chainlesschain 0.162.180 → 0.162.182

package/src/lib/plugin-runtime/capabilities.js

@@ -239,6 +239,56 @@ export function componentCapabilityDenial(manifest, capabilityNames) {
   return finding ? { reason: finding.reason } : null;
 }
 
+/**
+ * Enforce a declared network domain for a direct URL-based plugin component.
+ * Stdio children have no direct target here and remain subject to the process
+ * sandbox boundary; URL transports can be rejected before any connection.
+ */
+export function networkTargetDenial(manifest, targetUrl) {
+  if (!manifest || manifest.capabilitiesDeclared !== true || !targetUrl) {
+    return null;
+  }
+  let hostname;
+  try {
+    hostname = new URL(String(targetUrl)).hostname
+      .toLowerCase()
+      .replace(/\.$/, "");
+  } catch {
+    return { reason: `invalid network target URL: ${targetUrl}` };
+  }
+  const network = manifest.capabilities?.network || {
+    any: false,
+    domains: [],
+  };
+  if (network.any === true) return null;
+  const allowed = (network.domains || []).some((raw) => {
+    let domain = String(raw || "")
+      .trim()
+      .toLowerCase()
+      .replace(/\.$/, "");
+    if (!domain) return false;
+    if (domain.includes("://")) {
+      try {
+        domain = new URL(domain).hostname.toLowerCase().replace(/\.$/, "");
+      } catch {
+        return false;
+      }
+    } else {
+      domain = domain.replace(/:\d+$/, "");
+    }
+    if (domain.startsWith("*.")) {
+      const suffix = domain.slice(1);
+      return hostname.endsWith(suffix) && hostname.length > suffix.length;
+    }
+    return hostname === domain;
+  });
+  return allowed
+    ? null
+    : {
+        reason: `network target "${hostname}" is outside the plugin's declared domains`,
+      };
+}
+
 // ─── options schema ─────────────────────────────────────────────────────────
 
 export const OPTION_TYPES = Object.freeze([

package/src/lib/plugin-runtime/capability-consent.js

@@ -18,21 +18,22 @@
  * never touch the real user-data dir.
  */
 
-import fs from "fs";
 import path from "path";
 import { getElectronUserDataDir } from "../paths.js";
+import { withFileLock } from "../with-file-lock.js";
 import {
   normalizeCapabilities,
   diffCapabilities,
   describeCapabilities,
 } from "./capabilities.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "../durable-security-store.js";
 
 export const _deps = {
-  existsSync: fs.existsSync,
-  readFileSync: fs.readFileSync,
-  writeFileSync: fs.writeFileSync,
-  mkdirSync: fs.mkdirSync,
   now: () => new Date().toISOString(),
+  withFileLock,
   // Injectable so unit tests never touch the real user-data dir.
   storePath: () =>
     path.join(getElectronUserDataDir(), "plugin-capability-consent.json"),
@@ -43,20 +44,7 @@ function consentKey(scope, name) {
 }
 
 export function loadConsentStore() {
-  try {
-    const p = _deps.storePath();
-    if (!_deps.existsSync(p)) return {};
-    const data = JSON.parse(_deps.readFileSync(p, "utf8"));
-    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-  } catch {
-    return {};
-  }
-}
-
-function saveConsentStore(store) {
-  const p = _deps.storePath();
-  _deps.mkdirSync(path.dirname(p), { recursive: true });
-  _deps.writeFileSync(p, JSON.stringify(store, null, 2), "utf8");
+  return readSecurityStore(_deps.storePath(), "plugin capability consent");
 }
 
 /**
@@ -158,8 +146,15 @@ export function resolveConsentAction(
 /** Load the store and report whether one plugin's declared caps are consented. */
 export function isPluginCapabilityConsented(plugin, declaredCaps) {
   if (!plugin || !plugin.name) return false;
-  const entry = loadConsentStore()[consentKey(plugin.scope, plugin.name)];
-  return capabilityConsentStatus(declaredCaps, entry).consented;
+  if (capabilitiesAreEmpty(declaredCaps)) return true;
+  try {
+    const entry = loadConsentStore()[consentKey(plugin.scope, plugin.name)];
+    return capabilityConsentStatus(declaredCaps, entry).consented;
+  } catch {
+    // Security reads fail closed: an unavailable/corrupt consent store never
+    // turns into permission to use a capability.
+    return false;
+  }
 }
 
