chainlesschain 0.162.175 → 0.162.177

package/src/gateways/ws/session-protocol.js

@@ -96,6 +96,27 @@ async function ensureSessionHandler(server, ws, session) {
     envelopeBus: server.envelopeBus || null,
   });
 
+  // Route MCP elicitation through the authenticated WS question channel. The
+  // MCP client may be shared by the runtime, so this is deliberately only a
+  // transport hook; the MCP request/answer ids remain inside the pending
+  // interaction entry and unknown answers are ignored by the adapter.
+  if (
+    session.mcpClient &&
+    typeof session.mcpClient.setElicitationHandler === "function"
+  ) {
+    session.mcpClient.setElicitationHandler(
+      async (request) => {
+        const answer = await session.interaction.askElicitation(request);
+        if (answer == null) return { action: "cancel" };
+        if (typeof answer === "object") {
+          return { action: "accept", content: answer };
+        }
+        return { action: "accept", content: { value: answer } };
+      },
+      { sessionId: session.id, timeoutMs: 180000 },
+    );
+  }
+
   let handler;
   if (session.type === "chat") {
     const { WSChatHandler } = await import("../../lib/ws-chat-handler.js");
@@ -444,6 +465,11 @@ export function handleSessionList(server, id, ws) {
 export function handleSessionClose(server, id, ws, message) {
   const { sessionId } = message;
 
+  const closingSession = server.sessionManager?.getSession?.(sessionId);
+  if (closingSession?.mcpClient?.clearElicitationHandler) {
+    closingSession.mcpClient.clearElicitationHandler(sessionId);
+  }
+
   const handler = server.sessionHandlers.get(sessionId);
   if (handler && handler.destroy) {
     handler.destroy();

package/src/gateways/ws/ws-agent-handler.js

@@ -13,6 +13,7 @@
 
 import { agentLoop, formatToolArgs } from "../../runtime/agent-core.js";
 import { classifyToolSideEffect } from "../../lib/side-effect-ledger.js";
+import { DiffReviewFollowUpTracker } from "../../lib/diff-review-follow-up.js";
 import {
   loadSideEffectLedger,
   persistSideEffectLedger,
@@ -88,6 +89,8 @@ export class WSAgentHandler {
     const abortController = new AbortController();
     this._abortController = abortController;
     this._activeRequestId = requestId || null;
+    let sideEffectLedger = null;
+    let diffReviewFollowUps = null;
 
     try {
       const { session } = this;
@@ -159,88 +162,123 @@ export class WSAgentHandler {
       // persisted BEFORE it settles) and commit/fail on its result, so a bridge
       // worker killed mid-flight is surfaced for verification on resume (see
       // handleSessionResume) instead of being blindly replayed.
-      const sideEffectLedger = loadSideEffectLedger(session.id);
+      sideEffectLedger = loadSideEffectLedger(session.id);
+      diffReviewFollowUps = new DiffReviewFollowUpTracker(sideEffectLedger);
       let currentSideEffectOpId = null;
 
