chainlesschain 0.162.157 → 0.162.158

package/src/data/changelog.json

@@ -3,7 +3,7 @@
   "releases": [
     {
       "productVersion": "Unreleased",
-      "cliVersion": "0.162.157",
+      "cliVersion": "0.162.158",
       "cliVersions": [
         "0.4.46",
         "0.4.51",
@@ -15,11 +15,16 @@
         "0.162.154",
         "0.162.155",
         "0.162.156",
-        "0.162.157"
+        "0.162.157",
+        "0.162.158"
       ],
       "date": null,
       "title": "",
       "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.158：browser_state agent 工具 + REPL /remote-control + web-panel 直连配对/审批卡片 + 交付物预览下载（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.157 → **0.162.158** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + web-panel dist 随包；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。命令数不变（**173**）；AGENT_TOOLS **24 → 25**（新增 `browser_state`）。\n\n- **`browser_state` 一等 agent 工具（IDE gap P1 #8 收口）**：Chrome CDP 连接器（`cc browse chrome`）暴露为第 25 个 agent 工具——URL/标题/标签页 + 观察窗口 console/失败网络请求 + DOM 快照（agent 面 40k cap，CLI 命令面 150k）+ 可选截图（**生成的**临时路径，防 agent 自选路径经读工具覆盖任意文件）；LOW/READ/plan 模式可用，纯观察不点击不输入不导航，仅 loopback CDP。\n- **REPL `/remote-control`（别名 `/rc`）on|off|status（批 26）**：交互式会话内起自托管 WS + RemoteApprovalBridge 配对（URI + 可选二维码），TAB 补全 + /help；`cc agent --remote-control` 对交互式会话同样生效（启动失败降级 local-only 不中断会话）。**交互式远程审批赛跑语义**（新 `src/repl/remote-approval.js`）：两个交互 confirmer（ApprovalGate + settings/hook ask）把终端 prompt 与已配对设备赛跑，先答先赢；与 headless 刻意不同——远端超时/断开**不是决定**（静默的手机永不代键盘用户 auto-deny），设备先答则取消本地 readline 并压掉其搁浅的 idle-timeout。\n- **web-panel 直连（direct-LAN）配对 + `permission.request` 审批卡片（批 28）**：remoteSession store 自动识别双 URI 方案——relay E2EE 路径不变，新增 `chainlesschain://remote-control/pair#` 直连 transport（browser 版 parseDirectPairingUri + 客户端过期检查）；直连控制走 remote-session-publish **顶层 commandId+seq**（applyControlIdempotent direct-client 契约）；一次性 pairing token → 直连断开**刻意不自动重连**（重 join 必失败，诚实 disconnected 态 + 重配对提示）；两种 transport 喂同一 pendingApprovals 卡片（requestId 去重 + permission.resolved 任意裁决方清除 + 首等公民审批卡列表批准/拒绝）。\n- **交付物 Markdown 预览 + 浏览器下载（批 25）**：面板 text/markdown 预览走既有 MarkdownRenderer（marked+DOMPurify+hljs，零新依赖）；新 `GET /api/artifacts/<id>/download` 流式下载完整存档副本（WS 预览仍 cap）——Content-Disposition（RFC 5987）+ no-store/nosniff + 配置 wsToken 时同 WS 强度 token 门（sha256+timingSafeEqual，Bearer 头不进 URL）+ basename 防篡改守卫。\n- **安全修复 ×2**：① **直连配对信任边界**——直连（LAN）配对无密码学主机身份（区别 relay E2EE），钓鱼配对 URI 可把面板指向任意公网 ws:// 端点导走 serverToken/prompt/审批决定；两端 parser（web-panel + CLI 孪生）现拒绝指向非私网主机的明文 ws://（仅 loopback/RFC-1918/link-local/ULA，即 pickLanAddress 可能产出的全集；wss:// 不限），IPv6 括号 + IPv4-mapped 点分/hex 双形态识别，RED 反证过。② **chrome-connector launch-arg 加固**——launch URL 曾逐字进 Chrome argv（`--` 开头值被 Chrome 当开关解析=潜在命令执行面），现限 http(s)://、about:（URL parse 校验字节原样透传）+ CDP 端口处处整型边界校验。\n- **健壮性**：web-panel 审批卡发送失败恢复——approve() 乐观清除后若答复未离开本端（直连 publish 拒绝/socket 断/relay 未配对）恢复卡片并浮错，可重新裁决；失败窗口内别设备已 resolved 则抑制恢复（无僵尸卡）。RED 反证 + web-panel 全套 2512 绿。\n- **测试稳健性（仓库面，不进 npm 包）**：checkpoint-store `vi.setConfig 30s` + web-panel doctor 90s 两处负载敏感预算加固（trap #31 形态）；ai-doc-creator 集成测试改 chdir tmpDir，不再向仓库根泄漏 12 个产物文件。"
+        },
         {
           "heading": "Added — cc CLI 0.162.157：diff 审阅修订摘要 + plan 审阅快照 + Chrome 连接器 + Artifacts + Windows/PowerShell 一等 + --bare/无斜杠/读屏模式（CLI-only npm 发版）",
