chainlesschain 0.162.157 → 0.162.159

package/src/lib/cloud/cloud-client.js

@@ -0,0 +1,152 @@
+/**
+ * Self-hosted cloud handoff (gap-2026-07-11 P1#7) — the private-runner version
+ * of Claude Code's --cloud/--teleport. `cc cloud run "<task>"` bundles the
+ * current git branch, POSTs it to a configured private runner, and records the
+ * job locally; `cc cloud status/attach` poll and reflow the runner's result
+ * (plan / patch / PR / artifacts) back into the local workspace.
+ *
+ * No Anthropic cloud dependency: the runner is any HTTP endpoint speaking the
+ * small protocol below (a reference runner can be a box running `cc agent`).
+ *
+ *   POST   {base}/v1/jobs           {task, bundle(base64), branch, baseSha}     → {jobId}
+ *   GET    {base}/v1/jobs/{id}       → {status: queued|running|done|failed, summary?}
+ *   GET    {base}/v1/jobs/{id}/result → {patch?, plan?, pr?, artifacts?, log?}
+ *
+ * Auth: Bearer token (config cloud.token / CC_CLOUD_TOKEN). Transport (fetch)
+ * and the bundle builder are injected so this is unit-testable offline.
+ *
+ * Local job ledger: ~/.chainlesschain/cloud-jobs/<jobId>.json
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { getHomeDir } from "../paths.js";
+
+export const _deps = { fetch: (...a) => globalThis.fetch(...a) };
+
+export function cloudJobsDir() {
+  const dir = join(getHomeDir(), "cloud-jobs");
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function jobPath(jobId) {
+  if (!/^[\w.-]+$/.test(String(jobId || ""))) {
+    throw new Error(`invalid job id: ${jobId}`);
+  }
+  return join(cloudJobsDir(), `${jobId}.json`);
+}
+
+export function saveJob(job) {
+  writeFileSync(jobPath(job.jobId), JSON.stringify(job, null, 2), "utf-8");
+  return job;
+}
+
+export function readJob(jobId) {
+  try {
+    return JSON.parse(readFileSync(jobPath(jobId), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+
+export function listJobs() {
+  const dir = cloudJobsDir();
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((f) => f.endsWith(".json"))
+    .map((f) => {
+      try {
+        return JSON.parse(readFileSync(join(dir, f), "utf-8"));
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean)
+    .sort((a, b) => (b.submittedAt || 0) - (a.submittedAt || 0));
+}
+
+export class CloudClient {
+  /**
+   * @param {object} opts { baseUrl, token, deps? }
+   */
+  constructor(opts = {}) {
+    this.baseUrl = String(opts.baseUrl || "").replace(/\/+$/, "");
+    if (!this.baseUrl) {
+      throw new Error(
+        "no cloud runner configured — set cloud.baseUrl / CC_CLOUD_URL",
+      );
+    }
+    this.token = opts.token || null;
+    this.deps = { ..._deps, ...(opts.deps || {}) };
+  }
+
+  _headers(extra = {}) {
+    return {
+      "Content-Type": "application/json",
+      ...(this.token ? { Authorization: `Bearer ${this.token}` } : {}),
+      ...extra,
+    };
+  }
+
+  async _json(method, path, body) {
+    const res = await this.deps.fetch(`${this.baseUrl}${path}`, {
+      method,
+      headers: this._headers(),
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    });
+    if (!res.ok) {
+      throw new Error(`cloud runner ${method} ${path} → HTTP ${res.status}`);
+    }
+    return res.json();
+  }
+
+  /** Submit a job. `bundle` is a base64 git bundle of the branch. */
+  async submit({ task, bundle, branch, baseSha }) {
+    const data = await this._json("POST", "/v1/jobs", {
+      task,
+      bundle,
+      branch,
+      baseSha,
+    });
+    if (!data?.jobId) throw new Error("runner did not return a jobId");
+    return data;
+  }
+
+  async status(jobId) {
+    return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}`);
+  }
+
+  async result(jobId) {
+    return this._json("GET", `/v1/jobs/${encodeURIComponent(jobId)}/result`);
+  }
+}
+
+export const TERMINAL_CLOUD_STATUS = new Set(["done", "failed"]);
+
+/**
+ * Poll a job until terminal or the deadline. `onTick(status)` reports progress.
+ * `sleep`/`now` injected for tests.
+ */
+export async function pollUntilDone(client, jobId, opts = {}) {
+  const intervalMs = opts.intervalMs ?? 3000;
+  const timeoutMs = opts.timeoutMs ?? 30 * 60_000;
+  const sleep = opts.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = opts.now || (() => Date.now());
+  const deadline = now() + timeoutMs;
+  for (;;) {
+    const status = await client.status(jobId);
+    opts.onTick?.(status);
+    if (TERMINAL_CLOUD_STATUS.has(status.status)) return status;
+    if (now() >= deadline) {
+      return { status: "timeout", summary: "poll deadline reached" };
+    }
+    await sleep(intervalMs);
+  }
+}

package/src/lib/computer-use/authorization.js

@@ -0,0 +1,173 @@
+/**
+ * Computer-use authorization (gap-2026-07-11 P1#6) — the trust core shared by
+ * the computer-use MCP server. GUI control is the highest-privilege surface an
+ * agent can hold (it can click "OK" on anything), so it is:
+ *   - OFF unless explicitly enabled (`cc mcp computer-use` / --enable);
+ *   - capability-gated: each verb (screenshot/click/type/scroll/clipboard/
+ *     app-launch/window-list) can be individually withheld;
+ *   - per-app scoped: an allowlist confines control to named apps, and a
+ *     high-risk denylist (terminals, IDEs, file managers, system settings,
+ *     password managers) always requires confirmation even when allowed.
+ *
+ * Pure + dependency-free so it is exhaustively unit-tested; the server and the
+ * OS backend consume its verdicts.
+ */
+
+export const COMPUTER_USE_CAPABILITIES = [
+  "screenshot",
+  "window_list",
+  "app_launch",
+  "click",
+  "type",
+  "scroll",
+  "clipboard_read",
+  "clipboard_write",
+];
+
+// Read-only observation is lower risk than input injection; the tool-priority
+// guidance (MCP/API > shell > browser action > computer use) lives here so the
+// server can surface it and the model prefers cheaper, auditable paths.
+export const TOOL_PRIORITY = [
+  "mcp/api",
+  "shell",
+  "browser action",
+  "computer use",
+];
+
+// Apps where an unattended click/type is disproportionately dangerous — a
+// terminal runs commands, a password manager reveals secrets, system settings
+// change the machine. Matched case-insensitively as a substring of the app /
+// window identifier. Confirmation is forced even inside the allowlist.
+export const HIGH_RISK_APP_PATTERNS = [
+  "terminal",
+  "powershell",
+  "cmd.exe",
+  "conhost",
+  "windows terminal",
+  "iterm",
+  "code", // VS Code / VSCodium
+  "jetbrains",
+  "intellij",
+  "explorer.exe",
+  "finder",
+  "nautilus",
+  "settings",
+  "control panel",
+  "regedit",
+  "keychain",
+  "1password",
+  "bitwarden",
+  "lastpass",
+  "keepass",
+];
+
+/**
+ * @param {object} config computer-use config subtree
+ *   { enabled, capabilities?: string[], appAllowlist?: string[],
+ *     highRiskPatterns?: string[], confirmAll?: boolean }
+ */
+export function createAuthorizer(config = {}) {
+  const enabled = config.enabled === true;
+  const caps = new Set(
+    Array.isArray(config.capabilities) && config.capabilities.length > 0
+      ? config.capabilities
+      : COMPUTER_USE_CAPABILITIES,
+  );
+  const allowlist = Array.isArray(config.appAllowlist)
+    ? config.appAllowlist.map((a) => String(a).toLowerCase())
+    : null; // null = no app restriction (any app), [] = deny every app
+  const highRisk = (
+    Array.isArray(config.highRiskPatterns)
+      ? config.highRiskPatterns
+      : HIGH_RISK_APP_PATTERNS
+  ).map((p) => String(p).toLowerCase());
+  const confirmAll = config.confirmAll === true;
+
+  const INPUT_VERBS = new Set([
+    "click",
+    "type",
+    "scroll",
+    "app_launch",
+    "clipboard_write",
+  ]);
+
+  function isHighRiskApp(app) {
+    const a = String(app || "").toLowerCase();
+    if (!a) return false;
+    return highRisk.some((p) => a.includes(p));
+  }
+
+  /**
+   * @returns {{ allowed:boolean, requiresConfirmation:boolean, reason?:string }}
+   */
+  function authorize(capability, context = {}) {
+    if (!enabled) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason:
+          "computer-use is disabled — enable it explicitly (cc mcp computer-use --enable)",
+      };
+    }
+    if (!COMPUTER_USE_CAPABILITIES.includes(capability)) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason: `unknown capability: ${capability}`,
+      };
+    }
+    if (!caps.has(capability)) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason: `capability "${capability}" is not enabled for this session`,
+      };
+    }
+
+    const app = context.app || context.window || null;
+
+    // App allowlist applies to app-targeted verbs (input + launch). Pure
+    // observation (screenshot / window_list / clipboard_read) is not app-scoped.
