chainlesschain 0.162.181 → 0.162.183

package/src/harness/background-task-manager.js

@@ -9,7 +9,7 @@
  */
 
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { getHomeDir } from "../lib/paths.js";
@@ -42,9 +42,55 @@ const RECOVERABLE_TASK_STATUSES = new Set([
   TaskStatus.RUNNING,
 ]);
 
+function validatePinnedSandboxPolicy(policy) {
+  if (policy == null) return null;
+  if (
+    typeof policy !== "object" ||
+    Array.isArray(policy) ||
+    typeof policy.then === "function" ||
+    !Array.isArray(policy.requiredBoundaries) ||
+    policy.requiredBoundaries.length === 0 ||
+    policy.requiredBoundaries.some(
+      (boundary) => typeof boundary !== "string" || boundary.length === 0,
+    ) ||
+    !Object.isFrozen(policy) ||
+    !Object.isFrozen(policy.requiredBoundaries)
+  ) {
+    const error = new TypeError("invalid_background_task_sandbox_policy");
+    error.code = "ERR_BACKGROUND_TASK_SANDBOX_POLICY_INVALID";
+    error.sandboxReason = "invalid_background_task_sandbox_policy";
+    error.sandboxFailClosed = true;
+    throw error;
+  }
+  return policy;
+}
+
+function createUnsupportedSandboxError(sandboxPolicy) {
+  const requiredBoundaries = [...sandboxPolicy.requiredBoundaries];
+  const error = new Error(
+    `Background tasks cannot run without their required sandbox boundaries: ${requiredBoundaries.join(", ")}`,
+  );
+  error.code = "ERR_BACKGROUND_TASK_SANDBOX_UNSUPPORTED";
+  error.sandboxReason = "background_execution_unsupported";
+  error.sandboxFailClosed = true;
+  error.requiredBoundaries = requiredBoundaries;
+  error.actualGuarantees = [];
+  error.missingBoundaries = [...requiredBoundaries];
+  error.sandboxBackend = null;
+  error.sandboxCandidateBackend = null;
+  return error;
+}
+
 export class BackgroundTaskManager extends EventEmitter {
   constructor(options = {}) {
     super();
+    const resolveSandboxPolicy = options.resolveSandboxPolicy ?? null;
+    if (
+      resolveSandboxPolicy !== null &&
+      typeof resolveSandboxPolicy !== "function"
+    ) {
+      throw new TypeError("resolveSandboxPolicy must be a function or null");
+    }
     this.maxConcurrent = options.maxConcurrent || 3;
     this.heartbeatTimeout = options.heartbeatTimeout || 60000;
     this.historyLimit = options.historyLimit || 50;
@@ -54,6 +100,10 @@ export class BackgroundTaskManager extends EventEmitter {
       `${process.pid}@${process.platform}`;
     this.recoveryPolicy = options.recoveryPolicy || "claim-stale";
     this.staleNodeTimeout = options.staleNodeTimeout || 5 * 60 * 1000;
+    this._policyCwd = resolveSandboxPolicy
+      ? resolve(options.policyCwd || process.cwd())
+      : null;
+    this._resolveSandboxPolicy = resolveSandboxPolicy;
     this.tasks = new Map();
     this.processes = new Map();
     this._checkInterval = null;
@@ -72,12 +122,15 @@ export class BackgroundTaskManager extends EventEmitter {
       );
     }
 
+    const cwd = spec.cwd || process.cwd();
+    this._assertSandboxSupported(cwd);
+
     const id = `task-${Date.now()}-${createHash("sha256").update(Math.random().toString()).digest("hex").slice(0, 6)}`;
     const task = {
       id,
       type: spec.type || "shell",
       command: spec.command,
-      cwd: spec.cwd || process.cwd(),
+      cwd,
       description: spec.description || spec.command,
       status: TaskStatus.PENDING,
       createdAt: Date.now(),
@@ -111,6 +164,8 @@ export class BackgroundTaskManager extends EventEmitter {
       throw new Error(`Task ${taskId} is not pending (status: ${task.status})`);
     }
 
+    this._assertSandboxSupported(task.cwd);
+
     task.status = TaskStatus.RUNNING;
     task.startedAt = Date.now();
     task.lastHeartbeat = Date.now();
@@ -185,6 +240,19 @@ export class BackgroundTaskManager extends EventEmitter {
     return task;
   }
 
