chainlesschain 0.162.175 → 0.162.176

package/src/lib/plugin-runtime/bin.js

@@ -17,6 +17,7 @@
  */
 
 import path from "path";
+import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
@@ -135,3 +136,47 @@ export function applyPluginBinPath(opts = {}) {
     },
   };
 }
+
+/**
+ * Resolve the first executable token of a shell command to a trusted plugin
+ * bin. This is intentionally conservative: only an existing file directly
+ * under a collected plugin bin directory is attributed.
+ *
+ * @param {string} command
+ * @param {object} [opts] { cwd, scopes }
+ * @returns {{pluginId:string,pluginVersion:string,pluginSource:string,scope:string,binPath:string}|null}
+ */
+export function resolvePluginBinCommand(command, opts = {}) {
+  if (typeof command !== "string") return null;
+  const match = command.match(/^\s*(?:"([^"]+)"|'([^']+)'|([^\s]+))/);
+  const token = match?.[1] || match?.[2] || match?.[3] || "";
+  if (!token) return null;
+  const tokenBase = path.basename(token).toLowerCase();
+  const candidates = new Set([tokenBase]);
+  if (process.platform === "win32" && !path.extname(tokenBase)) {
+    candidates.add(`${tokenBase}.exe`);
+    candidates.add(`${tokenBase}.cmd`);
+    candidates.add(`${tokenBase}.bat`);
+  }
+  for (const entry of collectPluginBinDirs(opts)) {
+    for (const candidateName of candidates) {
+      const binPath = path.join(entry.dir, candidateName);
+      if (!fs.existsSync(binPath)) continue;
+      if (path.isAbsolute(token)) {
+        try {
+          if (path.resolve(token) !== path.resolve(binPath)) continue;
+        } catch {
+          continue;
+        }
+      }
+      return {
+        pluginId: entry.plugin,
+        pluginVersion: entry.version || null,
+        pluginSource: entry.dir,
+        scope: entry.scope || null,
+        binPath,
+      };
+    }
+  }
+  return null;
+}

package/src/lib/plugin-runtime/hooks.js

@@ -122,7 +122,20 @@ export function collectPluginHooks(opts = {}) {
     const map = normalizeHookMap(parsed);
     for (const [event, entries] of Object.entries(map)) {
       if (!Array.isArray(entries)) continue;
-      merged[event] = (merged[event] || []).concat(entries);
+      const tagged = entries.map((group) => {
+        if (!group || typeof group !== "object" || !Array.isArray(group.hooks)) return group;
+        return {
+          ...group,
+          hooks: group.hooks.map((hook) => ({
+            ...hook,
+            origin: "plugin:hook",
+            pluginId: p.name,
+            pluginVersion: p.version || null,
+            pluginSource: p.manifest?.manifestPath || null,
+          })),
+        };
+      });
+      merged[event] = (merged[event] || []).concat(tagged);
     }
   }
   warnHookCapabilityDeniedOnce(denied);

package/src/lib/plugin-runtime/install.js

@@ -29,7 +29,7 @@ import {
   discoverPlugins,
 } from "./scopes.js";
 import { verifyPluginManifest } from "../plugin-security.js";
-import { writePluginLock, LOCK_FILENAME } from "./signature.js";
+import { writePluginLock, buildPluginSbom, LOCK_FILENAME } from "./signature.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -118,6 +118,7 @@ export function installFromDirectory(srcDir, opts = {}) {
       signatureVerified: verification.signatureVerified === true,
       signatureBase64: verification.signatureBase64,
       publicKeyPem: verification.publicKeyPem,
+      sbom: buildPluginSbom(dest),
     });
   }
 

package/src/lib/plugin-runtime/lsp.js

@@ -91,6 +91,9 @@ export function ensurePluginLspServers(opts = {}) {
           args: s.args,
           extensions: s.extensions,
           id: s.id,
+          pluginId: p.name,
+          pluginVersion: p.version,
+          pluginSource: s.absPath || p.manifest.manifestPath,
         });
         registered.push({ plugin: p.name, languageId: s.languageId, id: s.id });
       } catch {

package/src/lib/plugin-runtime/mcp.js

@@ -119,7 +119,14 @@ export function collectPluginMcpServers(opts = {}) {
     for (const [name, cfg] of Object.entries(map)) {
       if (!cfg || typeof cfg !== "object") continue;
       if (name in servers) continue; // first plugin wins on a clash
-      servers[name] = cfg;
+      servers[name] = {
+        ...cfg,
+        origin: "plugin:mcp",
+        policy: "allow",
+        pluginId: p.name,
+        pluginVersion: p.version,
+        pluginSource: m.absPath || p.manifest.manifestPath,
+      };
       added++;
     }
     if (added > 0 && m.absPath) sources.push(m.absPath);

