chainlesschain 0.162.180 → 0.162.182

package/src/lib/lan-pairing-tokens.js

@@ -33,6 +33,7 @@ import path from "node:path";
 import os from "node:os";
 import crypto from "node:crypto";
 import { getHomeDir } from "./paths.js";
+import { withFileLock } from "./with-file-lock.js";
 
 /** Token lifetime — mirrors device-pairing-handler.js pairingTimeout (5 min). */
 const DEFAULT_TTL_MS = 5 * 60 * 1000;
@@ -108,7 +109,10 @@ export function buildToken({ did, deviceInfo } = {}) {
  * @param {string} [filePath]
  * @returns {{ schema: string, tokens: Array }}
  */
-export function readTokens(filePath = defaultTokenStorePath()) {
+export function readTokens(
+  filePath = defaultTokenStorePath(),
+  { failIfUnavailable = false } = {},
+) {
   if (!fs.existsSync(filePath)) {
     return { schema: "cc-pairing-tokens/v1", tokens: [] };
   }
@@ -121,9 +125,28 @@ export function readTokens(filePath = defaultTokenStorePath()) {
         tokens: parsed.tokens,
       };
     }
+    if (failIfUnavailable) {
+      const error = new Error(
+        `Pairing token store must contain a tokens array: ${filePath}`,
+      );
+      error.code = "PAIRING_TOKEN_STORE_CORRUPT";
+      throw error;
+    }
     return { schema: "cc-pairing-tokens/v1", tokens: [] };
-  } catch (_err) {
-    // Malformed → return empty (don't crash CLI; user can `revoke --all`).
+  } catch (cause) {
+    if (
+      failIfUnavailable ||
+      cause?.code === "PAIRING_TOKEN_STORE_CORRUPT"
+    ) {
+      if (cause?.code === "PAIRING_TOKEN_STORE_CORRUPT") throw cause;
+      const error = new Error(
+        `Could not read pairing token store: ${filePath}`,
+        { cause },
+      );
+      error.code = "PAIRING_TOKEN_STORE_UNAVAILABLE";
+      throw error;
+    }
+    // Advisory listing keeps its legacy empty fallback.
     return { schema: "cc-pairing-tokens/v1", tokens: [] };
   }
 }
@@ -134,19 +157,46 @@ export function readTokens(filePath = defaultTokenStorePath()) {
  * @param {{ schema?: string, tokens: Array }} state
  * @param {string} [filePath]
  */
-export function writeTokens(state, filePath = defaultTokenStorePath()) {
+function _prepareTokenStore(filePath) {
   const dir = path.dirname(filePath);
   if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   }
+}
+
+function _writeTokensUnlocked(state, filePath) {
+  _prepareTokenStore(filePath);
   const toWrite = {
     schema: state.schema || "cc-pairing-tokens/v1",
     tokens: state.tokens || [],
   };
   // Write to temp + rename for atomicity (avoid partial reads).
-  const tmp = filePath + ".tmp";
-  fs.writeFileSync(tmp, JSON.stringify(toWrite, null, 2), "utf-8");
-  fs.renameSync(tmp, filePath);
+  const tmp = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(toWrite, null, 2), {
+      encoding: "utf-8",
+      mode: 0o600,
+    });
+    fs.renameSync(tmp, filePath);
+  } catch (error) {
+    try {
+      fs.rmSync(tmp, { force: true });
+    } catch {
+      // Preserve the original persistence error.
+    }
+    throw error;
+  }
+}
+
+function _withTokenStoreLock(filePath, body) {
+  _prepareTokenStore(filePath);
+  return withFileLock(filePath, body, { failIfUnavailable: true });
+}
+
+export function writeTokens(state, filePath = defaultTokenStorePath()) {
+  return _withTokenStoreLock(filePath, () =>
+    _writeTokensUnlocked(state, filePath),
+  );
 }
 
