chainlesschain 0.162.176 → 0.162.177

package/src/repl/agent-repl.js

@@ -183,12 +183,12 @@ function persistRecentDenial(record, options = {}) {
  * user's attention (e.g. waiting on a permission/risk confirmation). A hook can
  * ring a bell / send a desktop notification. Best-effort, never blocks.
  */
-async function _fireNotification(message, type = "info") {
+async function _fireNotification(message, type = "info", session = null) {
   // Fire settings.json observe hooks first (best-effort)
   if (_settingsHooks) {
     try {
       const { runObserveHooks } =
-        await import("../lib/settings-hook-events.cjs");
+        await import("../lib/settings-hook-events.js");
       runObserveHooks(
         _settingsHooks,
         "Notification",
@@ -196,7 +196,7 @@ async function _fireNotification(message, type = "info") {
           message,
           type,
           cwd: process.cwd(),
-          session_id: _session?.sessionId || null,
+          session_id: session?.sessionId || null,
         },
         { cwd: process.cwd() },
       );
@@ -205,10 +205,10 @@ async function _fireNotification(message, type = "info") {
     }
   }
   // Fire database-registered Notification hooks (interceptable/suppressible)
-  if (_session) {
+  if (session) {
     try {
       const result = await fireNotification(_hookDb, message, {
-        session: _session,
+        session,
         type,
       });
       if (result?.directive?.suppress) {
@@ -750,6 +750,8 @@ export async function startAgentRepl(options = {}) {
         }
         await _fireNotification(
           `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
+          "info",
+          _sessionHandle,
         );
         const local = askGateApprovalLocally({ tool, args, riskLevel });
         if (!_remoteApproval?.bridge) return local.promise;
@@ -840,6 +842,8 @@ export async function startAgentRepl(options = {}) {
       }
       await _fireNotification(
         `Permission needed: ${tool}${rule ? " (" + rule + ")" : ""}`,
+        "info",
+        _sessionHandle,
       );
       const local = askPermissionLocally({ tool, args, rule, reason });
       if (!_remoteApproval?.bridge) return local.promise;
@@ -1142,7 +1146,7 @@ export async function startAgentRepl(options = {}) {
   if (_settingsHooks && _loadedReplInstructions) {
     try {
       const { runInstructionsLoadedHooks } =
-        await import("../lib/settings-hook-events.cjs");
+        await import("../lib/settings-hook-events.js");
       const ctx = runInstructionsLoadedHooks(_settingsHooks, {
         files: _loadedReplInstructions.files,
         cwd: process.cwd(),
@@ -1158,7 +1162,7 @@ export async function startAgentRepl(options = {}) {
   if (_settingsHooks) {
     try {
       const { runSessionStartHooks } =
-        await import("../lib/settings-hook-events.cjs");
+        await import("../lib/settings-hook-events.js");
       const ctx = runSessionStartHooks(_settingsHooks, {
         source: "startup",
         cwd: process.cwd(),
@@ -1466,7 +1470,7 @@ export async function startAgentRepl(options = {}) {
     if (_settingsHooks && messages.some((m) => m.role !== "system")) {
       try {
         const { runObserveHooks } =
-          await import("../lib/settings-hook-events.cjs");
+          await import("../lib/settings-hook-events.js");
         runObserveHooks(
           _settingsHooks,
           "SessionResume",
@@ -1764,31 +1768,34 @@ export async function startAgentRepl(options = {}) {
 
