chainlesschain 0.162.175 → 0.162.176

package/src/commands/permissions.js

@@ -5,6 +5,7 @@
  *   cc permissions list [--json]                merged ruleset + source file
  *   cc permissions test <tool> <args...>        dry-run: which rule decides?
  *   cc permissions add <allow|ask|deny> <rule>  append a rule to a settings file
+ *   cc permissions allow|ask|deny <rule>        convenience aliases for add
  *       [--local | --user]                      (default target: project)
  *
  * The ruleset is loaded by settings-loader (user < project < local < env) and
@@ -23,7 +24,7 @@ const KIND_COLOR = {
 };
 
 const RUNTIME_ADVISORY =
-  "advisory/not enforced: this command edits and dry-runs settings rules; the Agent runtime still has separate ApprovalGate/managed-policy wiring.";
+  "settings rules are enforced by the Agent Core when loaded into the active runtime; managed host policy and ApprovalGate still apply.";
 
 function printRuntimeAdvisory() {
   logger.log(chalk.yellow(RUNTIME_ADVISORY));
@@ -48,6 +49,48 @@ function buildArgs(tool, positional, rulesMod) {
   return {};
 }
 
+async function persistPermissionRule(decision, rule, options, operation = "add") {
+  try {
+    const kind = String(decision || "").toLowerCase();
+    if (!["allow", "ask", "deny"].includes(kind)) {
+      logger.error(
+        chalk.red(`decision must be allow | ask | deny (got "${decision}")`),
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const rulesMod = await import("../lib/permission-rules.cjs");
+    const mod = rulesMod.default || rulesMod;
+    if (!mod.parseRule(rule)) {
+      logger.error(
+        chalk.red(
+          `not a valid rule: "${rule}" (expected Tool or Tool(pattern), e.g. Bash(rm:*))`,
+        ),
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const scope = options.user ? "user" : options.local ? "local" : "project";
+    const { addRule } = await import("../lib/settings-loader.cjs");
+    const { file, added } = addRule({
+      cwd: process.cwd(),
+      kind,
+      rule,
+      scope,
+    });
+    if (!added) {
+      logger.log(chalk.gray(`already present in ${file}: ${kind} ${rule}`));
+      return;
+    }
+    logger.log(
+      `${KIND_COLOR[kind].bold("✓ " + kind)} ${rule} ${chalk.gray("→ " + file)}`,
+    );
+  } catch (err) {
+    logger.error(chalk.red(`permissions ${operation} failed: ${err.message}`));
+    process.exitCode = 1;
+  }
+}
+
 export function registerPermissionsCommand(program) {
   const cmd = program
     .command("permissions")
@@ -336,4 +379,17 @@ export function registerPermissionsCommand(program) {
         process.exitCode = 1;
       }
     });
+
+  // Explicit decision commands make the management surface easier to script
+  // and match the common `allow <rule>` / `deny <rule>` workflow.
+  for (const decision of ["allow", "ask", "deny"]) {
+    cmd
+      .command(`${decision} <rule>`)
+      .description(`Append an ${decision} permission rule`)
+      .option("--local", "Write to .claude/settings.local.json")
+      .option("--user", "Write to ~/.claude/settings.json")
+      .action(async (rule, options) => {
+        await persistPermissionRule(decision, rule, options, decision);
+      });
+  }
 }

package/src/commands/plugin.js

@@ -1314,6 +1314,7 @@ export function registerPluginCommand(program) {
         const scope = options.scope === "project" ? "project" : "user";
         const current = optsMod.loadPluginOptionValues(name, scope, {
           cwd: process.cwd(),
+          schema,
         });
         for (const pair of options.set) {
           const eq = pair.indexOf("=");
@@ -1326,6 +1327,7 @@ export function registerPluginCommand(program) {
         }
         optsMod.setPluginOptionValues(name, current, scope, {
           cwd: process.cwd(),
+          schema,
         });
         logger.success(`Set option(s) for ${name} at ${scope} scope`);
       }

package/src/commands/review.js

@@ -28,18 +28,22 @@
  * .chainlesschain/config.json `llm` exactly like `cc agent` / `cc ask`.
  */
 