+  _assertSandboxSupported(executionCwd) {
+    if (!this._resolveSandboxPolicy) return;
+    const sandboxPolicy = validatePinnedSandboxPolicy(
+      this._resolveSandboxPolicy({
+        workspaceCwd: this._policyCwd,
+        executionCwd,
+      }),
+    );
+    if (sandboxPolicy) {
+      throw createUnsupportedSandboxError(sandboxPolicy);
+    }
+  }
+
   get(taskId) {
     return this.tasks.get(taskId) || null;
   }

package/src/harness/jsonl-session-store.js

@@ -164,20 +164,22 @@ export function appendToolCall(sessionId, toolName, args) {
 
 /**
  * Compact tool-call record for usage attribution (用量归因): tool name +
- * error flag (+ an optional skill hint for `run_skill`) — deliberately NOT
+ * error flag (+ optional skill and plugin/version hints) — deliberately NOT
  * the args, which can carry whole file bodies (write_file content) and would
  * bloat the transcript. Written at tool-result time by the agent drivers so
- * `cc session usage --by tool|mcp` and `cc insights` can aggregate tool use
- * for any persisted session.
+ * `cc session usage --by tool|mcp|plugin` and `cc insights` can aggregate tool
+ * use for any persisted session.
  */
 export function appendToolCallCompact(
   sessionId,
-  { tool, isError, skill } = {},
+  { tool, isError, skill, plugin, pluginVersion } = {},
 ) {
   appendEvent(sessionId, "tool_call", {
     tool: tool || "?",
     is_error: Boolean(isError),
     ...(skill ? { skill: String(skill) } : {}),
+    ...(plugin ? { plugin: String(plugin) } : {}),
+    ...(pluginVersion ? { plugin_version: String(pluginVersion) } : {}),
   });
 }
 

package/src/harness/worktree-isolator.js

@@ -456,7 +456,11 @@ export function previewWorktreeMerge(repoDir, branchName, options = {}) {
 
   let mergeStarted = false;
   try {
-    gitExec(`merge ${baseBranch} --no-commit --no-ff`, worktree.path);
+    // Use argv form here rather than routing through a shell. Besides avoiding
+    // another quoting surface, this is important on Windows where a conflicted
+    // `git merge` followed immediately by another shell-wrapped git process can
+    // race the hosted runner's process/job cleanup and hide the unmerged index.
+    gitExecArgs(["merge", baseBranch, "--no-commit", "--no-ff"], worktree.path);
     mergeStarted = true;
 
     return {
@@ -713,7 +717,14 @@ function _hasBranchCommits(repoDir, branchName) {
 
 function _collectConflictFiles(repoDir) {
   try {
-    const output = gitExec("diff --name-only --diff-filter=U", repoDir);
+    // A conflict is expected to make the preceding merge exit non-zero. Query
+    // the index with a direct git argv invocation so Windows shell/process
+    // teardown cannot turn the authoritative conflict probe into an empty
+    // best-effort result.
+    const output = gitExecArgs(
+      ["diff", "--name-only", "--diff-filter=U"],
+      repoDir,
+    );
     return output
       .split("\n")
       .map((line) => line.trim())
@@ -988,7 +999,7 @@ function _resolveAutomationCandidate(type, filePath, branchName, candidateId) {
 
 function _abortMergeIfPresent(repoDir) {
   try {
-    gitExec("merge --abort", repoDir);
+    gitExecArgs(["merge", "--abort"], repoDir);
   } catch (_e) {
     // Ignore if there is no in-progress merge.
   }

package/src/lib/agent-core.js

@@ -12,6 +12,7 @@ export {
   getAgentToolDefinitions,
   getAgentToolDescriptors,
   getCachedPython,
+  _resetCachedPythonForTests,
   getEnvironmentInfo,
   _environmentProcessDeps,
   _agentToolProcessDeps,

package/src/lib/agent-schedule-store.js

@@ -48,6 +48,14 @@ function normalizeJitterMs(v) {
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 
+function normalizeMonitorWorkspaceCwd(value) {
+  if (value == null) return null;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("monitor workspaceCwd must be a non-empty string");
+  }
+  return path.resolve(value);
+}
+
 /**
  * A per-task execution policy for wakeup/cron entries — how the spawned
  * `cc agent` run should behave when this entry fires. Each field maps to a real
@@ -388,6 +396,7 @@ export class AgentScheduleStore {
 
