chainlesschain 0.162.180 → 0.162.182

package/src/lib/plugin-runtime/plugin-options.js

@@ -20,6 +20,7 @@
 
 import fs from "fs";
 import path from "path";
+import crypto from "node:crypto";
 import { getElectronUserDataDir } from "../paths.js";
 import {
   optionDefaults,
@@ -31,12 +32,16 @@ import {
   isSecretRef,
   secretRef,
 } from "../secret-store.js";
+import { withFileLock } from "../with-file-lock.js";
 
 export const _deps = {
   existsSync: fs.existsSync,
   readFileSync: fs.readFileSync,
+  renameSync: fs.renameSync,
+  unlinkSync: fs.unlinkSync,
   writeFileSync: fs.writeFileSync,
   mkdirSync: fs.mkdirSync,
+  withFileLock,
   secretStore: () => createSecretStore(),
   userStorePath: () =>
     path.join(getElectronUserDataDir(), "plugin-options.json"),
@@ -44,23 +49,54 @@ export const _deps = {
     path.join(cwd || process.cwd(), ".chainlesschain", "plugin-options.json"),
 };
 
-function readJsonObject(p) {
+function readJsonObject(p, { failIfUnavailable = false } = {}) {
   try {
     if (!_deps.existsSync(p)) return {};
     const data = JSON.parse(_deps.readFileSync(p, "utf8"));
-    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-  } catch {
+    if (data && typeof data === "object" && !Array.isArray(data)) return data;
+    throw new TypeError("top-level value must be an object");
+  } catch (cause) {
+    if (failIfUnavailable) {
+      const error = new Error(`Plugin option store is unavailable: ${p}`, {
+        cause,
+      });
+      error.code = "PLUGIN_OPTION_STORE_UNAVAILABLE";
+      throw error;
+    }
     return {};
   }
 }
 
 function writeJsonObject(p, obj) {
   _deps.mkdirSync(path.dirname(p), { recursive: true });
-  _deps.writeFileSync(p, JSON.stringify(obj, null, 2), "utf8");
+  const tmp = `${p}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, `${JSON.stringify(obj, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    _deps.renameSync(tmp, p);
+  } catch (error) {
+    try {
+      _deps.unlinkSync(tmp);
+    } catch {
+      // Preserve the original persistence error.
+    }
+    throw error;
+  }
+}
+
+function withOptionStoreLock(p, body) {
+  _deps.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+  return _deps.withFileLock(p, body, { failIfUnavailable: true });
 }
 
