chainlesschain 0.162.175 → 0.162.177

package/src/lib/hook-manager.js

@@ -4,7 +4,6 @@
  */
 
 import crypto from "crypto";
-import { execSync } from "child_process";
 import broker from "./process-execution-broker/index.js";
 
 /**
@@ -275,8 +274,8 @@ export async function executeHook(hook, context = {}) {
     const type = hook.type || HookType.SYNC;
 
     if (type === HookType.COMMAND || type === HookType.SCRIPT) {
-      // Command/script hooks execute a shell command (execSync hoisted to a
-      // top-level import — this runs per hook on the tool-use hot path).
+      // Command/script hooks execute a shell command through the shared
+      // process broker on the tool-use hot path.
       const cmd = hook.handler || "";
       if (!cmd) {
         return {
@@ -291,18 +290,10 @@ export async function executeHook(hook, context = {}) {
         HOOK_EVENT: hook.event,
         HOOK_CONTEXT: JSON.stringify(context),
       };
-      // M1: Record hook command execution in broker audit log
-      const auditEntry = {
-        pid: process.pid,
-        origin: "hook",
-        command: cmd,
-        args: [],
-        startedAt: Date.now(),
-        sessionId: context?.sessionId,
-      };
-      if (typeof broker._recordAudit === "function")
-        broker._recordAudit(auditEntry);
-      const output = execSync(cmd, {
+      const output = broker.execSync(cmd, {
+        origin: "hook-manager:command",
+        scope: "hook",
+        policy: "allow",
         encoding: "utf-8",
         timeout: hook.timeout || 20000,
         // execSync defaults maxBuffer to 1 MB; a hook that prints more (a

package/src/lib/hook-runner.cjs

@@ -17,10 +17,9 @@
  *                               agent — only an explicit block decision blocks).
  *
  * Returns a normalized `{ decision, reason, exitCode, stdout, stderr, ... }`.
- * `_deps.spawnSync` is injected for unit tests (no real process needed).
+ * Process runners are injected for unit tests and by the ESM Broker facade.
  */
 
-const cpDefault = require("node:child_process");
 const {
   normalizeShellKind,
   buildPowershellArgv,
@@ -28,7 +27,27 @@ const {
 } = require("./shell-selector.cjs");
 const { mergeHookDecisions } = require("./hook-event-bus.cjs");
 
-const _deps = { spawnSync: cpDefault.spawnSync, spawn: cpDefault.spawn };
+const _deps = { runSync: null, run: null };
+Object.defineProperties(_deps, {
+  spawnSync: {
+    enumerable: true,
+    get() {
+      return this.runSync;
+    },
+    set(value) {
+      this.runSync = value;
+    },
+  },
+  spawn: {
+    enumerable: true,
+    get() {
+      return this.run;
+    },
+    set(value) {
+      this.run = value;
+    },
+  },
+});
 
 const HOOK_DECISIONS = Object.freeze({
   BLOCK: "block",
@@ -232,7 +251,30 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
         CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
       },
     };
-    if (usePowershell) {
+    const processOptions = {
+      ...common,
+      origin: opts.origin || "hook",
+      policy: "allow",
+      scope: "hook",
+      pluginId: opts.pluginId || null,
+      pluginVersion: opts.pluginVersion || null,
+      pluginSource: opts.pluginSource || null,
+    };
+    const brokerRunSync =
+      opts.broker &&
+      opts.origin === "plugin:hook" &&
+      typeof opts.broker["spawnSync"] === "function"
+        ? opts.broker["spawnSync"].bind(opts.broker)
+        : null;
+    if (brokerRunSync) {
+      const invocation = usePowershell
+        ? buildPowershellArgv(command, shellKind, {
+            executionPolicy: loadShellConfig({ cwd: common.cwd })
+              .executionPolicy,
+          })
+        : { file: command, argv: [] };
+      res = brokerRunSync(invocation.file, invocation.argv, processOptions);
+    } else if (usePowershell) {
       // Per-hook `shell: powershell|pwsh` (settings hook entry): explicit argv
       // instead of the default shell; the enterprise ExecutionPolicy override
       // (settings shell.powershell.executionPolicy) applies here too.
@@ -240,9 +282,15 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
         cwd: common.cwd,
       });
       const inv = buildPowershellArgv(command, shellKind, { executionPolicy });
-      res = _deps.spawnSync(inv.file, inv.argv, common);
+      if (typeof _deps.runSync !== "function") {
+        throw new Error("hook process runner unavailable");
+      }
+      res = _deps.runSync(inv.file, inv.argv, processOptions);
     } else {
-      res = _deps.spawnSync(command, { ...common, shell: true });
+      if (typeof _deps.runSync !== "function") {
+        throw new Error("hook process runner unavailable");
+      }
+      res = _deps.runSync(command, { ...processOptions, shell: true });
     }
   } catch (err) {
     return {
@@ -346,15 +394,37 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
     ...process.env,
     CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
   };
+  const processOptions = {
+    cwd: wd,
+    env: spawnEnv,
+    origin: opts.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+    pluginId: opts.pluginId || null,
+    pluginVersion: opts.pluginVersion || null,
+    pluginSource: opts.pluginSource || null,
+  };
 