 /**
@@ -160,17 +210,19 @@ export function writeTokens(state, filePath = defaultTokenStorePath()) {
  */
 export function addToken(input, filePath = defaultTokenStorePath()) {
   const token = buildToken(input);
-  const state = readTokens(filePath);
-  // Invalidate prior pending tokens for the same DID.
-  state.tokens = state.tokens.map((t) => {
-    if (t.qrData?.did === input.did && t.status === STATUS.PENDING) {
-      return { ...t, status: STATUS.REVOKED, revokedAtMs: Date.now() };
-    }
-    return t;
+  return _withTokenStoreLock(filePath, () => {
+    const state = readTokens(filePath, { failIfUnavailable: true });
+    // Invalidate prior pending tokens for the same DID.
+    state.tokens = state.tokens.map((t) => {
+      if (t.qrData?.did === input.did && t.status === STATUS.PENDING) {
+        return { ...t, status: STATUS.REVOKED, revokedAtMs: Date.now() };
+      }
+      return t;
+    });
+    state.tokens.push(token);
+    _writeTokensUnlocked(state, filePath);
+    return token;
   });
-  state.tokens.push(token);
-  writeTokens(state, filePath);
-  return token;
 }
 
 /**
@@ -178,18 +230,20 @@ export function addToken(input, filePath = defaultTokenStorePath()) {
  * before `list` to keep status accurate.
  */
 export function sweepExpired(filePath = defaultTokenStorePath()) {
-  const state = readTokens(filePath);
-  const now = Date.now();
-  let touched = 0;
-  state.tokens = state.tokens.map((t) => {
-    if (t.status === STATUS.PENDING && t.expiresAtMs <= now) {
-      touched += 1;
-      return { ...t, status: STATUS.EXPIRED, expiredAtMs: now };
-    }
-    return t;
+  return _withTokenStoreLock(filePath, () => {
+    const state = readTokens(filePath, { failIfUnavailable: true });
+    const now = Date.now();
+    let touched = 0;
+    state.tokens = state.tokens.map((t) => {
+      if (t.status === STATUS.PENDING && t.expiresAtMs <= now) {
+        touched += 1;
+        return { ...t, status: STATUS.EXPIRED, expiredAtMs: now };
+      }
+      return t;
+    });
+    if (touched > 0) _writeTokensUnlocked(state, filePath);
+    return touched;
   });
-  if (touched > 0) writeTokens(state, filePath);
-  return touched;
 }
 
 /**
@@ -224,20 +278,22 @@ export function findToken(code, filePath = defaultTokenStorePath()) {
  * not found or already non-pending.
  */
 export function revokeToken(code, filePath = defaultTokenStorePath()) {
-  const state = readTokens(filePath);
-  const i = state.tokens.findIndex((t) => t.code === code);
-  if (i < 0) return { revoked: false, reason: "not_found" };
-  const t = state.tokens[i];
-  if (t.status !== STATUS.PENDING) {
-    return { revoked: false, reason: `not_pending(${t.status})` };
-  }
-  state.tokens[i] = {
-    ...t,
-    status: STATUS.REVOKED,
-    revokedAtMs: Date.now(),
-  };
-  writeTokens(state, filePath);
-  return { revoked: true, token: state.tokens[i] };
+  return _withTokenStoreLock(filePath, () => {
+    const state = readTokens(filePath, { failIfUnavailable: true });
+    const i = state.tokens.findIndex((t) => t.code === code);
+    if (i < 0) return { revoked: false, reason: "not_found" };
+    const t = state.tokens[i];
+    if (t.status !== STATUS.PENDING) {
+      return { revoked: false, reason: `not_pending(${t.status})` };
+    }
+    state.tokens[i] = {
+      ...t,
+      status: STATUS.REVOKED,
+      revokedAtMs: Date.now(),
+    };
+    _writeTokensUnlocked(state, filePath);
+    return { revoked: true, token: state.tokens[i] };
+  });
 }
 
