chainlesschain 0.162.162 → 0.162.164

package/src/lib/diagnostic-bundle.js

@@ -0,0 +1,230 @@
+/**
+ * De-identified diagnostic bundle assembler + mandatory secret-scan export gate
+ * (IDE gap P1-9 "脱敏诊断包" of CLAUDE_CODE_IDE_INCREMENTAL_GAP_ANALYSIS_2026-
+ * 07-13.md).
+ *
+ * When an IDE session misbehaves, a one-click diagnostic export is the fastest
+ * path to a fix — but a naive dump of "everything about the session" leaks
+ * source, keys and terminal output. The gap doc pins the contract exactly: a
+ * bundle carries version, platform, capability, connection state, redaction
+ * events, trace, reconnect history, and process/port/lockfile/worktree
+ * summaries; it does NOT carry source code, API keys, cookies, full environment
+ * variables, or unpermitted terminal output; and "导出前必须运行 Secret Scan".
+ *
+ * This module assembles that bundle from caller-supplied signals and runs the
+ * §8.1 recall-first scanner ([[secret-scan.js]]) as a fail-closed export gate.
+ * It reuses the canonical capability projection ([[capability-manifest.js]]) so
+ * the bundle never invents a second capability truth.
+ *
+ * Pure: no fs / process / clock / RNG — the caller collects the raw signals
+ * (which processes, which ports, the env object) and this module shapes, de-
+ * identifies and gates them. Timestamps, if any, are passed in.
+ */
+
+import { redactSecrets, scanSecrets, SURFACES } from "./secret-scan.js";
+import { buildCompatFixture } from "./capability-manifest.js";
+import { isSecretEnvName } from "./credential-guard.js";
+
+/** The categories deliberately EXCLUDED from every bundle (never assembled). */
+export const EXCLUDED_BY_DEFAULT = Object.freeze([
+  "source code body",
+  "API keys / tokens",
+  "cookies",
+  "full environment variable values",
+  "unpermitted terminal output",
+]);
+
+/**
+ * Summarize an environment WITHOUT any values: variable NAMES only, with the
+ * secret-named ones flagged (via isSecretEnvName). Honors the contract "默认不
+ * 包含完整环境变量" — a name is metadata, a value may be a credential.
+ * @param {object} env
+ * @returns {{count:number, names:string[], secretNames:string[]}}
+ */
+export function summarizeEnv(env) {
+  if (!env || typeof env !== "object") {
+    return { count: 0, names: [], secretNames: [] };
+  }
+  const names = Object.keys(env).sort();
+  const secretNames = names.filter((n) => isSecretEnvName(n));
+  return { count: names.length, names, secretNames };
+}
+
+/** Recursively redact every string in a value (arrays/objects walked). */
+function deepRedact(value, depth = 0) {
+  if (depth > 64) return value;
+  if (typeof value === "string") return redactSecrets(value);
+  if (Array.isArray(value)) return value.map((v) => deepRedact(v, depth + 1));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const k of Object.keys(value))
+      out[k] = deepRedact(value[k], depth + 1);
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Recursively scan a value for any residual secret, returning findings with a
+ * dotted path so the gate can name WHERE a leak survived. Read-only.
+ * @returns {Array<{path:string, category:string}>}
+ */
+export function scanBundleForSecrets(value, path = "", depth = 0) {
+  if (depth > 64) return [];
+  const findings = [];
+  if (typeof value === "string") {
+    for (const f of scanSecrets(value)) {
+      findings.push({ path: path || "(root)", category: f.category });
+    }
+  } else if (Array.isArray(value)) {
+    value.forEach((v, i) =>
+      findings.push(...scanBundleForSecrets(v, `${path}[${i}]`, depth + 1)),
+    );
+  } else if (value && typeof value === "object") {
+    for (const k of Object.keys(value)) {
+      findings.push(
+        ...scanBundleForSecrets(value[k], path ? `${path}.${k}` : k, depth + 1),
+      );
+    }
+  }
+  return findings;
+}
+
+const asArray = (v) => (Array.isArray(v) ? v : []);
+const asString = (v) =>
+  typeof v === "string" ? v : v == null ? "" : String(v);
+
+/**
+ * Assemble the diagnostic bundle from caller-supplied signals, de-identifying
+ * as it goes. Free-text fields are secret-redacted; env is reduced to names;
+ * terminal output is included ONLY with explicit permission (and still
+ * redacted). Excluded categories are never assembled in the first place.
+ *
+ * @param {object} input
+ * @param {string} [input.version]
+ * @param {object|string} [input.platform]
+ * @param {object} [input.capability]        defaults to the canonical compat fixture
+ * @param {string} [input.connectionState]
+ * @param {Array}  [input.reconnectHistory]  [{at?, reason?}] — reasons redacted
+ * @param {object} [input.trace]             {traceId, spanCount} summary (no content)
+ * @param {Array}  [input.redactionEvents]   [{surface, category, count}] — what was scrubbed