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { firstBalancedJson } from "../lib/json-schema-output.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
 import {
   dedupeFindings,
   buildReviewReport,
   findingKey,
 } from "../lib/review-pipeline.js";
 
+export const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
+
 /** Diffs larger than this are truncated before going to the model. */
 const MAX_DIFF_CHARS = 200_000;
 /** Per-untracked-file and total caps when inlining brand-new files. */
@@ -52,12 +56,16 @@ const VALID_EFFORTS = Object.freeze(["low", "medium", "high"]);
  * Run git with an argv array (no shell → no quoting hazards). UTF-8 in/out.
  * Returns trimmed stdout; throws with git's stderr on failure.
  */
-function gitCli(args, { cwd } = {}) {
-  const res = spawnSync("git", args, {
+export function gitCli(args, { cwd } = {}) {
+  const res = _deps.spawnSync("git", args, {
     cwd,
     encoding: "utf-8",
     windowsHide: true,
     maxBuffer: 256 * 1024 * 1024,
+    origin: "review:command-git",
+    policy: "allow",
+    scope: "review",
+    shell: false,
   });
   if (res.error) throw res.error;
   if (res.status !== 0) {
@@ -86,28 +94,28 @@ function isGitRepo(cwd, git = gitCli) {
  */
 export function resolveDiffArgs(opts = {}, stat = false) {
   const { staged, base, range, paths } = opts;
-  let args;
+  const args = ["diff"];
+  if (stat) args.push("--stat");
   let scope;
   let label;
   if (range) {
-    args = ["diff", range];
+    args.push("--end-of-options", range);
     scope = "range";
     label = `range ${range}`;
   } else if (base) {
     // three-dot: changes on HEAD since it diverged from <base> (PR-style).
-    args = ["diff", `${base}...HEAD`];
+    args.push("--end-of-options", `${base}...HEAD`);
     scope = "base";
     label = `${base}...HEAD`;
   } else if (staged) {
-    args = ["diff", "--cached"];
+    args.push("--cached");
     scope = "staged";
     label = "staged changes";
   } else {
-    args = ["diff", "HEAD"];
+    args.push("HEAD");
     scope = "working";
     label = "working tree vs HEAD";
   }
-  if (stat) args.push("--stat");
   const cleanPaths = Array.isArray(paths) ? paths.filter(Boolean) : [];
   if (cleanPaths.length) args.push("--", ...cleanPaths);
   return { args, scope, label };
@@ -361,13 +369,17 @@ function collectReviewDiff(scopeOpts, { cwd, git, includeUntracked }) {
 }
 
 /** Run `gh` with an argv array (no shell). UTF-8 in/out; throws on failure. */
-function ghCli(args, { cwd, input } = {}) {
-  const res = spawnSync("gh", args, {
+export function ghCli(args, { cwd, input } = {}) {
+  const res = _deps.spawnSync("gh", args, {
     cwd,
     input,
     encoding: "utf-8",
     windowsHide: true,
     maxBuffer: 64 * 1024 * 1024,
+    origin: "review:command-gh",
+    policy: "allow",
+    scope: "review",
+    shell: false,
   });
   if (res.error) throw res.error;
   if (res.status !== 0) {

package/src/commands/routine.js

@@ -13,11 +13,16 @@
  * agenda wakeup), exactly like `cc agenda run`.
  */
 
-import { spawn, execFile } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+  execFile: (...args) => executionBroker.execFile(...args),
+};
 
 const BIN_PATH = fileURLToPath(
   new URL("../../bin/chainlesschain.js", import.meta.url),
@@ -29,12 +34,18 @@ async function loadStore() {
 }
 
