chainlesschain 0.162.179 → 0.162.181

package/src/runtime/agent-core.js

@@ -93,6 +93,8 @@ import {
   formatProviderHttpError,
   formatProviderResponseError,
 } from "../lib/provider-http-error.js";
+import { buildPermissionDecision } from "../lib/permission-decision.js";
+import { resolveSandboxPolicyPath } from "../lib/agent-sandbox.js";
 
 export { formatProviderHttpError };
 
@@ -1172,6 +1174,95 @@ const GUARDED_FILE_MUTATION_TOOLS = new Set([
   "notebook_edit",
 ]);
 
+function agentFileToolPathRequests(name, args = {}, workspaceRoots = []) {
+  const one = (argument, access) =>
+    typeof args[argument] === "string" && args[argument].length > 0
+      ? [{ argument, path: args[argument], access }]
+      : [];
+  switch (name) {
+    case "read_file":
+      return one("path", "read");
+    case "write_file":
+    case "edit_file":
+    case "edit_file_hashed":
+    case "delete_file":
+    case "notebook_edit":
+      return one("path", "write");
+    case "move_file":
+      return [
+        ...one("path", "write"),
+        ...one("target_path", "write"),
+      ];
+    case "list_dir":
+      return [
+        {
+          argument: "path",
+          path:
+            typeof args.path === "string" && args.path.length > 0
+              ? args.path
+              : ".",
+          access: "read",
+        },
+      ];
+    case "search_files":
+      return typeof args.directory === "string" && args.directory.length > 0
+        ? [
+            {
+              argument: "directory",
+              path: args.directory,
+              access: "read",
+            },
+          ]
+        : workspaceRoots.map((root) => ({
+            argument: "directory",
+            path: root,
+            access: "read",
+          }));
+    case "code_intelligence":
+      return args.action === "workspace_symbols"
+        ? workspaceRoots.map((root) => ({
+            argument: "file",
+            path: root,
+            access: "read",
+          }))
+        : one("file", "read");
+    case "publish_artifact":
+      return one("path", "read");
+    default:
+      return [];
+  }
+}
+
+function guardAgentFileToolPaths(name, args, context, cwd) {
+  const workspaceRoots = workspaceRootsFor(
+    cwd,
+    context.additionalDirectories,
+  );
+  const requests = agentFileToolPathRequests(name, args || {}, workspaceRoots);
+  for (const request of requests) {
+    const verdict = resolveSandboxPolicyPath(request.path, {
+      access: request.access,
+      cwd,
+      workspaceRoots,
+      sandbox: context.sandbox || null,
+    });
+    if (!verdict.ok) {
+      return {
+        error:
+          `[Workspace Path Guard] ${name}.${request.argument} ` +
+          `"${request.path}" was blocked: ${verdict.error}.`,
+        policy: {
+          decision: "deny",
+          via: "workspace-path-guard",
+          reason: verdict.reason,
+          access: request.access,
+        },
+      };
+    }
+  }
+  return null;
+}
+
 function fileMutationPaths(name, args = {}) {
   return [
     args.path,
@@ -1553,6 +1644,16 @@ export async function executeTool(name, args, context = {}) {
     }
     context = { ...context, toolAttribution: attribution };
   }
+
+  // Built-in file tools are confined to the declared workspace roots even
+  // when no process sandbox is enabled. Resolve existing targets (and the
+  // nearest existing parent for creates) through symlinks/junctions before any
+  // permission hook, IDE preview, credential check, or filesystem operation
+  // can touch them. Explicit --add-dir roots and sandbox allowRead/allowWrite
+  // paths are the only supported expansions beyond cwd; deny paths still win.
+  const workspacePathDenial = guardAgentFileToolPaths(name, args, context, cwd);
+  if (workspacePathDenial) return workspacePathDenial;
+
   const toolContext = createToolContext({
     toolName: runtimeDescriptor?.name || name,
     cwd,
@@ -2758,6 +2859,39 @@ async function filterSkillsByCwd(skills, cwd) {
   }
 }
 
