chainlesschain 0.162.180 → 0.162.181

package/src/lib/plugin-runtime/capabilities.js

@@ -239,6 +239,56 @@ export function componentCapabilityDenial(manifest, capabilityNames) {
   return finding ? { reason: finding.reason } : null;
 }
 
+/**
+ * Enforce a declared network domain for a direct URL-based plugin component.
+ * Stdio children have no direct target here and remain subject to the process
+ * sandbox boundary; URL transports can be rejected before any connection.
+ */
+export function networkTargetDenial(manifest, targetUrl) {
+  if (!manifest || manifest.capabilitiesDeclared !== true || !targetUrl) {
+    return null;
+  }
+  let hostname;
+  try {
+    hostname = new URL(String(targetUrl)).hostname
+      .toLowerCase()
+      .replace(/\.$/, "");
+  } catch {
+    return { reason: `invalid network target URL: ${targetUrl}` };
+  }
+  const network = manifest.capabilities?.network || {
+    any: false,
+    domains: [],
+  };
+  if (network.any === true) return null;
+  const allowed = (network.domains || []).some((raw) => {
+    let domain = String(raw || "")
+      .trim()
+      .toLowerCase()
+      .replace(/\.$/, "");
+    if (!domain) return false;
+    if (domain.includes("://")) {
+      try {
+        domain = new URL(domain).hostname.toLowerCase().replace(/\.$/, "");
+      } catch {
+        return false;
+      }
+    } else {
+      domain = domain.replace(/:\d+$/, "");
+    }
+    if (domain.startsWith("*.")) {
+      const suffix = domain.slice(1);
+      return hostname.endsWith(suffix) && hostname.length > suffix.length;
+    }
+    return hostname === domain;
+  });
+  return allowed
+    ? null
+    : {
+        reason: `network target "${hostname}" is outside the plugin's declared domains`,
+      };
+}
+
 // ─── options schema ─────────────────────────────────────────────────────────
 
 export const OPTION_TYPES = Object.freeze([

package/src/lib/plugin-runtime/capability-consent.js

@@ -18,21 +18,22 @@
  * never touch the real user-data dir.
  */
 
-import fs from "fs";
 import path from "path";
 import { getElectronUserDataDir } from "../paths.js";
+import { withFileLock } from "../with-file-lock.js";
 import {
   normalizeCapabilities,
   diffCapabilities,
   describeCapabilities,
 } from "./capabilities.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "../durable-security-store.js";
 
 export const _deps = {
-  existsSync: fs.existsSync,
-  readFileSync: fs.readFileSync,
-  writeFileSync: fs.writeFileSync,
-  mkdirSync: fs.mkdirSync,
   now: () => new Date().toISOString(),
+  withFileLock,
   // Injectable so unit tests never touch the real user-data dir.
   storePath: () =>
     path.join(getElectronUserDataDir(), "plugin-capability-consent.json"),
@@ -43,20 +44,7 @@ function consentKey(scope, name) {
 }
 
 export function loadConsentStore() {
-  try {
-    const p = _deps.storePath();
-    if (!_deps.existsSync(p)) return {};
-    const data = JSON.parse(_deps.readFileSync(p, "utf8"));
-    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-  } catch {
-    return {};
-  }
-}
-
-function saveConsentStore(store) {
-  const p = _deps.storePath();
-  _deps.mkdirSync(path.dirname(p), { recursive: true });
-  _deps.writeFileSync(p, JSON.stringify(store, null, 2), "utf8");
+  return readSecurityStore(_deps.storePath(), "plugin capability consent");
 }
 
 /**
@@ -158,8 +146,15 @@ export function resolveConsentAction(
 /** Load the store and report whether one plugin's declared caps are consented. */
 export function isPluginCapabilityConsented(plugin, declaredCaps) {
   if (!plugin || !plugin.name) return false;
-  const entry = loadConsentStore()[consentKey(plugin.scope, plugin.name)];
-  return capabilityConsentStatus(declaredCaps, entry).consented;
+  if (capabilitiesAreEmpty(declaredCaps)) return true;
+  try {
+    const entry = loadConsentStore()[consentKey(plugin.scope, plugin.name)];
+    return capabilityConsentStatus(declaredCaps, entry).consented;
+  } catch {
+    // Security reads fail closed: an unavailable/corrupt consent store never
+    // turns into permission to use a capability.
+    return false;
+  }
 }
 
