chainlesschain 0.162.175 → 0.162.176

package/src/gateways/ws/ws-agent-handler.js

@@ -13,6 +13,7 @@
 
 import { agentLoop, formatToolArgs } from "../../runtime/agent-core.js";
 import { classifyToolSideEffect } from "../../lib/side-effect-ledger.js";
+import { DiffReviewFollowUpTracker } from "../../lib/diff-review-follow-up.js";
 import {
   loadSideEffectLedger,
   persistSideEffectLedger,
@@ -88,6 +89,8 @@ export class WSAgentHandler {
     const abortController = new AbortController();
     this._abortController = abortController;
     this._activeRequestId = requestId || null;
+    let sideEffectLedger = null;
+    let diffReviewFollowUps = null;
 
     try {
       const { session } = this;
@@ -159,88 +162,123 @@ export class WSAgentHandler {
       // persisted BEFORE it settles) and commit/fail on its result, so a bridge
       // worker killed mid-flight is surfaced for verification on resume (see
       // handleSessionResume) instead of being blindly replayed.
-      const sideEffectLedger = loadSideEffectLedger(session.id);
+      sideEffectLedger = loadSideEffectLedger(session.id);
+      diffReviewFollowUps = new DiffReviewFollowUpTracker(sideEffectLedger);
       let currentSideEffectOpId = null;
 
-      for await (const event of agentLoop(session.messages, loopOptions)) {
-        switch (event.type) {
-          case "slot-filling":
-            this.interaction.emit("slot-filling", {
-              requestId,
-              slot: event.slot,
-              question: event.question,
-            });
-            break;
-
-          case "tool-executing":
-            this.interaction.emit("tool-executing", {
-              requestId,
-              tool: event.tool,
-              args: event.args,
-              display: formatToolArgs(event.tool, event.args),
-            });
-            currentSideEffectOpId = null;
-            {
-              const se = classifyToolSideEffect(event.tool, event.args);
-              if (se) {
-                const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
-                currentSideEffectOpId = opId;
-                sideEffectLedger
-                  .prepare(opId, {
-                    kind: se.kind,
-                    key: se.key,
-                    meta: {
-                      tool: event.tool,
-                      idempotencyKey: operationIdempotencyKey({
+      const runAgentTurn = async () => {
+        for await (const event of agentLoop(session.messages, loopOptions)) {
+          switch (event.type) {
+            case "slot-filling":
+              this.interaction.emit("slot-filling", {
+                requestId,
+                slot: event.slot,
+                question: event.question,
+              });
+              break;
+
+            case "tool-executing":
+              this.interaction.emit("tool-executing", {
+                requestId,
+                tool: event.tool,
+                args: event.args,
+                display: formatToolArgs(event.tool, event.args),
+              });
+              currentSideEffectOpId = null;
+              {
+                const se = classifyToolSideEffect(event.tool, event.args);
+                if (se) {
+                  const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
+                  currentSideEffectOpId = opId;
+                  sideEffectLedger
+                    .prepare(opId, {
+                      kind: se.kind,
+                      key: se.key,
+                      meta: {
                         tool: event.tool,
-                        args: event.args,
-                      }),
-                    },
-                  })
-                  .start(opId);
+                        idempotencyKey: operationIdempotencyKey({
+                          tool: event.tool,
+                          args: event.args,
+                        }),
+                      },
+                    })
+                    .start(opId);
+                  persistSideEffectLedger(session.id, sideEffectLedger);
+                }
+              }
+              break;
+
+            case "tool-result":
+              this.interaction.emit("tool-result", {
+                requestId,
+                tool: event.tool,
+                result: event.result,
+                error: event.error,
+              });
+              if (currentSideEffectOpId) {
+                const err = event.error || event.result?.error || null;
+                if (event.result?._diffReviewAudit) {
+                  diffReviewFollowUps.observe(
+                    sideEffectLedger,
+                    currentSideEffectOpId,
+                    event.result._diffReviewAudit,
+                  );
+                }
+                if (err)
+                  sideEffectLedger.fail(
+                    currentSideEffectOpId,
+                    String(err).slice(0, 200),
+                  );
+                else sideEffectLedger.commit(currentSideEffectOpId);
                 persistSideEffectLedger(session.id, sideEffectLedger);
+                currentSideEffectOpId = null;
               }
-            }
-            break;
-
-          case "tool-result":
-            this.interaction.emit("tool-result", {
-              requestId,
-              tool: event.tool,
-              result: event.result,
-              error: event.error,
-            });
-            if (currentSideEffectOpId) {
-              const err = event.error || event.result?.error || null;
-              if (err)
-                sideEffectLedger.fail(
-                  currentSideEffectOpId,
-                  String(err).slice(0, 200),
-                );
-              else sideEffectLedger.commit(currentSideEffectOpId);
-              persistSideEffectLedger(session.id, sideEffectLedger);
-              currentSideEffectOpId = null;
-            }
-            break;
-
-          case "response-complete":
-            if (event.content) {
-              session.messages.push({
-                role: "assistant",
+              break;
+
+            case "response-complete":
+              if (event.content) {
+                session.messages.push({
+                  role: "assistant",
+                  content: event.content,
+                });
+              }
+              this.interaction.emit("response-complete", {
+                requestId,
                 content: event.content,
               });
-            }
-            this.interaction.emit("response-complete", {
-              requestId,
-              content: event.content,
-            });
-            break;
+              break;
+          }
         }
+      };
+
+      if (session.mcpClient?.withElicitationContext) {
+        await session.mcpClient.withElicitationContext(
+          session.id,
+          runAgentTurn,
+        );
+      } else {
+        await runAgentTurn();
+      }
+      if (
+        diffReviewFollowUps.complete(sideEffectLedger, {
+          status: "completed-without-reproposal",
+        }).length > 0
+      ) {
+        persistSideEffectLedger(session.id, sideEffectLedger);
       }
 