package/src/lib/plugin-runtime/monitors.js

@@ -81,6 +81,10 @@ function normalizeMonitor(plugin, raw) {
     intervalMs,
     env,
     cwd: plugin.root,
+    origin: "plugin:monitor",
+    pluginId: plugin.name,
+    pluginVersion: plugin.version,
+    pluginSource: plugin.manifest?.manifestPath || null,
   };
 }
 

package/src/lib/plugin-runtime/plugin-options.js

@@ -26,12 +26,18 @@ import {
   validateOptions,
   redactSensitiveOptions,
 } from "./capabilities.js";
+import {
+  createSecretStore,
+  isSecretRef,
+  secretRef,
+} from "../secret-store.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
   readFileSync: fs.readFileSync,
   writeFileSync: fs.writeFileSync,
   mkdirSync: fs.mkdirSync,
+  secretStore: () => createSecretStore(),
   userStorePath: () =>
     path.join(getElectronUserDataDir(), "plugin-options.json"),
   projectStorePath: (cwd) =>
@@ -54,20 +60,70 @@ function writeJsonObject(p, obj) {
 }
 
 /** Load a plugin's option VALUES at the given scope (`user` | `project`). */
-export function loadPluginOptionValues(name, scope, { cwd } = {}) {
+export function loadPluginOptionValues(name, scope, { cwd, schema, secretStore } = {}) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
   const store = readJsonObject(p);
   const v = store[name];
-  return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+  if (!v || typeof v !== "object" || Array.isArray(v)) return {};
+  const out = { ...v };
+  const normalized = schema || {};
+  for (const [key, desc] of Object.entries(normalized)) {
+    if (!desc?.sensitive || !isSecretRef(out[key])) continue;
+    try {
+      const value = (secretStore || _deps.secretStore)().get(out[key].__cc_secret_ref);
+      if (value != null) out[key] = value;
+      else delete out[key];
+    } catch {
+      // Missing/unavailable secret backends fail closed: do not expose a
+      // plaintext fallback and let validation keep the option at its default.
+      delete out[key];
+    }
+  }
+  return out;
 }
 
 /** Persist a plugin's option VALUES at a scope (replaces the plugin's entry). */
-export function setPluginOptionValues(name, values, scope, { cwd } = {}) {
+export function setPluginOptionValues(
+  name,
+  values,
+  scope,
+  { cwd, schema, secretStore } = {},
+) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
   const store = readJsonObject(p);
-  store[name] = values && typeof values === "object" ? values : {};
+  const input = values && typeof values === "object" ? values : {};
+  const persisted = { ...input };
+  const normalized = schema || {};
+  let secrets = null;
+  const getSecrets = () => {
+    if (!secrets) secrets = (secretStore || _deps.secretStore)();
+    return secrets;
+  };
+  const rejectedSensitive = [];
+  for (const [key, desc] of Object.entries(normalized)) {
+    if (!desc?.sensitive || !Object.prototype.hasOwnProperty.call(input, key)) continue;
+    // Project files are shareable and must never receive a sensitive value.
+    if (scope === "project") {
+      delete persisted[key];
+      rejectedSensitive.push(key);
+      continue;
+    }
+    if (input[key] == null || input[key] === "") {
+      delete persisted[key];
+      try { getSecrets().delete(`${name}/${key}`); } catch {}
+      continue;
+    }
+    getSecrets().set(`${name}/${key}`, input[key]);
+    persisted[key] = secretRef(`${name}/${key}`);
+  }
+  if (rejectedSensitive.length > 0) {
+    persisted.__cc_rejected_sensitive = [...new Set(rejectedSensitive)].sort();
+  } else if (Object.prototype.hasOwnProperty.call(persisted, "__cc_rejected_sensitive")) {
+    delete persisted.__cc_rejected_sensitive;
+  }
+  store[name] = persisted;
   writeJsonObject(p, store);
   return { name, scope, path: p };
 }
@@ -107,10 +163,21 @@ export function resolvePluginOptions(
 
   const warnings = [];
   const droppedFromProject = [];
+  const projectInput = { ...(projectValues || {}) };
+  const rejectedSensitive = Array.isArray(projectInput.__cc_rejected_sensitive)
+    ? projectInput.__cc_rejected_sensitive
+    : [];
+  delete projectInput.__cc_rejected_sensitive;
+  for (const key of rejectedSensitive) {
+    droppedFromProject.push(key);
+    warnings.push(
+      `project: option "${key}" is sensitive and cannot be set from project config — use user scope / OS keychain`,
+    );
+  }
 