+ * @param {Array}  [input.processes]         [{pid, name, cpu?}] metadata
+ * @param {Array<number|object>} [input.ports]
+ * @param {Array<string>} [input.lockfiles]
+ * @param {Array}  [input.worktrees]         [{path, branch}]
+ * @param {object} [input.env]               reduced to names only
+ * @param {string} [input.terminalOutput]    included only when opts.includeTerminalOutput
+ * @param {string} [input.notes]
+ * @param {object} [opts]
+ * @param {boolean} [opts.includeTerminalOutput=false]
+ * @returns {object} the assembled (already-redacted) bundle
+ */
+export function buildDiagnosticBundle(input = {}, opts = {}) {
+  const includeTerminal = opts.includeTerminalOutput === true;
+
+  const redactionEvents = asArray(input.redactionEvents)
+    .map((e) => ({
+      surface: SURFACES.includes(e?.surface) ? e.surface : "unknown",
+      category: asString(e?.category),
+      count: Number(e?.count) || 0,
+    }))
+    .filter((e) => e.category);
+
+  const bundle = {
+    schema: "cc-diagnostic-bundle/v1",
+    meta: {
+      version: asString(input.version) || null,
+      platform:
+        input.platform && typeof input.platform === "object"
+          ? input.platform
+          : asString(input.platform) || null,
+      excluded: [...EXCLUDED_BY_DEFAULT],
+    },
+    capability:
+      input.capability && typeof input.capability === "object"
+        ? input.capability
+        : buildCompatFixture(),
+    connection: {
+      state: asString(input.connectionState) || null,
+      reconnectHistory: asArray(input.reconnectHistory).map((r) => ({
+        at: r?.at ?? null,
+        reason: asString(r?.reason),
+      })),
+    },
+    trace: input.trace
+      ? {
+          traceId: asString(input.trace.traceId) || null,
+          spanCount: Number(input.trace.spanCount) || 0,
+        }
+      : null,
+    redactionEvents,
+    runtime: {
+      processes: asArray(input.processes).map((p) => ({
+        pid: p?.pid ?? null,
+        name: asString(p?.name),
+        cpu: p?.cpu ?? null,
+      })),
+      ports: asArray(input.ports).map((p) =>
+        typeof p === "object" && p
+          ? { port: Number(p.port) || null, proto: asString(p.proto) || null }
+          : { port: Number(p) || null, proto: null },
+      ),
+      lockfiles: asArray(input.lockfiles).map((f) => asString(f)),
+      worktrees: asArray(input.worktrees).map((w) => ({
+        path: asString(w?.path),
+        branch: asString(w?.branch) || null,
+      })),
+    },
+    // env is reduced to NAMES only up front (values never enter the bundle).
+    env: summarizeEnv(input.env),
+    notes: input.notes != null ? asString(input.notes) : null,
+  };
+
+  // Terminal output is unpermitted by default: dropped entirely, with a marker
+  // so the reader knows it was withheld (not merely absent).
+  if (includeTerminal && input.terminalOutput != null) {
+    bundle.terminalOutput = asString(input.terminalOutput);
+  } else {
+    bundle.terminalOutput = null;
+    bundle.terminalOutputWithheld = input.terminalOutput != null;
+  }
+
+  // Single de-identification pass over the WHOLE assembled bundle: every string
+  // field is secret-redacted regardless of which section it landed in, so the
+  // export gate is guaranteed clean no matter which signal carried a secret.
+  // env is already values-free, so its names (metadata) pass through untouched.
+  return deepRedact(bundle);
+}
+
+/**
+ * The mandatory pre-export gate ("导出前必须运行 Secret Scan"). Deep-scans the
+ * assembled bundle; fail-closed: if ANY residual secret survives, `ok` is false
+ * and `blocked` is true — the caller must NOT export it. On a clean bundle the
+ * gate returns it ready for export.
+ *
+ * @param {object} bundle  a buildDiagnosticBundle() result
+ * @returns {{ok:boolean, blocked:boolean, findings:Array, bundle:object}}
+ */
+export function secretScanGate(bundle) {
+  const findings = scanBundleForSecrets(bundle);
+  const ok = findings.length === 0;
+  return { ok, blocked: !ok, findings, bundle };
+}
+
+/**
+ * One-call assembly + gate. Builds the de-identified bundle and runs the secret
+ * scan. When the gate is clean, returns the exportable bundle; when it is not
+ * (should never happen given assembly redacts, but defense-in-depth), returns
+ * `ok:false` and the leak locations, and does NOT hand back an exportable body.
+ *
+ * @returns {{ok:boolean, bundle:(object|null), findings:Array}}
+ */
+export function exportDiagnosticBundle(input = {}, opts = {}) {
+  const bundle = buildDiagnosticBundle(input, opts);
+  const gate = secretScanGate(bundle);
+  return {
+    ok: gate.ok,
+    bundle: gate.ok ? bundle : null,
+    findings: gate.findings,
+  };
+}