 /** Record consent for a plugin's currently-declared capability set. */
@@ -168,24 +163,36 @@ export function consentPluginCapabilities(
   { scope = "project", version, capabilities } = {},
 ) {
   if (!version) throw new Error("consentPluginCapabilities requires a version");
-  const store = loadConsentStore();
-  store[consentKey(scope, name)] = {
-    version,
-    capabilities: canonicalCaps(capabilities),
-    consentedAt: _deps.now(),
-  };
-  saveConsentStore(store);
-  return { name, scope, version };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin capability consent",
+    (store) => {
+      store[consentKey(scope, name)] = {
+        version,
+        capabilities: canonicalCaps(capabilities),
+        consentedAt: _deps.now(),
+      };
+      return { name, scope, version };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** Revoke capability consent for a plugin at a scope. */
 export function revokeCapabilityConsent(name, { scope = "project" } = {}) {
-  const store = loadConsentStore();
-  const key = consentKey(scope, name);
-  const existed = Object.prototype.hasOwnProperty.call(store, key);
-  delete store[key];
-  saveConsentStore(store);
-  return { name, scope, removed: existed };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin capability consent",
+    (store) => {
+      const key = consentKey(scope, name);
+      const existed = Object.prototype.hasOwnProperty.call(store, key);
+      delete store[key];
+      return { name, scope, removed: existed };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** All consent entries (for `cc plugin consent --list`). */

package/src/lib/plugin-runtime/hooks.js

@@ -18,6 +18,7 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -124,17 +125,43 @@ export function collectPluginHooks(opts = {}) {
       if (!Array.isArray(entries)) continue;
       const tagged = entries.map((group) => {
         if (!group || typeof group !== "object" || !Array.isArray(group.hooks)) return group;
+        let groupSandboxPolicy;
+        try {
+          groupSandboxPolicy = mergePluginSandboxPolicies(
+            p.manifest.sandboxPolicy,
+            group.sandboxPolicy,
+          );
+        } catch {
+          return null;
+        }
+        const { sandboxPolicy: _rawGroupPolicy, ...groupConfig } = group;
         return {
-          ...group,
-          hooks: group.hooks.map((hook) => ({
-            ...hook,
-            origin: "plugin:hook",
-            pluginId: p.name,
-            pluginVersion: p.version || null,
-            pluginSource: p.manifest?.manifestPath || null,
-          })),
+          ...groupConfig,
+          hooks: group.hooks
+            .map((hook) => {
+              if (!hook || typeof hook !== "object") return hook;
+              let sandboxPolicy;
+              try {
+                sandboxPolicy = mergePluginSandboxPolicies(
+                  groupSandboxPolicy,
+                  hook.sandboxPolicy,
+                );
+              } catch {
+                return null;
+              }
+              const { sandboxPolicy: _rawHookPolicy, ...hookConfig } = hook;
+              return {
+                ...hookConfig,
+                ...(sandboxPolicy ? { sandboxPolicy } : {}),
+                origin: "plugin:hook",
+                pluginId: p.name,
+                pluginVersion: p.version || null,
+                pluginSource: p.manifest?.manifestPath || null,
+              };
+            })
+            .filter(Boolean),
         };
-      });
+      }).filter(Boolean);
       merged[event] = (merged[event] || []).concat(tagged);
     }
   }

package/src/lib/plugin-runtime/install.js

@@ -35,6 +35,8 @@ import {
 } from "./signature.js";
 import executionBroker from "../process-execution-broker/index.js";
 
+export const MAX_LISTED_PLUGIN_VERSIONS = 64;
+
 export const _deps = {
   existsSync: fs.existsSync,
   mkdirSync: fs.mkdirSync,
@@ -321,13 +323,27 @@ export function listInstalled(opts = {}) {
     cwd: opts.cwd,
     scopes: opts.scopes,
     skipPolicy: true,
-  }).map((p) => ({
-    name: p.name,
-    version: p.version,
-    scope: p.scope,
-    dir: p.root,
-    ok: p.manifest?.ok === true,
-  }));
+  }).map((p) => {
+    const allVersions = listInstalledVersions(p.scope, p.name, {
+      cwd: opts.cwd,
+    });
+    const versions = allVersions.slice(0, MAX_LISTED_PLUGIN_VERSIONS);
+    if (
+      p.version &&
+      !versions.includes(p.version) &&
+      allVersions.includes(p.version)
+    ) {
+      versions[versions.length - 1] = p.version;
+    }
+    return {
+      name: p.name,
+      version: p.version,
+      versions,
+      scope: p.scope,
+      dir: p.root,
+      ok: p.manifest?.ok === true,
+    };
+  });
 }
 
