chainlesschain 0.162.165 → 0.162.167

package/src/lib/install-command-policy.js

@@ -0,0 +1,333 @@
+/**
+ * install-command-policy — a UNIFIED classifier + audit for package-install
+ * shell commands across managers (npm / pnpm / yarn / bun / pip / pipx / poetry /
+ * conda / brew / winget / choco / apt / dnf / yum / apk / snap / gem / cargo /
+ * go / composer / dotnet).
+ *
+ * The gap (docs/…INCREMENTAL_GAP_ANALYSIS P0 "跨平台沙箱"): "npm、pip、winget、brew
+ * 等安装入口需要统一权限类型与审计事件". Today a `run_shell` install command is just
+ * another shell command — there is no single place that recognizes "this fetches
+ * and runs third-party code" regardless of which tool does it, and no unified
+ * audit trail. This module supplies both, as PURE detection (no I/O) plus a
+ * best-effort injected-IO audit sink, so it can be reused by the shell approval
+ * path today and other entry points (run_code, hooks) later.
+ *
+ * Design: a per-manager table maps a binary to its install subcommand(s), a
+ * global-scope signal, and package extraction. `classifyInstallCommand` splits a
+ * compound command into segments (reusing the shell-policy splitter) so
+ * `npm i foo && pip install bar` reports BOTH installs. Nothing here changes a
+ * permission decision — callers decide whether to raise a risk floor; the
+ * classification is advisory + auditable.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import shellPolicy from "../runtime/coding-agent-shell-policy.cjs";
+
+const { splitCommandSegments, tokenizeShellCommand } = shellPolicy;
+
+// Leading tokens that wrap the real command and must be stripped before the
+// binary is read: privilege elevation, env-var assignments, and `env`/`command`.
+const WRAPPER_TOKENS = new Set([
+  "sudo",
+  "doas",
+  "env",
+  "command",
+  "exec",
+  "nice",
+]);
+
+/**
+ * Per-manager install detection. `sub` = subcommand keywords that mean "install".
+ * `system` = the install always affects the whole machine/user (no project
+ * scope), so it is treated as global regardless of flags. `globalFlags`/
+ * `globalWords` mark a per-tool global install. `packageWord` (dotnet) requires a
+ * keyword before the package name.
+ */
+const MANAGERS = [
+  {
+    name: "npm",
+    bin: /^npm$/,
+    sub: ["install", "i", "add", "ci"],
+    globalFlags: ["-g", "--global"],
+  },
+  {
+    name: "pnpm",
+    bin: /^pnpm$/,
+    sub: ["install", "i", "add"],
+    globalFlags: ["-g", "--global"],
+  },
+  {
+    name: "yarn",
+    bin: /^yarn$/,
+    sub: ["add", "install"],
+    globalWords: ["global"],
+  },
+  {
+    name: "bun",
+    bin: /^bun$/,
+    sub: ["install", "i", "add"],
+    globalFlags: ["-g", "--global"],
+  },
+  { name: "pip", bin: /^pip[0-9.]*$/, sub: ["install"], globalFlags: [] },
+  { name: "pipx", bin: /^pipx$/, sub: ["install"], system: true },
+  { name: "poetry", bin: /^poetry$/, sub: ["add"], globalFlags: [] },
+  { name: "conda", bin: /^conda$/, sub: ["install"], globalFlags: [] },
+  { name: "brew", bin: /^brew$/, sub: ["install"], system: true },
+  { name: "winget", bin: /^winget$/, sub: ["install"], system: true },
+  { name: "choco", bin: /^choco(latey)?$/, sub: ["install"], system: true },
+  { name: "apt", bin: /^apt(-get)?$/, sub: ["install"], system: true },
+  { name: "dnf", bin: /^(dnf|yum)$/, sub: ["install"], system: true },
+  { name: "apk", bin: /^apk$/, sub: ["add"], system: true },
+  { name: "snap", bin: /^snap$/, sub: ["install"], system: true },
+  { name: "gem", bin: /^gem$/, sub: ["install"], system: true },
+  { name: "cargo", bin: /^cargo$/, sub: ["install"], system: true },
+  { name: "go", bin: /^go$/, sub: ["install", "get"], system: true },
+  {
+    name: "composer",
+    bin: /^composer$/,
+    sub: ["require", "install"],
+    globalWords: ["global"],
+  },
+  {
+    name: "dotnet",
+    bin: /^dotnet$/,
+    sub: ["add"],
+    packageWord: "package",
+    system: false,
+  },
+];
+
+/** Basename of a binary path, minus a Windows .exe/.cmd/.bat/.ps1 suffix. */
+function normalizeBin(token) {
+  const base = String(token || "")
