chainlesschain 0.162.181 → 0.162.182

package/src/lib/repl-bang-memorize.js

@@ -21,6 +21,7 @@ import fsDefault from "fs";
 import pathDefault from "path";
 import { findProjectRoot } from "./project-instructions.js";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 export const BANG_TIMEOUT_MS = 120_000;
 export const BANG_MAX_BUFFER = 10 * 1024 * 1024;
@@ -33,6 +34,8 @@ export const MEMO_NOTE_MAX = 4_000;
 
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
   fs: fsDefault,
   path: pathDefault,
 };
@@ -44,6 +47,46 @@ function cap(s) {
     : str;
 }
 
+function resolveWindowsCommandShell(opts = {}) {
+  const path = opts.deps?.path || _deps.path;
+  const env = opts.env || process.env;
+  const normalizeLocalPath = (candidate) => {
+    const value =
+      typeof candidate === "string"
+        ? candidate.trim()
+        : String(candidate || "");
+    // `path.win32.isAbsolute("\\foo")` is true even though the result still
+    // depends on the process's current drive. Require a drive-qualified local
+    // path so the helper receives one deterministic executable identity.
+    if (!/^[a-z]:[\\/]/i.test(value)) return null;
+    return path.win32.normalize(value);
+  };
+
+  for (const candidate of [opts.comSpec, env.ComSpec, env.COMSPEC]) {
+    const value = normalizeLocalPath(candidate);
+    if (value && path.win32.basename(value).toLowerCase() === "cmd.exe") {
+      return value;
+    }
+  }
+
+  for (const candidate of [
+    opts.systemRoot,
+    env.SystemRoot,
+    env.SYSTEMROOT,
+    env.WINDIR,
+    "C:\\Windows",
+  ]) {
+    const value = normalizeLocalPath(candidate);
+    if (value) {
+      return path.win32.join(value, "System32", "cmd.exe");
+    }
+  }
+
+  // The literal fallback above is absolute, so this is unreachable with Node's
+  // path.win32 implementation. Keep a fail-closed guard for injected path seams.
+  throw new Error("No absolute Windows command shell is available");
+}
+
 /** True when the REPL line is a `!` bash passthrough. */
 export function isBangCommand(trimmed) {
   return (
@@ -70,24 +113,37 @@ export function isMemorizeLine(trimmed) {
  */
 export function runBangCommand(line, opts = {}) {
   const spawnSync = opts.deps?.spawnSync || _deps.spawnSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const cwd = opts.cwd || process.cwd();
   const isWin =
     opts.platform != null
       ? opts.platform === "win32"
       : process.platform === "win32";
   const cmd = String(line).replace(/^!/, "").trim();
+  // A bang command is another arbitrary workspace process surface. Collect the
+  // tighten-only Plugin bin boundary union before the shell starts so it cannot
+  // bypass a policy that run_shell already pins for the same workspace.
+  const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+  const sandboxOptions = sandboxPolicy ? { sandboxPolicy } : {};
 
   const res = isWin
-    ? spawnSync("cmd.exe", ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`], {
-        encoding: "utf-8",
-        timeout: BANG_TIMEOUT_MS,
-        maxBuffer: BANG_MAX_BUFFER,
-        cwd,
-        origin: "repl:bang-command",
-        policy: "allow",
-        scope: "repl",
-        shell: false,
-      })
+    ? spawnSync(
+        resolveWindowsCommandShell(opts),
+        ["/d", "/s", "/c", `chcp 65001 >nul && ${cmd}`],
+        {
+          encoding: "utf-8",
+          timeout: BANG_TIMEOUT_MS,
+          maxBuffer: BANG_MAX_BUFFER,
+          cwd,
+          origin: "repl:bang-command",
+          policy: "allow",
+          scope: "repl",
+          shell: false,
+          ...sandboxOptions,
+        },
+      )
     : spawnSync("/bin/sh", ["-c", cmd], {
         encoding: "utf-8",
         timeout: BANG_TIMEOUT_MS,
@@ -97,6 +153,7 @@ export function runBangCommand(line, opts = {}) {
         policy: "allow",
         scope: "repl",
         shell: false,
+        ...sandboxOptions,
       });
 
   const exitCode = res.status == null ? (res.error ? -1 : 0) : res.status;

package/src/lib/slash-commands.js

@@ -24,11 +24,14 @@ import { homedir } from "node:os";
 import { expandFileRefs } from "../runtime/file-ref-expander.js";
 import { projectRootBase } from "./project-root.cjs";
 import executionBroker from "./process-execution-broker/index.js";
+import { collectPluginBinSandboxPolicy as collectDefaultPluginBinSandboxPolicy } from "./plugin-runtime/bin.js";
 
 const _deps = {
   fs: fsDefault,
   path: pathDefault,
   execSync: (...args) => executionBroker.execSync(...args),
+  collectPluginBinSandboxPolicy: (opts) =>
+    collectDefaultPluginBinSandboxPolicy(opts),
 };
 
