chainlesschain 0.162.175 → 0.162.177

package/src/lib/skill-process-broker.js

@@ -0,0 +1,71 @@
+import executionBroker from "./process-execution-broker/index.js";
+
+const defaultRunSync = executionBroker.spawnSync.bind(executionBroker);
+const defaultRunFileSync = executionBroker.execFileSync.bind(executionBroker);
+
+function skillIdentity(skill = {}) {
+  const identity = String(
+    skill.id || skill.name || skill.skillName || "unknown",
+  )
+    .trim()
+    .replace(/[^a-zA-Z0-9._:-]+/g, "-")
+    .slice(0, 96);
+  return identity || "unknown";
+}
+
+function declaresShellExecution(skill = {}) {
+  return (
+    Array.isArray(skill.capabilities) &&
+    skill.capabilities.some(
+      (capability) => String(capability).toLowerCase() === "shell-exec",
+    )
+  );
+}
+
+/**
+ * Create the narrow process facade exposed to a skill handler.
+ *
+ * The host, not the handler, owns provenance and permission metadata. Generated
+ * handlers can choose argv and ordinary process options, but cannot relabel the
+ * execution or bypass the Broker boundary.
+ */
+export function createSkillProcessBroker(
+  skill,
+  { runSync = defaultRunSync, runFileSync = defaultRunFileSync } = {},
+) {
+  if (!declaresShellExecution(skill)) return null;
+
+  const identity = skillIdentity(skill);
+  const metadata = Object.freeze({
+    origin: `skill:${identity}`,
+    policy: "allow",
+    scope: "skill",
+    pluginId: skill?.pluginId || skill?.plugin?.id || null,
+    pluginVersion: skill?.pluginVersion || skill?.plugin?.version || null,
+    pluginSource: skill?.pluginSource || skill?.plugin?.source || null,
+  });
+
+  return Object.freeze({
+    runSync(file, args = [], options = {}) {
+      return runSync(file, args, {
+        ...options,
+        ...metadata,
+      });
+    },
+
+    runFileSync(file, args = [], options = {}) {
+      return runFileSync(file, args, {
+        ...options,
+        ...metadata,
+        shell: false,
+      });
+    },
+  });
+}
+
+export const _skillProcessDefaults = {
+  runSync: defaultRunSync,
+  runFileSync: defaultRunFileSync,
+};
+
+export { declaresShellExecution as skillDeclaresShellExecution };

package/src/lib/slash-commands.js

@@ -21,11 +21,15 @@
 import fsDefault from "node:fs";
 import pathDefault from "node:path";
 import { homedir } from "node:os";
-import { execSync as execSyncDefault } from "node:child_process";
 import { expandFileRefs } from "../runtime/file-ref-expander.js";
 import { projectRootBase } from "./project-root.cjs";
+import executionBroker from "./process-execution-broker/index.js";
 
-const _deps = { fs: fsDefault, path: pathDefault, execSync: execSyncDefault };
+const _deps = {
+  fs: fsDefault,
+  path: pathDefault,
+  execSync: (...args) => executionBroker.execSync(...args),
+};
 
 /**
  * Split `--- ... ---` frontmatter from the body and camelCase the keys (so
@@ -191,6 +195,10 @@ function runBangs(text, { cwd, execSync }) {
         encoding: "utf-8",
         timeout: BANG_TIMEOUT_MS,
         stdio: ["ignore", "pipe", "pipe"],
+        origin: "slash-command:bang",
+        policy: "allow",
+        scope: "slash-command",
+        shell: true,
       });
       return String(out).trim();
     } catch (err) {

package/src/lib/status-line.cjs

@@ -13,15 +13,14 @@
  *
  * Best-effort throughout: a missing config, a broken command, or a timeout just
  * yields no status line — it never blocks or breaks the REPL. `_deps` injection
- * (spawnSync / settings reader) for tests.
+ * (process runner / settings reader) for tests.
  */
 