   createMonitor({
     command,
+    workspaceCwd = null,
     watchFile = null,
     watchUrl = null,
     watchChange = false,
@@ -443,16 +452,22 @@ export class AgentScheduleStore {
     if (stopWhen != null) {
       // Validate the regex up-front so a bad pattern errors at creation, not
       // silently at the first check.
-      // eslint-disable-next-line no-new
+
       new RegExp(stopWhen);
     }
     const now = this._now();
     const source = hasFile ? "file" : hasUrl ? "http" : "command";
+    const normalizedWorkspaceCwd = hasCommand
+      ? normalizeMonitorWorkspaceCwd(workspaceCwd)
+      : null;
     const entry = {
       id: randomUUID(),
       kind: "monitor",
       source,
       command: hasCommand ? command : null,
+      ...(normalizedWorkspaceCwd
+        ? { workspaceCwd: normalizedWorkspaceCwd }
+        : {}),
       watchFile: hasFile ? watchFile : null,
       watchUrl: hasUrl ? watchUrl : null,
       watchChange: hasFile ? Boolean(watchChange) : false,
@@ -513,28 +528,36 @@ export class AgentScheduleStore {
     const now = atMs != null ? Number(atMs) : this._now();
     const ttl = Math.max(1000, Number(leaseMs) || 120000);
     this._ensureDir();
-    return withFileLock(path.join(this.dir, ".agenda-claims"), () => {
-      const claimed = [];
-      for (const kind of SCHEDULE_KINDS) {
-        const entries = this._readAll(kind);
-        let changed = false;
-        for (const entry of entries) {
-          if (!isSchedulableStatus(entry) || isEntryExpired(entry, now)) continue;
-          if (hasLiveExecutionLease(entry, now)) continue;
-          const fireAt = effectiveFireAt(entry);
-          if (fireAt == null || fireAt > now) continue;
-          entry.executionLease = {
-            owner: `${process.pid}:${randomUUID()}`,
-            claimedAt: now,
-            expiresAt: now + ttl,
-          };
-          claimed.push({ ...entry, executionLease: { ...entry.executionLease } });
-          changed = true;
+    return withFileLock(
+      path.join(this.dir, ".agenda-claims"),
+      () => {
+        const claimed = [];
+        for (const kind of SCHEDULE_KINDS) {
+          const entries = this._readAll(kind);
+          let changed = false;
+          for (const entry of entries) {
+            if (!isSchedulableStatus(entry) || isEntryExpired(entry, now))
+              continue;
+            if (hasLiveExecutionLease(entry, now)) continue;
+            const fireAt = effectiveFireAt(entry);
+            if (fireAt == null || fireAt > now) continue;
+            entry.executionLease = {
+              owner: `${process.pid}:${randomUUID()}`,
+              claimedAt: now,
+              expiresAt: now + ttl,
+            };
+            claimed.push({
+              ...entry,
+              executionLease: { ...entry.executionLease },
+            });
+            changed = true;
+          }
+          if (changed) this._writeAll(kind, entries);
         }
-        if (changed) this._writeAll(kind, entries);
-      }
-      return claimed;
-    }, { failIfUnavailable: true });
+        return claimed;
+      },
+      { failIfUnavailable: true },
+    );
   }
 
   /** Release a failed/aborted claim so a later runner can retry it. */

package/src/lib/agent-team/team-runner.js

@@ -51,6 +51,10 @@ export class TeamRunner {
     this._executions = 0;
     this._inFlight = 0;
     this._maxInFlight = 0;
+    // Keys executing in this runner process. An event-loop stall may let a
+    // short lease expire before its heartbeat callback runs; peer loops in the
+    // same process must not steal and double-run that still-active task.
+    this._activeKeys = new Set();
     this._members = new Map(); // holder → lifecycle record
     this._budgetStopped = false;
   }
@@ -208,6 +212,7 @@ export class TeamRunner {
     let best = null;
     let bestScore = Infinity;
     for (const key of claimable) {
+      if (this._activeKeys.has(key)) continue;
       const t = this.registry.getTask(key);
       const score = rank[t?.priority] ?? 1;
       if (score < bestScore) {
@@ -222,10 +227,22 @@ export class TeamRunner {
     const task = this.registry.getTask(key);
     this._executions++;
     this._inFlight++;
+    this._activeKeys.add(key);
     this._maxInFlight = Math.max(this._maxInFlight, this._inFlight);
     this._setState(holder, "running", { key });
     this._emit("task:claimed", { key, holder, attempts: task.attempts });
-    const renew = () => this.registry.renew(key, { holder, ttlMs: this.ttlMs });
+    const renew = () => {
+      const result = this.registry.renew(key, {
+        holder,
+        ttlMs: this.ttlMs,
+      });
+      // A delayed timer may wake just after expiry. Reacquire is safe and
+      // optimistic: it succeeds only if no external runner has taken the
+      // lease; a real takeover remains authoritative and stops the heartbeat.
+      return !result?.ok && result?.reason === "not_holder_or_expired"
+        ? this.registry.acquire(key, { holder, ttlMs: this.ttlMs })
+        : result;
+    };
     // Heartbeat: the built-in executors (shell / agent / worktree) never call
     // `renew` themselves, so before this ANY task outliving the lease TTL was
     // indistinguishable from a crash — a peer could steal it and the SAME task
@@ -338,6 +355,7 @@ export class TeamRunner {
       });
     } finally {
       clearInterval(heartbeat);
+      this._activeKeys.delete(key);
       this._inFlight--;
     }
   }

package/src/lib/background-agent-supervisor.js

@@ -762,6 +762,47 @@ export function normalizeBackgroundWorktree(worktree, cwd) {
   return normalized;
 }
 
