chainlesschain 0.162.176 → 0.162.177

package/src/harness/background-task-worker.js

@@ -5,7 +5,7 @@
  * Sends messages to parent: { type: "heartbeat"|"result"|"error", ... }
  */
 
-import { execSync } from "node:child_process";
+import executionBroker from "../lib/process-execution-broker/index.js";
 
 const [command, cwd, type] = process.argv.slice(2);
 
@@ -14,23 +14,16 @@ const heartbeat = setInterval(() => {
 }, 5000);
 
 try {
-  let result;
-
-  if (type === "shell") {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  } else {
-    result = execSync(command, {
-      cwd: cwd || process.cwd(),
-      encoding: "utf-8",
-      timeout: 300000,
-      maxBuffer: 10 * 1024 * 1024,
-    });
-  }
+  const result = executionBroker.execSync(command, {
+    cwd: cwd || process.cwd(),
+    encoding: "utf-8",
+    timeout: 300000,
+    maxBuffer: 10 * 1024 * 1024,
+    origin: `background-task:command:${type || "unknown"}`,
+    policy: "allow",
+    scope: "background-task",
+    shell: true,
+  });
 
   if (process.send) {
     process.send({ type: "result", data: result || "Done" });

package/src/harness/mcp-client.js

@@ -8,7 +8,6 @@
  * thin re-export shim for backwards compatibility.
  */
 
-import { spawn } from "child_process";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { EventEmitter } from "events";
@@ -21,7 +20,7 @@ import { EventRuntimeProducer } from "../lib/event-runtime-producer.js";
  * `fetch` defaults to the global fetch (Node 18+).
  */
 export const _deps = {
-  spawn,
+  spawn: executionBroker.spawn.bind(executionBroker),
   fetch: (...args) => globalThis.fetch(...args),
   // Backoff sleep seam (tests override with a no-op so retries don't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -486,10 +485,7 @@ export class MCPClient extends EventEmitter {
             `stdio transport requires a command (server "${name}")`,
           );
         }
-        const spawnFn = String(config.origin || "").startsWith("plugin:")
-          ? executionBroker.spawn.bind(executionBroker)
-          : _deps.spawn;
-        const proc = spawnFn(config.command, config.args || [], {
+        const proc = _deps.spawn(config.command, config.args || [], {
           stdio: ["pipe", "pipe", "pipe"],
           // process.env < agent identity (CLAUDECODE / session id) < the
           // server's own config.env, so an explicit per-server override wins.
@@ -498,15 +494,13 @@ export class MCPClient extends EventEmitter {
             ...this._agentIdentityEnv(),
             ...(config.env || {}),
           },
-          ...(config.origin
-            ? {
-                origin: config.origin,
-                policy: config.policy || "allow",
-                pluginId: config.pluginId,
-                pluginVersion: config.pluginVersion,
-                pluginSource: config.pluginSource,
-              }
-            : {}),
+          origin: config.origin || `mcp:server:${name}`,
+          policy: config.policy || "allow",
+          scope: config.scope || "mcp",
+          shell: false,
+          pluginId: config.pluginId,
+          pluginVersion: config.pluginVersion,
+          pluginSource: config.pluginSource,
         });
 
         entry.process = proc;

package/src/harness/worktree-isolator.js

@@ -7,7 +7,6 @@
  * Feature-flag gated: WORKTREE_ISOLATION
  */
 
-import { execSync } from "node:child_process";
 import { existsSync, rmSync, symlinkSync, mkdirSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import {
@@ -93,10 +92,10 @@ export function removeWorktree(repoDir, worktreePath, options = {}) {
   let branch = null;
   if (deleteBranch) {
     try {
-      branch = execSync("git rev-parse --abbrev-ref HEAD", {
-        cwd: worktreePath,
-        encoding: "utf-8",
-      }).trim();
+      branch = gitExecArgs(
+        ["rev-parse", "--abbrev-ref", "HEAD"],
+        worktreePath,
+      ).trim();
     } catch (_e) {
       // Can't determine branch, skip branch deletion.
     }
@@ -215,11 +214,7 @@ function _worktreeCleanupState(repoDir, wt) {
 
