chainlesschain 0.162.180 → 0.162.182

package/src/lib/project-mcp-trust.js

@@ -13,12 +13,16 @@
  * Store: ~/.chainlesschain/trusted-project-mcp.json  { [absPath]: {fingerprint, trustedAt} }
  */
 
-import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { getHomeDir } from "./paths.js";
+import { withFileLock } from "./with-file-lock.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "./durable-security-store.js";
 
-export const _deps = { fs };
+export const _deps = { withFileLock };
 
 function storePath(opts = {}) {
   return (
@@ -33,13 +37,7 @@ export function projectMcpFingerprint(content) {
 }
 
 function readStore(opts) {
-  try {
-    const raw = _deps.fs.readFileSync(storePath(opts), "utf-8");
-    const data = JSON.parse(raw);
-    return data && typeof data === "object" ? data : {};
-  } catch {
-    return {};
-  }
+  return readSecurityStore(storePath(opts), "project MCP trust");
 }
 
 /**
@@ -61,23 +59,20 @@ export function checkProjectMcpTrust(file, content, opts = {}) {
 /** Record (or re-record) the trusted fingerprint for a file. */
 export function recordProjectMcpTrust(file, content, opts = {}) {
   const target = storePath(opts);
-  const store = readStore(opts);
-  store[path.resolve(file)] = {
-    fingerprint: projectMcpFingerprint(content),
-    trustedAt: new Date(
-      typeof opts.now === "number" ? opts.now : Date.now(),
-    ).toISOString(),
-  };
-  try {
-    _deps.fs.mkdirSync(path.dirname(target), { recursive: true });
-    _deps.fs.writeFileSync(target, JSON.stringify(store, null, 2), {
-      encoding: "utf-8",
-      mode: 0o600,
-    });
-    return true;
-  } catch {
-    return false; // best-effort — a failed record just re-prompts next run
-  }
+  return mutateSecurityStore(
+    target,
+    "project MCP trust",
+    (store) => {
+      store[path.resolve(file)] = {
+        fingerprint: projectMcpFingerprint(content),
+        trustedAt: new Date(
+          typeof opts.now === "number" ? opts.now : Date.now(),
+        ).toISOString(),
+      };
+      return true;
+    },
+    { lock: _deps.withFileLock },
+  );
 }
 
 /** Truthy CC_PROJECT_MCP_TRUST → the user explicitly re-trusts this run. */

package/src/lib/protocol-replay.js

@@ -15,10 +15,11 @@
  *      client must never receive a vN+1 field; a recording that violates that is
  *      a compat bug this catches deterministically, offline, in CI.
  *
- * The set of gateable wire fields ({seq, trace_id, tool_use_id}) is projected
- * from the ONE canonical [[capability-manifest.js]] via `toFieldGate()` — it can
- * NOT drift from the negotiated feature list. All non-negotiable frame fields
- * (type, content, tool name, …) always pass through untouched.
+ * The gateable wire fields are projected from the ONE canonical
+ * [[capability-manifest.js]] via `toGateableFieldGate()` — including companion
+ * fields controlled by the same logical feature. They cannot drift from the
+ * negotiated feature list. All non-negotiable frame fields (type, content,
+ * tool name, …) always pass through untouched.
  *
  * PURE + deterministic: no fs / process / clock / RNG. The `digest` lets a golden
  * recording be pinned so any change to negotiation/gating that alters wire output
@@ -30,13 +31,19 @@ import {
   negotiateProtocol,
   applyNegotiationToGate,
 } from "./capability-negotiation.js";
-import { toFieldGate } from "./capability-manifest.js";
+import { toGateableFieldGate } from "./capability-manifest.js";
 