 /** Production runner: `cc agent -p <prompt> --output-format json`. */
-function defaultRunAgent({ prompt }) {
+export function defaultRunAgent({ prompt }) {
   return new Promise((resolve) => {
-    const child = spawn(
+    const child = _deps.spawn(
       process.execPath,
-      [BIN_PATH, "agent", "-p", prompt, "--output-format", "json"],
-      { windowsHide: true },
+      [BIN_PATH, "agent", "--output-format", "json"],
+      {
+        windowsHide: true,
+        origin: "routine:agent",
+        policy: "allow",
+        scope: "routine",
+        shell: false,
+      },
     );
     let out = "";
     let err = "";
@@ -42,6 +53,10 @@ function defaultRunAgent({ prompt }) {
     child.stderr?.setEncoding("utf8");
     child.stdout?.on("data", (d) => (out += d));
     child.stderr?.on("data", (d) => (err += d));
+    if (child.stdin) {
+      child.stdin.on("error", () => {});
+      child.stdin.end(prompt);
+    }
     child.on("error", (error) =>
       resolve({ exitCode: -1, output: `spawn error: ${error.message}` }),
     );
@@ -70,12 +85,20 @@ function defaultRunAgent({ prompt }) {
 }
 
 /** Production github events fetch via gh CLI. */
-function defaultFetchEvents(repo) {
+export function defaultFetchEvents(repo) {
   return new Promise((resolve) => {
-    execFile(
+    _deps.execFile(
       "gh",
       ["api", `repos/${repo}/events`, "--paginate=false"],
-      { encoding: "utf8", timeout: 8000, windowsHide: true },
+      {
+        encoding: "utf8",
+        timeout: 8000,
+        windowsHide: true,
+        origin: "routine:github-events",
+        policy: "allow",
+        scope: "routine",
+        shell: false,
+      },
       (err, stdout) => {
         if (err) return resolve([]);
         try {

package/src/commands/session.js

@@ -61,6 +61,11 @@ import {
   listWorkflowSessions,
   readWorkflowSession,
 } from "../lib/workflow-state-reader.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 // DB sessions store `updated_at` as SQLite datetime('now') → "YYYY-MM-DD
 // HH:MM:SS" (UTC, space at index 10); JSONL sessions store toISOString() →
@@ -149,8 +154,7 @@ export function mapGhPrToSignals(gh = {}) {
  * mapped signals, or throws (caller degrades to a "pass --checks-file" hint).
  * 8s timeout, stderr suppressed — a missing / unauthenticated gh just fails.
  */
-async function fetchPrSignalsViaGh(target) {
-  const { execFileSync } = await import("node:child_process");
+export async function fetchPrSignalsViaGh(target) {
   const args = [
     "pr",
     "view",
@@ -159,10 +163,14 @@ async function fetchPrSignalsViaGh(target) {
     "number,state,headRefName,headRefOid,reviewDecision,statusCheckRollup",
   ];
   if (target.repo) args.push("--repo", String(target.repo));
-  const out = execFileSync("gh", args, {
+  const out = _deps.execFileSync("gh", args, {
     encoding: "utf-8",
     timeout: 8000,
     stdio: ["ignore", "pipe", "ignore"],
+    origin: "session:pr-status",
+    policy: "allow",
+    scope: "pr",
+    shell: false,
   });
   return mapGhPrToSignals(JSON.parse(out));
 }

package/src/commands/team.js

@@ -18,12 +18,16 @@
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-import { spawn } from "child_process";
 import { TaskLeaseRegistry } from "../lib/agent-team/task-lease.js";
 import { TeamRunner } from "../lib/agent-team/team-runner.js";
 import { TeamWorktreeCoordinator } from "../lib/agent-team/team-worktree.js";
 import { TeamBudget } from "../lib/agent-team/team-budget.js";
 import { TeamMailbox } from "../lib/agent-team/team-mailbox.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
@@ -94,17 +98,20 @@ function planWaves(reg) {
 }
 
 /** Real executor: run a task's shell `command`, success = exit 0. */
-function makeShellRunTask(logger) {
+export function makeShellRunTask(logger) {
   return function runTask({ task }) {
     const command = task.metadata?.command || task?.command;
     if (!command) {
       throw new Error(`task "${task.key}" has no \`command\` to --exec`);
     }
     return new Promise((resolve, reject) => {
-      const child = spawn(command, {
+      const child = _deps.spawn(command, [], {
         cwd: process.cwd(),
         shell: true,
         env: process.env,
+        origin: "team:shell",
+        policy: "allow",
+        scope: "team",
       });
       let err = "";
       child.stderr?.on("data", (d) => (err += d.toString("utf8")));
@@ -118,26 +125,32 @@ function makeShellRunTask(logger) {
 }
 