   // Project layer first (lower precedence). validateOptions errors on sensitive/
   // user-only keys at project scope — those are the drops we surface + refuse.
-  const proj = acceptedKeys(s, projectValues, "project");
+  const proj = acceptedKeys(s, projectInput, "project");
   for (const err of proj.res.errors) {
     if (/sensitive|user-scoped/.test(err)) {
       const m = err.match(/"([^"]+)"/);
@@ -145,7 +212,7 @@ export function resolvePluginOptions(
 /** Load both scopes' values from disk and resolve against a schema. */
 export function getResolvedPluginOptions(name, schema, { cwd } = {}) {
   return resolvePluginOptions(schema, {
-    userValues: loadPluginOptionValues(name, "user", { cwd }),
-    projectValues: loadPluginOptionValues(name, "project", { cwd }),
+    userValues: loadPluginOptionValues(name, "user", { cwd, schema }),
+    projectValues: loadPluginOptionValues(name, "project", { cwd, schema }),
   });
 }

package/src/lib/plugin-runtime/signature.js

@@ -30,8 +30,37 @@ export const _deps = {
   readFileSync: fs.readFileSync,
   writeFileSync: fs.writeFileSync,
   existsSync: fs.existsSync,
+  readdirSync: fs.readdirSync,
+  statSync: fs.statSync,
 };
 
+/** Build a deterministic file-level SBOM for an installed plugin directory. */
+export function buildPluginSbom(root) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of _deps.readdirSync(dir, { withFileTypes: true })) {
+      const abs = path.join(dir, entry.name);
+      const rel = path.relative(root, abs).replace(/\\/g, "/");
+      if (rel === LOCK_FILENAME) continue;
+      if (entry.isDirectory()) walk(abs);
+      else if (entry.isFile()) {
+        const bytes = _deps.readFileSync(abs);
+        files.push({
+          path: rel,
+          bytes: bytes.length,
+          sha256: createHash("sha256").update(bytes).digest("hex"),
+        });
+      }
+    }
+  };
+  walk(path.resolve(root));
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  const digest = createHash("sha256")
+    .update(files.map((file) => `${file.path}\0${file.sha256}\n`).join(""))
+    .digest("hex");
+  return { version: 1, digest, files };
+}
+
 /** Record a verified signature into the version dir. */
 export function writePluginLock(
   versionDir,
@@ -42,6 +71,7 @@ export function writePluginLock(
     signatureVerified,
     signatureBase64,
     publicKeyPem,
+    sbom = null,
   },
 ) {
   const rel = path.relative(versionDir, manifestFile).replace(/\\/g, "/");
@@ -55,6 +85,7 @@ export function writePluginLock(
     // lock is just self-asserted JSON and counts as unsigned.
     signatureBase64: signatureBase64 || null,
     publicKeyPem: publicKeyPem || null,
+    ...(sbom ? { sbom } : {}),
   };
   _deps.writeFileSync(
     path.join(versionDir, LOCK_FILENAME),
@@ -167,6 +198,20 @@ export function verifyInstalledSignature(plugin, opts = {}) {
       reason: "recorded signature does not verify over the on-disk manifest",
     };
   }
+  if (lock.sbom) {
+    let actualSbom;
+    try {
+      actualSbom = buildPluginSbom(plugin.root);
+    } catch {
+      return { signed: false, reason: "plugin SBOM cannot be read" };
+    }
+    if (
+      actualSbom.digest !== lock.sbom.digest ||
+      JSON.stringify(actualSbom.files) !== JSON.stringify(lock.sbom.files)
+    ) {
+      return { signed: false, reason: "plugin component SBOM mismatch" };
+    }
+  }
   const trustedKeys = opts.trustedKeys;
   if (trustedKeys && trustedKeys.size > 0) {
     if (!trustedKeys.has(publicKeySha256)) {

package/src/lib/pr-create.js

@@ -4,8 +4,23 @@
  * @module lib/pr-create
  */
 
-import { execSync } from "child_process";
 import { logger } from "./logger.js";
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
+
+function git(args, options = {}) {
+  return _deps.execFileSync("git", args, {
+    encoding: "utf8",
+    ...options,
+    origin: "pr:git",
+    policy: "allow",
+    scope: "pr",
+    shell: false,
+  });
+}
 