+    .replace(/\\/g, "/")
+    .split("/")
+    .pop();
+  return base.replace(/\.(exe|cmd|bat|ps1)$/i, "").toLowerCase();
+}
+
+/** Strip leading wrapper tokens (sudo/env/VAR=val) → the real argv, or null. */
+function unwrapArgv(tokens) {
+  let i = 0;
+  while (i < tokens.length) {
+    const t = tokens[i];
+    if (WRAPPER_TOKENS.has(t) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+      i += 1;
+      continue;
+    }
+    break;
+  }
+  return tokens.slice(i);
+}
+
+/**
+ * Classify ONE already-split command segment. Returns an install descriptor or
+ * null. Pure.
+ * @returns {{manager:string, subcommand:string, packages:string[], global:boolean}|null}
+ */
+export function classifyInstallSegment(segment) {
+  const argv = unwrapArgv(tokenizeShellCommand(segment));
+  if (argv.length === 0) return null;
+  const bin = normalizeBin(argv[0]);
+  const mgr = MANAGERS.find((m) => m.bin.test(bin));
+  if (!mgr) return null;
+
+  const rest = argv.slice(1);
+  // Find the install subcommand token (first non-flag token that matches). For
+  // dotnet, the trigger is `add … package`, so also require the package word.
+  let subIdx = -1;
+  let subcommand = null;
+  for (let i = 0; i < rest.length; i++) {
+    const tok = rest[i];
+    if (mgr.sub.includes(tok)) {
+      subIdx = i;
+      subcommand = tok;
+      break;
+    }
+  }
+  if (subIdx === -1) return null;
+  if (mgr.packageWord && !rest.slice(subIdx + 1).includes(mgr.packageWord)) {
+    return null; // e.g. `dotnet add reference` is not a package install
+  }
+
+  // Everything after the subcommand (and, for dotnet, after `package`) that is
+  // not a flag = the requested packages (best-effort; enough for audit).
+  let argsAfter = rest.slice(subIdx + 1);
+  if (mgr.packageWord) {
+    const pw = argsAfter.indexOf(mgr.packageWord);
+    argsAfter = pw >= 0 ? argsAfter.slice(pw + 1) : argsAfter;
+  }
+  const packages = argsAfter.filter((t) => !t.startsWith("-"));
+
+  const global =
+    mgr.system === true ||
+    (mgr.globalFlags || []).some((f) => rest.includes(f)) ||
+    (mgr.globalWords || []).some((w) => rest.includes(w));
+
+  return { manager: mgr.name, subcommand, packages, global };
+}
+
+/**
+ * Classify a full (possibly compound) shell command. Splits on `&&`/`||`/`;`/`|`
+ * so `npm i a && pip install b` reports BOTH. Returns `{ isInstall, installs }`.
+ * Pure.
+ */
+export function classifyInstallCommand(command) {
+  const segments = splitCommandSegments(String(command || ""));
+  const installs = [];
+  for (const seg of segments) {
+    const hit = classifyInstallSegment(seg);
+    if (hit) installs.push(hit);
+  }
+  return { isInstall: installs.length > 0, installs };
+}
+
+/** True if any classified install is global/system-scoped (higher blast radius). */
+export function hasGlobalInstall(classification) {
+  return !!(
+    classification &&
+    Array.isArray(classification.installs) &&
+    classification.installs.some((i) => i.global)
+  );
+}
+
+// ── remote-script execution ("curl … | sh") ────────────────────────────────
+// The most dangerous "fetch and run third-party code" vector isn't a package
+// manager at all — it's piping a download straight into a shell, or running a
+// shell over a command/process substitution that downloads. It runs UNPINNED,
+// UNVERIFIED, attacker-mutable code with the agent's privileges. These patterns
+// must be recognized on the RAW command (the pipe/substitution structure is lost
+// once split into segments), so they use anchored regexes rather than the
+// per-segment classifier.
+const REMOTE_FETCHERS = "curl|wget|fetch|iwr|invoke-webrequest|http|httpie";
+const SHELL_INTERPRETERS =
+  "sh|bash|zsh|ksh|dash|fish|python[0-9.]*|ruby|perl|node|deno|pwsh|powershell|eval|source";
+
+// `curl URL | sh`, `wget -O- URL | sudo bash`, `curl URL | tee f | sh`. After
+// the pipe, skip inline wrappers (`sudo `/`env `, space-separated) AND piped
+// pass-throughs (`tee f |`, `cat |`) before the interpreter.
+const PIPE_TO_SHELL_RE = new RegExp(