   // MCP elicitation in the interactive REPL uses the same readline surface as
   // approvals, while MCPClient retains the protocol-level response shape.
-  const mcpElicitationClients = [
-    _adhocMcp?.mcpClient,
-    _bundleMcpClient,
-  ].filter((client) => client?.setElicitationHandler);
+  const mcpElicitationClients = [_adhocMcp?.mcpClient, _bundleMcpClient].filter(
+    (client) => client?.setElicitationHandler,
+  );
   for (const client of mcpElicitationClients) {
     client.setElicitationHandler(
       (request) =>
         new Promise((resolve) => {
-          const label = request.message || "MCP server requests additional input";
-          rl.question(chalk.yellow(`\n  MCP [${request.server}] ${label}\n  > `), (answer) => {
-            const trimmed = String(answer || "").trim();
-            if (!trimmed) {
-              resolve({ action: "cancel" });
-            } else {
-              let content = { value: trimmed };
-              try {
-                const parsed = JSON.parse(trimmed);
-                if (parsed && typeof parsed === "object") content = parsed;
-              } catch {
-                // Plain text remains a valid single-field elicitation answer.
+          const label =
+            request.message || "MCP server requests additional input";
+          rl.question(
+            chalk.yellow(`\n  MCP [${request.server}] ${label}\n  > `),
+            (answer) => {
+              const trimmed = String(answer || "").trim();
+              if (!trimmed) {
+                resolve({ action: "cancel" });
+              } else {
+                let content = { value: trimmed };
+                try {
+                  const parsed = JSON.parse(trimmed);
+                  if (parsed && typeof parsed === "object") content = parsed;
+                } catch {
+                  // Plain text remains a valid single-field elicitation answer.
+                }
+                resolve({ action: "accept", content });
               }
-              resolve({ action: "accept", content });
-            }
-            rl.prompt();
-          });
+              rl.prompt();
+            },
+          );
         }),
       { timeoutMs: options.mcpElicitationTimeoutMs },
     );
@@ -1896,7 +1903,7 @@ export async function startAgentRepl(options = {}) {
         // turn — the session stays open, the current work is suspended. The
         // keypress handler can't await, so fire observe-only fire-and-forget.
         if (_settingsHooks) {
-          import("../lib/settings-hook-events.cjs")
+          import("../lib/settings-hook-events.js")
             .then(({ runObserveHooks }) =>
               runObserveHooks(
                 _settingsHooks,
@@ -2058,7 +2065,7 @@ export async function startAgentRepl(options = {}) {
   const _costStore = newCostStore(); // running token spend for `/cost`
   let _renderStatus = null;
   try {
-    const slm = await import("../lib/status-line.cjs");
+    const slm = await import("../lib/status-line.js");
     const _sl = slm.default || slm;
     const _slCfg = _sl.loadStatusLineConfig({ cwd: process.cwd() });
     _customStatus = !!_slCfg;
@@ -3153,12 +3160,12 @@ export async function startAgentRepl(options = {}) {
           if (_settingsHooks && oldCwd !== newCwd) {
             try {
               const { runCwdChangedHooks, dispatchAsyncHooks } =
-                await import("../lib/settings-hook-events.cjs");
+                await import("../lib/settings-hook-events.js");
               const payload = { oldCwd, newCwd, sessionId };
               runCwdChangedHooks(_settingsHooks, payload);
               if (!_asyncHookSupervisor) {
                 const { AsyncHookSupervisor } =
-                  await import("../lib/async-hook-supervisor.cjs");
+                  await import("../lib/async-hook-supervisor.js");
                 _asyncHookSupervisor = new AsyncHookSupervisor({
                   persistStats: true,
                 });
@@ -3739,7 +3746,7 @@ export async function startAgentRepl(options = {}) {
         if (_settingsHooks) {
           try {
             const { runObserveHooks, dispatchAsyncHooks } =
