chainlesschain 0.162.174 → 0.162.176

package/src/gateways/terminal/PtyManager.js

@@ -21,6 +21,7 @@ import EventEmitter from "events";
 import { randomUUID } from "crypto";
 import { createRequire } from "module";
 import { RingBuffer } from "./RingBuffer.js";
+import { executionBroker } from "../../lib/process-execution-broker/index.js";
 
 const require = createRequire(import.meta.url);
 
@@ -66,6 +67,7 @@ export class PtyManager extends EventEmitter {
     this.config = { ...DEFAULT_CONFIG, ...(opts.config || {}) };
     this._deps = {
       loadNodePty: opts._deps?.loadNodePty || (() => require("node-pty")),
+      spawnPty: opts._deps?.spawnPty || null,
       now: opts._deps?.now || (() => Date.now()),
     };
     this._sessions = new Map();
@@ -110,12 +112,17 @@ export class PtyManager extends EventEmitter {
       req.env && typeof req.env === "object" && !Array.isArray(req.env)
         ? req.env
         : {};
-    const proc = pty.spawn(cmd, [], {
+    const spawnPty =
+      this._deps.spawnPty || executionBroker.spawnPty.bind(executionBroker);
+    const proc = spawnPty(pty, cmd, [], {
       name: "xterm-256color",
       cols,
       rows,
       cwd,
       env: { ...process.env, ...extraEnv },
+      origin: "terminal:pty",
+      policy: "allow",
+      scope: "terminal",
     });
 
     const sessionId = randomUUID();

package/src/gateways/ws/message-dispatcher.js

@@ -110,6 +110,9 @@ export function createWsMessageDispatcher(server) {
         "session-close": () => server._handleSessionClose(id, ws, message),
         "session-interrupt": () =>
           server._handleSessionInterrupt(id, ws, message),
+        "permission-rules-get": () => server._handlePermissionRulesGet(id, ws),
+        "permission-rules-set": () =>
+          server._handlePermissionRulesSet(id, ws, message),
         "slash-command": () => server._handleSlashCommand(id, ws, message),
         "session-answer": () => server._handleSessionAnswer(id, ws, message),
         "remote-session-create": () =>

package/src/gateways/ws/session-protocol.js

@@ -96,6 +96,27 @@ async function ensureSessionHandler(server, ws, session) {
     envelopeBus: server.envelopeBus || null,
   });
 
+  // Route MCP elicitation through the authenticated WS question channel. The
+  // MCP client may be shared by the runtime, so this is deliberately only a
+  // transport hook; the MCP request/answer ids remain inside the pending
+  // interaction entry and unknown answers are ignored by the adapter.
+  if (
+    session.mcpClient &&
+    typeof session.mcpClient.setElicitationHandler === "function"
+  ) {
+    session.mcpClient.setElicitationHandler(
+      async (request) => {
+        const answer = await session.interaction.askElicitation(request);
+        if (answer == null) return { action: "cancel" };
+        if (typeof answer === "object") {
+          return { action: "accept", content: answer };
+        }
+        return { action: "accept", content: { value: answer } };
+      },
+      { sessionId: session.id, timeoutMs: 180000 },
+    );
+  }
+
   let handler;
   if (session.type === "chat") {
     const { WSChatHandler } = await import("../../lib/ws-chat-handler.js");
@@ -444,6 +465,11 @@ export function handleSessionList(server, id, ws) {
 export function handleSessionClose(server, id, ws, message) {
   const { sessionId } = message;
 
+  const closingSession = server.sessionManager?.getSession?.(sessionId);
+  if (closingSession?.mcpClient?.clearElicitationHandler) {
+    closingSession.mcpClient.clearElicitationHandler(sessionId);
+  }
+
   const handler = server.sessionHandlers.get(sessionId);
   if (handler && handler.destroy) {
     handler.destroy();

package/src/gateways/ws/ws-agent-handler.js

@@ -13,6 +13,7 @@
 
 import { agentLoop, formatToolArgs } from "../../runtime/agent-core.js";
 import { classifyToolSideEffect } from "../../lib/side-effect-ledger.js";
+import { DiffReviewFollowUpTracker } from "../../lib/diff-review-follow-up.js";
 import {
   loadSideEffectLedger,
   persistSideEffectLedger,
@@ -88,6 +89,8 @@ export class WSAgentHandler {
     const abortController = new AbortController();
     this._abortController = abortController;
     this._activeRequestId = requestId || null;
+    let sideEffectLedger = null;
+    let diffReviewFollowUps = null;
 