+/**
+ * Persist only the bounded, secret-free governance envelope needed by IDE task
+ * rows. The supervisor owns `owner`; callers cannot forge it. Prompt text,
+ * argv, credentials and tool arguments are deliberately excluded.
+ */
+export function normalizeBackgroundGovernance(
+  governance,
+  { id, sessionId } = {},
+) {
+  const source = governance && typeof governance === "object" ? governance : {};
+  const budget =
+    source.resourceBudget && typeof source.resourceBudget === "object"
+      ? source.resourceBudget
+      : {};
+  const positive = (value) => {
+    const n = Number(value);
+    return Number.isFinite(n) && n > 0 ? n : null;
+  };
+  const permissionMode = new Set([
+    "manual",
+    "auto",
+    "dontAsk",
+    "default",
+    "plan",
+    "acceptEdits",
+    "bypassPermissions",
+  ]).has(source.permissionMode)
+    ? source.permissionMode
+    : "default";
+  return {
+    version: 1,
+    owner: `background:${String(id || "").slice(0, 160)}`,
+    sessionId: sessionId ? String(sessionId).slice(0, 256) : null,
+    permissionMode,
+    resourceBudget: {
+      maxTurns: positive(budget.maxTurns),
+      maxCostUsd: positive(budget.maxCostUsd),
+    },
+  };
+}
+
 function persistedWorktree(state) {
   if (!state?.worktreePath) return null;
   return {
@@ -817,6 +858,7 @@ export function resumeBackgroundAgent(id, prompt, options = {}) {
     cliEntry: options.cliEntry,
     followUpArgv: ["agent", "--session", state.sessionId],
     worktree,
+    governance: state.governance,
   });
 }
 
@@ -855,10 +897,15 @@ export function launchBackgroundAgent({
   cliEntry,
   followUpArgv,
   worktree,
+  governance,
 }) {
   assertUsableCwd(cwd);
   const worktreeState = normalizeBackgroundWorktree(worktree, cwd);
   const id = createBackgroundAgentId();
+  const governanceState = normalizeBackgroundGovernance(governance, {
+    id,
+    sessionId,
+  });
   const dir = backgroundAgentsDir();
   const jobFile = join(dir, `${id}.job.${process.pid}.json`);
   const worker = fileURLToPath(
@@ -873,6 +920,7 @@ export function launchBackgroundAgent({
     cliEntry: cliEntry || process.argv[1],
     logFile: logPath(id),
     ...(worktreeState || {}),
+    governance: governanceState,
     // Present = interactive attach can start follow-up turns; absent = the
     // transport rejects prompts (log-only session).
     ...(Array.isArray(followUpArgv) ? { followUpArgv } : {}),
@@ -897,6 +945,7 @@ export function launchBackgroundAgent({
     exitCode: null,
     logFile: job.logFile,
     ...(worktreeState || {}),
+    governance: governanceState,
   };
   writeBackgroundAgentState(state);
   let child;

package/src/lib/hook-runner.js

@@ -35,8 +35,12 @@ function runHookProcessSync(file, argsOrOptions, maybeOptions) {
   });
 }
 
-runner._deps.run = runHookProcess;
-runner._deps.runSync = runHookProcessSync;
+export function _restoreProcessRunners() {
+  runner._deps.run = runHookProcess;
+  runner._deps.runSync = runHookProcessSync;
+}
+
+_restoreProcessRunners();
 
 export const {
   runCommandHook,

package/src/lib/packer/pkg-config-generator.js

@@ -385,7 +385,9 @@ export function generatePkgConfig(ctx) {
   const assets = [
     `${posixify(distDir)}/**/*`,
     `${posixify(templatesDir)}/**/*`,
-    `${posixify(cliRoot)}/src/lib/process-execution-broker/*.ps1`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.dll`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox-helper.exe`,
+    `${posixify(cliRoot)}/src/lib/process-execution-broker/windows-sandbox.cs`,
   ];
   if (prebuildsDir) assets.push(`${posixify(prebuildsDir)}/**/*`);
   // Project mode: bundle the collected .chainlesschain/ snapshot as an asset.