 /**
@@ -186,8 +189,16 @@ export function substituteArgs(text, args = []) {
   return out;
 }
 
+function isSandboxFailClosedError(error) {
+  return (
+    error?.sandboxFailClosed === true ||
+    (typeof error?.code === "string" &&
+      error.code.startsWith("ERR_PROCESS_SANDBOX"))
+  );
+}
+
 /** Run every `!`cmd`` and replace it with the command's stdout (best-effort). */
-function runBangs(text, { cwd, execSync }) {
+function runBangs(text, { cwd, execSync, sandboxPolicy }) {
   return text.replace(/!`([^`]+)`/g, (_, cmd) => {
     try {
       const out = execSync(cmd, {
@@ -199,9 +210,13 @@ function runBangs(text, { cwd, execSync }) {
         policy: "allow",
         scope: "slash-command",
         shell: true,
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
       });
       return String(out).trim();
     } catch (err) {
+      // Broker boundary failures are security decisions, not ordinary command
+      // failures. Preserve the exact structured error for the caller.
+      if (isSandboxFailClosedError(err)) throw err;
       return `[command failed: ${cmd} — ${err.message?.split("\n")[0] || err}]`;
     }
   });
@@ -215,18 +230,26 @@ function runBangs(text, { cwd, execSync }) {
  *
  * @param {object} command  output of getCommand/parseCommandFile (needs .body)
  * @param {string[]} args
- * @param {object} [opts] { cwd, allowBang, deps:{ execSync } }
+ * @param {object} [opts] { cwd, allowBang,
+ *   deps:{ execSync, collectPluginBinSandboxPolicy } }
  * @returns {{ prompt:string, warnings:string[] }}
  */
 export function expandCommand(command, args = [], opts = {}) {
   const cwd = opts.cwd || process.cwd();
   const execSync = opts.deps?.execSync || _deps.execSync;
+  const collectPluginBinSandboxPolicy =
+    opts.deps?.collectPluginBinSandboxPolicy ||
+    _deps.collectPluginBinSandboxPolicy;
   const warnings = [];
 
   let text = substituteArgs(command.body || "", args);
 
-  if (opts.allowBang !== false) {
-    text = runBangs(text, { cwd, execSync });
+  if (opts.allowBang !== false && /!`[^`]+`/.test(text)) {
+    // Resolve and pin once before the first bang. Every expansion in this macro
+    // receives the same immutable policy object, so no earlier command can run
+    // before a later discovery failure or observe a weaker boundary set.
+    const sandboxPolicy = collectPluginBinSandboxPolicy({ cwd });
+    text = runBangs(text, { cwd, execSync, sandboxPolicy });
   }
 
   // @file expansion appends a <referenced-files> block when anything resolves.

package/src/repl/agent-repl.js

@@ -915,8 +915,9 @@ export async function startAgentRepl(options = {}) {
     _pluginMonitors = null;
   }
 
-  // Put trusted plugins' bin/ executables on PATH for the session (Phase 3.3n),
-  // restored at SessionEnd. Trust-gated inside collectPluginBinDirs.
+  // Preserve PATH compatibility for trusted legacy bin components without a
+  // sandboxPolicy, restored at SessionEnd. Policy-bearing bins stay off PATH
+  // and use agent-core's exact direct Broker route.
   try {
     const { applyPluginBinPath } = await import("../lib/plugin-runtime/bin.js");
     const res = applyPluginBinPath({ cwd: process.cwd() });
@@ -3876,7 +3877,7 @@ export async function startAgentRepl(options = {}) {
           /* monitor restart is best-effort */
         }
 
-        // Re-apply plugin bin PATH (a newly-trusted plugin's executables).
+        // Re-apply legacy plugin bin PATH; strict bins remain direct-only.
         try {
           const { applyPluginBinPath } =
             await import("../lib/plugin-runtime/bin.js");