 /**
@@ -245,20 +301,22 @@ export function revokeToken(code, filePath = defaultTokenStorePath()) {
  * this after the mobile successfully connects.
  */
 export function markConsumed(code, filePath = defaultTokenStorePath()) {
-  const state = readTokens(filePath);
-  const i = state.tokens.findIndex((t) => t.code === code);
-  if (i < 0) return { consumed: false, reason: "not_found" };
-  const t = state.tokens[i];
-  if (t.status !== STATUS.PENDING) {
-    return { consumed: false, reason: `not_pending(${t.status})` };
-  }
-  state.tokens[i] = {
-    ...t,
-    status: STATUS.CONSUMED,
-    consumedAtMs: Date.now(),
-  };
-  writeTokens(state, filePath);
-  return { consumed: true, token: state.tokens[i] };
+  return _withTokenStoreLock(filePath, () => {
+    const state = readTokens(filePath, { failIfUnavailable: true });
+    const i = state.tokens.findIndex((t) => t.code === code);
+    if (i < 0) return { consumed: false, reason: "not_found" };
+    const t = state.tokens[i];
+    if (t.status !== STATUS.PENDING) {
+      return { consumed: false, reason: `not_pending(${t.status})` };
+    }
+    state.tokens[i] = {
+      ...t,
+      status: STATUS.CONSUMED,
+      consumedAtMs: Date.now(),
+    };
+    _writeTokensUnlocked(state, filePath);
+    return { consumed: true, token: state.tokens[i] };
+  });
 }
 
 export { STATUS, QR_TYPE, DEFAULT_TTL_MS };

package/src/lib/lsp/__tests__/lsp-client.test.js

@@ -15,6 +15,7 @@ import {
   buildSpawnCommand,
 } from "../lsp-client.js";
 import { encodeMessage, MessageBuffer } from "../jsonrpc-stream.js";
+import { executionBroker } from "../../process-execution-broker/index.js";
 
 /** A fake language server process. Auto-replies to `initialize`; test controls the rest. */
 class FakeChild extends EventEmitter {
@@ -94,6 +95,37 @@ describe("LSPClient handshake", () => {
         shell: false,
       }),
     );
+    expect(_deps.spawn.mock.calls[0][2]).not.toHaveProperty("sandboxPolicy");
+  });
+
+  it("passes plugin sandbox requirements to ProcessExecutionBroker", async () => {
+    const child = new FakeChild();
+    const brokerSpawn = vi
+      .spyOn(executionBroker, "spawn")
+      .mockReturnValue(child);
+    const client = makeClient(child, {
+      origin: "plugin:lsp",
+      pluginId: "strict-lsp",
+      pluginVersion: "1.0.0",
+      pluginSource: "/plugins/strict-lsp/.lsp.json",
+      sandboxPolicy: {
+        requiredBoundaries: ["filesystem", "network"],
+      },
+    });
+
+    await client.start();
+
+    expect(brokerSpawn).toHaveBeenCalledWith(
+      "fake-lsp",
+      ["--stdio"],
+      expect.objectContaining({
+        origin: "plugin:lsp",
+        sandboxPolicy: {
+          requiredBoundaries: ["filesystem", "network"],
+        },
+      }),
+    );
+    expect(_deps.spawn).not.toHaveBeenCalled();
   });
 
   it("kills the spawned server when the initialize handshake times out (no orphan)", async () => {

package/src/lib/lsp/__tests__/lsp-manager.test.js

@@ -19,6 +19,7 @@ import { _deps as regDeps } from "../lsp-server-registry.js";
 class FakeClient extends EventEmitter {
   constructor(opts) {
     super();
+    this.opts = opts;
     this.rootPath = opts.rootPath;
     this.running = true;
     this.notifications = [];
@@ -102,6 +103,30 @@ describe("position helpers", () => {
 });
 
 describe("ensureFor", () => {
+  it("passes resolved plugin sandbox requirements into LSPClient", async () => {
+    const mgr = new LSPManager();
+
+    await mgr._startServer(
+      "/proj::strict-lsp",
+      {
+        id: "strict-lsp",
+        command: "strict-lsp",
+        args: ["--stdio"],
+        origin: "plugin:lsp",
+        pluginId: "strict-plugin",
+        sandboxPolicy: {
+          requiredBoundaries: ["filesystem", "network"],
+        },
+      },
+      "/proj",
+    );
+
+    expect(lastClient.opts.sandboxPolicy).toEqual({
+      requiredBoundaries: ["filesystem", "network"],
+    });
+    await mgr.disposeAll();
+  });
+
   it("starts a server and sends didOpen the first time", async () => {
     const mgr = new LSPManager();
     const ready = await mgr.ensureFor("/proj/src/a.ts");

package/src/lib/lsp/lsp-client.js

@@ -47,6 +47,7 @@ export class LSPClient extends EventEmitter {
     this.pluginId = opts.pluginId || null;
     this.pluginVersion = opts.pluginVersion || null;
     this.pluginSource = opts.pluginSource || null;
+    this.sandboxPolicy = opts.sandboxPolicy || null;
 
     this._child = null;
     this._buffer = new MessageBuffer();
@@ -97,6 +98,9 @@ export class LSPClient extends EventEmitter {
             pluginId: this.pluginId,
             pluginVersion: this.pluginVersion,
             pluginSource: this.pluginSource,
+            ...(this.sandboxPolicy
+              ? { sandboxPolicy: this.sandboxPolicy }
+              : {}),
           }
         : {}),
     });

package/src/lib/lsp/lsp-manager.js

@@ -243,6 +243,9 @@ export class LSPManager {
       pluginId: resolved.pluginId,
       pluginVersion: resolved.pluginVersion,
       pluginSource: resolved.pluginSource,
+      ...(resolved.sandboxPolicy
+        ? { sandboxPolicy: resolved.sandboxPolicy }
+        : {}),
     });
     // Collect pushed diagnostics keyed by document, tracking publish count/time
     // so callers can wait for the project to load (first publish) and settle

package/src/lib/lsp/lsp-server-registry.js

@@ -96,6 +96,15 @@ export function registerLanguageServer(def) {
     pluginId: def.pluginId || null,
     pluginVersion: def.pluginVersion || null,
     pluginSource: def.pluginSource || null,
+    ...(def.sandboxPolicy
+      ? {
+          sandboxPolicy: {
+            requiredBoundaries: [
+              ...(def.sandboxPolicy.requiredBoundaries || []),
+            ],
+          },
+        }
+      : {}),
   };
   const existing = pluginServers.get(def.languageId) || [];
   // De-dupe by server id so re-registering the same server (e.g. a reload)
@@ -154,6 +163,15 @@ export function resolveServer(languageId, projectRoot) {
                 pluginId: def.pluginId,
                 pluginVersion: def.pluginVersion,
                 pluginSource: def.pluginSource,
+                ...(def.sandboxPolicy
+                  ? {
+                      sandboxPolicy: {
+                        requiredBoundaries: [
+                          ...(def.sandboxPolicy.requiredBoundaries || []),
+                        ],
+                      },
+                    }
+                  : {}),
               }
             : {}),
         };

package/src/lib/mcp-client.js

@@ -13,6 +13,7 @@ export {
   MCPClient,
   MCPServerConfig,
   inferTransport,
+  normalizeMcpElicitationRequest,
   isHttpTransport,
   isLikelyConnectionError,
   isTransientMcpError,

package/src/lib/mcp-oauth.js

@@ -49,6 +49,7 @@ export const _deps = {
   warn: (msg) => {
     if (!process.env.VITEST) process.stderr.write(msg);
   },
+  withStoreLock,
 };
 