-              await import("../lib/settings-hook-events.cjs");
+              await import("../lib/settings-hook-events.js");
             const payload = {
               session_id: sessionId || null,
               source: "reload-plugins",
@@ -3747,7 +3754,7 @@ export async function startAgentRepl(options = {}) {
             runObserveHooks(_settingsHooks, "ConfigChange", payload, { cwd });
             if (!_asyncHookSupervisor) {
               const { AsyncHookSupervisor } =
-                await import("../lib/async-hook-supervisor.cjs");
+                await import("../lib/async-hook-supervisor.js");
               _asyncHookSupervisor = new AsyncHookSupervisor({
                 persistStats: true,
               });
@@ -5099,7 +5106,7 @@ export async function startAgentRepl(options = {}) {
     if (_settingsHooks) {
       try {
         const { runUserPromptSubmitHooks } =
-          await import("../lib/settings-hook-events.cjs");
+          await import("../lib/settings-hook-events.js");
         const ups = runUserPromptSubmitHooks(_settingsHooks, {
           prompt: userContent,
           cwd: process.cwd(),
@@ -5122,10 +5129,10 @@ export async function startAgentRepl(options = {}) {
         // turn without blocking it; its result/rewake surfaces on a later turn
         // via the async-hook drain below. Lazily create the supervisor.
         const { dispatchAsyncHooks } =
-          await import("../lib/settings-hook-events.cjs");
+          await import("../lib/settings-hook-events.js");
         if (!_asyncHookSupervisor) {
           const { AsyncHookSupervisor } =
-            await import("../lib/async-hook-supervisor.cjs");
+            await import("../lib/async-hook-supervisor.js");
           _asyncHookSupervisor = new AsyncHookSupervisor({
             persistStats: true,
           });
@@ -5433,7 +5440,7 @@ export async function startAgentRepl(options = {}) {
       // fire-and-forget; their results/rewakes drain into the next turn above.
       if (_settingsHooks && !_asyncHookSupervisor) {
         const { AsyncHookSupervisor } =
-          await import("../lib/async-hook-supervisor.cjs");
+          await import("../lib/async-hook-supervisor.js");
         _asyncHookSupervisor = new AsyncHookSupervisor({ persistStats: true });
       }
       const {
@@ -5579,7 +5586,6 @@ export async function startAgentRepl(options = {}) {
         try {
           const rg = await import("../lib/repl-goal.js");
           const fsMod = await import("node:fs");
-          const cpMod = await import("node:child_process");
           const judge = async (cond, { finalText }) => {
             const { chatWithTools } = await import("../runtime/agent-core.js");
             const { firstBalancedJson } =
@@ -5621,7 +5627,6 @@ export async function startAgentRepl(options = {}) {
             response || "",
             {
               cwd: process.cwd(),
-              spawnSync: cpMod.spawnSync,
               existsSync: fsMod.existsSync,
               judge,
             },
@@ -5772,7 +5777,7 @@ export async function startAgentRepl(options = {}) {
       if (_settingsHooks) {
         try {
           const { runObserveHooks, dispatchAsyncHooks } =
-            await import("../lib/settings-hook-events.cjs");
+            await import("../lib/settings-hook-events.js");
           runObserveHooks(
             _settingsHooks,
             "Stop",
@@ -5781,7 +5786,7 @@ export async function startAgentRepl(options = {}) {
           );
           if (!_asyncHookSupervisor) {
             const { AsyncHookSupervisor } =
-              await import("../lib/async-hook-supervisor.cjs");
+              await import("../lib/async-hook-supervisor.js");
             _asyncHookSupervisor = new AsyncHookSupervisor({
               persistStats: true,
             });
@@ -5879,7 +5884,7 @@ export async function startAgentRepl(options = {}) {
     if (_settingsHooks) {
       try {
         const { runObserveHooks } =
-          await import("../lib/settings-hook-events.cjs");
+          await import("../lib/settings-hook-events.js");
         runObserveHooks(
           _settingsHooks,
           "SessionEnd",

