority order (lowest → highest) */
 export const LAYER_NAMES = [
   "bundled",
@@ -475,6 +488,12 @@ export class CLISkillLoader {
    * @returns {object[]} Resolved skill list
    */
   loadAll(options = {}) {
+    // `cc agent --bare` (CC_SKILLS=0): no skill layer loads at all — cache the
+    // empty result so getResolvedSkills stays cheap on every call.
+    if (allSkillsDisabled(options)) {
+      this._cache = [];
+      return this._cache;
+    }
     const layers = this.getLayerPaths();
     const skillMap = new Map();
     // Claude-Code `disableBundledSkills`: hide the built-in layer so only

package/src/lib/slash-dispatch.js

@@ -0,0 +1,34 @@
+/**
+ * `cc agent --disable-slash-commands` — REPL slash-dispatch bypass predicate.
+ *
+ * When active, a "/"-leading line is NOT dispatched to the built-in slash
+ * handlers (nor custom .claude/commands macros nor MCP prompt expansion): it
+ * reaches the model verbatim, the same fall-through an unmatched slash line
+ * already takes. `/exit` and `/quit` stay live so the session remains
+ * closable from the keyboard.
+ *
+ * The REPL swaps the dispatched string for a sentinel no handler can match
+ * (leading NUL — nothing in the dispatch chain starts with a control char)
+ * and restores the user's real text for the model turn.
+ */
+
+/** The dispatch sentinel — starts with NUL so no handler branch matches. */
+export function slashBypassSentinel() {
+  return String.fromCharCode(0) + "slash-bypassed";
+}
+
+/**
+ * Should this line bypass slash dispatch?
+ * @param {string} line     the trimmed input line
+ * @param {boolean} disabled  whether --disable-slash-commands is active
+ * @returns {boolean}
+ */
+export function slashDispatchBypassed(line, disabled) {
+  return (
+    disabled === true &&
+    typeof line === "string" &&
+    line.startsWith("/") &&
+    line !== "/exit" &&
+    line !== "/quit"
+  );
+}

package/src/lib/web-ui-server.js

@@ -19,6 +19,7 @@
 import http from "http";
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { fileURLToPath } from "url";
 import { getInlineSource as getEnvelopeInlineSource } from "./web-ui-envelope.js";
 import { CLISkillLoader } from "./skill-loader.js";
@@ -1224,28 +1225,140 @@ function findWebPanelDist(staticDir) {
   return null;
 }
 
+/** Constant-time token check (same construction as ws-server's): hash both
+ *  sides to a fixed length so length differences don't leak, then compare in
+ *  constant time. `null`/absent configured token → no auth required. */
+function downloadTokenOk(configuredToken, req) {
+  if (!configuredToken) return true;
+  let supplied = "";
+  const auth = String(req.headers?.authorization || "");
+  if (auth.toLowerCase().startsWith("bearer ")) {
+    supplied = auth.slice(7).trim();
+  } else {
+    try {
+      supplied =
+        new URL(req.url, "http://localhost").searchParams.get("token") || "";
+    } catch {
+      supplied = "";
+    }
+  }
+  const a = crypto.createHash("sha256").update(String(supplied)).digest();
+  const b = crypto
+    .createHash("sha256")
+    .update(String(configuredToken))
+    .digest();
+  return crypto.timingSafeEqual(a, b);
+}
+
+/** RFC 5987 filename* value for a Content-Disposition header. */
+function encodeDispositionFilename(name) {
+  const base = String(name || "artifact").replace(/[\r\n"]/g, "_");
+  return `attachment; filename*=UTF-8''${encodeURIComponent(base)}`;
+}
+
 /**
  * Handle `/api/*` routes. Returns `true` if the request was handled (caller
  * must stop further processing) and `false` for everything else (caller
  * continues with the static/SPA handler).
  *
- * Currently exposes a single read-only endpoint:
+ * Endpoints:
  *
  *   GET /api/skills → 200 { schema: 1, skills: [{name, source, category,
  *                    description, version}] }
+ *   GET /api/artifacts/<id>/download → the artifact's stored copy as an
+ *                    attachment (full file — the WS artifact-content preview
+ *                    route is capped; this is the uncapped download path the
+ *                    web-panel's 下载 button uses). When the server was
+ *                    created with a wsToken, the same token must accompany
+ *                    the request (`Authorization: Bearer` or `?token=`).
  *
- * The smoke-runner's project-mode probe (packer/smoke-runner.js) hits this
- * to verify bundled skills were materialized and registered. The shape is
- * deliberately minimal — the Web UI's richer skill views use WS.
+ * The smoke-runner's project-mode probe (packer/smoke-runner.js) hits
+ * /api/skills to verify bundled skills were materialized and registered. The
+ * shapes are deliberately minimal — the Web UI's richer views use WS.
  *
  * @param {import("http").IncomingMessage} req
  * @param {import("http").ServerResponse}  res
+ * @param {{ wsToken?: string|null }} [ctx]  server context (auth for downloads)
  * @returns {boolean}  true if handled, false if the caller should continue
  */
-export function handleApiRequest(req, res) {
+export function handleApiRequest(req, res, ctx = {}) {
   const urlPath = req.url.split("?")[0];
   if (!urlPath.startsWith("/api/")) return false;
 
