chainlesschain 0.162.162 → 0.162.163

package/src/lib/hook-event-log.cjs

@@ -0,0 +1,193 @@
+"use strict";
+
+/**
+ * hook-event-log — a persistent, hash-chained, replay-safe log of the hook
+ * delivery envelopes produced by the unified event bus ([[hook-event-bus.cjs]]).
+ *
+ * The event bus already stamps every settings-hook delivery with a stable
+ * `event_id` (see [[settings-hook-events.cjs]] `withDeliveryId`), but until now
+ * the full envelope was discarded — so there was nothing to look up when a user
+ * wants `cc hook replay <event-id>`. This store persists each envelope to a
+ * tamper-evident JSONL log so the replay command has a real source.
+ *
+ * Design:
+ * - OPT-IN: recording only happens when `CC_HOOK_EVENT_LOG` is enabled, so the
+ *   default hook-firing path is byte-for-byte unchanged (no new IO per turn).
+ * - Hash chain: each line is `{envelope, prevHash, hash}` where
+ *   `hash = sha256(prevHash + stableStringify(envelope))`. Editing / deleting /
+ *   reordering any recorded line breaks the chain (mirrors the session
+ *   transcript integrity design), which `verifyHookEventChain` detects.
+ * - Size guard: the log rotates to `<file>.1` once it exceeds MAX_LOG_BYTES so
+ *   an always-on session can't grow it without bound.
+ * - Pure over injected IO (`_deps.fs` / `_deps.os`) so it is fully unit-testable
+ *   without touching the real home directory.
+ */
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const crypto = require("crypto");
+const { stableStringify } = require("./hook-event-bus.cjs");
+
+const _deps = { fs, os };
+
+/** Cap the always-on log at 5 MiB, then rotate to `<file>.1`. */
+const MAX_LOG_BYTES = 5 * 1024 * 1024;
+
+/** Default log location: `~/.chainlesschain/hook-events.jsonl`. */
+function hookEventLogPath(homedir) {
+  const home = homedir || _deps.os.homedir();
+  return path.join(home, ".chainlesschain", "hook-events.jsonl");
+}
+
+/** Recording is opt-in — `CC_HOOK_EVENT_LOG=1` (or `true`) turns it on. */
+function isHookEventLogEnabled(env = process.env) {
+  const v = String(env.CC_HOOK_EVENT_LOG || "").toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
+/** Hash one envelope against the previous chain hash (deterministic). */
+function computeChainHash(prevHash, envelope) {
+  return crypto
+    .createHash("sha256")
+    .update(`${prevHash || "genesis"}\n${stableStringify(envelope)}`, "utf-8")
+    .digest("hex");
+}
+
+/** The hash the NEXT record must chain from (last parseable line's `hash`). */
+function latestChainHash(text) {
+  const lines = String(text || "").split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (!lines[i].trim()) continue;
+    try {
+      const rec = JSON.parse(lines[i]);
+      return typeof rec?.hash === "string" ? rec.hash : null;
+    } catch {
+      // half-written tail line — chain from the previous intact record
+      continue;
+    }
+  }
+  return null;
+}
+
+/**
+ * Append a hook envelope to the chained log. Best-effort: never throws — a
+ * failure to record must not break the turn that fired the hook.
+ *
+ * @param {object} envelope   a full envelope from buildHookEnvelope
+ * @param {object} [opts]     { filePath, homedir }
+ * @returns {{ok:boolean, event_id?:string, hash?:string, reason?:string}}
+ */
+function appendHookEvent(envelope, { filePath, homedir } = {}) {
+  if (!envelope || typeof envelope !== "object" || !envelope.event_id) {