-/** Negotiable wire field names ({seq, trace_id, tool_use_id}), single-sourced. */
+/** Negotiable wire field → primary gate field, single-sourced. */
+const GATEABLE_FIELD_GATE = Object.freeze(toGateableFieldGate());
+
+/** Every negotiable wire field name, including same-feature companions. */
 export const GATEABLE_FIELDS = Object.freeze(
-  [...new Set(Object.values(toFieldGate()))].sort(),
+  Object.keys(GATEABLE_FIELD_GATE).sort(),
 );
 
+const gateOn = (gate, field) =>
+  gate[GATEABLE_FIELD_GATE[field] || field] === true;
+
 /**
  * Run negotiation and fold it into a per-field gate the replay/audit read.
  * On an incompatible (ok:false) negotiation the gate stays empty → every gateable
@@ -50,8 +57,8 @@ export const GATEABLE_FIELDS = Object.freeze(
 export function gateFromNegotiation({ server = {}, client = null } = {}) {
   const negotiation = negotiateProtocol(server, client ?? null);
   const gate = applyNegotiationToGate(negotiation, {});
-  const enabledFields = GATEABLE_FIELDS.filter((f) => gate[f] === true);
-  const gatedFields = GATEABLE_FIELDS.filter((f) => gate[f] !== true);
+  const enabledFields = GATEABLE_FIELDS.filter((f) => gateOn(gate, f));
+  const gatedFields = GATEABLE_FIELDS.filter((f) => !gateOn(gate, f));
   return { negotiation, gate, enabledFields, gatedFields };
 }
 
@@ -61,14 +68,14 @@ export function gateFromNegotiation({ server = {}, client = null } = {}) {
  * Returns a shallow copy — the input frame is never mutated.
  *
  * @param {object} frame
- * @param {object} gate  {seq?:boolean, trace_id?:boolean, tool_use_id?:boolean}
+ * @param {object} gate  negotiated primary-field gate
  * @returns {object}
  */
 export function replayFrame(frame, gate = {}) {
   if (!frame || typeof frame !== "object") return frame;
   const out = {};
   for (const [k, v] of Object.entries(frame)) {
-    if (GATEABLE_FIELDS.includes(k) && gate[k] !== true) continue;
+    if (GATEABLE_FIELDS.includes(k) && !gateOn(gate, k)) continue;
     out[k] = v;
   }
   return out;
@@ -116,7 +123,7 @@ export function auditRecordedSession(frames, ctx = {}) {
     if (!frame || typeof frame !== "object") return;
     for (const field of GATEABLE_FIELDS) {
       if (
-        gate[field] !== true &&
+        !gateOn(gate, field) &&
         Object.prototype.hasOwnProperty.call(frame, field)
       ) {
         violations.push({

package/src/lib/repl-bang-memorize.js

@@ -21,6 +21,7 @@ import fsDefault from "fs";
 import pathDefault from "path";
 import { findProjectRoot } from "./project-instructions.js";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 export const BANG_TIMEOUT_MS = 120_000;
 export const BANG_MAX_BUFFER = 10 * 1024 * 1024;
@@ -33,6 +34,8 @@ export const MEMO_NOTE_MAX = 4_000;
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
   fs: fsDefault,
   path: pathDefault,
 };
@@ -44,6 +47,46 @@ function cap(s) {
     : str;
 }
 