 /**
  * Get current git branch
@@ -13,9 +28,7 @@ import { logger } from "./logger.js";
  */
 export function getCurrentBranch() {
   try {
-    return execSync("git rev-parse --abbrev-ref HEAD", {
-      encoding: "utf8",
-    }).trim();
+    return git(["rev-parse", "--abbrev-ref", "HEAD"]).trim();
   } catch {
     return "main";
   }
@@ -27,7 +40,7 @@ export function getCurrentBranch() {
  */
 export function getRemoteUrl() {
   try {
-    return execSync("git remote get-url origin", { encoding: "utf8" }).trim();
+    return git(["remote", "get-url", "origin"]).trim();
   } catch {
     return null;
   }
@@ -58,7 +71,7 @@ export async function preparePullRequest(options = {}) {
   const repo = parseGitHubRepo();
 
   // Check for uncommitted changes
-  const status = execSync("git status --porcelain", { encoding: "utf8" });
+  const status = git(["status", "--porcelain"]);
   const hasChanges = status.trim().length > 0;
 
   if (hasChanges && !options.skipStash) {
@@ -72,13 +85,13 @@ export async function preparePullRequest(options = {}) {
   const logRange = `${defaultBase}...${branch}`;
   let commitLog = "";
   try {
-    commitLog = execSync(`git log ${logRange} --oneline`, { encoding: "utf8" });
+    commitLog = git(["log", "--oneline", "--end-of-options", logRange, "--"]);
   } catch {
     commitLog = "";
   }
 
   const prUrl = repo
-    ? `https://github.com/${repo.owner}/${repo.repo}/compare/${defaultBase}...${branch}?expand=1`
+    ? `https://github.com/${repo.owner}/${repo.repo}/compare/${encodeURIComponent(defaultBase)}...${encodeURIComponent(branch)}?expand=1`
     : null;
 
   logger.info(`Branch: ${branch}`);

package/src/lib/pr-link-ledger.js

@@ -17,11 +17,14 @@
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { getHomeDir } from "./paths.js";
+import { executionBroker } from "./process-execution-broker/index.js";
 
-export const _deps = { execFile, now: () => Date.now() };
+export const _deps = {
+  execFile: (...args) => executionBroker.execFile(...args),
+  now: () => Date.now(),
+};
 
 const MAX_LINKS_PER_SESSION = 20;
 const MAX_SESSIONS = 500;
@@ -150,7 +153,16 @@ function ghPrForBranch(cwd, timeoutMs = 3000) {
       _deps.execFile(
         file,
         fileArgs,
-        { cwd, encoding: "utf8", timeout: timeoutMs, windowsHide: true },
+        {
+          cwd,
+          encoding: "utf8",
+          timeout: timeoutMs,
+          windowsHide: true,
+          origin: "pr:link-query",
+          policy: "allow",
+          scope: "pr",
+          shell: false,
+        },
         (err, stdout) => resolve(err ? null : String(stdout || "").trim()),
       );
     });

package/src/lib/process-execution-broker/credential-agent.js

@@ -65,6 +65,11 @@ const ENV_ALLOWLIST = new Set([
   "VISUAL",
   "NODE_ENV",
   "NODE_OPTIONS",
+  // Correlation identifiers required by ChainlessChain/Claude-compatible
+  // child processes. These identify a run; they are not authentication
+  // credentials. Other SESSION-named variables remain filtered.
+  "CC_SESSION_ID",
+  "CLAUDE_CODE_SESSION_ID",
   "npm_config_registry",
   "npm_config_cache",
   "NPM_CONFIG_REGISTRY",
@@ -208,9 +213,10 @@ class CredentialAgent {
   }
 
   /**
-   * Apply credential filtering to spawn options
+   * Apply credential filtering and return explicit audit metadata. Credential
+   * values and proxy reference ids are intentionally kept out of the report.
    */
-  apply(spawnOptions) {
+  applyWithReport(spawnOptions) {
     const env = spawnOptions.env || process.env;
     const { safeEnv, redacted: envRedacted } = this.filterEnvironment(env);
     spawnOptions.env = safeEnv;
@@ -231,7 +237,21 @@ class CredentialAgent {
       if (this._accessLog.length > 10000) this._accessLog.shift();
     }
 
-    return spawnOptions;
+    return {
+      spawnOptions,
+      report: {
+        envKeys: envRedacted.map((entry) => entry.key),
+        argIndexes: argRedacted.map((entry) => entry.index),
+        envCount: envRedacted.length,
+        argCount: argRedacted.length,
+        filtered: envRedacted.length > 0 || argRedacted.length > 0,
+      },
+    };
+  }
+
+  /** Backward-compatible mutation API for existing integrations. */
+  apply(spawnOptions) {
+    return this.applyWithReport(spawnOptions).spawnOptions;
   }
 
   /**