+  `\\b(${REMOTE_FETCHERS})\\b[^|]*\\|\\s*(?:(?:sudo|env|command|nice)\\s+|(?:tee|cat)\\b[^|]*\\|\\s*)*(${SHELL_INTERPRETERS})\\b`,
+  "i",
+);
+// `bash -c "$(curl URL)"`, `sh <(curl URL)`, `eval "$(wget -O- URL)"`
+const SUBST_TO_SHELL_RE = new RegExp(
+  `\\b(${SHELL_INTERPRETERS})\\b[^\\n]*[$<]\\(\\s*(?:sudo\\s+)?(${REMOTE_FETCHERS})\\b`,
+  "i",
+);
+
+function firstUrl(s) {
+  const m = String(s).match(/\bhttps?:\/\/[^\s'"|)>]+/i);
+  return m ? m[0] : null;
+}
+
+/**
+ * Detect remote-script execution in a raw shell command: a network fetcher piped
+ * into (or command/process-substituted into) a shell interpreter. Returns
+ * `{ isRemoteExec, matches:[{pattern, fetcher, interpreter, url}] }`. Pure.
+ */
+export function classifyRemoteExecCommand(command) {
+  const s = String(command || "");
+  const matches = [];
+  const pipe = PIPE_TO_SHELL_RE.exec(s);
+  if (pipe) {
+    matches.push({
+      pattern: "pipe-to-shell",
+      fetcher: pipe[1].toLowerCase(),
+      interpreter: pipe[2].toLowerCase(),
+      url: firstUrl(s),
+    });
+  }
+  const subst = SUBST_TO_SHELL_RE.exec(s);
+  if (subst) {
+    matches.push({
+      pattern: "cmdsubst-to-shell",
+      interpreter: subst[1].toLowerCase(),
+      fetcher: subst[2].toLowerCase(),
+      url: firstUrl(s),
+    });
+  }
+  return { isRemoteExec: matches.length > 0, matches };
+}
+
+/**
+ * Combined "untrusted code acquisition" classification: package installs AND
+ * remote-script execution. `flagged` is true if EITHER fires — the single signal
+ * a caller gates/audits on. Pure.
+ */
+export function classifyCodeAcquisition(command) {
+  const install = classifyInstallCommand(command);
+  const remote = classifyRemoteExecCommand(command);
+  return {
+    flagged: install.isInstall || remote.isRemoteExec,
+    isInstall: install.isInstall,
+    installs: install.installs,
+    isRemoteExec: remote.isRemoteExec,
+    remoteExec: remote.matches,
+  };
+}
+
+/**
+ * Resolve the install-command policy from env/settings (opt-in, so the default
+ * shell path is byte-unchanged). `audit` enables the audit trail; `riskFloor`
+ * ("low"|"medium"|"high") is the MINIMUM risk an install command is treated as
+ * (never lowers an already-higher risk).
+ */
+export function resolveInstallPolicy({
+  env = process.env,
+  settings = null,
+} = {}) {
+  const s = (settings && settings.installPolicy) || {};
+  const envAudit = env.CC_INSTALL_AUDIT;
+  const audit =
+    envAudit === "1" ? true : envAudit === "0" ? false : s.audit === true;
+  const riskFloor =
+    env.CC_INSTALL_RISK_FLOOR ||
+    (typeof s.riskFloor === "string" ? s.riskFloor : null) ||
+    null;
+  return {
+    audit,
+    riskFloor: riskFloor ? String(riskFloor).toLowerCase() : null,
+    enabled: audit || !!riskFloor,
+  };
+}
+
+const RISK_RANK = { low: 0, medium: 1, high: 2 };
+
+/**
+ * Apply a risk floor: return whichever of `currentRisk` / `floor` is HIGHER
+ * (never downgrades). Unknown values pass `currentRisk` through unchanged.
+ */
+export function applyRiskFloor(currentRisk, floor) {
+  if (!floor || !(floor in RISK_RANK)) return currentRisk;
+  const cur = RISK_RANK[currentRisk];
+  if (cur == null) return currentRisk;
+  return RISK_RANK[floor] > cur ? floor : currentRisk;
+}
+
+/** Best-effort append of one install-command audit record. Never throws. */
+export function recordInstallCommandAudit(entry, opts = {}) {
+  try {
+    const baseDir =
+      opts.baseDir ||
+      (opts.env || process.env).CC_AUDIT_DIR ||
+      path.join(os.homedir(), ".chainlesschain", "audit");
+    const _fs = opts.fs || fs;
+    _fs.mkdirSync(baseDir, { recursive: true });
+    const line = JSON.stringify({
+      ts: new Date(opts.now ? opts.now() : Date.now()).toISOString(),
+      kind: "install-command",
+      ...entry,
+    });
+    _fs.appendFileSync(
+      path.join(baseDir, "install-commands.jsonl"),
+      line + "\n",
+      "utf-8",
+    );
+    return true;
+  } catch {
+    return false; // audit is best-effort — never affect the run
+  }
+}