 /** Load a plugin's option VALUES at the given scope (`user` | `project`). */
-export function loadPluginOptionValues(name, scope, { cwd, schema, secretStore } = {}) {
+export function loadPluginOptionValues(
+  name,
+  scope,
+  { cwd, schema, secretStore } = {},
+) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
   const store = readJsonObject(p);
@@ -71,7 +107,9 @@ export function loadPluginOptionValues(name, scope, { cwd, schema, secretStore }
   for (const [key, desc] of Object.entries(normalized)) {
     if (!desc?.sensitive || !isSecretRef(out[key])) continue;
     try {
-      const value = (secretStore || _deps.secretStore)().get(out[key].__cc_secret_ref);
+      const value = (secretStore || _deps.secretStore)().get(
+        out[key].__cc_secret_ref,
+      );
       if (value != null) out[key] = value;
       else delete out[key];
     } catch {
@@ -92,40 +130,58 @@ export function setPluginOptionValues(
 ) {
   const p =
     scope === "project" ? _deps.projectStorePath(cwd) : _deps.userStorePath();
-  const store = readJsonObject(p);
-  const input = values && typeof values === "object" ? values : {};
-  const persisted = { ...input };
-  const normalized = schema || {};
-  let secrets = null;
-  const getSecrets = () => {
-    if (!secrets) secrets = (secretStore || _deps.secretStore)();
-    return secrets;
-  };
-  const rejectedSensitive = [];
-  for (const [key, desc] of Object.entries(normalized)) {
-    if (!desc?.sensitive || !Object.prototype.hasOwnProperty.call(input, key)) continue;
-    // Project files are shareable and must never receive a sensitive value.
-    if (scope === "project") {
-      delete persisted[key];
-      rejectedSensitive.push(key);
-      continue;
+  return withOptionStoreLock(p, () => {
+    const store = readJsonObject(p, { failIfUnavailable: true });
+    const input = values && typeof values === "object" ? values : {};
+    const persisted = { ...input };
+    const normalized = schema || {};
+    let secrets = null;
+    const getSecrets = () => {
+      if (!secrets) secrets = (secretStore || _deps.secretStore)();
+      return secrets;
+    };
+    const rejectedSensitive = [];
+    for (const [key, desc] of Object.entries(normalized)) {
+      if (
+        !desc?.sensitive ||
+        !Object.prototype.hasOwnProperty.call(input, key)
+      ) {
+        continue;
+      }
+      // Project files are shareable and must never receive a sensitive value.
+      if (scope === "project") {
+        delete persisted[key];
+        rejectedSensitive.push(key);
+        continue;
+      }
+      if (input[key] == null || input[key] === "") {
+        delete persisted[key];
+        try {
+          getSecrets().delete(`${name}/${key}`);
+        } catch {
+          // Missing secrets already behave as absent on read.
+        }
+        continue;
+      }
+      getSecrets().set(`${name}/${key}`, input[key]);
+      persisted[key] = secretRef(`${name}/${key}`);
     }
-    if (input[key] == null || input[key] === "") {
-      delete persisted[key];
-      try { getSecrets().delete(`${name}/${key}`); } catch {}
-      continue;
+    if (rejectedSensitive.length > 0) {
+      persisted.__cc_rejected_sensitive = [
+        ...new Set(rejectedSensitive),
+      ].sort();
+    } else if (
+      Object.prototype.hasOwnProperty.call(
+        persisted,
+        "__cc_rejected_sensitive",
+      )
+    ) {
+      delete persisted.__cc_rejected_sensitive;
     }
-    getSecrets().set(`${name}/${key}`, input[key]);
-    persisted[key] = secretRef(`${name}/${key}`);
-  }
-  if (rejectedSensitive.length > 0) {
-    persisted.__cc_rejected_sensitive = [...new Set(rejectedSensitive)].sort();
-  } else if (Object.prototype.hasOwnProperty.call(persisted, "__cc_rejected_sensitive")) {
-    delete persisted.__cc_rejected_sensitive;
-  }
-  store[name] = persisted;
-  writeJsonObject(p, store);
-  return { name, scope, path: p };
+    store[name] = persisted;
+    writeJsonObject(p, store);
+    return { name, scope, path: p };
+  });
 }
 
 /** Provided keys of `values` (that exist in schema) accepted at `scope`. */

package/src/lib/plugin-runtime/policy.js

@@ -164,6 +164,22 @@ export function capabilityConsentRequired(managed, env) {
   );
 }
 