-const cpDefault = require("node:child_process");
 const path = require("node:path");
 const { settingsPaths, readSettingsFile } = require("./settings-loader.cjs");
 
 const _deps = {
-  spawnSync: cpDefault.spawnSync,
+  runProcess: null,
   // injectable so tests don't touch real settings files
   readSettings: (cwd, settingsFile) => {
     const out = [];
@@ -181,7 +180,7 @@ function isStatusLineDisabled({ cwd = process.cwd(), settingsFile } = {}) {
 function renderStatusLine(
   config,
   context = {},
-  { cwd, timeout = 5000, columns, rows } = {},
+  { cwd, timeout = 5000, columns, rows, runProcess } = {},
 ) {
   if (!config || !config.command) return null;
   // Claude-Code parity (2.1.153): hand the command the terminal width/height so
@@ -194,7 +193,9 @@ function renderStatusLine(
   if (rws != null) env.LINES = String(rws);
   let res;
   try {
-    res = _deps.spawnSync(config.command, {
+    const runner = runProcess || _deps.runProcess;
+    if (typeof runner !== "function") return null;
+    res = runner(config.command, [], {
       input: JSON.stringify(context),
       cwd: cwd || process.cwd(),
       env,
@@ -202,6 +203,9 @@ function renderStatusLine(
       timeout,
       shell: true,
       maxBuffer: 1024 * 1024,
+      origin: "status-line:command",
+      policy: "allow",
+      scope: "status-line",
     });
   } catch {
     return null; // spawn failure → no status line
@@ -216,11 +220,28 @@ function renderStatusLine(
 }
 
 /** Convenience: load + render in one call (used by the REPL each turn). */
-function getStatusLine({ cwd, settingsFile, sessionId, model, provider, projectDir, timeout, columns, rows } = {}) {
+function getStatusLine({
+  cwd,
+  settingsFile,
+  sessionId,
+  model,
+  provider,
+  projectDir,
+  timeout,
+  columns,
+  rows,
+  runProcess,
+} = {}) {
   const config = loadStatusLineConfig({ cwd, settingsFile });
   if (!config) return null;
   const context = buildContext({ sessionId, model, provider, cwd, projectDir });
-  return renderStatusLine(config, context, { cwd, timeout, columns, rows });
+  return renderStatusLine(config, context, {
+    cwd,
+    timeout,
+    columns,
+    rows,
+    runProcess,
+  });
 }
 
 module.exports = {

package/src/lib/status-line.js

@@ -0,0 +1,33 @@
+import statusLine from "./status-line.cjs";
+import executionBroker from "./process-execution-broker/index.js";
+
+const brokerRunner = executionBroker.spawnSync.bind(executionBroker);
+
+export function renderStatusLine(config, context, options = {}) {
+  return statusLine.renderStatusLine(config, context, {
+    ...options,
+    runProcess:
+      options.runProcess || statusLine._deps.runProcess || brokerRunner,
+  });
+}
+
+export function getStatusLine(options = {}) {
+  return statusLine.getStatusLine({
+    ...options,
+    runProcess:
+      options.runProcess || statusLine._deps.runProcess || brokerRunner,
+  });
+}
+
+export const {
+  loadStatusLineConfig,
+  buildContext,
+  formatTokens,
+  shortenPath,
+  renderDefaultStatusLine,
+  isStatusLineDisabled,
+  terminalSize,
+  _deps,
+} = statusLine;
+
+export default { ...statusLine, renderStatusLine, getStatusLine };

package/src/lib/sub-agent-context.js

@@ -83,6 +83,10 @@ export class SubAgentContext {
     // nested spawns (threaded into the loop options so a nested spawn_sub_agent
     // reads it as ctx.subAgentContract).
     this.subAgentContract = options.subAgentContract || null;
+    // Optional session-level Extension Tier admission policy. Keep it as an
+    // explicit inherited capability so child loops cannot silently bypass the
+    // parent's admission decision.
+    this.toolAdmission = options.toolAdmission || null;
     // Skill capability INTERSECT: null = unrestricted; a list (possibly empty)
     // restricts run_skill/list_skills in this context's loop to those skills.
     this.skillAllowlist =
@@ -335,6 +339,7 @@ export class SubAgentContext {
       subAgentBudget: this.subAgentBudget,
       // This context's effective contract = the ceiling for its nested spawns.
       subAgentContract: this.subAgentContract,
+      toolAdmission: this.toolAdmission,
       // Skill allow-list restricting run_skill/list_skills in this loop.
       skillAllowlist: this.skillAllowlist,
       // Parent trace for hook envelopes (absent → key omitted, no parent_id).