package/src/lib/jsonl-session-store.js

@@ -21,6 +21,7 @@ export {
   readEvents,
   rebuildMessages,
   listJsonlSessions,
+  listSessionIds,
   renameSession,
   pruneJsonlSessions,
   forkSession,

package/src/lib/lsp/__tests__/lsp-server-registry.test.js

@@ -11,6 +11,7 @@ import {
   resolveServer,
   resolveBin,
   probeServers,
+  describeServer,
   registerLanguageServer,
   _resetPluginServers,
   _deps,
@@ -126,3 +127,29 @@ describe("probeServers", () => {
     expect(ids).toContain("typescript-language-server");
   });
 });
+
+describe("describeServer", () => {
+  it("names the builtin server for a language even when not installed", () => {
+    existsFor([]); // nothing on PATH
+    const ts = describeServer("typescript");
+    expect(ts.id).toBe("typescript-language-server");
+    expect(ts.bins).toContain("typescript-language-server");
+    // Independent of install state — it describes the EXPECTED server.
+    expect(describeServer("python").id).toBe("pyright");
+    expect(describeServer("go").id).toBe("gopls");
+  });
+
+  it("returns null for an unsupported language", () => {
+    expect(describeServer("cobol")).toBe(null);
+    expect(describeServer(undefined)).toBe(null);
+  });
+
+  it("prefers a registered plugin server over the builtin", () => {
+    registerLanguageServer({
+      languageId: "typescript",
+      command: "my-ts-lsp",
+      id: "plugin-ts",
+    });
+    expect(describeServer("typescript").id).toBe("plugin-ts");
+  });
+});

