chainlesschain 0.162.159 → 0.162.160

package/src/lib/ide-context-redaction.js

@@ -0,0 +1,130 @@
+/**
+ * IDE-context redaction — the implicit-context counterpart of the credential
+ * READ guard ([[credential-guard.js]]).
+ *
+ * The IDE bridge shares editor state (selection text, open-editor tabs,
+ * terminal output, diagnostics) with every prompt WITHOUT any tool-permission
+ * gate: nothing was "read" through read_file, so denyRead rules and the
+ * credential guard never fire. An open `.env` tab or an `export API_KEY=…`
+ * still visible in the integrated terminal would ride straight into model
+ * context. This module closes that side door:
+ *
+ *   1. `filterIdeFileEntry` — file-path entries (open editors, selection file,
+ *      diagnostics files) that name a credential file are dropped, reusing the
+ *      exact same `credentialFileReason` patterns the read guard enforces. The
+ *      non-resolved variant is deliberate: these paths come from the IDE, may
+ *      not exist locally, and a pure string check never touches the fs.
+ *   2. `redactSecretsInText` — free text (selection, terminal output,
+ *      diagnostic messages) is scrubbed with a conservative set of secret
+ *      shapes: AWS access-key ids, Bearer tokens, PEM private-key blocks,
+ *      well-known token prefixes, and `SECRET_NAME = value` assignments (only
+ *      the VALUE is swallowed — key names and ordinary code survive).
+ *
+ * Precision over recall, same posture as the guards: a redactor that mangles
+ * everyday code teaches users to turn it off. `CC_IDE_CONTEXT_REDACTION=0`
+ * disables (default ON).
+ */
+
+import {
+  credentialFileReason,
+  _internals as credentialGuardInternals,
+} from "./credential-guard.js";
+
+const REDACTED = "[REDACTED]";
+const REDACTED_FILE = "[redacted credential file]";
+
+// Boundary-delimited secret words (KEY / TOKEN / SECRET / PASSWORD / …) —
+// shared with the credential guard so both surfaces agree on what "looks
+// secret".
+const SECRET_VAR_RE = credentialGuardInternals.SECRET_VAR_RE;
+
+// AWS access-key ids are globally unique, fixed-shape strings.
+const AWS_ACCESS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
+
+// `Bearer <token>` in headers / curl lines / pasted requests.
+const BEARER_RE = /\b(Bearer)\s+[A-Za-z0-9\-._~+/=]{8,}/g;
+
+// PEM private-key blocks — the bytes ARE the secret. A block whose END marker
+// was truncated off still redacts to the end of the text (fail toward safety).
+const PEM_PRIVATE_KEY_RE =
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g;
+
+// High-precision vendor token prefixes (OpenAI/Anthropic sk-, GitHub PATs,
+// GitLab PATs, Slack xox*) — unambiguous even outside an assignment.
+const TOKEN_PREFIX_RE =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g;
+
+// `API_KEY = "value"` / `token: value` / JSON `"secret": "value"` — the key
+// must contain a boundary-delimited secret word, the value must be a bare
+// token-like run (≥8 chars, no spaces). The trailing lookahead rejects values
+// that continue into a call — `token = getToken()` is code, not a secret.
+// Only the value is replaced; the key and separator are kept so the agent
+// still sees WHAT was configured, just not the secret itself.
+const ASSIGNMENT_RE =
+  /\b([A-Za-z_][A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9+/=_.\-]{8,})\3(?![A-Za-z0-9+/=_.\-(])/g;
+
+/**
+ * Env kill-switch: CC_IDE_CONTEXT_REDACTION=0|false|no|off disables all IDE
+ * context redaction. Default ON — only an explicit opt-out turns it off.
+ */
+export function ideRedactionEnabled(env = process.env) {
+  const raw = env && env.CC_IDE_CONTEXT_REDACTION;
+  return !(raw != null && /^(0|false|no|off)$/i.test(String(raw).trim()));
+}
+
+/**
+ * Gate one IDE-supplied file-path entry (open-editor tab, selection file,
+ * diagnostic file). Returns the path unchanged when it is fine to share, or
+ * null when it names a credential/secret file and the whole entry must be
+ * dropped (or replaced with the `REDACTED_FILE_PLACEHOLDER`).
+ *
+ * Pure string check by design (non-resolved `credentialFileReason`): IDE paths
+ * may be remote/virtual, and a context filter must never do fs I/O. `cwd` is
+ * accepted for signature parity with the resolved guards but unused here.
+ *
+ * @param {string} filePath
+ * @param {object} [opts] { cwd?, env? }
+ * @returns {string|null}
+ */
+export function filterIdeFileEntry(filePath, opts = {}) {
+  const p = String(filePath || "");
+  if (!p) return filePath ?? null;
+  if (!ideRedactionEnabled(opts.env || process.env)) return filePath;
+  return credentialFileReason(p) ? null : filePath;
+}
+
+/**
+ * Scrub secret-shaped substrings out of IDE-supplied free text (selection
+ * text, terminal output, diagnostic messages). Non-strings pass through
+ * untouched; with the kill-switch off the text is returned as-is.
+ *
+ * @param {string} text
+ * @param {object} [opts] { env? }
+ * @returns {string}
+ */
+export function redactSecretsInText(text, opts = {}) {
+  if (typeof text !== "string" || text.length === 0) return text;
+  if (!ideRedactionEnabled(opts.env || process.env)) return text;
+  let out = text;
+  out = out.replace(PEM_PRIVATE_KEY_RE, REDACTED);
+  out = out.replace(BEARER_RE, (_m, word) => `${word} ${REDACTED}`);
+  out = out.replace(AWS_ACCESS_KEY_RE, REDACTED);
+  out = out.replace(TOKEN_PREFIX_RE, REDACTED);
+  out = out.replace(ASSIGNMENT_RE, (m, key, sep, quote, _value) => {
+    // Hyphens count as segment boundaries too (api-key ≙ api_key).
+    if (!SECRET_VAR_RE.test(key.replace(/-/g, "_"))) return m;
+    return `${key}${sep}${quote}${REDACTED}${quote}`;
+  });
+  return out;
+}
+
+export const REDACTED_MARKER = REDACTED;
+export const REDACTED_FILE_PLACEHOLDER = REDACTED_FILE;
+
+export const _internals = {
+  AWS_ACCESS_KEY_RE,
+  BEARER_RE,
+  PEM_PRIVATE_KEY_RE,
+  TOKEN_PREFIX_RE,
+  ASSIGNMENT_RE,
+};