package/src/lib/sub-agent-profiles.js

@@ -30,6 +30,8 @@ const FULL_TOOLS = Object.freeze([
   "write_file",
   "edit_file",
   "edit_file_hashed",
+  "delete_file",
+  "move_file",
   "list_dir",
   "search_files",
   "search_sessions",
@@ -49,6 +51,8 @@ const DESIGN_TOOLS = Object.freeze([
   "write_file",
   "edit_file",
   "edit_file_hashed",
+  "delete_file",
+  "move_file",
   "list_dir",
   "search_files",
   "web_fetch",

package/src/lib/turn-context.js

@@ -11,21 +11,23 @@
  * @module turn-context
  */
 
-import { execSync } from "child_process";
 import path from "path";
+import { executionBroker } from "./process-execution-broker/index.js";
 
-const _deps = { execSync };
+const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
 
 /**
  * Run a git command with stdio pipe and return stdout or null.
- * @param {string} cmd
+ * @param {string[]} args
  * @param {string} cwd
  * @returns {string|null}
  */
-function _git(cmd, cwd) {
+function _git(args, cwd) {
   try {
     return _deps
-      .execSync(`git ${cmd}`, {
+      .execFileSync("git", args, {
         cwd,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -33,6 +35,10 @@ function _git(cmd, cwd) {
         // `status --porcelain` on a dirty repo with many files can exceed the
         // 1 MB execSync default → ENOBUFS → null → "(clean)" misreport below.
         maxBuffer: 16 * 1024 * 1024,
+        origin: "context:git",
+        policy: "allow",
+        scope: "context",
+        shell: false,
       })
       .trim();
   } catch (_e) {
@@ -60,10 +66,10 @@ export function buildTurnContext({
   lines.push(`## Turn context (iteration ${iteration})`);
   lines.push(`- cwd: ${path.resolve(cwd)}`);
 
-  const branch = _git("rev-parse --abbrev-ref HEAD", cwd);
+  const branch = _git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
   if (branch) {
-    const head = _git("rev-parse --short HEAD", cwd);
-    const status = _git("status --porcelain", cwd);
+    const head = _git(["rev-parse", "--short", "HEAD"], cwd);
+    const status = _git(["status", "--porcelain"], cwd);
     // Distinguish "command failed" (null — timeout / huge output) from "" (truly
     // clean): the old `status && …` reported a repo as "(clean)" whenever status
     // couldn't be determined, which is a wrong signal to the model.

package/src/lib/unattended-action-policy.js

@@ -121,6 +121,89 @@ export function classifyActionRisk(actionClass) {
   return "conditional"; // push — depends on branch protection
 }
 
