chainlesschain 0.162.169 → 0.162.171

package/src/data/changelog.json

@@ -3,7 +3,7 @@
   "releases": [
     {
       "productVersion": "Unreleased",
-      "cliVersion": "0.162.169",
+      "cliVersion": "0.162.170",
       "cliVersions": [
         "0.4.46",
         "0.4.51",
@@ -27,11 +27,16 @@
         "0.162.166",
         "0.162.167",
         "0.162.168",
-        "0.162.169"
+        "0.162.169",
+        "0.162.170"
       ],
       "date": null,
       "title": "",
       "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.170：后台 Agent stop 自杀守卫 + 可注入 kill seam + smoke-runner 死 pid 守卫；发版门 flake 治本后首个无 skip_tests 发版（CLI-only npm 发版）",
+          "body": "> `chainlesschain` 0.162.169 → **0.162.170** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。CLI-only：`packages/cli/src` 仅两文件（+ vitest 4.1.5→4.1.10 devDep 升级与测试）；未触 `pdh/lib` → 无 Android bundle / 无 USR_VERSION。**无新增顶层命令，命令数 175 不变**；默认路径字节不变（守卫只在损坏/异常记录上改变行为）。本版同时是 CI 发版门 worker-death flake（卡了 .167/.168/.169 三个发版、cli-ci 30+ 连败）治本（trap #34）后的**验证发版**——test 门应首跑即绿、无需 `skip_tests`。\n\n- **后台 Agent stop 自杀守卫（真实世界加固）**：`stopBackgroundAgent` 现拒绝向 `pid === process.pid` 的记录发信号——合法的 worker 记录不可能指向执行 stop 的进程自身，命中即判损坏记录（标 `lost`/`self-pid-corrupt-record`、不杀任何进程）。此前一份损坏/手改的 state 文件能让 `cc daemon stop` 对用户自己的 shell 树发 SIGTERM（POSIX）或 `taskkill /T /F`（Windows）。agentPid 组杀同样加 `!== process.pid` 守卫；`defaultKillProcessTree` 同款自杀守卫。\n- **可注入 kill seam**：supervisor 全部 POSIX 信号从裸 `process.kill` 收进 `_deps.kill` 单一 seam——测试可注入（正是 flake 根因之一：`_deps.spawnSync` stub 只盖 Windows taskkill 分支、POSIX 裸 kill 拦不住），生产行为不变。\n- **smoke-runner 死 pid 守卫**：子进程已退出（`exitCode`/`signalCode` 非 null）时跳过 Windows `taskkill /T /F`——Windows 秒级复用 pid，对死尸 pid 的树杀会误杀顶替者全树（CI 上即另一 vitest worker / 无辜测试子进程）。\n- **vitest 4.1.5 → 4.1.10**（root workspace 全体 devDep）：含 4.1.9 的真 pool 修复（worker 崩溃挂起、per-task error 监听、STOPPED 态、回收 isTerminated 守卫）；非 flake 解药但保留为正确卫生。agent-sdk 刻意保持 `^3` 钉版；独立 web-panel 不动。"
+        },
         {
           "heading": "Added — cc CLI 0.162.169：增量 gap-analysis 收口批——后台 Agent `needs_input`/`uncertain_side_effect` 真实生产者 + IDE stream 路径副作用台账 + post-edit 诊断多根 + plugin 安装入统一 install 审计（CLI-only npm 发版）",
