chainlesschain 0.162.181 → 0.162.183

package/src/lib/plugin-runtime/install.js

@@ -26,22 +26,32 @@ import {
   listInstalledVersions,
   activeVersion,
   discoverPlugins,
+  DISABLED_FILENAME,
 } from "./scopes.js";
-import { verifyPluginManifest } from "../plugin-security.js";
+import {
+  enforcePluginPolicy,
+  verifyPluginManifest,
+} from "../plugin-security.js";
 import {
   writePluginLock,
   buildPluginSbom,
   LOCK_FILENAME,
+  readPluginLock,
+  verifyInstalledSignature,
 } from "./signature.js";
+import { loadManagedPluginPolicy, filterByManagedPolicy } from "./policy.js";
+import { managedSettingsPath } from "../settings-loader.cjs";
 import executionBroker from "../process-execution-broker/index.js";
 
 export const MAX_LISTED_PLUGIN_VERSIONS = 64;
+export const SOURCE_METADATA_FILENAME = ".plugin-source.json";
 
 export const _deps = {
   existsSync: fs.existsSync,
   mkdirSync: fs.mkdirSync,
   rmSync: fs.rmSync,
   readdirSync: fs.readdirSync,
+  readFileSync: fs.readFileSync,
   copyFileSync: fs.copyFileSync,
   lstatSync: fs.lstatSync,
   writeFileSync: fs.writeFileSync,
@@ -69,6 +79,17 @@ export function installFromDirectory(srcDir, opts = {}) {
     );
   }
   const { name, version } = manifest.metadata;
+  const sourceMetadata = normalizeSourceMetadata(opts.sourceMetadata);
+  if (opts.managedPolicy) {
+    enforcePluginPolicy(
+      {
+        name,
+        source: opts.policySource || sourceMetadata?.source || null,
+        action: "install",
+      },
+      opts.managedPolicy,
+    );
+  }
 
   // Optional signature/integrity verification of the manifest at install time
   // (Phase 3.3l). verifyPluginManifest THROWS on any mismatch/failure — a signed
@@ -108,6 +129,15 @@ export function installFromDirectory(srcDir, opts = {}) {
   // unsigned install that forged lock would otherwise survive into the
   // "immutable" version dir and defeat load-time requireSignedPlugins.
   _deps.rmSync(path.join(dest, LOCK_FILENAME), { force: true });
+  _deps.rmSync(path.join(dest, SOURCE_METADATA_FILENAME), { force: true });
+
+  if (sourceMetadata) {
+    _deps.writeFileSync(
+      path.join(dest, SOURCE_METADATA_FILENAME),
+      JSON.stringify(sourceMetadata, null, 2),
+      "utf8",
+    );
+  }
 
   // Record the verified signature into the installed (immutable) version dir so
   // load-time enforcement can re-check it. The manifest was copied verbatim, so
@@ -138,6 +168,8 @@ export function installFromDirectory(srcDir, opts = {}) {
     dir: dest,
     warnings: manifest.warnings,
     signatureVerified: verification?.signatureVerified === true,
+    sourceMetadata,
+    enabled: isPluginEnabled(name, { scope, cwd: opts.cwd }),
   };
 }
 
@@ -150,8 +182,21 @@ export function installFromDirectory(srcDir, opts = {}) {
  */
 export function installFromSource(source, opts = {}) {
   return _withMaterializedSource(source, (dir, info) => {
-    const res = installFromDirectory(dir, opts);
-    return info ? { ...res, source: info.url, ref: info.ref || null } : res;
+    const sourceMetadata =
+      normalizeSourceMetadata(opts.sourceMetadata) ||
+      normalizeSourceMetadata(
+        info
+          ? { type: "git", source: info.url, ref: info.ref || null }
+          : { type: "local", source: path.resolve(String(source || "")) },
+      );
+    const res = installFromDirectory(dir, { ...opts, sourceMetadata });
+    return info
+      ? {
+          ...res,
+          source: sourceMetadata?.source || null,
+          ref: sourceMetadata?.ref || null,
+        }
+      : res;
   });
 }
 