package/src/lib/doctor-checkup.js

@@ -23,10 +23,18 @@ import {
   statSync,
   rmSync,
 } from "node:fs";
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import { join, basename } from "node:path";
 import { getHomeDir, getConfigPath } from "./paths.js";
-import { checkAgenda, checkInstructionFiles } from "./runtime-checkup.js";
+import {
+  checkAgenda,
+  checkInstructionFiles,
+  checkHookConfig,
+  checkHooks,
+  checkSandbox,
+  checkDuplicateSkills,
+  DEFAULT_CHECKUP_THRESHOLDS,
+} from "./runtime-checkup.js";
 
 export const CHECK_LEVELS = Object.freeze({
   OK: "ok",
@@ -45,6 +53,7 @@ export const _deps = {
   statSync,
   rmSync,
   execSync,
+  spawnSync,
   now: () => Date.now(),
 };
 
@@ -315,6 +324,58 @@ async function pluginSection(opts, _deps2) {
   } catch (err) {
     checks.push(failedCheck("plugins", "Installed plugins", err));
   }
+
+  // Broken manifests + un-consented capabilities (Phase 3 capability gap).
+  // Distinct from the signature-lock check above: re-discover to get each
+  // plugin's parsed manifest (listInstalled drops it) so we can flag an invalid
+  // manifest and any DECLARED capability set the user has not consented to.
+  try {
+    const { discoverPlugins } = await import("./plugin-runtime/scopes.js");
+    const { isPluginCapabilityConsented } =
+      await import("./plugin-runtime/capability-consent.js");
+    const { checkPluginsAndLsp } = await import("./runtime-checkup.js");
+    const discovered =
+      discoverPlugins({ cwd: opts.cwd || process.cwd(), skipPolicy: true }) ||
+      [];
+    // Broken manifests → warn (shared runtime-checkup evaluator).
+    for (const f of checkPluginsAndLsp(
+      discovered.map((p) => ({
+        id: p.name,
+        healthy: p.manifest?.ok !== false,
+        kind: "plugin",
+      })),
+    )) {
+      checks.push(
+        check(
+          f.id,
+          `plugin ${f.ref}`,
+          CHECK_LEVELS.WARN,
+          `${f.message} — ${f.remediation}`,
+        ),
+      );
+    }
+    // Declared capabilities not yet consented → warn.
+    for (const p of discovered) {
+      if (!p.manifest?.capabilitiesDeclared) continue;
+      const consented = isPluginCapabilityConsented(
+        { name: p.name, scope: p.scope, version: p.version },
+        p.manifest.capabilities,
+      );
+      if (!consented) {
+        checks.push(
+          check(
+            "plugin-capability-unconsented",
+            `plugin ${p.name}`,
+            CHECK_LEVELS.WARN,
+            `declares capabilities not yet consented — run \`cc plugin consent ${p.name}\``,
+          ),
+        );
+      }
+    }
+  } catch (err) {
+    checks.push(failedCheck("plugin-capabilities", "plugin capabilities", err));
+  }
+
   return { id: "plugins", title: "Plugin trust", checks };
 }
 