           "body": "> `chainlesschain` 0.162.168 → **0.162.169** 发 npm `latest`（经 `npm-publish.yml`，`--provenance --access public`）。纯 `packages/cli/src` 增量（4 个 feat/fix commit + 测试 + gap-analysis 文档状态）；未触 `pdh/lib` → 无 Android cc bundle rollover / 无 USR_VERSION 改动。**无新增顶层命令，命令数 175 不变**。默认路径全部字节不变——唯一行为变化限**后台** agent 子进程（`ask_user_question` 从 `user_not_reachable` 变为 park 成 `needs_input`，前台/headless 不受影响）。\n\n- **P0 后台 Agent：`needs_input` + `uncertain_side_effect` 真实生产者（状态机相位收口）**：最后两个无生产者相位补齐。`uncertain_side_effect`——后台子进程 `--resume` 时 side-effect ledger reconcile 出 **UNKNOWN 结局**的不可逆操作（inspect 桶），即把 `phase:\"uncertain_side_effect\"` + 计数写进共享 state，Dashboard 归入 \"Needs input\"（unknown 必须人工确认）；worker 在下一 turn/idle 边界清注解。`needs_input`（**提问**态，区别于审批）——后台 turn 子进程的 `ask_user_question` 现在有人接：把 `phase:\"needs_input\"` + `pendingQuestion:{question,options}` 写进 state、指示模型结束回合，用户经 attach 的回复作为下一 turn 到达；新纯核 `idlePhaseFor` 保证**未答问题在 idle 边界不降级为 Idle**。session-lifecycle/phase 词表/Dashboard 分组同步扩齐；前台运行不供 interaction → 既有 `user_not_reachable` 路径逐字节不变。\n- **P0-2 IDE stream 路径副作用台账（崩溃恢复补全第三路）**：crash-safe side-effect ledger（prepare→start→commit|fail 记账 + resume 时 verify-before-replay reconcile）此前只在单-prompt runner 与 WS bridge——IDE 双面板真正驱动的 **headless-stream**（`--input-format stream-json --resume`）没有：面板 worker 在 git push/publish/opaque shell 中途被杀，resume 后无恢复通知、可能盲目重放。现 stream 孪生路径同样记账（副作用 settle 前持久化快照），resume 时 reconcile 并把 Recovery notice 以 system 消息 + `raw/side_effect_recovery` 行双路发出（已发的 VS 0.37.16 / JB 0.4.60 面板已渲染该行）。匿名/`--ephemeral` 运行字节不变。\n- **P2 LSP：post-edit 诊断多根**：`_postEditDiagnostics` 的根选择不再恒 cwd——三个编辑工具（write_file/edit_file/edit_file_hashed）按**包含被编辑文件的根**（`pickRootForFile`，镜像 code_intelligence）做 server 探测与共享池 key，编辑 `--add-dir` 根内文件时诊断走它自己项目的语言服务器而非静默降级为无诊断。单根会话字节不变。\n- **P0 沙箱：plugin 安装入统一 install 审计（「下载并运行第三方代码」三入口收口）**：`cc plugin add`/`upgrade` 拉来的插件带可执行组件（bin/hooks/LSP/MCP 以进程运行），本质是 plugin-runtime 版的 `npm install -g`——现与 run_shell 安装、run_code 自动安装共用同一 opt-in 审计 trail（`CC_INSTALL_AUDIT`/settings `installPolicy` → `install-commands.jsonl`）：新纯核 `classifyPluginInstall`（manager `cc-plugin`、`name@version`、**仅 user scope 判 global**、source URL + 已声明能力 token 随行），add 成功后与 upgrade **真落盘**新版本后记 `source:\"plugin_install\"`（up-to-date no-op 不记）。默认（策略关）零写；审计 best-effort 绝不破坏安装。"