 /** Spawn a headless `cc agent -p` for one prompt in `cwd`; resolve on exit 0. */
-function spawnAgent(prompt, cwd, opts = {}) {
+export function spawnAgent(prompt, cwd, opts = {}) {
   return new Promise((resolve, reject) => {
     const args = [
       BIN,
       "agent",
-      "-p",
-      prompt,
       "--permission-mode",
       opts.permissionMode || "acceptEdits",
       "--output-format",
       "text",
     ];
     if (opts.model) args.push("--model", opts.model);
-    const child = spawn(process.execPath, args, {
+    const child = _deps.spawn(process.execPath, args, {
       cwd,
       env: { ...process.env, CLAUDECODE: "1" },
       windowsHide: true,
+      origin: "team:agent",
+      policy: "allow",
+      scope: "team",
+      shell: false,
     });
     let err = "";
     child.stderr?.on("data", (d) => (err += d.toString("utf8")));
+    if (child.stdin) {
+      child.stdin.on("error", () => {});
+      child.stdin.end(prompt);
+    }
     child.on("error", (e) => reject(new Error(e.message)));
     child.on("close", (code) =>
       code === 0

package/src/commands/update.js

@@ -1,11 +1,58 @@
 import chalk from "chalk";
 import semver from "semver";
-import { execSync } from "node:child_process";
 import { checkForUpdates } from "../lib/version-checker.js";
 import { downloadRelease } from "../lib/downloader.js";
 import { VERSION } from "../constants.js";
 import { askConfirm } from "../lib/prompts.js";
 import logger from "../lib/logger.js";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+import { resolveNpmInvocation } from "../lib/npm-invocation.js";
+
+export const _deps = {
+  platform: process.platform,
+  execPath: process.execPath,
+  cliEntryPath: process.argv[1] || null,
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
+
+export function updateProcessInvocations(
+  platform = _deps.platform,
+  execPath = _deps.execPath,
+  cliEntryPath = _deps.cliEntryPath,
+) {
+  return {
+    npm: resolveNpmInvocation({ platform, execPath }),
+    chainlesschain: cliEntryPath
+      ? { command: execPath, prefixArgs: [cliEntryPath] }
+      : {
+          command:
+            platform === "win32" ? "chainlesschain.cmd" : "chainlesschain",
+          prefixArgs: [],
+        },
+  };
+}
+
+function runUpdateProcess(command, args, origin) {
+  const result = _deps.spawnSync(command, args, {
+    encoding: "utf-8",
+    stdio: "pipe",
+    origin,
+    policy: "allow",
+    scope: "update",
+    shell: false,
+  });
+  if (result?.error) throw result.error;
+  if (result?.status != null && result.status !== 0) {
+    const error = new Error(
+      `Update process failed (exit ${result.status}): ${command}`,
+    );
+    error.status = result.status;
+    error.stdout = result.stdout;
+    error.stderr = result.stderr;
+    throw error;
+  }
+  return String(result?.stdout || "");
+}
 
 /**
  * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`.
@@ -19,7 +66,7 @@ export function isInstallableVersion(v) {
   return typeof v === "string" && semver.valid(v) !== null;
 }
 
-async function selfUpdateCli(targetVersion) {
+export async function selfUpdateCli(targetVersion) {
   if (VERSION === targetVersion) {
     return true; // Already at the target version
   }
@@ -33,16 +80,24 @@ async function selfUpdateCli(targetVersion) {
 
   try {
     logger.info("Updating CLI package...");
-    execSync(`npm install -g chainlesschain@${targetVersion}`, {
-      encoding: "utf-8",
-      stdio: "pipe",
-    });
+    const invocations = updateProcessInvocations();
+    runUpdateProcess(
+      invocations.npm.command,
+      [
+        ...invocations.npm.prefixArgs,
+        "install",
+        "-g",
+        `chainlesschain@${targetVersion}`,
+      ],
+      "update:npm-install",
+    );
     // Verify the update actually took effect
     try {
-      const newVersion = execSync("chainlesschain --version", {
-        encoding: "utf-8",
-        stdio: "pipe",
-      }).trim();
+      const newVersion = runUpdateProcess(
+        invocations.chainlesschain.command,
+        [...invocations.chainlesschain.prefixArgs, "--version"],
+        "update:version-check",
+      ).trim();
       if (newVersion === targetVersion) {
         logger.success(`CLI updated to v${targetVersion}`);
         return true;