+/**
+ * Require every loadable plugin to opt into the capability model with an
+ * explicit `permissions` block. Mandatory consent implies this gate: otherwise
+ * a legacy plugin could bypass consent simply by omitting the declaration.
+ */
+export function capabilityDeclarationsRequired(managed, env) {
+  const runtimeEnv = env || process.env;
+  const raw = runtimeEnv.CC_REQUIRE_PLUGIN_CAPABILITIES;
+  if (raw != null && /^(1|true|yes|on)$/i.test(String(raw).trim())) return true;
+  return (
+    managed?.requirePluginCapabilityDeclarations === true ||
+    managed?.requirePluginCapabilityDeclarations === "require" ||
+    capabilityConsentRequired(managed, runtimeEnv)
+  );
+}
+
 /**
  * Drop plugins that DECLARE capabilities but whose current capability SET has
  * not been consented (first request or any widening). Fail-closed: a consent
@@ -175,12 +191,23 @@ export function capabilityConsentRequired(managed, env) {
  * @param {Array<{name, scope, manifest}>} plugins
  * @returns {{ kept: Array, dropped: Array<{name, reason}> }}
  */
-export function filterByCapabilityConsent(plugins) {
+export function filterByCapabilityConsent(
+  plugins,
+  { requireDeclarations = false } = {},
+) {
   const kept = [];
   const dropped = [];
   for (const p of plugins) {
     if (!p.manifest?.capabilitiesDeclared) {
-      kept.push(p); // legacy plugin, no declaration → not gated
+      if (requireDeclarations) {
+        dropped.push({
+          name: p.name,
+          reason:
+            "capability declaration required: add an explicit `permissions` block to plugin.json",
+        });
+      } else {
+        kept.push(p); // migration window: legacy declaration remains compatible
+      }
       continue;
     }
     let consented = false;

package/src/lib/plugin-runtime/sandbox-policy.js

@@ -0,0 +1,84 @@
+/**
+ * Normalize the small, declarative sandbox contract exposed to plugins.
+ *
+ * Plugins may require filesystem and/or network isolation for processes they
+ * cause the CLI to spawn. They may not select a sandbox profile or claim other
+ * broker guarantees. Keeping this layer narrower than ProcessExecutionBroker's
+ * internal contract prevents plugin-controlled policy from weakening managed
+ * defaults while still allowing an explicit requirement to fail closed.
+ */
+
+export const PLUGIN_SANDBOX_BOUNDARIES = Object.freeze([
+  "filesystem",
+  "network",
+]);
+
+const SUPPORTED_BOUNDARIES = new Set(PLUGIN_SANDBOX_BOUNDARIES);
+
+function invalidPolicy(message) {
+  const error = new Error(message);
+  error.code = "ERR_PLUGIN_SANDBOX_POLICY_INVALID";
+  return error;
+}
+
+/**
+ * @param {unknown} raw
+ * @param {{ label?: string }} [opts]
+ * @returns {{requiredBoundaries: string[]}|null}
+ */
+export function normalizePluginSandboxPolicy(raw, opts = {}) {
+  const label = opts.label || "sandboxPolicy";
+  if (raw === undefined || raw === null) return null;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw invalidPolicy(`${label} must be an object`);
+  }
+  const unsupportedKeys = Object.keys(raw).filter(
+    (key) => key !== "requiredBoundaries",
+  );
+  if (unsupportedKeys.length > 0) {
+    throw invalidPolicy(
+      `${label} contains unsupported field: ${unsupportedKeys[0]}`,
+    );
+  }
+
+  const boundaries = raw.requiredBoundaries;
+  if (boundaries === undefined) return null;
+  if (!Array.isArray(boundaries)) {
+    throw invalidPolicy(`${label}.requiredBoundaries must be an array`);
+  }
+
+  const requiredBoundaries = [];
+  for (const boundary of boundaries) {
+    if (
+      typeof boundary !== "string" ||
+      !SUPPORTED_BOUNDARIES.has(boundary)
+    ) {
+      throw invalidPolicy(
+        `${label}.requiredBoundaries contains unsupported boundary: ${String(boundary)}`,
+      );
+    }
+    if (!requiredBoundaries.includes(boundary)) {
+      requiredBoundaries.push(boundary);
+    }
+  }
+
+  return requiredBoundaries.length > 0 ? { requiredBoundaries } : null;
+}
+
+/**
+ * Merge manifest/component/descriptor requirements additively. A child
+ * descriptor can require more isolation, but cannot remove a manifest-level
+ * requirement.
+ */
+export function mergePluginSandboxPolicies(...policies) {
+  const requiredBoundaries = [];
+  for (const raw of policies) {
+    const policy = normalizePluginSandboxPolicy(raw);
+    for (const boundary of policy?.requiredBoundaries || []) {
+      if (!requiredBoundaries.includes(boundary)) {
+        requiredBoundaries.push(boundary);
+      }
+    }
+  }
+  return requiredBoundaries.length > 0 ? { requiredBoundaries } : null;
+}

package/src/lib/plugin-runtime/scopes.js

@@ -29,6 +29,7 @@ import {
   filterByManagedPolicy,
   filterByCapabilityConsent,
   capabilityConsentRequired,
+  capabilityDeclarationsRequired,
   warnDroppedOnce,
 } from "./policy.js";
 