           "body": "> `chainlesschain` 0.162.156 → **0.162.157** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` + 依赖指针（`@chainlesschain/personal-data-hub` 0.4.50→**0.4.51**，交易短信→金额事件，已先行在 npm）；命令数 **172 → 173**（新增顶层 `cc artifacts`，13 文档面已扫）；无 Android cc bundle rollover / 无 USR_VERSION 改动。agent-sdk 0.1.1（plan review payload additive 类型）此前已在 npm。\n\n- **Artifacts v1：`publish_artifact` agent 工具 + `cc artifacts` 命令**：agent 完成的交付物（报告/图表/构建产物）发布到 `~/.chainlesschain/artifacts`（index.jsonl + 按 id 存文件，title/kind/mime/sha256/session/TTL 元数据，100MB 守卫）——**只有元数据进对话/transcript**，大产物不再撑爆上下文；`cc artifacts list|show|open|remove|clean`（别名 `artifact`）管理与打开；工具 LOW 风险、plan 模式禁用（AGENT_TOOLS 23→24）。\n- **Windows/PowerShell 一等公民（批 22）**：run_shell 新增可选 `shell` 参数（`default|cmd|powershell|pwsh`），选择链 per-call > settings `shell.windowsDefault`（win32-only 分层，`CC_WINDOWS_SHELL` env 胜出）> 平台默认（未配置路径字节不变）；PowerShell 经**显式 argv** 运行（`-NoProfile [-ExecutionPolicy <enum 校验>] -Command`，防 argv 走私）；权限规则新增 `PowerShell(...)` 伞形族与 `shell:pwsh` 参数域；settings hooks 每 hook 可声明 `shell: powershell|pwsh`。结果携带 `shell`/`shell_note`。\n\n- **IDE diff 审阅：agent 能看到你改了什么（gap #4 收口的 CLI 面）**：在 IDE diff 里编辑 proposed content 后 Accept，工具结果此前只带 `userEdited: true` 布尔——agent 不知道你具体改了什么，其对文件的心智模型仍是它自己的原提案。现在新增 `userAmendments`：新纯核 `summarizeUserAmendments`（`lib/ide-context.js`）产出提案→实际写入的 -/+ 行级摘要，按最终文件 1-based 行锚定分块（复用 note-versioning 的 simpleDiff LCS；纯插入/删除直排防幻影空行；1M cell 守卫降级粗块；行数/字符双 cap）。配合 JetBrains 0.4.55（可编辑右栏回读）/ VS Code 0.37.x（原生支持）形成端到端闭环。\n- **plan 审阅快照写入会话（IDE plan review 的 CLI 协议面）**：`{type:\"plan\", action:\"approve\"|\"reject\"}` 控制消息现可携带 `review` 载荷（IDE 端 Markdown 审阅文档的快照 + 元数据，24k cap），CLI 把它写进会话 transcript——计划批准/拒绝留档可审计可回放（headless-stream.js；agent-sdk 0.1.1 `PlanControlInput.review` 类型同步）。\n- **`--bare`（`CC_BARE`）裸模式**：`--safe-mode` 全开关之上再关 skills（`CC_SKILLS=0`）、plugins（`CC_PLUGINS=0`）与 MCP/IDE/PDH/JetBrains 自动连接——两个新 env 各在单一咽喉点生效（skill-loader `loadAll` / plugin-runtime `discoverPlugins`）；显式 `--mcp-config/--ide/--pdh/--jetbrains` 仍胜出；权限规则不放松。最小攻击面/最快启动的干净 agent 环境。\n- **`--disable-slash-commands`（`CC_DISABLE_SLASH_COMMANDS`）**：REPL 里 `/` 开头输入原样送模型（纯谓词 + NUL 哨兵，`lib/slash-dispatch`）；`/exit`、`/quit` 保留；TAB 补全不再提示斜杠命令；宏与 MCP prompt 展开一并旁路。粘贴含 `/` 行首文本不再误触发。\n- **`--ax-screen-reader`（`CC_SCREEN_READER`）读屏友好模式**：mono 主题（零 ANSI 色）+ 状态栏关闭（新 `lib/accessibility.js`）——读屏器不再逐字念转义序列与高频刷新的状态行。\n- **`cc browse chrome status|launch|state`**：与 `browse fetch/scrape`（每次冷启空白 headless 浏览器）不同，连接器经 CDP attach 到**用户自己的 Chrome**，页面状态带着登录会话。`launch` 启动可调试 Chrome（默认**专用配置目录** `~/.chainlesschain/chrome-profile`——登录一次持久复用；`--default-profile` 可选复用真实配置但要求所有 Chrome 窗口先关闭）；`status` 探测 CDP 端口；`state` attach 后观察窗口期内的 console 消息与失败/4xx-5xx 网络请求（CDP 无追溯历史，`--reload` 可捕获加载期输出），快照 URL/标题/DOM（默认 150k cap）/可选截图，断开不杀浏览器。安全注记：CDP 端口是本机无鉴权控制通道，仅绑 loopback，用完关闭该 Chrome。查找 Chrome/Edge 可执行文件跨三平台（`CHROME_PATH` 优先）。attach 后 page targets 有挂载延迟——轮询 3s 而非误报\"无标签页\"。6 单测（注入 deps）+ 真 Chrome 145 live e2e（discover→attach→console/network 捕获→DOM→截图→干净断开）。两 IDE 插件入口（VS `ChainlessChain: Chrome Connector` / JB Tools 同名）已随 VS Code 0.37.10 / JetBrains 0.4.53 上市场——本版补上其依赖的 CLI 端命令。"