 /** Record consent for a plugin's currently-declared capability set. */
@@ -168,24 +163,36 @@ export function consentPluginCapabilities(
   { scope = "project", version, capabilities } = {},
 ) {
   if (!version) throw new Error("consentPluginCapabilities requires a version");
-  const store = loadConsentStore();
-  store[consentKey(scope, name)] = {
-    version,
-    capabilities: canonicalCaps(capabilities),
-    consentedAt: _deps.now(),
-  };
-  saveConsentStore(store);
-  return { name, scope, version };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin capability consent",
+    (store) => {
+      store[consentKey(scope, name)] = {
+        version,
+        capabilities: canonicalCaps(capabilities),
+        consentedAt: _deps.now(),
+      };
+      return { name, scope, version };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** Revoke capability consent for a plugin at a scope. */
 export function revokeCapabilityConsent(name, { scope = "project" } = {}) {
-  const store = loadConsentStore();
-  const key = consentKey(scope, name);
-  const existed = Object.prototype.hasOwnProperty.call(store, key);
-  delete store[key];
-  saveConsentStore(store);
-  return { name, scope, removed: existed };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin capability consent",
+    (store) => {
+      const key = consentKey(scope, name);
+      const existed = Object.prototype.hasOwnProperty.call(store, key);
+      delete store[key];
+      return { name, scope, removed: existed };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** All consent entries (for `cc plugin consent --list`). */

package/src/lib/plugin-runtime/hooks.js

@@ -18,6 +18,7 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -124,17 +125,43 @@ export function collectPluginHooks(opts = {}) {
       if (!Array.isArray(entries)) continue;
       const tagged = entries.map((group) => {
         if (!group || typeof group !== "object" || !Array.isArray(group.hooks)) return group;
+        let groupSandboxPolicy;
+        try {
+          groupSandboxPolicy = mergePluginSandboxPolicies(
+            p.manifest.sandboxPolicy,
+            group.sandboxPolicy,
+          );
+        } catch {
+          return null;
+        }
+        const { sandboxPolicy: _rawGroupPolicy, ...groupConfig } = group;
         return {
-          ...group,
-          hooks: group.hooks.map((hook) => ({
-            ...hook,
-            origin: "plugin:hook",
-            pluginId: p.name,
-            pluginVersion: p.version || null,
-            pluginSource: p.manifest?.manifestPath || null,
-          })),
+          ...groupConfig,
+          hooks: group.hooks
+            .map((hook) => {
+              if (!hook || typeof hook !== "object") return hook;
+              let sandboxPolicy;
+              try {
+                sandboxPolicy = mergePluginSandboxPolicies(
+                  groupSandboxPolicy,
+                  hook.sandboxPolicy,
+                );
+              } catch {
+                return null;
+              }
+              const { sandboxPolicy: _rawHookPolicy, ...hookConfig } = hook;
+              return {
+                ...hookConfig,
+                ...(sandboxPolicy ? { sandboxPolicy } : {}),
+                origin: "plugin:hook",
+                pluginId: p.name,
+                pluginVersion: p.version || null,
+                pluginSource: p.manifest?.manifestPath || null,
+              };
+            })
+            .filter(Boolean),
         };
-      });
+      }).filter(Boolean);
       merged[event] = (merged[event] || []).concat(tagged);
     }
   }

package/src/lib/plugin-runtime/install.js

@@ -35,6 +35,8 @@ import {
 } from "./signature.js";
 import executionBroker from "../process-execution-broker/index.js";
 
+export const MAX_LISTED_PLUGIN_VERSIONS = 64;
+
 export const _deps = {
   existsSync: fs.existsSync,
   mkdirSync: fs.mkdirSync,
@@ -321,13 +323,27 @@ export function listInstalled(opts = {}) {
     cwd: opts.cwd,
     scopes: opts.scopes,
     skipPolicy: true,
-  }).map((p) => ({
-    name: p.name,
-    version: p.version,
-    scope: p.scope,
-    dir: p.root,
-    ok: p.manifest?.ok === true,
-  }));
+  }).map((p) => {
+    const allVersions = listInstalledVersions(p.scope, p.name, {
+      cwd: opts.cwd,
+    });
+    const versions = allVersions.slice(0, MAX_LISTED_PLUGIN_VERSIONS);
+    if (
+      p.version &&
+      !versions.includes(p.version) &&
+      allVersions.includes(p.version)
+    ) {
+      versions[versions.length - 1] = p.version;
+    }
+    return {
+      name: p.name,
+      version: p.version,
+      versions,
+      scope: p.scope,
+      dir: p.root,
+      ok: p.manifest?.ok === true,
+    };
+  });
 }
 