package/src/gateways/ws/ws-agent-handler.js

@@ -26,6 +26,7 @@ import { runnableTaskModel } from "../../lib/runnable-provider.js";
 import { PlanState } from "../../lib/plan-mode.js";
 import { CLISlotFiller } from "../../lib/slot-filler.js";
 import { createAbortError, isAbortError } from "../../lib/abort-utils.js";
+import { createWsApprovalGate } from "./ws-approval-gate.js";
 
 export class WSAgentHandler {
   /**
@@ -34,7 +35,7 @@ export class WSAgentHandler {
    * @param {import("../../lib/interaction-adapter.js").WebSocketInteractionAdapter} options.interaction
    * @param {object} [options.db]
    */
-  constructor({ session, interaction, db }) {
+  constructor({ session, interaction, db, approvalGate }) {
     this.session = session;
     this.interaction = interaction;
     this.db = db || null;
@@ -44,6 +45,27 @@ export class WSAgentHandler {
     // P0-2: monotonic sequence for crash-safe side-effect ledger op ids. The
     // session id + a per-op nonce keep ids unique across turns and processes.
     this._sideEffectSeq = 0;
+    // P0 authority: permission-gate-over-WS. An explicitly injected gate wins
+    // (tests / embedders); otherwise one is built lazily on the first turn
+    // when CC_WS_APPROVAL_GATE=1 — its confirmer raises confirm questions
+    // over the interaction adapter WITH an approval binding the client must
+    // echo back on approve (mismatch → deny). Default (env unset, nothing
+    // injected): approvalGate stays null and loopOptions are byte-identical.
+    this._approvalGate = approvalGate || null;
+    this._approvalGateInit = Boolean(approvalGate);
+  }
+
+  /** Resolve the session's approval gate (lazy, opt-in; null when disabled). */
+  async _ensureApprovalGate() {
+    if (this._approvalGateInit) return this._approvalGate;
+    this._approvalGateInit = true;
+    if (process.env.CC_WS_APPROVAL_GATE === "1") {
+      this._approvalGate = await createWsApprovalGate({
+        sessionId: this.session.id,
+        interaction: this.interaction,
+      });
+    }
+    return this._approvalGate;
   }
 