       // Update last activity
       session.lastActivity = new Date().toISOString();
     } catch (err) {
+      if (
+        sideEffectLedger &&
+        diffReviewFollowUps?.complete(sideEffectLedger, {
+          status: "interrupted",
+          reason: isAbortError(err) ? "aborted" : err.message,
+        }).length > 0
+      ) {
+        persistSideEffectLedger(this.session.id, sideEffectLedger);
+      }
       if (isAbortError(err) || abortController.signal.aborted) {
         return;
       }

package/src/gateways/ws/ws-server.js

@@ -11,7 +11,6 @@
  */
 
 import { EventEmitter } from "node:events";
-import { spawn } from "node:child_process";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -113,6 +112,11 @@ import {
   handleArtifactRemove,
   handleArtifactShow,
 } from "./artifact-protocol.js";
+import { executionBroker } from "../../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -216,6 +220,7 @@ export class ChainlessChainWSServer extends EventEmitter {
    * @param {string}  [options.token]           - If set, clients must authenticate first
    * @param {number}  [options.maxConnections=10]
    * @param {number}  [options.timeout=30000]   - Command execution timeout (ms)
+   * @param {Function} [options.spawn]           - Process seam for tests
    */
   constructor(options = {}) {
     super();
@@ -240,6 +245,7 @@ export class ChainlessChainWSServer extends EventEmitter {
     // grace window so it can't hold a maxConnections slot forever (see
     // AUTH_TIMEOUT_MS). `??` so an explicit 0 (disable) is honoured.
     this.authTimeoutMs = options.authTimeoutMs ?? AUTH_TIMEOUT_MS;
+    this._spawnProcess = options.spawn || _deps.spawn;
 
     /** Optional Phase-5 envelope bus for fan-out to hosted HTTP SSE. */
     this.envelopeBus = options.envelopeBus || null;
@@ -255,6 +261,7 @@ export class ChainlessChainWSServer extends EventEmitter {
 
     /** Session manager for stateful agent/chat sessions */
     this.sessionManager = options.sessionManager || null;
+    this.projectRoot = options.projectRoot || process.cwd();
 
     /** Session handlers: sessionId → WSAgentHandler | WSChatHandler */
     this.sessionHandlers = new Map();
@@ -530,6 +537,67 @@ export class ChainlessChainWSServer extends EventEmitter {
     return this._dispatcher.dispatch(clientId, ws, message);
   }
 