@@ -202,6 +247,13 @@ export function updatePlugin(source, opts = {}) {
       );
     }
     const { name, version } = manifest.metadata;
+    const sourceMetadata =
+      normalizeSourceMetadata(opts.sourceMetadata) ||
+      normalizeSourceMetadata(
+        info
+          ? { type: "git", source: info.url, ref: info.ref || null }
+          : { type: "local", source: path.resolve(String(source || "")) },
+      );
     const previousVersion = getActiveVersion(name, { scope, cwd: opts.cwd });
     const dest = pluginVersionDir(scope, name, version, { cwd: opts.cwd });
     const sameVersionExists = _deps.existsSync(dest);
@@ -218,18 +270,24 @@ export function updatePlugin(source, opts = {}) {
         previousVersion,
         updated: previousVersion !== version,
         reinstalled: false,
-        source: info ? info.url : null,
+        source: sourceMetadata?.source || null,
+        ref: sourceMetadata?.ref || null,
       };
     }
 
-    const res = installFromDirectory(dir, { ...opts, scope, force: true });
+    const res = installFromDirectory(dir, {
+      ...opts,
+      scope,
+      force: true,
+      sourceMetadata,
+    });
     return {
       ...res,
       previousVersion,
       updated: previousVersion !== version,
       reinstalled: sameVersionExists,
-      source: info ? info.url : null,
-      ref: info ? info.ref || null : null,
+      source: sourceMetadata?.source || null,
+      ref: sourceMetadata?.ref || null,
     };
   });
 }
@@ -319,10 +377,26 @@ export function fetchGitRepo(url, ref) {
  * invisible and impossible to inspect / uninstall / un-deny.
  */
 export function listInstalled(opts = {}) {
+  let managed = null;
+  let managedError = null;
+  try {
+    managed = loadManagedPluginPolicy({
+      env: opts.env,
+      managedSettingsFile: opts.managedSettingsFile,
+    });
+  } catch (error) {
+    managedError = error;
+  }
+  const policySource = managedSettingsPath({
+    env: opts.env,
+    managedSettingsFile: opts.managedSettingsFile,
+  });
+
   return discoverPlugins({
     cwd: opts.cwd,
     scopes: opts.scopes,
     skipPolicy: true,
+    includeDisabled: true,
   }).map((p) => {
     const allVersions = listInstalledVersions(p.scope, p.name, {
       cwd: opts.cwd,
@@ -335,6 +409,16 @@ export function listInstalled(opts = {}) {
     ) {
       versions[versions.length - 1] = p.version;
     }
+    const lock = readPluginLock(p.root);
+    const signature = verifyInstalledSignature(p);
+    const policyResult =
+      managed && !managedError
+        ? filterByManagedPolicy([p], managed)
+        : { kept: [p], dropped: [] };
+    const policyDrop = policyResult.dropped[0] || null;
+    const sbomFiles = Array.isArray(lock?.sbom?.files)
+      ? lock.sbom.files.slice(0, 100000)
+      : [];
     return {
       name: p.name,
       version: p.version,
@@ -342,6 +426,45 @@ export function listInstalled(opts = {}) {
       scope: p.scope,
       dir: p.root,
       ok: p.manifest?.ok === true,
+      enabled: p.enabled !== false,
+      source: readSourceMetadata(p.root),
+      integrity: {
+        signature: {
+          present: Boolean(lock?.signatureBase64 && lock?.publicKeyPem),
+          verified: signature.signed === true,
+          reason: signature.signed ? null : signature.reason || "unsigned",
+          manifestSha256: lock?.sha256 || null,
+          publicKeySha256:
+            signature.publicKeySha256 || lock?.publicKeySha256 || null,
+        },
+        sbom: {
+          present: Boolean(lock?.sbom),
+          digest: lock?.sbom?.digest || null,
+          fileCount: sbomFiles.length,
+          totalBytes: Math.min(
+            Number.MAX_SAFE_INTEGER,
+            sbomFiles.reduce(
+              (sum, file) =>
+                sum +
+                (Number.isFinite(Number(file?.bytes)) && Number(file.bytes) > 0
+                  ? Number(file.bytes)
+                  : 0),
+              0,
+            ),
+          ),
+        },
+      },
+      policy: {
+        managed: Boolean(managed) || Boolean(managedError),
+        source: policySource,
+        allowed: !managedError && !policyDrop,
+        reason: managedError
+          ? managedError.message
+          : policyDrop?.reason || (managed ? "allowed by managed policy" : ""),
+        requireSigned:
+          managed?.requireSignedPlugins === true ||
+          managed?.requireSignedPlugins === "require",
+      },
     };
   });
 }
@@ -412,11 +535,107 @@ export function setActiveVersion(name, version, opts = {}) {
   return { name, version, scope, active: version };
 }
 