@@ -135,13 +136,20 @@ export function discoverPlugins(opts = {}) {
   const byName = new Map(); // name → record (later scope overrides earlier)
   for (const scope of scopes) {
     const root = scopeRoot(scope, opts);
-    if (!dirExists(root)) continue;
-    for (const encoded of listDirs(root)) {
+    if (!dirExists(root, opts.strictIo === true)) continue;
+    for (const encoded of listDirs(root, opts.strictIo === true)) {
       const nameDir = path.join(root, encoded);
-      const version = activeVersionForDir(nameDir);
+      const version = activeVersionForDir(nameDir, opts.strictIo === true);
       if (!version) continue;
       const versionDir = path.join(nameDir, version);
       const manifest = parsePluginManifest(versionDir);
+      if (opts.strictIo === true && manifest.ok !== true) {
+        throw new Error(
+          `plugin manifest is not safely loadable at ${versionDir}: ${
+            manifest.errors?.join("; ") || "unknown manifest error"
+          }`,
+        );
+      }
       manifest.scope = scope;
       const name = manifest.metadata?.name || encoded;
       byName.set(name, {
@@ -163,9 +171,10 @@ export function discoverPlugins(opts = {}) {
     managedSettingsFile: opts.managedSettingsFile,
   });
   const consentGate = capabilityConsentRequired(managed, opts.env);
+  const declarationsGate = capabilityDeclarationsRequired(managed, opts.env);
   // Default (no managed policy AND consent enforcement off): byte-identical —
   // return every discovered plugin, exactly as before.
-  if (!managed && !consentGate) return all;
+  if (!managed && !consentGate && !declarationsGate) return all;
   let list = all;
   if (managed) {
     const { kept, dropped } = filterByManagedPolicy(list, managed);
@@ -174,8 +183,10 @@ export function discoverPlugins(opts = {}) {
   }
   // Capability-consent enforcement funnels through the SAME chokepoint, so an
   // un-consented plugin loads NONE of its six component types (opt-in).
-  if (consentGate) {
-    const { kept, dropped } = filterByCapabilityConsent(list);
+  if (consentGate || declarationsGate) {
+    const { kept, dropped } = filterByCapabilityConsent(list, {
+      requireDeclarations: declarationsGate,
+    });
     if (dropped.length > 0) warnDroppedOnce(dropped);
     list = kept;
   }
@@ -184,8 +195,8 @@ export function discoverPlugins(opts = {}) {
 
 // ── internals ────────────────────────────────────────────────────────────
 
-function activeVersionForDir(nameDir) {
-  if (!dirExists(nameDir)) return null;
+function activeVersionForDir(nameDir, strictIo = false) {
+  if (!dirExists(nameDir, strictIo)) return null;
   const versions = _deps
     .readdirSync(nameDir, { withFileTypes: true })
     .filter((e) => e.isDirectory())
@@ -198,28 +209,31 @@ function activeVersionForDir(nameDir) {
     try {
       const pinned = _deps.readFileSync(activeFile, "utf8").trim();
       if (versions.includes(pinned)) return pinned;
-    } catch {
+    } catch (error) {
+      if (strictIo) throw error;
       /* fall through */
     }
   }
   return versions[0];
 }
 
-function dirExists(dir) {
+function dirExists(dir, strictIo = false) {
   try {
     return _deps.existsSync(dir) && _deps.statSync(dir).isDirectory();
-  } catch {
+  } catch (error) {
+    if (strictIo) throw error;
     return false;
   }
 }
 