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
@@ -500,29 +501,36 @@ function _sleepSyncMs(ms) {
  * lost update. An O_EXCL lockfile makes the whole RMW mutually exclusive across
  * processes, so each writer re-reads the latest store inside the lock.
  *
- * Robustness: a stale lock (holder crashed) older than STALE_MS is stolen; if
- * the lock can't be acquired within MAX_WAIT_MS we proceed anyway (degrading to
- * the pre-lock last-writer-wins rather than failing the login). When the
- * injected fs lacks the lock primitives (test fs / exotic fs) we run `fn`
- * directly — single-process correctness is unchanged, only cross-process mutual
- * exclusion is lost. Lock timing uses the wall clock (not the `now` test seam).
+ * Robustness: a stale lock (holder crashed) older than STALE_MS is stolen.
+ * Credential metadata is critical, so missing lock primitives, unexpected lock
+ * errors, and bounded contention all fail closed instead of running `fn`
+ * without exclusion. Lock timing uses the wall clock (not the `now` test seam).
  */
-function withStoreLock(file, fn) {
+export function withStoreLock(file, fn) {
   const fs = _deps.fs;
   if (
     typeof fs.openSync !== "function" ||
     typeof fs.closeSync !== "function" ||
     typeof fs.unlinkSync !== "function"
   ) {
-    return fn(); // no lock primitives → run unlocked (back-compat)
+    const error = new Error(
+      `MCP OAuth token store lock primitives unavailable: ${file}`,
+    );
+    error.code = "MCP_TOKEN_STORE_LOCK_UNAVAILABLE";
+    throw error;
   }
   const STALE_MS = 10_000;
   const MAX_WAIT_MS = 5_000;
   const lockPath = `${file}.lock`;
   try {
     fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
-  } catch {
-    /* dir may already exist — openSync below reports any real problem */
+  } catch (cause) {
+    const error = new Error(
+      `Could not prepare MCP OAuth token store lock: ${file}`,
+      { cause },
+    );
+    error.code = "MCP_TOKEN_STORE_LOCK_UNAVAILABLE";
+    throw error;
   }
   const start = Date.now();
   let fd = null;
@@ -532,9 +540,12 @@ function withStoreLock(file, fn) {
       break;
     } catch (err) {
       if (!err || err.code !== "EEXIST") {
-        // Unexpected (e.g. ENOENT/EACCES): don't fail the login over the lock —
-        // proceed unlocked, same as a missing-primitives fs.
-        return fn();
+        const error = new Error(
+          `Could not acquire MCP OAuth token store lock: ${file}`,
+          { cause: err },
+        );
+        error.code = "MCP_TOKEN_STORE_LOCK_UNAVAILABLE";
+        throw error;
       }
       let stale = false;
       try {
@@ -552,7 +563,14 @@ function withStoreLock(file, fn) {
         }
         continue;
       }
-      if (Date.now() - start > MAX_WAIT_MS) break; // give up waiting; proceed
+      if (Date.now() - start > MAX_WAIT_MS) {
+        const error = new Error(
+          `Timed out acquiring MCP OAuth token store lock: ${file}`,
+          { cause: err },
+        );
+        error.code = "MCP_TOKEN_STORE_LOCK_UNAVAILABLE";
+        throw error;
+      }
       _sleepSyncMs(50);
     }
   }
@@ -576,7 +594,7 @@ function withStoreLock(file, fn) {
 
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
-  return withStoreLock(file, () => {
+  return _deps.withStoreLock(file, () => {
     const r = _readStore(file); // re-read inside the lock (latest state)
     if (!r.ok) {
       // The existing store is unreadable. Writing a fresh single-entry store
@@ -594,16 +612,12 @@ export function saveStoredToken(serverUrl, record) {
 
 export function deleteStoredToken(serverUrl) {
   const file = tokenStorePath();
-  return withStoreLock(file, () => {
+  return _deps.withStoreLock(file, () => {
     const store = loadTokenStore(); // re-read inside the lock (latest state)
     const key = serverKey(serverUrl);
     if (!(key in store)) return false;
     delete store[key];
-    try {
-      _writeStoreSecure(file, store);
-    } catch {
-      /* best-effort */
-    }
+    _writeStoreSecure(file, store);
     return true;
   });
 }

package/src/lib/packer/pkg-config-generator.js

@@ -385,6 +385,9 @@ export function generatePkgConfig(ctx) {
   const assets = [
     `${posixify(distDir)}/**/*`,
     `${posixify(templatesDir)}/**/*`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.dll`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.exe`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox.cs`,
   ];
   if (prebuildsDir) assets.push(`${posixify(prebuildsDir)}/**/*`);
   // Project mode: bundle the collected .chainlesschain/ snapshot as an asset.