package/src/gateways/terminal/PtyManager.js

@@ -21,6 +21,7 @@ import EventEmitter from "events";
 import { randomUUID } from "crypto";
 import { createRequire } from "module";
 import { RingBuffer } from "./RingBuffer.js";
+import { executionBroker } from "../../lib/process-execution-broker/index.js";
 
 const require = createRequire(import.meta.url);
 
@@ -66,6 +67,7 @@ export class PtyManager extends EventEmitter {
     this.config = { ...DEFAULT_CONFIG, ...(opts.config || {}) };
     this._deps = {
       loadNodePty: opts._deps?.loadNodePty || (() => require("node-pty")),
+      spawnPty: opts._deps?.spawnPty || null,
       now: opts._deps?.now || (() => Date.now()),
     };
     this._sessions = new Map();
@@ -110,12 +112,17 @@ export class PtyManager extends EventEmitter {
       req.env && typeof req.env === "object" && !Array.isArray(req.env)
         ? req.env
         : {};
-    const proc = pty.spawn(cmd, [], {
+    const spawnPty =
+      this._deps.spawnPty || executionBroker.spawnPty.bind(executionBroker);
+    const proc = spawnPty(pty, cmd, [], {
       name: "xterm-256color",
       cols,
       rows,
       cwd,
       env: { ...process.env, ...extraEnv },
+      origin: "terminal:pty",
+      policy: "allow",
+      scope: "terminal",
     });
 
     const sessionId = randomUUID();

package/src/gateways/ws/message-dispatcher.js

@@ -110,6 +110,9 @@ export function createWsMessageDispatcher(server) {
         "session-close": () => server._handleSessionClose(id, ws, message),
         "session-interrupt": () =>
           server._handleSessionInterrupt(id, ws, message),
+        "permission-rules-get": () => server._handlePermissionRulesGet(id, ws),
+        "permission-rules-set": () =>
+          server._handlePermissionRulesSet(id, ws, message),
         "slash-command": () => server._handleSlashCommand(id, ws, message),
         "session-answer": () => server._handleSessionAnswer(id, ws, message),
         "remote-session-create": () =>

package/src/gateways/ws/session-protocol.js

@@ -96,6 +96,27 @@ async function ensureSessionHandler(server, ws, session) {
     envelopeBus: server.envelopeBus || null,
   });
 
+  // Route MCP elicitation through the authenticated WS question channel. The
+  // MCP client may be shared by the runtime, so this is deliberately only a
+  // transport hook; the MCP request/answer ids remain inside the pending
+  // interaction entry and unknown answers are ignored by the adapter.
+  if (
+    session.mcpClient &&
+    typeof session.mcpClient.setElicitationHandler === "function"
+  ) {
+    session.mcpClient.setElicitationHandler(
+      async (request) => {
+        const answer = await session.interaction.askElicitation(request);
+        if (answer == null) return { action: "cancel" };
+        if (typeof answer === "object") {
+          return { action: "accept", content: answer };
+        }
+        return { action: "accept", content: { value: answer } };
+      },
+      { sessionId: session.id, timeoutMs: 180000 },
+    );
+  }
+
   let handler;
   if (session.type === "chat") {
     const { WSChatHandler } = await import("../../lib/ws-chat-handler.js");
@@ -444,6 +465,11 @@ export function handleSessionList(server, id, ws) {
 export function handleSessionClose(server, id, ws, message) {
   const { sessionId } = message;
 
+  const closingSession = server.sessionManager?.getSession?.(sessionId);
+  if (closingSession?.mcpClient?.clearElicitationHandler) {
+    closingSession.mcpClient.clearElicitationHandler(sessionId);
+  }
+
   const handler = server.sessionHandlers.get(sessionId);
   if (handler && handler.destroy) {
     handler.destroy();