+/** Enable or disable one scoped plugin without deleting immutable versions. */
+export function setPluginEnabled(name, enabled, opts = {}) {
+  const scope = opts.scope || "user";
+  const cwd = opts.cwd;
+  const nameDir = pluginNameDir(scope, name, { cwd });
+  if (
+    !_deps.existsSync(nameDir) ||
+    listInstalledVersions(scope, name, { cwd }).length === 0
+  ) {
+    throw new Error(`${name} is not installed at ${scope} scope`);
+  }
+  const marker = path.join(nameDir, DISABLED_FILENAME);
+  if (enabled) {
+    _deps.rmSync(marker, { force: true });
+  } else {
+    _deps.writeFileSync(
+      marker,
+      JSON.stringify(
+        {
+          disabled: true,
+          reason: String(opts.reason || "disabled by user").slice(0, 256),
+        },
+        null,
+        2,
+      ),
+      "utf8",
+    );
+  }
+  return { name, scope, enabled: Boolean(enabled) };
+}
+
+/** Current lifecycle state for one scoped plugin. */
+export function isPluginEnabled(name, opts = {}) {
+  const scope = opts.scope || "user";
+  return !_deps.existsSync(
+    path.join(pluginNameDir(scope, name, { cwd: opts.cwd }), DISABLED_FILENAME),
+  );
+}
+
 /** Which version is active for a plugin at a scope (or null). */
 export function getActiveVersion(name, opts = {}) {
   return activeVersion(opts.scope || "user", name, { cwd: opts.cwd });
 }
 
+function readSourceMetadata(versionDir) {
+  const file = path.join(versionDir, SOURCE_METADATA_FILENAME);
+  if (!_deps.existsSync(file)) return null;
+  try {
+    return normalizeSourceMetadata(
+      JSON.parse(_deps.readFileSync(file, "utf8")),
+    );
+  } catch {
+    return null;
+  }
+}
+
+function normalizeSourceMetadata(value) {
+  if (!value || typeof value !== "object") return null;
+  const type = ["local", "git", "registry"].includes(value.type)
+    ? value.type
+    : "git";
+  const source = sanitizeSource(value.source, type === "local");
+  if (!source) return null;
+  const metadata = {
+    version: 1,
+    type,
+    source,
+    ref: cleanBounded(value.ref, 256),
+  };
+  const registry = sanitizeSource(value.registry);
+  const resolvedSource = sanitizeSource(value.resolvedSource);
+  const packageName = cleanBounded(value.package, 256);
+  if (registry) metadata.registry = registry;
+  if (resolvedSource) metadata.resolvedSource = resolvedSource;
+  if (packageName) metadata.package = packageName;
+  if (value.offline === true) metadata.offline = true;
+  return metadata;
+}
+
+function sanitizeSource(value, preservePath = false) {
+  const raw = cleanBounded(value, 4096);
+  if (!raw) return null;
+  if (preservePath) return raw;
+  try {
+    const parsed = new URL(raw);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return raw;
+  }
+}
+
+function cleanBounded(value, max) {
+  if (typeof value !== "string") return null;
+  const clean = value.replace(/\p{Cc}/gu, "").trim();
+  return clean ? clean.slice(0, max) : null;
+}
+
 // ── guarded recursive copy ────────────────────────────────────────────────
 
 /**

package/src/lib/plugin-runtime/manifest.js

@@ -199,14 +199,15 @@ export function parsePluginManifest(root) {
     warnings,
     manifestSandboxPolicy,
   );
-  c.bin = resolveBin(abs, manifest, safeResolve, warnings);
+  c.bin = resolveBin(
+    abs,
+    manifest,
+    safeResolve,
+    errors,
+    warnings,
+    manifestSandboxPolicy,
+  );
   c.settings = resolveSettings(abs, manifest, safeResolve);
-  if (manifestSandboxPolicy && c.bin.length > 0) {
-    errors.push(
-      "manifest.sandboxPolicy cannot currently protect plugin bin executables; " +
-        "top-level sandbox requirements with bin are not supported",
-    );
-  }
 
   // ── declared capabilities + options schema (P1) ──
   const hasPermissions =
@@ -451,10 +452,17 @@ function resolveLsp(
   return out;
 }
 