package/src/lib/permission-decision.js

@@ -0,0 +1,99 @@
+/**
+ * Build the additive, protocol-safe PermissionDecision attached to a gated
+ * tool result. The runtime remains the authority; IDEs and SDKs only render
+ * this explanation and must never re-evaluate it.
+ *
+ * The source result can contain user-controlled rules/reasons. Keep the wire
+ * object bounded and run every text field through the export-grade secret
+ * redactor before it reaches transcripts, ledgers, or IDE logs.
+ */
+
+import { redactSecrets } from "./secret-scan.js";
+
+export const PERMISSION_DECISION_VERSION = 1;
+
+const MAX_TEXT = 512;
+const MAX_CHAIN = 8;
+
+function boundedText(value, max = MAX_TEXT) {
+  if (value == null) return null;
+  let text;
+  if (typeof value === "string") {
+    text = value;
+  } else {
+    try {
+      text = JSON.stringify(value);
+    } catch {
+      text = String(value);
+    }
+  }
+  if (typeof text !== "string") text = String(value);
+  text = redactSecrets(text);
+  return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+
+function normalizeChain(value) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, MAX_CHAIN).map((entry) => {
+    const row = entry && typeof entry === "object" ? entry : {};
+    return {
+      layer: boundedText(row.layer, 80),
+      outcome: boundedText(row.outcome, 80),
+      via: boundedText(row.via || row.source, 120),
+      rule: boundedText(row.rule, 256),
+      reason: boundedText(row.reason),
+    };
+  });
+}
+
+/**
+ * @param {{
+ *   toolUseId?: string,
+ *   tool?: string,
+ *   result?: object,
+ * }} input
+ * @returns {object|null}
+ */
+export function buildPermissionDecision(input = {}) {
+  const result =
+    input.result && typeof input.result === "object" ? input.result : {};
+  const policy =
+    result.policy && typeof result.policy === "object" ? result.policy : {};
+  const approval =
+    result.approval && typeof result.approval === "object"
+      ? result.approval
+      : {};
+  const chain = normalizeChain(result.permissionChain);
+  const terminal = chain.length > 0 ? chain[chain.length - 1] : {};
+
+  const decision = boundedText(
+    policy.decision || approval.decision || terminal.outcome,
+    32,
+  );
+  if (!decision && chain.length === 0) return null;
+
+  const via = boundedText(
+    policy.via || approval.via || terminal.via || terminal.layer,
+    120,
+  );
+  const rule = boundedText(policy.rule || approval.rule || terminal.rule, 256);
+  const reason = boundedText(
+    policy.reason ||
+      approval.reason ||
+      terminal.reason ||
+      result.shellCommandPolicy?.reason,
+  );
+  const toolUseId = boundedText(input.toolUseId, 160);
+  const gate = via || decision || "policy";
+
+  return {
+    version: PERMISSION_DECISION_VERSION,
+    id: toolUseId ? `${toolUseId}:perm:${gate}` : null,
+    tool: boundedText(input.tool, 120),
+    decision,
+    via,
+    rule,
+    reason,
+    chain,
+  };
+}

package/src/lib/plugin-monitor-supervisor.js

@@ -224,6 +224,9 @@ export class PluginMonitorSupervisor {
               pluginId: desc.pluginId,
               pluginVersion: desc.pluginVersion,
               pluginSource: desc.pluginSource,
+              ...(desc.sandboxPolicy
+                ? { sandboxPolicy: desc.sandboxPolicy }
+                : {}),
             }
           : {}),
       },