+    return { ok: false, reason: "invalid envelope (no event_id)" };
+  }
+  const f = _deps.fs;
+  const fp = filePath || hookEventLogPath(homedir);
+  try {
+    const dir = path.dirname(fp);
+    if (!f.existsSync(dir)) f.mkdirSync(dir, { recursive: true });
+    let prevHash = null;
+    if (f.existsSync(fp)) {
+      let rotated = false;
+      try {
+        if (f.statSync(fp).size > MAX_LOG_BYTES) {
+          f.renameSync(fp, `${fp}.1`);
+          rotated = true;
+        }
+      } catch {
+        /* stat/rename best-effort */
+      }
+      if (!rotated) prevHash = latestChainHash(f.readFileSync(fp, "utf-8"));
+    }
+    const hash = computeChainHash(prevHash, envelope);
+    const line = `${JSON.stringify({ envelope, prevHash, hash })}\n`;
+    f.appendFileSync(fp, line, "utf-8");
+    return { ok: true, event_id: envelope.event_id, hash };
+  } catch (e) {
+    return { ok: false, reason: e.message };
+  }
+}
+
+/** Read every recorded record (skips malformed / half-written lines). */
+function readHookEventRecords({ filePath, homedir } = {}) {
+  const f = _deps.fs;
+  const fp = filePath || hookEventLogPath(homedir);
+  if (!f.existsSync(fp)) return [];
+  const out = [];
+  for (const line of f.readFileSync(fp, "utf-8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+      /* skip malformed / partial line */
+    }
+  }
+  return out;
+}
+
+/**
+ * Look up the envelope for a delivery id. The LATEST matching record wins (an
+ * event_id can recur across processes; the most recent delivery is what a user
+ * replaying "the last one" means).
+ */
+function findHookEvent(eventId, { filePath, homedir } = {}) {
+  if (!eventId) return null;
+  const records = readHookEventRecords({ filePath, homedir });
+  for (let i = records.length - 1; i >= 0; i--) {
+    if (records[i]?.envelope?.event_id === eventId) return records[i].envelope;
+  }
+  return null;
+}
+
+/** The most recent `limit` envelopes (newest last), for `cc hook events-log`. */
+function listHookEvents({ limit = 20, filePath, homedir } = {}) {
+  const records = readHookEventRecords({ filePath, homedir });
+  const n = Math.max(0, Number(limit) || 0);
+  return records.slice(n ? -n : 0).map((r) => r.envelope);
+}
+
+/**
+ * Recompute the chain and report the first break, if any.
+ * @returns {{ok:boolean, length:number, brokenAt:number, reason?:string}}
+ */
+function verifyHookEventChain({ filePath, homedir } = {}) {
+  const records = readHookEventRecords({ filePath, homedir });
+  let prev = null;
+  for (let i = 0; i < records.length; i++) {
+    const { envelope, prevHash, hash } = records[i] || {};
+    if ((prevHash ?? null) !== prev) {
+      return {
+        ok: false,
+        length: records.length,
+        brokenAt: i,
+        reason: "prevHash does not match the previous record's hash",
+      };
+    }
+    const expect = computeChainHash(prev, envelope);
+    if (expect !== hash) {
+      return {
+        ok: false,
+        length: records.length,
+        brokenAt: i,
+        reason: "record hash does not match its envelope (tampered)",
+      };
+    }
+    prev = hash;
+  }
+  return { ok: true, length: records.length, brokenAt: -1 };
+}
+
+module.exports = {
+  MAX_LOG_BYTES,
+  hookEventLogPath,
+  isHookEventLogEnabled,
+  computeChainHash,
+  latestChainHash,
+  appendHookEvent,
+  readHookEventRecords,
+  findHookEvent,
+  listHookEvents,
+  verifyHookEventChain,
+  _deps,
+};