@@ -566,7 +627,7 @@ async function runtimeSection(opts, deps) {
       dueAt: e.kind === "wakeup" ? e.dueAt : e.nextAt,
       recurring: e.kind !== "wakeup",
     }));
-    for (const f of checkAgenda(entries, now)) {
+    for (const f of checkAgenda(entries, now, DEFAULT_CHECKUP_THRESHOLDS)) {
       checks.push(
         check(
           f.id,
@@ -595,7 +656,7 @@ async function runtimeSection(opts, deps) {
         }
       }
     }
-    for (const f of checkInstructionFiles(files)) {
+    for (const f of checkInstructionFiles(files, DEFAULT_CHECKUP_THRESHOLDS)) {
       checks.push(
         check(
           f.id,
@@ -609,12 +670,221 @@ async function runtimeSection(opts, deps) {
     checks.push(failedCheck("instructions", "instruction files", err));
   }
 
+  // settings.json hook config — statically catch hooks that will silently never
+  // fire (unknown event / bad regex matcher / missing command) or are
+  // misconfigured (bad timeout). Runtime hook health (slow/circuit-broken) needs
+  // live per-process stats and isn't computed here.
+  try {
+    const settingsHooks = await import("./settings-hooks.cjs");
+    const mod = settingsHooks.default || settingsHooks;
+    const cwd = opts.cwd || process.cwd();
+    const files = mod.settingsFiles(cwd);
+    const seen = new Set();
+    for (const file of files) {
+      if (seen.has(file) || !deps.existsSync(file)) continue;
+      seen.add(file);
+      let hooksBlock = null;
+      try {
+        const parsed = JSON.parse(deps.readFileSync(file, "utf-8"));
+        hooksBlock = parsed && typeof parsed === "object" ? parsed.hooks : null;
+      } catch {
+        continue; // malformed settings.json is reported elsewhere (config section)
+      }
+      if (!hooksBlock) continue;
+      for (const f of checkHookConfig(hooksBlock, {
+        validEvents: mod.HOOK_EVENTS,
+      })) {
+        checks.push(
+          check(
+            f.id,
+            `${basename(file)} ${f.ref}`,
+            SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+            `${f.message} — ${f.remediation}`,
+          ),
+        );
+      }
+    }
+  } catch (err) {
+    checks.push(failedCheck("hook-config", "settings hook config", err));
+  }
+
+  // Async-hook RUNTIME health — the reliability aggregate persisted by
+  // AsyncHookSupervisor.stopAll(): hooks that have been repeatedly failing,
+  // circuit-broken (N failures in a row), or slow on average. Complements the
+  // static config check above (which catches hooks that never fire at all).
+  try {
+    const store = await import("./hook-stats-store.cjs");
+    const mod = store.default || store;
+    const statsFs = {
+      existsSync: deps.existsSync,
+      readFileSync: deps.readFileSync,
+    };
+    const stats = mod.loadHookStats(mod.defaultHookStatsPath(), statsFs);
+    const hooks = mod.toCheckHooksInput(stats, {
+      circuitThreshold: DEFAULT_CHECKUP_THRESHOLDS.hookFailureThreshold,
+    });
+    for (const f of checkHooks(hooks, DEFAULT_CHECKUP_THRESHOLDS)) {
+      checks.push(
+        check(
+          f.id,
+          `hook ${f.ref}`,
+          SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+          `${f.message} — ${f.remediation}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("hook-health", "async hook stats", err));
+  }
+
+  // Sandbox real capability — catch the "silent degradation" case where a
+  // sandbox is configured in settings.json but its engine (docker/bwrap) isn't
+  // actually runnable, so tool subprocesses run UNSANDBOXED without warning.
+  try {
+    const settingsHooks = await import("./settings-hooks.cjs");
+    const shMod = settingsHooks.default || settingsHooks;
+    const sandboxMod = await import("./agent-sandbox.js");
+    const cwd = opts.cwd || process.cwd();
+    let sandboxSettings = null;
+    for (const file of shMod.settingsFiles(cwd)) {
+      if (!deps.existsSync(file)) continue;
+      try {
+        const parsed = JSON.parse(deps.readFileSync(file, "utf-8"));
+        if (parsed && parsed.sandbox && typeof parsed.sandbox === "object") {
+          sandboxSettings = { ...(sandboxSettings || {}), ...parsed.sandbox };
+        }
+      } catch {
+        // malformed settings.json is reported by the config section
+      }
+    }
+    if (sandboxSettings && sandboxSettings.enabled === true) {
+      const sandbox = sandboxMod.normalizeAgentSandbox(true, {
+        settings: sandboxSettings,
+        cwd,
+      });
+      if (sandbox) {
+        const probe = sandboxMod.probeSandboxAvailability(sandbox, {
+          spawnSync: deps.spawnSync,
+        });
+        for (const f of checkSandbox({
+          configured: true,
+          engine: sandbox.engine,
+          available: probe.available,
+          reason: probe.reason,
+          failIfUnavailable: sandbox.policy?.failIfUnavailable === true,
+          isolationLevel: sandboxMod.isolationLevel(sandbox),
+        })) {
+          checks.push(
+            check(
+              f.id,
+              `sandbox ${f.ref}`,
+              SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+              f.remediation ? `${f.message} — ${f.remediation}` : f.message,
+            ),
+          );
+        }
+      }
+    }
+  } catch (err) {
+    checks.push(failedCheck("sandbox", "sandbox availability", err));
+  }
+
+  // Duplicate skills — an id defined in more than one layer silently shadows
+  // (loadAll keeps only the winner), so a user's custom skill can override, or
+  // be overridden by, another without any signal. opts.skillLayerEntries lets a
+  // caller inject the (un-deduped) entry list; otherwise scan via the loader.
+  try {
+    let entries = opts.skillLayerEntries;
+    if (!entries) {
+      const { CLISkillLoader } = await import("./skill-loader.js");
+      entries = new CLISkillLoader().listSkillLayerEntries();
+    }
+    for (const f of checkDuplicateSkills(entries)) {
+      checks.push(
+        check(
+          f.id,
+          `skill ${f.ref}`,
+          SEVERITY_TO_LEVEL[f.severity] || CHECK_LEVELS.INFO,
+          `${f.message} — ${f.remediation}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("skill-duplicate", "skill layers", err));
+  }
+
   if (checks.length === 0) {
     checks.push(check("runtime-clean", "runtime hygiene", CHECK_LEVELS.OK, ""));
   }
   return { id: "runtime", title: "Runtime checkup", checks };
 }
 