   let child;
   try {
+    const brokerRun =
+      opts.broker &&
+      opts.origin === "plugin:hook" &&
+      typeof opts.broker["spawn"] === "function"
+        ? opts.broker["spawn"].bind(opts.broker)
+        : null;
+    const run = brokerRun || _deps.run;
+    if (typeof run !== "function") {
+      throw new Error("hook process runner unavailable");
+    }
     if (usePowershell) {
       const { executionPolicy } = loadShellConfig({ cwd: wd });
       const inv = buildPowershellArgv(command, shellKind, { executionPolicy });
-      child = _deps.spawn(inv.file, inv.argv, { cwd: wd, env: spawnEnv });
+      child = run(inv.file, inv.argv, processOptions);
     } else {
-      child = _deps.spawn(command, { cwd: wd, env: spawnEnv, shell: true });
+      child = brokerRun
+        ? run(command, [], { ...processOptions, shell: true })
+        : run(command, { ...processOptions, shell: true });
     }
   } catch (err) {
     return {
@@ -444,6 +514,11 @@ function runHooks(commandHooks, input = {}, opts = {}) {
   const runOne = (h) =>
     runCommandHook(h.command, input, {
       ...opts,
+      broker: opts.broker,
+      origin: h.origin,
+      pluginId: h.pluginId,
+      pluginVersion: h.pluginVersion,
+      pluginSource: h.pluginSource,
       timeout: h.timeout != null ? h.timeout * 1000 : opts.timeout,
       // per-hook shell selection (P1 #8): `{ "type":"command", "command":…,
       // "shell":"powershell" }` in the settings hook entry
@@ -504,6 +579,11 @@ async function runHooksParallel(commandHooks, input = {}, opts = {}) {
     hooks.map((h) =>
       runCommandHookAsync(h.command, input, {
         ...opts,
+        broker: opts.broker,
+        origin: h.origin,
+        pluginId: h.pluginId,
+        pluginVersion: h.pluginVersion,
+        pluginSource: h.pluginSource,
         timeout: h.timeout != null ? h.timeout * 1000 : opts.timeout,
         shell: h.shell != null ? h.shell : opts.shell,
       }).then((r) => ({ h, r })),

package/src/lib/hook-runner.js

@@ -0,0 +1,55 @@
+import runner from "./hook-runner.cjs";
+import executionBroker from "./process-execution-broker/index.js";
+
+const brokerRunner = executionBroker.spawn.bind(executionBroker);
+const brokerSyncRunner = executionBroker.spawnSync.bind(executionBroker);
+
+export const _processDeps = {
+  run: brokerRunner,
+  runSync: brokerSyncRunner,
+};
+
+function normalizeInvocation(argsOrOptions, maybeOptions) {
+  return Array.isArray(argsOrOptions)
+    ? { args: argsOrOptions, options: maybeOptions || {} }
+    : { args: [], options: argsOrOptions || {} };
+}
+
+function runHookProcess(file, argsOrOptions, maybeOptions) {
+  const { args, options } = normalizeInvocation(argsOrOptions, maybeOptions);
+  return _processDeps.run(file, args, {
+    ...options,
+    origin: options.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+  });
+}
+
+function runHookProcessSync(file, argsOrOptions, maybeOptions) {
+  const { args, options } = normalizeInvocation(argsOrOptions, maybeOptions);
+  return _processDeps.runSync(file, args, {
+    ...options,
+    origin: options.origin || "hook",
+    policy: "allow",
+    scope: "hook",
+  });
+}
+
+runner._deps.run = runHookProcess;
+runner._deps.runSync = runHookProcessSync;
+
+export const {
+  runCommandHook,
+  runCommandHookAsync,
+  runHooks,
+  runHooksParallel,
+  interpretHookOutcome,
+  tryParseDecision,
+  HOOK_DECISIONS,
+  HOOK_PAYLOAD_SCHEMA_VERSION,
+  hookBreakerConfig,
+  _resetHookBreaker,
+  _deps,
+} = runner;
+
+export default runner;

package/src/lib/hooks-v2-producers.js

@@ -0,0 +1,15 @@
+/**
+ * Best-effort bridge from real runtime producers to Hooks v2.
+ * Hook failures never change the surrounding agent or interaction result.
+ */
+export function emitHooksV2Event(eventName, context = {}, options = {}) {
+  void import("./hooks-v2-runtime.js")
+    .then(({ default: runtime }) => {
+      if (!runtime || typeof runtime.executeHooks !== "function") return;
+      return runtime.executeHooks(eventName, context, options);
+    })
+    .catch(() => {
+      // Hooks are an optional extension; producer delivery is best-effort.
+    });
+}
+

package/src/lib/hooks-v2-runtime.js

@@ -24,10 +24,12 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import broker from "./process-execution-broker/index.js";
+import { EventRuntimeStore } from "./event-runtime-store.js";
 
 const VALID_HOOK_EVENTS = new Set([
   // Session
-  "PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStop",
+  "PreToolUse", "PostToolUse", "Notification", "Stop", "SubagentStart", "SubagentStop",
+  "SessionResume", "SessionPause", "PostCompact",
   // Auth
   "PreCommit", "PostCommit",
   // Skill
@@ -35,24 +37,33 @@ const VALID_HOOK_EVENTS = new Set([
   // Model
   "PreCompact", "ModelSelection",
   // Config
-  "ConfigChange", "PermissionAllow", "PermissionDeny",
+  "ConfigChange", "PermissionAllow", "PermissionDeny", "PermissionRequest", "PermissionDenied",
   // Timeline
   "TimelineEntry",
   // MCP
-  "McpRequest", "McpResponse",
+  "McpRequest", "McpResponse", "MCPElicitation",
+  // Task / workspace lifecycle
+  "TaskCreated", "TaskCompleted", "InstructionsLoaded", "CwdChanged",
+  "WorktreeCreate", "WorktreeRemove",
 ]);
 
 const VALID_EXECUTOR_TYPES = new Set(["command", "http", "prompt", "agent", "js"]);
 
 class HooksV2Runtime extends EventEmitter {
-  constructor(configDir) {
+  constructor(configDir, options = {}) {
     super();
     this.configDir = configDir;
+    this.durableStore = options.durableStore || null;
     this.hooks = new Map(); // eventName -> HookDefinition[]
     this.executionLog = [];
     this._loaded = false;
   }
 
+  setDurableStore(store) {
+    this.durableStore = store || null;
+    return this.durableStore;
+  }
+
   /**
    * @typedef {Object} HookDefinition
    * @property {string} id
@@ -132,17 +143,29 @@ class HooksV2Runtime extends EventEmitter {
    * @param {Object} context - event context (tool_name, tool_input, session_id, etc.)
    * @returns {Promise<{results: Array, blocked: boolean, blockingResult?: any}>}
    */
-  async emitEvent(eventName, context = {}) {
+  async emitEvent(eventName, context = {}, options = {}) {
     if (!VALID_HOOK_EVENTS.has(eventName)) {
       throw new Error(`Invalid hook event: ${eventName}`);
     }
 
     const hooks = this.hooks.get(eventName) || [];
-    const results = [];
-    let blocked = false;
-    let blockingResult = null;
-
+    const durableRecord = this.durableStore
+      ? this.durableStore.enqueueInbox(
+          { event: eventName, context },
+          { id: context.event_id || context.eventId || null },
+        )
+      : null;
+    // Hooks are parallel by default. De-duplicate by id so a reload or layered
+    // config cannot execute the same handler twice. `parallel:false` remains a
+    // deterministic compatibility mode for callers that require ordering.
+    const uniqueHooks = [];
+    const seen = new Set();
     for (const hook of hooks) {
+      if (seen.has(hook.id)) continue;
+      seen.add(hook.id);
+      uniqueHooks.push(hook);
+    }
+    const runOne = async (hook) => {
       const execId = crypto.randomUUID();
       const start = Date.now();
       const record = { execId, hookId: hook.id, event: eventName, type: hook.type, startedAt: new Date() };
@@ -170,28 +193,47 @@ class HooksV2Runtime extends EventEmitter {
         record.durationMs = Date.now() - start;
         record.status = "success";
         record.result = result;
-        results.push(record);
-
-        // Check for blocking decision
-        if (hook.blocking && result && result.decision === "block") {
-          blocked = true;
-          blockingResult = result;
-          record.blocked = true;
-        }
+        if (hook.blocking && result && result.decision === "block") record.blocked = true;
 
         this.emit("hook:success", record);
       } catch (err) {
         record.durationMs = Date.now() - start;
         record.status = "error";
         record.error = err.message;
-        results.push(record);
         this.emit("hook:error", record);
       }
 
       this.executionLog.push(record);
+      return record;
+    };
+    const results = options.parallel === false
+      ? []
+      : await Promise.all(uniqueHooks.map(runOne));
+    if (options.parallel === false) {
+      for (const hook of uniqueHooks) results.push(await runOne(hook));
     }
+    const blocking = results.filter((r) => r.blocked === true);
+    const blocked = blocking.length > 0;
+    const blockingResult = blocking[0]?.result || null;
+
+    const outcome = { success: !blocked, results, blocked, blockingResult };
+    if (durableRecord && !durableRecord.duplicate) {
+      this.durableStore.acknowledgeInbox(durableRecord.id, {
+        event: eventName,
+        blocked,
+        resultCount: results.length,
+      });
+      this.durableStore.enqueueOutbox(
+        { event: eventName, outcome },
+        { id: `${durableRecord.id}:result` },
+      );
+    }
+    return outcome;
+  }
 
-    return { results, blocked, blockingResult };
+  /** Compatibility/public name used by runtime parity and SDK callers. */
+  async executeHooks(eventName, context = {}, options = {}) {
+    return this.emitEvent(eventName, context, options);
   }
 
   async _execCommand(hook, context) {
@@ -253,7 +295,9 @@ class HooksV2Runtime extends EventEmitter {
   }
 
   async _execJs(hook, context) {
-    // In-process JS execution via vm (sandboxed) - stub for full vm2/isolated-vm integration
+    if (typeof hook.handler === "function") return hook.handler(context);
+    // In-process JS execution via vm (sandboxed) - config-loaded code remains
+    // disabled until the dedicated VM executor is enabled.
     return { decision: "noop", note: "JS executor stub - context received", contextKeys: Object.keys(context) };
   }
 
@@ -273,6 +317,11 @@ class HooksV2Runtime extends EventEmitter {
 }
 
 // Singleton instance
-const hooksRuntime = new HooksV2Runtime();
+const hooksRuntime = new HooksV2Runtime(undefined, {
+  durableStore:
+    process.env.CC_EVENT_RUNTIME_DURABLE === "1"
+      ? new EventRuntimeStore()
+      : null,
+});
 export default hooksRuntime;
 export { HooksV2Runtime, VALID_HOOK_EVENTS, VALID_EXECUTOR_TYPES };

package/src/lib/host-adb-bridge.js

@@ -17,8 +17,8 @@
  * still used for the V5/V6 IPC code path (separate hub singleton).
  *
  * Methods implemented (only what system-data-android consumes):
- *   - `contacts.query({since?})` →
- *       [{ lookupKey, displayName }, ...]
+ *   - `contacts.query({since?})` → contacts with phones, emails,
+ *       organization, job title, starred state, and photo URI
  *   - `app.list({includeSystem?})` →
  *       [{ packageName }, ...]
  *
@@ -31,10 +31,20 @@
  *     `\n` / EOS — every parse routine strips `\r+$` first.
  */
 
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import executionBroker from "./process-execution-broker/index.js";
 
-const execFileP = promisify(execFile);
+export const _deps = {
+  execFile: (...args) => executionBroker.execFile(...args),
+};
+
+function execFileP(file, args, options) {
+  return new Promise((resolve, reject) => {
+    _deps.execFile(file, args, options, (error, stdout, stderr) => {
+      if (error) reject(error);
+      else resolve({ stdout, stderr });
+    });
+  });
+}
 
 export class HostAdbBridgeUnavailableError extends Error {
   constructor(reason) {
@@ -52,6 +62,10 @@ async function adb(args, opts = {}) {
       timeout: opts.timeoutMs || 30_000,
       maxBuffer: 32 * 1024 * 1024,
       encoding: "utf8",
+      origin: "host-adb:command",
+      policy: "allow",
+      scope: "host-adb",
+      shell: false,
     });
     if (stderr && /error:|failed:|protocol fault/i.test(stderr)) {
       throw new HostAdbBridgeUnavailableError(stderr.trim().split("\n")[0]);
@@ -120,27 +134,116 @@ function parseContentQueryRows(stdout) {
   return rows;
 }
 
-async function queryContacts(_params, opts) {
+function mergeContactRows(contactRows, phoneRows, emailRows, organizationRows) {
+  const byId = new Map();
+  for (const row of contactRows) {
+    const contactId = row._id == null ? null : String(row._id);
+    const displayName = row.display_name || null;
+    if (!contactId || !displayName) continue;
+    byId.set(contactId, {
+      lookupKey: row.lookup || null,
+      displayName,
+      phones: [],
+      emails: [],
+      starred: row.starred === "1",
+      organization: null,
+      jobTitle: null,
+      photoUri: row.photo_uri || null,
+    });
+  }
+
+  const appendUnique = (rows, field, valueOf) => {
+    for (const row of rows) {
+      const contact = byId.get(String(row.contact_id));
+      const value = valueOf(row);
+      if (!contact || typeof value !== "string" || !value.trim()) continue;
+      const normalized = value.trim();
+      if (!contact[field].includes(normalized)) contact[field].push(normalized);
+    }
+  };
+  appendUnique(phoneRows, "phones", (row) => row.data1 || row.number);
+  appendUnique(emailRows, "emails", (row) => row.data1 || row.address);
+  for (const row of organizationRows) {
+    const contact = byId.get(String(row.contact_id));
+    if (!contact) continue;
+    const organization = row.data1 || row.company;
+    const jobTitle = row.data4 || row.title;
+    if (!contact.organization && organization && organization.trim()) {
+      contact.organization = organization.trim();
+    }
+    if (!contact.jobTitle && jobTitle && jobTitle.trim()) {
+      contact.jobTitle = jobTitle.trim();
+    }
+  }
+  return [...byId.values()];
+}
+
+async function queryContacts(params, opts) {
   const serial = await pickDevice(opts);
-  const stdout = await adb(
-    [
-      "shell",
-      "content",
-      "query",
-      "--uri",
-      "content://com.android.contacts/contacts",
-      "--projection",
-      "lookup:display_name",
-    ],
-    { ...opts, serial },
+  const contactArgs = [
+    "shell",
+    "content",
+    "query",
+    "--uri",
+    "content://com.android.contacts/contacts",
+    "--projection",
+    "_id:lookup:display_name:starred:photo_uri",
+  ];
+  if (Number.isInteger(params?.since) && params.since > 0) {
+    contactArgs.push(
+      "--where",
+      `contact_last_updated_timestamp >= ${params.since}`,
+    );
+  }
+  const commandOpts = { ...opts, serial, timeoutMs: opts.timeoutMs || 120_000 };
+  const [contactsOut, phonesOut, emailsOut, organizationsOut] =
+    await Promise.all([
+      adb(contactArgs, commandOpts),
+      adb(
+        [
+          "shell",
+          "content",
+          "query",
+          "--uri",
+          "content://com.android.contacts/data/phones",
+          "--projection",
+          "contact_id:data1",
+        ],
+        commandOpts,
+      ),
+      adb(
+        [
+          "shell",
+          "content",
+          "query",
+          "--uri",
+          "content://com.android.contacts/data/emails",
+          "--projection",
+          "contact_id:data1",
+        ],
+        commandOpts,
+      ),
+      adb(
+        [
+          "shell",
+          "content",
+          "query",
+          "--uri",
+          "content://com.android.contacts/data",
+          "--projection",
+          "contact_id:data1:data4",
+          "--where",
+          "mimetype='vnd.android.cursor.item/organization'",
+        ],
+        commandOpts,
+      ),
+    ]);
+  return mergeContactRows(
+    parseContentQueryRows(contactsOut),
+    parseContentQueryRows(phonesOut),
+    parseContentQueryRows(emailsOut),
+    parseContentQueryRows(organizationsOut),
   );
-  const rows = parseContentQueryRows(stdout);
-  return rows
-    .map((r) => ({
-      lookupKey: r.lookup || null,
-      displayName: r.display_name || null,
-    }))
-    .filter((c) => c.displayName);
 }
 
 async function listApps(params, opts) {
@@ -496,7 +599,9 @@ export function createHostAdbBridge(opts = {}) {
 
 // Exposed for unit testing without spawning real adb.
 export const _internals = {
+  adb,
   parseContentQueryRows,
+  mergeContactRows,
   listDevices,
   pickDevice,
   queryContacts,