chainlesschain 0.162.170 → 0.162.172

package/src/gateways/ws/ws-agent-handler.js

@@ -26,6 +26,7 @@ import { runnableTaskModel } from "../../lib/runnable-provider.js";
 import { PlanState } from "../../lib/plan-mode.js";
 import { CLISlotFiller } from "../../lib/slot-filler.js";
 import { createAbortError, isAbortError } from "../../lib/abort-utils.js";
+import { createWsApprovalGate } from "./ws-approval-gate.js";
 
 export class WSAgentHandler {
   /**
@@ -34,7 +35,7 @@ export class WSAgentHandler {
    * @param {import("../../lib/interaction-adapter.js").WebSocketInteractionAdapter} options.interaction
    * @param {object} [options.db]
    */
-  constructor({ session, interaction, db }) {
+  constructor({ session, interaction, db, approvalGate }) {
     this.session = session;
     this.interaction = interaction;
     this.db = db || null;
@@ -44,6 +45,27 @@ export class WSAgentHandler {
     // P0-2: monotonic sequence for crash-safe side-effect ledger op ids. The
     // session id + a per-op nonce keep ids unique across turns and processes.
     this._sideEffectSeq = 0;
+    // P0 authority: permission-gate-over-WS. An explicitly injected gate wins
+    // (tests / embedders); otherwise one is built lazily on the first turn
+    // when CC_WS_APPROVAL_GATE=1 — its confirmer raises confirm questions
+    // over the interaction adapter WITH an approval binding the client must
+    // echo back on approve (mismatch → deny). Default (env unset, nothing
+    // injected): approvalGate stays null and loopOptions are byte-identical.
+    this._approvalGate = approvalGate || null;
+    this._approvalGateInit = Boolean(approvalGate);
+  }
+
+  /** Resolve the session's approval gate (lazy, opt-in; null when disabled). */
+  async _ensureApprovalGate() {
+    if (this._approvalGateInit) return this._approvalGate;
+    this._approvalGateInit = true;
+    if (process.env.CC_WS_APPROVAL_GATE === "1") {
+      this._approvalGate = await createWsApprovalGate({
+        sessionId: this.session.id,
+        interaction: this.interaction,
+      });
+    }
+    return this._approvalGate;
   }
 
   /**
@@ -127,6 +149,9 @@ export class WSAgentHandler {
         slotFiller,
         interaction: this.interaction,
         signal: abortController.signal,
+        // P0 authority: null unless opted in (byte-identical default — agent
+        // core already defaults `options.approvalGate || null`).
+        approvalGate: await this._ensureApprovalGate(),
       };
 