 /**

package/src/lib/plugin-runtime/lsp.js

@@ -73,6 +73,7 @@ export function ensurePluginLspServers(opts = {}) {
 
   const denied = [];
   for (const p of trusted) {
+    if (!p.manifest || p.manifest.ok !== true) continue;
     const servers = p.manifest?.components?.lsp || [];
     if (servers.length === 0) continue;
     // Component-level capability gate: a plugin that declared a permissions
@@ -94,6 +95,9 @@ export function ensurePluginLspServers(opts = {}) {
           pluginId: p.name,
           pluginVersion: p.version,
           pluginSource: s.absPath || p.manifest.manifestPath,
+          ...(s.sandboxPolicy
+            ? { sandboxPolicy: s.sandboxPolicy }
+            : {}),
         });
         registered.push({ plugin: p.name, languageId: s.languageId, id: s.id });
       } catch {

package/src/lib/plugin-runtime/manifest.js

@@ -32,6 +32,10 @@ import {
   normalizeOptionsSchema,
   auditDeclaredCapabilities,
 } from "./capabilities.js";
+import {
+  mergePluginSandboxPolicies,
+  normalizePluginSandboxPolicy,
+} from "./sandbox-policy.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
@@ -137,6 +141,19 @@ export function parsePluginManifest(root) {
     license: strOr(manifest.license, ""),
   };
 
+  let manifestSandboxPolicy = null;
+  try {
+    manifestSandboxPolicy = normalizePluginSandboxPolicy(
+      manifest.sandboxPolicy,
+      { label: "manifest.sandboxPolicy" },
+    );
+    if (manifestSandboxPolicy) {
+      result.sandboxPolicy = manifestSandboxPolicy;
+    }
+  } catch (err) {
+    errors.push(err.message);
+  }
+
   // A helper that resolves a plugin-relative path safely, recording an error if
   // it escapes the root or is absolute. Returns the absolute path or null.
   const safeResolve = (rel, label) => {
@@ -174,8 +191,22 @@ export function parsePluginManifest(root) {
     conventionPath: ["monitors", "monitors.json"],
     listKey: "monitors",
   });
-  c.lsp = resolveLsp(abs, manifest, safeResolve, errors, warnings);
-  c.bin = resolveBin(abs, manifest, safeResolve, warnings);
+  c.lsp = resolveLsp(
+    abs,
+    manifest,
+    safeResolve,
+    errors,
+    warnings,
+    manifestSandboxPolicy,
+  );
+  c.bin = resolveBin(
+    abs,
+    manifest,
+    safeResolve,
+    errors,
+    warnings,
+    manifestSandboxPolicy,
+  );
   c.settings = resolveSettings(abs, manifest, safeResolve);
 
   // ── declared capabilities + options schema (P1) ──
@@ -363,7 +394,14 @@ function extractList(obj, listKey) {
   return { count: 0, names: [] };
 }
 
-function resolveLsp(root, manifest, safeResolve, errors, warnings) {
+function resolveLsp(
+  root,
+  manifest,
+  safeResolve,
+  errors,
+  warnings,
+  manifestSandboxPolicy,
+) {
   let content = manifest.lsp;
   // Convention file `.lsp.json`.
   if (!content) {
@@ -392,21 +430,39 @@ function resolveLsp(root, manifest, safeResolve, errors, warnings) {
       warnings.push("lsp server entry missing languageId/command — skipped");
       continue;
     }
+    let sandboxPolicy;
+    try {
+      sandboxPolicy = mergePluginSandboxPolicies(
+        manifestSandboxPolicy,
+        s.sandboxPolicy,
+      );
+    } catch (err) {
+      errors.push(`lsp server "${s.languageId}": ${err.message}`);
+      continue;
+    }
     out.push({
       languageId: s.languageId,
       command: s.command,
       args: Array.isArray(s.args) ? s.args.map(String) : [],
       extensions: Array.isArray(s.extensions) ? s.extensions.map(String) : [],
       id: typeof s.id === "string" ? s.id : s.command,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
     });
   }
   return out;
 }
 
-function resolveBin(root, manifest, safeResolve, warnings) {
+function resolveBin(
+  root,
+  manifest,
+  safeResolve,
+  errors,
+  warnings,
+  manifestSandboxPolicy,
+) {
   const out = [];
   const seen = new Set();
-  const push = (name, rel) => {
+  const push = (name, rel, descriptorPolicy = null) => {
     const absPath = safeResolve(rel, `bin["${name}"]`);
     if (!absPath) return;
     if (!_deps.existsSync(absPath)) {
@@ -414,8 +470,29 @@ function resolveBin(root, manifest, safeResolve, warnings) {
       return;
     }
     if (seen.has(name)) return;
+    let sandboxPolicy;
+    try {
+      sandboxPolicy = mergePluginSandboxPolicies(
+        manifestSandboxPolicy,
+        descriptorPolicy,
+      );
+    } catch (err) {
+      errors.push(`bin "${name}": ${err.message}`);
+      return;
+    }
+    if (sandboxPolicy && !/^[A-Za-z0-9._-]+$/.test(name)) {
+      errors.push(
+        `bin alias "${name}" with sandboxPolicy contains unsupported characters; use letters, numbers, dot, underscore, or hyphen`,
+      );
+      return;
+    }
     seen.add(name);
-    out.push({ name, path: rel, absPath });
+    out.push({
+      name,
+      path: rel,
+      absPath,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
+    });
   };
 