package/src/lib/ide-context.js

@@ -18,6 +18,10 @@
  */
 
 import { simpleDiff } from "./note-versioning.js";
+import {
+  filterIdeFileEntry,
+  redactSecretsInText,
+} from "./ide-context-redaction.js";
 
 /** Hard cap on the selected text we inline into the prompt. */
 const SELECTION_TEXT_CAP = 2000;
@@ -86,6 +90,61 @@ export function parseToolResultJson(result) {
   }
 }
 
+// ─── Redaction seams (see [[ide-context-redaction.js]]) ─────────────────────
+// IDE context bypasses the tool-permission layer entirely (nothing goes
+// through read_file), so credential files and secret-shaped text are filtered
+// HERE, at the collection boundary, before anything reaches the prompt.
+// CC_IDE_CONTEXT_REDACTION=0 disables (the filters below become pass-through).
+
+/** Drop the selection when it lives in a credential file; scrub its text. */
+function sanitizeIdeSelection(sel, env) {
+  if (!sel) return sel;
+  if (sel.file && filterIdeFileEntry(sel.file, { env }) === null) return null;
+  if (typeof sel.text === "string" && sel.text.length > 0) {
+    const scrubbed = redactSecretsInText(sel.text, { env });
+    if (scrubbed !== sel.text) return { ...sel, text: scrubbed };
+  }
+  return sel;
+}
+
+/** Drop open-editor entries whose file is a credential file. */
+function sanitizeIdeEditors(editors, env) {
+  if (!Array.isArray(editors)) return editors;
+  return editors.filter(
+    (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
+  );
+}
+
+/** Scrub secret-shaped text out of terminal commands and their output. */
+function sanitizeIdeTerminals(terms, env) {
+  if (!Array.isArray(terms)) return terms;
+  return terms.map((t) => {
+    if (!t || typeof t !== "object") return t;
+    const out = { ...t };
+    if (typeof out.command === "string") {
+      out.command = redactSecretsInText(out.command, { env });
+    }
+    if (typeof out.output === "string") {
+      out.output = redactSecretsInText(out.output, { env });
+    }
+    return out;
+  });
+}
+
+/** Drop diagnostics for credential files; scrub their message text. */
+function sanitizeIdeDiagnostics(diags, env) {
+  if (!Array.isArray(diags)) return diags;
+  return diags
+    .filter(
+      (d) => !(d && d.file && filterIdeFileEntry(d.file, { env }) === null),
+    )
+    .map((d) =>
+      d && typeof d.message === "string"
+        ? { ...d, message: redactSecretsInText(d.message, { env }) }
+        : d,
+    );
+}
+
 /** Resolve to the promise's value, or null after `ms` / on rejection. */
 function withTimeout(promise, ms) {
   return new Promise((resolve) => {
@@ -137,18 +196,22 @@ export async function collectIdeContext(mcp, opts = {}) {
       ? call("mcp__ide__getTerminalOutput", { limit: TERMINAL_LIMIT })
       : Promise.resolve(null),
   ]);
-  const openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
-  const terminals = Array.isArray(terminalData?.terminals)
+  const env = opts.env || process.env;
+  const sel = sanitizeIdeSelection(selection || null, env);
+  let openEditors = Array.isArray(editors?.editors) ? editors.editors : null;
+  if (openEditors) openEditors = sanitizeIdeEditors(openEditors, env);
+  let terminals = Array.isArray(terminalData?.terminals)
     ? terminalData.terminals
     : null;
+  if (terminals) terminals = sanitizeIdeTerminals(terminals, env);
   if (
-    !selection &&
+    !sel &&
     !(openEditors && openEditors.length > 0) &&
     !(terminals && terminals.length > 0)
   ) {
     return null;
   }
-  return { selection: selection || null, openEditors, terminals };
+  return { selection: sel, openEditors, terminals };
 }
 