package/src/lib/lsp/lsp-server-registry.js

@@ -232,3 +232,17 @@ export function probeServers(projectRoot) {
 export function supportedExtensions() {
   return Object.keys(EXTENSION_LANGUAGE).sort();
 }
+
+/**
+ * Describe the server that WOULD serve a languageId, whether or not its binary
+ * is installed — the first plugin candidate, else the builtin. Unlike
+ * `resolveServer` (which returns null when nothing is on PATH), this names the
+ * expected server so a doctor / status view can say *what to install*. Returns
+ * `{ id, bins }` or null for an unsupported language.
+ */
+export function describeServer(languageId) {
+  const candidates = [...(pluginServers.get(languageId) || [])];
+  if (BUILTIN_SERVERS[languageId]) candidates.push(BUILTIN_SERVERS[languageId]);
+  const def = candidates[0];
+  return def ? { id: def.id, bins: [...def.bins] } : null;
+}

package/src/lib/packer/smoke-runner.js

@@ -85,6 +85,15 @@ export async function smokeTestExe(ctx) {
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
     shell: needsShell,
+    // POSIX: own process group so teardown can signal the WHOLE tree via the
+    // negative pid. Critical when shell:true wraps the launch in `/bin/sh -c`
+    // (the `.sh` test shim, and any real exe that re-execs): a plain
+    // child.kill() then hits only the wrapper shell and orphans the real
+    // `node` server grandchild (ppid→1), which kept serving AND — via the
+    // stdio pipe fds it inherited from the worker — pinned the vitest forks
+    // pool past its terminate deadline ("Worker exited unexpectedly" flake).
+    // No-op on Windows, where killChild uses taskkill /T to walk the tree.
+    detached: process.platform !== "win32",
   });
 
   let stdoutBuf = "";
@@ -104,9 +113,26 @@ export async function smokeTestExe(ctx) {
         // is enough in practice, but /T protects us if that ever changes.
         spawn("taskkill", ["/F", "/T", "/PID", String(child.pid)], {
           stdio: "ignore",
-        });
+        }).unref();
+      } else if (child.pid) {
+        // Negative pid → the whole process group from the detached spawn above,
+        // so a shell:true wrapper's exec'd/forked `node` grandchild dies too
+        // (a plain child.kill would signal only the wrapper and orphan the
+        // server). SIGKILL, not SIGTERM: a smoke teardown has no reason to wait
+        // for a graceful close and not every packed/fake server installs a
+        // SIGTERM handler. Fall back to a direct kill if the group is already
+        // gone (ESRCH).
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+            /* already gone */
+          }
+        }
       } else {
-        child.kill("SIGTERM");
+        child.kill("SIGKILL");
       }
     } catch {
       /* best effort */
@@ -115,9 +141,10 @@ export async function smokeTestExe(ctx) {
 
   // Early-death watchdog: if the child exits before we see a listening
   // port, report the stdout/stderr so the user sees the real failure
-  // instead of a generic timeout.
+  // instead of a generic timeout. Named so cleanup() can detach it.
+  let onExit;
   const deathPromise = new Promise((_, reject) => {
-    child.on("exit", (code, signal) => {
+    onExit = (code, signal) => {
       reject(
         new PackError(
           `Smoke-test process exited (code=${code}, signal=${signal}) before ports came up.\n` +
@@ -126,16 +153,52 @@ export async function smokeTestExe(ctx) {
           EXIT.SMOKE,
         ),
       );
-    });
+    };
+    child.on("exit", onExit);
   });
 
+  // Full teardown: killing the child is not enough — the parent still holds
+  // the child's stdout/stderr PIPE handles and the ChildProcess object, all of
+  // which keep the event loop alive (killed-but-unreaped on Windows, or
+  // still-open pipes on POSIX). Left dangling across the ~8 smokeTestExe calls
+  // this test makes, they pinned the vitest forks-pool worker so it could not
+  // terminate → the "Worker exited unexpectedly" / "Timeout terminating forks
+  // worker" flake blamed on whatever file ran next on the reused worker. Detach
+  // the exit watcher, destroy the pipes, kill, and unref so nothing survives.
+  let cleaned = false;
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    try {
+      child.removeListener("exit", onExit);
+    } catch {
+      /* noop */
+    }
+    killChild();
+    try {
+      child.stdout?.destroy();
+    } catch {
+      /* noop */
+    }
+    try {
+      child.stderr?.destroy();
+    } catch {
+      /* noop */
+    }
+    try {
+      child.unref();
+    } catch {
+      /* noop */
+    }
+  };
+
   try {
     await Promise.race([
       waitForPorts({ uiPort, wsPort, timeoutMs: bootTimeoutMs }),
       deathPromise,
     ]);
   } catch (e) {
-    killChild();
+    cleanup();
     throw e;
   }
 