package/src/runtime/agent-core.js

@@ -16,15 +16,14 @@
 
 import fs from "fs";
 import path from "path";
-import { execSync, spawn, spawnSync } from "child_process";
 import broker from "../lib/process-execution-broker/index.js";
 import os from "os";
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
 import sharedPermissionRules from "../lib/permission-rules.cjs";
 import sharedSettingsHooks from "../lib/settings-hooks.cjs";
-import sharedHookRunner from "../lib/hook-runner.cjs";
-import sharedHookEvents from "../lib/settings-hook-events.cjs";
+import sharedHookRunner from "../lib/hook-runner.js";
+import sharedHookEvents from "../lib/settings-hook-events.js";
 import { mergeProviderOptions } from "../lib/provider-options.js";
 import { applyCredentialProxy } from "../lib/credential-proxy.js";
 import { describeBackgroundCommand } from "../lib/terminal-context.js";
@@ -113,6 +112,33 @@ const {
   withDeliveryId,
 } = sharedHookEvents;
 
+const searchProcessRunner = broker.execSync.bind(broker);
+const runCodeProcessRunner = broker.execFileSync.bind(broker);
+
+export const _agentToolProcessDeps = {
+  runSearch: searchProcessRunner,
+  runCode: runCodeProcessRunner,
+};
+
+function runSearchProcess(command, options = {}) {
+  return _agentToolProcessDeps.runSearch(command, {
+    ...options,
+    origin: "agent-core:search-files",
+    policy: "allow",
+    scope: "agent-core",
+  });
+}
+
+function runCodeProcess(file, args, options = {}, origin = "run-code") {
+  return _agentToolProcessDeps.runCode(file, args, {
+    ...options,
+    origin: `agent-core:${origin}`,
+    policy: "allow",
+    scope: "agent-core",
+    shell: false,
+  });
+}
+
 // ─── Background shell tasks ────────────────────────────────────────────────
 //
 // run_shell is synchronous (execSync) and capped at a foreground timeout, which
@@ -231,25 +257,54 @@ function _releaseBgChildHandles(task) {
   }
 }
 
+const backgroundTaskRunner = broker.spawn.bind(broker);
+const backgroundTaskSyncRunner = broker.spawnSync.bind(broker);
+
+export const _backgroundProcessDeps = {
+  run: backgroundTaskRunner,
+  runSync: backgroundTaskSyncRunner,
+};
+
+export function _runBackgroundTaskkill(pid, { sync = false } = {}) {
+  const args = ["/pid", String(pid), "/T", "/F"];
+  const options = {
+    windowsHide: true,
+    origin: "agent-core:background-taskkill",
+    policy: "allow",
+    scope: "agent-core",
+  };
+  return sync
+    ? _backgroundProcessDeps.runSync("taskkill", args, options)
+    : _backgroundProcessDeps.run("taskkill", args, options);
+}
+
+const gitProcessRunner = broker.spawnSync.bind(broker);
+
+export const _gitProcessDeps = {
+  run: gitProcessRunner,
+};
+
 function _killTask(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
   try {
     if (process.platform === "win32") {
       if (child.pid) {
-        const tk = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
-          windowsHide: true,
-        });
-        // A spawn that fails to launch emits an async 'error' event — with no
-        // listener Node rethrows it as an UNCAUGHT exception (the try/catch
-        // here can't catch the async emit), crashing the CLI. Handle it and
-        // fall back to a direct kill.
-        tk.on("error", () => {
+        const tk = _runBackgroundTaskkill(child.pid);
+        const fallbackDirectKill = () => {
           try {
-            child.kill();
+            if (!child.killed) child.kill("SIGKILL");
           } catch {
             /* already dead */
           }
+        };
+        // A launch failure emits 'error'; a permissions/policy failure instead
+        // launches taskkill successfully and exits non-zero. Both must fall
+        // back or the background command remains alive while teardown reports
+        // success.
+        tk.once("error", fallbackDirectKill);
+        tk.once("close", (code) => {
+          if (code !== 0) fallbackDirectKill();
         });
       } else {
         child.kill();
@@ -310,9 +365,13 @@ function _killTaskSync(task) {
   try {
     if (process.platform === "win32") {
       if (child.pid) {
-        spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
-          windowsHide: true,
-        });
+        const killed = _runBackgroundTaskkill(child.pid, { sync: true });
+        if (killed.error || killed.status !== 0) {
+          // Restricted runners can execute taskkill but receive a non-zero
+          // access/policy result. Direct termination is the synchronous
+          // last-resort for the child handle we own.
+          child.kill("SIGKILL");
+        }
       } else {
         child.kill();
       }
@@ -693,6 +752,21 @@ export function reloadSkills() {
 let _cachedPython = null;
 let _cachedEnvInfo = null;
 