+  /** Read the same .claude settings rules used by the Agent Core. */
+  async _handlePermissionRulesGet(id, ws) {
+    try {
+      const { loadSettings } = await import("../../lib/settings-loader.cjs");
+      const loaded = loadSettings({ cwd: this.projectRoot });
+      this._send(ws, {
+        id,
+        type: "permission-rules",
+        rules: loaded.rules,
+        sources: loaded.sources,
+        files: loaded.files,
+        managed: loaded.managed || null,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_READ_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
+  /** Persist one rule through settings-loader; managed policy remains authoritative. */
+  async _handlePermissionRulesSet(id, ws, message) {
+    try {
+      const decision = String(message.decision || "").toLowerCase();
+      if (!["allow", "ask", "deny"].includes(decision)) {
+        throw new Error("decision must be allow, ask, or deny");
+      }
+      const rulesMod = await import("../../lib/permission-rules.cjs");
+      const mod = rulesMod.default || rulesMod;
+      if (!mod.parseRule(message.rule)) throw new Error("invalid permission rule");
+      const { addRule } = await import("../../lib/settings-loader.cjs");
+      const scope = ["project", "local", "user"].includes(message.scope)
+        ? message.scope
+        : "project";
+      const result = addRule({
+        cwd: this.projectRoot,
+        kind: decision,
+        rule: message.rule,
+        scope,
+      });
+      this._send(ws, {
+        id,
+        type: "permission-rule-updated",
+        ...result,
+        decision,
+        rule: message.rule,
+        scope,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_WRITE_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
   /**
    * Handle an orchestrate message — runs ChainlessChain orchestration with
    * real-time progress pushed back over this WebSocket connection.
@@ -854,7 +922,7 @@ export class ChainlessChainWSServer extends EventEmitter {
       return;
     }
 
-    const child = spawn(process.execPath, [BIN_PATH, ...args], {
+    const child = this._spawnProcess(process.execPath, [BIN_PATH, ...args], {
       env: {
         ...process.env,
         FORCE_COLOR: "0",
@@ -870,6 +938,10 @@ export class ChainlessChainWSServer extends EventEmitter {
       },
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
+      origin: "gateway:ws-command",
+      policy: "allow",
+      scope: "gateway",
+      shell: false,
     });
 
     this.processes.set(id, child);

package/src/harness/jsonl-session-store.js

@@ -20,6 +20,7 @@ import {
   verifyTranscriptText,
   TRANSCRIPT_CHAIN_STATUS,
 } from "./transcript-integrity.js";
+import { withFileLock } from "../lib/with-file-lock.js";
 
 function getSessionsDir() {
   const dir = join(getHomeDir(), "sessions");
@@ -82,12 +83,18 @@ function _resolveChainTail(sessionId, filePath) {
 
 export function appendEvent(sessionId, type, data) {
   const filePath = sessionPath(sessionId);
-  const prevHash = _resolveChainTail(sessionId, filePath);
-  const core = { type, timestamp: Date.now(), data };
-  const hash = computeEventHash(prevHash, core);
-  const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
-  appendFileSync(filePath, line, "utf-8");
-  _chainTailCache.set(sessionId, hash);
+  withFileLock(
+    filePath,
+    () => {
+      const prevHash = _resolveChainTail(sessionId, filePath);
+      const core = { type, timestamp: Date.now(), data };
+      const hash = computeEventHash(prevHash, core);
+      const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
+      appendFileSync(filePath, line, "utf-8");
+      _chainTailCache.set(sessionId, hash);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /**

package/src/harness/mcp-client.js

@@ -9,9 +9,12 @@
  */
 
 import { spawn } from "child_process";
+import { executionBroker } from "../lib/process-execution-broker/index.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { EventEmitter } from "events";
 import { pathToFileURL } from "url";
 import { safeJsonParse } from "../lib/safe-json.js";
+import { EventRuntimeProducer } from "../lib/event-runtime-producer.js";
 