+// ── execution context (P1-7) ───────────────────────────────────────────────
+// "任务在哪执行是 Session 一等属性": surface the DETECTED execution location and
+// the fail-closed permission posture it implies. Read-only advisory — it never
+// blocks. A local trusted machine is OK; a remote/unknown environment is a WARN
+// because a session there fails closed to read-only unless powers are granted
+// explicitly (and any policy violation from the pure model is listed).
+async function executionSection(opts, deps) {
+  const checks = [];
+  try {
+    const {
+      detectAmbientLocation,
+      validateExecutionContext,
+      EXECUTION_LOCATION,
+    } = await import("./execution-location.js");
+    // /.dockerenv is the classic in-container marker; keep it injectable via deps
+    // so the section is deterministic under test.
+    let dockerEnvFileExists = false;
+    try {
+      dockerEnvFileExists = deps.existsSync("/.dockerenv") === true;
+    } catch {
+      // non-POSIX host / unreadable — treat as not-a-container.
+    }
+    const location = detectAmbientLocation({
+      env: opts.env || process.env,
+      dockerEnvFileExists,
+    });
+    // Honest minimal input: just the detected location + the working dir. We do
+    // NOT fabricate a return path or granted powers — the validation then flags a
+    // real remote box with nowhere to return results, which is a meaningful hint.
+    const result = validateExecutionContext({
+      location,
+      source: { dir: opts.cwd || process.cwd() },
+    });
+    const isUnknown = location === EXECUTION_LOCATION.UNKNOWN;
+    const level =
+      isUnknown || result.descriptor.remote
+        ? CHECK_LEVELS.WARN
+        : CHECK_LEVELS.OK;
+    checks.push(
+      check(
+        "execution-location",
+        `Execution location: ${location}`,
+        level,
+        result.descriptor.remote
+          ? "remote/unknown — a session here fails closed to read-only unless powers are granted explicitly"
+          : isUnknown
+            ? "could not identify the environment — treated as untrusted (read-only floor)"
+            : "local trusted machine",
+      ),
+    );
+    if (result.violations.length > 0) {
+      checks.push(
+        check(
+          "execution-policy",
+          "Execution policy",
+          CHECK_LEVELS.WARN,
+          `fail-closed advisories: ${result.violations.join(", ")}`,
+        ),
+      );
+    }
+  } catch (err) {
+    checks.push(failedCheck("execution-location", "execution context", err));
+  }
+  return { id: "execution", title: "Execution context", checks };
+}
+
 /**
  * Collect all checkup sections. Never throws — a failing subsystem becomes an
  * `err` check inside its section.
@@ -633,6 +903,7 @@ export async function collectCheckupSections(opts = {}) {
     backgroundSection,
     worktreeSection,
     runtimeSection,
+    executionSection,
   ]) {
     try {
       sections.push(await build(opts, deps));