-function listDirs(dir) {
+function listDirs(dir, strictIo = false) {
   try {
     return _deps
       .readdirSync(dir, { withFileTypes: true })
       .filter((e) => e.isDirectory())
       .map((e) => e.name);
-  } catch {
+  } catch (error) {
+    if (strictIo) throw error;
     return [];
   }
 }

package/src/lib/plugin-runtime/trust.js

@@ -21,16 +21,17 @@
  * running untrusted SHELL/binaries behind the user's back.
  */
 
-import fs from "fs";
 import path from "path";
 import { getElectronUserDataDir } from "../paths.js";
+import { withFileLock } from "../with-file-lock.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "../durable-security-store.js";
 
 export const _deps = {
-  existsSync: fs.existsSync,
-  readFileSync: fs.readFileSync,
-  writeFileSync: fs.writeFileSync,
-  mkdirSync: fs.mkdirSync,
   now: () => new Date().toISOString(),
+  withFileLock,
   // Path of the trust store; injectable so unit tests never touch the real
   // user-data dir.
   storePath: () => path.join(getElectronUserDataDir(), "plugin-trust.json"),
@@ -39,20 +40,7 @@ export const _deps = {
 const AUTO_TRUSTED_SCOPES = new Set(["user", "local"]);
 
 export function loadTrustStore() {
-  try {
-    const p = _deps.storePath();
-    if (!_deps.existsSync(p)) return {};
-    const data = JSON.parse(_deps.readFileSync(p, "utf8"));
-    return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-  } catch {
-    return {};
-  }
-}
-
-function saveTrustStore(store) {
-  const p = _deps.storePath();
-  _deps.mkdirSync(path.dirname(p), { recursive: true });
-  _deps.writeFileSync(p, JSON.stringify(store, null, 2), "utf8");
+  return readSecurityStore(_deps.storePath(), "plugin trust");
 }
 
 function trustKey(scope, name) {
@@ -66,27 +54,44 @@ function trustKey(scope, name) {
 export function isPluginTrusted(plugin) {
   if (!plugin || !plugin.name) return false;
   if (AUTO_TRUSTED_SCOPES.has(plugin.scope)) return true;
-  const entry = loadTrustStore()[trustKey(plugin.scope, plugin.name)];
-  return Boolean(entry && entry.version === plugin.version);
+  try {
+    const entry = loadTrustStore()[trustKey(plugin.scope, plugin.name)];
+    return Boolean(entry && entry.version === plugin.version);
+  } catch {
+    // Project code must stay disabled when the trust store is unavailable.
+    return false;
+  }
 }
 
 /** Trust a plugin (records the exact version). */
 export function trustPlugin(name, { scope = "project", version } = {}) {
   if (!version) throw new Error("trustPlugin requires a version");
-  const store = loadTrustStore();
-  store[trustKey(scope, name)] = { version, trustedAt: _deps.now() };
-  saveTrustStore(store);
-  return { name, scope, version };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin trust",
+    (store) => {
+      store[trustKey(scope, name)] = { version, trustedAt: _deps.now() };
+      return { name, scope, version };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** Revoke trust for a plugin at a scope. */
 export function untrustPlugin(name, { scope = "project" } = {}) {
-  const store = loadTrustStore();
-  const key = trustKey(scope, name);
-  const existed = Object.prototype.hasOwnProperty.call(store, key);
-  delete store[key];
-  saveTrustStore(store);
-  return { name, scope, removed: existed };
+  const file = _deps.storePath();
+  return mutateSecurityStore(
+    file,
+    "plugin trust",
+    (store) => {
+      const key = trustKey(scope, name);
+      const existed = Object.prototype.hasOwnProperty.call(store, key);
+      delete store[key];
+      return { name, scope, removed: existed };
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** All trust entries (for `cc plugin trust --list`). */