 /**
@@ -304,8 +367,11 @@ export async function collectIdeDiagnostics(mcp, filePath, opts = {}) {
   );
   const all = Array.isArray(data?.diagnostics) ? data.diagnostics : null;
   if (!all) return null;
-  const relevant = all.filter(
-    (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+  const relevant = sanitizeIdeDiagnostics(
+    all.filter(
+      (d) => d && DIAG_SEVERITIES.has(String(d.severity).toLowerCase()),
+    ),
+    env,
   );
   return relevant.length > 0 ? relevant : null;
 }
@@ -653,6 +719,7 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
   const mentions = findIdeMentions(src);
   if (mentions.length === 0) return out;
   const timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
+  const env = opts.env || process.env;
   const blocks = [];
   for (const kind of mentions) {
     try {
@@ -663,11 +730,9 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           );
           continue;
         }
-        const sel = await callIdeToolJson(
-          mcp,
-          "mcp__ide__getSelection",
-          {},
-          timeoutMs,
+        const sel = sanitizeIdeSelection(
+          await callIdeToolJson(mcp, "mcp__ide__getSelection", {}, timeoutMs),
+          env,
         );
         const b = formatSelectionMention(sel);
         if (b) {
@@ -689,7 +754,14 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           {},
           timeoutMs,
         );
-        const b = formatDiagnosticsMention(data);
+        const safe =
+          data && Array.isArray(data.diagnostics)
+            ? {
+                ...data,
+                diagnostics: sanitizeIdeDiagnostics(data.diagnostics, env),
+              }
+            : data;
+        const b = formatDiagnosticsMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("diagnostics");
@@ -709,7 +781,11 @@ export async function expandIdeMentions(text, mcp, opts = {}) {
           { limit: TERMINAL_MENTION_LIMIT },
           timeoutMs,
         );
-        const b = formatTerminalMention(data);
+        const safe =
+          data && Array.isArray(data.terminals)
+            ? { ...data, terminals: sanitizeIdeTerminals(data.terminals, env) }
+            : data;
+        const b = formatTerminalMention(safe);
         if (b) {
           blocks.push(b);
           out.expanded.push("terminal");

package/src/lib/jsonl-session-store.js

@@ -21,6 +21,8 @@ export {
   readEvents,
   rebuildMessages,
   listJsonlSessions,
+  renameSession,
+  pruneJsonlSessions,
   forkSession,
   sessionExists,
   getLastSessionId,

package/src/lib/llm-config-defaults.js

@@ -38,24 +38,40 @@ export async function reconcileConfigLlmProvider(cfgLlm = {}) {
   if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
     return { llm: cfgLlm, changed: false };
   }
-  const { inferProviderFromBaseUrl, modelForeignToProvider } = await import(
-    "./runnable-provider.js"
-  );
+  const { inferProviderFromBaseUrl, modelForeignToProvider } =
+    await import("./runnable-provider.js");
   const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
   if (!inferred || inferred === cfgLlm.provider) {
     return { llm: cfgLlm, changed: false };
   }
   const corrected = { ...cfgLlm, provider: inferred };
   if (modelForeignToProvider(inferred, cfgLlm.model)) {
-    const { selectModelForTask, TaskType } = await import(
-      "./task-model-selector.js"
-    );
+    const { selectModelForTask, TaskType } =
+      await import("./task-model-selector.js");
     const def = selectModelForTask(inferred, TaskType.CHAT);
     if (def) corrected.model = def;
   }
   return { llm: corrected, changed: true };
 }
 