     try {
       const { session } = this;
@@ -159,88 +162,123 @@ export class WSAgentHandler {
       // persisted BEFORE it settles) and commit/fail on its result, so a bridge
       // worker killed mid-flight is surfaced for verification on resume (see
       // handleSessionResume) instead of being blindly replayed.
-      const sideEffectLedger = loadSideEffectLedger(session.id);
+      sideEffectLedger = loadSideEffectLedger(session.id);
+      diffReviewFollowUps = new DiffReviewFollowUpTracker(sideEffectLedger);
       let currentSideEffectOpId = null;
 
-      for await (const event of agentLoop(session.messages, loopOptions)) {
-        switch (event.type) {
-          case "slot-filling":
-            this.interaction.emit("slot-filling", {
-              requestId,
-              slot: event.slot,
-              question: event.question,
-            });
-            break;
-
-          case "tool-executing":
-            this.interaction.emit("tool-executing", {
-              requestId,
-              tool: event.tool,
-              args: event.args,
-              display: formatToolArgs(event.tool, event.args),
-            });
-            currentSideEffectOpId = null;
-            {
-              const se = classifyToolSideEffect(event.tool, event.args);
-              if (se) {
-                const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
-                currentSideEffectOpId = opId;
-                sideEffectLedger
-                  .prepare(opId, {
-                    kind: se.kind,
-                    key: se.key,
-                    meta: {
-                      tool: event.tool,
-                      idempotencyKey: operationIdempotencyKey({
+      const runAgentTurn = async () => {
+        for await (const event of agentLoop(session.messages, loopOptions)) {
+          switch (event.type) {
+            case "slot-filling":
+              this.interaction.emit("slot-filling", {
+                requestId,
+                slot: event.slot,
+                question: event.question,
+              });
+              break;
+
+            case "tool-executing":
+              this.interaction.emit("tool-executing", {
+                requestId,
+                tool: event.tool,
+                args: event.args,
+                display: formatToolArgs(event.tool, event.args),
+              });
+              currentSideEffectOpId = null;
+              {
+                const se = classifyToolSideEffect(event.tool, event.args);
+                if (se) {
+                  const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
+                  currentSideEffectOpId = opId;
+                  sideEffectLedger
+                    .prepare(opId, {
+                      kind: se.kind,
+                      key: se.key,
+                      meta: {
                         tool: event.tool,
-                        args: event.args,
-                      }),
-                    },
-                  })
-                  .start(opId);
+                        idempotencyKey: operationIdempotencyKey({
+                          tool: event.tool,
+                          args: event.args,
+                        }),
+                      },
+                    })
+                    .start(opId);
+                  persistSideEffectLedger(session.id, sideEffectLedger);
+                }
+              }
+              break;
+
+            case "tool-result":
+              this.interaction.emit("tool-result", {
+                requestId,
+                tool: event.tool,
+                result: event.result,
+                error: event.error,
+              });
+              if (currentSideEffectOpId) {
+                const err = event.error || event.result?.error || null;
+                if (event.result?._diffReviewAudit) {
+                  diffReviewFollowUps.observe(
+                    sideEffectLedger,
+                    currentSideEffectOpId,
+                    event.result._diffReviewAudit,
+                  );
+                }
+                if (err)
+                  sideEffectLedger.fail(
+                    currentSideEffectOpId,
+                    String(err).slice(0, 200),
+                  );
+                else sideEffectLedger.commit(currentSideEffectOpId);
                 persistSideEffectLedger(session.id, sideEffectLedger);
+                currentSideEffectOpId = null;
               }
-            }
-            break;
-
-          case "tool-result":
-            this.interaction.emit("tool-result", {
-              requestId,
-              tool: event.tool,
-              result: event.result,
-              error: event.error,
-            });
-            if (currentSideEffectOpId) {
-              const err = event.error || event.result?.error || null;
-              if (err)
-                sideEffectLedger.fail(
-                  currentSideEffectOpId,
-                  String(err).slice(0, 200),
-                );
-              else sideEffectLedger.commit(currentSideEffectOpId);
-              persistSideEffectLedger(session.id, sideEffectLedger);
-              currentSideEffectOpId = null;
-            }
-            break;
-
-          case "response-complete":
-            if (event.content) {
-              session.messages.push({
-                role: "assistant",
+              break;
+
+            case "response-complete":
+              if (event.content) {
+                session.messages.push({
+                  role: "assistant",
+                  content: event.content,
+                });
+              }
+              this.interaction.emit("response-complete", {
+                requestId,
                 content: event.content,
               });
-            }
-            this.interaction.emit("response-complete", {
-              requestId,
-              content: event.content,
-            });
-            break;
+              break;
+          }
         }
+      };
+
+      if (session.mcpClient?.withElicitationContext) {
+        await session.mcpClient.withElicitationContext(
+          session.id,
+          runAgentTurn,
+        );
+      } else {
+        await runAgentTurn();
+      }
+      if (
+        diffReviewFollowUps.complete(sideEffectLedger, {
+          status: "completed-without-reproposal",
+        }).length > 0
+      ) {
+        persistSideEffectLedger(session.id, sideEffectLedger);
       }
 