   // Dirty state: separate tracked modifications from untracked files.
   try {
-    const porcelain = execSync("git status --porcelain", {
-      cwd: wt.path,
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    const porcelain = gitExecArgs(["status", "--porcelain"], wt.path);
     const lines = porcelain.split("\n").filter((l) => l.trim().length > 0);
     state.untracked = lines.some((l) => l.startsWith("??"));
     state.uncommitted = lines.some((l) => !l.startsWith("??"));
@@ -393,8 +388,16 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
     };
   } catch (err) {
     const errMsg = err.message || String(err);
-    if (errMsg.includes("CONFLICT") || errMsg.includes("conflict")) {
-      const conflictPaths = _collectConflictFiles(repoDir);
+    // Git can report merge conflicts on stdout while execSync's Error.message
+    // contains only the failed command (and localized installations need not
+    // include the English word "conflict"). The unmerged index is the
+    // authoritative signal.
+    const conflictPaths = _collectConflictFiles(repoDir);
+    if (
+      conflictPaths.length > 0 ||
+      errMsg.includes("CONFLICT") ||
+      errMsg.includes("conflict")
+    ) {
       if (conflictPaths.length === 0) {
         conflictPaths.push(..._extractConflictPathsFromMessage(errMsg));
       }
@@ -690,15 +693,9 @@ function _fileStatus(repoDir, base, branch, filePath) {
 
 function _hasUncommittedChanges(worktreePath) {
   try {
-    const output = execSync("git status --porcelain", {
-      cwd: worktreePath,
-      encoding: "utf-8",
-      // A worktree with many dirty files produces >1 MB of porcelain output and
-      // would ENOBUFS on the default cap — the catch below then reports "clean"
-      // (fail-OPEN), which could let a caller discard a worktree full of
-      // uncommitted work. Give it the same 64 MB headroom as gitExec.
-      maxBuffer: 64 * 1024 * 1024,
-    });
+    // gitExecArgs carries the shared 64 MB maxBuffer, avoiding a fail-open
+    // "clean" result when a large worktree exceeds Node's default output cap.
+    const output = gitExecArgs(["status", "--porcelain"], worktreePath);
     return output.trim().length > 0;
   } catch (_e) {
     return false;

package/src/lib/agent-core.js

@@ -13,6 +13,8 @@ export {
   getAgentToolDescriptors,
   getCachedPython,
   getEnvironmentInfo,
+  _environmentProcessDeps,
+  _agentToolProcessDeps,
   getBaseSystemPrompt,
   buildSystemPrompt,
   executeTool,
@@ -29,6 +31,9 @@ export {
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
   killAllBackgroundShellTasksSync,
+  _backgroundProcessDeps,
+  _runBackgroundTaskkill,
+  _gitProcessDeps,
   reapIdleBackgroundShellTasks,
   _ingestSearchOutput,
   writeFileVerified,

package/src/lib/agent-ipc-bus.js

@@ -13,6 +13,11 @@ import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
 import { EventRuntimeProducer } from "./event-runtime-producer.js";
 import { EventRuntimeStore } from "./event-runtime-store.js";
+import executionBroker from "./process-execution-broker/index.js";
+
+export const _deps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+};
 
 /**
  * @typedef {Object} InteractionRequest
@@ -170,12 +175,12 @@ class AgentIPCBus extends EventEmitter {
    * @returns {Promise<{process: ChildProcess, agentId: string}>}
    */
   async spawnAgentProcess(command, args = [], options = {}) {
-    const { spawn } = await import("node:child_process");
     const agentId = options.agentId || crypto.randomUUID();
     const heartbeatMs = options.heartbeatMs || 30000;
 