 /**

package/src/lib/plugin-runtime/lsp.js

@@ -73,6 +73,7 @@ export function ensurePluginLspServers(opts = {}) {
 
   const denied = [];
   for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
     const servers = p.manifest?.components?.lsp || [];
     if (servers.length === 0) continue;
     // Component-level capability gate: a plugin that declared a permissions
@@ -94,6 +95,9 @@ export function ensurePluginLspServers(opts = {}) {
           pluginId: p.name,
           pluginVersion: p.version,
           pluginSource: s.absPath || p.manifest.manifestPath,
+          ...(s.sandboxPolicy
+            ? { sandboxPolicy: s.sandboxPolicy }
+            : {}),
         });
         registered.push({ plugin: p.name, languageId: s.languageId, id: s.id });
       } catch {

package/src/lib/plugin-runtime/manifest.js

@@ -32,6 +32,10 @@ import {
   normalizeOptionsSchema,
   auditDeclaredCapabilities,
 } from "./capabilities.js";
+import {
+  mergePluginSandboxPolicies,
+  normalizePluginSandboxPolicy,
+} from "./sandbox-policy.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -137,6 +141,19 @@ export function parsePluginManifest(root) {
     license: strOr(manifest.license, ""),
   };
 
+  let manifestSandboxPolicy = null;
+  try {
+    manifestSandboxPolicy = normalizePluginSandboxPolicy(
+      manifest.sandboxPolicy,
+      { label: "manifest.sandboxPolicy" },
+    );
+    if (manifestSandboxPolicy) {
+      result.sandboxPolicy = manifestSandboxPolicy;
+    }
+  } catch (err) {
+    errors.push(err.message);
+  }
+
   // A helper that resolves a plugin-relative path safely, recording an error if
   // it escapes the root or is absolute. Returns the absolute path or null.
   const safeResolve = (rel, label) => {
@@ -174,9 +191,22 @@ export function parsePluginManifest(root) {
     conventionPath: ["monitors", "monitors.json"],
     listKey: "monitors",
   });
-  c.lsp = resolveLsp(abs, manifest, safeResolve, errors, warnings);
+  c.lsp = resolveLsp(
+    abs,
+    manifest,
+    safeResolve,
+    errors,
+    warnings,
+    manifestSandboxPolicy,
+  );
   c.bin = resolveBin(abs, manifest, safeResolve, warnings);
   c.settings = resolveSettings(abs, manifest, safeResolve);
+  if (manifestSandboxPolicy && c.bin.length > 0) {
+    errors.push(
+      "manifest.sandboxPolicy cannot currently protect plugin bin executables; " +
+        "top-level sandbox requirements with bin are not supported",
+    );
+  }
 
   // ── declared capabilities + options schema (P1) ──
   const hasPermissions =
@@ -363,7 +393,14 @@ function extractList(obj, listKey) {
   return { count: 0, names: [] };
 }
 
-function resolveLsp(root, manifest, safeResolve, errors, warnings) {
+function resolveLsp(
+  root,
+  manifest,
+  safeResolve,
+  errors,
+  warnings,
+  manifestSandboxPolicy,
+) {
   let content = manifest.lsp;
   // Convention file `.lsp.json`.
   if (!content) {
@@ -392,12 +429,23 @@ function resolveLsp(root, manifest, safeResolve, errors, warnings) {
       warnings.push("lsp server entry missing languageId/command — skipped");
       continue;
     }
+    let sandboxPolicy;
+    try {
+      sandboxPolicy = mergePluginSandboxPolicies(
+        manifestSandboxPolicy,
+        s.sandboxPolicy,
+      );
+    } catch (err) {
+      errors.push(`lsp server "${s.languageId}": ${err.message}`);
+      continue;
+    }
     out.push({
       languageId: s.languageId,
       command: s.command,
       args: Array.isArray(s.args) ? s.args.map(String) : [],
       extensions: Array.isArray(s.extensions) ? s.extensions.map(String) : [],
       id: typeof s.id === "string" ? s.id : s.command,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
     });
   }
   return out;