package/src/lib/interaction-adapter.js

@@ -14,6 +14,7 @@ import {
   LEGACY_TO_UNIFIED_TYPE,
 } from "../runtime/runtime-events.js";
 import { createAbortError } from "./abort-utils.js";
+import { verifyApprovalBinding } from "./agent-authority.js";
 import { createEnvelope } from "@chainlesschain/session-core";
 
 // Phase 5: parallel service-envelope emission. Map WS agent-handler event
@@ -167,12 +168,21 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         reject,
         timeoutId,
         kind: options.kind || null,
+        // Approval binding (authority §"权限来源"): when a permission gate raises
+        // this request WITH a binding (tool_call_id + args + policy digest), an
+        // *approve* answer must echo the SAME binding or it is a stale / mis-
+        // routed / argument-tampered verdict and is rejected in _resolvePending.
+        // null (the default for plain questions) → no binding check, unchanged.
+        binding: options.binding || null,
       });
 
       this._sendWs({
         ...message,
         sessionId: this.sessionId,
         requestId,
+        // Ride the binding out so the remote UI/bridge can echo it back on the
+        // answer (only present when the caller supplied one).
+        ...(options.binding ? { binding: options.binding } : {}),
       });
     });
   }
@@ -210,8 +220,8 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
    * Called by ws-server when a session-answer message arrives.
    * Resolves the corresponding pending promise.
    */
-  resolveAnswer(requestId, answer) {
-    this._resolvePending(requestId, answer, "question");
+  resolveAnswer(requestId, answer, binding = null) {
+    this._resolvePending(requestId, answer, "question", binding);
   }
 
   async requestHostTool(toolName, args = {}, extra = {}) {
@@ -321,7 +331,12 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     }
   }
 