-      for await (const event of agentLoop(session.messages, loopOptions)) {
-        switch (event.type) {
-          case "slot-filling":
-            this.interaction.emit("slot-filling", {
-              requestId,
-              slot: event.slot,
-              question: event.question,
-            });
-            break;
-
-          case "tool-executing":
-            this.interaction.emit("tool-executing", {
-              requestId,
-              tool: event.tool,
-              args: event.args,
-              display: formatToolArgs(event.tool, event.args),
-            });
-            currentSideEffectOpId = null;
-            {
-              const se = classifyToolSideEffect(event.tool, event.args);
-              if (se) {
-                const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
-                currentSideEffectOpId = opId;
-                sideEffectLedger
-                  .prepare(opId, {
-                    kind: se.kind,
-                    key: se.key,
-                    meta: {
-                      tool: event.tool,
-                      idempotencyKey: operationIdempotencyKey({
+      const runAgentTurn = async () => {
+        for await (const event of agentLoop(session.messages, loopOptions)) {
+          switch (event.type) {
+            case "slot-filling":
+              this.interaction.emit("slot-filling", {
+                requestId,
+                slot: event.slot,
+                question: event.question,
+              });
+              break;
+
+            case "tool-executing":
+              this.interaction.emit("tool-executing", {
+                requestId,
+                tool: event.tool,
+                args: event.args,
+                display: formatToolArgs(event.tool, event.args),
+              });
+              currentSideEffectOpId = null;
+              {
+                const se = classifyToolSideEffect(event.tool, event.args);
+                if (se) {
+                  const opId = `ws:${session.id}:${Date.now()}:${this._sideEffectSeq++}`;
+                  currentSideEffectOpId = opId;
+                  sideEffectLedger
+                    .prepare(opId, {
+                      kind: se.kind,
+                      key: se.key,
+                      meta: {
                         tool: event.tool,
-                        args: event.args,
-                      }),
-                    },
-                  })
-                  .start(opId);
+                        idempotencyKey: operationIdempotencyKey({
+                          tool: event.tool,
+                          args: event.args,
+                        }),
+                      },
+                    })
+                    .start(opId);
+                  persistSideEffectLedger(session.id, sideEffectLedger);
+                }
+              }
+              break;
+
+            case "tool-result":
+              this.interaction.emit("tool-result", {
+                requestId,
+                tool: event.tool,
+                result: event.result,
+                error: event.error,
+              });
+              if (currentSideEffectOpId) {
+                const err = event.error || event.result?.error || null;
+                if (event.result?._diffReviewAudit) {
+                  diffReviewFollowUps.observe(
+                    sideEffectLedger,
+                    currentSideEffectOpId,
+                    event.result._diffReviewAudit,
+                  );
+                }
+                if (err)
+                  sideEffectLedger.fail(
+                    currentSideEffectOpId,
+                    String(err).slice(0, 200),
+                  );
+                else sideEffectLedger.commit(currentSideEffectOpId);
                 persistSideEffectLedger(session.id, sideEffectLedger);
+                currentSideEffectOpId = null;
               }
-            }
-            break;
-
-          case "tool-result":
-            this.interaction.emit("tool-result", {
-              requestId,
-              tool: event.tool,
-              result: event.result,
-              error: event.error,
-            });
-            if (currentSideEffectOpId) {
-              const err = event.error || event.result?.error || null;
-              if (err)
-                sideEffectLedger.fail(
-                  currentSideEffectOpId,
-                  String(err).slice(0, 200),
-                );
-              else sideEffectLedger.commit(currentSideEffectOpId);
-              persistSideEffectLedger(session.id, sideEffectLedger);
-              currentSideEffectOpId = null;
-            }
-            break;
-
-          case "response-complete":
-            if (event.content) {
-              session.messages.push({
-                role: "assistant",
+              break;
+
+            case "response-complete":
+              if (event.content) {
+                session.messages.push({
+                  role: "assistant",
+                  content: event.content,
+                });
+              }
+              this.interaction.emit("response-complete", {
+                requestId,
                 content: event.content,
               });
-            }
-            this.interaction.emit("response-complete", {
-              requestId,
-              content: event.content,
-            });
-            break;
+              break;
+          }
         }
+      };
+
+      if (session.mcpClient?.withElicitationContext) {
+        await session.mcpClient.withElicitationContext(
+          session.id,
+          runAgentTurn,
+        );
+      } else {
+        await runAgentTurn();
+      }
+      if (
+        diffReviewFollowUps.complete(sideEffectLedger, {
+          status: "completed-without-reproposal",
+        }).length > 0
+      ) {
+        persistSideEffectLedger(session.id, sideEffectLedger);
       }
 