-function resolveBin(root, manifest, safeResolve, warnings) {
+function resolveBin(
+  root,
+  manifest,
+  safeResolve,
+  errors,
+  warnings,
+  manifestSandboxPolicy,
+) {
   const out = [];
   const seen = new Set();
-  const push = (name, rel) => {
+  const push = (name, rel, descriptorPolicy = null) => {
     const absPath = safeResolve(rel, `bin["${name}"]`);
     if (!absPath) return;
     if (!_deps.existsSync(absPath)) {
@@ -462,8 +470,29 @@ function resolveBin(root, manifest, safeResolve, warnings) {
       return;
     }
     if (seen.has(name)) return;
+    let sandboxPolicy;
+    try {
+      sandboxPolicy = mergePluginSandboxPolicies(
+        manifestSandboxPolicy,
+        descriptorPolicy,
+      );
+    } catch (err) {
+      errors.push(`bin "${name}": ${err.message}`);
+      return;
+    }
+    if (sandboxPolicy && !/^[A-Za-z0-9._-]+$/.test(name)) {
+      errors.push(
+        `bin alias "${name}" with sandboxPolicy contains unsupported characters; use letters, numbers, dot, underscore, or hyphen`,
+      );
+      return;
+    }
     seen.add(name);
-    out.push({ name, path: rel, absPath });
+    out.push({
+      name,
+      path: rel,
+      absPath,
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
+    });
   };
 
   if (
@@ -471,8 +500,35 @@ function resolveBin(root, manifest, safeResolve, warnings) {
     typeof manifest.bin === "object" &&
     !Array.isArray(manifest.bin)
   ) {
-    for (const [name, rel] of Object.entries(manifest.bin)) {
-      if (typeof rel === "string") push(name, rel);
+    for (const [name, descriptor] of Object.entries(manifest.bin)) {
+      if (typeof descriptor === "string") {
+        push(name, descriptor);
+        continue;
+      }
+      if (
+        descriptor &&
+        typeof descriptor === "object" &&
+        !Array.isArray(descriptor)
+      ) {
+        const unsupported = Object.keys(descriptor).filter(
+          (key) => !["path", "sandboxPolicy"].includes(key),
+        );
+        if (unsupported.length > 0) {
+          errors.push(
+            `bin "${name}" contains unsupported field: ${unsupported[0]}`,
+          );
+          continue;
+        }
+        if (typeof descriptor.path !== "string") {
+          errors.push(`bin "${name}".path must be a non-empty string`);
+          continue;
+        }
+        push(name, descriptor.path, descriptor.sandboxPolicy);
+        continue;
+      }
+      errors.push(
+        `bin "${name}" must be a path string or { path, sandboxPolicy } object`,
+      );
     }
     return out;
   }

package/src/lib/plugin-runtime/scopes.js

@@ -42,6 +42,7 @@ export const _deps = {
 
 // Lowest → highest precedence.
 export const SCOPES = ["user", "project", "local"];
+export const DISABLED_FILENAME = ".disabled";
 
 /** Filesystem-safe encoding of a (possibly scoped, e.g. @org/name) plugin name. */
 export function encodeName(name) {
@@ -105,6 +106,13 @@ export function activeVersion(scope, name, opts = {}) {
   return versions[0];
 }
 
+/** Whether one scoped plugin install is eligible for runtime discovery. */
+export function isPluginEnabled(scope, name, opts = {}) {
+  return !_deps.existsSync(
+    path.join(pluginNameDir(scope, name, opts), DISABLED_FILENAME),
+  );
+}
+
 /**
  * Discover every installed plugin's ACTIVE version across all scopes, applying
  * scope precedence (local > project > user) so a name installed at multiple
@@ -116,8 +124,8 @@ export function activeVersion(scope, name, opts = {}) {
  * for tooling that must see even blocked plugins (e.g. `cc plugin installed`
  * showing why something is blocked). No managed settings file → no filtering.
  *
- * @param {object} [opts] { cwd, scopes?, skipPolicy?, env?, managedSettingsFile? }
- * @returns {Array<{scope, name, version, root, manifest}>}
+ * @param {object} [opts] { cwd, scopes?, skipPolicy?, includeDisabled?, env?, managedSettingsFile? }
+ * @returns {Array<{scope, name, version, root, manifest, enabled}>}
  */
 export function discoverPlugins(opts = {}) {
   // `cc agent --bare` (CC_PLUGINS=0): the plugin runtime is fully off. Every
@@ -136,13 +144,22 @@ export function discoverPlugins(opts = {}) {
   const byName = new Map(); // name → record (later scope overrides earlier)
   for (const scope of scopes) {
     const root = scopeRoot(scope, opts);
-    if (!dirExists(root)) continue;
-    for (const encoded of listDirs(root)) {
+    if (!dirExists(root, opts.strictIo === true)) continue;
+    for (const encoded of listDirs(root, opts.strictIo === true)) {
       const nameDir = path.join(root, encoded);
-      const version = activeVersionForDir(nameDir);
+      const enabled = !_deps.existsSync(path.join(nameDir, DISABLED_FILENAME));
+      if (!enabled && opts.includeDisabled !== true) continue;
+      const version = activeVersionForDir(nameDir, opts.strictIo === true);
       if (!version) continue;
       const versionDir = path.join(nameDir, version);
       const manifest = parsePluginManifest(versionDir);
+      if (opts.strictIo === true && manifest.ok !== true) {
+        throw new Error(
+          `plugin manifest is not safely loadable at ${versionDir}: ${
+            manifest.errors?.join("; ") || "unknown manifest error"
+          }`,
+        );
+      }
       manifest.scope = scope;
       const name = manifest.metadata?.name || encoded;
       byName.set(name, {
@@ -151,6 +168,7 @@ export function discoverPlugins(opts = {}) {
         version: manifest.metadata?.version || version,
         root: versionDir,
         manifest,
+        enabled,
       });
     }
   }
@@ -188,8 +206,8 @@ export function discoverPlugins(opts = {}) {
 