+  const artifactMatch = urlPath.match(
+    /^\/api\/artifacts\/([A-Za-z0-9_]+)\/download$/,
+  );
+  if (artifactMatch) {
+    if (req.method !== "GET") {
+      res.writeHead(405, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Method Not Allowed" }));
+      return true;
+    }
+    // The panel authenticates its WS with this token; the download endpoint
+    // serves artifact FILE CONTENT, so it must not be weaker than the WS.
+    if (!downloadTokenOk(ctx.wsToken || null, req)) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Unauthorized" }));
+      return true;
+    }
+    // Async body in a sync router: the route is claimed (return true) and the
+    // response completes when the store import resolves.
+    (async () => {
+      try {
+        const { ArtifactStore } = await import("./artifact-store.js");
+        const store = new ArtifactStore();
+        const entry = store.get(artifactMatch[1]);
+        if (!entry) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Not Found" }));
+          return;
+        }
+        // Same tamper guard as the WS content route: the stored filename must
+        // be a plain basename or the index row is refused.
+        if (
+          !entry.file ||
+          entry.file !== path.basename(entry.file) ||
+          entry.file.includes("..")
+        ) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Bad artifact index row" }));
+          return;
+        }
+        const storedPath = store.storedPath(entry);
+        let size;
+        try {
+          size = fs.statSync(storedPath).size;
+        } catch {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Stored copy missing" }));
+          return;
+        }
+        const downloadName =
+          entry.title && path.extname(entry.title)
+            ? entry.title
+            : path.basename(entry.sourcePath || entry.file);
+        res.writeHead(200, {
+          "Content-Type": entry.mime || "application/octet-stream",
+          "Content-Length": size,
+          "Content-Disposition": encodeDispositionFilename(downloadName),
+          "Cache-Control": "no-store",
+          "X-Content-Type-Options": "nosniff",
+        });
+        const stream = fs.createReadStream(storedPath);
+        stream.on("error", () => res.destroy());
+        stream.pipe(res);
+      } catch (err) {
+        try {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: err.message }));
+        } catch {
+          /* headers already sent — connection is torn down by the stream */
+        }
+      }
+    })();
+    return true;
+  }
+
   if (urlPath === "/api/skills") {
     if (req.method !== "GET") {
       res.writeHead(405, { "Content-Type": "application/json" });
@@ -1328,7 +1441,7 @@ export function createWebUIServer(opts) {
     return http.createServer((req, res) => {
       // /api/* routes are handled before the static file logic so GET /api/skills
       // doesn't accidentally resolve to index.html via the SPA fallback.
-      if (handleApiRequest(req, res)) return;
+      if (handleApiRequest(req, res, { wsToken: opts.wsToken || null })) return;
 
       if (req.method !== "GET") {
         res.writeHead(405, { "Content-Type": "text/plain" });
@@ -1415,7 +1528,7 @@ export function createWebUIServer(opts) {
   // ── Fallback: embedded classic single-page HTML ─────────────────────────
   const html = buildHtml(opts);
   return http.createServer((req, res) => {
-    if (handleApiRequest(req, res)) return;
+    if (handleApiRequest(req, res, { wsToken: opts.wsToken || null })) return;
 
     const urlPath = req.url.split("?")[0];
     if (