+const environmentProbeRunner = broker.execFileSync.bind(broker);
+
+export const _environmentProcessDeps = {
+  run: environmentProbeRunner,
+};
+
+function runEnvironmentProbe(file, args, options = {}) {
+  return _environmentProcessDeps.run(file, args, {
+    ...options,
+    origin: "agent-core:environment-probe",
+    policy: "allow",
+    scope: "agent-core",
+  });
+}
+
 /**
  * Get cached Python interpreter info (reuses cli-anything-bridge detection).
  * @returns {{ found: boolean, command?: string, version?: string }}
@@ -716,7 +790,7 @@ export function getEnvironmentInfo() {
   let pipAvailable = false;
   if (py.found) {
     try {
-      execSync(`${py.command} -m pip --version`, {
+      runEnvironmentProbe(py.command, ["-m", "pip", "--version"], {
         encoding: "utf-8",
         timeout: 10000,
         stdio: ["pipe", "pipe", "pipe"],
@@ -729,7 +803,7 @@ export function getEnvironmentInfo() {
 
   let nodeVersion = null;
   try {
-    nodeVersion = execSync("node --version", {
+    nodeVersion = runEnvironmentProbe(process.execPath, ["--version"], {
       encoding: "utf-8",
       timeout: 5000,
     }).trim();
@@ -739,7 +813,7 @@ export function getEnvironmentInfo() {
 
   let gitAvailable = false;
   try {
-    execSync("git --version", {
+    runEnvironmentProbe("git", ["--version"], {
       encoding: "utf-8",
       timeout: 5000,
       stdio: ["pipe", "pipe", "pipe"],
@@ -1387,11 +1461,11 @@ export async function executeTool(name, args, context = {}) {
         override.capabilityGranted ?? admission.capabilityGranted,
       policyAllowed:
         override.policyAllowed ??
-        (context.hostManagedToolPolicy ?
-          ((context.hostManagedToolPolicy?.tools ||
-            context.hostManagedToolPolicy?.toolPolicies || {})[name]
-            ?.allowed !== false) :
-          admission.policyAllowed),
+        (context.hostManagedToolPolicy
+          ? (context.hostManagedToolPolicy?.tools ||
+              context.hostManagedToolPolicy?.toolPolicies ||
+              {})[name]?.allowed !== false
+          : admission.policyAllowed),
       permissionGranted:
         override.permissionGranted ?? admission.permissionGranted,
       budgetOk: override.budgetOk ?? admission.budgetOk,
@@ -3158,9 +3232,8 @@ async function executeToolInner(
       // from an ambient system command in the process audit log.
       let pluginBinProvenance = null;
       try {
-        const { resolvePluginBinCommand } = await import(
-          "../lib/plugin-runtime/bin.js"
-        );
+        const { resolvePluginBinCommand } =
+          await import("../lib/plugin-runtime/bin.js");
         pluginBinProvenance = resolvePluginBinCommand(args.command, { cwd });
       } catch {
         pluginBinProvenance = null;
@@ -3551,12 +3624,15 @@ async function executeToolInner(
       // command-execution bypass for a prompt-injected agent. Quoted args (a
       // commit message) keep their content via the quote-aware tokenizer.
       const gitArgs = tokenizeShellWords(normalizedCommand);
-      const res = spawnSync("git", gitArgs, {
+      const res = _gitProcessDeps.run("git", gitArgs, {
         cwd: args.cwd || cwd,
         encoding: "utf8",
         timeout: 60000,
         maxBuffer: 1024 * 1024,
         windowsHide: true,
+        origin: "agent-core:git-command",
+        policy: "allow",
+        scope: "agent-core",
       });
       const readOnly = isReadOnlyGitCommand(normalizedCommand);
       if (res.error) {
@@ -4157,7 +4233,7 @@ async function executeToolInner(
         };
         try {
           if (!fs.existsSync(root)) continue;
-          const output = execSync(cmd, {
+          const output = runSearchProcess(cmd, {
             cwd: root,
             encoding: "utf8",
             timeout: 10000,
@@ -4428,7 +4504,7 @@ async function executeToolInner(
             onWarn: (msg) => {
               // Non-fatal — logged as warning, skipped servers captured
               // in mountResult.skipped.
-              // eslint-disable-next-line no-console
+
               console.warn(msg);
             },
           });
@@ -4763,7 +4839,7 @@ async function _executeRunCode(args, cwd) {
     const start = Date.now();
     let output;
     try {
-      output = execSync(`${interpreter} "${scriptPath}"`, {
+      output = runCodeProcess(interpreter, [scriptPath], {
         cwd,
         encoding: "utf8",
         timeout: timeoutSec * 1000,
@@ -4863,12 +4939,18 @@ async function _executeRunCode(args, cwd) {
 
           // Attempt pip install
           try {
-            execSync(`${interpreter} -m pip install ${packageName}`, {
-              encoding: "utf-8",
-              timeout: 120000,
-              maxBuffer: 2 * 1024 * 1024,
-              stdio: ["pipe", "pipe", "pipe"],
-            });
+            runCodeProcess(
+              interpreter,
+              ["-m", "pip", "install", packageName],
+              {
+                cwd,
+                encoding: "utf-8",
+                timeout: 120000,
+                maxBuffer: 2 * 1024 * 1024,
+                stdio: ["pipe", "pipe", "pipe"],
+              },
+              "run-code-install",
+            );
             recordInstallAudit({
               package: packageName,
               interpreter,
@@ -4879,12 +4961,17 @@ async function _executeRunCode(args, cwd) {
 
             // Retry execution
             const retryStart = Date.now();
-            const retryOutput = execSync(`${interpreter} "${scriptPath}"`, {
-              cwd,
-              encoding: "utf8",
-              timeout: timeoutSec * 1000,
-              maxBuffer: 5 * 1024 * 1024,
-            });
+            const retryOutput = runCodeProcess(
+              interpreter,
+              [scriptPath],
+              {
+                cwd,
+                encoding: "utf8",
+                timeout: timeoutSec * 1000,
+                maxBuffer: 5 * 1024 * 1024,
+              },
+              "run-code-retry",
+            );
             const retryDuration = Date.now() - retryStart;
 
             return {
@@ -5618,10 +5705,7 @@ async function _executeSpawnSubAgent(args, ctx) {
         task: subCtx.task,
         background: payload?.background === true,
       });
-    } else if (
-      type === "sub-agent.completed" ||
-      type === "sub-agent.failed"
-    ) {
+    } else if (type === "sub-agent.completed" || type === "sub-agent.failed") {
       emitHooksV2Event("TaskCompleted", {
         task_id: subCtx.id,
         session_id: parentSessionId,
@@ -7944,9 +8028,9 @@ export async function* agentLoop(messages, options) {
         let toolArgs;
         try {
           toolArgs =
-          typeof call.function.arguments === "string"
-            ? JSON.parse(call.function.arguments)
-            : call.function.arguments;
+            typeof call.function.arguments === "string"
+              ? JSON.parse(call.function.arguments)
+              : call.function.arguments;
         } catch {
           toolArgs = {};
         }