       // Update last activity
       session.lastActivity = new Date().toISOString();
     } catch (err) {
+      if (
+        sideEffectLedger &&
+        diffReviewFollowUps?.complete(sideEffectLedger, {
+          status: "interrupted",
+          reason: isAbortError(err) ? "aborted" : err.message,
+        }).length > 0
+      ) {
+        persistSideEffectLedger(this.session.id, sideEffectLedger);
+      }
       if (isAbortError(err) || abortController.signal.aborted) {
         return;
       }

package/src/gateways/ws/ws-server.js

@@ -11,7 +11,6 @@
  */
 
 import { EventEmitter } from "node:events";
-import { spawn } from "node:child_process";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -113,6 +112,11 @@ import {
   handleArtifactRemove,
   handleArtifactShow,
 } from "./artifact-protocol.js";
+import { executionBroker } from "../../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+};
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -216,6 +220,7 @@ export class ChainlessChainWSServer extends EventEmitter {
    * @param {string}  [options.token]           - If set, clients must authenticate first
    * @param {number}  [options.maxConnections=10]
    * @param {number}  [options.timeout=30000]   - Command execution timeout (ms)
+   * @param {Function} [options.spawn]           - Process seam for tests
    */
   constructor(options = {}) {
     super();
@@ -240,6 +245,7 @@ export class ChainlessChainWSServer extends EventEmitter {
     // grace window so it can't hold a maxConnections slot forever (see
     // AUTH_TIMEOUT_MS). `??` so an explicit 0 (disable) is honoured.
     this.authTimeoutMs = options.authTimeoutMs ?? AUTH_TIMEOUT_MS;
+    this._spawnProcess = options.spawn || _deps.spawn;
 
     /** Optional Phase-5 envelope bus for fan-out to hosted HTTP SSE. */
     this.envelopeBus = options.envelopeBus || null;
@@ -255,6 +261,7 @@ export class ChainlessChainWSServer extends EventEmitter {
 
     /** Session manager for stateful agent/chat sessions */
     this.sessionManager = options.sessionManager || null;
+    this.projectRoot = options.projectRoot || process.cwd();
 
     /** Session handlers: sessionId → WSAgentHandler | WSChatHandler */
     this.sessionHandlers = new Map();
@@ -530,6 +537,67 @@ export class ChainlessChainWSServer extends EventEmitter {
     return this._dispatcher.dispatch(clientId, ws, message);
   }
 
+  /** Read the same .claude settings rules used by the Agent Core. */
+  async _handlePermissionRulesGet(id, ws) {
+    try {
+      const { loadSettings } = await import("../../lib/settings-loader.cjs");
+      const loaded = loadSettings({ cwd: this.projectRoot });
+      this._send(ws, {
+        id,
+        type: "permission-rules",
+        rules: loaded.rules,
+        sources: loaded.sources,
+        files: loaded.files,
+        managed: loaded.managed || null,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_READ_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
+  /** Persist one rule through settings-loader; managed policy remains authoritative. */
+  async _handlePermissionRulesSet(id, ws, message) {
+    try {
+      const decision = String(message.decision || "").toLowerCase();
+      if (!["allow", "ask", "deny"].includes(decision)) {
+        throw new Error("decision must be allow, ask, or deny");
+      }
+      const rulesMod = await import("../../lib/permission-rules.cjs");
+      const mod = rulesMod.default || rulesMod;
+      if (!mod.parseRule(message.rule)) throw new Error("invalid permission rule");
+      const { addRule } = await import("../../lib/settings-loader.cjs");
+      const scope = ["project", "local", "user"].includes(message.scope)
+        ? message.scope
+        : "project";
+      const result = addRule({
+        cwd: this.projectRoot,
+        kind: decision,
+        rule: message.rule,
+        scope,
+      });
+      this._send(ws, {
+        id,
+        type: "permission-rule-updated",
+        ...result,
+        decision,
+        rule: message.rule,
+        scope,
+      });
+    } catch (error) {
+      this._send(ws, {
+        id,
+        type: "error",
+        code: "PERMISSION_RULES_WRITE_FAILED",
+        message: error.message,
+      });
+    }
+  }
+
   /**
    * Handle an orchestrate message — runs ChainlessChain orchestration with
    * real-time progress pushed back over this WebSocket connection.
@@ -854,7 +922,7 @@ export class ChainlessChainWSServer extends EventEmitter {
       return;
     }
 