   /**
@@ -127,6 +149,9 @@ export class WSAgentHandler {
         slotFiller,
         interaction: this.interaction,
         signal: abortController.signal,
+        // P0 authority: null unless opted in (byte-identical default — agent
+        // core already defaults `options.approvalGate || null`).
+        approvalGate: await this._ensureApprovalGate(),
       };
 
       // P0-2: crash-safe side-effect ledger for the IDE/bridge path — mirrors

package/src/gateways/ws/ws-approval-gate.js

@@ -0,0 +1,131 @@
+/**
+ * Permission-gate-over-WS — the approval-BINDING producer for the WS path.
+ *
+ * The consumer side has been wired for a while: WebSocketInteractionAdapter
+ * stores `options.binding` on a pending request, rides it out on the message,
+ * and `_resolvePending` rejects an approve whose echoed binding mismatches
+ * (deny, fail closed). What was missing is the PRODUCER: nothing on the WS
+ * path ever raised an approval request WITH a binding, because the WS agent
+ * handler wired no ApprovalGate at all (CONFIRM-tier decisions fell closed).
+ *
+ * This module supplies both halves:
+ *   - `buildWsApprovalConfirmer` — the gate confirmer that computes
+ *     `approvalBindingDigest({toolCallId, args, policyDigest})` (mirroring the
+ *     headless-stream `interactiveConfirm` producer) and asks the WS client
+ *     over the interaction adapter with the binding attached. Timeout /
+ *     disconnect / any transport error → false (fail closed).
+ *   - `createWsApprovalGate` — a session-scoped gate whose CONFIRM decisions
+ *     route to that confirmer. Policy tiers stay authoritative on the shared
+ *     singleton gate (so `sessions.policy.set` over WS keeps working and no
+ *     global confirmer is ever mutated — a per-session confirmer on the
+ *     process-wide singleton would race across concurrent WS sessions).
+ *
+ * Default byte-identical: the WS handler only builds this when
+ * `CC_WS_APPROVAL_GATE=1` (or a gate is injected); otherwise loopOptions
+ * carry `approvalGate: null` exactly as before.
+ */
+
+import { approvalBindingDigest } from "../../lib/agent-authority.js";
+
+/**
+ * Build the binding-attaching confirmer for one WS session.
+ *
+ * @param {object} opts
+ * @param {{askConfirm: Function}} opts.interaction - the session's WS adapter
+ * @param {string} opts.sessionId
+ * @returns {(ctx?: object) => Promise<boolean>}
+ */
+export function buildWsApprovalConfirmer({ interaction, sessionId }) {
+  let approvalSeq = 0;
+  return async (ctx = {}) => {
+    const command = ctx.command ?? ctx.args?.command ?? null;
+    const risk = ctx.riskLevel || ctx.risk || "unknown";
+    // Bind this approval to the exact call it authorizes (same recipe as the
+    // headless-stream producer): request identity + normalized args + the
+    // policy/rule in force. The client must echo it back on approve.
+    const binding = approvalBindingDigest({
+      toolCallId: `${sessionId}:appr-${++approvalSeq}`,
+      args: ctx.args ?? (command != null ? { command } : null),
+      policyDigest: ctx.rule || ctx.riskLevel || ctx.risk || null,
+    });
+    const what = ctx.tool || ctx.toolName || "tool";
+    const detail = command != null ? `: ${String(command).slice(0, 200)}` : "";
+    try {
+      const ok = await interaction.askConfirm(
+        `Approve ${what}${detail}? (risk: ${risk})`,
+        {
+          default: false,
+          binding,
+          // Structured context so UIs can render a proper approval card
+          // instead of parsing the question text.
+          approval: {
+            tool: what,
+            command,
+            risk,
+            rule: ctx.rule || null,
+          },
+        },
+      );
+      return ok === true;
+    } catch {
+      // timeout / disconnect / interrupt → fail closed, never approve
+      return false;
+    }
+  };
+}
+
+/**
+ * Create a session-scoped approval gate for the WS agent handler.
+ *
+ * Policy lookups delegate to the persistent singleton gate (per-session tiers
+ * set via `sessions.policy.set` stay live); CONFIRM decisions route to the
+ * binding-attaching WS confirmer. Returns null on any load failure so the
+ * caller degrades to the legacy no-gate path (fail closed at CONFIRM).
+ *
+ * @param {object} opts
+ * @param {string} opts.sessionId
+ * @param {{askConfirm: Function}} opts.interaction
+ * @param {object} [opts.deps] - test seams: `loadSingletons`, `loadSessionCore`
+ * @returns {Promise<object|null>}
+ */
+export async function createWsApprovalGate({
+  sessionId,
+  interaction,
+  deps = {},
+}) {
+  try {
+    const loadSingletons =
+      deps.loadSingletons ||
+      (() => import("../../lib/session-core-singletons.js"));
+    const loadSessionCore =
+      deps.loadSessionCore || (() => import("@chainlesschain/session-core"));
+    const [singletons, core] = await Promise.all([
+      loadSingletons(),
+      loadSessionCore(),
+    ]);
+    const inner = await singletons.getApprovalGate();
+    const confirmer =
+      deps.confirmer || buildWsApprovalConfirmer({ interaction, sessionId });
+    const gate = new core.ApprovalGate({
+      defaultPolicy: core.APPROVAL_POLICY?.STRICT || "strict",
+      confirm: confirmer,
+    });
+    return {
+      // Explicit ctx.policy always wins inside decide(); resolve it from the
+      // singleton on every call so mid-session `sessions.policy.set` applies.
+      decide: (ctx = {}) =>
+        gate.decide({
+          ...ctx,
+          policy:
+            ctx.policy || inner.getSessionPolicy(ctx.sessionId || sessionId),
+        }),
+      hasConfirmer: () => gate.hasConfirmer(),
+      setConfirmer: (fn) => gate.setConfirmer(fn),
+      getSessionPolicy: (sid) => inner.getSessionPolicy(sid || sessionId),
+      setSessionPolicy: (sid, policy) =>
+        inner.setSessionPolicy(sid || sessionId, policy),
+    };
+  } catch {
+    return null; // degrade to the legacy no-gate path
+  }
+}