     return new Promise((resolve, reject) => {
-      const child = spawn(command, args, {
+      const spawnOptions = options.spawnOptions || {};
+      const child = _deps.spawn(command, args, {
         stdio: ["pipe", "pipe", "pipe"],
         env: {
           ...process.env,
@@ -184,7 +189,11 @@ class AgentIPCBus extends EventEmitter {
           CHAINLESSCHAIN_IPC_PROTOCOL: "jsonrpc-stdio-v1",
           ...options.env,
         },
-        ...options.spawnOptions,
+        ...spawnOptions,
+        origin: spawnOptions.origin || "agent-ipc:subagent",
+        policy: spawnOptions.policy || "allow",
+        scope: spawnOptions.scope || "agent-ipc",
+        shell: spawnOptions.shell === true,
       });
 
       let buffer = "";

package/src/lib/agent-team/team-worktree.js

@@ -23,7 +23,12 @@ import {
 } from "../../harness/worktree-isolator.js";
 import { isGitRepo as _isGitRepo } from "../../lib/git-integration.js";
 import { normalizeSparsePaths } from "../../lib/worktree-sparse.js";
-import { execFileSync, spawn } from "node:child_process";
+import executionBroker from "../../lib/process-execution-broker/index.js";
+
+export const _processDeps = {
+  spawn: executionBroker.spawn.bind(executionBroker),
+  execFileSync: executionBroker.execFileSync.bind(executionBroker),
+};
 
 /**
  * Resolve the sparse-checkout / dependency-symlink options for a task, letting a
@@ -49,7 +54,14 @@ function resolveWorktreeOptions(task, defaults) {
 
 function defaultRunShell(command, cwd) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, { cwd, shell: true, env: process.env });
+    const child = _processDeps.spawn(command, [], {
+      cwd,
+      shell: true,
+      env: process.env,
+      origin: "team-worktree:task-command",
+      policy: "allow",
+      scope: "team-worktree",
+    });
     let err = "";
     child.stderr?.on("data", (d) => (err += d.toString("utf8")));
     child.on("error", (e) => reject(new Error(e.message)));
@@ -61,12 +73,22 @@ function defaultRunShell(command, cwd) {
   });
 }
 
+function runTeamGit(args, cwd) {
+  return _processDeps.execFileSync("git", args, {
+    cwd,
+    stdio: "ignore",
+    origin: "team-worktree:commit",
+    policy: "allow",
+    scope: "team-worktree",
+    shell: false,
+  });
+}
+
 /** Stage + commit everything in a worktree. Returns true if a commit was made. */
 function defaultCommit(worktreePath, message) {
-  execFileSync("git", ["add", "-A"], { cwd: worktreePath, stdio: "ignore" });
+  runTeamGit(["add", "-A"], worktreePath);
   try {
-    execFileSync(
-      "git",
+    runTeamGit(
       [
         "-c",
         "user.email=team@chainlesschain.local",
@@ -76,7 +98,7 @@ function defaultCommit(worktreePath, message) {
         "-m",
         message,
       ],
-      { cwd: worktreePath, stdio: "ignore" },
+      worktreePath,
     );
     return true;
   } catch {

package/src/lib/agent-worktree.js

@@ -11,24 +11,28 @@
  *    a merge hint. Removal failures fail-open to "kept".
  */
 
-import { execFileSync, execSync } from "child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { createWorktree, removeWorktree } from "./worktree-isolator.js";
 import { findProjectRoot } from "./project-instructions.js";
+import executionBroker from "./process-execution-broker/index.js";
 
 export const _deps = {
-  execFileSync,
-  execSync,
+  execFileSync: executionBroker.execFileSync.bind(executionBroker),
   createWorktree,
   removeWorktree,
 };
 
-function git(cmd, cwd, deps) {
-  return (deps.execSync || execSync)(`git ${cmd}`, {
+function git(args, cwd, deps, options = {}) {
+  const run = deps.execFileSync || _deps.execFileSync;
+  return run("git", args, {
     cwd,
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
+    stdio: options.stdio || ["ignore", "pipe", "ignore"],
+    origin: options.origin || "agent-worktree:query",
+    policy: "allow",
+    scope: "agent-worktree",
+    shell: false,
   });
 }
 