+async function promoteBrowserScreenshot(
+  filePath,
+  { sessionId = null, title = "Browser screenshot" } = {},
+) {
+  if (!filePath) return { artifact: null, error: null };
+  try {
+    const { ArtifactStore, publicArtifactMetadata } =
+      await import("../lib/artifact-store.js");
+    const entry = new ArtifactStore().publish({
+      filePath,
+      title,
+      kind: "screenshot",
+      sessionId: sessionId ? String(sessionId) : null,
+    });
+    return { artifact: publicArtifactMetadata(entry), error: null };
+  } catch (err) {
+    const code =
+      typeof err?.code === "string"
+        ? err.code.replace(/[^A-Z0-9_-]/gi, "").slice(0, 40)
+        : "";
+    return {
+      artifact: null,
+      error: `browser screenshot artifact publication failed${code ? ` (${code})` : ""}`,
+    };
+  } finally {
+    try {
+      fs.rmSync(filePath, { force: true });
+    } catch {
+      /* best-effort cleanup */
+    }
+  }
+}
+
 async function executeToolInner(
   name,
   args,
@@ -4219,7 +4353,8 @@ async function executeToolInner(
       // Only METADATA returns to the conversation (the transcript never
       // carries the file body); `cc artifacts` lists/inspects/cleans.
       try {
-        const { ArtifactStore } = await import("../lib/artifact-store.js");
+        const { ArtifactStore, publicArtifactMetadata } =
+          await import("../lib/artifact-store.js");
         const store = new ArtifactStore();
         const entry = store.publish({
           filePath: path.resolve(cwd, String(args.path || "")),
@@ -4229,7 +4364,7 @@ async function executeToolInner(
           sessionId: sessionId ? String(sessionId) : null,
         });
         return attachDescriptor({
-          published: entry,
+          published: publicArtifactMetadata(entry),
           hint: "The user can browse this with `cc artifacts list` / `cc artifacts show <id>`.",
         });
       } catch (err) {
@@ -4265,7 +4400,25 @@ async function executeToolInner(
             error: `browser_state failed: ${state.error}`,
           });
         }
-        return attachDescriptor(state);
+        const safeState = { ...state };
+        if (state.screenshotPath) {
+          const promoted = await promoteBrowserScreenshot(
+            state.screenshotPath,
+            {
+              sessionId,
+              title: `Browser state — ${state.title || "page"}`,
+            },
+          );
+          delete safeState.screenshotPath;
+          delete safeState.screenshotRef;
+          if (promoted.artifact) {
+            safeState.screenshotArtifact = promoted.artifact;
+            safeState.screenshotRef = promoted.artifact.id;
+          } else {
+            safeState.screenshotArtifactError = promoted.error;
+          }
+        }
+        return attachDescriptor(safeState);
       } catch (err) {
         return attachDescriptor({
           error: `browser_state failed: ${err.message}`,
@@ -4336,7 +4489,32 @@ async function executeToolInner(
             error: `browser_act failed: ${result.error}`,
           });
         }
-        return attachDescriptor(result);
+        const safeResult = { ...result, steps: [] };
+        for (let i = 0; i < (result.steps || []).length; i += 1) {
+          const originalStep = result.steps[i];
+          const step = { ...originalStep };
+          if (originalStep.screenshotPath) {
+            const promoted = await promoteBrowserScreenshot(
+              originalStep.screenshotPath,
+              {
+                sessionId,
+                title: `Browser action screenshot ${i + 1}`,
+              },
+            );
+            delete step.screenshotPath;
+            delete step.screenshotRef;
+            if (promoted.artifact) {
+              step.screenshotArtifact = promoted.artifact;
+              step.screenshotRef = promoted.artifact.id;
+              step.detail = `screenshot artifact: ${promoted.artifact.id}`;
+            } else {
+              step.screenshotArtifactError = promoted.error;
+              step.detail = promoted.error;
+            }
+          }
+          safeResult.steps.push(step);
+        }
+        return attachDescriptor(safeResult);
       } catch (err) {
         return attachDescriptor({
           error: `browser_act failed: ${err.message}`,
@@ -5297,7 +5475,7 @@ export function safeStringifyToolResult(value) {
   }
 }
 
-function emitToolHookLifecycle({
+export function emitToolHookLifecycle({
   tool,
   args,
   result,
@@ -5306,6 +5484,7 @@ function emitToolHookLifecycle({
   turnId = null,
   toolUseId = null,
   cwd = process.cwd(),
+  emit = emitHooksV2Event,
 }) {
   const failed = Boolean(error || result?.error);
   const base = {
@@ -5317,7 +5496,7 @@ function emitToolHookLifecycle({
     duration_ms: Number(result?.toolTelemetryRecord?.durationMs || 0),
     cwd,
   };
-  emitHooksV2Event(failed ? "PostToolUseFailure" : "PostToolUse", {
+  emit(failed ? "PostToolUseFailure" : "PostToolUse", {
     ...base,
     ...(failed
       ? {
@@ -5337,7 +5516,7 @@ function emitToolHookLifecycle({
       args?.targetPath ||
       args?.target_path ||
       null;
-    emitHooksV2Event("FileChanged", {
+    emit("FileChanged", {
       ...base,
       path: changedPath == null ? null : String(changedPath),
       operation: tool,
@@ -5346,6 +5525,32 @@ function emitToolHookLifecycle({
   return failed;
 }
 
+export function emitToolBatchHookLifecycle({
+  records = [],
+  sessionId = null,
+  turnId = null,
+  cwd = process.cwd(),
+  parallel = false,
+  emit = emitHooksV2Event,
+}) {
+  if (!Array.isArray(records) || records.length === 0) return null;
+  const failed = records.filter((record) => record?.failed === true).length;
+  const payload = {
+    schema_version: 1,
+    session_id: sessionId,
+    turn_id: turnId,
+    cwd,
+    parallel: parallel === true,
+    total: records.length,
+    succeeded: records.length - failed,
+    failed,
+    tool_names: records.map((record) => record?.tool || "(unknown)"),
+    tool_use_ids: records.map((record) => record?.toolUseId || null),
+  };
+  emit("PostToolBatch", payload);
+  return payload;
+}
+
 /**
  * Execute a spawn_sub_agent tool call.
  * Creates an isolated SubAgentContext, runs it, and returns only the summary.
@@ -7507,11 +7712,12 @@ function extractInitialPromptText(messages) {
  * recompute it. Not exported (no shim-parity impact) — only the telemetry seam
  * uses it.
  */
-function permissionDecisionId(callId, policy) {
-  if (!policy || typeof policy !== "object" || !policy.decision) return null;
-  const gate = policy.via || policy.decision;
-  const base = callId || "call";
-  return `${base}:perm:${gate}`;
+function permissionDecision(callId, tool, result) {
+  return buildPermissionDecision({
+    toolUseId: callId,
+    tool,
+    result,
+  });
 }
 
 export async function* agentLoop(messages, options) {
@@ -7931,6 +8137,14 @@ export async function* agentLoop(messages, options) {
                 // self-persist is best-effort
               }
             }
+            emitHooksV2Event("PostCompact", {
+              schema_version: 1,
+              trigger: "auto",
+              session_id: options.sessionId || null,
+              messages_after: messages.length,
+              stats,
+              cwd: options.cwd || process.cwd(),
+            });
             yield { type: "compaction", stats, runId };
           }
         }
@@ -8182,7 +8396,33 @@ export async function* agentLoop(messages, options) {
             },
             { cwd: options.cwd || process.cwd() },
           );
-        } catch (_err) {
+          const failures = (stopOutcome?.results || []).filter(
+            (result) =>
+              result?.nonBlockingError === true ||
+              result?.malformedDecision === true ||
+              result?.breakerOpen === true,
+          );
+          if (failures.length > 0) {
+            emitHooksV2Event("StopFailure", {
+              schema_version: 1,
+              session_id: options.sessionId || null,
+              run_id: runId,
+              phase: "stop-hook",
+              failures: failures.map((failure) => ({
+                command: failure.command || null,
+                exit_code: failure.exitCode ?? null,
+                reason: failure.reason || failure.error || null,
+              })),
+            });
+          }
+        } catch (error) {
+          emitHooksV2Event("StopFailure", {
+            schema_version: 1,
+            session_id: options.sessionId || null,
+            run_id: runId,
+            phase: "stop-hook",
+            reason: error?.message || String(error),
+          });
           stopOutcome = null; // never affect the run outcome
         }
         if (stopOutcome && stopOutcome.decision === "block") {
@@ -8243,6 +8483,8 @@ export async function* agentLoop(messages, options) {
       );
     if (parallelReads) {
       throwIfAborted(signal);
+      const turnId = `${runId}:t${budget.consumed}`;
+      const toolBatchRecords = [];
       // Kick every read off now; settle into {result,error} so an unawaited
       // promise can never surface as an unhandled rejection if the loop aborts
       // before it is consumed.
@@ -8277,6 +8519,21 @@ export async function* agentLoop(messages, options) {
         };
         const { result: toolResult, error: toolError } = await promise;
         throwIfAborted(signal);
+        const failed = emitToolHookLifecycle({
+          tool: call.function.name,
+          args: toolArgs,
+          result: toolResult,
+          error: toolError,
+          sessionId: options.sessionId || null,
+          turnId,
+          toolUseId: call.id,
+          cwd: options.cwd || process.cwd(),
+        });
+        toolBatchRecords.push({
+          tool: call.function.name,
+          toolUseId: call.id,
+          failed,
+        });
         const warningMsg = budget.toWarningMessage();
         const resultStr = capToolResultString(
           safeStringifyToolResult(toolResult),
@@ -8284,6 +8541,11 @@ export async function* agentLoop(messages, options) {
         const toolContent = warningMsg
           ? `${resultStr}\n\n${warningMsg}`
           : resultStr;
+        const decision = permissionDecision(
+          call.id,
+          call.function.name,
+          toolResult,
+        );
         yield {
           type: "tool-result",
           tool: call.function.name,
@@ -8291,10 +8553,8 @@ export async function* agentLoop(messages, options) {
           error: toolError,
           tool_use_id: call.id,
           turn_id: `${runId}:t${budget.consumed}`,
-          permission_decision_id: permissionDecisionId(
-            call.id,
-            toolResult?.policy,
-          ),
+          permission_decision_id: decision?.id || null,
+          permission_decision: decision,
         };
         messages.push({
           role: "tool",
@@ -8302,9 +8562,18 @@ export async function* agentLoop(messages, options) {
           tool_call_id: call.id,
         });
       }
+      emitToolBatchHookLifecycle({
+        records: toolBatchRecords,
+        sessionId: options.sessionId || null,
+        turnId,
+        cwd: options.cwd || process.cwd(),
+        parallel: true,
+      });
       continue; // all read results in place — back to the LLM call
     }
 
+    const turnId = `${runId}:t${budget.consumed}`;
+    const toolBatchRecords = [];
     for (const call of toolCalls) {
       throwIfAborted(signal);
       const fn = call?.function;
@@ -8318,6 +8587,21 @@ export async function* agentLoop(messages, options) {
       // malformed call.
       if (typeof toolName !== "string" || !toolName) {
         const reason = "malformed tool call: missing function name";
+        emitToolHookLifecycle({
+          tool: "(unknown)",
+          args: null,
+          result: { error: reason },
+          error: reason,
+          sessionId: options.sessionId || null,
+          turnId,
+          toolUseId: call?.id || null,
+          cwd: options.cwd || process.cwd(),
+        });
+        toolBatchRecords.push({
+          tool: "(unknown)",
+          toolUseId: call?.id || null,
+          failed: true,
+        });
         yield {
           type: "tool-result",
           tool: "(unknown)",
@@ -8413,14 +8697,14 @@ export async function* agentLoop(messages, options) {
             // (derived from the call + gate, so it's recomputable from the
             // tool-result's policy + tool_call_id) plus the low-cardinality
             // decision, letting a blocked tool span be tied to its decision.
-            const decId =
+            const decision =
               r && typeof r === "object"
-                ? permissionDecisionId(call.id, r.policy)
+                ? permissionDecision(call.id, toolName, r)
                 : null;
-            if (decId) {
+            if (decision?.id) {
               const permAttrs = buildTelemetryAttributes({
-                decisionId: decId,
-                "permission.decision": r.policy.decision,
+                decisionId: decision.id,
+                "permission.decision": decision.decision,
               });
               if (permAttrs["permission.decision_id"]) {
                 span.setAttribute(
@@ -8458,6 +8742,7 @@ export async function* agentLoop(messages, options) {
         ? `${resultStr}\n\n${warningMsg}`
         : resultStr;
 
+      const decision = permissionDecision(call.id, toolName, toolResult);
       yield {
         type: "tool-result",
         tool: toolName,
@@ -8465,10 +8750,8 @@ export async function* agentLoop(messages, options) {
         error: toolError,
         tool_use_id: call.id,
         turn_id: `${runId}:t${budget.consumed}`,
-        permission_decision_id: permissionDecisionId(
-          call.id,
-          toolResult?.policy,
-        ),
+        permission_decision_id: decision?.id || null,
+        permission_decision: decision,
       };
 
       messages.push({
@@ -8476,7 +8759,29 @@ export async function* agentLoop(messages, options) {
         content: toolContent,
         tool_call_id: call.id,
       });
+      const failed = emitToolHookLifecycle({
+        tool: toolName,
+        args: toolArgs,
+        result: toolResult,
+        error: toolError,
+        sessionId: options.sessionId || null,
+        turnId,
+        toolUseId: call.id,
+        cwd: options.cwd || process.cwd(),
+      });
+      toolBatchRecords.push({
+        tool: toolName,
+        toolUseId: call.id,
+        failed,
+      });
     }
+    emitToolBatchHookLifecycle({
+      records: toolBatchRecords,
+      sessionId: options.sessionId || null,
+      turnId,
+      cwd: options.cwd || process.cwd(),
+      parallel: false,
+    });
   }
 
   // Budget exhausted — flush any child usage the final iteration produced,

package/src/runtime/coding-agent-contract-shared.cjs

@@ -1155,7 +1155,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     kind: "browser",
     tier: "extension",
     description:
-      "Capture live state from the user's real Chrome over CDP: current URL/title, open tabs, console messages and failed/error network requests observed during a short watch window, a capped DOM snapshot, and optionally a screenshot (saved to a temp file whose path is returned). Requires a debuggable Chrome — the user starts one with `cc browse chrome launch`. Console/network capture starts at attach time (CDP keeps no history) — set reload=true to observe load-time errors. Use to verify web changes in the user's logged-in browser.",
+      "Capture live state from the user's real Chrome over CDP: current URL/title, open tabs, console messages and failed/error network requests observed during a short watch window, a capped DOM snapshot, and optionally a screenshot (published as a session-bound Artifact; no host temp path enters the agent result). Requires a debuggable Chrome — the user starts one with `cc browse chrome launch`. Console/network capture starts at attach time (CDP keeps no history) — set reload=true to observe load-time errors. Use to verify web changes in the user's logged-in browser.",
     inputSchema: {
       type: "object",
       properties: {
@@ -1187,7 +1187,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
         screenshot: {
           type: "boolean",
           description:
-            "Save a screenshot to a generated temp file and return its path (default false)",
+            "Capture a screenshot and return opaque, session-bound Artifact metadata (default false)",
         },
       },
       required: [],
@@ -1208,7 +1208,7 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     kind: "browser",
     tier: "extension",
     description:
-      "Perform EXPLICIT actions in the user's connected Chrome over loopback CDP: click, type, press, navigate (http/https only), waitForSelector, screenshot (saved to a generated temp path — never a chosen one), assertText. Approval-gated (HIGH risk): use browser_state first to observe; only act when the task genuinely requires driving the browser. Steps run in order and fail fast unless continue_on_error; each returns {ok, action, detail, durationMs} and every executed step is audit-logged under ~/.chainlesschain/browser-actions/. Requires a debuggable Chrome (`cc browse chrome launch`).",
+      "Perform EXPLICIT actions in the user's connected Chrome over loopback CDP: click, type, press, navigate (http/https only), waitForSelector, screenshot (published as a session-bound Artifact; never a caller-chosen path), assertText. Approval-gated (HIGH risk): use browser_state first to observe; only act when the task genuinely requires driving the browser. Steps run in order and fail fast unless continue_on_error; each returns {ok, action, detail, durationMs} and every executed step is audit-logged under ~/.chainlesschain/browser-actions/. Requires a debuggable Chrome (`cc browse chrome launch`).",
     inputSchema: {
       type: "object",
       properties: {