-    const child = spawn(process.execPath, [BIN_PATH, ...args], {
+    const child = this._spawnProcess(process.execPath, [BIN_PATH, ...args], {
       env: {
         ...process.env,
         FORCE_COLOR: "0",
@@ -870,6 +938,10 @@ export class ChainlessChainWSServer extends EventEmitter {
       },
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
+      origin: "gateway:ws-command",
+      policy: "allow",
+      scope: "gateway",
+      shell: false,
     });
 
     this.processes.set(id, child);

package/src/harness/background-task-manager.js

@@ -1,19 +1,23 @@
 /**
  * Background Task Manager - daemon task queue with completion notifications.
  *
- * Tasks run in child_process.fork() for isolation.
+ * Tasks run in a brokered Node child with an IPC channel for isolation.
  * Queue persisted to .chainlesschain/tasks/queue.jsonl.
  * Completion notifications delivered to REPL callback.
  *
  * Feature-flag gated: BACKGROUND_TASKS
  */
 
-import { fork } from "node:child_process";
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { getHomeDir } from "../lib/paths.js";
+import executionBroker from "../lib/process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
 
 function getTasksDir() {
   const dir = join(getHomeDir(), "tasks");
@@ -114,13 +118,21 @@ export class BackgroundTaskManager extends EventEmitter {
     task.recoverySourceStatus = null;
     this._recordHistory(task, "started", { status: task.status });
 
-    const child = fork(
-      join(import.meta.dirname || ".", "background-task-worker.js"),
-      [task.command, task.cwd, task.type],
+    const workerPath = join(
+      import.meta.dirname || ".",
+      "background-task-worker.js",
+    );
+    const child = _deps.spawn(
+      process.execPath,
+      [...process.execArgv, workerPath, task.command, task.cwd, task.type],
       {
         cwd: task.cwd,
-        silent: true,
+        stdio: ["pipe", "pipe", "pipe", "ipc"],
         env: { ...process.env, CC_TASK_ID: taskId },
+        origin: "background-task:worker",
+        policy: "allow",
+        scope: "background-task",
+        shell: false,
       },
     );
 

package/src/harness/background-task-worker.js

@@ -5,7 +5,7 @@
  * Sends messages to parent: { type: "heartbeat"|"result"|"error", ... }
  */
 
-import { execSync } from "node:child_process";
+import executionBroker from "../lib/process-execution-broker/index.js";
 
 const [command, cwd, type] = process.argv.slice(2);
 
@@ -14,23 +14,16 @@ const heartbeat = setInterval(() => {
 }, 5000);
 
 try {
-  let result;
-
-  if (type === "shell") {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  } else {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  }
+  const result = executionBroker.execSync(command, {
+    cwd: cwd || process.cwd(),
+    encoding: "utf-8",
+    timeout: 300000,
+    maxBuffer: 10 * 1024 * 1024,
+    origin: `background-task:command:${type || "unknown"}`,
+    policy: "allow",
+    scope: "background-task",
+    shell: true,
+  });
 
   if (process.send) {
     process.send({ type: "result", data: result || "Done" });

package/src/harness/jsonl-session-store.js

@@ -20,6 +20,7 @@ import {
   verifyTranscriptText,
   TRANSCRIPT_CHAIN_STATUS,
 } from "./transcript-integrity.js";
+import { withFileLock } from "../lib/with-file-lock.js";
 
 function getSessionsDir() {
   const dir = join(getHomeDir(), "sessions");
@@ -82,12 +83,18 @@ function _resolveChainTail(sessionId, filePath) {
 
 export function appendEvent(sessionId, type, data) {
   const filePath = sessionPath(sessionId);
-  const prevHash = _resolveChainTail(sessionId, filePath);
-  const core = { type, timestamp: Date.now(), data };
-  const hash = computeEventHash(prevHash, core);
-  const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
-  appendFileSync(filePath, line, "utf-8");
-  _chainTailCache.set(sessionId, hash);
+  withFileLock(
+    filePath,
+    () => {
+      const prevHash = _resolveChainTail(sessionId, filePath);
+      const core = { type, timestamp: Date.now(), data };
+      const hash = computeEventHash(prevHash, core);
+      const line = JSON.stringify({ ...core, prevHash, hash }) + "\n";
+      appendFileSync(filePath, line, "utf-8");
+      _chainTailCache.set(sessionId, hash);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /**