chainlesschain 0.162.175 → 0.162.177

package/src/lib/process-execution-broker/index.js

@@ -106,6 +106,10 @@ class ProcessExecutionBroker extends EventEmitter {
     this._credentialAgent = credentialAgent;
     this._credentialFilteringEnabled = true;
     this._sandboxEnabled = true;
+    // Keep the legacy aliases used by older call sites and make the strict
+    // plugin path use the same switches as the general broker path.
+    this._credentialAgentEnabled = true;
+    this._platformSandboxEnabled = true;
 
     this._ensureLogDir();
     this._loadPermissions();
@@ -176,6 +180,75 @@ class ProcessExecutionBroker extends EventEmitter {
     return safe;
   }
 
+  _credentialBoundaryEnabled() {
+    return (
+      this._credentialFilteringEnabled !== false &&
+      this._credentialAgentEnabled !== false
+    );
+  }
+
+  _sanitizeAuditArgs(args) {
+    const values = Array.isArray(args) ? args : [];
+    try {
+      return this._credentialAgent.sanitizeArgs(values).sanitizedArgs;
+    } catch {
+      return values.map(() => "***REDACTION_FAILED***");
+    }
+  }
+
+  _applyCredentialBoundary(command, args, spawnOptions, origin) {
+    const originalArgs = Array.isArray(args) ? [...args] : [];
+    const originalEnv = spawnOptions.env || process.env;
+    const input = {
+      ...spawnOptions,
+      env: originalEnv,
+      args: originalArgs,
+      file: command,
+      origin,
+    };
+    let filtered;
+    let report = null;
+    if (typeof this._credentialAgent.applyWithReport === "function") {
+      const result = this._credentialAgent.applyWithReport(input);
+      filtered = result.spawnOptions;
+      report = result.report;
+    } else {
+      filtered = this._credentialAgent.apply(input);
+    }
+    const filteredArgs = Array.isArray(filtered?.args)
+      ? filtered.args
+      : originalArgs;
+    const filteredEnv = filtered?.env || {};
+    const inferredEnvCount = Object.keys(originalEnv).filter(
+      (key) =>
+        this._credentialAgent.isSensitiveKey?.(key) &&
+        !Object.prototype.hasOwnProperty.call(filteredEnv, key),
+    ).length;
+    const inferredArgCount = originalArgs.reduce(
+      (count, value, index) =>
+        count + (String(value) === String(filteredArgs[index]) ? 0 : 1),
+      0,
+    );
+    const credentialReport = report || {
+      envCount: inferredEnvCount,
+      argCount: inferredArgCount,
+      filtered: inferredEnvCount > 0 || inferredArgCount > 0,
+    };
+    return {
+      args: filteredArgs,
+      env: filteredEnv,
+      report: credentialReport,
+    };
+  }
+
+  _recordCredentialReport(auditEntry, report) {
+    const filtered = report?.filtered === true;
+    auditEntry.credentialFiltered = filtered;
+    auditEntry.credentialEnvCount = Number(report?.envCount || 0);
+    auditEntry.credentialArgCount = Number(report?.argCount || 0);
+    if (filtered) this._stats.credFiltered++;
+  }
+
   _getTraceContext() {
     const traceCtx = getTraceCtx();
     if (traceCtx && traceCtx.activeContext) {
@@ -252,7 +325,7 @@ class ProcessExecutionBroker extends EventEmitter {
       origin,
       scope,
       command,
-      args: args || [],
+      args: this._sanitizeAuditArgs(args),
       cwd,
       startTime,
       permissionDecision: decision,
@@ -263,6 +336,9 @@ class ProcessExecutionBroker extends EventEmitter {
       exitCode: null,
       endTime: null,
       durationMs: null,
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
     };
 
     if (decision === "deny" || decision === "prompt") {
@@ -298,21 +374,17 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     // P0-1: Credential filtering (default-on) — strip secrets from env/args
-    const credInfo = { redacted: 0 };
-    if (this._credentialFilteringEnabled) {
-      const before = JSON.stringify(spawnOpts.env || {}).length;
-      const filtered = this._credentialAgent.apply({
-        ...spawnOpts,
-        file: command,
-        args: args || [],
+    if (this._credentialBoundaryEnabled()) {
+      const credentialBoundary = this._applyCredentialBoundary(
+        command,
+        args,
+        spawnOpts,
         origin,
-      });
-      spawnOpts.env = filtered.env;
-      spawnOpts.args = filtered.args;
-      const after = JSON.stringify(spawnOpts.env).length;
-      credInfo.redacted = before > after ? 1 : 0;
-      if (credInfo.redacted) this._stats.credFiltered++;
-      auditEntry.credentialFiltered = !!credInfo.redacted;
+      );
+      spawnOpts.env = credentialBoundary.env;
+      args = credentialBoundary.args;
+      auditEntry.args = [...args];
+      this._recordCredentialReport(auditEntry, credentialBoundary.report);
     }
 
     // P0-1: Platform sandbox wrapping — apply macOS/Windows/Linux sandbox
@@ -354,8 +426,8 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     // Use native spawn from _native (set by patch-child-process.js)
-    const nativeSpawn = this._native?.spawn || nativeSpawn;
-    const proc = nativeSpawn(command, args, optsForSpawn);
+    const nativeSpawnFn = this._native?.spawn || nativeSpawn;
+    const proc = nativeSpawnFn(command, args, optsForSpawn);
 
     // P0-1: Post-spawn sandbox setup (Windows Job Object association, etc.)
     if (sandboxApplied && proc.pid) {
@@ -409,7 +481,10 @@ class ProcessExecutionBroker extends EventEmitter {
         error: err.message,
         component: origin,
       });
-      this.emit("error", auditEntry);
+      // EventEmitter treats an unhandled `error` event as an exception. A
+      // process ENOENT must reach the child-process listener/callback instead
+      // of crashing callers that did not subscribe to broker diagnostics.
+      if (this.listenerCount("error") > 0) this.emit("error", auditEntry);
     });
     return proc;
   }
@@ -435,7 +510,7 @@ class ProcessExecutionBroker extends EventEmitter {
       origin,
       scope,
       command,
-      args: args || [],
+      args: this._sanitizeAuditArgs(args),
       cwd,
       startTime,
       permissionDecision: decision,
@@ -443,6 +518,9 @@ class ProcessExecutionBroker extends EventEmitter {
       isDangerous,
       shell: !!options.shell,
       sync: true,
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
     };
 
     if (decision === "deny" || decision === "prompt") {
@@ -471,20 +549,17 @@ class ProcessExecutionBroker extends EventEmitter {
     }
 
     // P0-1: Credential filtering agent — strip secrets from env/args before spawn
-    if (this._credentialAgentEnabled) {
-      try {
-        const credInfo = credentialAgent.apply(spawnOpts, {
-          command,
-          args,
-          origin,
-        });
-        if (credInfo.redacted) this._stats.credFiltered++;
-        auditEntry.credentialFiltered = !!credInfo.redacted;
-      } catch (credErr) {
-        process.emitWarning(
-          `Credential agent apply failed: ${credErr.message}`,
-        );
-      }
+    if (this._credentialBoundaryEnabled()) {
+      const credentialBoundary = this._applyCredentialBoundary(
+        command,
+        args,
+        spawnOpts,
+        origin,
+      );
+      spawnOpts.env = credentialBoundary.env;
+      args = credentialBoundary.args;
+      auditEntry.args = [...args];
+      this._recordCredentialReport(auditEntry, credentialBoundary.report);
     }
 
     // P0-1: Platform sandbox wrapping (sync path)
@@ -523,9 +598,9 @@ class ProcessExecutionBroker extends EventEmitter {
       }
     }
 
-    const nativeSpawnSync = this._native?.spawnSync || nativeSpawnSync;
+    const nativeSpawnSyncFn = this._native?.spawnSync || nativeSpawnSync;
     try {
-      const result = nativeSpawnSync(command, args, optsForSync);
+      const result = nativeSpawnSyncFn(command, args, optsForSync);
       auditEntry.exitCode = result.status;
       auditEntry.endTime = Date.now();
       auditEntry.durationMs = auditEntry.endTime - startTime;
@@ -542,6 +617,94 @@ class ProcessExecutionBroker extends EventEmitter {
     }
   }
 
+  /**
+   * Route a node-pty session through the same provenance and credential
+   * boundary as child_process execution. node-pty owns the native PTY
+   * allocation, so the platform sandbox is reported as unavailable here
+   * rather than being falsely marked as applied.
+   */
+  spawnPty(ptyModule, command, args = [], options = {}) {
+    if (!ptyModule || typeof ptyModule.spawn !== "function") {
+      throw new TypeError("pty_module_spawn_unavailable");
+    }
+    const executionId = crypto.randomUUID();
+    const startTime = Date.now();
+    const origin = options.origin || "terminal:pty";
+    const scope = options.scope || "terminal";
+    const policy = options.policy || "allow";
+    const auditEntry = {
+      executionId,
+      traceId: this._getTraceContext()?.traceId || null,
+      origin,
+      scope,
+      command,
+      args: this._sanitizeAuditArgs(args),
+      cwd: options.cwd || process.cwd(),
+      startTime,
+      permissionDecision: policy,
+      policy,
+      operation: "pty.spawn",
+      pty: true,
+      sandboxed: false,
+      sandboxReason: "native_pty_host_boundary",
+      pluginId: options.pluginId || null,
+      pluginVersion: options.pluginVersion || null,
+      pluginSource: options.pluginSource || null,
+    };
+    if (policy === "deny" || policy === "prompt") {
+      auditEntry.deniedReason = `policy_${policy}`;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = 0;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(
+        auditEntry,
+        "denied",
+        new Error(auditEntry.deniedReason),
+      );
+      const error = new Error(`PTY spawn denied: ${auditEntry.deniedReason}`);
+      error.auditEntry = auditEntry;
+      throw error;
+    }
+
+    const spawnOptions = { ...options, args: [...auditEntry.args] };
+    delete spawnOptions.origin;
+    delete spawnOptions.policy;
+    delete spawnOptions.scope;
+    delete spawnOptions.pluginId;
+    delete spawnOptions.pluginVersion;
+    delete spawnOptions.pluginSource;
+    try {
+      if (this._credentialBoundaryEnabled()) {
+        const credentialBoundary = this._applyCredentialBoundary(
+          command,
+          args,
+          spawnOptions,
+          origin,
+        );
+        spawnOptions.env = credentialBoundary.env;
+        spawnOptions.args = credentialBoundary.args;
+        auditEntry.args = [...credentialBoundary.args];
+        this._recordCredentialReport(auditEntry, credentialBoundary.report);
+      }
+      const filteredArgs = spawnOptions.args || [];
+      delete spawnOptions.args;
+      const proc = ptyModule.spawn(command, filteredArgs, spawnOptions);
+      auditEntry.pid = proc?.pid ?? null;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = auditEntry.endTime - startTime;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "started");
+      return proc;
+    } catch (error) {
+      auditEntry.error = error.message;
+      auditEntry.endTime = Date.now();
+      auditEntry.durationMs = auditEntry.endTime - startTime;
+      this._recordAudit(auditEntry);
+      this._writeRplEntry(auditEntry, "error", error);
+      throw error;
+    }
+  }
+
   exec(command, options, callback) {
     const opts = typeof options === "function" ? {} : options;
     const cb = typeof options === "function" ? options : callback;
@@ -558,15 +721,129 @@ class ProcessExecutionBroker extends EventEmitter {
       shell: true,
       origin: options.origin || "shell:execSync",
     };
-    return this.spawnSync(command, [], spawnOpts);
+    const result = this.spawnSync(command, [], spawnOpts);
+    if (result?.error) throw result.error;
+    if (result?.status != null && result.status !== 0) {
+      const error = new Error(
+        `Command failed (exit ${result.status}): ${command}`,
+      );
+      error.status = result.status;
+      error.stdout = result.stdout;
+      error.stderr = result.stderr;
+      throw error;
+    }
+    return result?.stdout ?? "";
   }
 
   execFile(file, args, options, callback) {
-    return this.spawn(file, args, options || {});
+    if (typeof args === "function") {
+      callback = args;
+      args = [];
+      options = {};
+    } else if (!Array.isArray(args)) {
+      callback = typeof options === "function" ? options : callback;
+      options = args || {};
+      args = [];
+    } else if (typeof options === "function") {
+      callback = options;
+      options = {};
+    }
+
+    options = options || {};
+    const proc = this.spawn(file, args, options);
+    if (typeof callback !== "function") return proc;
+
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    const outputEncoding = options.encoding ?? "utf8";
+    const returnBuffers =
+      outputEncoding === "buffer" || outputEncoding === null;
+    const configuredMaxBuffer = options.maxBuffer;
+    const maxBuffer =
+      configuredMaxBuffer === Infinity
+        ? Infinity
+        : Number.isFinite(configuredMaxBuffer) && configuredMaxBuffer >= 0
+          ? configuredMaxBuffer
+          : 1024 * 1024;
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let completionError = null;
+    let completed = false;
+
+    const asBuffer = (chunk) =>
+      Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    const render = (chunks) => {
+      const value = Buffer.concat(chunks);
+      return returnBuffers ? value : value.toString(outputEncoding);
+    };
+    const finish = (error, code = null, signal = null) => {
+      if (completed) return;
+      completed = true;
+      const stdout = render(stdoutChunks);
+      const stderr = render(stderrChunks);
+      if (error) {
+        error.stdout = stdout;
+        error.stderr = stderr;
+        if (error.status === undefined) error.status = code;
+        if (error.signal === undefined) error.signal = signal;
+      }
+      callback(error, stdout, stderr);
+    };
+    const collect = (stream, chunks, streamName) => {
+      if (!stream || typeof stream.on !== "function") return;
+      stream.on("data", (chunk) => {
+        const value = asBuffer(chunk);
+        chunks.push(value);
+        if (streamName === "stdout") stdoutBytes += value.length;
+        else stderrBytes += value.length;
+        const streamBytes = streamName === "stdout" ? stdoutBytes : stderrBytes;
+        if (!completionError && streamBytes > maxBuffer) {
+          completionError = new Error(`${streamName} maxBuffer exceeded`);
+          completionError.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
+          completionError.stream = streamName;
+          try {
+            proc.kill(options.killSignal || "SIGTERM");
+          } catch {}
+        }
+      });
+    };
+
+    collect(proc.stdout, stdoutChunks, "stdout");
+    collect(proc.stderr, stderrChunks, "stderr");
+    proc.once("error", (error) => finish(error));
+    proc.once("close", (code, signal) => {
+      if (completionError) return finish(completionError, code, signal);
+      if (code === 0) return finish(null, code, signal);
+      const error = new Error(
+        `Command failed (exit ${code ?? "unknown"}): ${file}`,
+      );
+      error.code = code;
+      error.killed = Boolean(proc.killed);
+      error.signal = signal;
+      error.status = code;
+      return finish(error, code, signal);
+    });
+    return proc;
   }
 
   execFileSync(file, args, options = {}) {
-    return this.spawnSync(file, args, options);
+    if (!Array.isArray(args)) {
+      options = args || {};
+      args = [];
+    }
+    const result = this.spawnSync(file, args, options);
+    if (result?.error) throw result.error;
+    if (result?.status !== 0) {
+      const error = new Error(
+        `Command failed (exit ${result?.status ?? "unknown"}): ${file}`,
+      );
+      error.status = result?.status ?? null;
+      error.signal = result?.signal ?? null;
+      error.stdout = result?.stdout;
+      error.stderr = result?.stderr;
+      throw error;
+    }
+    return result?.stdout ?? "";
   }
 
   fork(modulePath, args, options = {}) {

package/src/lib/process-execution-broker/patch-child-process.js

@@ -3,10 +3,9 @@
  * This runs at CLI startup, before any other imports, ensuring every subprocess is audited
  */
 import { createRequire } from "node:module";
-const require = createRequire(import.meta.url);
+import { executionBroker } from "./index.js";
 
-// Import ExecutionBroker singleton
-const { executionBroker } = require("./index.js");
+const require = createRequire(import.meta.url);
 
 // Get the REAL native child_process module (unpatched, from Node.js internals)
 const nativeCp = require("node:child_process");

package/src/lib/process-manager.js

@@ -1,4 +1,3 @@
-import { spawn, execSync } from "node:child_process";
 import {
   readFileSync,
   writeFileSync,
@@ -10,6 +9,12 @@ import { join } from "node:path";
 import { getPidFilePath, getBinDir, ensureDir, getStatePath } from "./paths.js";
 import { isWindows } from "./platform.js";
 import logger from "./logger.js";
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: (...args) => executionBroker.spawn(...args),
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 export function startApp(options = {}) {
   ensureDir(getStatePath());
@@ -44,10 +49,14 @@ export function startApp(options = {}) {
 
   logger.verbose(`Starting: ${appPath} ${args.join(" ")}`);
 
-  const child = spawn(appPath, args, {
+  const child = _deps.spawn(appPath, args, {
     detached: true,
     stdio: "ignore",
     env: { ...process.env, ...options.env },
+    origin: "app:start",
+    policy: "allow",
+    scope: "app",
+    shell: false,
   });
 
   child.unref();
@@ -90,7 +99,13 @@ export function stopApp() {
 
   try {
     if (isWindows()) {
-      execSync(`taskkill /PID ${pid} /T /F`, { stdio: "ignore" });
+      _deps.execFileSync("taskkill", ["/PID", String(pid), "/T", "/F"], {
+        stdio: "ignore",
+        origin: "app:stop",
+        policy: "allow",
+        scope: "app",
+        shell: false,
+      });
     } else {
       process.kill(pid, "SIGTERM");
     }

package/src/lib/publish-workspace.js

@@ -4,11 +4,15 @@
  * @module lib/publish-workspace
  */
 
-import { execSync } from "child_process";
+import executionBroker from "./process-execution-broker/index.js";
 import { logger } from "./logger.js";
 import path from "path";
 import fs from "fs";
 
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
+
 /**
  * Get all workspace packages
  * @returns {Array<{name: string, path: string, version: string}>}
@@ -60,16 +64,20 @@ export function getWorkspacePackages() {
 export function publishPackage(pkg, options = {}) {
   try {
     logger.info(`Publishing ${pkg.name}@${pkg.version}...`);
-    let cmd = "npm publish";
-    if (options.tag) cmd += ` --tag ${options.tag}`;
-    if (options.access) cmd += ` --access ${options.access}`;
+    const args = ["publish"];
+    if (options.tag) args.push("--tag", String(options.tag));
+    if (options.access) args.push("--access", String(options.access));
 
-    execSync(cmd, {
+    _deps.execFileSync("npm", args, {
+      origin: "publish-workspace:npm",
+      scope: "publish",
+      policy: "allow",
+      shell: false,
       cwd: pkg.path,
       stdio: "inherit",
       encoding: "utf8",
     });
-    logger.succeed(`Published ${pkg.name}@${pkg.version}`);
+    logger.success(`Published ${pkg.name}@${pkg.version}`);
     return true;
   } catch (err) {
     logger.error(`Failed to publish ${pkg.name}: ${err.message}`);

package/src/lib/repl-bang-memorize.js

@@ -17,10 +17,10 @@
  * All process/fs access goes through `_deps` for tests.
  */
 
-import { spawnSync as spawnSyncDefault } from "child_process";
 import fsDefault from "fs";
 import pathDefault from "path";
 import { findProjectRoot } from "./project-instructions.js";
+import executionBroker from "./process-execution-broker/index.js";
 
 export const BANG_TIMEOUT_MS = 120_000;
 export const BANG_MAX_BUFFER = 10 * 1024 * 1024;
@@ -32,7 +32,7 @@ export const BANG_OUTPUT_CAP = 30_000;
 export const MEMO_NOTE_MAX = 4_000;
 
 export const _deps = {
-  spawnSync: spawnSyncDefault,
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
   fs: fsDefault,
   path: pathDefault,
 };
@@ -83,12 +83,20 @@ export function runBangCommand(line, opts = {}) {
         timeout: BANG_TIMEOUT_MS,
         maxBuffer: BANG_MAX_BUFFER,
         cwd,
+        origin: "repl:bang-command",
+        policy: "allow",
+        scope: "repl",
+        shell: false,
       })
     : spawnSync("/bin/sh", ["-c", cmd], {
         encoding: "utf-8",
         timeout: BANG_TIMEOUT_MS,
         maxBuffer: BANG_MAX_BUFFER,
         cwd,
+        origin: "repl:bang-command",
+        policy: "allow",
+        scope: "repl",
+        shell: false,
       });
 
   const exitCode = res.status == null ? (res.error ? -1 : 0) : res.status;

package/src/lib/repl-goal.js

@@ -19,6 +19,23 @@ import {
   GoalConditionEngine,
   GOAL_DECISION,
 } from "./goal-condition-engine.js";
+import executionBroker from "./process-execution-broker/index.js";
+
+const brokerRunner = executionBroker.spawnSync.bind(executionBroker);
+
+export const _processDeps = {
+  run: brokerRunner,
+};
+
+function runReplGoalCommand(command, options = {}) {
+  return _processDeps.run(command, [], {
+    ...options,
+    timeout: options.timeout ?? 30000,
+    origin: "repl-goal:exit-zero",
+    policy: "allow",
+    scope: "repl-goal",
+  });
+}
 
 // Interactive sessions are human-paced, so the turn-count budget is generous —
 // it exists only as a backstop (the engine hard-caps at 100 regardless). The
@@ -94,7 +111,7 @@ export function renderGoalVerdict(decision, events) {
 /**
  * Evaluate the session goal against a completed turn's final text. Deterministic
  * conditions run inline (contains/regex on the text; exit-zero/file-exists via
- * injected `spawnSync`/`existsSync`); a model condition delegates to `judge`.
+ * injected process runner/`existsSync`); a model condition delegates to `judge`.
  *
  * @param {GoalConditionEngine} engine
  * @param {string} finalText  the assistant's answer this turn
@@ -110,7 +127,7 @@ export async function evaluateReplGoalTurn(engine, finalText, deps = {}) {
     evaluation = runDeterministicCheck(cond, {
       lastOutput: finalText,
       cwd: deps.cwd,
-      spawnSync: deps.spawnSync,
+      spawnSync: deps.spawnSync || runReplGoalCommand,
       existsSync: deps.existsSync,
     });
   } else if (typeof deps.judge === "function") {