+    if (allowlist && (INPUT_VERBS.has(capability) || app)) {
+      const target = String(app || context.target || "").toLowerCase();
+      if (!target) {
+        return {
+          allowed: false,
+          requiresConfirmation: false,
+          reason: `capability "${capability}" needs a target app while an allowlist is configured`,
+        };
+      }
+      const ok = allowlist.some(
+        (a) => target.includes(a) || a.includes(target),
+      );
+      if (!ok) {
+        return {
+          allowed: false,
+          requiresConfirmation: false,
+          reason: `app "${app || context.target}" is not in the computer-use allowlist`,
+        };
+      }
+    }
+
+    // High-risk apps and input verbs (or confirmAll) require confirmation.
+    const highRiskApp = isHighRiskApp(app);
+    const requiresConfirmation =
+      confirmAll || highRiskApp || INPUT_VERBS.has(capability);
+    return {
+      allowed: true,
+      requiresConfirmation,
+      reason: highRiskApp
+        ? `high-risk app (${app}) — confirmation required`
+        : requiresConfirmation
+          ? `${capability} injects input — confirmation required`
+          : undefined,
+    };
+  }
+
+  return {
+    enabled,
+    capabilities: [...caps],
+    authorize,
+    isHighRiskApp,
+  };
+}

package/src/lib/computer-use/computer-use-server.js

@@ -0,0 +1,276 @@
+/**
+ * Computer-use MCP server (gap-2026-07-11 P1#6) — exposes GUI control verbs to
+ * an MCP client, gated by the authorization core (authorization.js) and driven
+ * by an OS backend (control-backend.js). Streamable-HTTP MCP, same transport
+ * shape as `cc mcp serve`: POST JSON-RPC → application/json.
+ *
+ * Every tools/call runs through the authorizer first. A verb the authorizer
+ * marks `requiresConfirmation` is refused unless the caller supplied
+ * `confirm: true` in the tool args (the MCP client's approval surface / the
+ * agent's confirm flow owns the human check) — an unattended agent can never
+ * silently click a high-risk app.
+ */
+
+import http from "node:http";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import {
+  createAuthorizer,
+  COMPUTER_USE_CAPABILITIES,
+  TOOL_PRIORITY,
+} from "./authorization.js";
+import { createWindowsBackend } from "./control-backend.js";
+
+const rpcResult = (id, result) =>
+  JSON.stringify({ jsonrpc: "2.0", id, result });
+const rpcError = (id, code, message) =>
+  JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
+const ok = (data) => ({
+  content: [{ type: "text", text: JSON.stringify(data) }],
+});
+const fail = (msg) => ({
+  content: [{ type: "text", text: msg }],
+  isError: true,
+});
+
+function bearerMatches(authHeader, token) {
+  const m = /^Bearer\s+(.+)$/.exec(String(authHeader || ""));
+  if (!m) return false;
+  const a = Buffer.from(m[1]);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+const TOOL_SCHEMAS = {
+  computer_screenshot: {
+    description: "Capture the screen to a PNG (read-only observation).",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_window_list: {
+    description: "List visible windows (pid, app, title).",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_clipboard_read: {
+    description: "Read the system clipboard text.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_clipboard_write: {
+    description: "Write text to the system clipboard.",
+    inputSchema: {
+      type: "object",
+      properties: { text: { type: "string" } },
+      required: ["text"],
+    },
+  },
+  computer_click: {
+    description:
+      "Click at screen coordinates (input injection; requires confirm:true for high-risk apps).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        x: { type: "number" },
+        y: { type: "number" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["x", "y"],
+    },
+  },
+  computer_type: {
+    description: "Type text into the focused window (input injection).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        text: { type: "string" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["text"],
+    },
+  },
+  computer_scroll: {
+    description: "Scroll by N notches (positive up, negative down).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        amount: { type: "number" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["amount"],
+    },
+  },
+  computer_app_launch: {
+    description: "Launch an application by path/name.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        app: { type: "string" },
+        args: { type: "array", items: { type: "string" } },
+        confirm: { type: "boolean" },
+      },
+      required: ["app"],
+    },
+  },
+};
+
+const TOOL_CAPABILITY = {
+  computer_screenshot: "screenshot",
+  computer_window_list: "window_list",
+  computer_clipboard_read: "clipboard_read",
+  computer_clipboard_write: "clipboard_write",
+  computer_click: "click",
+  computer_type: "type",
+  computer_scroll: "scroll",
+  computer_app_launch: "app_launch",
+};
+
+/**
+ * Execute one tool call through authorize → confirm-gate → backend.
+ * Pure orchestration (no HTTP) so it is unit-tested directly.
+ */
+export function handleToolCall(name, args = {}, { authorizer, backend }) {
+  const capability = TOOL_CAPABILITY[name];
+  if (!capability) return fail(`unknown tool: ${name}`);
+
+  const context = { app: args.app || null, target: args.app || null };
+  const verdict = authorizer.authorize(capability, context);
+  if (!verdict.allowed) return fail(`[computer-use denied] ${verdict.reason}`);
+  if (verdict.requiresConfirmation && args.confirm !== true) {
+    return fail(
+      `[computer-use needs confirmation] ${verdict.reason || capability} — re-call with confirm:true after the user approves`,
+    );
+  }
+
+  let result;
+  switch (name) {
+    case "computer_screenshot":
+      result = backend.screenshot(
+        args.path ||
+          join(tmpdir(), `cc-screenshot-${randomBytes(4).toString("hex")}.png`),
+      );
+      break;
+    case "computer_window_list":
+      result = backend.windowList();
+      break;
+    case "computer_clipboard_read":
+      result = backend.clipboardRead();
+      break;
+    case "computer_clipboard_write":
+      result = backend.clipboardWrite(args.text);
+      break;
+    case "computer_click":
+      result = backend.click(args.x, args.y);
+      break;
+    case "computer_type":
+      result = backend.type(args.text);
+      break;
+    case "computer_scroll":
+      result = backend.scroll(args.amount);
+      break;
+    case "computer_app_launch":
+      result = backend.appLaunch(args.app, args.args || []);
+      break;
+    default:
+      return fail(`unhandled tool: ${name}`);
+  }
+  return result.ok ? ok(result) : fail(result.error || `${name} failed`);
+}
+
+export function availableTools(authorizer) {
+  return Object.entries(TOOL_SCHEMAS)
+    .filter(([name]) => authorizer.capabilities.includes(TOOL_CAPABILITY[name]))
+    .map(([name, t]) => ({
+      name,
+      description: t.description,
+      inputSchema: t.inputSchema,
+    }));
+}
+
+export function startComputerUseServer(opts = {}) {
+  const authorizer = createAuthorizer({
+    enabled: true, // starting the server IS the explicit opt-in
+    ...opts.config,
+  });
+  const backend = opts.backend || createWindowsBackend();
+  const token =
+    opts.token === false ? null : opts.token || randomBytes(16).toString("hex");
+
+  const server = http.createServer((req, res) => {
+    const send = (status, body) => {
+      res.writeHead(status, { "Content-Type": "application/json" });
+      res.end(body);
+    };
+    if (req.method !== "POST")
+      return send(405, rpcError(null, -32600, "POST only"));
+    if (token && !bearerMatches(req.headers.authorization, token)) {
+      return send(401, rpcError(null, -32001, "unauthorized"));
+    }
+    let raw = "";
+    let bytes = 0;
+    let aborted = false;
+    req.on("data", (c) => {
+      if (aborted) return;
+      bytes += c.length;
+      if (bytes > 1024 * 1024) {
+        aborted = true;
+        send(413, rpcError(null, -32600, "request too large"));
+        req.destroy();
+      } else raw += c;
+    });
+    req.on("end", () => {
+      if (aborted) return;
+      let msg;
+      try {
+        msg = JSON.parse(raw);
+      } catch {
+        return send(400, rpcError(null, -32700, "parse error"));
+      }
+      const { id, method, params } = msg || {};
+      if (method === "initialize") {
+        return send(
+          200,
+          rpcResult(id, {
+            protocolVersion: params?.protocolVersion || "2025-03-26",
+            capabilities: { tools: {} },
+            serverInfo: { name: "cc-computer-use", version: "1.0.0" },
+            instructions: `Tool priority (prefer the cheapest, most auditable): ${TOOL_PRIORITY.join(" > ")}. Input verbs need confirm:true.`,
+          }),
+        );
+      }
+      if (method === "notifications/initialized") {
+        res.writeHead(202);
+        return res.end();
+      }
+      if (method === "tools/list") {
+        return send(200, rpcResult(id, { tools: availableTools(authorizer) }));
+      }
+      if (method === "tools/call") {
+        const result = handleToolCall(params?.name, params?.arguments || {}, {
+          authorizer,
+          backend,
+        });
+        return send(200, rpcResult(id, result));
+      }
+      return send(200, rpcError(id, -32601, `unknown method: ${method}`));
+    });
+  });
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port || 0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve({
+        server,
+        port,
+        token,
+        url: `http://127.0.0.1:${port}`,
+        capabilities: authorizer.capabilities,
+        stop: () => new Promise((r) => server.close(() => r())),
+      });
+    });
+  });
+}
+
+export { COMPUTER_USE_CAPABILITIES };