 // ── internals ────────────────────────────────────────────────────────────
 
-function activeVersionForDir(nameDir) {
-  if (!dirExists(nameDir)) return null;
+function activeVersionForDir(nameDir, strictIo = false) {
+  if (!dirExists(nameDir, strictIo)) return null;
   const versions = _deps
     .readdirSync(nameDir, { withFileTypes: true })
     .filter((e) => e.isDirectory())
@@ -202,28 +220,31 @@ function activeVersionForDir(nameDir) {
     try {
       const pinned = _deps.readFileSync(activeFile, "utf8").trim();
       if (versions.includes(pinned)) return pinned;
-    } catch {
+    } catch (error) {
+      if (strictIo) throw error;
       /* fall through */
     }
   }
   return versions[0];
 }
 
-function dirExists(dir) {
+function dirExists(dir, strictIo = false) {
   try {
     return _deps.existsSync(dir) && _deps.statSync(dir).isDirectory();
-  } catch {
+  } catch (error) {
+    if (strictIo) throw error;
     return false;
   }
 }
 
-function listDirs(dir) {
+function listDirs(dir, strictIo = false) {
   try {
     return _deps
       .readdirSync(dir, { withFileTypes: true })
       .filter((e) => e.isDirectory())
       .map((e) => e.name);
-  } catch {
+  } catch (error) {
+    if (strictIo) throw error;
     return [];
   }
 }

package/src/lib/plugin-usage-attribution.js

@@ -0,0 +1,44 @@
+/**
+ * Extract a secret-free plugin identity from a tool result. Plugin bins expose
+ * an explicit `plugin_bin` record; extension-tier tools may expose a
+ * `toolAttribution.source` in the stable `plugin:<id>` / `plugin/<id>` form.
+ */
+export function extractPluginUsageAttribution(result) {
+  const pluginBin =
+    result?.plugin_bin && typeof result.plugin_bin === "object"
+      ? result.plugin_bin
+      : null;
+  if (pluginBin?.plugin) {
+    const plugin = boundedIdentity(pluginBin.plugin, 256);
+    if (!plugin) return {};
+    return {
+      plugin,
+      pluginVersion: pluginBin.version
+        ? boundedIdentity(pluginBin.version, 128) || undefined
+        : undefined,
+    };
+  }
+  const attribution =
+    result?.toolAttribution && typeof result.toolAttribution === "object"
+      ? result.toolAttribution
+      : null;
+  const source =
+    typeof attribution?.source === "string" ? attribution.source : "";
+  const match = source.match(/^plugin(?::|\/)(.+)$/i);
+  const plugin = match ? boundedIdentity(match[1], 256) : null;
+  return plugin
+    ? {
+        plugin,
+        pluginVersion: attribution.version
+          ? boundedIdentity(attribution.version, 128) || undefined
+          : undefined,
+      }
+    : {};
+}
+
+function boundedIdentity(value, max) {
+  const clean = String(value ?? "")
+    .replace(/\p{Cc}/gu, "")
+    .trim();
+  return clean ? clean.slice(0, max) : null;
+}