@@ -90,17 +94,17 @@ export function validateAgentWorktree(info, { deps = _deps } = {}) {
     }
 
     const repoTop = canonicalPath(
-      git("rev-parse --show-toplevel", info.repoRoot, deps).trim(),
+      git(["rev-parse", "--show-toplevel"], info.repoRoot, deps).trim(),
     );
     const worktreeTop = canonicalPath(
-      git("rev-parse --show-toplevel", worktreePath, deps).trim(),
+      git(["rev-parse", "--show-toplevel"], worktreePath, deps).trim(),
     );
     if (repoTop !== repo || worktreeTop !== worktree) {
       return { valid: false, reason: "worktree path identity mismatch" };
     }
 
     const registered = parseRegisteredWorktrees(
-      git("worktree list --porcelain", info.repoRoot, deps),
+      git(["worktree", "list", "--porcelain"], info.repoRoot, deps),
     ).find((entry) => {
       try {
         return canonicalPath(entry.path) === worktree;
@@ -138,16 +142,13 @@ function removeVerifiedAgentWorktree(info, deps) {
     return null;
   }
 
-  const run = deps.execFileSync || execFileSync;
-  run("git", ["worktree", "remove", info.path], {
-    cwd: info.repoRoot,
-    encoding: "utf8",
+  git(["worktree", "remove", info.path], info.repoRoot, deps, {
+    origin: "agent-worktree:cleanup",
     stdio: ["ignore", "pipe", "pipe"],
   });
   try {
-    run("git", ["branch", "-D", "--", info.branch], {
-      cwd: info.repoRoot,
-      encoding: "utf8",
+    git(["branch", "-D", "--", info.branch], info.repoRoot, deps, {
+      origin: "agent-worktree:cleanup",
       stdio: ["ignore", "pipe", "pipe"],
     });
     return null;
@@ -174,7 +175,7 @@ export function setupAgentWorktree({
   const suffix = Math.random().toString(36).slice(2, 6);
   const branch = `cc-agent-${stamp}-${suffix}`;
   const info = (deps.createWorktree || createWorktree)(repoRoot, branch);
-  const baseSha = git("rev-parse HEAD", info.path, deps).trim();
+  const baseSha = git(["rev-parse", "HEAD"], info.path, deps).trim();
   return { ...info, repoRoot, baseSha };
 }
 
@@ -205,8 +206,8 @@ export function finishAgentWorktree(info, { deps = _deps } = {}) {
   let headSha = null;
   let readable = false;
   try {
-    dirty = git("status --porcelain", info.path, deps).trim().length > 0;
-    headSha = git("rev-parse HEAD", info.path, deps).trim();
+    dirty = git(["status", "--porcelain"], info.path, deps).trim().length > 0;
+    headSha = git(["rev-parse", "HEAD"], info.path, deps).trim();
     readable = true;
   } catch {
     /* unreadable → keep, never destroy work we cannot verify */

package/src/lib/async-hook-supervisor.cjs

@@ -28,11 +28,10 @@
  *   - tree-reaping of every child on stopAll() / process 'exit', so a session
  *     never leaves an orphan hook process.
  *
- * `_deps.spawn` / `_deps.now` are injected so the whole supervisor is unit-
+ * Process runners and `_deps.now` are injected so the whole supervisor is unit-
  * testable with fake child processes (no real shell).
  */
 
-const cpDefault = require("node:child_process");
 const { tryParseDecision } = require("./hook-runner.cjs");
 