-  _resolvePending(requestId, payload, expectedKind = null) {
+  _resolvePending(
+    requestId,
+    payload,
+    expectedKind = null,
+    incomingBinding = null,
+  ) {
     const pending = this._pending.get(requestId);
     if (!pending) {
       return;
@@ -337,11 +352,26 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
       return;
     }
 
+    // Approval-binding guard (authority §"权限来源"): if this request was raised
+    // with a binding AND the answer echoes a binding that does NOT match, the
+    // verdict is for a different / argument-tampered call — settle as a DENY
+    // (fail closed) instead of the approve it claims to be, mirroring the local
+    // headless approval gate. Backward-compatible: no request binding, or an
+    // answer with no echoed binding, resolves exactly as before.
+    let effective = payload;
+    if (
+      pending.binding &&
+      incomingBinding &&
+      !verifyApprovalBinding(pending.binding, incomingBinding)
+    ) {
+      effective = false;
+    }
+
     this._pending.delete(requestId);
     if (pending.timeoutId) {
       clearTimeout(pending.timeoutId);
     }
-    pending.resolve(payload);
+    pending.resolve(effective);
   }
 }
 

package/src/lib/json-schema-output.js

@@ -7,13 +7,17 @@
  * `deps.writeOut` capture seam — the runner itself is untouched: each attempt
  * runs with output captured, the validated JSON is the only thing printed.
  *
- * Validator subset (enough for tool/script contracts, not full draft-2020):
- * type (object/array/string/number/integer/boolean/null), properties,
- * required, items, enum, const, additionalProperties:false. Zero deps.
+ * Constrained validation delegates to the richer Draft-2020-12-subset validator
+ * in [[json-schema-validate.js]] (type, properties, required, items/prefixItems,
+ * enum/const, additionalProperties, min/max, pattern, format, allOf/anyOf/oneOf/
+ * not, if/then/else, local $ref) so retries get precise coded/pointered errors —
+ * the model is told exactly WHICH JSON Pointer failed and WHY. The legacy
+ * `validateAgainstSchema` (loose `$.a.b` strings) stays exported for callers.
  */
 
 import fsDefault from "fs";
 import {
+  validate,
   validateSchema,
   buildStructuredResultEvent,
   computeSchemaDigest,
@@ -96,6 +100,20 @@ export function validateAgainstSchema(value, schema, path = "$") {
   return errors;
 }
 
+/**
+ * Render the richer validator's coded/pointered error objects as human-readable
+ * `<JSON Pointer>: <message>` strings for the corrective retry prompt and the
+ * final failure report. The empty root pointer is shown as `(root)`.
+ *
+ * @param {Array<{instancePath?:string, message:string}>} errors
+ * @returns {string[]}
+ */
+export function formatSchemaErrors(errors) {
+  return (errors || []).map(
+    (e) => `${e.instancePath || "(root)"}: ${e.message}`,
+  );
+}
+
 /**
  * Return the first *balanced* JSON object/array substring in `text`, honoring
  * string literals so braces inside strings don't throw off the depth count.
@@ -203,18 +221,29 @@ export function loadSchemaFile(fs, schemaFile) {
       "No schema provided: pass --json-schema <file> or a schema object",
     );
   }
+  // Inline JSON support: a value that starts with `{` is treated as a literal
+  // schema object, never a path (a filesystem path can't start with `{`). This
+  // lets `--json-schema '{"type":"object",...}'` work without a temp file.
+  const trimmed = String(schemaFile).trim();
+  const isInline = trimmed.startsWith("{");
   let raw;
-  try {
-    raw = fs.readFileSync(schemaFile, "utf-8");
-  } catch (e) {
-    throw new Error(`Cannot read schema file "${schemaFile}": ${e.message}`);
+  if (isInline) {
+    raw = trimmed;
+  } else {
+    try {
+      raw = fs.readFileSync(schemaFile, "utf-8");
+    } catch (e) {
+      throw new Error(`Cannot read schema file "${schemaFile}": ${e.message}`);
+    }
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (e) {
     throw new Error(
-      `Invalid JSON in schema file "${schemaFile}": ${e.message}`,
+      isInline
+        ? `Invalid inline JSON schema: ${e.message}`
+        : `Invalid JSON in schema file "${schemaFile}": ${e.message}`,
     );
   }
   // Startup schema meta-validation (P2): reject a malformed schema up front
@@ -226,7 +255,9 @@ export function loadSchemaFile(fs, schemaFile) {
       .slice(0, 5)
       .map((e) => `  - ${e.schemaPath || "/"}: ${e.message}`)
       .join("\n");
-    throw new Error(`Invalid JSON Schema in "${schemaFile}":\n${detail}`);
+    throw new Error(
+      `Invalid JSON Schema in ${isInline ? "inline schema" : `"${schemaFile}"`}:\n${detail}`,
+    );
   }
   return parsed;
 }
@@ -275,12 +306,15 @@ export async function runJsonSchemaConstrained(cfg = {}) {
     lastRaw = raw;
     const parsed = extractJsonPayload(raw);
     if (parsed.ok) {
-      const errors = validateAgainstSchema(parsed.value, schema);
-      if (errors.length === 0) {
+      // Richer validator: enforces the full supported subset (format assertions,
+      // if/then/else, min/max, pattern, combinators, …) and yields coded/pointered
+      // errors so the retry prompt tells the model exactly which pointer failed.
+      const { valid, errors } = validate(parsed.value, schema);
+      if (valid) {
         writeOut(`${JSON.stringify(parsed.value, null, 2)}\n`);
         return 0;
       }
-      lastErrors = errors;
+      lastErrors = formatSchemaErrors(errors);
     } else {
       lastErrors = [parsed.error];
     }

package/src/lib/json-schema-validate.js

@@ -22,9 +22,11 @@
  * Supported keywords: type (+ integer), enum, const, properties, required,
  * additionalProperties (bool|schema), patternProperties-free, items,
  * prefixItems, minItems/maxItems, uniqueItems, minLength/maxLength, pattern,
- * minimum/maximum/exclusiveMinimum/exclusiveMaximum, multipleOf,
- * minProperties/maxProperties, allOf/anyOf/oneOf/not, and local `$ref`
- * (`#/$defs/…`, `#/definitions/…`, or any in-document JSON Pointer).
+ * format (date-time/date/time/email/uri/uuid/ipv4/ipv6/hostname — asserted;
+ * unknown formats pass through as annotations), minimum/maximum/
+ * exclusiveMinimum/exclusiveMaximum, multipleOf, minProperties/maxProperties,
+ * allOf/anyOf/oneOf/not, if/then/else, and local `$ref` (`#/$defs/…`,
+ * `#/definitions/…`, or any in-document JSON Pointer).
  */
 
 import crypto from "crypto";
@@ -41,6 +43,97 @@ const KNOWN_TYPES = new Set([
 
 const MAX_REF_DEPTH = 128; // guards recursive $ref against cyclic data
 
+// ─── format assertions ───────────────────────────────────────────────────────
+// Draft 2020-12 `format` is asserted here (the protocol-facing structured-output
+// contract wants it enforced, not merely annotated). A format not in this map is
+// treated as an annotation and always passes. All checkers are pure strings→bool.
+
+function isCalendarDate(y, m, d) {
+  if (m < 1 || m > 12 || d < 1) return false;
+  const leap = (y % 4 === 0 && y % 100 !== 0) || y % 400 === 0;
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return d <= days[m - 1];
+}
+
+function checkDate(v) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(v);
+  return !!m && isCalendarDate(+m[1], +m[2], +m[3]);
+}
+
+function checkTime(v) {
+  const m = /^(\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?$/.exec(v);
+  if (!m) return false;
+  const hh = +m[1];
+  const mm = +m[2];
+  const ss = +m[3];
+  return hh <= 23 && mm <= 59 && ss <= 60; // 60 allows a leap second
+}
+
+function checkDateTime(v) {
+  const m = /^(.+)[Tt](.+)$/.exec(v);
+  if (!m) return false;
+  // RFC 3339 date-time requires an offset/Z on the time part.
+  if (!/([Zz]|[+-]\d{2}:\d{2})$/.test(m[2])) return false;
+  return checkDate(m[1]) && checkTime(m[2]);
+}
+
+function checkOctet(s) {
+  if (!/^\d{1,3}$/.test(s)) return false;
+  if (s.length > 1 && s[0] === "0") return false; // no leading zeros
+  return +s <= 255;
+}
+
+function checkIpv4(v) {
+  const parts = v.split(".");
+  return parts.length === 4 && parts.every(checkOctet);
+}
+
+function checkIpv6(v) {
+  if (typeof v !== "string" || v.length === 0) return false;
+  // At most one "::" compression; split on it.
+  const halves = v.split("::");
+  if (halves.length > 2) return false;
+  const hextet = /^[0-9a-fA-F]{1,4}$/;
+  if (halves.length === 2) {
+    const left = halves[0] === "" ? [] : halves[0].split(":");
+    const right = halves[1] === "" ? [] : halves[1].split(":");
+    if (
+      !left.every((g) => hextet.test(g)) ||
+      !right.every((g) => hextet.test(g))
+    )
+      return false;
+    return left.length + right.length <= 7; // "::" stands for ≥1 zero group
+  }
+  const groups = v.split(":");
+  return groups.length === 8 && groups.every((g) => hextet.test(g));
+}
+
+function checkHostname(v) {
+  if (typeof v !== "string" || v.length === 0 || v.length > 253) return false;
+  const labels = v.replace(/\.$/, "").split(".");
+  return labels.every((l) =>
+    /^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(l),
+  );
+}
+
+const FORMAT_CHECKERS = {
+  "date-time": checkDateTime,
+  date: checkDate,
+  time: checkTime,
+  email: (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v),
+  uri: (v) => /^[A-Za-z][A-Za-z0-9+.-]*:\S*$/.test(v),
+  uuid: (v) =>
+    /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(
+      v,
+    ),
+  ipv4: checkIpv4,
+  ipv6: checkIpv6,
+  hostname: checkHostname,
+};
+
+/** Known format names (exported for meta-validation / callers). */
+export const KNOWN_FORMATS = new Set(Object.keys(FORMAT_CHECKERS));
+
 /** RFC 6901 JSON Pointer from a segment array ("" = document root). */
 export function jsonPointer(segments) {
   if (!segments || segments.length === 0) return "";
@@ -194,6 +287,32 @@ function _validate(value, schema, inst, sch, root, errors, depth) {
     _validateObject(value, schema, inst, sch, root, errors, depth);
 
   _validateCombinators(value, schema, inst, sch, root, errors, depth);
+  _validateConditional(value, schema, inst, sch, root, errors, depth);
+}
+
+/**
+ * if/then/else — Draft 2020-12 conditional application. `if` is a *test* whose
+ * own errors are never reported; if the value matches `if`, `then` applies,
+ * otherwise `else` applies. No `if` keyword ⇒ then/else are inert.
+ */
+function _validateConditional(value, schema, inst, sch, root, errors, depth) {
+  if (schema.if === undefined) return;
+  const matched = _branchValid(value, schema.if, root, depth);
+  if (matched) {
+    if (schema.then !== undefined) {
+      _validate(
+        value,
+        schema.then,
+        inst,
+        [...sch, "then"],
+        root,
+        errors,
+        depth,
+      );
+    }
+  } else if (schema.else !== undefined) {
+    _validate(value, schema.else, inst, [...sch, "else"], root, errors, depth);
+  }
 }
 
 function _validateString(value, schema, inst, sch, errors) {
@@ -232,6 +351,19 @@ function _validateString(value, schema, inst, sch, errors) {
       );
     }
   }
+  if (typeof schema.format === "string") {
+    const check = FORMAT_CHECKERS[schema.format];
+    // Unknown format = annotation only (always passes), per Draft 2020-12.
+    if (check && !check(value)) {
+      _err(
+        errors,
+        "format",
+        inst,
+        [...sch, "format"],
+        `string is not a valid ${schema.format}`,
+      );
+    }
+  }
 }
 
 function _validateNumber(value, schema, inst, sch, errors) {
@@ -650,6 +782,14 @@ function _metaValidate(schema, segs, errors, depth) {
   }
   if (schema.not !== undefined)
     _metaValidate(schema.not, [...segs, "not"], errors, depth + 1);
+  if (schema.format !== undefined && typeof schema.format !== "string") {
+    _metaErr(errors, "format", [...segs, "format"], "format must be a string");
+  }
+  for (const k of ["if", "then", "else"]) {
+    if (schema[k] !== undefined) {
+      _metaValidate(schema[k], [...segs, k], errors, depth + 1);
+    }
+  }
   for (const defsKey of ["$defs", "definitions"]) {
     if (schema[defsKey] !== undefined) {
       if (