package/src/lib/plugin-runtime/mcp.js

@@ -17,7 +17,11 @@
 import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
-import { componentCapabilityDenial } from "./capabilities.js";
+import {
+  componentCapabilityDenial,
+  networkTargetDenial,
+} from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -35,9 +39,8 @@ function warnMcpCapabilityDeniedOnce(entries) {
   const list = entries.map((e) => `${e.name} (${e.reason})`).join("; ");
   try {
     process.stderr.write(
-      `[plugins] refused MCP server(s) from plugin(s) that declared a permissions ` +
-        `block but did not declare the 'mcp' capability their server needs: ${list}\n` +
-        `          add 'mcp' to the plugin's permissions block to enable them.\n`,
+      `[plugins] refused MCP server(s) outside declared plugin capabilities: ${list}\n` +
+        `          declare 'mcp' and every direct URL domain in the plugin permissions block.\n`,
     );
   } catch {
     /* stderr notice is best-effort */
@@ -119,8 +122,30 @@ export function collectPluginMcpServers(opts = {}) {
     for (const [name, cfg] of Object.entries(map)) {
       if (!cfg || typeof cfg !== "object") continue;
       if (name in servers) continue; // first plugin wins on a clash
+      let sandboxPolicy;
+      try {
+        sandboxPolicy = mergePluginSandboxPolicies(
+          p.manifest.sandboxPolicy,
+          cfg.sandboxPolicy,
+        );
+      } catch {
+        // An invalid explicit requirement must never degrade to an unsandboxed
+        // process. Refuse only this server so independent entries still load.
+        continue;
+      }
+      const targetUrl = cfg.url || cfg.transport?.url || null;
+      const networkDenial = networkTargetDenial(p.manifest, targetUrl);
+      if (networkDenial) {
+        denied.push({
+          name: `${p.name}/${name}`,
+          reason: networkDenial.reason,
+        });
+        continue;
+      }
+      const { sandboxPolicy: _rawSandboxPolicy, ...serverConfig } = cfg;
       servers[name] = {
-        ...cfg,
+        ...serverConfig,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
         origin: "plugin:mcp",
         policy: "allow",
         pluginId: p.name,

package/src/lib/plugin-runtime/monitors.js

@@ -22,6 +22,7 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -68,6 +69,15 @@ function normalizeMonitor(plugin, raw) {
     raw.env && typeof raw.env === "object" && !Array.isArray(raw.env)
       ? raw.env
       : null;
+  let sandboxPolicy;
+  try {
+    sandboxPolicy = mergePluginSandboxPolicies(
+      plugin.manifest?.sandboxPolicy,
+      raw.sandboxPolicy,
+    );
+  } catch {
+    return null;
+  }
   return {
     plugin: plugin.name,
     scope: plugin.scope,
@@ -85,6 +95,7 @@ function normalizeMonitor(plugin, raw) {
     pluginId: plugin.name,
     pluginVersion: plugin.version,
     pluginSource: plugin.manifest?.manifestPath || null,
+    ...(sandboxPolicy ? { sandboxPolicy } : {}),
   };
 }
 

package/src/lib/plugin-runtime/plugin-options.js

@@ -20,6 +20,7 @@
 
 import fs from "fs";
 import path from "path";
+import crypto from "node:crypto";
 import { getElectronUserDataDir } from "../paths.js";
 import {
   optionDefaults,
@@ -31,12 +32,16 @@ import {
   isSecretRef,
   secretRef,
 } from "../secret-store.js";
+import { withFileLock } from "../with-file-lock.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
   readFileSync: fs.readFileSync,
+  renameSync: fs.renameSync,
+  unlinkSync: fs.unlinkSync,
   writeFileSync: fs.writeFileSync,
   mkdirSync: fs.mkdirSync,
+  withFileLock,
   secretStore: () => createSecretStore(),
   userStorePath: () =>
     path.join(getElectronUserDataDir(), "plugin-options.json"),
@@ -44,23 +49,54 @@ export const _deps = {
     path.join(cwd || process.cwd(), ".chainlesschain", "plugin-options.json"),
 };
 
-function readJsonObject(p) {
+function readJsonObject(p, { failIfUnavailable = false } = {}) {
   try {
     if (!_deps.existsSync(p)) return {};
     const data = JSON.parse(_deps.readFileSync(p, "utf8"));
-    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-  } catch {
+    if (data && typeof data === "object" && !Array.isArray(data)) return data;
+    throw new TypeError("top-level value must be an object");
+  } catch (cause) {
+    if (failIfUnavailable) {
+      const error = new Error(`Plugin option store is unavailable: ${p}`, {
+        cause,
+      });
+      error.code = "PLUGIN_OPTION_STORE_UNAVAILABLE";
+      throw error;
+    }
     return {};
   }
 }
 
 function writeJsonObject(p, obj) {
   _deps.mkdirSync(path.dirname(p), { recursive: true });
-  _deps.writeFileSync(p, JSON.stringify(obj, null, 2), "utf8");
+  const tmp = `${p}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, `${JSON.stringify(obj, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    _deps.renameSync(tmp, p);
+  } catch (error) {
+    try {
+      _deps.unlinkSync(tmp);
+    } catch {
+      // Preserve the original persistence error.
+    }
+    throw error;
+  }
+}
+
+function withOptionStoreLock(p, body) {
+  _deps.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+  return _deps.withFileLock(p, body, { failIfUnavailable: true });
 }
 