   if (
@@ -423,8 +500,35 @@ function resolveBin(root, manifest, safeResolve, warnings) {
     typeof manifest.bin === "object" &&
     !Array.isArray(manifest.bin)
   ) {
-    for (const [name, rel] of Object.entries(manifest.bin)) {
-      if (typeof rel === "string") push(name, rel);
+    for (const [name, descriptor] of Object.entries(manifest.bin)) {
+      if (typeof descriptor === "string") {
+        push(name, descriptor);
+        continue;
+      }
+      if (
+        descriptor &&
+        typeof descriptor === "object" &&
+        !Array.isArray(descriptor)
+      ) {
+        const unsupported = Object.keys(descriptor).filter(
+          (key) => !["path", "sandboxPolicy"].includes(key),
+        );
+        if (unsupported.length > 0) {
+          errors.push(
+            `bin "${name}" contains unsupported field: ${unsupported[0]}`,
+          );
+          continue;
+        }
+        if (typeof descriptor.path !== "string") {
+          errors.push(`bin "${name}".path must be a non-empty string`);
+          continue;
+        }
+        push(name, descriptor.path, descriptor.sandboxPolicy);
+        continue;
+      }
+      errors.push(
+        `bin "${name}" must be a path string or { path, sandboxPolicy } object`,
+      );
     }
     return out;
   }

package/src/lib/plugin-runtime/mcp.js

@@ -17,7 +17,11 @@
 import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
-import { componentCapabilityDenial } from "./capabilities.js";
+import {
+  componentCapabilityDenial,
+  networkTargetDenial,
+} from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -35,9 +39,8 @@ function warnMcpCapabilityDeniedOnce(entries) {
   const list = entries.map((e) => `${e.name} (${e.reason})`).join("; ");
   try {
     process.stderr.write(
-      `[plugins] refused MCP server(s) from plugin(s) that declared a permissions ` +
-        `block but did not declare the 'mcp' capability their server needs: ${list}\n` +
-        `          add 'mcp' to the plugin's permissions block to enable them.\n`,
+      `[plugins] refused MCP server(s) outside declared plugin capabilities: ${list}\n` +
+        `          declare 'mcp' and every direct URL domain in the plugin permissions block.\n`,
     );
   } catch {
     /* stderr notice is best-effort */
@@ -119,8 +122,30 @@ export function collectPluginMcpServers(opts = {}) {
     for (const [name, cfg] of Object.entries(map)) {
       if (!cfg || typeof cfg !== "object") continue;
       if (name in servers) continue; // first plugin wins on a clash
+      let sandboxPolicy;
+      try {
+        sandboxPolicy = mergePluginSandboxPolicies(
+          p.manifest.sandboxPolicy,
+          cfg.sandboxPolicy,
+        );
+      } catch {
+        // An invalid explicit requirement must never degrade to an unsandboxed
+        // process. Refuse only this server so independent entries still load.
+        continue;
+      }
+      const targetUrl = cfg.url || cfg.transport?.url || null;
+      const networkDenial = networkTargetDenial(p.manifest, targetUrl);
+      if (networkDenial) {
+        denied.push({
+          name: `${p.name}/${name}`,
+          reason: networkDenial.reason,
+        });
+        continue;
+      }
+      const { sandboxPolicy: _rawSandboxPolicy, ...serverConfig } = cfg;
       servers[name] = {
-        ...cfg,
+        ...serverConfig,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
         origin: "plugin:mcp",
         policy: "allow",
         pluginId: p.name,

package/src/lib/plugin-runtime/monitors.js

@@ -22,6 +22,7 @@ import fs from "fs";
 import { discoverPlugins } from "./scopes.js";
 import { partitionByTrust, warnUntrustedOnce } from "./trust.js";
 import { componentCapabilityDenial } from "./capabilities.js";
+import { mergePluginSandboxPolicies } from "./sandbox-policy.js";
 
 export const _deps = { readFileSync: fs.readFileSync };
 
@@ -68,6 +69,15 @@ function normalizeMonitor(plugin, raw) {
     raw.env && typeof raw.env === "object" && !Array.isArray(raw.env)
       ? raw.env
       : null;
+  let sandboxPolicy;
+  try {
+    sandboxPolicy = mergePluginSandboxPolicies(
+      plugin.manifest?.sandboxPolicy,
+      raw.sandboxPolicy,
+    );
+  } catch {
+    return null;
+  }
   return {
     plugin: plugin.name,
     scope: plugin.scope,
@@ -85,6 +95,7 @@ function normalizeMonitor(plugin, raw) {
     pluginId: plugin.name,
     pluginVersion: plugin.version,
     pluginSource: plugin.manifest?.manifestPath || null,
+    ...(sandboxPolicy ? { sandboxPolicy } : {}),
   };
 }