package/src/lib/agent-worktree.js

@@ -11,11 +11,18 @@
  *    a merge hint. Removal failures fail-open to "kept".
  */
 
-import { execSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
 import { createWorktree, removeWorktree } from "./worktree-isolator.js";
 import { findProjectRoot } from "./project-instructions.js";
 
-export const _deps = { execSync, createWorktree, removeWorktree };
+export const _deps = {
+  execFileSync,
+  execSync,
+  createWorktree,
+  removeWorktree,
+};
 
 function git(cmd, cwd, deps) {
   return (deps.execSync || execSync)(`git ${cmd}`, {
@@ -25,6 +32,132 @@ function git(cmd, cwd, deps) {
   });
 }
 
+function canonicalPath(value) {
+  const absolute = resolve(String(value || ""));
+  const real = realpathSync.native
+    ? realpathSync.native(absolute)
+    : realpathSync(absolute);
+  return process.platform === "win32" ? real.toLowerCase() : real;
+}
+
+function parseRegisteredWorktrees(text) {
+  const entries = [];
+  let current = null;
+  for (const line of String(text || "").split(/\r?\n/)) {
+    if (line.startsWith("worktree ")) {
+      if (current) entries.push(current);
+      current = { path: line.slice("worktree ".length) };
+      continue;
+    }
+    if (!current) continue;
+    if (line.startsWith("HEAD ")) current.head = line.slice("HEAD ".length);
+    if (line.startsWith("branch ")) {
+      current.branch = line.slice("branch ".length);
+    }
+  }
+  if (current) entries.push(current);
+  return entries;
+}
+
+/**
+ * Verify that persisted worktree metadata still identifies the same linked
+ * worktree. Cleanup callers use this as a fail-closed identity check before
+ * invoking any removal primitive: a missing/corrupt path must never turn into
+ * a recursive delete of the repository checkout.
+ *
+ * @returns {{valid:boolean, reason:string}}
+ */
+export function validateAgentWorktree(info, { deps = _deps } = {}) {
+  const worktreePath = info?.path || info?.worktreePath;
+  if (!worktreePath || !info?.repoRoot || !info?.branch || !info?.baseSha) {
+    return { valid: false, reason: "incomplete worktree metadata" };
+  }
+  if (!/^[0-9a-f]{40,64}$/i.test(String(info.baseSha))) {
+    return { valid: false, reason: "invalid worktree base SHA" };
+  }
+  if (!existsSync(worktreePath) || !existsSync(info.repoRoot)) {
+    return { valid: false, reason: "worktree or repository path is missing" };
+  }
+
+  try {
+    const repo = canonicalPath(info.repoRoot);
+    const worktree = canonicalPath(worktreePath);
+    if (repo === worktree) {
+      return {
+        valid: false,
+        reason: "refusing to treat the main checkout as an agent worktree",
+      };
+    }
+
+    const repoTop = canonicalPath(
+      git("rev-parse --show-toplevel", info.repoRoot, deps).trim(),
+    );
+    const worktreeTop = canonicalPath(
+      git("rev-parse --show-toplevel", worktreePath, deps).trim(),
+    );
+    if (repoTop !== repo || worktreeTop !== worktree) {
+      return { valid: false, reason: "worktree path identity mismatch" };
+    }
+
+    const registered = parseRegisteredWorktrees(
+      git("worktree list --porcelain", info.repoRoot, deps),
+    ).find((entry) => {
+      try {
+        return canonicalPath(entry.path) === worktree;
+      } catch {
+        return false;
+      }
+    });
+    if (!registered) {
+      return {
+        valid: false,
+        reason: "path is not a registered worktree of the repository",
+      };
+    }
+    if (registered.branch !== `refs/heads/${info.branch}`) {
+      return {
+        valid: false,
+        reason: "registered worktree branch does not match persisted metadata",
+      };
+    }
+    return { valid: true, reason: "verified" };
+  } catch (error) {
+    return {
+      valid: false,
+      reason: `worktree identity could not be verified: ${error.message}`,
+    };
+  }
+}
+
+function removeVerifiedAgentWorktree(info, deps) {
+  // Unit seams historically inject removeWorktree directly. Keep that seam,
+  // while production uses a non-forced git removal: if the tree changed
+  // between inspection and deletion, git refuses instead of discarding it.
+  if (deps.removeWorktree && deps.removeWorktree !== removeWorktree) {
+    deps.removeWorktree(info.repoRoot, info.path);
+    return null;
+  }
+
+  const run = deps.execFileSync || execFileSync;
+  run("git", ["worktree", "remove", info.path], {
+    cwd: info.repoRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  try {
+    run("git", ["branch", "-D", "--", info.branch], {
+      cwd: info.repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return null;
+  } catch (error) {
+    // The worktree itself is already gone. Preserve an honest warning rather
+    // than claiming the whole cleanup failed and that the path was kept.
+    return `branch cleanup failed: ${error.message}`;
+  }
+}
+
 /**
  * @returns {{ path, branch, repoRoot, baseSha }}
  */
@@ -51,22 +184,57 @@ export function setupAgentWorktree({
 export function finishAgentWorktree(info, { deps = _deps } = {}) {
   if (!info) return { removed: false, kept: false, reason: "no worktree" };
 
+  // Production cleanup validates the persisted path against git's own
+  // worktree registry. Custom dependency bundles are test seams and retain the
+  // historical pure mocked behavior unless they provide validateWorktree.
+  const validation =
+    typeof deps.validateWorktree === "function"
+      ? deps.validateWorktree(info)
+      : deps === _deps
+        ? validateAgentWorktree(info, { deps })
+        : { valid: true, reason: "injected validation seam" };
+  if (!validation?.valid) {
+    return {
+      removed: false,
+      kept: true,
+      reason: `unverifiable worktree: ${validation?.reason || "unknown reason"}`,
+    };
+  }
+
   let dirty = true;
   let headSha = null;
+  let readable = false;
   try {
     dirty = git("status --porcelain", info.path, deps).trim().length > 0;
     headSha = git("rev-parse HEAD", info.path, deps).trim();
+    readable = true;
   } catch {
     /* unreadable → keep, never destroy work we cannot verify */
   }
 
+  if (!readable) {
+    return {
+      removed: false,
+      kept: true,
+      reason: "unverifiable worktree: git state could not be read",
+    };
+  }
+
   const hasCommits = headSha !== null && headSha !== info.baseSha;
   if (!dirty && !hasCommits) {
     try {
-      (deps.removeWorktree || removeWorktree)(info.repoRoot, info.path);
-      return { removed: true, kept: false, reason: "no changes" };
+      const warning = removeVerifiedAgentWorktree(info, deps);
+      return {
+        removed: true,
+        kept: false,
+        reason: warning ? `no changes; ${warning}` : "no changes",
+      };
     } catch (err) {
-      return { removed: false, kept: true, reason: `cleanup failed: ${err.message}` };
+      return {
+        removed: false,
+        kept: true,
+        reason: `cleanup failed: ${err.message}`,
+      };
     }
   }
   return {