       // Update last activity
       session.lastActivity = new Date().toISOString();
     } catch (err) {
+      if (
+        sideEffectLedger &&
+        diffReviewFollowUps?.complete(sideEffectLedger, {
+          status: "interrupted",
+          reason: isAbortError(err) ? "aborted" : err.message,
+        }).length > 0
+      ) {
+        persistSideEffectLedger(this.session.id, sideEffectLedger);
+      }
       if (isAbortError(err) || abortController.signal.aborted) {
         return;
       }

package/src/gateways/ws/ws-server.js

@@ -11,7 +11,6 @@
  */
 
 import { EventEmitter } from "node:events";
-import { spawn } from "node:child_process";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -113,6 +112,11 @@ import {
   handleArtifactRemove,
   handleArtifactShow,
 } from "./artifact-protocol.js";
+import { executionBroker } from "../../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -216,6 +220,7 @@ export class ChainlessChainWSServer extends EventEmitter {
    * @param {string}  [options.token]           - If set, clients must authenticate first
    * @param {number}  [options.maxConnections=10]
    * @param {number}  [options.timeout=30000]   - Command execution timeout (ms)
+   * @param {Function} [options.spawn]           - Process seam for tests
    */
   constructor(options = {}) {
     super();
@@ -240,6 +245,7 @@ export class ChainlessChainWSServer extends EventEmitter {
     // grace window so it can't hold a maxConnections slot forever (see
     // AUTH_TIMEOUT_MS). `??` so an explicit 0 (disable) is honoured.
     this.authTimeoutMs = options.authTimeoutMs ?? AUTH_TIMEOUT_MS;
+    this._spawnProcess = options.spawn || _deps.spawn;
 
     /** Optional Phase-5 envelope bus for fan-out to hosted HTTP SSE. */
     this.envelopeBus = options.envelopeBus || null;
@@ -255,6 +261,7 @@ export class ChainlessChainWSServer extends EventEmitter {
 
     /** Session manager for stateful agent/chat sessions */
     this.sessionManager = options.sessionManager || null;
+    this.projectRoot = options.projectRoot || process.cwd();
 
     /** Session handlers: sessionId → WSAgentHandler | WSChatHandler */
     this.sessionHandlers = new Map();
@@ -530,6 +537,67 @@ export class ChainlessChainWSServer extends EventEmitter {
     return this._dispatcher.dispatch(clientId, ws, message);
   }
 