+import { resolveApiKeyFromHelper } from "./api-key-helper.js";
+
+/**
+ * Key backfill order: config llm.apiKey (plaintext, legacy) first, then
+ * llm.apiKeyHelper (external command → OS credential store). The helper only
+ * runs when no key is otherwise present, so configured setups never pay a
+ * subprocess spawn.
+ */
+function backfillApiKey(options, cfgLlm) {
+  if (options.apiKey) return;
+  if (cfgLlm.apiKey) {
+    options.apiKey = cfgLlm.apiKey;
+  } else if (cfgLlm.apiKeyHelper) {
+    const key = resolveApiKeyFromHelper(cfgLlm.apiKeyHelper);
+    if (key) options.apiKey = key;
+  }
+}
+
 export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   // The IDE chat panel pins --provider/--model (read from config) but DROPS
   // --base-url/--api-key. With an explicit --provider the block below bails, so
@@ -71,7 +87,7 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.provider === cfgLlm.provider
   ) {
     if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
-    if (!options.apiKey && cfgLlm.apiKey) options.apiKey = cfgLlm.apiKey;
+    backfillApiKey(options, cfgLlm);
     if (!options.model && !opts.explicitModel && cfgLlm.model) {
       options.model = cfgLlm.model;
     }
@@ -85,6 +101,6 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.model = cfgLlm.model;
   }
   if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
-  if (!options.apiKey && cfgLlm.apiKey) options.apiKey = cfgLlm.apiKey;
+  backfillApiKey(options, cfgLlm);
   return options;
 }

package/src/lib/project-mcp-trust.js

@@ -0,0 +1,87 @@
+/**
+ * Project `.mcp.json` fingerprint trust (gap-analysis 2026-07-11 P1 "MCP 生命
+ * 周期" — 配置指纹变化后重新信任).
+ *
+ * `--project-mcp` opts a run into a checked-in `.mcp.json`, which can spawn
+ * arbitrary commands. That consent is for the file AS THE USER SAW IT — a
+ * later commit (or a compromised dependency's postinstall) editing the file
+ * must not ride the standing opt-in. So the first successful load records a
+ * sha256 fingerprint per absolute file path; a later load whose content no
+ * longer matches is REFUSED (fail-closed) until the user re-trusts via
+ * `CC_PROJECT_MCP_TRUST=1` (one-shot) or `cc mcp trust-project`.
+ *
+ * Store: ~/.chainlesschain/trusted-project-mcp.json  { [absPath]: {fingerprint, trustedAt} }
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { getHomeDir } from "./paths.js";
+
+export const _deps = { fs };
+
+function storePath(opts = {}) {
+  return (
+    opts.storePath ||
+    process.env.CC_PROJECT_MCP_TRUST_STORE ||
+    path.join(getHomeDir(), "trusted-project-mcp.json")
+  );
+}
+
+export function projectMcpFingerprint(content) {
+  return createHash("sha256").update(String(content), "utf-8").digest("hex");
+}
+
+function readStore(opts) {
+  try {
+    const raw = _deps.fs.readFileSync(storePath(opts), "utf-8");
+    const data = JSON.parse(raw);
+    return data && typeof data === "object" ? data : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Check a project .mcp.json against the trust store.
+ * @returns {{status:"first-use"|"trusted"|"changed", fingerprint:string}}
+ */
+export function checkProjectMcpTrust(file, content, opts = {}) {
+  const fingerprint = projectMcpFingerprint(content);
+  const record = readStore(opts)[path.resolve(file)];
+  if (!record || !record.fingerprint) {
+    return { status: "first-use", fingerprint };
+  }
+  return {
+    status: record.fingerprint === fingerprint ? "trusted" : "changed",
+    fingerprint,
+  };
+}
+
+/** Record (or re-record) the trusted fingerprint for a file. */
+export function recordProjectMcpTrust(file, content, opts = {}) {
+  const target = storePath(opts);
+  const store = readStore(opts);
+  store[path.resolve(file)] = {
+    fingerprint: projectMcpFingerprint(content),
+    trustedAt: new Date(
+      typeof opts.now === "number" ? opts.now : Date.now(),
+    ).toISOString(),
+  };
+  try {
+    _deps.fs.mkdirSync(path.dirname(target), { recursive: true });
+    _deps.fs.writeFileSync(target, JSON.stringify(store, null, 2), {
+      encoding: "utf-8",
+      mode: 0o600,
+    });
+    return true;
+  } catch {
+    return false; // best-effort — a failed record just re-prompts next run
+  }
+}
+
+/** Truthy CC_PROJECT_MCP_TRUST → the user explicitly re-trusts this run. */
+export function projectMcpRetrustRequested(env = process.env) {
+  const raw = String(env.CC_PROJECT_MCP_TRUST || "").toLowerCase();
+  return raw === "1" || raw === "true";
+}

package/src/lib/sensitive-file-guard.js

@@ -66,3 +66,54 @@ export function sensitiveFileReason(targetPath) {
   }
   return null;
 }
+
+/**
+ * Auto-exec CONFIG write guard — the CLI-side twin of the IDE extension's
+ * `classifyAutoExecTarget` (vscode-extension/src/auto-exec-guard.js, kept as
+ * an independent pure function: no cross-package import). These files are not
+ * shells or hooks, but writing them still plants code that RUNS without an
+ * explicit user action: VS Code tasks auto-run on folder open, launch configs
+ * fire on debug, `.mcp.json` spawns arbitrary server processes the agent then
+ * auto-loads, JetBrains run configurations execute on the next Run, and
+ * devcontainer postCreate/postStart commands run on container open. Same
+ * conservative name-based posture as `sensitiveFileReason`; an unknown path is
+ * simply not risky (null), never a false positive.
+ *
+ * @param {string} targetPath  path as the tool received it (rel or abs)
+ * @returns {string|null} human reason when auto-exec-risky, null otherwise
+ */
+export function autoExecConfigReason(targetPath) {
+  const p = String(targetPath || "");
+  if (!p) return null;
+  const norm = p.replace(/\\/g, "/").toLowerCase();
+  const base = norm.split("/").pop() || "";
+  if (!base) return null;
+  if (base === ".mcp.json" || base === "mcp.json") {
+    return `auto-exec config: MCP server config (${base}) — can spawn arbitrary server processes the agent auto-loads`;
+  }
+  if (/(^|\/)\.vscode\/tasks\.json$/.test(norm)) {
+    return "auto-exec config: VS Code tasks (.vscode/tasks.json) — tasks can auto-run on folder open";
+  }
+  if (/(^|\/)\.vscode\/launch\.json$/.test(norm)) {
+    return "auto-exec config: VS Code launch/debug config (.vscode/launch.json) — runs commands on the next debug session";
+  }
+  if (/(^|\/)\.vscode\/settings\.json$/.test(norm)) {
+    return "auto-exec config: VS Code workspace settings (.vscode/settings.json) — can rebind shells/tools the user then runs";
+  }
+  if (/(^|\/)\.idea\/runconfigurations\//.test(norm)) {
+    return `auto-exec config: JetBrains run configuration (${base}) — executes on the user's next Run action`;
+  }
+  if (/(^|\/)\.idea\/workspace\.xml$/.test(norm)) {
+    return "auto-exec config: JetBrains workspace.xml — can embed run/startup tasks";
+  }
+  if (
+    base === "devcontainer.json" ||
+    /(^|\/)\.devcontainer\/devcontainer\.json$/.test(norm)
+  ) {
+    return "auto-exec config: devcontainer.json — postCreate/postStart commands run on container open";
+  }
+  if (base.endsWith(".code-workspace")) {
+    return `auto-exec config: VS Code workspace file (${base}) — can carry auto-run tasks and settings`;
+  }
+  return null;
+}

package/src/lib/sub-agent-context.js

@@ -253,12 +253,16 @@ export class SubAgentContext {
     const artifacts = [];
     let lastContent = "";
 
-    // Build filtered tool list
-    const tools = this._getFilteredTools();
-
     // Merge LLM options — pass shared iteration budget if available
     const options = {
       ...this._llmOptions,
+      // Tool allowlist (fixed 2026-07-11): the filtered list used to be
+      // computed via _getFilteredTools() but never handed to agentLoop, so a
+      // sub-agent's `tools`/frontmatter allowlist was silently ignored at the
+      // LLM surface. agentLoop consumes NAMES via enabledToolNames.
+      ...(Array.isArray(this.allowedTools) && this.allowedTools.length > 0
+        ? { enabledToolNames: this.allowedTools }
+        : {}),
       contextEngine: this.contextEngine,
       cwd: this.cwd,
       // Nesting level: lets a nested spawn_sub_agent see — and cap — its depth.