+/**
+ * Classify a shell command before it reaches the process broker. This is a
+ * deliberately conservative, token-free classifier: compound commands use
+ * the highest-risk segment and unknown commands remain unknown so an
+ * unattended caller can fail closed.
+ */
+export function classifyShellAction(command) {
+  if (typeof command !== "string" || !command.trim()) return null;
+  const segments = command
+    .split(/&&|\|\||[;\n]|\|/)
+    .map((part) =>
+      part
+        .trim()
+        .replace(/^(?:env\s+)?(?:sudo\s+)?(?:command\s+)?/i, "")
+        .toLowerCase(),
+    )
+    .filter(Boolean);
+  const classifySegment = (segment) => {
+    if (/^git\s+push\b/.test(segment)) return ACTION_CLASS.PUSH;
+    if (/^git\s+(?:merge|rebase|cherry-pick)\b/.test(segment)) {
+      return ACTION_CLASS.MERGE;
+    }
+    if (/^(?:npm|pnpm|yarn|bun)\s+publish\b/.test(segment)) {
+      return ACTION_CLASS.PUBLISH;
+    }
+    if (
+      /^(?:terraform\s+(?:apply|destroy)|pulumi\s+up|kubectl\s+(?:apply|delete|rollout)|helm\s+(?:install|upgrade)|docker\s+push)\b/.test(
+        segment,
+      )
+    ) {
+      return segment.startsWith("docker push")
+        ? ACTION_CLASS.DEPLOY
+        : ACTION_CLASS.INFRA_MUTATION;
+    }
+    if (/\b(?:deploy|rollout)\b/.test(segment)) return ACTION_CLASS.DEPLOY;
+    if (/^(?:git\s+(?:status|diff|log|show|branch)|ls\b|dir\b|pwd\b|cat\b|type\b|rg\b|grep\b|find\b|where\b)/.test(segment)) {
+      return ACTION_CLASS.READ;
+    }
+    if (/^(?:npm|pnpm|yarn|bun)\s+(?:test|run\s+(?:test|lint|build)|install\b)/.test(segment) || /^(?:pytest|vitest|jest|cargo\s+test|go\s+test)\b/.test(segment)) {
+      return ACTION_CLASS.LOCAL_WRITE;
+    }
+    if (/^echo\b/.test(segment) && />/.test(segment)) {
+      return ACTION_CLASS.LOCAL_WRITE;
+    }
+    return null;
+  };
+  const rank = [
+    ACTION_CLASS.READ,
+    ACTION_CLASS.LOCAL_WRITE,
+    ACTION_CLASS.COMMIT,
+    ACTION_CLASS.PUSH,
+    ACTION_CLASS.PUBLISH,
+    ACTION_CLASS.MERGE,
+    ACTION_CLASS.DEPLOY,
+    ACTION_CLASS.INFRA_MUTATION,
+    ACTION_CLASS.EXTERNAL_MESSAGE,
+  ];
+  const classified = segments.map(classifySegment);
+  return classified.reduce((highest, current) => {
+    if (!current) return null;
+    if (!highest) return current;
+    return rank.indexOf(current) > rank.indexOf(highest) ? current : highest;
+  }, null);
+}
+
+/** Apply the unattended policy to a shell command, including protected push targets. */
+export function evaluateUnattendedShellAction(command, params = {}) {
+  const actionClass = classifyShellAction(command);
+  const protectedBranch =
+    params.protectedBranch === true ||
+    /\bgit\s+push\b[^\n]*(?:^|\s)(?:main|master|develop|production)(?:\s|$)/i.test(
+      command || "",
+    );
+  return {
+    actionClass,
+    ...evaluateUnattendedAction({
+    ...params,
+    actionClass,
+    protectedBranch,
+    }),
+  };
+}
+
 /**
  * Decide whether a fired task may perform one action. Fail-closed.
  *

package/src/lib/update-notice.js

@@ -5,12 +5,12 @@
 import fsDefault from "fs";
 import pathDefault from "path";
 import osDefault from "os";
-import { spawn as spawnDefault } from "child_process";
 import { fileURLToPath } from "url";
 import chalk from "chalk";
 import semver from "semver";
 import { VERSION } from "../constants.js";
 import { readDiskVersion } from "./version-skew.js";
+import { executionBroker } from "./process-execution-broker/index.js";
 
 export const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 export const NPM_LATEST_URL =
@@ -19,7 +19,7 @@ export const _deps = {
   fs: fsDefault,
   path: pathDefault,
   os: osDefault,
-  spawn: spawnDefault,
+  spawn: (...args) => executionBroker.spawn(...args),
 };
 
 export function cachePath(deps = _deps) {
@@ -95,6 +95,10 @@ export function maybeNotifyUpdate(opts = {}) {
         detached: true,
         stdio: "ignore",
         windowsHide: true,
+        origin: "update:notice-refresh",
+        policy: "allow",
+        scope: "update",
+        shell: false,
       });
       if (child && typeof child.unref === "function") child.unref();
       out.spawned = true;

package/src/lib/with-file-lock.js

@@ -26,6 +26,7 @@ export function withFileLock(targetPath, fn, opts = {}) {
     _fs = defaultFs,
     _now = () => Date.now(),
     _sleep = sleepSync,
+    failIfUnavailable = false,
   } = opts;
 
   const lockDir = `${targetPath}.lock`;
@@ -54,6 +55,12 @@ export function withFileLock(targetPath, fn, opts = {}) {
     }
   }
 
+  if (!held && failIfUnavailable) {
+    const error = new Error(`Could not acquire state lock: ${targetPath}`);
+    error.code = "STATE_LOCK_UNAVAILABLE";
+    throw error;
+  }
+
   try {
     return fn({ locked: held });
   } finally {

package/src/lib/ws-server.js

@@ -14,4 +14,5 @@ export {
   ChainlessChainWSServer,
   tokenizeCommand,
   isCommandBlocked,
+  _deps,
 } from "../gateways/ws/ws-server.js";