+  /** Read the same .claude settings rules used by the Agent Core. */
+  async _handlePermissionRulesGet(id, ws) {
+    try {
+      const { loadSettings } = await import("../../lib/settings-loader.cjs");
+      const loaded = loadSettings({ cwd: this.projectRoot });
+      this._send(ws, {
+        id,
+        type: "permission-rules",
+        rules: loaded.rules,
+        sources: loaded.sources,
+        files: loaded.files,
+        managed: loaded.managed || null,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_READ_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
+  /** Persist one rule through settings-loader; managed policy remains authoritative. */
+  async _handlePermissionRulesSet(id, ws, message) {
+    try {
+      const decision = String(message.decision || "").toLowerCase();
+      if (!["allow", "ask", "deny"].includes(decision)) {
+        throw new Error("decision must be allow, ask, or deny");
+      }
+      const rulesMod = await import("../../lib/permission-rules.cjs");
+      const mod = rulesMod.default || rulesMod;
+      if (!mod.parseRule(message.rule)) throw new Error("invalid permission rule");
+      const { addRule } = await import("../../lib/settings-loader.cjs");
+      const scope = ["project", "local", "user"].includes(message.scope)
+        ? message.scope
+        : "project";
+      const result = addRule({
+        cwd: this.projectRoot,
+        kind: decision,
+        rule: message.rule,
+        scope,
+      });
+      this._send(ws, {
+        id,
+        type: "permission-rule-updated",
+        ...result,
+        decision,
+        rule: message.rule,
+        scope,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_WRITE_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
   /**
    * Handle an orchestrate message — runs ChainlessChain orchestration with
    * real-time progress pushed back over this WebSocket connection.
@@ -854,11 +922,12 @@ export class ChainlessChainWSServer extends EventEmitter {
       return;
     }
 
-    const child = spawn(process.execPath, [BIN_PATH, ...args], {
+    const child = this._spawnProcess(process.execPath, [BIN_PATH, ...args], {
       env: {
         ...process.env,
         FORCE_COLOR: "0",
         NO_SPINNER: "1",
+        NODE_NO_WARNINGS: "1",
         // When this server runs inside Electron (e.g. desktop web-shell)
         // process.execPath points at the Electron binary, not node. Setting
         // ELECTRON_RUN_AS_NODE=1 makes Electron behave as a plain Node
@@ -869,6 +938,10 @@ export class ChainlessChainWSServer extends EventEmitter {
       },
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
+      origin: "gateway:ws-command",
+      policy: "allow",
+      scope: "gateway",
+      shell: false,
     });
 
     this.processes.set(id, child);
@@ -894,27 +967,42 @@ export class ChainlessChainWSServer extends EventEmitter {
 
     if (stream) {
       // Stream mode: send chunks as they arrive
+      // stdout is the primary command result. Node can deliver a startup
+      // warning on stderr before the first stdout chunk (especially on the
+      // `--version` fast path), which otherwise makes consumers mistake the
+      // warning for the command output. Hold early stderr until stdout has
+      // been announced; if there is no stdout, flush it before stream-end.
+      let stdoutSeen = false;
+      const pendingStderr = [];
+
       child.stdout.on("data", (data) => {
+        stdoutSeen = true;
         this._send(ws, {
           id,
           type: "stream-data",
           channel: "stdout",
           data: data.toString("utf8"),
         });
+        while (pendingStderr.length > 0) {
+          this._send(ws, pendingStderr.shift());
+        }
       });
 
       child.stderr.on("data", (data) => {
-        this._send(ws, {
+        const message = {
           id,
           type: "stream-data",
           channel: "stderr",
           data: data.toString("utf8"),
-        });
+        };
+        if (stdoutSeen) this._send(ws, message);
+        else pendingStderr.push(message);
       });
 
       child.on("close", (exitCode) => {
         clearTimeout(timer);
         this.processes.delete(id);
+        for (const message of pendingStderr) this._send(ws, message);
         this._send(ws, {
           id,
           type: "stream-end",

package/src/harness/jsonl-session-store.js

@@ -20,6 +20,7 @@ import {
   verifyTranscriptText,
   TRANSCRIPT_CHAIN_STATUS,
 } from "./transcript-integrity.js";
+import { withFileLock } from "../lib/with-file-lock.js";
 
 function getSessionsDir() {
   const dir = join(getHomeDir(), "sessions");
@@ -82,12 +83,18 @@ function _resolveChainTail(sessionId, filePath) {
 
 export function appendEvent(sessionId, type, data) {
   const filePath = sessionPath(sessionId);
-  const prevHash = _resolveChainTail(sessionId, filePath);
-  const core = { type, timestamp: Date.now(), data };
-  const hash = computeEventHash(prevHash, core);
-  const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
-  appendFileSync(filePath, line, "utf-8");
-  _chainTailCache.set(sessionId, hash);
+  withFileLock(
+    filePath,
+    () => {
+      const prevHash = _resolveChainTail(sessionId, filePath);
+      const core = { type, timestamp: Date.now(), data };
+      const hash = computeEventHash(prevHash, core);
+      const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
+      appendFileSync(filePath, line, "utf-8");
+      _chainTailCache.set(sessionId, hash);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /**