chainlesschain 0.162.180 → 0.162.181

package/src/lib/event-runtime-store.js

@@ -45,6 +45,8 @@ export class EventRuntimeStore {
     leaseMs = 120000,
     lockTimeoutMs = 2000,
     maxQueueLength = 10000,
+    hostStaleMs = 15000,
+    maxHostRecords = 100,
   } = {}) {
     this.dir = dir;
     this._now = typeof now === "function" ? now : () => Number(now);
@@ -53,6 +55,8 @@ export class EventRuntimeStore {
     this.leaseMs = Math.max(1, Number(leaseMs) || 120000);
     this.lockTimeoutMs = Math.max(0, Number(lockTimeoutMs) || 2000);
     this.maxQueueLength = Math.max(1, Number(maxQueueLength) || 10000);
+    this.hostStaleMs = Math.max(1, Number(hostStaleMs) || 15000);
+    this.maxHostRecords = Math.max(1, Number(maxHostRecords) || 100);
   }
 
   _assertQueue(queue) {
@@ -64,6 +68,10 @@ export class EventRuntimeStore {
     return path.join(this.dir, `${queue}.json`);
   }
 
+  _hostsFile() {
+    return path.join(this.dir, "hosts.json");
+  }
+
   _ensureDir() {
     fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
   }
@@ -86,6 +94,23 @@ export class EventRuntimeStore {
     fs.renameSync(tmp, file);
   }
 
+  _readHosts() {
+    try {
+      const value = JSON.parse(fs.readFileSync(this._hostsFile(), "utf8"));
+      return Array.isArray(value) ? value : [];
+    } catch {
+      return [];
+    }
+  }
+
+  _writeHosts(records) {
+    this._ensureDir();
+    const file = this._hostsFile();
+    const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(records, null, 2), "utf8");
+    fs.renameSync(tmp, file);
+  }
+
   _mutate(queue, fn) {
     this._ensureDir();
     return withFileLock(
@@ -100,6 +125,121 @@ export class EventRuntimeStore {
     );
   }
 
+  _mutateHosts(fn) {
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".event-runtime"),
+      () => {
+        const records = this._readHosts();
+        const result = fn(records);
+        this._writeHosts(records);
+        return result;
+      },
+      { timeoutMs: this.lockTimeoutMs, failIfUnavailable: true },
+    );
+  }
+
+  /**
+   * Publish a process-host heartbeat in the same lock domain as the queues.
+   * The registry is bounded and additive: it is safe for an older observer to
+   * ignore hosts.json while newer `cc status --json` consumers can distinguish
+   * a live worker from queued work with no owner.
+   */
+  reportHost(
+    {
+      id = this.owner,
+      pid = process.pid,
+      role = "cli",
+      state = "running",
+      startedAt = null,
+      heartbeatAt = this._now(),
+      staleAfterMs = this.hostStaleMs,
+      lastStats = null,
+      lastError = null,
+    } = {},
+  ) {
+    const hostId = String(id || "").trim();
+    if (!hostId) throw new Error("Event Runtime host id is required");
+    const observedAt = Number(heartbeatAt);
+    const timestamp = Number.isFinite(observedAt) ? observedAt : this._now();
+    return this._mutateHosts((records) => {
+      const existing = records.find((record) => record.id === hostId);
+      const record =
+        existing ||
+        (() => {
+          const created = { id: hostId };
+          records.push(created);
+          return created;
+        })();
+      record.pid =
+        pid != null && Number.isFinite(Number(pid)) ? Number(pid) : null;
+      record.role = String(role || "cli");
+      record.state = state === "stopped" ? "stopped" : "running";
+      record.startedAt =
+        existing?.startedAt != null &&
+        Number.isFinite(Number(existing.startedAt))
+          ? Number(existing.startedAt)
+          : startedAt != null && Number.isFinite(Number(startedAt))
+            ? Number(startedAt)
+            : timestamp;
+      record.heartbeatAt = timestamp;
+      record.staleAfterMs = Math.max(
+        1,
+        Number(staleAfterMs) || this.hostStaleMs,
+      );
+      record.lastStats = clone(lastStats);
+      record.lastError =
+        lastError == null ? null : String(lastError).slice(0, 1000);
+      if (record.state === "stopped") record.stoppedAt = timestamp;
+      else delete record.stoppedAt;
+
+      if (records.length > this.maxHostRecords) {
+        records.sort((a, b) => {
+          const aRunning = a.state === "running" ? 1 : 0;
+          const bRunning = b.state === "running" ? 1 : 0;
+          return (
+            bRunning - aRunning ||
+            Number(b.heartbeatAt || 0) - Number(a.heartbeatAt || 0)
+          );
+        });
+        records.splice(this.maxHostRecords);
+      }
+      return clone(record);
+    });
+  }
+
+  stopHost(id = this.owner, options = {}) {
+    return this.reportHost({
+      ...options,
+      id,
+      state: "stopped",
+      heartbeatAt: options.heartbeatAt ?? this._now(),
+    });
+  }
+
+  listHosts({ now = this._now(), includeStopped = true } = {}) {
+    const t = Number(now);
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".event-runtime"),
+      () =>
+        this._readHosts()
+          .filter((record) => includeStopped || record.state !== "stopped")
+          .map((record) => ({
+            ...clone(record),
+            stale:
+              record.state === "running" &&
+              Number(record.heartbeatAt || 0) +
+                Math.max(
+                  1,
+                  Number(record.staleAfterMs) || this.hostStaleMs,
+                ) <=
+                t,
+          })),
+      { timeoutMs: this.lockTimeoutMs, failIfUnavailable: true },
+    );
+  }
+
   enqueue(
     queue,
     event,
@@ -418,6 +558,28 @@ export class EventRuntimeStore {
           : Object.values(queues).some((queue) => queue.pressure === "high")
             ? "high"
             : "normal";
+        const hostEntries = this._readHosts().map((record) => ({
+          ...clone(record),
+          stale:
+            record.state === "running" &&
+            Number(record.heartbeatAt || 0) +
+              Math.max(
+                1,
+                Number(record.staleAfterMs) || this.hostStaleMs,
+              ) <=
+              t,
+        }));
+        const hosts = {
+          total: hostEntries.length,
+          running: hostEntries.filter(
+            (record) => record.state === "running" && !record.stale,
+          ).length,
+          stale: hostEntries.filter((record) => record.stale).length,
+          stopped: hostEntries.filter(
+            (record) => record.state === "stopped",
+          ).length,
+          entries: hostEntries,
+        };
         return {
           schema: "chainlesschain.event-runtime-health.v1",
           observedAt: new Date(t).toISOString(),
@@ -425,6 +587,7 @@ export class EventRuntimeStore {
           highWatermarkRatio: highWatermark,
           pressure,
           queues,
+          hosts,
         };
       },
       { timeoutMs: this.lockTimeoutMs, failIfUnavailable: true },

package/src/lib/goal-store.js

@@ -146,8 +146,18 @@ export function createGoal(input = {}, opts = {}) {
     updatedAt: nowIso(),
   };
   ensureDir(root);
-  atomicWriteFileSync(goalFile(root, id), JSON.stringify(goal, null, 2));
-  return goal;
+  const file = goalFile(root, id);
+  return withFileLock(
+    file,
+    () => {
+      if (fs.existsSync(file)) {
+        throw new Error(`goal already exists: ${id}`);
+      }
+      atomicWriteFileSync(file, JSON.stringify(goal, null, 2));
+      return goal;
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 function normalizeKr(kr) {
@@ -212,19 +222,22 @@ export function listGoals(opts = {}) {
 function mutate(id, fn, opts = {}) {
   // Serialize the read-modify-write across processes (cc+cc, or cc+desktop
   // sharing the goals dir) so concurrent goal edits don't lose an update.
-  // Best-effort lock (with-file-lock): on contention timeout it proceeds anyway,
-  // so the CLI never hangs.
+  // Durable goal state never proceeds without exclusion after bounded retry.
   // Guard before deriving the lock path: an unsafe id would otherwise place the
   // lock file at a traversal path (`<root>/../../x.json.lock`) before getGoal
   // even runs. getGoal/saveGoal also guard, but keep the lock inside the dir.
   if (isUnsafeGoalId(id)) throw new Error(`no such goal: ${id}`);
   const root = opts.root || defaultRoot();
-  return withFileLock(goalFile(root, id), () => {
-    const goal = getGoal(id, opts);
-    if (!goal) throw new Error(`no such goal: ${id}`);
-    fn(goal);
-    return saveGoal(goal, opts);
-  });
+  return withFileLock(
+    goalFile(root, id),
+    () => {
+      const goal = getGoal(id, opts);
+      if (!goal) throw new Error(`no such goal: ${id}`);
+      fn(goal);
+      return saveGoal(goal, opts);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /** Add a key result to a goal. */
@@ -368,8 +381,15 @@ export function deleteGoal(id, opts = {}) {
   const root = opts.root || defaultRoot();
   const file = goalFile(root, id);
   if (!fs.existsSync(file)) return false;
-  fs.rmSync(file);
-  return true;
+  return withFileLock(
+    file,
+    () => {
+      if (!fs.existsSync(file)) return false;
+      fs.rmSync(file);
+      return true;
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 /**

package/src/lib/headless-manifest.js

@@ -150,7 +150,8 @@ export function buildAgentCapabilities() {
     // P1-9: permission modes, formats and the feature flags all project from the
     // single canonical [[capability-manifest.js]] so `cc agent --capabilities`,
     // the negotiator and the docs can no longer drift. Additive protocol-v1
-    // stream fields (event_seq / tool_use_id / trace_id) come in via the wire
+    // stream fields (event_seq / tool_use_id / permission_decision / trace_id)
+    // come in via the wire
     // features; the mcp object and sandbox_engines come from the manifest too.
     permission_modes: [...CAPABILITY_MANIFEST.permissionModes],
     output_formats: [...CAPABILITY_MANIFEST.outputFormats],

package/src/lib/hook-environment.cjs

@@ -0,0 +1,58 @@
+"use strict";
+
+/**
+ * Environment boundary shared by every CLI hook surface.
+ *
+ * Hooks receive only the small set needed to locate executables and temporary
+ * files. Extra inherited variables require both an administrator-managed
+ * allowlist and an explicit request from the hook definition.
+ */
+const SAFE_HOOK_ENV_KEYS = Object.freeze([
+  "PATH",
+  "PATHEXT",
+  "SystemRoot",
+  "WINDIR",
+  "COMSPEC",
+  "TMP",
+  "TEMP",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "HOME",
+  "USERPROFILE",
+]);
+
+function normalizeNames(values) {
+  return new Set(
+    (Array.isArray(values) ? values : [])
+      .map((value) => String(value || "").trim())
+      .filter(Boolean),
+  );
+}
+
+function buildManagedHookEnvironment({
+  source = process.env,
+  managedAllowlist = [],
+  requestedAllowlist = [],
+  values = {},
+} = {}) {
+  const env = {};
+  for (const key of SAFE_HOOK_ENV_KEYS) {
+    if (source[key] != null) env[key] = source[key];
+  }
+
+  const managed = normalizeNames(managedAllowlist);
+  for (const key of normalizeNames(requestedAllowlist)) {
+    if (managed.has(key) && source[key] != null) env[key] = source[key];
+  }
+
+  for (const [key, value] of Object.entries(values || {})) {
+    if (value != null) env[key] = String(value);
+  }
+  return env;
+}
+
+module.exports = {
+  SAFE_HOOK_ENV_KEYS,
+  buildManagedHookEnvironment,
+};

package/src/lib/hook-manager.js

@@ -5,6 +5,9 @@
 
 import crypto from "crypto";
 import broker from "./process-execution-broker/index.js";
+import hookEnvironment from "./hook-environment.cjs";
+
+const { buildManagedHookEnvironment } = hookEnvironment;
 
 /**
  * Hook priority levels — lower values run first.
@@ -285,11 +288,15 @@ export async function executeHook(hook, context = {}) {
           executionTime: 0,
         };
       }
-      const env = {
-        ...process.env,
-        HOOK_EVENT: hook.event,
-        HOOK_CONTEXT: JSON.stringify(context),
-      };
+      const env = buildManagedHookEnvironment({
+        managedAllowlist: hook.managedEnvironmentAllowlist,
+        requestedAllowlist:
+          hook.environmentAllowlist || hook.envAllowlist,
+        values: {
+          HOOK_EVENT: hook.event,
+          HOOK_CONTEXT: JSON.stringify(context),
+        },
+      });
       const output = broker.execSync(cmd, {
         origin: "hook-manager:command",
         scope: "hook",

package/src/lib/hook-runner.cjs

@@ -26,6 +26,9 @@ const {
   loadShellConfig,
 } = require("./shell-selector.cjs");
 const { mergeHookDecisions } = require("./hook-event-bus.cjs");
+const {
+  buildManagedHookEnvironment,
+} = require("./hook-environment.cjs");
 
 const _deps = { runSync: null, run: null };
 Object.defineProperties(_deps, {
@@ -56,6 +59,86 @@ const HOOK_DECISIONS = Object.freeze({
   CONTINUE: "continue",
 });
 
+/**
+ * Resolve the sandbox contract for one legacy command hook. Requirements from
+ * the caller (for example managed settings) and from the hook entry are
+ * additive; the caller's profile wins so a hook cannot weaken managed policy.
+ */
+function resolveHookSandboxPolicy(hook = {}, opts = {}) {
+  const hookPolicy = hook.sandboxPolicy;
+  const callerPolicy = opts.sandboxPolicy;
+  for (const [label, value] of [
+    ["hook sandboxPolicy", hookPolicy],
+    ["managed hook sandboxPolicy", callerPolicy],
+  ]) {
+    if (
+      value !== undefined &&
+      (value === null || typeof value !== "object" || Array.isArray(value))
+    ) {
+      const error = new Error(`${label} must be an object`);
+      error.code = "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED";
+      throw error;
+    }
+  }
+
+  const requiredBoundaries = [];
+  for (const [label, value] of [
+    ["managed requiredBoundaries", opts.requiredBoundaries],
+    [
+      "managed sandboxPolicy.requiredBoundaries",
+      callerPolicy?.requiredBoundaries,
+    ],
+    ["hook requiredBoundaries", hook.requiredBoundaries],
+    ["hook sandboxPolicy.requiredBoundaries", hookPolicy?.requiredBoundaries],
+  ]) {
+    if (value === undefined) continue;
+    if (!Array.isArray(value)) {
+      const error = new Error(`${label} must be an array`);
+      error.code = "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED";
+      throw error;
+    }
+    for (const boundary of value) {
+      if (!requiredBoundaries.includes(boundary)) {
+        requiredBoundaries.push(boundary);
+      }
+    }
+  }
+
+  const configured =
+    hookPolicy !== undefined ||
+    callerPolicy !== undefined ||
+    hook.requiredBoundaries !== undefined ||
+    opts.requiredBoundaries !== undefined;
+  if (!configured) return null;
+  const resolved = {
+    ...(hookPolicy || {}),
+    ...(callerPolicy || {}),
+  };
+  delete resolved.requiredBoundaries;
+  if (requiredBoundaries.length > 0) {
+    resolved.requiredBoundaries = requiredBoundaries;
+  }
+  return resolved;
+}
+
+function hookSpawnFailure(error) {
+  const sandboxDenied =
+    error?.code === "ERR_PROCESS_SANDBOX_BOUNDARY_UNSATISFIED";
+  return {
+    decision: sandboxDenied
+      ? HOOK_DECISIONS.BLOCK
+      : HOOK_DECISIONS.CONTINUE,
+    reason: sandboxDenied
+      ? `hook sandbox denied: ${error.message}`
+      : `hook spawn failed: ${error.message}`,
+    exitCode: null,
+    error: error.message,
+    ...(sandboxDenied
+      ? { sandboxDenied: true }
+      : { nonBlockingError: true }),
+  };
+}
+
 /** JSON.parse that returns undefined (not throws) on failure. */
 function tryJson(text) {
   try {
@@ -237,6 +320,7 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
   const usePowershell = shellKind === "powershell" || shellKind === "pwsh";
   let res;
   try {
+    const sandboxPolicy = resolveHookSandboxPolicy({}, opts);
     const common = {
       input: JSON.stringify({
         ...input,
@@ -246,10 +330,13 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
       encoding: "utf-8",
       timeout,
       maxBuffer: 8 * 1024 * 1024,
-      env: {
-        ...process.env,
-        CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
-      },
+      env: buildManagedHookEnvironment({
+        managedAllowlist: opts.managedEnvironmentAllowlist,
+        requestedAllowlist: opts.environmentAllowlist,
+        values: {
+          CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
+        },
+      }),
     };
     const processOptions = {
       ...common,
@@ -259,6 +346,7 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
       pluginId: opts.pluginId || null,
       pluginVersion: opts.pluginVersion || null,
       pluginSource: opts.pluginSource || null,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
     };
     const brokerRunSync =
       opts.broker &&
@@ -293,13 +381,7 @@ function _runCommandHookInner(command, input = {}, opts = {}) {
       res = _deps.runSync(command, { ...processOptions, shell: true });
     }
   } catch (err) {
-    return {
-      decision: HOOK_DECISIONS.CONTINUE,
-      reason: `hook spawn failed: ${err.message}`,
-      exitCode: null,
-      error: err.message,
-      nonBlockingError: true,
-    };
+    return hookSpawnFailure(err);
   }
   return interpretHookOutcome(res);
 }
@@ -390,10 +472,19 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
     ...input,
     schema_version: input.schema_version ?? HOOK_PAYLOAD_SCHEMA_VERSION,
   });
-  const spawnEnv = {
-    ...process.env,
-    CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
-  };
+  const spawnEnv = buildManagedHookEnvironment({
+    managedAllowlist: opts.managedEnvironmentAllowlist,
+    requestedAllowlist: opts.environmentAllowlist,
+    values: {
+      CLAUDE_HOOK_EVENT: event || input.hook_event_name || "",
+    },
+  });
+  let sandboxPolicy;
+  try {
+    sandboxPolicy = resolveHookSandboxPolicy({}, opts);
+  } catch (error) {
+    return hookSpawnFailure(error);
+  }
   const processOptions = {
     cwd: wd,
     env: spawnEnv,
@@ -403,6 +494,7 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
     pluginId: opts.pluginId || null,
     pluginVersion: opts.pluginVersion || null,
     pluginSource: opts.pluginSource || null,
+    ...(sandboxPolicy ? { sandboxPolicy } : {}),
   };
 
   let child;
@@ -427,13 +519,7 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
         : run(command, { ...processOptions, shell: true });
     }
   } catch (err) {
-    return {
-      decision: HOOK_DECISIONS.CONTINUE,
-      reason: `hook spawn failed: ${err.message}`,
-      exitCode: null,
-      error: err.message,
-      nonBlockingError: true,
-    };
+    return hookSpawnFailure(err);
   }
 
   return await new Promise((resolve) => {
@@ -511,19 +597,23 @@ async function _runCommandHookInnerAsync(command, input = {}, opts = {}) {
 function runHooks(commandHooks, input = {}, opts = {}) {
   const results = [];
   const hooks = commandHooks || [];
-  const runOne = (h) =>
-    runCommandHook(h.command, input, {
+  const runOne = (h) => {
+    const sandboxPolicy = resolveHookSandboxPolicy(h, opts);
+    return runCommandHook(h.command, input, {
       ...opts,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
       broker: opts.broker,
       origin: h.origin,
       pluginId: h.pluginId,
       pluginVersion: h.pluginVersion,
       pluginSource: h.pluginSource,
       timeout: h.timeout != null ? h.timeout * 1000 : opts.timeout,
+      environmentAllowlist: h.environmentAllowlist || h.envAllowlist,
       // per-hook shell selection (P1 #8): `{ "type":"command", "command":…,
       // "shell":"powershell" }` in the settings hook entry
       shell: h.shell != null ? h.shell : opts.shell,
     });
+  };
 
   if (opts.mergeStrict) {
     const decisions = [];
@@ -576,18 +666,21 @@ function runHooks(commandHooks, input = {}, opts = {}) {
 async function runHooksParallel(commandHooks, input = {}, opts = {}) {
   const hooks = commandHooks || [];
   const settled = await Promise.all(
-    hooks.map((h) =>
-      runCommandHookAsync(h.command, input, {
+    hooks.map((h) => {
+      const sandboxPolicy = resolveHookSandboxPolicy(h, opts);
+      return runCommandHookAsync(h.command, input, {
         ...opts,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
         broker: opts.broker,
         origin: h.origin,
         pluginId: h.pluginId,
         pluginVersion: h.pluginVersion,
         pluginSource: h.pluginSource,
         timeout: h.timeout != null ? h.timeout * 1000 : opts.timeout,
+        environmentAllowlist: h.environmentAllowlist || h.envAllowlist,
         shell: h.shell != null ? h.shell : opts.shell,
-      }).then((r) => ({ h, r })),
-    ),
+      }).then((r) => ({ h, r }));
+    }),
   );
   const results = settled.map(({ h, r }) => ({ command: h.command, ...r }));
   const decisions = settled.map(({ h, r }) => ({
@@ -615,6 +708,7 @@ module.exports = {
   HOOK_DECISIONS,
   HOOK_PAYLOAD_SCHEMA_VERSION,
   hookBreakerConfig,
+  resolveHookSandboxPolicy,
   _resetHookBreaker,
   _deps,
 };

package/src/lib/hook-runner.js

@@ -48,6 +48,7 @@ export const {
   HOOK_DECISIONS,
   HOOK_PAYLOAD_SCHEMA_VERSION,
   hookBreakerConfig,
+  resolveHookSandboxPolicy,
   _resetHookBreaker,
   _deps,
 } = runner;

package/src/lib/hooks-v2-producers.js

@@ -38,3 +38,39 @@ export async function executeHooksV2Event(
     };
   }
 }
+
+export function resolvePromptExpansion(prompt, outcome = {}) {
+  const base = String(prompt ?? "");
+  const updates = [];
+  const context = [];
+  for (const record of Array.isArray(outcome.results) ? outcome.results : []) {
+    if (record?.status !== "success" || !record.result) continue;
+    if (typeof record.result.updatedPrompt === "string") {
+      updates.push(record.result.updatedPrompt);
+    }
+    if (typeof record.result.additionalContext === "string") {
+      const value = record.result.additionalContext.trim();
+      if (value) context.push(value);
+    }
+  }
+  const distinctUpdates = [...new Set(updates)];
+  if (distinctUpdates.length > 1) {
+    return {
+      prompt: base,
+      blocked: true,
+      reason: "conflicting UserPromptExpansion updatedPrompt results",
+    };
+  }
+  let resolved = distinctUpdates[0] ?? base;
+  if (context.length > 0) {
+    resolved += `\n\n[hook context]\n${context.join("\n")}`;
+  }
+  return {
+    prompt: resolved,
+    blocked: outcome.blocked === true || outcome.decision === "block",
+    reason:
+      outcome.blockingResult?.reason ||
+      outcome.blockingResult?.message ||
+      null,
+  };
+}