@@ -148,7 +211,7 @@ export async function smokeTestExe(ctx) {
       timeoutMs: probeTimeoutMs,
     });
   } catch (e) {
-    killChild();
+    cleanup();
     throw new PackError(
       `Smoke-test HTTP probe failed: ${e.message}`,
       EXIT.SMOKE,
@@ -156,7 +219,7 @@ export async function smokeTestExe(ctx) {
   }
 
   if (uiStatus < 200 || uiStatus >= 300) {
-    killChild();
+    cleanup();
     throw new PackError(
       `Smoke-test HTTP probe: http://127.0.0.1:${uiPort}/ returned ${uiStatus} (expected 2xx)`,
       EXIT.SMOKE,
@@ -191,7 +254,7 @@ export async function smokeTestExe(ctx) {
           `        skills check: /api/skills returned 404 — skipping (older pack predating Phase 2b)`,
         );
         skillsCheck = { ok: true, skipped: "endpoint-404" };
-        killChild();
+        cleanup();
         return {
           ok: true,
           uiStatus,
@@ -200,7 +263,7 @@ export async function smokeTestExe(ctx) {
           skillsCheck,
         };
       }
-      killChild();
+      cleanup();
       throw new PackError(
         `Smoke-test /api/skills probe failed: ${e.message}`,
         EXIT.SMOKE,
@@ -216,7 +279,7 @@ export async function smokeTestExe(ctx) {
     );
     const missing = bundledSkillNames.filter((n) => !registeredNames.has(n));
     if (missing.length > 0) {
-      killChild();
+      cleanup();
       throw new PackError(
         `Smoke-test skills check: bundled skill(s) not registered: ${missing.join(", ")}`,
         EXIT.SMOKE,
@@ -228,7 +291,7 @@ export async function smokeTestExe(ctx) {
     skillsCheck = { ok: true, checked: bundledSkillNames.length };
   }
 
-  killChild();
+  cleanup();
 
   return {
     ok: true,
@@ -280,12 +343,17 @@ function tryConnect(host, port, timeoutMs) {
 function probeHttp({ host, port, path: urlPath, timeoutMs }) {
   return new Promise((resolve, reject) => {
     const req = http.get(
-      { host, port, path: urlPath, timeout: timeoutMs },
+      // agent:false → a one-off connection that closes after the response
+      // instead of lingering in the global keep-alive pool (leak-free probe).
+      { host, port, path: urlPath, timeout: timeoutMs, agent: false },
       (res) => {
         const status = res.statusCode || 0;
         // Drain body so the socket can close cleanly.
         res.on("data", () => {});
-        res.on("end", () => resolve(status));
+        res.on("end", () => {
+          req.destroy(); // release the socket now, don't wait for GC
+          resolve(status);
+        });
         res.on("error", reject);
       },
     );
@@ -299,10 +367,11 @@ function probeHttp({ host, port, path: urlPath, timeoutMs }) {
 function probeHttpJson({ host, port, path: urlPath, timeoutMs }) {
   return new Promise((resolve, reject) => {
     const req = http.get(
-      { host, port, path: urlPath, timeout: timeoutMs },
+      { host, port, path: urlPath, timeout: timeoutMs, agent: false },
       (res) => {
         if (res.statusCode < 200 || res.statusCode >= 300) {
           res.resume();
+          req.destroy();
           reject(new Error(`HTTP ${res.statusCode} from ${urlPath}`));
           return;
         }
@@ -311,6 +380,7 @@ function probeHttpJson({ host, port, path: urlPath, timeoutMs }) {
           body += d.toString("utf8");
         });
         res.on("end", () => {
+          req.destroy(); // release the socket now, don't wait for GC
           try {
             resolve(JSON.parse(body));
           } catch (e) {