 const DEFAULT_TIMEOUT_MS = 60000;
@@ -52,8 +51,10 @@ class AsyncHookSupervisor {
         ? Number(opts.maxConcurrent)
         : DEFAULT_MAX_CONCURRENT;
     this._deps = {
-      spawn: opts.spawn || cpDefault.spawn,
-      spawnSync: opts.spawnSync || cpDefault.spawnSync,
+      run: opts.run || opts.spawn || null,
+      runSync: opts.runSync || opts.spawnSync || null,
+      killProcess: opts.killProcess || process.kill.bind(process),
+      platform: opts.platform || process.platform,
       now: opts.now || (() => Date.now()),
     };
     this._running = new Map(); // key -> { child, timer }
@@ -125,8 +126,12 @@ class AsyncHookSupervisor {
       return;
     }
     try {
-      if (process.platform === "win32") {
-        const r = this._deps.spawnSync(
+      if (this._deps.platform === "win32") {
+        // Snapshot before taskkill: a policy-restricted taskkill may terminate
+        // the shell and then fail on its descendants, orphaning them so a
+        // parent-PID query performed afterward can no longer find the tree.
+        const descendants = this._windowsDescendantPids(pid);
+        const r = this._deps.runSync(
           "taskkill",
           ["/PID", String(pid), "/T", "/F"],
           { windowsHide: true },
@@ -135,20 +140,27 @@ class AsyncHookSupervisor {
         // tree snapshot and termination. Repeat once so that race cannot
         // leave a short-lived hook grandchild orphaned.
         if (!r?.error && r?.status === 0) {
-          this._deps.spawnSync(
-            "taskkill",
-            ["/PID", String(pid), "/T", "/F"],
-            { windowsHide: true },
-          );
+          this._deps.runSync("taskkill", ["/PID", String(pid), "/T", "/F"], {
+            windowsHide: true,
+          });
         }
-        // If taskkill couldn't launch, fall back to a direct kill.
+        // Restricted runners can launch taskkill but still receive a non-zero
+        // access/policy result. Enumerate the tree while it is still alive,
+        // then terminate descendants leaf-first before killing the shell.
         if (r && (r.error || (r.status != null && r.status !== 0))) {
+          for (const descendant of descendants.reverse()) {
+            try {
+              this._deps.killProcess(descendant, "SIGKILL");
+            } catch {
+              /* already gone */
+            }
+          }
           child.kill(signal);
         }
       } else {
         // Negative pid → the whole process group (requires the detached spawn).
         try {
-          process.kill(-pid, signal);
+          this._deps.killProcess(-pid, signal);
         } catch {
           child.kill(signal);
         }
@@ -162,6 +174,102 @@ class AsyncHookSupervisor {
     }
   }
 