+function resolveWindowsCommandShell(opts = {}) {
+  const path = opts.deps?.path || _deps.path;
+  const env = opts.env || process.env;
+  const normalizeLocalPath = (candidate) => {
+    const value =
+      typeof candidate === "string"
+        ? candidate.trim()
+        : String(candidate || "");
+    // `path.win32.isAbsolute("\\foo")` is true even though the result still
+    // depends on the process's current drive. Require a drive-qualified local
+    // path so the helper receives one deterministic executable identity.
+    if (!/^[a-z]:[\\/]/i.test(value)) return null;
+    return path.win32.normalize(value);
+  };
+
+  for (const candidate of [opts.comSpec, env.ComSpec, env.COMSPEC]) {
+    const value = normalizeLocalPath(candidate);
+    if (value && path.win32.basename(value).toLowerCase() === "cmd.exe") {
+      return value;
+    }
+  }
+
+  for (const candidate of [
+    opts.systemRoot,
+    env.SystemRoot,
+    env.SYSTEMROOT,
+    env.WINDIR,
+    "C:\\Windows",
+  ]) {
+    const value = normalizeLocalPath(candidate);
+    if (value) {
+      return path.win32.join(value, "System32", "cmd.exe");
+    }
+  }
+
+  // The literal fallback above is absolute, so this is unreachable with Node's
+  // path.win32 implementation. Keep a fail-closed guard for injected path seams.
+  throw new Error("No absolute Windows command shell is available");
+}
+
 /** True when the REPL line is a `!` bash passthrough. */
 export function isBangCommand(trimmed) {
   return (
@@ -70,24 +113,37 @@ export function isMemorizeLine(trimmed) {
  */
 export function runBangCommand(line, opts = {}) {
   const spawnSync = opts.deps?.spawnSync || _deps.spawnSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const cwd = opts.cwd || process.cwd();
   const isWin =
     opts.platform != null
       ? opts.platform === "win32"
       : process.platform === "win32";
   const cmd = String(line).replace(/^!/, "").trim();
+  // A bang command is another arbitrary workspace process surface. Collect the
+  // tighten-only Plugin bin boundary union before the shell starts so it cannot
+  // bypass a policy that run_shell already pins for the same workspace.
+  const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+  const sandboxOptions = sandboxPolicy ? { sandboxPolicy } : {};
 
   const res = isWin
-    ? spawnSync("cmd.exe", ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`], {
-        encoding: "utf-8",
-        timeout: BANG_TIMEOUT_MS,
-        maxBuffer: BANG_MAX_BUFFER,
-        cwd,
-        origin: "repl:bang-command",
-        policy: "allow",
-        scope: "repl",
-        shell: false,
-      })
+    ? spawnSync(
+        resolveWindowsCommandShell(opts),
+        ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`],
+        {
+          encoding: "utf-8",
+          timeout: BANG_TIMEOUT_MS,
+          maxBuffer: BANG_MAX_BUFFER,
+          cwd,
+          origin: "repl:bang-command",
+          policy: "allow",
+          scope: "repl",
+          shell: false,
+          ...sandboxOptions,
+        },
+      )
     : spawnSync("/bin/sh", ["-c", cmd], {
         encoding: "utf-8",
         timeout: BANG_TIMEOUT_MS,
@@ -97,6 +153,7 @@ export function runBangCommand(line, opts = {}) {
         policy: "allow",
         scope: "repl",
         shell: false,
+        ...sandboxOptions,
       });
 
   const exitCode = res.status == null ? (res.error ? -1 : 0) : res.status;

package/src/lib/settings-hooks.cjs

@@ -256,6 +256,19 @@ function collectHooks(hooksBlock, event, toolName) {
           pluginId: h.pluginId || null,
           pluginVersion: h.pluginVersion || null,
           pluginSource: h.pluginSource || null,
+          ...(h.shell != null ? { shell: h.shell } : {}),
+          ...(h.environmentAllowlist != null
+            ? { environmentAllowlist: h.environmentAllowlist }
+            : {}),
+          ...(h.envAllowlist != null
+            ? { envAllowlist: h.envAllowlist }
+            : {}),
+          ...(h.sandboxPolicy !== undefined
+            ? { sandboxPolicy: h.sandboxPolicy }
+            : {}),
+          ...(h.requiredBoundaries !== undefined
+            ? { requiredBoundaries: h.requiredBoundaries }
+            : {}),
         });
     }
   }

package/src/lib/skill-loader.js

@@ -332,6 +332,7 @@ export class CLISkillLoader {
     this._cacheStats = {
       descriptorScans: 0,
       descriptorCacheHits: 0,
+      descriptorUses: new Map(),
       bodyCacheHits: 0,
       bodyCacheMisses: 0,
       bodyLoads: new Map(),
@@ -579,10 +580,16 @@ export class CLISkillLoader {
       estimatedTokens: cached.estimatedTokens,
       loads: 0,
       cacheHits: 0,
+      contextLoads: 0,
+      contextCacheHits: 0,
       loadedBecause: [],
     };
     prior.loads += 1;
     if (cacheRead) prior.cacheHits += 1;
+    if (context.bodyIncluded === true) {
+      prior.contextLoads += 1;
+      if (cacheRead) prior.contextCacheHits += 1;
+    }
     const reason = context.loadedBecause || "explicit";
     if (!prior.loadedBecause.includes(reason)) prior.loadedBecause.push(reason);
     this._cacheStats.bodyLoads.set(skill.skillMdPath, prior);
@@ -594,12 +601,17 @@ export class CLISkillLoader {
         sourceType: "skill",
         sourceId: skill.id,
         permissionMode: context.permissionMode || "agent",
-        tokenCount: cached.estimatedTokens,
+        // Only text that actually entered a model prompt consumes context
+        // tokens. Ordinary run_skill materialization is still recorded, but
+        // as a content-size/cache observation rather than a false token charge.
+        tokenCount:
+          context.bodyIncluded === true ? cached.estimatedTokens : 0,
         metadata: {
           source: skill.source,
           loadedBecause: reason,
           cacheRead,
           bodyIncluded: context.bodyIncluded === true,
+          estimatedBodyTokens: cached.estimatedTokens,
         },
       });
     } catch {
@@ -612,6 +624,22 @@ export class CLISkillLoader {
   recordDescriptorUse(skills, context = {}) {
     for (const skill of Array.isArray(skills) ? skills : []) {
       const descriptorText = `${skill.id}\n${skill.description || ""}\n${skill.category || ""}`;
+      const estimatedTokens = estimateSkillTokens(descriptorText);
+      const prior = this._cacheStats.descriptorUses.get(skill.id) || {
+        id: skill.id,
+        source: skill.source,
+        estimatedTokens,
+        contextLoads: 0,
+        contextTokens: 0,
+        loadedBecause: [],
+      };
+      prior.contextLoads += 1;
+      prior.contextTokens += estimatedTokens;
+      const reason = context.loadedBecause || "list_skills";
+      if (!prior.loadedBecause.includes(reason)) {
+        prior.loadedBecause.push(reason);
+      }
+      this._cacheStats.descriptorUses.set(skill.id, prior);
       try {
         this._contextLedger?.recordRead?.({
           sessionId: context.sessionId || "unknown",
@@ -619,10 +647,10 @@ export class CLISkillLoader {
           sourceType: "skill_descriptor",
           sourceId: skill.id,
           permissionMode: context.permissionMode || "agent",
-          tokenCount: estimateSkillTokens(descriptorText),
+          tokenCount: estimatedTokens,
           metadata: {
             source: skill.source,
-            loadedBecause: context.loadedBecause || "list_skills",
+            loadedBecause: reason,
             bodyLoaded: skill.bodyLoaded === true,
           },
         });
@@ -635,10 +663,28 @@ export class CLISkillLoader {
   /** Content-free cache/cost snapshot for `cc context --sources`. */
   getCacheLedger() {
     const descriptors = Array.isArray(this._cache) ? this._cache : [];
-    const descriptorChars = descriptors.reduce(
-      (sum, skill) =>
-        sum +
-        `${skill.id}\n${skill.displayName}\n${skill.description}\n${skill.category}`.length,
+    const descriptorEntries = descriptors.map((skill) => {
+      const descriptorText = `${skill.id}\n${skill.displayName}\n${skill.description}\n${skill.category}`;
+      const used = this._cacheStats.descriptorUses.get(skill.id);
+      return {
+        id: skill.id,
+        source: skill.source,
+        estimatedTokens: estimateSkillTokens(descriptorText),
+        contextLoads: Number(used?.contextLoads) || 0,
+        contextTokens: Number(used?.contextTokens) || 0,
+        loadedBecause: [...(used?.loadedBecause || [])],
+      };
+    });
+    const descriptorTokens = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.estimatedTokens,
+      0,
+    );
+    const descriptorContextLoads = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.contextLoads,
+      0,
+    );
+    const descriptorContextTokens = descriptorEntries.reduce(
+      (sum, entry) => sum + entry.contextTokens,
       0,
     );
     const residentPaths = new Set(this._bodyCache.keys());
@@ -649,20 +695,46 @@ export class CLISkillLoader {
       0,
     );
     const bodyLoads = Array.from(this._cacheStats.bodyLoads.values()).map(
-      (entry) => ({ ...entry, loadedBecause: [...entry.loadedBecause] }),
+      (entry) => ({
+        ...entry,
+        cacheMisses: Math.max(0, entry.loads - entry.cacheHits),
+        contextTokens: entry.estimatedTokens * entry.contextLoads,
+        loadedBecause: [...entry.loadedBecause],
+      }),
+    );
+    const bodyTotals = bodyLoads.reduce(
+      (totals, entry) => {
+        totals.estimatedTokensResident += entry.estimatedTokens;
+        totals.estimatedTokensServed += entry.estimatedTokens * entry.loads;
+        totals.estimatedTokensAvoidedByCache +=
+          entry.estimatedTokens * entry.cacheHits;
+        totals.contextLoads += entry.contextLoads;
+        totals.contextTokens += entry.contextTokens;
+        return totals;
+      },
+      {
+        estimatedTokensResident: 0,
+        estimatedTokensServed: 0,
+        estimatedTokensAvoidedByCache: 0,
+        contextLoads: 0,
+        contextTokens: 0,
+      },
     );
     return {
       descriptors: {
         resident: descriptors.length,
         scans: this._cacheStats.descriptorScans,
         cacheHits: this._cacheStats.descriptorCacheHits,
-        rawChars: descriptorChars,
-        estimatedTokens: estimateSkillTokens(descriptorChars),
+        estimatedTokens: descriptorTokens,
+        contextLoads: descriptorContextLoads,
+        contextTokens: descriptorContextTokens,
+        entries: descriptorEntries,
       },
       bodies: {
         resident: this._bodyCache.size,
         cacheHits: this._cacheStats.bodyCacheHits,
         cacheMisses: this._cacheStats.bodyCacheMisses,
+        ...bodyTotals,
         entries: bodyLoads,
       },
       savings: {
@@ -770,6 +842,7 @@ export class CLISkillLoader {
     this._cacheStats = {
       descriptorScans: 0,
       descriptorCacheHits: 0,
+      descriptorUses: new Map(),
       bodyCacheHits: 0,
       bodyCacheMisses: 0,
       bodyLoads: new Map(),

package/src/lib/slash-commands.js

@@ -24,11 +24,14 @@ import { homedir } from "node:os";
 import { expandFileRefs } from "../runtime/file-ref-expander.js";
 import { projectRootBase } from "./project-root.cjs";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 const _deps = {
   fs: fsDefault,
   path: pathDefault,
   execSync: (...args) => executionBroker.execSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
 };
 
 /**
@@ -186,8 +189,16 @@ export function substituteArgs(text, args = []) {
   return out;
 }
 
+function isSandboxFailClosedError(error) {
+  return (
+    error?.sandboxFailClosed === true ||
+    (typeof error?.code === "string" &&
+      error.code.startsWith("ERR_PROCESS_SANDBOX"))
+  );
+}
+
 /** Run every `!`cmd`` and replace it with the command's stdout (best-effort). */
-function runBangs(text, { cwd, execSync }) {
+function runBangs(text, { cwd, execSync, sandboxPolicy }) {
   return text.replace(/!`([^`]+)`/g, (_, cmd) => {
     try {
       const out = execSync(cmd, {
@@ -199,9 +210,13 @@ function runBangs(text, { cwd, execSync }) {
         policy: "allow",
         scope: "slash-command",
         shell: true,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
       });
       return String(out).trim();
     } catch (err) {
+      // Broker boundary failures are security decisions, not ordinary command
+      // failures. Preserve the exact structured error for the caller.
+      if (isSandboxFailClosedError(err)) throw err;
       return `[command failed: ${cmd} — ${err.message?.split("\n")[0] || err}]`;
     }
   });
@@ -215,18 +230,26 @@ function runBangs(text, { cwd, execSync }) {
  *
  * @param {object} command  output of getCommand/parseCommandFile (needs .body)
  * @param {string[]} args
- * @param {object} [opts] { cwd, allowBang, deps:{ execSync } }
+ * @param {object} [opts] { cwd, allowBang,
+ *   deps:{ execSync, collectPluginBinSandboxPolicy } }
  * @returns {{ prompt:string, warnings:string[] }}
  */
 export function expandCommand(command, args = [], opts = {}) {
   const cwd = opts.cwd || process.cwd();
   const execSync = opts.deps?.execSync || _deps.execSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const warnings = [];
 
   let text = substituteArgs(command.body || "", args);
 
-  if (opts.allowBang !== false) {
-    text = runBangs(text, { cwd, execSync });
+  if (opts.allowBang !== false && /!`[^`]+`/.test(text)) {
+    // Resolve and pin once before the first bang. Every expansion in this macro
+    // receives the same immutable policy object, so no earlier command can run
+    // before a later discovery failure or observe a weaker boundary set.
+    const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+    text = runBangs(text, { cwd, execSync, sandboxPolicy });
   }
 
   // @file expansion appends a <referenced-files> block when anything resolves.

package/src/lib/sync-credentials.js

@@ -214,14 +214,15 @@ function setCredentials(providerId, creds) {
   if (!creds || typeof creds !== "object") {
     throw new Error("sync-credentials: creds must be an object");
   }
-  // Serialize the decrypt-modify-encrypt across processes so a concurrent write
-  // to a different provider doesn't drop this one (best-effort, never hangs).
+  // Credential metadata is security-critical: never decrypt-modify-encrypt
+  // without exclusion, because a lost update can silently restore/revoke the
+  // wrong provider credentials.
   return withFileLock(_vaultPath(), () => {
     const all = loadAll();
     if (!all.sync || typeof all.sync !== "object") all.sync = {};
     all.sync[providerId] = { ...creds };
     return saveAll(all);
-  });
+  }, { failIfUnavailable: true });
 }
 
 function clearCredentials(providerId) {
@@ -233,7 +234,7 @@ function clearCredentials(providerId) {
       return saveAll(all);
     }
     return true;
-  });
+  }, { failIfUnavailable: true });
 }
 
 /** Test seam: override the resolved chainlesschain dir without env leak. */

package/src/lib/turn-binding.js

@@ -555,12 +555,14 @@ export function createTurnBindingFeed({
           // New core events expose the exact decision id. Legacy/custom event
           // sources retain the deterministic compatibility derivation.
           const policy = event.result?.policy;
-          if (policy && (policy.via || policy.decision)) {
-            log.recordPermissionDecision(
-              turnId,
-              event.permission_decision_id ||
-                `${callId || "call"}:perm:${policy.via || policy.decision}`,
-            );
+          const decisionId =
+            event.permission_decision_id ||
+            event.permission_decision?.id ||
+            (policy && (policy.via || policy.decision)
+              ? `${callId || "call"}:perm:${policy.via || policy.decision}`
+              : null);
+          if (decisionId) {
+            log.recordPermissionDecision(turnId, decisionId);
             dirty = true;
           }
           if (event.result?.userEdited === true) {