 /** Load a plugin's option VALUES at the given scope (`user` | `project`). */
-export function loadPluginOptionValues(name, scope, { cwd, schema, secretStore } = {}) {
+export function loadPluginOptionValues(
+  name,
+  scope,
+  { cwd, schema, secretStore } = {},
+) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
   const store = readJsonObject(p);
@@ -71,7 +107,9 @@ export function loadPluginOptionValues(name, scope, { cwd, schema, secretStore }
   for (const [key, desc] of Object.entries(normalized)) {
     if (!desc?.sensitive || !isSecretRef(out[key])) continue;
     try {
-      const value = (secretStore || _deps.secretStore)().get(out[key].__cc_secret_ref);
+      const value = (secretStore || _deps.secretStore)().get(
+        out[key].__cc_secret_ref,
+      );
       if (value != null) out[key] = value;
       else delete out[key];
     } catch {
@@ -92,40 +130,58 @@ export function setPluginOptionValues(
 ) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
-  const store = readJsonObject(p);
-  const input = values && typeof values === "object" ? values : {};
-  const persisted = { ...input };
-  const normalized = schema || {};
-  let secrets = null;
-  const getSecrets = () => {
-    if (!secrets) secrets = (secretStore || _deps.secretStore)();
-    return secrets;
-  };
-  const rejectedSensitive = [];
-  for (const [key, desc] of Object.entries(normalized)) {
-    if (!desc?.sensitive || !Object.prototype.hasOwnProperty.call(input, key)) continue;
-    // Project files are shareable and must never receive a sensitive value.
-    if (scope === "project") {
-      delete persisted[key];
-      rejectedSensitive.push(key);
-      continue;
+  return withOptionStoreLock(p, () => {
+    const store = readJsonObject(p, { failIfUnavailable: true });
+    const input = values && typeof values === "object" ? values : {};
+    const persisted = { ...input };
+    const normalized = schema || {};
+    let secrets = null;
+    const getSecrets = () => {
+      if (!secrets) secrets = (secretStore || _deps.secretStore)();
+      return secrets;
+    };
+    const rejectedSensitive = [];
+    for (const [key, desc] of Object.entries(normalized)) {
+      if (
+        !desc?.sensitive ||
+        !Object.prototype.hasOwnProperty.call(input, key)
+      ) {
+        continue;
+      }
+      // Project files are shareable and must never receive a sensitive value.
+      if (scope === "project") {
+        delete persisted[key];
+        rejectedSensitive.push(key);
+        continue;
+      }
+      if (input[key] == null || input[key] === "") {
+        delete persisted[key];
+        try {
+          getSecrets().delete(`${name}/${key}`);
+        } catch {
+          // Missing secrets already behave as absent on read.
+        }
+        continue;
+      }
+      getSecrets().set(`${name}/${key}`, input[key]);
+      persisted[key] = secretRef(`${name}/${key}`);
     }
-    if (input[key] == null || input[key] === "") {
-      delete persisted[key];
-      try { getSecrets().delete(`${name}/${key}`); } catch {}
-      continue;
+    if (rejectedSensitive.length > 0) {
+      persisted.__cc_rejected_sensitive = [
+        ...new Set(rejectedSensitive),
+      ].sort();
+    } else if (
+      Object.prototype.hasOwnProperty.call(
+        persisted,
+        "__cc_rejected_sensitive",
+      )
+    ) {
+      delete persisted.__cc_rejected_sensitive;
     }
-    getSecrets().set(`${name}/${key}`, input[key]);
-    persisted[key] = secretRef(`${name}/${key}`);
-  }
-  if (rejectedSensitive.length > 0) {
-    persisted.__cc_rejected_sensitive = [...new Set(rejectedSensitive)].sort();
-  } else if (Object.prototype.hasOwnProperty.call(persisted, "__cc_rejected_sensitive")) {
-    delete persisted.__cc_rejected_sensitive;
-  }
-  store[name] = persisted;
-  writeJsonObject(p, store);
-  return { name, scope, path: p };
+    store[name] = persisted;
+    writeJsonObject(p, store);
+    return { name, scope, path: p };
+  });
 }
 
 /** Provided keys of `values` (that exist in schema) accepted at `scope`. */