+  /**
+   * Snapshot a Windows process tree for the taskkill-denied fallback. Query the
+   * process table once instead of issuing a quoted WMIC `where` expression for
+   * every level: Node/cmd quoting can silently turn that expression into an
+   * invalid WMIC alias query. PowerShell/CIM covers systems where WMIC has been
+   * removed. Traversal is bounded + cycle-safe so corrupt data cannot stall
+   * session teardown.
+   */
+  _windowsDescendantPids(rootPid) {
+    if (this._deps.platform !== "win32") return [];
+    const root = Number(rootPid);
+    if (!Number.isInteger(root) || root <= 0) return [];
+    let output = "";
+    let shouldTryCim = false;
+    try {
+      const result = this._deps.runSync(
+        "wmic",
+        [
+          "path",
+          "Win32_Process",
+          "get",
+          "ParentProcessId,ProcessId",
+          "/format:csv",
+        ],
+        {
+          encoding: "utf8",
+          windowsHide: true,
+          timeout: 3000,
+        },
+      );
+      if (!result?.error && result?.status === 0) {
+        output = String(result.stdout || "");
+      } else if (result?.error?.code === "ENOENT") {
+        shouldTryCim = true;
+      }
+    } catch {
+      shouldTryCim = true;
+    }
+    if (!output && shouldTryCim) {
+      try {
+        const result = this._deps.runSync(
+          "powershell.exe",
+          [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            "Get-CimInstance Win32_Process | ForEach-Object { '{0},{1}' -f $_.ParentProcessId,$_.ProcessId }",
+          ],
+          {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 3000,
+          },
+        );
+        if (!result?.error && result?.status === 0) {
+          output = String(result.stdout || "");
+        }
+      } catch {
+        return [];
+      }
+    }
+
+    const childrenByParent = new Map();
+    for (const line of output.split(/\r?\n/)) {
+      const fields = line.trim().split(",");
+      if (fields.length < 2) continue;
+      const parentPid = Number(fields.at(-2));
+      const childPid = Number(fields.at(-1));
+      if (
+        !Number.isInteger(parentPid) ||
+        parentPid < 0 ||
+        !Number.isInteger(childPid) ||
+        childPid <= 0
+      ) {
+        continue;
+      }
+      const children = childrenByParent.get(parentPid) || [];
+      children.push(childPid);
+      childrenByParent.set(parentPid, children);
+    }
+
+    const seen = new Set([root]);
+    const pending = [root];
+    const descendants = [];
+    while (pending.length > 0 && seen.size <= 256) {
+      const parentPid = pending.shift();
+      for (const childPid of childrenByParent.get(parentPid) || []) {
+        if (seen.has(childPid)) continue;
+        seen.add(childPid);
+        descendants.push(childPid);
+        pending.push(childPid);
+      }
+    }
+    return descendants;
+  }
+
   /** Install the process-exit reaper exactly once, only when a child exists. */
   _installExitHook() {
     if (this._exitHookInstalled) return;
@@ -257,22 +365,24 @@ class AsyncHookSupervisor {
         // POSIX: own process group so a timeout / stopAll can signal the whole
         // tree (shell + the real hook command), not just the shell wrapper.
         // No-op on Windows, where the tree is reaped via `taskkill /T` instead.
-        detached: process.platform !== "win32",
+        detached: this._deps.platform !== "win32",
         env: {
           ...process.env,
           CLAUDE_HOOK_EVENT: hook.event || payload.hook_event_name || "",
         },
       };
-      child = opts.broker && hook.origin === "plugin:hook"
-        ? opts.broker.spawn(hook.command, [], {
-            ...spawnOptions,
-            origin: hook.origin,
-            policy: "allow",
-            pluginId: hook.pluginId || null,
-            pluginVersion: hook.pluginVersion || null,
-            pluginSource: hook.pluginSource || null,
-          })
-        : this._deps.spawn(hook.command, spawnOptions);
+      if (typeof this._deps.run !== "function") {
+        throw new Error("async hook process runner unavailable");
+      }
+      child = this._deps.run(hook.command, {
+        ...spawnOptions,
+        origin: hook.origin || "async-hook:command",
+        policy: "allow",
+        scope: "async-hook",
+        pluginId: hook.pluginId || null,
+        pluginVersion: hook.pluginVersion || null,
+        pluginSource: hook.pluginSource || null,
+      });
     } catch (err) {
       this._record(hook, {
         ok: false,

package/src/lib/async-hook-supervisor.js

@@ -0,0 +1,47 @@
+import supervisor from "./async-hook-supervisor.cjs";
+import executionBroker from "./process-execution-broker/index.js";
+
+const brokerRunner = executionBroker.spawn.bind(executionBroker);
+const brokerSyncRunner = executionBroker.spawnSync.bind(executionBroker);
+
+export const _processDeps = {
+  run: brokerRunner,
+  runSync: brokerSyncRunner,
+};
+
+function runAsyncHook(command, options = {}) {
+  return _processDeps.run(command, [], {
+    ...options,
+    origin: options.origin || "async-hook:command",
+    policy: "allow",
+    scope: "async-hook",
+  });
+}
+
+function runAsyncHookSupervisorCommand(command, args, options = {}) {
+  return _processDeps.runSync(command, args, {
+    ...options,
+    origin: options.origin || "async-hook:supervisor",
+    policy: "allow",
+    scope: "async-hook",
+  });
+}
+
+export class AsyncHookSupervisor extends supervisor.AsyncHookSupervisor {
+  constructor(options = {}) {
+    super({
+      ...options,
+      run: options.run || options.spawn || runAsyncHook,
+      runSync:
+        options.runSync || options.spawnSync || runAsyncHookSupervisorCommand,
+    });
+  }
+}
+
+export const { DEFAULT_TIMEOUT_MS, DEFAULT_MAX_CONCURRENT } = supervisor;
+
+export default {
+  AsyncHookSupervisor,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_CONCURRENT,
+};