package/src/lib/chrome-connector.js

@@ -33,6 +33,38 @@ import path from "path";
 import http from "http";
 
 export const DEFAULT_CDP_PORT = 9222;
+
+/** Coerce + bound-check a CDP port (goes into URLs and Chrome argv). */
+export function normalizeCdpPort(port) {
+  const n = Number(port ?? DEFAULT_CDP_PORT);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    throw new Error(`Invalid CDP port: ${port}`);
+  }
+  return n;
+}
+
+/**
+ * A launch URL must be a real web page. Anything else — and especially a
+ * value starting with `--`, which Chrome would parse as a SWITCH (e.g.
+ * --renderer-cmd-prefix=… is command execution) — is refused. Today `url`
+ * only comes from the local `cc browse chrome launch --url` flag, but this
+ * keeps the argv safe if it ever becomes agent- or remote-driven.
+ */
+export function normalizeLaunchUrl(url) {
+  if (url == null || url === "") return null;
+  let parsed;
+  try {
+    parsed = new URL(String(url));
+  } catch {
+    throw new Error(`Invalid launch URL: ${url}`);
+  }
+  if (!["http:", "https:", "about:"].includes(parsed.protocol)) {
+    throw new Error(
+      `Launch URL must be http(s):// or about: (got ${parsed.protocol})`,
+    );
+  }
+  return String(url); // validated — pass through byte-identical
+}
 export const DEFAULT_DOM_CAP = 150000;
 
 const _deps = {
@@ -65,7 +97,9 @@ export async function discoverCdp({
   port = DEFAULT_CDP_PORT,
   deps = _deps,
 } = {}) {
-  const res = await deps.httpGet(`http://127.0.0.1:${port}/json/version`);
+  const res = await deps.httpGet(
+    `http://127.0.0.1:${normalizeCdpPort(port)}/json/version`,
+  );
   if (res.status !== 200) return { ok: false, port };
   try {
     const info = JSON.parse(res.body);
@@ -150,7 +184,7 @@ export function buildChromeLaunchArgs({
   deps = _deps,
 } = {}) {
   const args = [
-    `--remote-debugging-port=${port}`,
+    `--remote-debugging-port=${normalizeCdpPort(port)}`,
     // No first-run wizards in the dedicated profile.
     "--no-first-run",
     "--no-default-browser-check",
@@ -158,7 +192,8 @@ export function buildChromeLaunchArgs({
   if (!defaultProfile) {
     args.push(`--user-data-dir=${profileDir || connectorProfileDir({ deps })}`);
   }
-  if (url) args.push(String(url));
+  const launchUrl = normalizeLaunchUrl(url);
+  if (launchUrl) args.push(launchUrl);
   return args;
 }
 
@@ -216,7 +251,7 @@ export async function captureState({
   let browser;
   try {
     browser = await playwright.chromium.connectOverCDP(
-      `http://127.0.0.1:${port}`,
+      `http://127.0.0.1:${normalizeCdpPort(port)}`,
     );
   } catch (err) {
     return {

package/src/lib/remote-control.js

@@ -24,6 +24,7 @@ import os from "os";
 import path from "path";
 import { randomBytes } from "crypto";
 import { REMOTE_SESSION_SCOPES } from "../harness/remote-session-registry.js";
+import { extractHost, isPrivateHost } from "./sandbox-network-policy.js";
 
 export const REMOTE_CONTROL_DEFAULT_PORT = 18800;
 export const REMOTE_CONTROL_PAIRING_SCHEME =
@@ -159,6 +160,39 @@ export function buildDirectPairingUri({
   return REMOTE_CONTROL_PAIRING_SCHEME + b64url(JSON.stringify(payload));
 }
 
+/**
+ * Direct pairing carries NO cryptographic host identity (unlike relay E2EE),
+ * so the endpoint itself is the trust boundary: plaintext `ws://` is only
+ * acceptable to loopback/RFC-1918/link-local hosts (the only thing
+ * `pickLanAddress()` ever emits); anything else must be `wss://`. Throws on
+ * violation — mirrored by the web-panel parser (remote-control-pairing.js).
+ */
+export function assertDirectWsUrlAllowed(wsUrl) {
+  let parsed;
+  try {
+    parsed = new URL(String(wsUrl));
+  } catch {
+    throw new Error(`Invalid direct pairing endpoint: ${wsUrl}`);
+  }
+  if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
+    throw new Error(
+      `Direct pairing endpoint must be ws:// or wss:// (got ${parsed.protocol})`,
+    );
+  }
+  // extractHost strips IPv6 brackets ("[::1]" → "::1") — isPrivateHost alone
+  // would miss bracketed literals (the documented new URL() gotcha).
+  if (
+    parsed.protocol === "ws:" &&
+    !isPrivateHost(extractHost(parsed.hostname))
+  ) {
+    throw new Error(
+      `Refusing plaintext ws:// to non-private host "${parsed.hostname}" — ` +
+        "direct pairing is LAN/loopback only; use wss:// for anything else",
+    );
+  }
+  return parsed;
+}
+
 /** Inverse of buildDirectPairingUri. Throws on malformed input. */
 export function parseDirectPairingUri(uri) {
   if (
@@ -175,6 +209,7 @@ export function parseDirectPairingUri(uri) {
       `Unsupported remote-control pairing payload (v=${payload.v}, transport=${payload.transport})`,
     );
   }
+  if (payload.wsUrl) assertDirectWsUrlAllowed(payload.wsUrl);
   return payload;
 }
 

package/src/lib/web-ui-server.js

@@ -19,6 +19,7 @@
 import http from "http";
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { fileURLToPath } from "url";
 import { getInlineSource as getEnvelopeInlineSource } from "./web-ui-envelope.js";
 import { CLISkillLoader } from "./skill-loader.js";
@@ -1224,28 +1225,140 @@ function findWebPanelDist(staticDir) {
   return null;
 }
 
+/** Constant-time token check (same construction as ws-server's): hash both
+ *  sides to a fixed length so length differences don't leak, then compare in
+ *  constant time. `null`/absent configured token → no auth required. */
+function downloadTokenOk(configuredToken, req) {
+  if (!configuredToken) return true;
+  let supplied = "";
+  const auth = String(req.headers?.authorization || "");
+  if (auth.toLowerCase().startsWith("bearer ")) {
+    supplied = auth.slice(7).trim();
+  } else {
+    try {
+      supplied =
+        new URL(req.url, "http://localhost").searchParams.get("token") || "";
+    } catch {
+      supplied = "";
+    }
+  }
+  const a = crypto.createHash("sha256").update(String(supplied)).digest();
+  const b = crypto
+    .createHash("sha256")
+    .update(String(configuredToken))
+    .digest();
+  return crypto.timingSafeEqual(a, b);
+}
+
+/** RFC 5987 filename* value for a Content-Disposition header. */
+function encodeDispositionFilename(name) {
+  const base = String(name || "artifact").replace(/[\r\n"]/g, "_");
+  return `attachment; filename*=UTF-8''${encodeURIComponent(base)}`;
+}
+
 /**
  * Handle `/api/*` routes. Returns `true` if the request was handled (caller
  * must stop further processing) and `false` for everything else (caller
  * continues with the static/SPA handler).
  *
- * Currently exposes a single read-only endpoint:
+ * Endpoints:
  *
  *   GET /api/skills → 200 { schema: 1, skills: [{name, source, category,
  *                    description, version}] }
+ *   GET /api/artifacts/<id>/download → the artifact's stored copy as an
+ *                    attachment (full file — the WS artifact-content preview
+ *                    route is capped; this is the uncapped download path the
+ *                    web-panel's 下载 button uses). When the server was
+ *                    created with a wsToken, the same token must accompany
+ *                    the request (`Authorization: Bearer` or `?token=`).
  *
- * The smoke-runner's project-mode probe (packer/smoke-runner.js) hits this
- * to verify bundled skills were materialized and registered. The shape is
- * deliberately minimal — the Web UI's richer skill views use WS.
+ * The smoke-runner's project-mode probe (packer/smoke-runner.js) hits
+ * /api/skills to verify bundled skills were materialized and registered. The
+ * shapes are deliberately minimal — the Web UI's richer views use WS.
  *
  * @param {import("http").IncomingMessage} req
  * @param {import("http").ServerResponse}  res
+ * @param {{ wsToken?: string|null }} [ctx]  server context (auth for downloads)
  * @returns {boolean}  true if handled, false if the caller should continue
  */
-export function handleApiRequest(req, res) {
+export function handleApiRequest(req, res, ctx = {}) {
   const urlPath = req.url.split("?")[0];
   if (!urlPath.startsWith("/api/")) return false;
 
+  const artifactMatch = urlPath.match(
+    /^\/api\/artifacts\/([A-Za-z0-9_]+)\/download$/,
+  );
+  if (artifactMatch) {
+    if (req.method !== "GET") {
+      res.writeHead(405, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Method Not Allowed" }));
+      return true;
+    }
+    // The panel authenticates its WS with this token; the download endpoint
+    // serves artifact FILE CONTENT, so it must not be weaker than the WS.
+    if (!downloadTokenOk(ctx.wsToken || null, req)) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Unauthorized" }));
+      return true;
+    }
+    // Async body in a sync router: the route is claimed (return true) and the
+    // response completes when the store import resolves.
+    (async () => {
+      try {
+        const { ArtifactStore } = await import("./artifact-store.js");
+        const store = new ArtifactStore();
+        const entry = store.get(artifactMatch[1]);
+        if (!entry) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Not Found" }));
+          return;
+        }
+        // Same tamper guard as the WS content route: the stored filename must
+        // be a plain basename or the index row is refused.
+        if (
+          !entry.file ||
+          entry.file !== path.basename(entry.file) ||
+          entry.file.includes("..")
+        ) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Bad artifact index row" }));
+          return;
+        }
+        const storedPath = store.storedPath(entry);
+        let size;
+        try {
+          size = fs.statSync(storedPath).size;
+        } catch {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Stored copy missing" }));
+          return;
+        }
+        const downloadName =
+          entry.title && path.extname(entry.title)
+            ? entry.title
+            : path.basename(entry.sourcePath || entry.file);
+        res.writeHead(200, {
+          "Content-Type": entry.mime || "application/octet-stream",
+          "Content-Length": size,
+          "Content-Disposition": encodeDispositionFilename(downloadName),
+          "Cache-Control": "no-store",
+          "X-Content-Type-Options": "nosniff",
+        });
+        const stream = fs.createReadStream(storedPath);
+        stream.on("error", () => res.destroy());
+        stream.pipe(res);
+      } catch (err) {
+        try {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: err.message }));
+        } catch {
+          /* headers already sent — connection is torn down by the stream */
+        }
+      }
+    })();
+    return true;
+  }
+
   if (urlPath === "/api/skills") {
     if (req.method !== "GET") {
       res.writeHead(405, { "Content-Type": "application/json" });
@@ -1328,7 +1441,7 @@ export function createWebUIServer(opts) {
     return http.createServer((req, res) => {
       // /api/* routes are handled before the static file logic so GET /api/skills
       // doesn't accidentally resolve to index.html via the SPA fallback.
-      if (handleApiRequest(req, res)) return;
+      if (handleApiRequest(req, res, { wsToken: opts.wsToken || null })) return;
 
       if (req.method !== "GET") {
         res.writeHead(405, { "Content-Type": "text/plain" });
@@ -1415,7 +1528,7 @@ export function createWebUIServer(opts) {
   // ── Fallback: embedded classic single-page HTML ─────────────────────────
   const html = buildHtml(opts);
   return http.createServer((req, res) => {
-    if (handleApiRequest(req, res)) return;
+    if (handleApiRequest(req, res, { wsToken: opts.wsToken || null })) return;
 
     const urlPath = req.url.split("?")[0];
     if (