 /**
  * Injectable dependencies — overridable from tests.
@@ -166,6 +169,178 @@ export class MCPClient extends EventEmitter {
       options && Array.isArray(options.roots) && options.roots.length > 0
         ? options.roots.map(String)
         : null;
+    // MCP elicitation (server -> client `elicitation/create`).  The handler is
+    // intentionally injected by the host (REPL, headless, or Desktop bridge)
+    // so the transport layer never reads stdin or invents an approval policy.
+    this._elicitationHandler =
+      typeof options.elicitationHandler === "function"
+        ? options.elicitationHandler
+        : null;
+    this._elicitationHandlers = new Map();
+    this._elicitationContext = new AsyncLocalStorage();
+    this._elicitationTimeoutMs =
+      Number(options.elicitationTimeoutMs) > 0
+        ? Number(options.elicitationTimeoutMs)
+        : 180000;
+    this._pendingElicitations = new Map();
+    this._runtimeProducer = options.eventRuntimeStore
+      ? new EventRuntimeProducer({ store: options.eventRuntimeStore, emitter: this })
+      : null;
+  }
+
+  /** Install or clear the host-side MCP elicitation resolver. */
+  setElicitationHandler(handler, options = {}) {
+    const sessionId = options.sessionId;
+    if (sessionId != null && sessionId !== "") {
+      const key = String(sessionId);
+      if (typeof handler === "function") this._elicitationHandlers.set(key, handler);
+      else this._elicitationHandlers.delete(key);
+    } else {
+      this._elicitationHandler =
+        typeof handler === "function" ? handler : null;
+    }
+    if (Number(options.timeoutMs) > 0) {
+      this._elicitationTimeoutMs = Number(options.timeoutMs);
+    }
+  }
+
+  /** Run an async agent turn with a session-scoped elicitation route. */
+  withElicitationContext(sessionId, fn) {
+    if (typeof fn !== "function") return Promise.resolve(undefined);
+    return this._elicitationContext.run(
+      sessionId == null ? null : String(sessionId),
+      fn,
+    );
+  }
+
+  /** Remove a session route when a WS session is closed. */
+  clearElicitationHandler(sessionId) {
+    if (sessionId == null || sessionId === "") return false;
+    return this._elicitationHandlers.delete(String(sessionId));
+  }
+
+  /** Resolve a pending server elicitation by its server/request id pair. */
+  respondElicitation(serverName, requestId, response) {
+    const key = this._elicitationKey(serverName, requestId);
+    const pending = this._pendingElicitations.get(key);
+    if (!pending) return false;
+    pending.resolve(this._normalizeElicitationResponse(response));
+    try {
+      this._runtimeProducer?.store.acknowledgeInbox(
+        `mcp-elicitation:${this._elicitationKey(serverName, requestId)}`,
+        { response: this._normalizeElicitationResponse(response) },
+      );
+    } catch {}
+    return true;
+  }
+
+  /** Cancel a pending server elicitation. */
+  cancelElicitation(serverName, requestId) {
+    return this.respondElicitation(serverName, requestId, {
+      action: "cancel",
+    });
+  }
+
+  _elicitationKey(serverName, requestId) {
+    return `${String(serverName)}:${String(requestId)}`;
+  }
+
+  _normalizeElicitationResponse(response) {
+    const action = String(response?.action || "decline").toLowerCase();
+    const safeAction = new Set(["accept", "decline", "cancel"]).has(action)
+      ? action
+      : "decline";
+    const normalized = { action: safeAction };
+    if (safeAction === "accept" && response?.content !== undefined) {
+      normalized.content = response.content;
+    }
+    return normalized;
+  }
+
+  async _resolveElicitation(serverName, requestId, params = {}) {
+    const key = this._elicitationKey(serverName, requestId);
+    try {
+      this._runtimeProducer?.publish(
+        { type: "mcp_elicitation", server: serverName, requestId, params },
+        { origin: "mcp", id: `mcp-elicitation:${key}` },
+      );
+    } catch (error) {
+      this.emit("elicitation-error", { server: serverName, requestId, error });
+      return { action: "cancel" };
+    }
+    const contextSessionId = this._elicitationContext.getStore();
+    const handler =
+      (contextSessionId && this._elicitationHandlers.get(contextSessionId)) ||
+      this._elicitationHandler;
+    if (handler) {
+      try {
+        const direct = await handler({
+          server: serverName,
+          requestId,
+          ...params,
+        });
+        if (direct !== undefined) {
+          const response = this._normalizeElicitationResponse(direct);
+          try {
+            this._runtimeProducer?.store.acknowledgeInbox(
+              `mcp-elicitation:${key}`,
+              { response },
+            );
+          } catch {}
+          return response;
+        }
+      } catch (error) {
+        this.emit("elicitation-error", {
+          server: serverName,
+          requestId,
+          error,
+        });
+        return { action: "cancel" };
+      }
+    }
+
+    // An event-driven host may answer later through respondElicitation().
+    // No handler/listener means fail closed with decline rather than leaving a
+    // server request hanging indefinitely.
+    if (this.listenerCount("elicitation-request") === 0) {
+      try {
+        this._runtimeProducer?.store.acknowledgeInbox(
+          `mcp-elicitation:${key}`,
+          { response: { action: "decline" } },
+        );
+      } catch {}
+      return { action: "decline" };
+    }
+    return new Promise((resolve) => {
+      const timeout = setTimeout(() => {
+        this._pendingElicitations.delete(key);
+        this.emit("elicitation-timeout", { server: serverName, requestId });
+        try {
+          this._runtimeProducer?.store.fail(
+            "inbox",
+            `mcp-elicitation:${key}`,
+            "elicitation timeout",
+            { retryDelayMs: 0, maxAttempts: 1 },
+          );
+        } catch {}
+        resolve({ action: "cancel" });
+      }, this._elicitationTimeoutMs);
+      timeout.unref?.();
+      this._pendingElicitations.set(key, {
+        resolve: (response) => {
+          clearTimeout(timeout);
+          this._pendingElicitations.delete(key);
+          resolve(this._normalizeElicitationResponse(response));
+        },
+      });
+      this.emit("elicitation-request", {
+        server: serverName,
+        requestId,
+        ...params,
+        respond: (response) => this.respondElicitation(serverName, requestId, response),
+        cancel: () => this.cancelElicitation(serverName, requestId),
+      });
+    });
   }
 