       // P0-2: crash-safe side-effect ledger for the IDE/bridge path — mirrors

package/src/gateways/ws/ws-approval-gate.js

@@ -0,0 +1,131 @@
+/**
+ * Permission-gate-over-WS — the approval-BINDING producer for the WS path.
+ *
+ * The consumer side has been wired for a while: WebSocketInteractionAdapter
+ * stores `options.binding` on a pending request, rides it out on the message,
+ * and `_resolvePending` rejects an approve whose echoed binding mismatches
+ * (deny, fail closed). What was missing is the PRODUCER: nothing on the WS
+ * path ever raised an approval request WITH a binding, because the WS agent
+ * handler wired no ApprovalGate at all (CONFIRM-tier decisions fell closed).
+ *
+ * This module supplies both halves:
+ *   - `buildWsApprovalConfirmer` — the gate confirmer that computes
+ *     `approvalBindingDigest({toolCallId, args, policyDigest})` (mirroring the
+ *     headless-stream `interactiveConfirm` producer) and asks the WS client
+ *     over the interaction adapter with the binding attached. Timeout /
+ *     disconnect / any transport error → false (fail closed).
+ *   - `createWsApprovalGate` — a session-scoped gate whose CONFIRM decisions
+ *     route to that confirmer. Policy tiers stay authoritative on the shared
+ *     singleton gate (so `sessions.policy.set` over WS keeps working and no
+ *     global confirmer is ever mutated — a per-session confirmer on the
+ *     process-wide singleton would race across concurrent WS sessions).
+ *
+ * Default byte-identical: the WS handler only builds this when
+ * `CC_WS_APPROVAL_GATE=1` (or a gate is injected); otherwise loopOptions
+ * carry `approvalGate: null` exactly as before.
+ */
+
+import { approvalBindingDigest } from "../../lib/agent-authority.js";
+
+/**
+ * Build the binding-attaching confirmer for one WS session.
+ *
+ * @param {object} opts
+ * @param {{askConfirm: Function}} opts.interaction - the session's WS adapter
+ * @param {string} opts.sessionId
+ * @returns {(ctx?: object) => Promise<boolean>}
+ */
+export function buildWsApprovalConfirmer({ interaction, sessionId }) {
+  let approvalSeq = 0;
+  return async (ctx = {}) => {
+    const command = ctx.command ?? ctx.args?.command ?? null;
+    const risk = ctx.riskLevel || ctx.risk || "unknown";
+    // Bind this approval to the exact call it authorizes (same recipe as the
+    // headless-stream producer): request identity + normalized args + the
+    // policy/rule in force. The client must echo it back on approve.
+    const binding = approvalBindingDigest({
+      toolCallId: `${sessionId}:appr-${++approvalSeq}`,
+      args: ctx.args ?? (command != null ? { command } : null),
+      policyDigest: ctx.rule || ctx.riskLevel || ctx.risk || null,
+    });
+    const what = ctx.tool || ctx.toolName || "tool";
+    const detail = command != null ? `: ${String(command).slice(0, 200)}` : "";
+    try {
+      const ok = await interaction.askConfirm(
+        `Approve ${what}${detail}? (risk: ${risk})`,
+        {
+          default: false,
+          binding,
+          // Structured context so UIs can render a proper approval card
+          // instead of parsing the question text.
+          approval: {
+            tool: what,
+            command,
+            risk,
+            rule: ctx.rule || null,
+          },
+        },
+      );
+      return ok === true;
+    } catch {
+      // timeout / disconnect / interrupt → fail closed, never approve
+      return false;
+    }
+  };
+}
+
+/**
+ * Create a session-scoped approval gate for the WS agent handler.
+ *
+ * Policy lookups delegate to the persistent singleton gate (per-session tiers
+ * set via `sessions.policy.set` stay live); CONFIRM decisions route to the
+ * binding-attaching WS confirmer. Returns null on any load failure so the
+ * caller degrades to the legacy no-gate path (fail closed at CONFIRM).
+ *
+ * @param {object} opts
+ * @param {string} opts.sessionId
+ * @param {{askConfirm: Function}} opts.interaction
+ * @param {object} [opts.deps] - test seams: `loadSingletons`, `loadSessionCore`
+ * @returns {Promise<object|null>}
+ */
+export async function createWsApprovalGate({
+  sessionId,
+  interaction,
+  deps = {},
+}) {
+  try {
+    const loadSingletons =
+      deps.loadSingletons ||
+      (() => import("../../lib/session-core-singletons.js"));
+    const loadSessionCore =
+      deps.loadSessionCore || (() => import("@chainlesschain/session-core"));
+    const [singletons, core] = await Promise.all([
+      loadSingletons(),
+      loadSessionCore(),
+    ]);
+    const inner = await singletons.getApprovalGate();
+    const confirmer =
+      deps.confirmer || buildWsApprovalConfirmer({ interaction, sessionId });
+    const gate = new core.ApprovalGate({
+      defaultPolicy: core.APPROVAL_POLICY?.STRICT || "strict",
+      confirm: confirmer,
+    });
+    return {
+      // Explicit ctx.policy always wins inside decide(); resolve it from the
+      // singleton on every call so mid-session `sessions.policy.set` applies.
+      decide: (ctx = {}) =>
+        gate.decide({
+          ...ctx,
+          policy:
+            ctx.policy || inner.getSessionPolicy(ctx.sessionId || sessionId),
+        }),
+      hasConfirmer: () => gate.hasConfirmer(),
+      setConfirmer: (fn) => gate.setConfirmer(fn),
+      getSessionPolicy: (sid) => inner.getSessionPolicy(sid || sessionId),
+      setSessionPolicy: (sid, policy) =>
+        inner.setSessionPolicy(sid || sessionId, policy),
+    };
+  } catch {
+    return null; // degrade to the legacy no-gate path
+  }
+}