   /**
@@ -311,7 +486,10 @@ export class MCPClient extends EventEmitter {
             `stdio transport requires a command (server "${name}")`,
           );
         }
-        const proc = _deps.spawn(config.command, config.args || [], {
+        const spawnFn = String(config.origin || "").startsWith("plugin:")
+          ? executionBroker.spawn.bind(executionBroker)
+          : _deps.spawn;
+        const proc = spawnFn(config.command, config.args || [], {
           stdio: ["pipe", "pipe", "pipe"],
           // process.env < agent identity (CLAUDECODE / session id) < the
           // server's own config.env, so an explicit per-server override wins.
@@ -320,6 +498,15 @@ export class MCPClient extends EventEmitter {
             ...this._agentIdentityEnv(),
             ...(config.env || {}),
           },
+          ...(config.origin
+            ? {
+                origin: config.origin,
+                policy: config.policy || "allow",
+                pluginId: config.pluginId,
+                pluginVersion: config.pluginVersion,
+                pluginSource: config.pluginSource,
+              }
+            : {}),
         });
 
         entry.process = proc;
@@ -510,6 +697,12 @@ export class MCPClient extends EventEmitter {
     const entry = this.servers.get(name);
     if (!entry) return false;
 
+    for (const [key, pending] of this._pendingElicitations) {
+      if (key.startsWith(`${String(name)}:`)) {
+        pending.resolve({ action: "cancel" });
+      }
+    }
+
     if (entry.process) {
       entry.process.kill();
     }
@@ -1125,6 +1318,12 @@ export class MCPClient extends EventEmitter {
       this._sendResponse(serverName, id, {});
       return;
     }
+    if (method === "elicitation/create") {
+      this._resolveElicitation(serverName, id, msg.params || {})
+        .then((response) => this._sendResponse(serverName, id, response))
+        .catch(() => this._sendResponse(serverName, id, { action: "cancel" }));
+      return;
+    }
     this._sendResponse(serverName, id, undefined, {
       code: -32601,
       message: `method not found: ${method}`,

package/src/lib/__tests__/personal-data-hub-aichat-wizard.test.js

@@ -91,6 +91,21 @@ describe("createVendorAdapterBridge (cli)", () => {
     expect(r.userId).toBe("userToken");
   });
 
+  it("attaches a validated session to the registry runtime adapter", async () => {
+    const runtimeAdapter = { setSession: vi.fn() };
+    const bridge = createVendorAdapterBridge({
+      specs: [fakeSpec("deepseek", async () => ({ ok: true }))],
+      runtimeAdapter,
+      _httpClientFactory: () => ({}),
+    });
+
+    await bridge.registerVendor("deepseek", { userToken: "abc" });
+
+    expect(runtimeAdapter.setSession).toHaveBeenCalledOnce();
+    expect(runtimeAdapter.setSession.mock.calls[0][0]).toBe("deepseek");
+    expect(runtimeAdapter.setSession.mock.calls[0][1].get("userToken")).toBe("abc");
+  });
+
   it("UNKNOWN_VENDOR for unrecognized", async () => {
     const bridge = createVendorAdapterBridge({
       specs: [fakeSpec("deepseek", async () => ({ ok: true }))],

package/src/lib/agent-coordinator.js

@@ -281,6 +281,8 @@ export const ROLE_TOOL_WHITELIST = {
     "read_file",
     "write_file",
     "edit_file",
+    "delete_file",
+    "move_file",
     "run_shell",
     "search_files",
     "list_dir",
@@ -297,6 +299,8 @@ export const ROLE_TOOL_WHITELIST = {
     "read_file",
     "write_file",
     "edit_file",
+    "delete_file",
+    "move_file",
     "run_shell",
     "search_files",
     "list_dir",